@andreprado/agentkit 0.1.0-alpha.17 → 0.1.0-alpha.19

package/src/runtime/targets/cloudflare/build.ts

@@ -320,8 +320,8 @@ async function listSourceFiles(root: string): Promise<string[]> {
 function findImportSpecifiers(source: string): string[] {
   const specifiers: string[] = [];
   const patterns = [
-    /\bimport\s+(?:type\s+)?(?:[^"'()]*?\s+from\s+)?["']([^"']+)["']/g,
-    /\bexport\s+[^"'()]*?\s+from\s+["']([^"']+)["']/g,
+    /\bimport\s+(?!type\b)(?:[^"'()]*?\s+from\s+)?["']([^"']+)["']/g,
+    /\bexport\s+(?!type\b)[^"'()]*?\s+from\s+["']([^"']+)["']/g,
     /\brequire\(\s*["']([^"']+)["']\s*\)/g,
     /\bimport\(\s*["']([^"']+)["']\s*\)/g,
   ];
@@ -390,6 +390,8 @@ export function composioManaged(input) {
   const toolkits = normalizeToolkitList(input.toolkits, "composioManaged.toolkits");
   const tools = input.tools ? normalizeComposioToolMap(input.tools, toolkits) : undefined;
   const tags = input.tags ? normalizeIntegrationTags(input.tags) : undefined;
+  const confirmExternalWrites =
+    input.confirmExternalWrites === undefined ? undefined : Boolean(input.confirmExternalWrites);
 
   return {
     type: "composio",
@@ -399,6 +401,7 @@ export function composioManaged(input) {
     toolkits,
     ...(tools ? { tools } : {}),
     ...(tags ? { tags } : {}),
+    ...(confirmExternalWrites === undefined ? {} : { confirmExternalWrites }),
   };
 }
 
@@ -437,6 +440,17 @@ export function whatsappChannel(input) {
   };
 }
 
+export function discordChannel(input) {
+  return {
+    type: "discord",
+    provider: "discord",
+    name: input.name,
+    secrets: normalizeChannelSecrets(input.secrets ?? ["DISCORD_PUBLIC_KEY"], "discord channel"),
+    ...(input.limits ? { limits: input.limits } : {}),
+    ...(input.buffer ? { buffer: normalizeChannelBuffer(input.buffer, "discord channel") } : {}),
+  };
+}
+
 function defaultWhatsappChannelSecrets(provider) {
   if (provider === "zapster") {
     return ["ZAPSTER_API_KEY", "ZAPSTER_INSTANCE_ID", "ZAPSTER_WEBHOOK_ID"];
@@ -713,11 +727,17 @@ export class AgentKitConversationStore extends DurableObject {
         status TEXT NOT NULL,
         input_json TEXT NOT NULL,
         output_json TEXT,
+        rendered_json TEXT,
         error_message TEXT,
         created_at TEXT NOT NULL,
         completed_at TEXT
       );
     \`);
+    try {
+      this.sql.exec("ALTER TABLE tool_calls ADD COLUMN rendered_json TEXT");
+    } catch {
+      // Existing Durable Object tables either already have this column or do not need migration.
+    }
   }
 
   async fetch(request) {
@@ -731,6 +751,22 @@ export class AgentKitConversationStore extends DurableObject {
       return this.getMessages(url.searchParams.get("conversationId"));
     }
 
+    if (request.method === "GET" && url.pathname === "/conversations") {
+      return this.listConversations();
+    }
+
+    const conversationTraceMatch = url.pathname.match(/^\\/conversations\\/([^/]+)\\/trace$/);
+
+    if (request.method === "GET" && conversationTraceMatch) {
+      return this.getConversationTrace(decodeURIComponent(conversationTraceMatch[1] || ""));
+    }
+
+    const conversationMatch = url.pathname.match(/^\\/conversations\\/([^/]+)$/);
+
+    if (request.method === "GET" && conversationMatch) {
+      return this.getConversation(decodeURIComponent(conversationMatch[1] || ""));
+    }
+
     return Response.json({ error: { code: "not_found", message: "Unknown Durable Object route." } }, { status: 404 });
   }
 
@@ -754,6 +790,129 @@ export class AgentKitConversationStore extends DurableObject {
     });
   }
 
