@andreprado/agentkit 0.1.0 → 0.2.0

package/src/runtime/targets/cloudflare/build.ts

@@ -1,3319 +0,0 @@
-import { createHash } from "node:crypto";
-import { mkdir, readFile, readdir, unlink, writeFile } from "node:fs/promises";
-import { dirname, extname, join, relative, resolve } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-
-import { build as esbuild, type Plugin } from "esbuild";
-
-import { loadAgentCapsule, type LoadedAgentCapsule } from "../../config";
-import { buildSharedAgentManifest, type ManifestSchema, type SharedAgentManifest } from "../../core/manifest";
-import { AgentKitError } from "../../errors";
-import { resolveKnowledgeConfig } from "../../knowledge/config";
-import { KNOWLEDGE_SCHEMA_SQL } from "../../knowledge/schema";
-
-export type BuildTarget = "cloudflare";
-
-export type AgentBuildResult = {
-  target: BuildTarget;
-  root: string;
-  buildDir: string;
-  manifestPath: string;
-  workerPath: string;
-  wranglerPath: string;
-  durableObjectSchemaPath: string;
-  tursoSchemaPath: string | null;
-  bundleSha256: string;
-  warnings: string[];
-};
-
-export type AgentManifest = {
-  schema_version: SharedAgentManifest["schema_version"];
-  name: SharedAgentManifest["name"];
-  runtime: "edge";
-  target: "cloudflare";
-  provider: SharedAgentManifest["provider"];
-  timeZone: SharedAgentManifest["timeZone"];
-  prompt: SharedAgentManifest["prompt"];
-  secrets: SharedAgentManifest["secrets"];
-  tools: SharedAgentManifest["tools"];
-  integrations: SharedAgentManifest["integrations"];
-  channels: SharedAgentManifest["channels"];
-  transcription: SharedAgentManifest["transcription"];
-  knowledge: SharedAgentManifest["knowledge"];
-  access: SharedAgentManifest["access"];
-  storage: {
-    driver: "agentkit";
-    database: SharedAgentManifest["storage"]["database"];
-    files:
-      | {
-          driver: "none";
-        }
-      | {
-          driver: "r2";
-          binding: "AGENTKIT_FILES";
-          bucket: string;
-          prefix: string;
-          maxUploadBytes: number;
-        };
-  };
-};
-
-export type AgentManifestWithBundle = AgentManifest & {
-  bundle: {
-    content_type: "application/javascript";
-    sha256: string;
-  };
-};
-
-const CLOUDFLARE_BUILD_DIR = ".agentkit/build/cloudflare";
-const AGENTKIT_BUILD_DIR = ".agentkit/build";
-const CLOUDFLARE_COMPATIBILITY_DATE = "2026-05-27";
-const CLOUDFLARE_COMPATIBILITY_FLAGS = ["nodejs_compat"] as const;
-const moduleDir = dirname(fileURLToPath(import.meta.url));
-
-export async function buildCloudflareAgentCapsule(
-  cwd = process.cwd(),
-): Promise<AgentBuildResult> {
-  const capsule = await loadAgentCapsule(cwd);
-  validateCloudflareBuild(capsule);
-  await assertEdgeCompatibleImports(capsule);
-
-  const tursoSchema = await loadTursoSchema(capsule);
-  const manifest = buildManifest(capsule, tursoSchema);
-  const warnings = buildWarnings(capsule);
-  const agentkitBuildDir = join(capsule.root, AGENTKIT_BUILD_DIR);
-  const cloudflareBuildDir = join(capsule.root, CLOUDFLARE_BUILD_DIR);
-  const manifestPath = join(agentkitBuildDir, "agent.manifest.json");
-  const workerEntryPath = join(cloudflareBuildDir, "worker.entry.ts");
-  const workerPath = join(cloudflareBuildDir, "worker.js");
-  const wranglerPath = join(cloudflareBuildDir, "wrangler.jsonc");
-  const durableObjectSchemaPath = join(cloudflareBuildDir, "durable-object-schema.sql");
-  const tursoSchemaPath = tursoSchema ? join(cloudflareBuildDir, "turso-schema.sql") : null;
-  const bundleConfig = await writeEdgeBundleConfig(capsule);
-
-  await mkdir(agentkitBuildDir, { recursive: true });
-  await mkdir(cloudflareBuildDir, { recursive: true });
-  try {
-    const workerEntrySource = renderCloudflareWorker({
-      manifest,
-      instructions: capsule.instructions,
-      configPath: bundleConfig.configPath,
-    });
-    await writeFile(workerEntryPath, workerEntrySource);
-    await bundleCloudflareWorker(workerEntryPath, workerPath, bundleConfig.shimPath);
-  } finally {
-    await Promise.all(bundleConfig.cleanupPaths.map((path) => unlink(path).catch(() => undefined)));
-  }
-
-  const workerSource = await readFile(workerPath, "utf8");
-  const bundleSha256 = sha256(workerSource);
-  const manifestWithBundle: AgentManifestWithBundle = {
-    ...manifest,
-    bundle: {
-      content_type: "application/javascript",
-      sha256: bundleSha256,
-    },
-  };
-
-  await writeFile(manifestPath, `${JSON.stringify(manifestWithBundle, null, 2)}\n`);
-  await writeFile(wranglerPath, renderWranglerConfig(capsule.config.name, manifest.storage.files));
-  await writeFile(durableObjectSchemaPath, renderDurableObjectSchema());
-  if (tursoSchemaPath && tursoSchema) {
-    await writeFile(tursoSchemaPath, tursoSchema.source);
-  }
-
-  return {
-    target: "cloudflare",
-    root: capsule.root,
-    buildDir: cloudflareBuildDir,
-    manifestPath,
-    workerPath,
-    wranglerPath,
-    durableObjectSchemaPath,
-    tursoSchemaPath,
-    bundleSha256,
-    warnings,
-  };
-}
-
-function validateCloudflareBuild(capsule: LoadedAgentCapsule): void {
-  if (capsule.config.runtime !== "edge") {
-    throw new AgentKitError(
-      "build_not_edge",
-      'Cloudflare deploy requires runtime: "edge" in agentkit.config.ts.',
-    );
-  }
-
-  if (capsule.config.storage.driver !== "agentkit") {
-    throw new AgentKitError(
-      "build_storage_driver",
-      'Cloudflare deploy requires storage.driver: "agentkit" so hosted state is managed by AgentKit Cloud.',
-    );
-  }
-
-  const knowledge = resolveKnowledgeConfig(capsule.config);
-
-  if (knowledge.enabled && capsule.config.storage.database?.driver !== "turso") {
-    throw new AgentKitError(
-      "build_knowledge_database",
-      'Cloudflare Knowledge deploy requires storage.database.driver: "turso" so chunks and retrieval state are available to the hosted runtime.',
-    );
-  }
-}
-
-function buildWarnings(capsule: LoadedAgentCapsule): string[] {
-  const warnings: string[] = [];
-
-  if (capsule.config.access.mode === "private") {
-    warnings.push(
-      "Private access requires setting AGENTKIT_PRIVATE_TOKEN as a Cloudflare secret before /chat accepts requests.",
-    );
-  }
-
-  if (capsule.config.storage.database?.driver === "turso") {
-    warnings.push(
-      "AgentKit Cloud will provision Turso and inject TURSO_DATABASE_URL/TURSO_AUTH_TOKEN; only --local-wrangler deploys must provide them manually.",
-    );
-  }
-
-  if (capsule.config.storage.files?.driver === "r2") {
-    warnings.push("R2 file storage requires the AGENTKIT_FILES binding in wrangler.jsonc to point at an existing bucket.");
-  }
-
-  return warnings;
-}
-
-function buildManifest(
-  capsule: LoadedAgentCapsule,
-  tursoSchema: ManifestSchema | null,
-): AgentManifest {
-  const shared = buildSharedAgentManifest(capsule, { databaseSchema: tursoSchema });
-
-  return {
-    schema_version: shared.schema_version,
-    name: shared.name,
-    runtime: "edge",
-    target: "cloudflare",
-    provider: shared.provider,
-    timeZone: shared.timeZone,
-    prompt: shared.prompt,
-    secrets: shared.secrets,
-    tools: shared.tools,
-    integrations: shared.integrations,
-    channels: shared.channels,
-    transcription: shared.transcription,
-    knowledge: shared.knowledge,
-    access: shared.access,
-    storage: {
-      driver: "agentkit",
-      database: shared.storage.database,
-      files: buildCloudflareFilesManifest(shared.storage.files),
-    },
-  };
-}
-
-function buildCloudflareFilesManifest(files: SharedAgentManifest["storage"]["files"]): AgentManifest["storage"]["files"] {
-  if (files.driver === "none") {
-    return { driver: "none" };
-  }
-
-  return {
-    driver: "r2",
-    binding: "AGENTKIT_FILES",
-    bucket: files.bucket,
-    prefix: files.prefix,
-    maxUploadBytes: files.maxUploadBytes,
-  };
-}
-
-async function loadTursoSchema(capsule: LoadedAgentCapsule): Promise<ManifestSchema | null> {
-  const database = capsule.config.storage.database;
-  const knowledge = resolveKnowledgeConfig(capsule.config);
-  const sources: string[] = [];
-
-  if (!database || database.driver !== "turso") {
-    return null;
-  }
-
-  if (database.schema) {
-    sources.push(await readFile(resolve(capsule.root, database.schema), "utf8"));
-  }
-
-  if (knowledge.enabled) {
-    sources.push(KNOWLEDGE_SCHEMA_SQL);
-  }
-
-  if (sources.length === 0) {
-    return null;
-  }
-
-  const source = sources.map((part) => part.trim()).filter(Boolean).join("\n\n") + "\n";
-  const digest = sha256(source);
-  return { source, sha256: digest };
-}
-
-const EDGE_INCOMPATIBLE_IMPORTS = new Map<string, string>([
-  ["bun:sqlite", "Use ctx.db inside tools instead of importing SQLite or Bun database APIs."],
-  ["node:fs", "Cloudflare Workers cannot read local files. Move static data into config, prompts, files, or a tool input."],
-  ["fs", "Cloudflare Workers cannot read local files. Move static data into config, prompts, files, or a tool input."],
-  ["node:path", "Cloudflare Workers do not provide Node path APIs in tool bundles. Avoid filesystem path logic in edge tools."],
-  ["path", "Cloudflare Workers do not provide Node path APIs in tool bundles. Avoid filesystem path logic in edge tools."],
-  ["node:net", "Cloudflare Workers cannot open raw TCP sockets from tools. Use fetch-compatible APIs."],
-  ["net", "Cloudflare Workers cannot open raw TCP sockets from tools. Use fetch-compatible APIs."],
-  ["node:child_process", "Cloudflare Workers cannot spawn local processes. Move this work to a local/container target."],
-  ["child_process", "Cloudflare Workers cannot spawn local processes. Move this work to a local/container target."],
-  ["better-sqlite3", "Use ctx.db inside tools instead of importing native database clients."],
-  ["sqlite3", "Use ctx.db inside tools instead of importing native database clients."],
-  ["libsql", "Use ctx.db inside tools so AgentKit can route local SQLite and hosted Turso consistently."],
-  ["@libsql/client", "Use ctx.db inside tools so AgentKit can route local SQLite and hosted Turso consistently."],
-]);
-
-async function assertEdgeCompatibleImports(capsule: LoadedAgentCapsule): Promise<void> {
-  const files = await listSourceFiles(capsule.root);
-
-  for (const file of files) {
-    const source = await readFile(file, "utf8");
-
-    for (const specifier of findImportSpecifiers(source)) {
-      const guidance = edgeImportGuidance(specifier);
-
-      if (!guidance) {
-        continue;
-      }
-
-      throw new AgentKitError(
-        "edge_incompatible_import",
-        [
-          `Cloudflare build cannot include import "${specifier}" from ${relative(capsule.root, file)}.`,
-          `Target runtime: cloudflare.`,
-          guidance,
-        ].join(" "),
-      );
-    }
-  }
-}
-
-async function listSourceFiles(root: string): Promise<string[]> {
-  const entries = await readdir(root, { withFileTypes: true });
-  const files: string[] = [];
-
-  for (const entry of entries) {
-    if (entry.name === "node_modules" || entry.name === ".agentkit" || entry.name === ".git") {
-      continue;
-    }
-
-    const path = join(root, entry.name);
-
-    if (entry.isDirectory()) {
-      files.push(...(await listSourceFiles(path)));
-      continue;
-    }
-
-    if (entry.isFile() && [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"].includes(extname(entry.name))) {
-      files.push(path);
-    }
-  }
-
-  return files.sort();
-}
-
-function findImportSpecifiers(source: string): string[] {
-  const specifiers: string[] = [];
-  const patterns = [
-    /\bimport\s+(?!type\b)(?:[^"'()]*?\s+from\s+)?["']([^"']+)["']/g,
-    /\bexport\s+(?!type\b)[^"'()]*?\s+from\s+["']([^"']+)["']/g,
-    /\brequire\(\s*["']([^"']+)["']\s*\)/g,
-    /\bimport\(\s*["']([^"']+)["']\s*\)/g,
-  ];
-
-  for (const pattern of patterns) {
-    for (const match of source.matchAll(pattern)) {
-      if (match[1]) {
-        specifiers.push(match[1]);
-      }
-    }
-  }
-
-  return specifiers;
-}
-
-function edgeImportGuidance(specifier: string): string | null {
-  if (EDGE_INCOMPATIBLE_IMPORTS.has(specifier)) {
-    return EDGE_INCOMPATIBLE_IMPORTS.get(specifier) ?? null;
-  }
-
-  for (const [blocked, guidance] of EDGE_INCOMPATIBLE_IMPORTS) {
-    if (specifier === blocked || specifier.startsWith(`${blocked}/`)) {
-      return guidance;
-    }
-  }
-
-  return null;
-}
-
-async function writeEdgeBundleConfig(
-  capsule: LoadedAgentCapsule,
-): Promise<{ configPath: string; shimPath: string; cleanupPaths: string[] }> {
-  const source = await readFile(capsule.configPath, "utf8");
-  const suffix = `${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
-  const shimPath = join(dirname(capsule.configPath), `.agentkit.edge-shim-${suffix}.ts`);
-  const bundleConfigPath = join(dirname(capsule.configPath), `.agentkit.config.edge-bundle-${suffix}.ts`);
-  const localAgentKitPath = resolve(moduleDir, "../../../index.ts");
-  const shimImport = JSON.stringify(`./${relative(dirname(capsule.configPath), shimPath)}`);
-  const patchedSource = source
-    .replace(
-      /from\s+(["'])file:\/\/([^"']+)\1/g,
-      (_match, quote: string, path: string) => `from ${quote}${decodeURIComponent(path)}${quote}`,
-    )
-    .replace(/from\s+["']@andreprado\/agentkit["']/g, `from ${shimImport}`)
-    .replace(
-      new RegExp(`from\\s+["']${escapeRegExp(localAgentKitPath)}["']`, "g"),
-      `from ${shimImport}`,
-    );
-
-  await writeFile(shimPath, renderEdgeShim());
-  await writeFile(bundleConfigPath, patchedSource);
-  return { configPath: bundleConfigPath, shimPath, cleanupPaths: [bundleConfigPath, shimPath] };
-}
-
-function renderEdgeShim(): string {
