fix(vtex): read MESH_REQUEST_CONTEXT per-request, not from cached factory env (#431)

* fix(vtex): bump @decocms/runtime to ^1.6.2 to restore state propagation

The kubernetes-bun rollback in #429 dropped @decocms/runtime from ^1.6.2
back to 1.3.1. With 1.3.1, requests reach the pod with a populated
MESH_REQUEST_CONTEXT envelope (token/connectionId/meshUrl all set) but
state arrives as an empty object — so state.accountName is null and
every tool call fails with "VTEX accountName is missing".

Confirmed in the deployed pod logs:
  hasMeshContext: true, hasToken: true, hasConnectionId: true,
  hasMeshUrl: true, stateKeys: [], stateAccountNamePresent: false

The Workers latency that prompted the revert was startup-CPU-budget
specific to Cloudflare Workers, not a Bun problem, so this only bumps
the runtime/bindings/sdk versions and keeps the kubernetes-bun deploy
and serve()-style entrypoint intact.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(vtex): read MESH_REQUEST_CONTEXT from runtimeContext, not factory closure

Every tool was capturing `env` in its factory closure and reading
`env.MESH_REQUEST_CONTEXT` from inside execute. The @decocms/runtime
caches tool registrations after the first request (see tools.ts:
`let cached: Registrations | null`) and creates a fresh `bindings` env
per request — so the captured env is the FIRST request's snapshot,
frozen for the lifetime of the pod.

When a pod's first request happened to carry an `x-mesh-token` with
populated state, every subsequent call reused that captured state
(seemingly worked). When the first request was an unauthenticated
`tools/list` (e.g. just after a Knative scale-up), every later call
saw `state: {}` and failed with "VTEX accountName is missing" — even
though studio was correctly forwarding the JWT with the connection's
configuration_state. Verified end-to-end: studio's `buildRequestHeaders`
mints a JWT containing `state: { accountName, appKey, appToken }` for
this connection, the JWT reaches the pod, but the cached tool closure
ignores it.

The runtime expects `execute` to read per-request env from
`runtimeContext.env` (filled from AsyncLocalStorage on every call) — see
the comment in @decocms/runtime tools.ts:821 ("Tool *execution* reads
per-request context from State (AsyncLocalStorage), so reusing
definitions is safe"). Switch all four execute paths
(createToolFromOperation + the three custom tools) to read from
`runtimeContext.env` and discard the captured factory env.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: viktormarinho

vtex/server/lib/tool-adapter.ts

@@ -291,28 +291,22 @@ export interface ToolFromOperationConfig {
 export function createToolFromOperation(config: ToolFromOperationConfig) {
   const flatInput = flattenRequestSchema(config.requestSchema);
 
-  return (env: Env) =>
+  // The factory's `env` is captured ONCE when the runtime resolves tool
+  // registrations on the first request, then cached for the process lifetime
+  // (see @decocms/runtime tools.ts: `let cached: Registrations | null`).
+  // Reading `env.MESH_REQUEST_CONTEXT` from this closure pins every tool call
+  // to the FIRST request's context — so an unauthenticated tools/list at pod
+  // start would poison every subsequent state read with `state: {}`.
+  // Read per-request env from `runtimeContext` instead — the runtime fills
+  // it from AsyncLocalStorage on every execute call.
+  return (_env: Env) =>
     createTool({
       id: config.id,
       description: config.description,
       annotations: config.annotations,
       inputSchema: flatInput,
-      execute: async ({ context }) => {
-        const meshCtx = env.MESH_REQUEST_CONTEXT;
-        console.log(
-          `[VTEX] tool=${config.id} mesh-context-shape:`,
-          JSON.stringify({
-            hasMeshContext: Boolean(meshCtx),
-            hasToken: Boolean(meshCtx?.token),
-            hasConnectionId: Boolean(meshCtx?.connectionId),
-            hasMeshUrl: Boolean(meshCtx?.meshUrl),
-            stateKeys: meshCtx?.state ? Object.keys(meshCtx.state) : [],
-            stateAccountNamePresent: Boolean(
-              (meshCtx?.state as { accountName?: unknown } | undefined)
-                ?.accountName,
-            ),
-          }),
-        );
+      execute: async ({ context, runtimeContext }) => {
+        const meshCtx = (runtimeContext.env as Env).MESH_REQUEST_CONTEXT;
         const creds = resolveCredentials(meshCtx?.state);
         assertValidCredentials(creds, config.id);
         const factory = config.clientFactory ?? createVtexClient;