+  listConversations() {
+    const rows = this.sql.exec(\`
+      SELECT conversations.id, conversations.agent_name, conversations.title, conversations.created_at, conversations.updated_at, COUNT(messages.id) AS message_count
+      FROM conversations
+      LEFT JOIN messages ON messages.conversation_id = conversations.id
+      GROUP BY conversations.id, conversations.agent_name, conversations.title, conversations.created_at, conversations.updated_at
+      ORDER BY conversations.updated_at DESC
+    \`).toArray();
+
+    return Response.json({
+      conversations: rows.map((row) => ({
+        id: String(row.id),
+        agentName: String(row.agent_name),
+        title: row.title === null || row.title === undefined ? null : String(row.title),
+        createdAt: String(row.created_at),
+        updatedAt: String(row.updated_at),
+        messageCount: Number(row.message_count || 0),
+      })),
+    });
+  }
+
+  getConversation(conversationId) {
+    const conversation = this.readConversation(conversationId);
+
+    if (!conversation) {
+      return Response.json(
+        { error: { code: "conversation_not_found", message: \`Conversation "\${conversationId}" was not found.\` } },
+        { status: 404 },
+      );
+    }
+
+    return Response.json(conversation);
+  }
+
+  getConversationTrace(conversationId) {
+    const conversation = this.readConversation(conversationId);
+
+    if (!conversation) {
+      return Response.json(
+        { error: { code: "conversation_not_found", message: \`Conversation "\${conversationId}" was not found.\` } },
+        { status: 404 },
+      );
+    }
+
+    const runs = this.sql.exec(
+      "SELECT id, conversation_id, provider, model, status, error_code, error_message, created_at, completed_at FROM runs WHERE conversation_id = ? ORDER BY rowid ASC",
+      conversationId,
+    ).toArray();
+
+    return Response.json({
+      ...conversation,
+      runs: runs.map((run) => ({
+        id: String(run.id),
+        conversationId: String(run.conversation_id),
+        provider: String(run.provider),
+        model: String(run.model),
+        status: String(run.status),
+        errorCode: run.error_code === null || run.error_code === undefined ? null : String(run.error_code),
+        errorMessage: run.error_message === null || run.error_message === undefined ? null : String(run.error_message),
+        startedAt: String(run.created_at),
+        completedAt: run.completed_at === null || run.completed_at === undefined ? null : String(run.completed_at),
+        toolCalls: this.readToolCalls(String(run.id)),
+      })),
+    });
+  }
+
+  readConversation(conversationId) {
+    if (!conversationId) {
+      return null;
+    }
+
+    const row = this.sql.exec(
+      "SELECT id, agent_name, title, created_at, updated_at FROM conversations WHERE id = ?",
+      conversationId,
+    ).one();
+
+    if (!row) {
+      return null;
+    }
+
+    const messages = this.sql.exec(
+      "SELECT id, conversation_id, role, content, created_at FROM messages WHERE conversation_id = ? ORDER BY rowid ASC",
+      conversationId,
+    ).toArray();
+
+    return {
+      id: String(row.id),
+      agentName: String(row.agent_name),
+      title: row.title === null || row.title === undefined ? null : String(row.title),
+      createdAt: String(row.created_at),
+      updatedAt: String(row.updated_at),
+      messages: messages.map((message) => ({
+        id: String(message.id),
+        conversationId: String(message.conversation_id),
+        role: String(message.role),
+        content: String(message.content),
+        createdAt: String(message.created_at),
+      })),
+    };
+  }
+
+  readToolCalls(runId) {
+    const rows = this.sql.exec(
+      "SELECT id, run_id, conversation_id, tool_name, visibility, status, input_json, output_json, rendered_json, error_message, created_at, completed_at FROM tool_calls WHERE run_id = ? ORDER BY rowid ASC",
+      runId,
+    ).toArray();
+
+    return rows.map((row) => ({
+      id: String(row.id),
+      runId: String(row.run_id),
+      conversationId: String(row.conversation_id),
+      name: String(row.tool_name),
+      visibility: String(row.visibility),
+      status: String(row.status),
+      input: parseStoredJson(row.input_json, {}),
+      output: row.output_json === null || row.output_json === undefined ? undefined : parseStoredJson(row.output_json, null),
+      rendered: row.rendered_json === null || row.rendered_json === undefined ? undefined : parseStoredJson(row.rendered_json, null),
+      errorMessage: row.error_message === null || row.error_message === undefined ? null : String(row.error_message),
+      createdAt: String(row.created_at),
+      completedAt: row.completed_at === null || row.completed_at === undefined ? null : String(row.completed_at),
+    }));
+  }
+
   persistMessages(input) {
     const now = new Date().toISOString();
     const conversationId = String(input.conversationId || crypto.randomUUID());
@@ -805,7 +964,7 @@ export class AgentKitConversationStore extends DurableObject {
 