-  return `export function defineAgent(config) {
-  return config;
-}
-
-export function defineTool(tool) {
-  return tool;
-}
-
-export function composioManaged(input) {
-  const name = normalizeIntegrationName(input.name ?? "composio", "composio integration name");
-  const toolkits = normalizeToolkitList(input.toolkits, "composioManaged.toolkits");
-  const tools = input.tools ? normalizeComposioToolMap(input.tools, toolkits) : undefined;
-  const tags = input.tags ? normalizeIntegrationTags(input.tags) : undefined;
-  const confirmExternalWrites =
-    input.confirmExternalWrites === undefined ? undefined : Boolean(input.confirmExternalWrites);
-
-  return {
-    type: "composio",
-    provider: "composio",
-    mode: "managed",
-    name,
-    toolkits,
-    ...(tools ? { tools } : {}),
-    ...(tags ? { tags } : {}),
-    ...(confirmExternalWrites === undefined ? {} : { confirmExternalWrites }),
-  };
-}
-
-export function websiteChannel(input) {
-  return {
-    type: "website",
-    provider: "agentkit",
-    name: input.name,
-    access: input.access ?? { mode: "token" },
-    secrets: normalizeChannelSecrets(input.secrets ?? ["AGENTKIT_WEBSITE_CHANNEL_TOKEN"], "website channel"),
-    ...(input.limits ? { limits: input.limits } : {}),
-    ...(input.buffer ? { buffer: normalizeChannelBuffer(input.buffer, "website channel") } : {}),
-  };
-}
-
-export function telegramChannel(input) {
-  return {
-    type: "telegram",
-    provider: "telegram",
-    name: input.name,
-    secrets: normalizeChannelSecrets(input.secrets ?? ["TELEGRAM_BOT_TOKEN", "TELEGRAM_WEBHOOK_SECRET"], "telegram channel"),
-    allowedUpdates: input.allowedUpdates ?? ["message"],
-    ...(input.limits ? { limits: input.limits } : {}),
-    ...(input.buffer ? { buffer: normalizeChannelBuffer(input.buffer, "telegram channel") } : {}),
-  };
-}
-
-export function whatsappChannel(input) {
-  return {
-    type: "whatsapp",
-    provider: input.provider,
-    name: input.name,
-    secrets: normalizeChannelSecrets(input.secrets ?? defaultWhatsappChannelSecrets(input.provider), \`\${input.provider} whatsapp channel\`),
-    ...(input.limits ? { limits: input.limits } : {}),
-    ...(input.buffer ? { buffer: normalizeChannelBuffer(input.buffer, \`\${input.provider} whatsapp channel\`) } : {}),
-  };
-}
-
-export function discordChannel(input) {
-  return {
-    type: "discord",
-    provider: "discord",
-    name: input.name,
-    secrets: normalizeChannelSecrets(input.secrets ?? ["DISCORD_PUBLIC_KEY"], "discord channel"),
-    ...(input.limits ? { limits: input.limits } : {}),
-    ...(input.buffer ? { buffer: normalizeChannelBuffer(input.buffer, "discord channel") } : {}),
-  };
-}
-
-export function slackChannel(input) {
-  return {
-    type: "slack",
-    provider: "slack",
-    name: input.name,
-    secrets: normalizeChannelSecrets(input.secrets ?? ["SLACK_BOT_TOKEN", "SLACK_SIGNING_SECRET"], "slack channel"),
-    ...(input.limits ? { limits: input.limits } : {}),
-    ...(input.buffer ? { buffer: normalizeChannelBuffer(input.buffer, "slack channel") } : {}),
-  };
-}
-
-export function webhookChannel(input) {
-  return {
-    type: "webhook",
-    provider: "generic",
-    direction: "inbound",
-    name: input.name,
-    secrets: normalizeChannelSecrets(input.secrets ?? ["AGENTKIT_WEBHOOK_SECRET"], "generic webhook channel"),
-    ...(input.limits ? { limits: input.limits } : {}),
-    ...(input.buffer ? { buffer: normalizeChannelBuffer(input.buffer, "generic webhook channel") } : {}),
-    ...(input.replyTo ? { replyTo: normalizeChannelReplyRoute(input.replyTo, "generic webhook channel") } : {}),
-  };
-}
-
-export function webhookOutputChannel(input) {
-  const auth = normalizeGenericWebhookOutputAuth(input.auth ?? { type: "none" }, "generic webhook output channel");
-  const requiredSecrets = [
-    input.urlSecret,
-    ...genericWebhookOutputAuthSecrets(auth),
-    ...(input.secrets ?? []),
-  ];
-
-  return {
-    type: "webhook",
-    provider: "generic",
-    direction: "outbound",
-    name: input.name,
-    urlSecret: normalizeSecretName(input.urlSecret, "generic webhook output channel urlSecret"),
-    auth,
-    secrets: normalizeChannelSecrets(requiredSecrets, "generic webhook output channel"),
-    ...(input.limits ? { limits: input.limits } : {}),
-  };
-}
-
-function defaultWhatsappChannelSecrets(provider) {
-  if (provider === "zapster") {
-    return ["ZAPSTER_API_KEY", "ZAPSTER_INSTANCE_ID", "ZAPSTER_WEBHOOK_ID", "ZAPSTER_WEBHOOK_TOKEN"];
-  }
-
-  if (provider === "uazapi") {
-    return ["UAZAPI_BASE_URL", "UAZAPI_TOKEN", "UAZAPI_WEBHOOK_TOKEN"];
-  }
-
-  if (provider === "evolution") {
-    return ["EVOLUTION_API_BASE_URL", "EVOLUTION_API_KEY", "EVOLUTION_INSTANCE_NAME", "EVOLUTION_WEBHOOK_TOKEN"];
-  }
-
-  return ["META_WHATSAPP_ACCESS_TOKEN", "META_WHATSAPP_APP_SECRET", "META_WHATSAPP_VERIFY_TOKEN"];
-}
-
-function normalizeChannelSecrets(secrets, context) {
-  const uniqueSecrets = new Set();
-
-  for (const secret of secrets) {
-    uniqueSecrets.add(normalizeSecretName(secret, \`\${context} secrets\`));
-  }
-
-  return Array.from(uniqueSecrets).sort();
-}
-
-function normalizeSecretName(secret, context) {
-  if (!/^[A-Z_][A-Z0-9_]*$/.test(secret)) {
-    if (context.endsWith("secrets")) {
-      throw new Error(\`\${context} must be environment variable names, not secret values.\`);
-    }
-
-    throw new Error(\`\${context} must be an environment variable name, not a secret value.\`);
-  }
-
-  return secret;
-}
-
-function normalizeChannelReplyRoute(input, context) {
-  const channel = input.channel.trim();
-
-  if (!/^[a-z][a-z0-9-]*$/.test(channel)) {
-    throw new Error(\`\${context} replyTo.channel must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens.\`);
-  }
-
-  return {
-    channel,
-    ...(input.recipientFrom ? { recipientFrom: normalizeJsonPath(input.recipientFrom, \`\${context} replyTo.recipientFrom\`) } : {}),
-  };
-}
-
-function normalizeJsonPath(value, context) {
-  const path = value.trim().replace(/^payload\\./, "");
-
-  if (!/^[A-Za-z_][A-Za-z0-9_]*(?:\\.[A-Za-z_][A-Za-z0-9_]*)*$/.test(path)) {
-    throw new Error(\`\${context} must be a dotted JSON field path such as "phone" or "customer.phone".\`);
-  }
-
-  return path;
-}
-
-function normalizeGenericWebhookOutputAuth(auth, context) {
-  if (auth.type === "none") {
-    return { type: "none" };
-  }
-
-  if (auth.type === "bearer") {
-    return {
-      type: "bearer",
-      tokenSecret: normalizeSecretName(auth.tokenSecret, \`\${context} auth.tokenSecret\`),
-    };
-  }
-
-  if (auth.type === "header") {
-    if (!/^[A-Za-z][A-Za-z0-9-]*$/.test(auth.headerName)) {
-      throw new Error(\`\${context} auth.headerName must be an HTTP header name.\`);
-    }
-
-    return {
-      type: "header",
-      headerName: auth.headerName,
-      valueSecret: normalizeSecretName(auth.valueSecret, \`\${context} auth.valueSecret\`),
-    };
-  }
-
-  if (auth.type === "hmac") {
-    if (auth.headerName !== undefined && !/^[A-Za-z][A-Za-z0-9-]*$/.test(auth.headerName)) {
-      throw new Error(\`\${context} auth.headerName must be an HTTP header name.\`);
-    }
-
-    return {
-      type: "hmac",
-      secret: normalizeSecretName(auth.secret, \`\${context} auth.secret\`),
-      ...(auth.headerName ? { headerName: auth.headerName } : {}),
-    };
-  }
-
-  throw new Error(\`\${context} auth.type must be "none", "bearer", "header", or "hmac".\`);
-}
-
-function genericWebhookOutputAuthSecrets(auth) {
-  if (auth.type === "bearer") {
-    return [auth.tokenSecret];
-  }
-
-  if (auth.type === "header") {
-    return [auth.valueSecret];
-  }
-
-  if (auth.type === "hmac") {
-    return [auth.secret];
-  }
-
-  return [];
-}
-
-function normalizeIntegrationName(value, context) {
-  const name = value.trim();
-
-  if (!/^[a-z][a-z0-9-]*$/.test(name)) {
-    throw new Error(\`\${context} must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens.\`);
-  }
-
-  return name;
-}
-
-function normalizeToolkitList(values, context) {
-  if (!Array.isArray(values) || values.length === 0) {
-    throw new Error(\`\${context} must include at least one toolkit slug.\`);
-  }
-
-  const toolkits = new Set();
-
-  for (const value of values) {
-    if (typeof value !== "string") {
-      throw new Error(\`\${context} entries must be toolkit slug strings.\`);
-    }
-
-    const toolkit = value.trim().toLowerCase();
-
-    if (!/^[a-z][a-z0-9_-]*$/.test(toolkit)) {
-      throw new Error(\`\${context} entries must start with a letter and contain only letters, numbers, underscores, and hyphens.\`);
-    }
-
-    toolkits.add(toolkit);
-  }
-
-  return Array.from(toolkits).sort();
-}
-
-function normalizeComposioToolMap(values, toolkits) {
-  const toolkitSet = new Set(toolkits);
-  const normalized = {};
-
-  for (const [rawToolkit, rawTools] of Object.entries(values)) {
-    const toolkit = rawToolkit.trim().toLowerCase();
-
-    if (!toolkitSet.has(toolkit)) {
-      throw new Error(\`composioManaged.tools.\${rawToolkit} must reference a toolkit listed in composioManaged.toolkits.\`);
-    }
-
-    if (!Array.isArray(rawTools) || rawTools.length === 0) {
-      throw new Error(\`composioManaged.tools.\${rawToolkit} must include at least one Composio action slug.\`);
-    }
-
-    const tools = new Set();
-
-    for (const rawTool of rawTools) {
-      if (typeof rawTool !== "string") {
-        throw new Error(\`composioManaged.tools.\${rawToolkit} entries must be Composio action slug strings.\`);
-      }
-
-      const tool = rawTool.trim().toUpperCase();
-
-      if (!/^[A-Z][A-Z0-9_]*$/.test(tool)) {
-        throw new Error(\`composioManaged.tools.\${rawToolkit} entries must be uppercase Composio action slugs.\`);
-      }
-
-      tools.add(tool);
-    }
-
-    normalized[toolkit] = Array.from(tools).sort();
-  }
-
-  return Object.keys(normalized).length > 0 ? normalized : undefined;
-}
-
-function normalizeIntegrationTags(tags) {
-  const normalized = {};
-
-  if (tags.enable !== undefined) {
-    normalized.enable = normalizeTagList(tags.enable, "composioManaged.tags.enable");
-  }
-
-  if (tags.disable !== undefined) {
-    normalized.disable = normalizeTagList(tags.disable, "composioManaged.tags.disable");
-  }
-
-  return normalized;
-}
-
-function normalizeTagList(values, context) {
-  if (!Array.isArray(values)) {
-    throw new Error(\`\${context} must be an array of tag strings.\`);
-  }
-
-  return Array.from(new Set(values.map((value) => {
-    if (typeof value !== "string" || value.trim().length === 0) {
-      throw new Error(\`\${context} entries must be non-empty strings.\`);
-    }
-
-    return value.trim();
-  }))).sort();
-}
-
-function normalizeChannelBuffer(input, context) {
-  if (input.mode === "off") {
-    return { mode: "off" };
-  }
-
-  if (input.mode !== undefined && input.mode !== "debounce") {
-    throw new Error(\`\${context} buffer.mode must be "off" or "debounce".\`);
-  }
-
-  const buffer = {
-    mode: "debounce",
-    quietWindowMs: input.quietWindowMs ?? 2500,
-    maxWaitMs: input.maxWaitMs ?? 12000,
-    maxMessages: input.maxMessages ?? 20,
-    maxChars: input.maxChars ?? 8000,
-  };
-
-  for (const field of ["quietWindowMs", "maxWaitMs", "maxMessages", "maxChars"]) {
-    if (!Number.isInteger(buffer[field]) || buffer[field] <= 0) {
-      throw new Error(\`\${context} buffer.\${field} must be a positive integer.\`);
-    }
-  }
-
-  if (buffer.maxWaitMs < buffer.quietWindowMs) {
-    throw new Error(\`\${context} buffer.maxWaitMs must be greater than or equal to buffer.quietWindowMs.\`);
-  }
-
-  return buffer;
-}
-`;
-}
-
-function escapeRegExp(value: string): string {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-
-async function bundleCloudflareWorker(entryPath: string, workerPath: string, edgeShimPath: string): Promise<void> {
-  const localAgentKitPath = resolve(moduleDir, "../../../index.ts");
-  const localAgentKitFileUrl = pathToFileURL(localAgentKitPath).href;
-  const localAgentKitImportPattern = new RegExp(
-    `^(?:${escapeRegExp(localAgentKitPath)}|${escapeRegExp(localAgentKitFileUrl)})$`,
-  );
-
-  try {
-    const result = await esbuild({
-      entryPoints: [entryPath],
-      bundle: true,
-      platform: "browser",
-      format: "esm",
-      target: "es2022",
-      external: ["cloudflare:workers"],
-      minify: true,
-      write: false,
-      logLevel: "silent",
-      plugins: [
-        {
-          name: "agentkit-edge-shim",
-          setup(build) {
-            build.onResolve({ filter: /^@andreprado\/agentkit$/ }, () => ({
-              path: edgeShimPath,
-            }));
-            build.onResolve({ filter: localAgentKitImportPattern }, () => ({
-              path: edgeShimPath,
-            }));
-          },
-        } satisfies Plugin,
-      ],
-    });
-
-    const output = result.outputFiles?.[0];
-
-    if (!output) {
-      throw new Error("No bundle was emitted.");
-    }
-
-    const processShim = "var process = globalThis.process ?? (globalThis.process = { env: {}, versions: {} });\n";
-    await writeFile(workerPath, processShim + output.text);
-  } catch (error) {
-    throw new AgentKitError(
-      "edge_bundle_failed",
-      `Could not bundle Agent Capsule for Cloudflare Workers. ${formatBuildError(error)}`,
-      { cause: error },
-    );
-  }
-}
-
-function formatBuildError(error: unknown): string {
-  if (error && typeof error === "object" && "errors" in error && Array.isArray(error.errors)) {
-    const messages = error.errors.map((log) => String(log?.text ?? log?.message ?? "")).filter(Boolean);
-    if (messages.length > 0) {
-      return messages.join("\n");
-    }
-  }
-