vtex/server/tools/custom/reorder-collection.ts

@@ -267,14 +267,18 @@ async function uploadCollectionFile(params: {
   }
 }
 
-export const reorderCollection = (env: Env) =>
+// Read per-request env from `runtimeContext` — see comment in
+// lib/tool-adapter.ts for why the factory's captured env is unsafe to read
+// inside execute (cached registrations + fresh per-request bindings).
+export const reorderCollection = (_env: Env) =>
   createTool({
     id: "VTEX_REORDER_COLLECTION",
     description:
       "Overwrite collection contents by removing current SKUs and importing a new ordered SKU list via spreadsheet file.",
     inputSchema: reorderCollectionInputSchema,
     outputSchema: reorderCollectionOutputSchema,
-    execute: async ({ context }) => {
+    execute: async ({ context, runtimeContext }) => {
+      const env = runtimeContext.env as Env;
       const reorderPromise = (async () => {
         const credentials = resolveCredentials(env.MESH_REQUEST_CONTEXT?.state);
         assertValidCredentials(credentials, "VTEX_REORDER_COLLECTION");

vtex/server/tools/custom/search-collections.ts

@@ -2,15 +2,19 @@ import { createTool } from "@decocms/runtime/tools";
 import { z } from "zod";
 import type { Env } from "../../types/env.ts";
 
-export const searchCollections = (env: Env) =>
+// Read per-request env from `runtimeContext` — see comment in
+// lib/tool-adapter.ts for why the factory's captured env is unsafe to read
+// inside execute (cached registrations + fresh per-request bindings).
+export const searchCollections = (_env: Env) =>
   createTool({
     id: "VTEX_SEARCH_COLLECTIONS",
     description: "Search collections by name or other terms.",
     annotations: { readOnlyHint: true },
     inputSchema: z.object({
       searchTerms: z.string().describe("Search terms to find collections"),
     }),
-    execute: async ({ context }) => {
+    execute: async ({ context, runtimeContext }) => {
+      const env = runtimeContext.env as Env;
       const credentials = env.MESH_REQUEST_CONTEXT.state;
       const { accountName, appKey, appToken } = credentials;
 

vtex/server/tools/custom/update-product-specifications.ts

@@ -39,14 +39,18 @@ const outputSchema = z.object({
   productId: z.number().int().positive(),
 });
 
-export const updateProductSpecifications = (env: Env) =>
+// Read per-request env from `runtimeContext` — see comment in
+// lib/tool-adapter.ts for why the factory's captured env is unsafe to read
+// inside execute (cached registrations + fresh per-request bindings).
+export const updateProductSpecifications = (_env: Env) =>
   createTool({
     id: "VTEX_UPDATE_PRODUCT_SPECIFICATIONS",
     description:
       "Replace all specifications for a product. Pass the complete set — values not included are removed. Caller does GET → merge → POST for partial updates. Counterpart of VTEX_GET_PRODUCT_SPECIFICATIONS.",
     inputSchema,
     outputSchema,
-    execute: async ({ context }) => {
+    execute: async ({ context, runtimeContext }) => {
+      const env = runtimeContext.env as Env;
       const credentials = resolveCredentials(env.MESH_REQUEST_CONTEXT?.state);
       assertValidCredentials(credentials, "VTEX_UPDATE_PRODUCT_SPECIFICATIONS");
       const url = `https://${credentials.accountName}.vtexcommercestable.com.br/api/catalog_system/pvt/products/${context.productId}/specification`;