     for (const toolCall of input.toolCalls || []) {
       this.sql.exec(
-        "INSERT INTO tool_calls (id, run_id, conversation_id, tool_name, visibility, status, input_json, output_json, error_message, created_at, completed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+        "INSERT INTO tool_calls (id, run_id, conversation_id, tool_name, visibility, status, input_json, output_json, rendered_json, error_message, created_at, completed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
         String(toolCall.id || crypto.randomUUID()),
         runId,
         conversationId,
@@ -814,6 +973,7 @@ export class AgentKitConversationStore extends DurableObject {
         String(toolCall.status || "completed"),
         JSON.stringify(toolCall.input ?? {}),
         toolCall.output === undefined ? null : JSON.stringify(toolCall.output),
+        toolCall.rendered === undefined ? null : JSON.stringify(toolCall.rendered),
         toolCall.errorMessage ? String(toolCall.errorMessage) : null,
         now,
         now,
@@ -867,6 +1027,15 @@ export default {
     }
 
     if (request.method === "GET" && url.pathname === "/") {
+      const auth = await authorizeDeployAccess(request, env, {}, {
+        notConfiguredCode: "cloud_access_not_configured",
+        notConfiguredMessage: "Hosted AgentKit Cloud routes require a deploy access token gate.",
+      });
+
+      if (auth) {
+        return auth;
+      }
+
       return Response.json({
         agent: manifest.name,
         status: "ready",
@@ -876,7 +1045,16 @@ export default {
     }
 
     if (request.method === "GET" && url.pathname === "/health") {
-      return Response.json({ status: "ok", agent: manifest.name });
+      const auth = await authorizeDeployAccess(request, env, {}, {
+        notConfiguredCode: "cloud_access_not_configured",
+        notConfiguredMessage: "Hosted AgentKit Cloud routes require a deploy access token gate.",
+      });
+
+      if (auth) {
+        return auth;
+      }
+
+      return Response.json({ ok: true });
     }
 
     if (isHostedChannelWebhookPath(url.pathname)) {
@@ -887,16 +1065,24 @@ export default {
       return handleChat(request, env);
     }
 
-    if (request.method === "POST" && url.pathname.startsWith("/tools/")) {
-      return handleTool(request, env, decodeURIComponent(url.pathname.slice("/tools/".length)));
+    if (request.method === "GET" && (url.pathname === "/conversations" || url.pathname === "/v1/conversations")) {
+      return handleConversationRead(request, env, "list");
     }
 
-    if (request.method === "GET" && url.pathname === "/_agentkit/turso/health") {
-      return handleTursoHealth(request, env);
+    const conversationTraceMatch = url.pathname.match(/^\\/(?:v1\\/)?conversations\\/([^/]+)\\/trace$/);
+
+    if (request.method === "GET" && conversationTraceMatch) {
+      return handleConversationRead(request, env, "trace", decodeURIComponent(conversationTraceMatch[1] || ""));
     }
 
-    if (request.method === "POST" && url.pathname === "/_agentkit/turso/query") {
-      return handleTursoQuery(request, env);
+    const conversationMatch = url.pathname.match(/^\\/(?:v1\\/)?conversations\\/([^/]+)$/);
+
+    if (request.method === "GET" && conversationMatch) {
+      return handleConversationRead(request, env, "show", decodeURIComponent(conversationMatch[1] || ""));
+    }
+
+    if (request.method === "POST" && url.pathname.startsWith("/tools/")) {
+      return handleTool(request, env, decodeURIComponent(url.pathname.slice("/tools/".length)));
     }
 