-  return error instanceof Error ? error.message : String(error);
-}
-
-function renderCloudflareWorker(input: { manifest: AgentManifest; instructions: string; configPath: string }): string {
-  const manifestJson = JSON.stringify(input.manifest, null, 2);
-  const instructionsJson = JSON.stringify(input.instructions);
-  const configImportPath = JSON.stringify(input.configPath);
-  const providerImportPath = JSON.stringify(resolve(moduleDir, "../../../providers/index.ts"));
-  const composioIntegrationImportPath = JSON.stringify(resolve(moduleDir, "../../integrations/composio.ts"));
-  const promptContextImportPath = JSON.stringify(resolve(moduleDir, "../../prompt-context.ts"));
-
-  return `import { DurableObject } from "cloudflare:workers";
-import agentConfig from ${configImportPath};
-import { getProviderAdapter } from ${providerImportPath};
-import { MANAGED_COMPOSIO_USER_ID_BINDING, createManagedComposioTools } from ${composioIntegrationImportPath};
-import { appendRuntimePromptContext, buildRuntimeClockContext } from ${promptContextImportPath};
-
-const manifest = ${manifestJson};
-const instructions = ${instructionsJson};
-const hostedKnowledgeTool = manifest.knowledge.enabled ? createHostedKnowledgeSearchTool() : null;
-const DEFAULT_TOOL_TIMEOUT_MS = 30000;
-
-export class AgentKitConversationStore extends DurableObject {
-  constructor(ctx, env) {
-    super(ctx, env);
-    this.sql = ctx.storage.sql;
-    this.sql.exec(\`
-      CREATE TABLE IF NOT EXISTS conversations (
-        id TEXT PRIMARY KEY,
-        agent_name TEXT NOT NULL,
-        title TEXT,
-        created_at TEXT NOT NULL,
-        updated_at TEXT NOT NULL
-      );
-      CREATE TABLE IF NOT EXISTS messages (
-        id TEXT PRIMARY KEY,
-        conversation_id TEXT NOT NULL,
-        role TEXT NOT NULL,
-        content TEXT NOT NULL,
-        created_at TEXT NOT NULL
-      );
-      CREATE TABLE IF NOT EXISTS runs (
-        id TEXT PRIMARY KEY,
-        conversation_id TEXT NOT NULL,
-        provider TEXT NOT NULL,
-        model TEXT NOT NULL,
-        status TEXT NOT NULL,
-        error_code TEXT,
-        error_message TEXT,
-        input_tokens INTEGER,
-        output_tokens INTEGER,
-        total_tokens INTEGER,
-        cost_json TEXT,
-        created_at TEXT NOT NULL,
-        completed_at TEXT
-      );
-      CREATE TABLE IF NOT EXISTS tool_calls (
-        id TEXT PRIMARY KEY,
-        run_id TEXT NOT NULL,
-        conversation_id TEXT NOT NULL,
-        tool_name TEXT NOT NULL,
-        visibility TEXT NOT NULL,
-        status TEXT NOT NULL,
-        input_json TEXT NOT NULL,
-        output_json TEXT,
-        rendered_json TEXT,
-        error_message TEXT,
-        created_at TEXT NOT NULL,
-        completed_at TEXT
-      );
-    \`);
-    try {
-      this.sql.exec("ALTER TABLE tool_calls ADD COLUMN rendered_json TEXT");
-    } catch {
-      // Existing Durable Object tables either already have this column or do not need migration.
-    }
-    for (const statement of [
-      "ALTER TABLE runs ADD COLUMN input_tokens INTEGER",
-      "ALTER TABLE runs ADD COLUMN output_tokens INTEGER",
-      "ALTER TABLE runs ADD COLUMN total_tokens INTEGER",
-      "ALTER TABLE runs ADD COLUMN cost_json TEXT",
-    ]) {
-      try {
-        this.sql.exec(statement);
-      } catch {
-        // Existing Durable Object tables either already have this column or do not need migration.
-      }
-    }
-  }
-
-  async fetch(request) {
-    const url = new URL(request.url);
-
-    if (request.method === "POST" && url.pathname === "/messages") {
-      return this.persistMessages(await request.json());
-    }
-
-    if (request.method === "GET" && url.pathname === "/messages") {
-      return this.getMessages(url.searchParams.get("conversationId"));
-    }
-
-    if (request.method === "GET" && url.pathname === "/conversations") {
-      return this.listConversations();
-    }
-
-    const conversationTraceMatch = url.pathname.match(/^\\/conversations\\/([^/]+)\\/trace$/);
-
-    if (request.method === "GET" && conversationTraceMatch) {
-      return this.getConversationTrace(decodeURIComponent(conversationTraceMatch[1] || ""));
-    }
-
-    const conversationMatch = url.pathname.match(/^\\/conversations\\/([^/]+)$/);
-
-    if (request.method === "GET" && conversationMatch) {
-      return this.getConversation(decodeURIComponent(conversationMatch[1] || ""));
-    }
-
-    return Response.json({ error: { code: "not_found", message: "Unknown Durable Object route." } }, { status: 404 });
-  }
-
-  getMessages(conversationId) {
-    if (!conversationId) {
-      return Response.json({ messages: [] });
-    }
-
-    const rows = this.sql.exec(
-      "SELECT role, content FROM messages WHERE conversation_id = ? ORDER BY rowid ASC",
-      String(conversationId),
-    ).toArray();
-
-    return Response.json({
-      messages: rows
-        .filter((row) => row.role === "user" || row.role === "assistant")
-        .map((row) => ({
-          role: String(row.role),
-          content: String(row.content),
-        })),
-    });
-  }
-
-  listConversations() {
-    const rows = this.sql.exec(\`
-      SELECT conversations.id, conversations.agent_name, conversations.title, conversations.created_at, conversations.updated_at, COUNT(messages.id) AS message_count
-      FROM conversations
-      LEFT JOIN messages ON messages.conversation_id = conversations.id
-      GROUP BY conversations.id, conversations.agent_name, conversations.title, conversations.created_at, conversations.updated_at
-      ORDER BY conversations.updated_at DESC
-    \`).toArray();
-
-    return Response.json({
-      conversations: rows.map((row) => ({
-        id: String(row.id),
-        agentName: String(row.agent_name),
-        title: row.title === null || row.title === undefined ? null : String(row.title),
-        createdAt: String(row.created_at),
-        updatedAt: String(row.updated_at),
-        messageCount: Number(row.message_count || 0),
-      })),
-    });
-  }
-
-  getConversation(conversationId) {
-    const conversation = this.readConversation(conversationId);
-
-    if (!conversation) {
-      return Response.json(
-        { error: { code: "conversation_not_found", message: \`Conversation "\${conversationId}" was not found.\` } },
-        { status: 404 },
-      );
-    }
-
-    return Response.json(conversation);
-  }
-
-  getConversationTrace(conversationId) {
-    const conversation = this.readConversation(conversationId);
-
-    if (!conversation) {
-      return Response.json(
-        { error: { code: "conversation_not_found", message: \`Conversation "\${conversationId}" was not found.\` } },
-        { status: 404 },
-      );
-    }
-
-    const runs = this.sql.exec(
-      "SELECT id, conversation_id, provider, model, status, error_code, error_message, input_tokens, output_tokens, total_tokens, cost_json, created_at, completed_at FROM runs WHERE conversation_id = ? ORDER BY rowid ASC",
-      conversationId,
-    ).toArray();
-
-    return Response.json({
-      ...conversation,
-      runs: runs.map((run) => ({
-        id: String(run.id),
-        conversationId: String(run.conversation_id),
-        provider: String(run.provider),
-        model: String(run.model),
-        status: String(run.status),
-        errorCode: run.error_code === null || run.error_code === undefined ? null : String(run.error_code),
-        errorMessage: run.error_message === null || run.error_message === undefined ? null : String(run.error_message),
-        usage: readStoredUsage(run),
-        startedAt: String(run.created_at),
-        completedAt: run.completed_at === null || run.completed_at === undefined ? null : String(run.completed_at),
-        toolCalls: this.readToolCalls(String(run.id)),
-      })),
-    });
-  }
-
-  readConversation(conversationId) {
-    if (!conversationId) {
-      return null;
-    }
-
-    const row = this.sql.exec(
-      "SELECT id, agent_name, title, created_at, updated_at FROM conversations WHERE id = ?",
-      conversationId,
-    ).one();
-
-    if (!row) {
-      return null;
-    }
-
-    const messages = this.sql.exec(
-      "SELECT id, conversation_id, role, content, created_at FROM messages WHERE conversation_id = ? ORDER BY rowid ASC",
-      conversationId,
-    ).toArray();
-
-    return {
-      id: String(row.id),
-      agentName: String(row.agent_name),
-      title: row.title === null || row.title === undefined ? null : String(row.title),
-      createdAt: String(row.created_at),
-      updatedAt: String(row.updated_at),
-      messages: messages.map((message) => ({
-        id: String(message.id),
-        conversationId: String(message.conversation_id),
-        role: String(message.role),
-        content: String(message.content),
-        createdAt: String(message.created_at),
-      })),
-    };
-  }
-
-  readToolCalls(runId) {
-    const rows = this.sql.exec(
-      "SELECT id, run_id, conversation_id, tool_name, visibility, status, input_json, output_json, rendered_json, error_message, created_at, completed_at FROM tool_calls WHERE run_id = ? ORDER BY rowid ASC",
-      runId,
-    ).toArray();
-
-    return rows.map((row) => ({
-      id: String(row.id),
-      runId: String(row.run_id),
-      conversationId: String(row.conversation_id),
-      name: String(row.tool_name),
-      visibility: String(row.visibility),
-      status: String(row.status),
-      input: parseStoredJson(row.input_json, {}),
-      output: row.output_json === null || row.output_json === undefined ? undefined : parseStoredJson(row.output_json, null),
-      rendered: row.rendered_json === null || row.rendered_json === undefined ? undefined : parseStoredJson(row.rendered_json, null),
-      errorMessage: row.error_message === null || row.error_message === undefined ? null : String(row.error_message),
-      createdAt: String(row.created_at),
-      completedAt: row.completed_at === null || row.completed_at === undefined ? null : String(row.completed_at),
-    }));
-  }
-
-  persistMessages(input) {
-    const now = new Date().toISOString();
-    const conversationId = String(input.conversationId || crypto.randomUUID());
-    const runId = crypto.randomUUID();
-    const userMessageId = crypto.randomUUID();
-    const assistantMessageId = crypto.randomUUID();
-    const title = titleFromMessage(String(input.userMessage || ""));
-    const usage = normalizeRuntimeUsage(input.usage);
-
-    this.sql.exec(
-      "INSERT OR IGNORE INTO conversations (id, agent_name, title, created_at, updated_at) VALUES (?, ?, ?, ?, ?)",
-      conversationId,
-      manifest.name,
-      title,
-      now,
-      now,
-    );
-    this.sql.exec("UPDATE conversations SET updated_at = ? WHERE id = ?", now, conversationId);
-    this.sql.exec(
-      "INSERT INTO messages (id, conversation_id, role, content, created_at) VALUES (?, ?, ?, ?, ?)",
-      userMessageId,
-      conversationId,
-      "user",
-      String(input.userMessage || ""),
-      now,
-    );
-    this.sql.exec(
-      "INSERT INTO runs (id, conversation_id, provider, model, status, error_code, error_message, input_tokens, output_tokens, total_tokens, cost_json, created_at, completed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
-      runId,
-      conversationId,
-      manifest.provider.name,
-      manifest.provider.model,
-      String(input.status || "completed"),
-      input.errorCode ? String(input.errorCode) : null,
-      input.errorMessage ? String(input.errorMessage) : null,
-      usage.inputTokens ?? null,
-      usage.outputTokens ?? null,
-      usage.totalTokens ?? null,
-      usage.cost && Object.keys(usage.cost).length > 0 ? JSON.stringify(usage.cost) : null,
-      now,
-      now,
-    );
-
-    if (input.assistantMessage !== undefined) {
-      this.sql.exec(
-        "INSERT INTO messages (id, conversation_id, role, content, created_at) VALUES (?, ?, ?, ?, ?)",
-        assistantMessageId,
-        conversationId,
-        "assistant",
-        String(input.assistantMessage || ""),
-        now,
-      );
-    }
-
-    for (const toolCall of input.toolCalls || []) {
-      this.sql.exec(
-        "INSERT INTO tool_calls (id, run_id, conversation_id, tool_name, visibility, status, input_json, output_json, rendered_json, error_message, created_at, completed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
-        String(toolCall.id || crypto.randomUUID()),
-        runId,
-        conversationId,
-        String(toolCall.name || ""),
-        String(toolCall.visibility || "user"),
-        String(toolCall.status || "completed"),
-        JSON.stringify(toolCall.input ?? {}),
-        toolCall.output === undefined ? null : JSON.stringify(toolCall.output),
-        toolCall.rendered === undefined ? null : JSON.stringify(toolCall.rendered),
-        toolCall.errorMessage ? String(toolCall.errorMessage) : null,
-        now,
-        now,
-      );
-    }
-
-    return Response.json({
-      conversationId,
-      runId,
-      userMessageId,
-      assistantMessageId: input.assistantMessage === undefined ? null : assistantMessageId,
-    });
-  }
-}
-
-export default {
-  async fetch(request, env, ctx) {
-    const url = new URL(request.url);
-
-    if (request.method === "GET" && url.pathname === "/_agentkit") {
-      const auth = authorizeAdmin(request, env);
-
-      if (auth) {
-        return auth;
-      }
-
-      const hostedTools = createHostedTools(env);
-
-      return Response.json({
-        agent: manifest.name,
-        runtime: manifest.runtime,
-        target: manifest.target,
-        provider: manifest.provider,
-        prompt: manifest.prompt,
-        tools: hostedTools.map((tool) => tool.name),
