fix(agent-worker): defer heavy SDKs to lazy import to clear CF startup CPU limit

The agent-worker bundle eagerly evaluated ElevenLabs (6.5MB), Polar (2.2MB),
Composio (1.2MB), FAL and Exa SDKs at isolate startup via the static tool
registry import chain, exceeding Cloudflare's script-startup CPU limit (10021)
so the worker could never deploy. Convert each to `import type` + an async
factory using dynamic `import()`, so esbuild wraps them in lazy init wrappers
and their module-init runs only on first tool use, not at startup.

Also fix the production deploy ordering: gateway must deploy before agent
because agent cross-script binds gateway's QuotaTracker DO (the defining script
must exist first). Service bindings resolve lazily so there is no cycle.

Remove dead Blaxel secret bindings (BL_API_KEY/REGION/WORKSPACE) from the
webhooks-worker — unused since the Daytona migration and blocking its deploy.

Author: iamjr15

.github/workflows/deploy-workers.yml

@@ -19,7 +19,11 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  deploy-agent:
+  # Gateway MUST deploy first: it DEFINES the QuotaTracker Durable Object that the
+  # agent worker cross-script binds to (CF requires the defining script to exist
+  # before a consumer can bind its class). Gateway's own service binding to
+  # cheatcode-agent resolves lazily, so gateway-first has no chicken-and-egg.
+  deploy-gateway:
     # Only on a successful Static Checks run on main, or a manual dispatch.
     if: ${{ github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main') }}
     runs-on: ubuntu-latest
@@ -36,16 +40,16 @@ jobs:
           node-version: 22
           cache: pnpm
       - run: pnpm install --frozen-lockfile
-      - run: pnpm turbo build --filter=@cheatcode/agent-worker
+      - run: pnpm turbo build --filter=@cheatcode/gateway-worker
       - uses: cloudflare/wrangler-action@v3
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          workingDirectory: apps/agent-worker
+          workingDirectory: apps/gateway-worker
           command: deploy
 
-  deploy-gateway:
-    needs: deploy-agent
+  deploy-agent:
+    needs: deploy-gateway
     runs-on: ubuntu-latest
     environment: production
     steps:
@@ -60,16 +64,16 @@ jobs:
           node-version: 22
           cache: pnpm
       - run: pnpm install --frozen-lockfile
-      - run: pnpm turbo build --filter=@cheatcode/gateway-worker
+      - run: pnpm turbo build --filter=@cheatcode/agent-worker
       - uses: cloudflare/wrangler-action@v3
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          workingDirectory: apps/gateway-worker
+          workingDirectory: apps/agent-worker
           command: deploy
 
   deploy-webhooks:
-    needs: deploy-gateway
+    needs: deploy-agent
     runs-on: ubuntu-latest
     environment: production
     steps:

apps/webhooks-worker/src/index.ts

@@ -45,9 +45,6 @@ export interface WebhooksEnv
   AGENT?: Fetcher;
   CLERK_WEBHOOK_SECRET?: WorkerSecret;
   CLERK_WEBHOOK_SIGNING_SECRET?: WorkerSecret;
-  BL_API_KEY?: WorkerSecret;
-  BL_REGION?: WorkerSecret;
-  BL_WORKSPACE?: WorkerSecret;
   CLOUDFLARE_ACCOUNT_ID?: string;
   CLOUDFLARE_ANALYTICS_API_TOKEN?: WorkerSecret;
   COMPOSIO_API_KEY?: WorkerSecret;

apps/webhooks-worker/wrangler.jsonc

@@ -27,21 +27,6 @@
       "store_id": "ba25994718db4707ab99a498e22eb5a6",
       "secret_name": "daytona-api-key"
     },
-    {
-      "binding": "BL_API_KEY",
-      "store_id": "ba25994718db4707ab99a498e22eb5a6",
-      "secret_name": "blaxel-api-key"
-    },
-    {
-      "binding": "BL_REGION",
-      "store_id": "ba25994718db4707ab99a498e22eb5a6",
-      "secret_name": "blaxel-region"
-    },
-    {
-      "binding": "BL_WORKSPACE",
-      "store_id": "ba25994718db4707ab99a498e22eb5a6",
-      "secret_name": "blaxel-workspace"
-    },
     {
       "binding": "CLERK_WEBHOOK_SIGNING_SECRET",
       "store_id": "ba25994718db4707ab99a498e22eb5a6",

packages/agent-core/src/mastra/tools/composio-tool.ts

@@ -1,4 +1,3 @@
-import { Composio } from "@composio/core";
 import { createTool } from "@mastra/core/tools";
 import { z } from "zod/v4";
 import {
@@ -138,7 +137,11 @@ interface BoundedJson {
   truncated: boolean;
 }
 