     if (url.pathname.startsWith("/files/")) {
@@ -909,8 +1095,8 @@ export default {
 
 function isHostedChannelWebhookPath(pathname) {
   return (
-    /^\\/channels\\/[^/]+\\/(?:website\\/agentkit|telegram\\/telegram|whatsapp\\/(?:zapster|meta))\\/webhook$/.test(pathname) ||
-    /^\\/channels\\/[^/]+\\/(?:website|telegram)\\/webhook$/.test(pathname) ||
+    /^\\/channels\\/[^/]+\\/(?:website\\/agentkit|telegram\\/telegram|whatsapp\\/(?:zapster|meta)|discord\\/discord)\\/webhook$/.test(pathname) ||
+    /^\\/channels\\/[^/]+\\/(?:website|telegram|discord)\\/webhook$/.test(pathname) ||
     /^\\/channels\\/[^/]+\\/whatsapp\\/(?:zapster|meta)\\/webhook$/.test(pathname)
   );
 }
@@ -949,71 +1135,6 @@ async function forwardHostedChannelWebhook(request, env, url) {
   });
 }
 
-async function handleTursoHealth(request, env) {
-  const auth = authorizeAdmin(request, env);
-
-  if (auth) {
-    return auth;
-  }
-
-  const configError = requireTurso(env);
-
-  if (configError) {
-    return configError;
-  }
-
-  const response = await fetch(toTursoBaseUrl(env.TURSO_DATABASE_URL) + "/health", {
-    headers: {
-      Authorization: \`Bearer \${env.TURSO_AUTH_TOKEN}\`,
-    },
-  });
-
-  return Response.json({
-    driver: "turso",
-    ok: response.ok,
-    status: response.status,
-  }, { status: response.ok ? 200 : 502 });
-}
-
-async function handleTursoQuery(request, env) {
-  const auth = authorizeAdmin(request, env);
-
-  if (auth) {
-    return auth;
-  }
-
-  const configError = requireTurso(env);
-
-  if (configError) {
-    return configError;
-  }
-
-  let body;
-
-  try {
-    body = await request.json();
-  } catch {
-    return Response.json(
-      { error: { code: "validation_error", message: "Expected JSON body with sql and optional args fields." } },
-      { status: 400 },
-    );
-  }
-
-  const sql = String(body.sql || "").trim();
-
-  if (!sql) {
-    return Response.json({ error: { code: "validation_error", message: "sql must be non-empty." } }, { status: 400 });
-  }
-
-  const args = Array.isArray(body.args) ? body.args : [];
-  try {
-    const result = await executeTursoSql(env, sql, args);
-    return Response.json(result);
-  } catch (error) {
-    return hostedErrorResponse(error);
-  }
-}
-
 async function handleFile(request, env, rawKey) {
   const auth = authorizeAdmin(request, env);
 
@@ -1141,6 +1262,7 @@ async function handleTool(request, env, toolName) {
       },
       input: result.input,
       output: result.output,
+      ...(result.rendered ? { rendered: result.rendered } : {}),
     });
   } catch (error) {
     return hostedErrorResponse(error);
@@ -1186,35 +1308,12 @@ async function handleChat(request, env) {
   let content;
   const toolCalls = [];
 
-  const toolRequest = parseToolRequest(message);
-
-  if (toolRequest) {
-    try {
-      const toolResult = await executeHostedTool({
-        name: toolRequest.name,
-        input: toolRequest.input,
-        env,
-        signal: request.signal,
-        invocation: "chat",
-      });
-      toolCalls.push(toolResult);
-      content =
-        toolResult.visibility === "internal"
-          ? \`Tool \${toolResult.name}: completed\`
-          : \`Tool \${toolResult.name}: \${JSON.stringify(toolResult.output)}\`;
-    } catch (error) {
-      await persistFailure(env, conversationId, message, error);
-      return hostedErrorResponse(error);
-    }
-  }
-
-  if (content === undefined) {
-    try {
-      content = await callHostedProvider(env, [...previousMessages, { role: "user", content: message }], request.signal);
-    } catch (error) {
-      await persistFailure(env, conversationId, message, error);
-      return hostedErrorResponse(error);
-    }
+  try {
+    const providerResult = await callHostedProvider(env, [...previousMessages, { role: "user", content: message }], request.signal, toolCalls);
+    content = providerResult.content;
+  } catch (error) {
+    await persistFailure(env, conversationId, message, error, toolCalls);
+    return hostedErrorResponse(error);
   }
 
   const persisted = await persist(env, {
@@ -1233,6 +1332,39 @@ async function handleChat(request, env) {
   });
 }
 