-        integrations: hostedIntegrations(env),
-        channels: manifest.channels.map((channel) => ({
-          name: channel.name,
-          type: channel.type,
-          provider: channel.provider,
-          secrets: channel.secrets,
-        })),
-        knowledge: manifest.knowledge,
-        access: manifest.access,
-        storage: manifest.storage,
-        database: inspectHostedDatabase(),
-        secrets: Object.fromEntries(manifest.secrets.map((name) => [name, env[name] ? "set" : "missing"])),
-        managedSecrets: hostedManagedSecrets(),
-        userSecrets: manifest.secrets.filter((name) => !hostedManagedSecrets().includes(name)),
-      });
-    }
-
-    if (request.method === "GET" && url.pathname === "/") {
-      const auth = await authorizeDeployAccess(request, env, {}, {
-        notConfiguredCode: "cloud_access_not_configured",
-        notConfiguredMessage: "Hosted AgentKit Cloud routes require a deploy access token gate.",
-      });
-
-      if (auth) {
-        return auth;
-      }
-
-      return Response.json({
-        agent: manifest.name,
-        status: "ready",
-        inspect: "/_agentkit",
-        chat: "/chat",
-      });
-    }
-
-    if (request.method === "GET" && url.pathname === "/health") {
-      const auth = await authorizeDeployAccess(request, env, {}, {
-        notConfiguredCode: "cloud_access_not_configured",
-        notConfiguredMessage: "Hosted AgentKit Cloud routes require a deploy access token gate.",
-      });
-
-      if (auth) {
-        return auth;
-      }
-
-      return Response.json({ ok: true });
-    }
-
-    if (isHostedChannelWebhookPath(url.pathname)) {
-      return forwardHostedChannelWebhook(request, env, url);
-    }
-
-    if (request.method === "POST" && (url.pathname === "/chat" || url.pathname === "/v1/chat")) {
-      return handleChat(request, env, ctx);
-    }
-
-    if (request.method === "GET" && (url.pathname === "/conversations" || url.pathname === "/v1/conversations")) {
-      return handleConversationRead(request, env, "list");
-    }
-
-    const conversationTraceMatch = url.pathname.match(/^\\/(?:v1\\/)?conversations\\/([^/]+)\\/trace$/);
-
-    if (request.method === "GET" && conversationTraceMatch) {
-      return handleConversationRead(request, env, "trace", decodeURIComponent(conversationTraceMatch[1] || ""));
-    }
-
-    const conversationMatch = url.pathname.match(/^\\/(?:v1\\/)?conversations\\/([^/]+)$/);
-
-    if (request.method === "GET" && conversationMatch) {
-      return handleConversationRead(request, env, "show", decodeURIComponent(conversationMatch[1] || ""));
-    }
-
-    if (request.method === "POST" && url.pathname.startsWith("/tools/")) {
-      return handleTool(request, env, decodeURIComponent(url.pathname.slice("/tools/".length)));
-    }
-
-    if (url.pathname.startsWith("/files/")) {
-      return handleFile(request, env, url.pathname.slice("/files/".length));
-    }
-
-    return Response.json({ error: { code: "not_found", message: "Unknown AgentKit route." } }, { status: 404 });
-  },
-};
-
-function isHostedChannelWebhookPath(pathname) {
-  return (
-    /^\\/channels\\/[^/]+\\/(?:website\\/agentkit|telegram\\/telegram|whatsapp\\/(?:zapster|meta|uazapi|evolution)|discord\\/discord|slack\\/slack|webhook\\/generic)\\/webhook$/.test(pathname) ||
-    /^\\/channels\\/[^/]+\\/(?:website|telegram|discord|slack|webhook)\\/webhook$/.test(pathname) ||
-    /^\\/channels\\/[^/]+\\/webhook$/.test(pathname) ||
-    /^\\/channels\\/[^/]+\\/whatsapp\\/(?:zapster|meta|uazapi|evolution)\\/webhook$/.test(pathname)
-  );
-}
-
-async function forwardHostedChannelWebhook(request, env, url) {
-  if (!env.AGENTKIT_CLOUD_API_URL) {
-    return Response.json(
-      {
-        error: {
-          code: "channel_webhook_proxy_not_configured",
-          message: "Hosted channel webhooks require AGENTKIT_CLOUD_API_URL on the deployed Worker.",
-        },
-      },
-      { status: 501 },
-    );
-  }
-
-  const target = new URL(\`\${url.pathname}\${url.search}\`, env.AGENTKIT_CLOUD_API_URL);
-  const headers = new Headers(request.headers);
-  headers.delete("host");
-  headers.delete("content-length");
-
-  if (env.AGENTKIT_DEPLOY_ID) {
-    headers.set("X-AgentKit-Deploy-ID", env.AGENTKIT_DEPLOY_ID);
-  }
-
-  if (env.AGENTKIT_RUNTIME_GATE_TOKEN) {
-    headers.set("X-AgentKit-Runtime-Gate", env.AGENTKIT_RUNTIME_GATE_TOKEN);
-  }
-
-  return fetch(target.href, {
-    method: request.method,
-    headers,
-    body: request.method === "GET" || request.method === "HEAD" ? undefined : request.body,
-    redirect: "manual",
-  });
-}
-
-async function handleFile(request, env, rawKey) {
-  const auth = authorizeAdmin(request, env);
-
-  if (auth) {
-    return auth;
-  }
-
-  if (manifest.storage.files.driver !== "r2") {
-    return Response.json({ error: { code: "files_not_configured", message: "R2 files are not configured." } }, { status: 404 });
-  }
-
-  if (!env.AGENTKIT_FILES) {
-    return Response.json(
-      { error: { code: "deploy_not_ready", message: "AGENTKIT_FILES R2 binding is not configured." } },
-      { status: 503 },
-    );
-  }
-
-  const key = objectKey(rawKey);
-
-  if (!key) {
-    return Response.json({ error: { code: "validation_error", message: "file key must be non-empty." } }, { status: 400 });
-  }
-
-  if (request.method === "PUT" || request.method === "POST") {
-    const contentLengthHeader = request.headers.get("content-length");
-
-    if (contentLengthHeader === null) {
-      return Response.json(
-        { error: { code: "length_required", message: "File upload requires content-length." } },
-        { status: 411 },
-      );
-    }
-
-    const contentLength = Number(contentLengthHeader);
-
-    if (!Number.isFinite(contentLength) || contentLength < 0) {
-      return Response.json(
-        { error: { code: "validation_error", message: "content-length must be a valid non-negative number." } },
-        { status: 400 },
-      );
-    }
-
-    if (contentLength > manifest.storage.files.maxUploadBytes) {
-      return Response.json(
-        { error: { code: "payload_too_large", message: "File exceeds configured maxUploadBytes." } },
-        { status: 413 },
-      );
-    }
-
-    const body = await request.arrayBuffer();
-
-    if (body.byteLength > manifest.storage.files.maxUploadBytes) {
-      return Response.json(
-        { error: { code: "payload_too_large", message: "File exceeds configured maxUploadBytes." } },
-        { status: 413 },
-      );
-    }
-
-    await env.AGENTKIT_FILES.put(key, body, {
-      httpMetadata: {
-        contentType: request.headers.get("content-type") || "application/octet-stream",
-      },
-      customMetadata: {
-        agent: manifest.name,
-      },
-    });
-
-    return Response.json({ key, bucket: manifest.storage.files.bucket });
-  }
-
-  if (request.method === "GET") {
-    const object = await env.AGENTKIT_FILES.get(key);
-
-    if (!object) {
-      return Response.json({ error: { code: "not_found", message: "File not found." } }, { status: 404 });
-    }
-
-    const headers = new Headers();
-    object.writeHttpMetadata(headers);
-    headers.set("etag", object.httpEtag);
-    return new Response(object.body, { headers });
-  }
-
-  if (request.method === "DELETE") {
-    await env.AGENTKIT_FILES.delete(key);
-    return Response.json({ key, deleted: true });
-  }
-
-  return Response.json({ error: { code: "method_not_allowed", message: "Unsupported file method." } }, { status: 405 });
-}
-
-async function handleTool(request, env, toolName) {
-  const auth = authorizeAdmin(request, env);
-
-  if (auth) {
-    return auth;
-  }
-
-  let body;
-
-  try {
-    body = await request.json();
-  } catch {
-    return Response.json(
-      { error: { code: "validation_error", message: "Expected JSON body with optional input field." } },
-      { status: 400 },
-    );
-  }
-
-  try {
-    const result = await executeHostedTool({
-      name: toolName,
-      input: isRecord(body) && "input" in body ? body.input : body ?? {},
-      env,
-      signal: request.signal,
-      invocation: "tool",
-    });
-
-    return Response.json({
-      tool: {
-        id: result.id,
-        name: result.name,
-        visibility: result.visibility,
-      },
-      input: result.input,
-      output: result.output,
-      ...(result.rendered ? { rendered: result.rendered } : {}),
-    });
-  } catch (error) {
-    return hostedErrorResponse(error);
-  }
-}
-
-async function handleChat(request, env, ctx) {
-  let body;
-
-  try {
-    body = await request.json();
-  } catch {
-    return Response.json(
-      { error: { code: "validation_error", message: "Expected JSON body with a message field." } },
-      { status: 400 },
-    );
-  }
-
-  const auth = await authorizeChat(request, env, body);
-
-  if (auth) {
-    return auth;
-  }
-
-  const message = readChatMessage(body);
-
-  if (!message) {
-    return Response.json(
-      { error: { code: "validation_error", message: "message must be a non-empty string." } },
-      { status: 400 },
-    );
-  }
-
-  let conversationId;
-
-  try {
-    conversationId = normalizeConversationId(body.conversationId) ?? crypto.randomUUID();
-  } catch (error) {
-    return hostedErrorResponse(error);
-  }
-
-  const previousMessages = await loadConversationMessages(env, conversationId).catch(() => []);
-  let content;
-  let providerResult;
-  const toolCalls = [];
-
-  try {
-    providerResult = await callHostedProvider(env, [...previousMessages, { role: "user", content: message }], request.signal, toolCalls);
-    content = providerResult.content;
-  } catch (error) {
-    const persisted = await persistFailure(env, conversationId, message, error, toolCalls);
-    queueRuntimeUsage(ctx, sendRuntimeUsage(env, {
-      kind: "chat_run",
-      status: "failed",
-      conversationId,
-      runId: persisted?.runId,
-      provider: manifest.provider.name,
-      model: manifest.provider.model,
-      metadata: {
-        error_code: error && typeof error === "object" && "code" in error ? String(error.code) : "runtime_error",
-        tool_calls: toolCalls.length,
-      },
-    }));
-    return hostedErrorResponse(error);
-  }
-
-  const persisted = await persist(env, {
-    conversationId,
-    userMessage: message,
-    assistantMessage: content,
-    usage: providerResult.usage,
-    toolCalls,
-  });
-  queueRuntimeUsage(ctx, sendRuntimeUsage(env, {
-    kind: "chat_run",
-    status: "succeeded",
-    conversationId: persisted.conversationId ?? conversationId,
-    runId: persisted.runId,
-    provider: manifest.provider.name,
-    model: manifest.provider.model,
-    usage: providerResult.usage,
-    metadata: {
-      tool_calls: toolCalls.length,
-    },
-  }));
-
-  return Response.json({
-    message: {
-      role: "assistant",
-      content,
-    },
-    ...persisted,
-  });
-}
-
-async function handleConversationRead(request, env, action, conversationId) {
-  const auth = await authorizeConversationRead(request, env);
-
-  if (auth) {
-    return auth;
-  }
-
-  if (!env.AGENTKIT_CONVERSATIONS) {
-    return Response.json({ error: { code: "conversations_not_configured", message: "Hosted conversation storage is not configured." } }, { status: 503 });
-  }
-
-  if (action === "list") {
-    const stub = hostedConversationStore(env);
-    return stub.fetch("https://agentkit.internal/conversations");
-  }
-
-  if (!conversationId) {
-    return Response.json({ error: { code: "validation_error", message: "Missing conversation id." } }, { status: 400 });
-  }
-
-  const stub = hostedConversationStore(env);
-  const suffix = action === "trace" ? "/trace" : "";
-  const path = \`/conversations/\${encodeURIComponent(conversationId)}\${suffix}\`;
-  const response = await stub.fetch(\`https://agentkit.internal\${path}\`);
-
-  if (response.status !== 404) {
-    return response;
-  }
-
-  const legacyStub = legacyConversationStore(env, conversationId);
-  return legacyStub.fetch(\`https://agentkit.internal\${path}\`);
-}
-
-function readChatMessage(body) {
-  if (typeof body.message === "string") {
-    return body.message.trim();
-  }
-
-  if (body.message && typeof body.message === "object" && body.message.role === "user" && typeof body.message.content === "string") {
-    return body.message.content.trim();
-  }
-
-  return "";
-}
-
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-async function callHostedProvider(env, messages, signal, toolCalls = []) {
-  const adapter = getProviderAdapter(manifest.provider);
-  const hostedTools = createHostedTools(env);
-  const clock = buildRuntimeClockContext({
-    timeZone: manifest.timeZone,
-    env,
-  });
-  const result = await adapter.run({
-    agent: {
-      name: manifest.name,
-      runtime: manifest.runtime,
-      provider: manifest.provider,
-    },
-    instructions: appendRuntimePromptContext(
-      withToolVisibilityInstructions(appendHostedKnowledgePromptPolicy(instructions), hostedTools),
-      {
-        clock,
-      },
-    ),
-    messages,
-    tools: hostedTools,
-    toolRuntime: createHostedProviderToolRuntime(env, signal, clock, toolCalls),
-    env,
-    signal,
-  });
-
-  return {
-    content: result.message.content,
-    usage: result.usage,
-  };
-}
-
-function appendHostedKnowledgePromptPolicy(baseInstructions) {
-  if (!manifest.knowledge.enabled) {
-    return baseInstructions;
-  }
-
-  return \`\${baseInstructions.trimEnd()}
-
-Knowledge rules:
-- Use agentkit_search_knowledge before answering business-specific factual questions about the user's documents, policies, prices, availability, services, procedures, or source-specific claims.
