fix(#346 review F1-F4): no 206-compress + Vary + precompress VAD + cache test

- F1 [HIGH — data corruption]: @fastify/compress was compressing 206/Range attachment responses while Content-Range still described the RAW offsets, so a resuming client (curl -C -, download managers) appended encoded bytes as raw → corrupted file. sendFileResponse now sets the request header `x-no-compression` (the documented @fastify/compress opt-out — its onSend skips when the request carries it; the reviewer's `Content-Encoding: identity` does NOT work because compress explicitly excludes `identity` and overwrites it). This opts the whole download route (both 200 full-file and 206 range) out of on-the-fly compression — correct, since attachment bytes are final and mostly binary. - F2: static responses now emit `Vary: Accept-Encoding` (the preCompressed content-negotiated /assets/* were `immutable` without Vary → shared-cache could serve a brotli variant to an identity/gzip-only client). - F3: vite compression `include` extended to .wasm/.onnx so the VAD binaries (~26MB .wasm, ~2.3MB .onnx under public/vad) are precompressed at build (.br emitted) instead of runtime-brotli'd on every request. (include REPLACES the plugin default, so the default js/css/json/html set is re-listed.) - F4: extracted the cache classification into a pure `resolveStaticAssetHeaders` + static.module.spec.ts (3 tests: /assets/* immutable+Vary, index.html no-store, non-hashed not-immutable). Gate: server tsc 0 (deps present), static.module.spec 3/3, client build emits .wasm.br/.onnx.br, frozen install 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
perf(delivery): pre-compress static + cache headers + compress API responses (#346 )
2026-07-04 23:33:59 +03:00 · 2026-07-04 21:29:54 +03:00
13 changed files with 501 additions and 218 deletions
@@ -97,6 +97,7 @@
    "typescript": "5.9.3",
    "typescript-eslint": "8.57.1",
    "vite": "8.0.5",
+    "vite-plugin-compression2": "2.5.3",
    "vitest": "4.1.6"
  }
 }
@@ -1,5 +1,6 @@
 import { defineConfig, loadEnv } from "vite";
 import react from "@vitejs/plugin-react";
+import { compression } from "vite-plugin-compression2";
 import * as path from "path";
 import { execSync } from "node:child_process";

@@ -53,7 +54,25 @@ export default defineConfig(({ mode }) => {
      },
      APP_VERSION: JSON.stringify(resolveAppVersion(envPath)),
    },
-    plugins: [react()],
+    plugins: [
+      react(),
+      // Emit .br and .gz next to every built asset so the server can serve the
+      // precompressed copy (see @fastify/static preCompressed in static.module.ts).
+      compression({
+        algorithms: ["brotliCompress", "gzip"],
+        // vite-plugin-compression2's default `include` only covers text-ish
+        // bundle output (js/mjs/json/css/html/svg/…). Extend it with the large
+        // VAD binaries copied from public/vad (.wasm ~26MB, .onnx ~2.3MB) so
+        // they are brotli/gzip'd once at build time and served via
+        // @fastify/static preCompressed — otherwise @fastify/compress would
+        // re-brotli them on EVERY request. The default types are repeated here
+        // because setting `include` replaces (does not extend) the default.
+        include: /\.(html|xml|css|json|js|mjs|svg|yaml|yml|toml|wasm|onnx)$/,
+        // index.html is rewritten at server boot (window.CONFIG injection); a
+        // precompressed copy would go stale — NEVER precompress it.
+        exclude: [/index\.html$/],
+      }),
+    ],
    build: {
      rolldownOptions: {
        output: {
@@ -43,6 +43,7 @@
    "@clickhouse/client": "^1.18.2",
    "@docmost/mcp": "workspace:*",
    "@docmost/pdf-inspector": "1.9.6",
+    "@fastify/compress": "^9.0.0",
    "@fastify/cookie": "^11.0.2",
    "@fastify/multipart": "^10.0.0",
    "@fastify/static": "^9.1.3",
@@ -455,13 +455,59 @@ export class AiChatToolsService {
        },
      }),