-function createComposioToolClient(apiKey: string): ComposioToolClient {
+// Dynamically imported so the ~1.2 MB Composio SDK stays out of the agent-worker
+// isolate's startup path (CF startup CPU limit). Only loaded when a Composio tool
+// actually fires.
+async function createComposioToolClient(apiKey: string): Promise<ComposioToolClient> {
+  const { Composio } = await import("@composio/core");
   const composio = new Composio({ apiKey });
   return {
     execute: (slug, body) => composio.tools.execute(slug, body),
@@ -190,7 +193,7 @@ export async function listComposioTools(
   }
 
   try {
-    const toolClient = client ?? createComposioToolClient(runtime.apiKey);
+    const toolClient = client ?? (await createComposioToolClient(runtime.apiKey));
     const tools = await toolClient.getTools(runtime.userId, { toolkits: [input.integration] });
     const bounded = boundedJson(tools, MAX_COMPOSIO_OUTPUT_CHARS);
     return composioListToolsOutputSchema.parse({
@@ -231,7 +234,7 @@ export async function executeComposioAction(
   }
 
   try {
-    const toolClient = client ?? createComposioToolClient(runtime.apiKey);
+    const toolClient = client ?? (await createComposioToolClient(runtime.apiKey));
     const response = composioExecuteResponseSchema.parse(
       await toolClient.execute(input.toolSlug, executeBody(input, runtime.userId, connectionId)),
     );

packages/billing/src/index.ts

@@ -1,5 +1,5 @@
 import { APIError } from "@cheatcode/observability";
-import { Polar } from "@polar-sh/sdk";
+import type { Polar } from "@polar-sh/sdk";
 import { z } from "zod";
 import { PLAN_CATALOG, type PlanCatalogEntry } from "./catalog";
 
@@ -178,7 +178,7 @@ export interface SubscriptionActionResult {
 }
 
 export async function createCheckoutUrl(input: CreateCheckoutUrlInput): Promise<string> {
-  const response = await polarClient(input.accessToken).checkouts.create({
+  const response = await (await polarClient(input.accessToken)).checkouts.create({
     allowDiscountCodes: true,
     externalCustomerId: input.userId,
     metadata: { userId: input.userId },
@@ -202,7 +202,9 @@ export async function createCustomerPortalUrl(
         externalCustomerId: input.externalCustomerId,
         ...(input.returnUrl ? { returnUrl: input.returnUrl } : {}),
       };
-  const response = await polarClient(input.accessToken).customerSessions.create(sessionInput);
+  const response = await (await polarClient(input.accessToken)).customerSessions.create(
+    sessionInput,
+  );
   return parseCustomerPortalUrl(response);
 }
 
@@ -214,7 +216,7 @@ export async function cancelSubscriptionAtPeriodEnd(
     ...(input.reason ? { customerCancellationReason: input.reason } : {}),
     ...(input.comment ? { customerCancellationComment: input.comment } : {}),
   };
-  const response = await polarClient(input.accessToken).subscriptions.update({
+  const response = await (await polarClient(input.accessToken)).subscriptions.update({
     id: input.subscriptionId,
     subscriptionUpdate,
   });
@@ -224,15 +226,15 @@ export async function cancelSubscriptionAtPeriodEnd(
 export async function reactivateSubscription(
   input: ReactivateSubscriptionInput,
 ): Promise<SubscriptionActionResult> {
-  const response = await polarClient(input.accessToken).subscriptions.update({
+  const response = await (await polarClient(input.accessToken)).subscriptions.update({
     id: input.subscriptionId,
     subscriptionUpdate: { cancelAtPeriodEnd: false },
   });
   return parseSubscriptionAction(response);
 }
 
 export async function updateCustomerProfile(input: UpdateCustomerProfileInput): Promise<void> {
-  await polarClient(input.accessToken).customers.update({
+  await (await polarClient(input.accessToken)).customers.update({
     customerUpdate: {
       email: input.email,
       ...(input.name !== undefined ? { name: input.name } : {}),
@@ -332,13 +334,18 @@ function isoDateOrNow(value: Date | null | undefined): string {
   return (value ?? new Date()).toISOString();
 }
 