-- Do not invent prices, policies, legal/clinical claims, availability, or source-specific facts when Knowledge has not returned support for the answer.
-- Use retrieved Knowledge as context for the final answer, but do not expose raw retrieval JSON, scores, chunk IDs, or internal tool output objects to the user.
-\`;
-}
-
-function withToolVisibilityInstructions(baseInstructions, tools) {
-  const internalTools = tools
-    .filter((tool) => tool.visibility === "internal")
-    .map((tool) => tool.name)
-    .sort();
-
-  if (internalTools.length === 0) {
-    return baseInstructions;
-  }
-
-  return \`\${baseInstructions.trimEnd()}
-
-Tool visibility rules:
-- Tool outputs marked internal are operational state for the agent, not user-facing content.
-- Use internal outputs to decide what to do next, but do not reveal raw internal labels, scores, statuses, JSON fields, or tool output objects to the user.
-- Internal tools: \${internalTools.join(", ")}.
-\`;
-}
-
-function createHostedKnowledgeSearchTool() {
-  return {
-    name: manifest.knowledge.internalTool || "agentkit_search_knowledge",
-    description: "Search the Agent Capsule's configured Knowledge sources for business-specific facts.",
-    visibility: "internal",
-    inputSchema: {
-      type: "object",
-      properties: {
-        query: { type: "string" },
-        topK: { type: "integer" },
-      },
-      required: ["query"],
-      additionalProperties: false,
-    },
-    outputSchema: {
-      type: "object",
-      properties: {
-        results: {
-          type: "array",
-          items: {
-            type: "object",
-            properties: {
-              content: { type: "string" },
-              score: { type: "number" },
-              source: { type: "object" },
-            },
-            required: ["content", "score", "source"],
-          },
-        },
-      },
-      required: ["results"],
-      additionalProperties: false,
-    },
-    secrets: manifest.knowledge.embedding.secret ? [manifest.knowledge.embedding.secret] : [],
-    async execute(input, ctx) {
-      const query = typeof input?.query === "string" ? input.query : "";
-      const topK = normalizeKnowledgeTopK(input?.topK ?? manifest.knowledge.retrieval.topK);
-      const results = await searchHostedKnowledge(ctx.database, query, topK, ctx.secrets ?? {});
-
-      return {
-        results: results.map((result) => ({
-          content: result.content,
-          score: result.score,
-          source: result.source,
-        })),
-      };
-    },
-  };
-}
-
-async function searchHostedKnowledge(database, query, topK, secrets) {
-  const normalizedQuery = String(query || "").trim();
-
-  if (!normalizedQuery) {
-    throw agentKitError("knowledge_query_invalid", "Knowledge search query must be a non-empty string.");
-  }
-
-  const hasEmbeddingProvider = manifest.knowledge.embedding.provider !== "none";
-  const lexical =
-    manifest.knowledge.retrieval.hybrid || !hasEmbeddingProvider
-      ? await searchHostedKnowledgeLexical(database, normalizedQuery, Math.max(topK * 4, topK))
-      : [];
-  const semantic = hasEmbeddingProvider
-    ? await searchHostedKnowledgeSemantic(database, normalizedQuery, topK * 4, secrets)
-    : [];
-
-  return combineHostedKnowledgeResults(lexical, semantic, topK);
-}
-
-async function searchHostedKnowledgeLexical(database, query, limit) {
-  const tokens = hostedKnowledgeQueryTokens(query);
-
-  if (tokens.length === 0) {
-    return [];
-  }
-
-  try {
-    const result = await database.query(
-      \`
-      SELECT
-        c.id AS chunk_id,
-        c.source_id AS source_id,
-        c.content AS content,
-        c.title AS title,
-        c.section AS section,
-        c.locator AS locator,
-        s.source_key AS source_key,
-        rank
-      FROM agentkit_knowledge_fts
-      JOIN agentkit_knowledge_chunks c ON c.id = agentkit_knowledge_fts.chunk_id
-      JOIN agentkit_knowledge_sources s ON s.id = c.source_id
-      WHERE agentkit_knowledge_fts MATCH ?
-      ORDER BY rank ASC
-      LIMIT ?
-    \`,
-      [tokens.map((token) => \`"\${token.replace(/"/g, '""')}"\`).join(" OR "), limit],
-    );
-
-    return result.rows.map((row, index) => hostedKnowledgeResultFromRow(row, hostedLexicalScore(index), null));
-  } catch {
-    return searchHostedKnowledgeLexicalFallback(database, query, limit);
-  }
-}
-
-async function searchHostedKnowledgeLexicalFallback(database, query, limit) {
-  const like = \`%\${query.toLowerCase()}%\`;
-  const result = await database.query(
-    \`
-    SELECT
-      c.id AS chunk_id,
-      c.source_id AS source_id,
-      c.content AS content,
-      c.title AS title,
-      c.section AS section,
-      c.locator AS locator,
-      s.source_key AS source_key
-    FROM agentkit_knowledge_chunks c
-    JOIN agentkit_knowledge_sources s ON s.id = c.source_id
-    WHERE lower(c.content) LIKE ?
-      OR lower(COALESCE(c.title, '')) LIKE ?
-      OR lower(COALESCE(c.section, '')) LIKE ?
-    ORDER BY c.created_at DESC, c.ordinal ASC
-    LIMIT ?
-  \`,
-    [like, like, like, limit],
-  );
-
-  return result.rows.map((row, index) => hostedKnowledgeResultFromRow(row, hostedLexicalScore(index), null));
-}
-
-async function searchHostedKnowledgeSemantic(database, query, limit, secrets) {
-  const queryEmbedding = await createHostedKnowledgeEmbedding(query, secrets);
-
-  if (!queryEmbedding) {
-    return [];
-  }
-
-  try {
-    return await searchHostedKnowledgeNativeVector(database, queryEmbedding, limit);
-  } catch {
-    return searchHostedKnowledgeSemanticFallback(database, queryEmbedding, limit);
-  }
-}
-
-async function searchHostedKnowledgeNativeVector(database, queryEmbedding, limit) {
-  const vector = JSON.stringify(queryEmbedding);
-  const result = await database.query(
-    \`
-    SELECT
-      c.id AS chunk_id,
-      c.source_id AS source_id,
-      c.content AS content,
-      c.title AS title,
-      c.section AS section,
-      c.locator AS locator,
-      s.source_key AS source_key,
-      vector_distance_cos(v.embedding, vector32(?)) AS vector_distance
-    FROM vector_top_k('agentkit_knowledge_vectors_embedding_idx', vector32(?), ?) nearest
-    JOIN agentkit_knowledge_vectors v ON v.id = nearest.id
-    JOIN agentkit_knowledge_chunks c ON c.id = v.chunk_id
-    JOIN agentkit_knowledge_sources s ON s.id = c.source_id
-    ORDER BY vector_distance ASC
-  \`,
-    [vector, vector, limit],
-  );
-
-  return result.rows
-    .map((row) => {
-      const distance = Number(row.vector_distance);
-      const semantic = Number.isFinite(distance) ? 1 - distance : 0;
-      return hostedKnowledgeResultFromRow(row, 0, semantic);
-    })
-    .filter((result) => result.match.semantic !== null && result.match.semantic > 0)
-    .slice(0, limit);
-}
-
-async function searchHostedKnowledgeSemanticFallback(database, queryEmbedding, limit) {
-  const result = await database.query(
-    \`
-    SELECT
-      c.id AS chunk_id,
-      c.source_id AS source_id,
-      c.content AS content,
-      c.title AS title,
-      c.section AS section,
-      c.locator AS locator,
-      c.embedding_json AS embedding_json,
-      s.source_key AS source_key
-    FROM agentkit_knowledge_chunks c
-    JOIN agentkit_knowledge_sources s ON s.id = c.source_id
-    WHERE c.embedding_json IS NOT NULL
-    ORDER BY c.created_at DESC, c.ordinal ASC
-  \`,
-  );
-
-  return result.rows
-    .map((row) => {
-      const embedding = parseHostedKnowledgeEmbedding(row.embedding_json);
-      const semantic = embedding ? hostedCosineSimilarity(queryEmbedding, embedding) : 0;
-      return hostedKnowledgeResultFromRow(row, 0, semantic);
-    })
-    .filter((result) => result.match.semantic !== null && result.match.semantic > 0)
-    .sort((left, right) => (right.match.semantic ?? 0) - (left.match.semantic ?? 0))
-    .slice(0, limit);
-}
-
-async function createHostedKnowledgeEmbedding(input, secrets) {
-  const provider = manifest.knowledge.embedding.provider;
-
-  if (provider === "none") {
-    return null;
-  }
-
-  if (provider === "test") {
-    return hostedFakeEmbedding(input, manifest.knowledge.embedding.dimensions || 32);
-  }
-
-  if (provider !== "openai") {
-    throw agentKitError("knowledge_embedding_provider_unsupported", "Unsupported knowledge embedding provider.");
-  }
-
-  const secretName = manifest.knowledge.embedding.secret || "OPENAI_API_KEY";
-  const apiKey = secrets[secretName];
-
-  if (!apiKey) {
-    throw agentKitError("knowledge_embedding_secret_missing", \`Knowledge embeddings require missing secret "\${secretName}".\`);
-  }
-
-  const response = await fetch("https://api.openai.com/v1/embeddings", {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      authorization: \`Bearer \${apiKey}\`,
-    },
-    body: JSON.stringify({
-      model: manifest.knowledge.embedding.model || "text-embedding-3-small",
-      input,
-      encoding_format: "float",
-      ...(manifest.knowledge.embedding.dimensions ? { dimensions: manifest.knowledge.embedding.dimensions } : {}),
-    }),
-  });
-
-  if (!response.ok) {
-    const text = await response.text().catch(() => "");
-    throw agentKitError(
-      "knowledge_embedding_failed",
-      \`OpenAI embedding request failed with HTTP \${response.status}.\${text ? " " + text.slice(0, 240) : ""}\`,
-    );
-  }
-
-  const payload = await response.json();
-  const embedding = payload?.data?.[0]?.embedding;
-
-  if (!Array.isArray(embedding) || embedding.some((value) => typeof value !== "number")) {
-    throw agentKitError("knowledge_embedding_failed", "OpenAI embedding response did not contain a numeric vector.");
-  }
-
-  return embedding;
-}
-
-function combineHostedKnowledgeResults(lexical, semantic, topK) {
-  const byChunk = new Map();
-
-  for (const result of lexical) {
-    byChunk.set(result.chunkId, result);
-  }
-
-  for (const result of semantic) {
-    const existing = byChunk.get(result.chunkId);
-
-    if (!existing) {
-      byChunk.set(result.chunkId, {
-        ...result,
-        score: hostedCombinedScore(0, result.match.semantic),
-      });
-      continue;
-    }
-
-    byChunk.set(result.chunkId, {
-      ...existing,
-      score: hostedCombinedScore(existing.match.lexical, result.match.semantic),
-      match: {
-        lexical: existing.match.lexical,
-        semantic: result.match.semantic,
-      },
-    });
-  }
-
-  return Array.from(byChunk.values())
-    .map((result) => ({
-      ...result,
-      score: result.score || hostedCombinedScore(result.match.lexical, result.match.semantic),
-    }))
-    .sort((left, right) => right.score - left.score || left.source.path.localeCompare(right.source.path))
-    .slice(0, topK);
-}
-
-function hostedKnowledgeResultFromRow(row, lexical, semantic) {
-  return {
-    chunkId: String(row.chunk_id),
-    content: String(row.content),
-    score: hostedCombinedScore(lexical, semantic),
-    source: {
-      id: String(row.source_id),
-      path: String(row.source_key),
-      title: typeof row.title === "string" ? row.title : null,
-      section: typeof row.section === "string" ? row.section : null,
-      locator: typeof row.locator === "string" ? row.locator : null,
-    },
-    match: {
-      lexical,
-      semantic,
-    },
-  };
-}
-
-function normalizeKnowledgeTopK(value) {
-  const topK = Number(value);
-
-  if (!Number.isInteger(topK) || topK <= 0 || topK > 50) {
-    throw agentKitError("knowledge_query_invalid", "Knowledge search topK must be a positive integer no larger than 50.");
-  }
-
-  return topK;
-}
-
-function hostedKnowledgeQueryTokens(query) {
-  return Array.from(new Set(String(query).toLowerCase().match(/[\\p{L}\\p{N}_-]+/gu) ?? [])).slice(0, 12);
-}
-
-function parseHostedKnowledgeEmbedding(value) {
-  if (typeof value !== "string") {
-    return null;
-  }
-
-  try {
-    const parsed = JSON.parse(value);
-    return Array.isArray(parsed) && parsed.every((item) => typeof item === "number") ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-
-function hostedCombinedScore(lexical, semantic) {
-  const semanticScore = semantic === null ? 0 : Math.max(0, (semantic + 1) / 2);
-  return Number((lexical * 0.6 + semanticScore * 0.4).toFixed(6));
-}
-
-function hostedLexicalScore(index) {
-  return Number((1 / (index + 1)).toFixed(6));
-}
-
-function hostedCosineSimilarity(left, right) {
-  if (left.length !== right.length || left.length === 0) {
-    return 0;
-  }
-
-  let dot = 0;
-  let leftNorm = 0;
-  let rightNorm = 0;
-
-  for (let index = 0; index < left.length; index += 1) {
-    dot += left[index] * right[index];
-    leftNorm += left[index] * left[index];
-    rightNorm += right[index] * right[index];
-  }
-
-  if (leftNorm === 0 || rightNorm === 0) {
-    return 0;
-  }
-
-  return dot / (Math.sqrt(leftNorm) * Math.sqrt(rightNorm));
-}
-
-async function hostedFakeEmbedding(input, dimensions) {