-      // Schema + description now live in @docmost/mcp's SHARED_TOOL_SPECS (#294).
-      // This layer keeps only its own execute-side guards (require a selection
-      // for a top-level comment; reject suggestedText on a reply / without a
-      // selection) — the schema+description are shared.
-      createComment: sharedTool(
-        sharedToolSpecs.createComment,
-        async ({
+      // INTENTIONAL per-transport divergence (not shared): the description is
+      // tuned for the in-app agent (e.g. "retry with a corrected EXACT selection"
+      // and "Reversible via the comment UI"); the standalone MCP `create_comment`
+      // keeps its own wording. Kept per-layer.
+      createComment: tool({
+        description:
+          'Add an INLINE comment to a page, or reply to an existing top-level ' +
+          'comment (one level only — the backend rejects replies to replies). ' +
+          'The comment is anchored inline to the given exact `selection` text ' +
+          '(which gets highlighted); page-level comments are NOT supported. A ' +
+          "new top-level comment REQUIRES a `selection`. Replies inherit the " +
+          "parent's anchor and take no selection. If the call fails with a " +
+          '"selection not found" error, retry with a corrected EXACT selection ' +
+          'copied verbatim from a single paragraph/block. You may also attach a ' +
+          '`suggestedText` proposing a replacement for the `selection` (a human ' +
+          'applies it from the UI); when set, the `selection` must occur exactly ' +
+          'once in the page. Reversible via the comment UI.',
+        inputSchema: modelFriendlyInput({
+          pageId: z.string().describe('The id of the page to comment on.'),
+          content: z.string().describe('The comment body as Markdown.'),
+          selection: z
+            .string()
+            .min(1)
+            .max(250)
+            .optional()
+            .describe(
+              'EXACT contiguous text from a SINGLE paragraph/block to anchor ' +
+                '(highlight) the comment on (<=250 chars, avoid spanning across ' +
+                'formatting boundaries). Required for a new top-level comment; ' +
+                'omit only when replying via parentCommentId.',
+            ),
+          parentCommentId: z
+            .string()
+            .optional()
+            .describe(
+              'Optional id of a TOP-LEVEL comment to reply to (one level ' +
+                'of replies only).',
+            ),
+          suggestedText: z
+            .string()
+            .min(1)
+            .max(2000)
+            .optional()
+            .describe(
+              'Optional proposed replacement (PLAIN TEXT) for the `selection`, ' +
+                'applied by a human via the UI (never auto-applied). REQUIRES a ' +
+                '`selection`; NOT allowed on a reply. When set, the `selection` ' +
+                'must be UNIQUE in the page — expand it with surrounding context ' +
+                '(still <=250 chars) if it occurs more than once, or the call is ' +
+                'refused.',
+            ),
+        }),
+        execute: async ({
          pageId,
          content,
          selection,
@@ -502,17 +548,26 @@ export class AiChatToolsService {
          const data = (result?.data ?? {}) as { id?: string };
          return { commentId: data.id, pageId };
        },
-      ),
+      }),

-      // Schema + description now live in @docmost/mcp's SHARED_TOOL_SPECS (#294).
-      resolveComment: sharedTool(
-        sharedToolSpecs.resolveComment,
-        async ({ commentId, resolved }) => {
+      resolveComment: tool({
+        description:
+          'Resolve or reopen a top-level comment thread (reversible — toggle ' +
+          'the resolved flag). Only top-level comments can be resolved.',
+        inputSchema: modelFriendlyInput({
+          commentId: z
+            .string()
+            .describe('The id of the top-level comment to resolve/reopen.'),
+          resolved: z
+            .boolean()
+            .describe('true to resolve the thread, false to reopen it.'),
+        }),
+        execute: async ({ commentId, resolved }) => {
          // resolveComment(commentId, resolved) -> { success, commentId, resolved }.
          await client.resolveComment(commentId, resolved);
          return { commentId, resolved };
        },
-      ),
+      }),

      // --- READ tools (added) ---

@@ -618,12 +673,24 @@ export class AiChatToolsService {
          await client.getTable(pageId, tableRef),
      }),