+async function handleConversationRead(request, env, action, conversationId) {
+  const auth = await authorizeConversationRead(request, env);
+
+  if (auth) {
+    return auth;
+  }
+
+  if (!env.AGENTKIT_CONVERSATIONS) {
+    return Response.json({ error: { code: "conversations_not_configured", message: "Hosted conversation storage is not configured." } }, { status: 503 });
+  }
+
+  if (action === "list") {
+    const stub = hostedConversationStore(env);
+    return stub.fetch("https://agentkit.internal/conversations");
+  }
+
+  if (!conversationId) {
+    return Response.json({ error: { code: "validation_error", message: "Missing conversation id." } }, { status: 400 });
+  }
+
+  const stub = hostedConversationStore(env);
+  const suffix = action === "trace" ? "/trace" : "";
+  const path = \`/conversations/\${encodeURIComponent(conversationId)}\${suffix}\`;
+  const response = await stub.fetch(\`https://agentkit.internal\${path}\`);
+
+  if (response.status !== 404) {
+    return response;
+  }
+
+  const legacyStub = legacyConversationStore(env, conversationId);
+  return legacyStub.fetch(\`https://agentkit.internal\${path}\`);
+}
+
 function readChatMessage(body) {
   if (typeof body.message === "string") {
     return body.message.trim();
@@ -1249,7 +1381,7 @@ function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
-async function callHostedProvider(env, messages, signal) {
+async function callHostedProvider(env, messages, signal, toolCalls = []) {
   const adapter = getProviderAdapter(manifest.provider);
   const hostedTools = createHostedTools(env);
   const clock = buildRuntimeClockContext({
@@ -1270,12 +1402,14 @@ async function callHostedProvider(env, messages, signal) {
     ),
     messages,
     tools: hostedTools,
-    toolRuntime: createHostedProviderToolRuntime(env, signal, clock),
+    toolRuntime: createHostedProviderToolRuntime(env, signal, clock, toolCalls),
     env,
     signal,
   });
 
-  return result.message.content;
+  return {
+    content: result.message.content,
+  };
 }
 
 function appendHostedKnowledgePromptPolicy(baseInstructions) {
@@ -1701,36 +1835,17 @@ async function hostedFakeEmbedding(input, dimensions) {
   return norm === 0 ? values : values.map((value) => Number((value / norm).toFixed(8)));
 }
 
-async function persistFailure(env, conversationId, userMessage, error) {
+async function persistFailure(env, conversationId, userMessage, error, toolCalls = []) {
   await persist(env, {
     conversationId,
     userMessage,
     status: "failed",
     errorCode: error && typeof error === "object" && "code" in error ? String(error.code) : "runtime_error",
     errorMessage: error instanceof Error ? error.message : String(error),
-    toolCalls: [],
+    toolCalls,
   }).catch(() => undefined);
 }
 
-function parseToolRequest(content) {
-  let parsed;
-
-  try {
-    parsed = JSON.parse(content);
-  } catch {
-    return null;
-  }
-
-  if (!isRecord(parsed) || typeof parsed.tool !== "string" || parsed.tool.length === 0) {
-    return null;
-  }
-
-  return {
-    name: parsed.tool,
-    input: "input" in parsed ? parsed.input : {},
-  };
-}
-
 function inspectHostedDatabase() {
   const schema = manifest.storage.database.driver === "turso" ? manifest.storage.database.schema : null;
 