-function polarClient(accessToken: string): Polar {
+// Dynamically imported so the 2.2 MB Polar SDK stays out of the importing
+// isolate's startup path (CF startup CPU limit). The agent-worker pulls this
+// package for pure entitlement math and must not pay the Polar parse cost; the
+// SDK loads only when a checkout/portal/subscription call is actually made.
+async function polarClient(accessToken: string): Promise<Polar> {
   if (accessToken.trim().length === 0) {
     throw new APIError(503, "unavailable_maintenance", "Polar access token is not configured", {
       hint: "Set POLAR_ACCESS_TOKEN in the gateway Worker environment.",
       retriable: false,
     });
   }
+  const { Polar } = await import("@polar-sh/sdk");
   return new Polar({ accessToken });
 }
 

packages/tools-media/src/elevenlabs.ts

@@ -1,5 +1,5 @@
 import { APIError } from "@cheatcode/observability";
-import { ElevenLabsClient } from "@elevenlabs/elevenlabs-js";
+import type { ElevenLabsClient } from "@elevenlabs/elevenlabs-js";
 import { z } from "zod/v4";
 import { storeBytesMediaArtifact } from "./artifacts";
 import type { MediaRuntimeContext } from "./runtime";
@@ -36,15 +36,16 @@ const TranscriptionResponseSchema = z
 export async function executeElevenLabsTts(
   input: unknown,
   runtimeContext: MediaRuntimeContext,
-  client: ElevenLabsClientLike = createElevenLabsClient(runtimeContext),
+  client?: ElevenLabsClientLike,
 ): Promise<ElevenLabsTtsOutput> {
+  const resolvedClient = client ?? (await createElevenLabsClient(runtimeContext));
   const parsedInput = ElevenLabsTtsInputSchema.parse(input);
   const request: TextToSpeechRequest = {
     modelId: parsedInput.modelId,
     outputFormat: parsedInput.outputFormat,
     text: parsedInput.text,
   };
-  const audio = await client.textToSpeech.convert(parsedInput.voiceId, request);
+  const audio = await resolvedClient.textToSpeech.convert(parsedInput.voiceId, request);
   const contentType = outputFormatContentType(parsedInput.outputFormat);
   const artifact = await storeBytesMediaArtifact({
     contentType,
@@ -71,8 +72,9 @@ export async function executeElevenLabsTts(
 export async function executeElevenLabsTranscription(
   input: unknown,
   runtimeContext: MediaRuntimeContext,
-  client: ElevenLabsClientLike = createElevenLabsClient(runtimeContext),
+  client?: ElevenLabsClientLike,
 ): Promise<ElevenLabsTranscriptionOutput> {
+  const resolvedClient = client ?? (await createElevenLabsClient(runtimeContext));
   const parsedInput = ElevenLabsTranscriptionInputSchema.parse(input);
   const audio = await transcriptionAudio(parsedInput, runtimeContext);
   const request: SpeechToTextRequest = {
@@ -84,7 +86,9 @@ export async function executeElevenLabsTranscription(
   if (parsedInput.languageCode) {
     request["languageCode"] = parsedInput.languageCode;
   }
-  const response = TranscriptionResponseSchema.parse(await client.speechToText.convert(request));
+  const response = TranscriptionResponseSchema.parse(
+    await resolvedClient.speechToText.convert(request),
+  );
   return ElevenLabsTranscriptionOutputSchema.parse({
     languageCode: response.languageCode ?? response.language_code,
     modelId: parsedInput.modelId,
@@ -93,7 +97,13 @@ export async function executeElevenLabsTranscription(
   });
 }
 
-function createElevenLabsClient(runtimeContext: MediaRuntimeContext): ElevenLabsClientLike {
+// Dynamically imported so the 6.5 MB ElevenLabs SDK is a lazy chunk — kept out
+// of the agent-worker isolate's startup path (CF startup CPU limit). Only loaded
+// when a TTS/STT tool actually fires.
+async function createElevenLabsClient(
+  runtimeContext: MediaRuntimeContext,
+): Promise<ElevenLabsClientLike> {
+  const { ElevenLabsClient } = await import("@elevenlabs/elevenlabs-js");
   return new ElevenLabsClient({
     apiKey: requireMediaProviderKey(runtimeContext, "elevenlabs"),
   });