-      // Schema + description now live in @docmost/mcp's SHARED_TOOL_SPECS (#294).
-      listComments: sharedTool(
-        sharedToolSpecs.listComments,
-        async ({ pageId, includeResolved }) =>
+      listComments: tool({
+        description:
+          'List comments on a page in one call. By DEFAULT only ACTIVE ' +
+          'threads are returned; resolved threads (a resolved top-level ' +
+          'comment and all its replies) are hidden and their count reported ' +
+          'as `resolvedThreadsHidden` so you can re-query with ' +
+          '`includeResolved: true` to see everything. Returns ' +
+          '`{ items, resolvedThreadsHidden }`. Content is returned as Markdown.',
+        inputSchema: modelFriendlyInput({
+          pageId: z.string().describe('The id of the page.'),
+          includeResolved: z
+            .boolean()
+            .optional()
+            .describe('default only active threads; true — include resolved'),
+        }),
+        execute: async ({ pageId, includeResolved }) =>
          await client.listComments(pageId, includeResolved),
-      ),
+      }),

      getComment: tool({
        description: 'Fetch a single comment by id (content as Markdown).',
@@ -633,12 +700,26 @@ export class AiChatToolsService {
        execute: async ({ commentId }) => await client.getComment(commentId),
      }),

-      // Schema + description now live in @docmost/mcp's SHARED_TOOL_SPECS (#294).
-      checkNewComments: sharedTool(
-        sharedToolSpecs.checkNewComments,
-        async ({ spaceId, since, parentPageId }) =>
+      checkNewComments: tool({
+        description:
+          'Find new comments across a space (optionally scoped to a subtree) ' +
+          'created after a given timestamp.',
+        inputSchema: modelFriendlyInput({
+          spaceId: z.string().describe('The id of the space to scan.'),
+          since: z
+            .string()
+            .describe('An ISO-8601 timestamp; only comments created after it.'),
+          parentPageId: z
+            .string()
+            .optional()
+            .describe(
+              'Optional page id to scope the scan to that page and its ' +
+                'descendants.',
+            ),
+        }),
+        execute: async ({ spaceId, since, parentPageId }) =>
          await client.checkNewComments(spaceId, since, parentPageId),
-      ),
+      }),

      listShares: sharedTool(
        sharedToolSpecs.listShares,
@@ -108,14 +108,23 @@ export const INLINE_TOOL_TIERS: Record<
    tier: 'core',
    catalogLine: "listPages — list recent pages, or a space's full page tree.",
  },
-  // NOTE: createComment, listComments and resolveComment moved to
-  // @docmost/mcp's SHARED_TOOL_SPECS (#294); they carry their own tier +
-  // catalogLine there. getComment stays inline (MCP-only shape divergence is
-  // n/a — it simply has no shared spec).
+  listComments: {
+    tier: 'core',
+    catalogLine: 'listComments — list all comments on a page (including resolved).',
+  },
  getComment: {
    tier: 'core',
    catalogLine: 'getComment — fetch a single comment by id.',
  },
+  createComment: {
+    tier: 'core',
+    catalogLine:
+      'createComment — add an inline comment (optionally with a suggested edit).',
+  },
+  resolveComment: {
+    tier: 'core',
+    catalogLine: 'resolveComment — resolve or reopen a comment thread.',
+  },

  // --- deferred inline ---
  createPage: {
@@ -148,8 +157,11 @@ export const INLINE_TOOL_TIERS: Record<
    tier: 'deferred',
    catalogLine: 'getTable — read a table as a matrix of cell texts and cell ids.',
  },
-  // NOTE: checkNewComments moved to @docmost/mcp's SHARED_TOOL_SPECS (#294);
-  // it carries its own deferred tier + catalogLine there.
+  checkNewComments: {
+    tier: 'deferred',
+    catalogLine:
+      'checkNewComments — find comments in a space created after a timestamp.',
+  },
  getPageHistory: {
    tier: 'deferred',
    catalogLine:
@@ -474,6 +474,19 @@ export class AttachmentController {
    const fileSize = Number(attachment.fileSize);
    const rangeHeader = req.headers.range;