@@ -1784,21 +1899,28 @@ function hostedIntegrations(env) {
   );
 }
 
-function createHostedProviderToolRuntime(env, signal, clock) {
+function createHostedProviderToolRuntime(env, signal, clock, toolCalls) {
   const hostedTools = createHostedTools(env);
 
   return {
     definitions: hostedTools,
-    execute(request) {
-      return executeHostedTool({
-        tools: hostedTools,
-        name: request.name,
-        input: request.input,
-        env,
-        signal,
-        invocation: "chat",
-        clock,
-      });
+    async execute(request) {
+      try {
+        const result = await executeHostedTool({
+          tools: hostedTools,
+          name: request.name,
+          input: request.input,
+          env,
+          signal,
+          invocation: "chat",
+          clock,
+        });
+        toolCalls?.push(result);
+        return result;
+      } catch (error) {
+        toolCalls?.push(failedHostedToolCall(hostedTools, request, error));
+        throw error;
+      }
     },
   };
 }
@@ -1821,6 +1943,12 @@ async function executeHostedTool(request) {
     timeZone: manifest.timeZone,
     env: request.env,
   });
+  const runtime = {
+    environment: "hosted",
+    invocation: request.invocation ?? "tool",
+    target: "cloudflare",
+    database: manifest.storage.database.driver === "turso" ? "turso" : "none",
+  };
   const output = await runToolWithTimeout(
     tool,
     input,
@@ -1829,12 +1957,7 @@ async function executeHostedTool(request) {
       database,
       signal: request.signal,
       clock,
-      runtime: {
-        environment: "hosted",
-        invocation: request.invocation ?? "tool",
-        target: "cloudflare",
-        database: manifest.storage.database.driver === "turso" ? "turso" : "none",
-      },
+      runtime,
     },
     tool.timeoutMs ?? DEFAULT_TOOL_TIMEOUT_MS,
   );
@@ -1843,6 +1966,8 @@ async function executeHostedTool(request) {
     validateSchema(output, tool.outputSchema, \`tool "\${tool.name}" output\`);
   }
 
+  const rendered = renderHostedToolOutput(tool, input, output, runtime, clock);
+
   return {
     id,
     name: tool.name,
@@ -1850,9 +1975,135 @@ async function executeHostedTool(request) {
     status: "completed",
     input,
     output,
+    ...(rendered ? { rendered } : {}),
+  };
+}
+
+function failedHostedToolCall(tools, request, error) {
+  const tool = tools.find((candidate) => candidate.name === request.name);
+
+  return {
+    id: crypto.randomUUID(),
+    name: String(request.name || ""),
+    visibility: tool?.visibility ?? "user",
+    status: "failed",
+    input: request.input ?? {},
+    errorMessage: error instanceof Error ? error.message : String(error),
+  };
+}
+
+function renderHostedToolOutput(tool, input, output, runtime, clock) {
+  if (!tool.render) {
+    return undefined;
+  }
+
+  const rendered = tool.render(output, {
+    input,
+    runtime,
+    clock,
+  });
+
+  if (typeof rendered === "string") {
+    return { text: rendered };
+  }
+
+  if (!isRecord(rendered) || typeof rendered.text !== "string" || rendered.text.trim().length === 0) {
+    throw agentKitError("tool_validation_error", \`tool "\${tool.name}" render must return a non-empty text string.\`);
+  }
+
+  if (rendered.blocks !== undefined) {
+    if (!Array.isArray(rendered.blocks)) {
+      throw agentKitError("tool_validation_error", \`tool "\${tool.name}" render.blocks must be an array when provided.\`);
+    }
+
+    for (const [index, block] of rendered.blocks.entries()) {
+      validateRenderBlock(block, \`tool "\${tool.name}" render.blocks[\${index}]\`);
+    }
+  }
+
+  return {
+    text: rendered.text,
+    ...(rendered.blocks ? { blocks: rendered.blocks } : {}),
   };
 }
 