-  const values = Array.from({ length: dimensions }, () => 0);
-  const tokens = String(input).toLowerCase().match(/[\\p{L}\\p{N}_-]+/gu) ?? [];
-  const encoder = new TextEncoder();
-
-  for (const token of tokens) {
-    const hash = new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(token)));
-    const slot = hash[0] % dimensions;
-    const sign = hash[1] % 2 === 0 ? 1 : -1;
-    values[slot] += sign * (1 + (hash[2] % 7) / 10);
-  }
-
-  const norm = Math.sqrt(values.reduce((sum, value) => sum + value * value, 0));
-  return norm === 0 ? values : values.map((value) => Number((value / norm).toFixed(8)));
-}
-
-async function persistFailure(env, conversationId, userMessage, error, toolCalls = []) {
-  return persist(env, {
-    conversationId,
-    userMessage,
-    status: "failed",
-    errorCode: error && typeof error === "object" && "code" in error ? String(error.code) : "runtime_error",
-    errorMessage: error instanceof Error ? error.message : String(error),
-    toolCalls,
-  }).catch(() => undefined);
-}
-
-function inspectHostedDatabase() {
-  const schema = manifest.storage.database.driver === "turso" ? manifest.storage.database.schema : null;
-
-  return {
-    local: {
-      driver: "sqlite",
-      path: ".agentkit/agentkit.db",
-      schema,
-    },
-    hosted: {
-      driver: manifest.storage.database.driver,
-      provisioning: manifest.storage.database.driver === "turso" ? "agentkit-managed" : "none",
-      schema,
-    },
-  };
-}
-
-function hostedManagedSecrets() {
-  const secrets = [];
-
-  if (manifest.storage.database.driver === "turso") {
-    secrets.push("TURSO_AUTH_TOKEN", "TURSO_DATABASE_URL");
-  }
-
-  if (manifest.integrations.some((integration) => integration.provider === "composio" && integration.mode === "managed")) {
-    secrets.push("COMPOSIO_API_KEY");
-  }
-
-  return secrets.sort();
-}
-
-function createHostedTools(env) {
-  return [
-    ...(hostedKnowledgeTool ? [hostedKnowledgeTool] : []),
-    ...createManagedComposioTools(agentConfig, { userId: env[MANAGED_COMPOSIO_USER_ID_BINDING] }),
-    ...(agentConfig.tools ?? []),
-  ];
-}
-
-function hostedIntegrations(env) {
-  const userId = env[MANAGED_COMPOSIO_USER_ID_BINDING];
-
-  if (!userId) {
-    return manifest.integrations;
-  }
-
-  return manifest.integrations.map((integration) =>
-    integration.provider === "composio" && integration.mode === "managed"
-      ? { ...integration, userId }
-      : integration,
-  );
-}
-
-function createHostedProviderToolRuntime(env, signal, clock, toolCalls) {
-  const hostedTools = createHostedTools(env);
-
-  return {
-    definitions: hostedTools,
-    async execute(request) {
-      try {
-        const result = await executeHostedTool({
-          tools: hostedTools,
-          name: request.name,
-          input: request.input,
-          env,
-          signal,
-          invocation: "chat",
-          clock,
-        });
-        toolCalls?.push(result);
-        return result;
-      } catch (error) {
-        toolCalls?.push(failedHostedToolCall(hostedTools, request, error));
-        throw error;
-      }
-    },
-  };
-}
-
-async function executeHostedTool(request) {
-  const hostedTools = request.tools ?? createHostedTools(request.env);
-  const tool = hostedTools.find((candidate) => candidate.name === request.name);
-  const id = crypto.randomUUID();
-
-  if (!tool) {
-    throw agentKitError("tool_not_found", \`Tool "\${request.name}" is not declared in agentkit.config.ts.\`);
-  }
-
-  const input = normalizeOptionalNulls(request.input ?? {}, tool.inputSchema);
-  validateSchema(input, tool.inputSchema, \`tool "\${tool.name}" input\`);
-  assertToolInvocationAuthorized(tool, request.invocation ?? "tool");
-
-  const secrets = resolveToolSecrets(tool, request.env);
-  const database = createHostedDatabaseRunner(request.env);
-  const clock = request.clock ?? buildRuntimeClockContext({
-    timeZone: manifest.timeZone,
-    env: request.env,
-  });
-  const runtime = {
-    environment: "hosted",
-    invocation: request.invocation ?? "tool",
-    target: "cloudflare",
-    database: manifest.storage.database.driver === "turso" ? "turso" : "none",
-  };
-  const output = await runToolWithTimeout(
-    tool,
-    input,
-    {
-      secrets,
-      database,
-      signal: request.signal,
-      clock,
-      runtime,
-    },
-    tool.timeoutMs ?? DEFAULT_TOOL_TIMEOUT_MS,
-  );
-
-  if (tool.outputSchema) {
-    validateSchema(output, tool.outputSchema, \`tool "\${tool.name}" output\`);
-  }
-
-  const rendered = renderHostedToolOutput(tool, input, output, runtime, clock);
-
-  return {
-    id,
-    name: tool.name,
-    visibility: tool.visibility ?? "user",
-    status: "completed",
-    input,
-    output,
-    ...(rendered ? { rendered } : {}),
-  };
-}
-
-function assertToolInvocationAuthorized(tool, invocation) {
-  if (invocation === "tool") {
-    return;
-  }
-
-  const privilegedPermissions = (tool.permissions ?? []).filter((permission) => !permission.endsWith(":read"));
-
-  if (privilegedPermissions.length === 0) {
-    return;
-  }
-
-  throw agentKitError(
-    "tool_authorization_required",
-    \`Tool "\${tool.name}" requires an explicit operator invocation because it declares privileged permissions: \${privilegedPermissions.join(", ")}.\`,
-  );
-}
-
-function failedHostedToolCall(tools, request, error) {
-  const tool = tools.find((candidate) => candidate.name === request.name);
-
-  return {
-    id: crypto.randomUUID(),
-    name: String(request.name || ""),
-    visibility: tool?.visibility ?? "user",
-    status: "failed",
-    input: request.input ?? {},
-    errorMessage: error instanceof Error ? error.message : String(error),
-  };
-}
-
-function renderHostedToolOutput(tool, input, output, runtime, clock) {
-  if (!tool.render) {
-    return undefined;
-  }
-
-  const rendered = tool.render(output, {
-    input,
-    runtime,
-    clock,
-  });
-
-  if (typeof rendered === "string") {
-    return { text: rendered };
-  }
-
-  if (!isRecord(rendered) || typeof rendered.text !== "string" || rendered.text.trim().length === 0) {
-    throw agentKitError("tool_validation_error", \`tool "\${tool.name}" render must return a non-empty text string.\`);
-  }
-
-  if (rendered.blocks !== undefined) {
-    if (!Array.isArray(rendered.blocks)) {
-      throw agentKitError("tool_validation_error", \`tool "\${tool.name}" render.blocks must be an array when provided.\`);
-    }
-
-    for (const [index, block] of rendered.blocks.entries()) {
-      validateRenderBlock(block, \`tool "\${tool.name}" render.blocks[\${index}]\`);
-    }
-  }
-
-  return {
-    text: rendered.text,
-    ...(rendered.blocks ? { blocks: rendered.blocks } : {}),
-  };
-}
-
-function validateRenderBlock(block, label) {
-  if (!isRecord(block)) {
-    throw agentKitError("tool_validation_error", \`\${label} must be an object.\`);
-  }
-
-  if (block.type === "text") {
-    if (typeof block.text !== "string" || block.text.trim().length === 0) {
-      throw agentKitError("tool_validation_error", \`\${label}.text must be a non-empty string.\`);
-    }
-
-    return;
-  }
-
-  if (block.type === "card") {
-    if (typeof block.title !== "string" || block.title.trim().length === 0) {
-      throw agentKitError("tool_validation_error", \`\${label}.title must be a non-empty string.\`);
-    }
-
-    validateOptionalString(block.subtitle, \`\${label}.subtitle\`);
-    validateRenderFields(block.fields, \`\${label}.fields\`);
-    validateRenderActions(block.actions, \`\${label}.actions\`);
-    return;
-  }
-
-  throw agentKitError("tool_validation_error", \`\${label}.type must be "text" or "card".\`);
-}
-
-function validateRenderFields(value, label) {
-  if (value === undefined) {
-    return;
-  }
-
-  if (!Array.isArray(value)) {
-    throw agentKitError("tool_validation_error", \`\${label} must be an array when provided.\`);
-  }
-
-  for (const [index, field] of value.entries()) {
-    if (!isRecord(field)) {
-      throw agentKitError("tool_validation_error", \`\${label}[\${index}] must be an object.\`);
-    }
-
-    validateRequiredString(field.label, \`\${label}[\${index}].label\`);
-    validateRequiredString(field.value, \`\${label}[\${index}].value\`);
-  }
-}
-
-function validateRenderActions(value, label) {
-  if (value === undefined) {
-    return;
-  }
-
-  if (!Array.isArray(value)) {
-    throw agentKitError("tool_validation_error", \`\${label} must be an array when provided.\`);
-  }
-
-  for (const [index, action] of value.entries()) {
-    if (!isRecord(action)) {
-      throw agentKitError("tool_validation_error", \`\${label}[\${index}] must be an object.\`);
-    }
-
-    validateRequiredString(action.label, \`\${label}[\${index}].label\`);
-    validateOptionalString(action.href, \`\${label}[\${index}].href\`);
-  }
-}
-
-function validateRequiredString(value, label) {
-  if (typeof value !== "string" || value.trim().length === 0) {
-    throw agentKitError("tool_validation_error", \`\${label} must be a non-empty string.\`);
-  }
-}
-
-function validateOptionalString(value, label) {
-  if (value !== undefined && typeof value !== "string") {
-    throw agentKitError("tool_validation_error", \`\${label} must be a string when provided.\`);
-  }
-}
-
-function resolveToolSecrets(tool, env) {
-  const secrets = {};
-
-  for (const secretName of tool.secrets ?? []) {
-    if (!env[secretName]) {
-      throw agentKitError("tool_secret_missing", \`Tool "\${tool.name}" requires missing secret "\${secretName}".\`);
-    }
-
-    secrets[secretName] = env[secretName];
-  }
-
-  return secrets;
-}
-
-async function runToolWithTimeout(tool, input, context, timeoutMs) {
-  const controller = new AbortController();
-  const parentSignal = context.signal;
-
-  if (parentSignal?.aborted) {
-    throw agentKitError("runtime_aborted", \`Tool "\${tool.name}" was aborted before it started.\`);
-  }
-
-  const abortFromParent = () => controller.abort(parentSignal?.reason);
-  parentSignal?.addEventListener("abort", abortFromParent, { once: true });
-
-  let timeout;
-
-  try {
-    const timeoutPromise = new Promise((_, reject) => {
-      timeout = setTimeout(() => {
-        controller.abort();
-        reject(agentKitError("tool_timeout", \`Tool "\${tool.name}" timed out after \${timeoutMs}ms.\`));
-      }, timeoutMs);
-    });
-
-    const execution = Promise.resolve().then(() =>
-      tool.execute(input, {
-        secrets: context.secrets,
-        signal: controller.signal,
-        runtime: context.runtime,
-        clock: context.clock,
-        database: context.database,
-        db: context.database,
-        storage: {
-          sql: context.database,
-        },
-      }),
-    );
-
-    return await Promise.race([execution, timeoutPromise]);
-  } finally {
-    if (timeout) {
-      clearTimeout(timeout);
-    }
-
-    parentSignal?.removeEventListener("abort", abortFromParent);
-  }
-}
-
-function createHostedDatabaseRunner(env) {
-  const run = async (sql, args = []) => {
-    validateDatabaseQuery(sql, args);
-
-    const configError = requireTurso(env);
-
-    if (configError) {
-      const payload = await configError.json().catch(() => null);
-      const error = payload?.error;
-      throw agentKitError(error?.code || "database_not_configured", error?.message || "Hosted database is not configured.");
-    }
-
-    return executeTursoSql(env, sql, args);
-  };
-
-  run.execute = run;
-  run.query = run;
-  run.batch = async (statements) => {
-    if (!Array.isArray(statements)) {
-      throw agentKitError("database_query_invalid", "ctx.db.batch requires an array of statements.");
-    }
-
-    for (const [index, statement] of statements.entries()) {
-      if (!isRecord(statement)) {
-        throw agentKitError("database_query_invalid", \`ctx.db.batch statement \${index} must be an object.\`);
-      }
-
-      validateDatabaseQuery(statement.sql, statement.args ?? []);
-    }
-
-    const configError = requireTurso(env);
-
-    if (configError) {
-      const payload = await configError.json().catch(() => null);
-      const error = payload?.error;
-      throw agentKitError(error?.code || "database_not_configured", error?.message || "Hosted database is not configured.");
-    }
-
-    return executeTursoBatch(env, statements);
-  };
-  run.transaction = async () => {
-    throw agentKitError(
-      "database_transaction_unsupported",
-      "Hosted Cloudflare tools do not expose long-lived interactive transactions in v1. Use ctx.db.batch([...]) for atomic Turso pipeline operations.",
-    );
-  };
-  return run;
-}
-
-function validateDatabaseQuery(sql, args) {
-  if (typeof sql !== "string" || sql.trim().length === 0) {
-    throw agentKitError("database_query_invalid", "Database SQL must be a non-empty string.");
-  }
-
-  if (!Array.isArray(args)) {