+    // Opt this download route out of the global @fastify/compress hook.
+    // Attachment bytes are final and mostly binary, so on-the-fly compression
+    // only burns CPU — and on the 206/Range branch it is actively corrupting:
+    // compress decides purely by Content-Type, so for a compressible mime
+    // (application/octet-stream fallback, image/svg+xml, text/*) it would gzip
+    // the byte slice and drop Content-Length while Content-Range still
+    // describes the RAW offsets and the status stays 206. A resuming client
+    // (`curl -C -`, download managers) then appends the encoded bytes as if
+    // raw and ends up with a broken file. @fastify/compress skips whenever the
+    // request carries `x-no-compression` (see its onSend hook), so setting it
+    // here covers both the 200 (full file) and 206 (range) responses.
+    req.headers['x-no-compression'] = 'true';
+
    res.header('Accept-Ranges', 'bytes');
    res.header(
      'Content-Security-Policy',
@@ -0,0 +1,35 @@
+import { resolveStaticAssetHeaders } from './static.module';
+
+// Unit tests for the static-asset cache classifier extracted from the
+// @fastify/static setHeaders callback (precedent: sandbox.controller.spec.ts).
+describe('resolveStaticAssetHeaders', () => {
+  it('marks a content-hashed /assets/ file immutable and sets Vary', () => {
+    const headers = resolveStaticAssetHeaders(
+      '/app/apps/client/dist/assets/index-a1b2c3.js',
+    );
+    expect(headers['cache-control']).toBe(
+      'public, max-age=31536000, immutable',
+    );
+    expect(headers['vary']).toBe('Accept-Encoding');
+  });
+
+  it('makes index.html always revalidate (never immutable)', () => {
+    const headers = resolveStaticAssetHeaders(
+      '/app/apps/client/dist/index.html',
+    );
+    expect(headers['cache-control']).toBe(
+      'no-cache, no-store, must-revalidate',
+    );
+    expect(headers['vary']).toBe('Accept-Encoding');
+  });
+
+  it('does NOT mark a non-hashed asset immutable but still sets Vary', () => {
+    const headers = resolveStaticAssetHeaders(
+      '/app/apps/client/dist/locales/en.json',
+    );
+    // No immutable cache-control — this path keeps @fastify/static's default
+    // etag/last-modified revalidation.
+    expect(headers['cache-control']).toBeUndefined();
+    expect(headers['vary']).toBe('Accept-Encoding');
+  });
+});
@@ -5,6 +5,46 @@ import * as fs from 'node:fs';
 import fastifyStatic from '@fastify/static';
 import { EnvironmentService } from '../environment/environment.service';

+/**
+ * Resolve the response headers for a statically served client asset.
+ *
+ * Extracted from the @fastify/static `setHeaders` callback so the cache
+ * classification stays a pure, unit-testable function (see
+ * static.module.spec.ts).
+ *
+ * `Vary: Accept-Encoding` is emitted for every static response because
+ * @fastify/static negotiates a precompressed .br/.gz neighbour by the client's
+ * Accept-Encoding but does NOT set Vary itself. Without it a shared/proxy cache
+ * keyed on the URL alone could store the brotli variant and later serve it to a
+ * client that only sent `Accept-Encoding: identity`/gzip → an undecodable body.
+ * This matters most for the immutable /assets/ files, which proxies may keep
+ * for a year.
+ */
+export function resolveStaticAssetHeaders(
+  filePath: string,
+): Record<string, string> {
+  const headers: Record<string, string> = { vary: 'Accept-Encoding' };
+
+  // Content-hashed files under /assets/ never change for a given URL, so they
+  // can be cached forever and skip revalidation entirely.
+  if (filePath.includes('/assets/')) {
+    headers['cache-control'] = 'public, max-age=31536000, immutable';
+    return headers;
+  }
+
+  // index.html is rewritten at boot (window.CONFIG injection) and on every
+  // deploy — it must be revalidated on every load.
+  if (filePath.endsWith('index.html')) {
+    headers['cache-control'] = 'no-cache, no-store, must-revalidate';
+    return headers;
+  }
+
+  // Everything else (locales, vad, icons, manifest) is NOT content-hashed and
+  // changes between deploys, so it keeps @fastify/static's default
+  // etag/last-modified revalidation — do NOT mark it immutable.
+  return headers;
+}
+
@Module({})
 export class StaticModule implements OnModuleInit {
  constructor(
@@ -68,6 +108,16 @@ export class StaticModule implements OnModuleInit {
      await app.register(fastifyStatic, {
        root: clientDistPath,
        wildcard: false,
+        // Serve the build-time .br/.gz neighbour when the client accepts it
+        // (see vite-plugin-compression2 in apps/client/vite.config.ts).
+        preCompressed: true,
+        setHeaders: (res, filePath) => {
+          for (const [name, value] of Object.entries(
+            resolveStaticAssetHeaders(filePath),
+          )) {
+            res.setHeader(name, value);
+          }
+        },
      });