+function validateRenderBlock(block, label) {
+  if (!isRecord(block)) {
+    throw agentKitError("tool_validation_error", \`\${label} must be an object.\`);
+  }
+
+  if (block.type === "text") {
+    if (typeof block.text !== "string" || block.text.trim().length === 0) {
+      throw agentKitError("tool_validation_error", \`\${label}.text must be a non-empty string.\`);
+    }
+
+    return;
+  }
+
+  if (block.type === "card") {
+    if (typeof block.title !== "string" || block.title.trim().length === 0) {
+      throw agentKitError("tool_validation_error", \`\${label}.title must be a non-empty string.\`);
+    }
+
+    validateOptionalString(block.subtitle, \`\${label}.subtitle\`);
+    validateRenderFields(block.fields, \`\${label}.fields\`);
+    validateRenderActions(block.actions, \`\${label}.actions\`);
+    return;
+  }
+
+  throw agentKitError("tool_validation_error", \`\${label}.type must be "text" or "card".\`);
+}
+
+function validateRenderFields(value, label) {
+  if (value === undefined) {
+    return;
+  }
+
+  if (!Array.isArray(value)) {
+    throw agentKitError("tool_validation_error", \`\${label} must be an array when provided.\`);
+  }
+
+  for (const [index, field] of value.entries()) {
+    if (!isRecord(field)) {
+      throw agentKitError("tool_validation_error", \`\${label}[\${index}] must be an object.\`);
+    }
+
+    validateRequiredString(field.label, \`\${label}[\${index}].label\`);
+    validateRequiredString(field.value, \`\${label}[\${index}].value\`);
+  }
+}
+
+function validateRenderActions(value, label) {
+  if (value === undefined) {
+    return;
+  }
+
+  if (!Array.isArray(value)) {
+    throw agentKitError("tool_validation_error", \`\${label} must be an array when provided.\`);
+  }
+
+  for (const [index, action] of value.entries()) {
+    if (!isRecord(action)) {
+      throw agentKitError("tool_validation_error", \`\${label}[\${index}] must be an object.\`);
+    }
+
+    validateRequiredString(action.label, \`\${label}[\${index}].label\`);
+    validateOptionalString(action.href, \`\${label}[\${index}].href\`);
+  }
+}
+
+function validateRequiredString(value, label) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw agentKitError("tool_validation_error", \`\${label} must be a non-empty string.\`);
+  }
+}
+
+function validateOptionalString(value, label) {
+  if (value !== undefined && typeof value !== "string") {
+    throw agentKitError("tool_validation_error", \`\${label} must be a string when provided.\`);
+  }
+}
+
 function resolveToolSecrets(tool, env) {
   const secrets = {};
 
@@ -2119,6 +2370,20 @@ function allowsNull(schema) {
 }
 
 async function authorizeChat(request, env, body) {
+  return authorizeDeployAccess(request, env, body, {
+    notConfiguredCode: "chat_access_not_configured",
+    notConfiguredMessage: "Hosted chat requires a deploy access token gate.",
+  });
+}
+
+async function authorizeConversationRead(request, env) {
+  return authorizeDeployAccess(request, env, {}, {
+    notConfiguredCode: "conversation_access_not_configured",
+    notConfiguredMessage: "Hosted conversation reads require a deploy access token gate.",
+  });
+}
+
+async function authorizeDeployAccess(request, env, body, options) {
   const runtimeGate = await authorizeRuntimeGate(request, env, body);
 
   if (runtimeGate) {
@@ -2129,52 +2394,28 @@ async function authorizeChat(request, env, body) {
     return runtimeGate;
   }
 
-  if (manifest.access.mode === "public") {
-    return null;
-  }
+  const token = deployAccessToken(request, body);
+  const acceptedTokens = [env.AGENTKIT_PRIVATE_TOKEN, env.AGENTKIT_ACCESS_TOKEN].filter(
+    (value) => typeof value === "string" && value.length > 0,
+  );
 
-  if (manifest.access.mode === "private") {
-    if (!env.AGENTKIT_PRIVATE_TOKEN) {
-      return Response.json(
-        {
-          error: {
-            code: "deploy_not_ready",
-            message: "Private deploy requires AGENTKIT_PRIVATE_TOKEN to be set as a Cloudflare secret.",
-          },
+  if (acceptedTokens.length === 0) {
+    return Response.json(
+      {
+        error: {
+          code: options.notConfiguredCode,
+          message: options.notConfiguredMessage,
         },
-        { status: 503 },
-      );
-    }
-
-    const expected = \`Bearer \${env.AGENTKIT_PRIVATE_TOKEN}\`;
-    if (request.headers.get("authorization") !== expected) {
-      return Response.json(
-        { error: { code: "unauthorized", message: "Missing or invalid deploy access token." } },
-        { status: 401 },
-      );
-    }
+      },
+      { status: 503 },
+    );
   }
 