-    throw agentKitError("database_query_invalid", "Database SQL args must be an array.");
-  }
-
-  for (const arg of args) {
-    if (arg !== null && typeof arg !== "string" && typeof arg !== "number" && typeof arg !== "boolean") {
-      throw agentKitError("database_query_invalid", "Database SQL args may only contain strings, numbers, booleans, or null.");
-    }
-  }
-}
-
-function validateSchema(value, schema, label) {
-  const error = validateValue(value, schema, "$");
-
-  if (error) {
-    throw agentKitError("tool_validation_error", \`\${label} failed schema validation: \${error}\`);
-  }
-}
-
-function validateValue(value, schema, path) {
-  if (Array.isArray(schema.enum) && !schema.enum.some((item) => Object.is(item, value))) {
-    return \`\${path} must be one of \${JSON.stringify(schema.enum)}.\`;
-  }
-
-  const types = Array.isArray(schema.type) ? schema.type : [schema.type];
-  const errors = types.map((type) => validateValueForType(value, schema, type, path)).filter((error) => error !== null);
-
-  if (errors.length < types.length) {
-    return null;
-  }
-
-  if (types.length > 1) {
-    return \`\${path} must match one of these schema types: \${types.join(", ")}.\`;
-  }
-
-  return errors[0] ?? null;
-}
-
-function validateValueForType(value, schema, type, path) {
-  switch (type) {
-    case "object":
-      return validateObject(value, schema, path);
-    case "array":
-      return validateArray(value, schema, path);
-    case "string":
-      return typeof value === "string" ? null : \`\${path} must be a string.\`;
-    case "number":
-      return typeof value === "number" && Number.isFinite(value) ? null : \`\${path} must be a number.\`;
-    case "integer":
-      return Number.isInteger(value) ? null : \`\${path} must be an integer.\`;
-    case "boolean":
-      return typeof value === "boolean" ? null : \`\${path} must be a boolean.\`;
-    case "null":
-      return value === null ? null : \`\${path} must be null.\`;
-    default:
-      return \`\${path} has unsupported schema type "\${type}".\`;
-  }
-}
-
-function validateObject(value, schema, path) {
-  if (!isRecord(value)) {
-    return \`\${path} must be an object.\`;
-  }
-
-  for (const property of schema.required ?? []) {
-    if (!(property in value)) {
-      return \`\${path}.\${property} is required.\`;
-    }
-  }
-
-  for (const [property, propertySchema] of Object.entries(schema.properties ?? {})) {
-    if (property in value) {
-      const error = validateValue(value[property], propertySchema, \`\${path}.\${property}\`);
-
-      if (error) {
-        return error;
-      }
-    }
-  }
-
-  if (schema.additionalProperties === false) {
-    const allowedProperties = new Set(Object.keys(schema.properties ?? {}));
-
-    for (const property of Object.keys(value)) {
-      if (!allowedProperties.has(property)) {
-        return \`\${path}.\${property} is not allowed.\`;
-      }
-    }
-  }
-
-  return null;
-}
-
-function validateArray(value, schema, path) {
-  if (!Array.isArray(value)) {
-    return \`\${path} must be an array.\`;
-  }
-
-  if (!schema.items) {
-    return null;
-  }
-
-  for (const [index, item] of value.entries()) {
-    const error = validateValue(item, schema.items, \`\${path}[\${index}]\`);
-
-    if (error) {
-      return error;
-    }
-  }
-
-  return null;
-}
-
-function normalizeOptionalNulls(value, schema) {
-  const types = schemaTypes(schema);
-
-  if (types.includes("object") && isRecord(value)) {
-    const required = new Set(schema.required ?? []);
-    const properties = schema.properties ?? {};
-    const normalized = { ...value };
-
-    for (const [property, propertySchema] of Object.entries(properties)) {
-      if (!(property in normalized)) {
-        continue;
-      }
-
-      if (normalized[property] === null && !required.has(property) && !allowsNull(propertySchema)) {
-        delete normalized[property];
-        continue;
-      }
-
-      normalized[property] = normalizeOptionalNulls(normalized[property], propertySchema);
-    }
-
-    return normalized;
-  }
-
-  if (types.includes("array") && Array.isArray(value) && schema.items) {
-    return value.map((item) => normalizeOptionalNulls(item, schema.items));
-  }
-
-  return value;
-}
-
-function schemaTypes(schema) {
-  return Array.isArray(schema.type) ? schema.type : [schema.type];
-}
-
-function allowsNull(schema) {
-  return schemaTypes(schema).includes("null") || (Array.isArray(schema.enum) && schema.enum.some((item) => item === null));
-}
-
-async function authorizeChat(request, env, body) {
-  return authorizeDeployAccess(request, env, body, {
-    notConfiguredCode: "chat_access_not_configured",
-    notConfiguredMessage: "Hosted chat requires a deploy access token gate.",
-  });
-}
-
-async function authorizeConversationRead(request, env) {
-  return authorizeDeployAccess(request, env, {}, {
-    notConfiguredCode: "conversation_access_not_configured",
-    notConfiguredMessage: "Hosted conversation reads require a deploy access token gate.",
-  });
-}
-
-async function authorizeDeployAccess(request, env, body, options) {
-  const runtimeGate = await authorizeRuntimeGate(request, env, body);
-
-  if (runtimeGate) {
-    if (runtimeGate === "authorized") {
-      return null;
-    }
-
-    return runtimeGate;
-  }
-
-  const token = deployAccessToken(request, body);
-  const acceptedTokens = [env.AGENTKIT_PRIVATE_TOKEN, env.AGENTKIT_ACCESS_TOKEN].filter(
-    (value) => typeof value === "string" && value.length > 0,
-  );
-
-  if (acceptedTokens.length === 0) {
-    return Response.json(
-      {
-        error: {
-          code: options.notConfiguredCode,
-          message: options.notConfiguredMessage,
-        },
-      },
-      { status: 503 },
-    );
-  }
-
-  if (!token || !acceptedTokens.includes(token)) {
-    return Response.json(
-      { error: { code: "unauthorized", message: "Missing or invalid deploy access token." } },
-      { status: 401 },
-    );
-  }
-
-  return null;
-}
-
-async function authorizeRuntimeGate(request, env, body) {
-  if (!env.AGENTKIT_CLOUD_API_URL || !env.AGENTKIT_DEPLOY_ID || !env.AGENTKIT_RUNTIME_GATE_TOKEN) {
-    return null;
-  }
-
-  let response;
-  const token = deployAccessToken(request, body);
-
-  try {
-    response = await fetch(
-      new URL(\`/v1/runtime/deploys/\${encodeURIComponent(env.AGENTKIT_DEPLOY_ID)}/authorize\`, env.AGENTKIT_CLOUD_API_URL).href,
-      {
-        method: "POST",
-        headers: {
-          "Authorization": \`Bearer \${env.AGENTKIT_RUNTIME_GATE_TOKEN}.\${token}\`,
-          "Content-Type": "application/json",
-          "X-AgentKit-Deploy-Access-Token": token,
-        },
-        body: JSON.stringify({
-          token,
-        }),
-      },
-    );
-  } catch {
-    return Response.json(
-      { error: { code: "runtime_gate_unavailable", message: "AgentKit runtime gate is temporarily unavailable." } },
-      { status: 503 },
-    );
-  }
-
-  if (response.ok) {
-    return "authorized";
-  }
-
-  const payload = await response.json().catch(() => ({
-    error: {
-      code: "runtime_gate_failed",
-      message: "AgentKit runtime gate rejected the request.",
-    },
-  }));
-  return Response.json(payload, { status: response.status });
-}
-
-function deployAccessToken(request, body) {
-  const authorization = request.headers.get("authorization");
-
-  if (authorization?.startsWith("Bearer ")) {
-    return authorization.slice("Bearer ".length);
-  }
-
-  const tokenHeader =
-    request.headers.get("x-agentkit-access-token") ??
-    request.headers.get("x-agentkit-deploy-access-token") ??
-    "";
-  const token = tokenHeader.startsWith("Bearer ") ? tokenHeader.slice("Bearer ".length) : tokenHeader;
-  if (token.trim()) {
-    return token.trim();
-  }
-
-  if (body && typeof body === "object") {
-    const bodyToken = typeof body.access_token === "string" ? body.access_token : typeof body.accessToken === "string" ? body.accessToken : "";
-    return bodyToken.trim();
-  }
-
-  return "";
-}
-
-function authorizeAdmin(request, env) {
-  if (!env.AGENTKIT_PRIVATE_TOKEN) {
-    return Response.json(
-      {
-        error: {
-          code: "deploy_not_ready",
-          message: "Privileged AgentKit endpoints require AGENTKIT_PRIVATE_TOKEN to be set as a Cloudflare secret.",
-        },
-      },
-      { status: 503 },
-    );
-  }
-
-  const expected = \`Bearer \${env.AGENTKIT_PRIVATE_TOKEN}\`;
-  if (request.headers.get("authorization") !== expected) {
-    return Response.json(
-      { error: { code: "unauthorized", message: "Missing or invalid AgentKit admin token." } },
-      { status: 401 },
-    );
-  }
-
-  return null;
-}
-
-async function persist(env, input) {
-  if (!env.AGENTKIT_CONVERSATIONS) {
-    return {};
-  }
-
-  const stub = hostedConversationStore(env);
-  const response = await stub.fetch("https://agentkit.internal/messages", {
-    method: "POST",
-    body: JSON.stringify(input),
-  });
-
-  if (!response.ok) {
-    throw new Error(\`Could not persist conversation: \${response.status}\`);
-  }
-
-  return response.json();
-}
-
-function queueRuntimeUsage(ctx, promise) {
-  const safePromise = promise.catch(() => undefined);
-
-  if (ctx && typeof ctx.waitUntil === "function") {
-    ctx.waitUntil(safePromise);
-    return;
-  }
-
-  void safePromise;
-}
-
-async function sendRuntimeUsage(env, input) {
-  if (!env.AGENTKIT_CLOUD_API_URL || !env.AGENTKIT_DEPLOY_ID || !env.AGENTKIT_RUNTIME_GATE_TOKEN) {
-    return;
-  }
-
-  const usage = normalizeRuntimeUsage(input.usage);
-  const metadata = isRecord(input.metadata) ? input.metadata : {};
-  const body = {
-    kind: input.kind || "chat_run",
-    status: input.status || "succeeded",
-    ...(input.runId ? { run_id: String(input.runId) } : {}),
-    ...(input.conversationId ? { conversation_id: String(input.conversationId) } : {}),
-    ...(input.provider ? { provider: String(input.provider) } : {}),
-    ...(input.model ? { model: String(input.model) } : {}),
-    ...(usage.inputTokens !== undefined ? { input_tokens: usage.inputTokens } : {}),
-    ...(usage.outputTokens !== undefined ? { output_tokens: usage.outputTokens } : {}),
-    ...(usage.totalTokens !== undefined ? { total_tokens: usage.totalTokens } : {}),
-    ...(usage.cost && Object.keys(usage.cost).length > 0 ? { cost: usage.cost } : {}),
-    ...(usage.cost?.total !== undefined ? { cost_usd: usage.cost.total } : {}),
-    metadata: sanitizeRuntimeUsageMetadata(metadata),
-  };
-
-  const url = new URL(
-    "/v1/runtime/deploys/" + encodeURIComponent(String(env.AGENTKIT_DEPLOY_ID)) + "/usage",
-    env.AGENTKIT_CLOUD_API_URL,
-  );
-  await fetch(url.href, {
-    method: "POST",
-    headers: {
-      Authorization: "Bearer " + env.AGENTKIT_RUNTIME_GATE_TOKEN,
-      "Content-Type": "application/json",
-    },
-    body: JSON.stringify(body),
-  });
-}
-
-function sanitizeRuntimeUsageMetadata(value) {
-  const metadata = {};
-
-  for (const [key, raw] of Object.entries(value)) {
-    if (!/^[A-Za-z0-9_.:-]{1,80}$/.test(key)) {
-      continue;
-    }
-
-    if (typeof raw === "string") {
-      metadata[key] = raw.length > 160 ? raw.slice(0, 160) : raw;
-    } else if (typeof raw === "number" && Number.isFinite(raw)) {
-      metadata[key] = raw;
-    } else if (typeof raw === "boolean") {
-      metadata[key] = raw;
-    }
-  }
-
-  return metadata;
-}
-
-async function loadConversationMessages(env, conversationId) {
-  if (!env.AGENTKIT_CONVERSATIONS || !conversationId) {
-    return [];
-  }
-
-  const stub = hostedConversationStore(env);
-  const response = await stub.fetch(
-    \`https://agentkit.internal/messages?conversationId=\${encodeURIComponent(conversationId)}\`,
-  );
-
-  if (!response.ok) {
-    return [];
-  }
-
-  const payload = await response.json();
-  const messages = Array.isArray(payload.messages)
-    ? payload.messages.filter((message) =>
-        message &&
-        typeof message === "object" &&
-        (message.role === "user" || message.role === "assistant") &&
-        typeof message.content === "string"
-      )
-    : [];
-
-  if (messages.length > 0) {
-    return messages;
-  }
-
-  const legacyStub = legacyConversationStore(env, conversationId);
-  const legacyResponse = await legacyStub.fetch(
-    \`https://agentkit.internal/messages?conversationId=\${encodeURIComponent(conversationId)}\`,
-  );
-
-  if (!legacyResponse.ok) {
-    return [];
-  }
-
-  const legacyPayload = await legacyResponse.json();
-  return Array.isArray(legacyPayload.messages)
-    ? legacyPayload.messages.filter((message) =>
-        message &&
-        typeof message === "object" &&
-        (message.role === "user" || message.role === "assistant") &&
-        typeof message.content === "string"
-      )
-    : [];
-}
-
-function hostedConversationStore(env) {
-  const id = env.AGENTKIT_CONVERSATIONS.idFromName("agentkit-conversations");