      app.get(RENDER_PATH, (req: any, res: any) => {
@@ -10,6 +10,7 @@ import { TransformHttpResponseInterceptor } from './common/interceptors/http-res
 import { WsRedisIoAdapter } from './ws/adapter/ws-redis.adapter';
 import fastifyMultipart from '@fastify/multipart';
 import fastifyCookie from '@fastify/cookie';
+import fastifyCompress from '@fastify/compress';
 import fastifyIp from 'fastify-ip';
 import { InternalLogFilter } from './common/logger/internal-log-filter';
 import { EnvironmentService } from './integrations/environment/environment.service';
@@ -60,6 +61,17 @@ async function bootstrap() {
  await app.register(fastifyIp);
  await app.register(fastifyMultipart);
  await app.register(fastifyCookie);
+  // Compress dynamic responses (API JSON, the rewritten share-SEO HTML) when the
+  // client accepts br/gzip. @fastify/compress only compresses content-types that
+  // mime-db flags `compressible` (application/json, text/html, …); `text/event-stream`
+  // is not in mime-db, so SSE is never compressed by the allowlist. The AI-chat
+  // stream additionally hijacks the raw socket (pipeUIMessageStreamToResponse ->
+  // res.raw in ai-chat.service.ts), bypassing Fastify's reply/onSend lifecycle
+  // entirely, so this hook can never buffer that stream.
+  await app.register(fastifyCompress, {
+    // Skip tiny payloads where compression overhead outweighs the savings.
+    threshold: 1024,
+  });

  const environmentService = app.get(EnvironmentService);
  const frameHeader = resolveFrameHeader(
@@ -12,6 +12,11 @@ services:
    ports:
      - "3000:3000"
    restart: unless-stopped
+    # The app already serves precompressed (brotli/gzip) static assets with
+    # long-lived cache headers and gzips dynamic API responses. For the best
+    # cold-load latency you can OPTIONALLY put a reverse proxy (caddy / nginx /
+    # traefik) in front with HTTP/2 (or HTTP/3) and brotli enabled — none is
+    # required for compression to work.
    volumes:
      - docmost:/app/data/storage

@@ -721,8 +721,26 @@ server.registerTool(
 // --- Comment tools (ported from upstream PR #3 by Max Nikitin) ---

 // Tool: list_comments
-registerShared(
-  SHARED_TOOL_SPECS.listComments,
+server.registerTool(
+  "list_comments",
+  {
+    description:
+      "List comments on a page in one call (pagination is handled " +
+      "internally). By DEFAULT only ACTIVE threads are returned; resolved " +
+      "threads (a resolved top-level comment and all its replies) are hidden " +
+      "and their count reported as `resolvedThreadsHidden` so you can re-query " +
+      "with `includeResolved: true` to see everything. Returns " +
+      "`{ items, resolvedThreadsHidden }`. Content is returned as Markdown.",
+    inputSchema: {
+      pageId: z.string().describe("ID of the page"),
+      includeResolved: z
+        .boolean()
+        .optional()
+        .describe(
+          "default only active threads; true — include resolved",
+        ),
+    },
+  },
  async ({ pageId, includeResolved }) => {
    const comments = await docmostClient.listComments(pageId, includeResolved);
    return jsonContent(comments);
@@ -730,11 +748,55 @@ registerShared(
 );