-  if (manifest.access.mode === "token") {
-    if (!env.AGENTKIT_ACCESS_TOKEN) {
-      return Response.json(
-        {
-          error: {
-            code: "deploy_not_ready",
-            message: "Token deploy requires AGENTKIT_ACCESS_TOKEN to be set as a Cloudflare secret.",
-          },
-        },
-        { status: 503 },
-      );
-    }
-
-    const expected = \`Bearer \${env.AGENTKIT_ACCESS_TOKEN}\`;
-    if (request.headers.get("authorization") !== expected) {
-      return Response.json(
-        { error: { code: "unauthorized", message: "Missing or invalid deploy access token." } },
-        { status: 401 },
-      );
-    }
+  if (!token || !acceptedTokens.includes(token)) {
+    return Response.json(
+      { error: { code: "unauthorized", message: "Missing or invalid deploy access token." } },
+      { status: 401 },
+    );
   }
 
   return null;
@@ -2276,8 +2517,7 @@ async function persist(env, input) {
     return {};
   }
 
-  const id = env.AGENTKIT_CONVERSATIONS.idFromName(input.conversationId);
-  const stub = env.AGENTKIT_CONVERSATIONS.get(id);
+  const stub = hostedConversationStore(env);
   const response = await stub.fetch("https://agentkit.internal/messages", {
     method: "POST",
     body: JSON.stringify(input),
@@ -2295,8 +2535,7 @@ async function loadConversationMessages(env, conversationId) {
     return [];
   }
 
-  const id = env.AGENTKIT_CONVERSATIONS.idFromName(conversationId);
-  const stub = env.AGENTKIT_CONVERSATIONS.get(id);
+  const stub = hostedConversationStore(env);
   const response = await stub.fetch(
     \`https://agentkit.internal/messages?conversationId=\${encodeURIComponent(conversationId)}\`,
   );
@@ -2306,7 +2545,7 @@ async function loadConversationMessages(env, conversationId) {
   }
 
   const payload = await response.json();
-  return Array.isArray(payload.messages)
+  const messages = Array.isArray(payload.messages)
     ? payload.messages.filter((message) =>
         message &&
         typeof message === "object" &&
@@ -2314,6 +2553,39 @@ async function loadConversationMessages(env, conversationId) {
         typeof message.content === "string"
       )
     : [];
+
+  if (messages.length > 0) {
+    return messages;
+  }
+
+  const legacyStub = legacyConversationStore(env, conversationId);
+  const legacyResponse = await legacyStub.fetch(
+    \`https://agentkit.internal/messages?conversationId=\${encodeURIComponent(conversationId)}\`,
+  );
+
+  if (!legacyResponse.ok) {
+    return [];
+  }
+
+  const legacyPayload = await legacyResponse.json();
+  return Array.isArray(legacyPayload.messages)
+    ? legacyPayload.messages.filter((message) =>
+        message &&
+        typeof message === "object" &&
+        (message.role === "user" || message.role === "assistant") &&
+        typeof message.content === "string"
+      )
+    : [];
+}
+
+function hostedConversationStore(env) {
+  const id = env.AGENTKIT_CONVERSATIONS.idFromName("agentkit-conversations");
+  return env.AGENTKIT_CONVERSATIONS.get(id);
+}
+
+function legacyConversationStore(env, conversationId) {
+  const id = env.AGENTKIT_CONVERSATIONS.idFromName(conversationId);
+  return env.AGENTKIT_CONVERSATIONS.get(id);
 }
 
 function normalizeConversationId(value) {
@@ -2590,6 +2862,18 @@ function titleFromMessage(content) {
   const compact = content.split(/\\r?\\n/, 1)[0].replace(/\\s+/g, " ").trim();
   return compact.length <= 80 ? compact : \`\${compact.slice(0, 77)}...\`;
 }
+
+function parseStoredJson(value, fallback) {
+  if (typeof value !== "string") {
+    return fallback;
+  }
+
+  try {
+    return JSON.parse(value);
+  } catch {
+    return fallback;
+  }
+}
 `;
 }
 
@@ -2673,6 +2957,7 @@ CREATE TABLE IF NOT EXISTS tool_calls (
   status TEXT NOT NULL,
   input_json TEXT NOT NULL,
   output_json TEXT,
+  rendered_json TEXT,
   error_message TEXT,
   created_at TEXT NOT NULL,
   completed_at TEXT