packages/tools-media/src/fal.ts

@@ -1,5 +1,4 @@
 import { APIError } from "@cheatcode/observability";
-import { createFalClient } from "@fal-ai/client";
 import { z } from "zod/v4";
 import { storeRemoteMediaArtifact } from "./artifacts";
 import type { MediaRuntimeContext } from "./runtime";
@@ -51,12 +50,13 @@ const FalVideoResponseSchema = z
 export async function executeFalImage(
   input: unknown,
   runtimeContext: MediaRuntimeContext,
-  client: FalClientLike = createScopedFalClient(runtimeContext),
+  client?: FalClientLike,
 ): Promise<FalMediaOutput> {
+  const resolvedClient = client ?? (await createScopedFalClient(runtimeContext));
   const parsedInput = FalImageInputSchema.parse(input);
   const response = FalImageResponseSchema.parse(
     unwrapFalData(
-      await client.subscribe(parsedInput.modelId, { input: falImagePayload(parsedInput) }),
+      await resolvedClient.subscribe(parsedInput.modelId, { input: falImagePayload(parsedInput) }),
     ),
   );
   const artifact = await storeFalImageArtifact({
@@ -80,12 +80,15 @@ export async function executeFalImage(
 export async function executeFalImageEdit(
   input: unknown,
   runtimeContext: MediaRuntimeContext,
-  client: FalClientLike = createScopedFalClient(runtimeContext),
+  client?: FalClientLike,
 ): Promise<FalMediaOutput> {
+  const resolvedClient = client ?? (await createScopedFalClient(runtimeContext));
   const parsedInput = FalImageEditInputSchema.parse(input);
   const response = FalImageResponseSchema.parse(
     unwrapFalData(
-      await client.subscribe(parsedInput.modelId, { input: falImageEditPayload(parsedInput) }),
+      await resolvedClient.subscribe(parsedInput.modelId, {
+        input: falImageEditPayload(parsedInput),
+      }),
     ),
   );
   const artifact = await storeFalImageArtifact({
@@ -109,12 +112,13 @@ export async function executeFalImageEdit(
 export async function executeFalVideo(
   input: unknown,
   runtimeContext: MediaRuntimeContext,
-  client: FalClientLike = createScopedFalClient(runtimeContext),
+  client?: FalClientLike,
 ): Promise<FalMediaOutput> {
+  const resolvedClient = client ?? (await createScopedFalClient(runtimeContext));
   const parsedInput = FalVideoInputSchema.parse(input);
   const response = FalVideoResponseSchema.parse(
     unwrapFalData(
-      await client.subscribe(parsedInput.modelId, { input: falVideoPayload(parsedInput) }),
+      await resolvedClient.subscribe(parsedInput.modelId, { input: falVideoPayload(parsedInput) }),
     ),
   );
   if (!response.video) {
@@ -145,7 +149,10 @@ export async function executeFalVideo(
   });
 }
 
-function createScopedFalClient(runtimeContext: MediaRuntimeContext): FalClientLike {
+// Dynamically imported so the FAL SDK stays out of the agent-worker isolate's
+// startup path (CF startup CPU limit). Only loaded when an image/video tool fires.
+async function createScopedFalClient(runtimeContext: MediaRuntimeContext): Promise<FalClientLike> {
+  const { createFalClient } = await import("@fal-ai/client");
   return createFalClient({
     credentials: requireMediaProviderKey(runtimeContext, "fal"),
   });

packages/tools-research/src/exa.ts

@@ -1,5 +1,4 @@
 import type { ContentsOptions, RegularSearchOptions } from "exa-js";
-import Exa from "exa-js";
 import type { ResearchRuntimeContext } from "./runtime";
 import { requireResearchProviderKey } from "./runtime";
 import {
@@ -33,18 +32,22 @@ export interface ExaClientLike {
 export async function executeExaSearch(
   input: unknown,
   runtimeContext: ResearchRuntimeContext,
-  client: ExaClientLike = createExaClient(runtimeContext),
+  client?: ExaClientLike,
 ): Promise<ExaSearchOutput> {
+  const resolvedClient = client ?? (await createExaClient(runtimeContext));
   const parsedInput = ExaSearchInputSchema.parse(input);
-  const response = await client.search(parsedInput.query, exaSearchOptions(parsedInput));
+  const response = await resolvedClient.search(parsedInput.query, exaSearchOptions(parsedInput));
 
   return ExaSearchOutputSchema.parse({
     requestId: response.requestId,
     results: response.results.map(normalizeExaResult),
   });
 }
 
-function createExaClient(runtimeContext: ResearchRuntimeContext): ExaClientLike {
+// Dynamically imported so the Exa SDK stays out of the agent-worker isolate's
+// startup path (CF startup CPU limit). Only loaded when the research tool fires.
+async function createExaClient(runtimeContext: ResearchRuntimeContext): Promise<ExaClientLike> {
+  const { default: Exa } = await import("exa-js");
   const client = new Exa(requireResearchProviderKey(runtimeContext, "exa"));
   return {
     search: (query, options) =>