 // Tool: create_comment
-// Schema + description now live in the shared registry (#294). The execute body
-// keeps this transport's own guards (require a selection for a top-level
-// comment; reject suggestedText on a reply / without a selection).
-registerShared(
-  SHARED_TOOL_SPECS.createComment,
+// INTENTIONAL per-transport divergence (not shared): the in-app copy tunes the
+// guidance for the in-app agent (e.g. "retry with a corrected EXACT selection"
+// and "Reversible via the comment UI"); this transport keeps its own wording.
+server.registerTool(
+  "create_comment",
+  {
+    description:
+      "Create a new comment on a page. The comment is ALWAYS inline and is " +
+      "anchored to (highlights) its `selection` text — there are no page-level " +
+      "comments. Content is provided as Markdown and automatically converted. " +
+      "A top-level comment REQUIRES an exact `selection`; if the selection " +
+      "cannot be found in the page the call fails (no orphan comment is left). " +
+      "Replies (parentCommentId set) inherit the parent's anchor and take no " +
+      "selection. You may also attach a `suggestedText` proposing a replacement " +
+      "for the `selection`; a human applies (or rejects) it from the UI. When " +
+      "`suggestedText` is set the `selection` MUST occur exactly once in the " +
+      "page — expand it with surrounding context if it is ambiguous.",
+    inputSchema: {
+      pageId: z.string().describe("ID of the page to comment on"),
+      content: z.string().min(1).describe("Comment content in Markdown format"),
+      selection: z
+        .string()
+        .min(1)
+        // Enforce the documented 250-char cap to match the description above.
+        .max(250)
+        .optional()
+        .describe(
+          "EXACT contiguous text from a single paragraph/block to anchor the " +
+            "comment on (<=250 chars). Required for a top-level comment; omit " +
+            "only when replying via parentCommentId.",
+        ),
+      parentCommentId: z
+        .string()
+        .optional()
+        .describe("Parent comment ID to create a reply (max 2 nesting levels)"),
+      suggestedText: z
+        .string()
+        .min(1)
+        .max(2000)
+        .optional()
+        .describe(
+          "Optional proposed replacement (PLAIN TEXT) for the `selection`, " +
+            "applied by a human via the UI (never auto-applied). REQUIRES a " +
+            "`selection`; NOT allowed on a reply. When set, the `selection` must " +
+            "be UNIQUE in the page — expand it with surrounding context (still " +
+            "<=250 chars) if it occurs more than once, or the call is refused.",
+        ),
+    },
+  },
  async ({ pageId, content, selection, parentCommentId, suggestedText }) => {
    if (!parentCommentId && (!selection || !selection.trim())) {
      throw new Error(
@@ -810,9 +872,28 @@ server.registerTool(
 );

 // Tool: resolve_comment
-// Schema + description now live in the shared registry (#294).
-registerShared(
-  SHARED_TOOL_SPECS.resolveComment,
+server.registerTool(
+  "resolve_comment",
+  {
+    description:
+      "Resolve (close) or reopen a comment thread. Only top-level comments can " +
+      "be resolved — the server rejects resolving a reply. Reversible: pass " +
+      "resolved=false to reopen. Resolving keeps the thread and its replies " +
+      "(unlike delete_comment, which permanently removes them).",
+    inputSchema: {
+      commentId: z
+        .string()
+        .min(1)
+        .describe("ID of the top-level comment thread to resolve or reopen"),
+      resolved: z
+        .boolean()
+        .optional()
+        .default(true)
+        .describe(
+          "true (default) marks the thread resolved/closed; false reopens it",
+        ),
+    },
+  },
  async ({ commentId, resolved }) => {
    const result = await docmostClient.resolveComment(commentId, resolved);
    return jsonContent(result);
@@ -820,10 +901,30 @@ registerShared(
 );

