fix(vtex): bump @decocms/runtime to ^1.6.2 to restore state propagation

[viktormarinho]

Summary

• Bumps @decocms/runtime 1.3.1 → ^1.6.2, @decocms/bindings ^1.3.1 → ^1.4.0, and @modelcontextprotocol/sdk 1.20.2 → ^1.27.1 (now in dependencies, where 1.6.x expects it).
• Keeps the kubernetes-bun deploy, the serve() entrypoint, and the rest of the dev tooling untouched — this is purely a runtime version bump.

Why

Every VTEX tool call has been failing since the rollback in #429 with:

VTEX accountName is missing (tool=…) — set MESH_REQUEST_CONTEXT.state.accountName or VTEX_ACCOUNT_NAME env var.

The diagnostic logging added in #423 lets us see exactly what the deployed pod sees:

hasMeshContext: true, hasToken: true, hasConnectionId: true, hasMeshUrl: true,
stateKeys: [], stateAccountNamePresent: false

The MESH_REQUEST_CONTEXT envelope is reaching the pod fully populated, but state arrives as {}. The connection's saved configSchema values aren't being hydrated into state for the tool to read.

Vtex was on ^1.6.2 immediately before #429, where state propagation worked. The rollback dropped it three minor versions back to 1.3.1, which evidently doesn't speak the current mesh's state shape. The latency that motivated the rollback (~5s/call tools/list) was Cloudflare Workers' startup-CPU budget being blown by the 708-tool surface — that's not a problem on Bun, so we should be able to safely take the runtime upgrade without re-introducing it.

Test plan

• bun run check — clean
• bun test — 77 pass, 0 fail (mock state propagates correctly through the tool adapter)
• bun run build — bundles successfully (4.57 MB, 1268 modules)
• After deploy, confirm pod logs show stateKeys: ["accountName","appKey","appToken"] and a successful VTEX_GET_COLLECTION_PRODUCTS call.
• Watch warm tools/list latency — should stay sub-second on Bun even with the 1.6.2 cache wrapper.

If state arrives correctly after this deploy, follow-up PR can strip the diagnostic logs added in #423.

🤖 Generated with Claude Code

---

Summary by cubic

Restores VTEX tool state propagation by upgrading @decocms/runtime to ^1.6.2, fixing the missing accountName error caused by 1.3.1. No changes to the deploy setup or entrypoint.

• Bug Fixes

  • state is hydrated from MESH_REQUEST_CONTEXT again, so VTEX tools can read accountName and execute.

• Dependencies

  • @decocms/runtime: 1.3.1 → ^1.6.2
  • @decocms/bindings: ^1.3.1 → ^1.4.0
  • @modelcontextprotocol/sdk: 1.20.2 (devDependency) → ^1.27.1 (dependency)

^{Written for commit 4b3497f. Summary will update on new commits.}