-  return env.AGENTKIT_CONVERSATIONS.get(id);
-}
-
-function legacyConversationStore(env, conversationId) {
-  const id = env.AGENTKIT_CONVERSATIONS.idFromName(conversationId);
-  return env.AGENTKIT_CONVERSATIONS.get(id);
-}
-
-function normalizeConversationId(value) {
-  if (value === undefined || value === null) {
-    return null;
-  }
-
-  if (typeof value !== "string") {
-    throw agentKitError("validation_error", "conversationId must be a non-empty string when provided.");
-  }
-
-  const conversationId = value.trim();
-  if (!conversationId) {
-    throw agentKitError("validation_error", "conversationId must be a non-empty string when provided.");
-  }
-
-  return conversationId;
-}
-
-function agentKitError(code, message) {
-  const error = new Error(message);
-  error.code = code;
-  return error;
-}
-
-function hostedErrorResponse(error) {
-  const code = error && typeof error === "object" && "code" in error ? String(error.code) : "runtime_error";
-  const message = error instanceof Error ? error.message : String(error);
-  const status =
-    code === "tool_not_found" || code === "database_not_configured" || code === "files_not_configured"
-      ? 404
-      : code === "constraint_conflict"
-        ? 409
-      : code === "tool_validation_error" || code === "validation_error" || code === "database_query_invalid"
-        ? 400
-        : code === "database_unavailable" || code === "database_transaction_unsupported"
-          ? 503
-        : code === "database_schema_error"
-          ? 500
-        : code === "provider_not_supported"
-          ? 501
-        : code === "tool_secret_missing" || code === "secret_not_found" || code === "deploy_not_ready"
-          ? 503
-          : 500;
-
-  return Response.json({ error: { code, message } }, { status });
-}
-
-async function executeTursoSql(env, sql, args) {
-  const results = await executeTursoPipeline(env, [
-    {
-      type: "execute",
-      stmt: {
-        sql,
-        args: args.map(toTursoArg),
-      },
-    },
-  ]);
-
-  return results[0] ?? emptyDatabaseResult();
-}
-
-async function executeTursoBatch(env, statements) {
-  const results = await executeTursoPipeline(
-    env,
-    statements.map((statement) => ({
-      type: "execute",
-      stmt: {
-        sql: statement.sql,
-        args: (statement.args ?? []).map(toTursoArg),
-      },
-    })),
-  );
-
-  return results;
-}
-
-async function executeTursoPipeline(env, executeRequests) {
-  let response;
-
-  try {
-    response = await fetch(toTursoBaseUrl(env.TURSO_DATABASE_URL) + "/v2/pipeline", {
-    method: "POST",
-    headers: {
-      Authorization: \`Bearer \${env.TURSO_AUTH_TOKEN}\`,
-      "Content-Type": "application/json",
-    },
-    body: JSON.stringify({
-      requests: [...executeRequests, { type: "close" }],
-    }),
-  });
-  } catch (error) {
-    throw agentKitError("database_unavailable", \`Turso SQL over HTTP request failed before a response: \${error instanceof Error ? error.message : String(error)}\`);
-  }
-
-  const payload = await response.json().catch(() => null);
-
-  if (!response.ok) {
-    throw mapTursoHttpError(response.status, payload);
-  }
-
-  const results = [];
-
-  for (const [index, result] of (payload?.results ?? []).entries()) {
-    if (index >= executeRequests.length) {
-      break;
-    }
-
-    const error = result?.response?.error ?? result?.error;
-
-    if (error) {
-      throw mapTursoSqlError(error);
-    }
-
-    results.push(normalizeTursoExecuteResult(result));
-  }
-
-  return results;
-}
-
-function normalizeTursoExecuteResult(payload) {
-  const result = payload?.response?.result ?? payload?.results?.[0]?.response?.result;
-  const columns = Array.isArray(result?.cols) ? result.cols.map((column) => String(column.name || "")) : [];
-  const rows = Array.isArray(result?.rows)
-    ? result.rows.map((row) =>
-        Object.fromEntries(row.map((value, index) => [columns[index] || \`column_\${index}\`, fromTursoValue(value)])),
-      )
-    : [];
-
-  return {
-    rows,
-    rowsAffected: Number(result?.affected_row_count ?? 0),
-    lastInsertRowid: result?.last_insert_rowid ?? null,
-    columns,
-  };
-}
-
-function emptyDatabaseResult() {
-  return {
-    rows: [],
-    rowsAffected: 0,
-    lastInsertRowid: null,
-    columns: [],
-  };
-}
-
-function mapTursoHttpError(status, payload) {
-  if (status === 429 || status === 500 || status === 502 || status === 503 || status === 504) {
-    return agentKitError("database_unavailable", \`Turso SQL over HTTP is unavailable (HTTP \${status}).\`);
-  }
-
-  return mapTursoSqlError(payload?.error ?? payload);
-}
-
-function mapTursoSqlError(error) {
-  const message = readTursoErrorMessage(error);
-
-  if (/constraint failed|unique constraint|primary key|foreign key|check constraint|SQLITE_CONSTRAINT/i.test(message)) {
-    return agentKitError("constraint_conflict", "Database constraint conflict.");
-  }
-
-  if (/no such table|no such column|has no column named|schema|SQLITE_SCHEMA/i.test(message)) {
-    return agentKitError("database_schema_error", \`Database schema error: \${message}\`);
-  }
-
-  if (/syntax error|incomplete input|SQLITE_ERROR|invalid sql/i.test(message)) {
-    return agentKitError("database_query_invalid", \`Database query is invalid: \${message}\`);
-  }
-
-  return agentKitError("database_unavailable", \`Turso SQL over HTTP failed: \${message}\`);
-}
-
-function readTursoErrorMessage(error) {
-  if (!error) {
-    return "unknown Turso error";
-  }
-
-  if (typeof error === "string") {
-    return error;
-  }
-
-  if (typeof error.message === "string") {
-    return error.message;
-  }
-
-  if (typeof error.code === "string") {
-    return error.code;
-  }
-
-  return JSON.stringify(error);
-}
-
-function fromTursoValue(value) {
-  if (!value || value.type === "null") {
-    return null;
-  }
-
-  if (value.type === "integer") {
-    const numberValue = Number(value.value);
-    return Number.isSafeInteger(numberValue) ? numberValue : String(value.value);
-  }
-
-  if (value.type === "float") {
-    return Number(value.value);
-  }
-
-  if (value.type === "text" || value.type === "blob") {
-    return String(value.value ?? "");
-  }
-
-  return value.value ?? null;
-}
-
-function requireTurso(env) {
-  if (manifest.storage.database.driver !== "turso") {
-    return Response.json({ error: { code: "database_not_configured", message: "Turso is not configured." } }, { status: 404 });
-  }
-
-  if (!env.TURSO_DATABASE_URL || !env.TURSO_AUTH_TOKEN) {
-    return Response.json(
-      {
-        error: {
-          code: "deploy_not_ready",
-          message: "TURSO_DATABASE_URL and TURSO_AUTH_TOKEN must be set as Cloudflare secrets.",
-        },
-      },
-      { status: 503 },
-    );
-  }
-
-  return null;
-}
-
-function toTursoBaseUrl(value) {
-  return String(value).replace(/^libsql:\\/\\//, "https://").replace(/\\/$/, "");
-}
-
-function toTursoArg(value) {
-  if (value === null || value === undefined) {
-    return { type: "null" };
-  }
-
-  if (typeof value === "boolean") {
-    return { type: "integer", value: value ? "1" : "0" };
-  }
-
-  if (typeof value === "number" && Number.isInteger(value)) {
-    return { type: "integer", value: String(value) };
-  }
-
-  if (typeof value === "number") {
-    return { type: "float", value: String(value) };
-  }
-
-  if (typeof value === "string") {
-    return { type: "text", value };
-  }
-
-  throw agentKitError("database_query_invalid", "Database SQL args may only contain strings, numbers, booleans, or null.");
-}
-
-function objectKey(rawKey) {
-  const decoded = decodeURIComponent(String(rawKey || "")).replace(/^\\/+/, "");
-
-  if (!decoded || decoded.includes("..")) {
-    return null;
-  }
-
-  const prefix = manifest.storage.files.driver === "r2" ? manifest.storage.files.prefix : "";
-  return [prefix, decoded].filter(Boolean).join("/").replace(/\\/+/g, "/");
-}
-
-function titleFromMessage(content) {
-  const compact = content.split(/\\r?\\n/, 1)[0].replace(/\\s+/g, " ").trim();
-  return compact.length <= 80 ? compact : \`\${compact.slice(0, 77)}...\`;
-}
-
-function readStoredUsage(row) {
-  const usage = {};
-  const inputTokens = normalizeRuntimeInteger(row.input_tokens);
-  const outputTokens = normalizeRuntimeInteger(row.output_tokens);
-  const totalTokens = normalizeRuntimeInteger(row.total_tokens);
-  const cost = normalizeRuntimeCost(parseStoredJson(row.cost_json, {}));
-
-  if (inputTokens !== undefined) usage.inputTokens = inputTokens;
-  if (outputTokens !== undefined) usage.outputTokens = outputTokens;
-  if (totalTokens !== undefined) usage.totalTokens = totalTokens;
-  if (Object.keys(cost).length > 0) usage.cost = cost;
-
-  return usage;
-}
-
-function normalizeRuntimeUsage(value) {
-  if (!isRecord(value)) {
-    return {};
-  }
-
-  const usage = {};
-  const inputTokens = normalizeRuntimeInteger(value.inputTokens ?? value.input_tokens);
-  const outputTokens = normalizeRuntimeInteger(value.outputTokens ?? value.output_tokens);
-  const totalTokens = normalizeRuntimeInteger(value.totalTokens ?? value.total_tokens);
-  const cost = normalizeRuntimeCost(value.cost);
-
-  if (inputTokens !== undefined) usage.inputTokens = inputTokens;
-  if (outputTokens !== undefined) usage.outputTokens = outputTokens;
-  if (totalTokens !== undefined) usage.totalTokens = totalTokens;
-  if (Object.keys(cost).length > 0) usage.cost = cost;
-
-  return usage;
-}
-
-function normalizeRuntimeCost(value) {
-  if (!isRecord(value)) {
-    return {};
-  }
-
-  const cost = {};
-
-  for (const field of ["input", "output", "cacheRead", "cacheWrite", "total"]) {
-    const normalized = normalizeRuntimeNumber(value[field]);
-
-    if (normalized !== undefined) {
-      cost[field] = normalized;
-    }
-  }
-
-  return cost;
-}
-
-function normalizeRuntimeInteger(value) {
-  const normalized = normalizeRuntimeNumber(value);
-  return normalized !== undefined && Number.isInteger(normalized) ? normalized : undefined;
-}
-
-function normalizeRuntimeNumber(value) {
-  const parsed = typeof value === "string" && value.trim() ? Number(value) : value;
-  return typeof parsed === "number" && Number.isFinite(parsed) && parsed >= 0 ? parsed : undefined;
-}
-
-function parseStoredJson(value, fallback) {
-  if (typeof value !== "string") {
-    return fallback;
-  }
-
-  try {
-    return JSON.parse(value);
-  } catch {
-    return fallback;
-  }
-}
-`;
-}
-
-function renderWranglerConfig(agentName: string, files: AgentManifest["storage"]["files"]): string {
-  const config: Record<string, unknown> = {
-    $schema: "node_modules/wrangler/config-schema.json",
-    name: `agentkit-${slugify(agentName)}`,
-    main: "./worker.js",
-    compatibility_date: CLOUDFLARE_COMPATIBILITY_DATE,
-    compatibility_flags: [...CLOUDFLARE_COMPATIBILITY_FLAGS],
-    observability: {
-      enabled: true,
-    },
-    durable_objects: {
-      bindings: [
-        {
-          name: "AGENTKIT_CONVERSATIONS",
-          class_name: "AgentKitConversationStore",
-        },
-      ],
-    },
-    migrations: [
-      {
-        tag: "v1",
-        new_sqlite_classes: ["AgentKitConversationStore"],
-      },
-    ],
-  };
-
-  if (files.driver === "r2") {
-    config.r2_buckets = [
-      {
-        binding: files.binding,
-        bucket_name: files.bucket,
-      },
-    ];
-  }
-
-  return `${JSON.stringify(
-    config,
-    null,
-    2,
-  )}\n`;
-}
-
-function renderDurableObjectSchema(): string {
-  return `CREATE TABLE IF NOT EXISTS conversations (
-  id TEXT PRIMARY KEY,
-  agent_name TEXT NOT NULL,
-  title TEXT,
-  created_at TEXT NOT NULL,
-  updated_at TEXT NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS messages (
-  id TEXT PRIMARY KEY,
-  conversation_id TEXT NOT NULL,
-  role TEXT NOT NULL,
-  content TEXT NOT NULL,
-  created_at TEXT NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS runs (
-  id TEXT PRIMARY KEY,
-  conversation_id TEXT NOT NULL,
-  provider TEXT NOT NULL,
-  model TEXT NOT NULL,
-  status TEXT NOT NULL,
-  error_code TEXT,
-  error_message TEXT,
-  input_tokens INTEGER,
-  output_tokens INTEGER,
-  total_tokens INTEGER,
-  cost_json TEXT,
-  created_at TEXT NOT NULL,
-  completed_at TEXT
-);
-
-CREATE TABLE IF NOT EXISTS tool_calls (
-  id TEXT PRIMARY KEY,
-  run_id TEXT NOT NULL,
-  conversation_id TEXT NOT NULL,
-  tool_name TEXT NOT NULL,
-  visibility TEXT NOT NULL,
-  status TEXT NOT NULL,
-  input_json TEXT NOT NULL,
-  output_json TEXT,
-  rendered_json TEXT,
-  error_message TEXT,
-  created_at TEXT NOT NULL,
-  completed_at TEXT
-);
-`;
-}
-
-function slugify(value: string): string {
-  const slug = value
-    .toLowerCase()
-    .replace(/[^a-z0-9-]+/g, "-")
-    .replace(/^-+|-+$/g, "")
-    .slice(0, 48);
-
-  return slug || "agent";
-}
-
-function sha256(source: string): string {
-  return createHash("sha256").update(source).digest("hex");
-}