 // Tool: check_new_comments
-// Schema + description now live in the shared registry (#294). The execute body
-// keeps this transport's own guard rejecting an unparseable `since` timestamp.
-registerShared(
-  SHARED_TOOL_SPECS.checkNewComments,
+server.registerTool(
+  "check_new_comments",
+  {
+    description:
+      "Check for new comments across pages in a space since a given timestamp. " +
+      "Optionally scope to a page subtree (folder). Returns only comments " +
+      "created after the specified time.",
+    inputSchema: {
+      spaceId: z.string().describe("Space ID to check for new comments"),
+      since: z
+        .string()
+        .min(1)
+        .describe(
+          "ISO 8601 timestamp — only return comments created after this time (e.g. '2026-03-10T00:00:00Z')",
+        ),
+      parentPageId: z
+        .string()
+        .optional()
+        .describe(
+          "Optional root page ID to scope the check to a subtree (folder). " +
+            "Only pages under this parent will be checked.",
+        ),
+    },
+  },
  async ({ spaceId, since, parentPageId }) => {
    // Reject an unparseable timestamp up front: otherwise the comparison
    // against NaN silently treats every comment as "not new" and the tool
@@ -509,175 +509,4 @@ export const SHARED_TOOL_SPECS = {
      pageId: z.string().min(1),
    }),
  },
-
-  // --- comment tools (unified from the per-layer inline definitions, #294) ---
-  //
-  // create_comment and resolve_comment previously carried a "per-transport
-  // divergence" note in BOTH layers; #294 unifies their schema + description
-  // here. Only the four tools that genuinely exist in BOTH layers live in the
-  // registry: create/list/resolve comment and check_new_comments.
-  //
-  // update_comment and delete_comment are intentionally NOT here: they exist
-  // ONLY on the standalone MCP server. The in-app agent deliberately exposes no
-  // hard comment edit/delete tool (comment edits are irreversible / not
-  // version-tracked; see the guardrail tests in ai-chat-tools.service.spec.ts),
-  // so there is nothing to unify — they stay inline in index.ts.
-
-  createComment: {
-    mcpName: 'create_comment',
-    inAppKey: 'createComment',
-    // CANONICAL: the in-app copy (the more-maintained one). It keeps the same
-    // rules as the MCP copy — inline-only, top-level requires a `selection`, no
-    // page-level comments, replies inherit the anchor, suggestedText must be
-    // unique — and adds the "retry with a corrected EXACT selection" and reply-
-    // to-reply-rejected guidance the MCP copy lacked. Execute-side validation
-    // (reject suggestedText on a reply, require a selection) stays per-layer.
-    description:
-      'Add an INLINE comment to a page, or reply to an existing top-level ' +
-      'comment (one level only — the backend rejects replies to replies). ' +
-      'The comment is anchored inline to the given exact `selection` text ' +
-      '(which gets highlighted); page-level comments are NOT supported. A ' +
-      'new top-level comment REQUIRES a `selection`. Replies inherit the ' +
-      "parent's anchor and take no selection. If the call fails with a " +
-      '"selection not found" error, retry with a corrected EXACT selection ' +
-      'copied verbatim from a single paragraph/block. You may also attach a ' +
-      '`suggestedText` proposing a replacement for the `selection` (a human ' +
-      'applies it from the UI); when set, the `selection` must occur exactly ' +
-      'once in the page. Reversible via the comment UI.',
-    tier: 'core',
-    catalogLine:
-      'createComment — add an inline comment (optionally with a suggested edit).',
-    // Reconciled schema: the field set is identical across both layers; the
-    // only constraint drift is `content`, which the MCP copy pinned to
-    // .min(1) while the in-app copy left unbounded — the stricter MCP form is
-    // kept (an empty comment body is never valid).
-    buildShape: (z) => ({
-      pageId: z.string().describe('The id of the page to comment on.'),
-      content: z.string().min(1).describe('The comment body as Markdown.'),
-      selection: z
-        .string()
-        .min(1)
-        .max(250)
-        .optional()
-        .describe(
-          'EXACT contiguous text from a SINGLE paragraph/block to anchor ' +
-            '(highlight) the comment on (<=250 chars, avoid spanning across ' +
-            'formatting boundaries). Required for a new top-level comment; ' +
-            'omit only when replying via parentCommentId.',
-        ),
-      parentCommentId: z
-        .string()
-        .optional()
-        .describe(
-          'Optional id of a TOP-LEVEL comment to reply to (one level ' +
-            'of replies only).',
-        ),
-      suggestedText: z
-        .string()
-        .min(1)
-        .max(2000)
-        .optional()
-        .describe(
-          'Optional proposed replacement (PLAIN TEXT) for the `selection`, ' +
-            'applied by a human via the UI (never auto-applied). REQUIRES a ' +
-            '`selection`; NOT allowed on a reply. When set, the `selection` ' +
-            'must be UNIQUE in the page — expand it with surrounding context ' +
-            '(still <=250 chars) if it occurs more than once, or the call is ' +
-            'refused.',
-        ),
-    }),
-  },
-
-  listComments: {
-    mcpName: 'list_comments',
-    inAppKey: 'listComments',
-    // CANONICAL: the two copies are near-identical; the MCP copy is the
-    // superset (it keeps the "(pagination is handled internally)" note the
-    // in-app copy dropped), so it is used verbatim.
-    description:
-      'List comments on a page in one call (pagination is handled ' +
-      'internally). By DEFAULT only ACTIVE threads are returned; resolved ' +
-      'threads (a resolved top-level comment and all its replies) are hidden ' +
-      'and their count reported as `resolvedThreadsHidden` so you can re-query ' +
-      'with `includeResolved: true` to see everything. Returns ' +
-      '`{ items, resolvedThreadsHidden }`. Content is returned as Markdown.',
-    tier: 'core',
-    catalogLine:
-      'listComments — list all comments on a page (including resolved).',
-    buildShape: (z) => ({
-      pageId: z.string().describe('ID of the page'),
-      includeResolved: z
-        .boolean()
-        .optional()
-        .describe('default only active threads; true — include resolved'),
-    }),
-  },
-
-  resolveComment: {
-    mcpName: 'resolve_comment',
-    inAppKey: 'resolveComment',
-    // CANONICAL: the MCP copy's richer wording, minus its snake_case reference
-    // to `delete_comment` (a sibling tool that does NOT exist in the in-app
-    // layer) — rephrased transport-neutrally per the registry convention.
-    description:
-      'Resolve (close) or reopen a top-level comment thread (reversible — ' +
-      'pass resolved=false to reopen). Only top-level comments can be ' +
-      'resolved; the server rejects resolving a reply. Resolving keeps the ' +
-      'thread and its replies intact (it is not a deletion).',
-    tier: 'core',
-    catalogLine: 'resolveComment — resolve or reopen a comment thread.',
-    // Reconciled schema: `resolved` drifted — the MCP copy made it optional
-    // with .default(true) (resolve is the common case, documented), the in-app
-    // copy made it required. The MCP form is kept (a strict superset: it never
-    // rejects a previously-valid input and adds a sensible default), and
-    // commentId keeps the MCP copy's stricter .min(1).
-    buildShape: (z) => ({
-      commentId: z
-        .string()
-        .min(1)
-        .describe('ID of the top-level comment thread to resolve or reopen'),
-      resolved: z
-        .boolean()
-        .optional()
-        .default(true)
-        .describe(
-          'true (default) marks the thread resolved/closed; false reopens it',
-        ),
-    }),
-  },
-
-  checkNewComments: {
-    mcpName: 'check_new_comments',
-    inAppKey: 'checkNewComments',
-    // CANONICAL: the MCP copy (the more detailed of the two). The MCP layer's
-    // execute-side guard that rejects an unparseable `since` timestamp stays in
-    // its execute body (per-layer logic), not in the shared schema.
-    description:
-      'Check for new comments across pages in a space since a given ' +
-      'timestamp. Optionally scope to a page subtree (folder). Returns only ' +
-      'comments created after the specified time.',
-    tier: 'deferred',
-    catalogLine:
-      'checkNewComments — find comments in a space created after a timestamp.',
-    // Reconciled schema: `since` keeps the MCP copy's stricter .min(1) (the
-    // in-app copy left it unbounded); field descriptions use the MCP copy's
-    // more detailed wording (it carries an example timestamp).
-    buildShape: (z) => ({
-      spaceId: z.string().describe('Space ID to check for new comments'),
-      since: z
-        .string()
-        .min(1)
-        .describe(
-          "ISO 8601 timestamp — only return comments created after this time " +
-            "(e.g. '2026-03-10T00:00:00Z')",
-        ),
-      parentPageId: z
-        .string()
-        .optional()
-        .describe(
-          'Optional root page ID to scope the check to a subtree (folder). ' +
-            'Only pages under this parent will be checked.',
-        ),
-    }),
-  },
 } satisfies Record<string, SharedToolSpec>;
@@ -501,6 +501,9 @@ importers:
      vite:
        specifier: 8.0.5
        version: 8.0.5(@types/node@22.19.1)(esbuild@0.28.0)(jiti@2.4.2)(less@4.2.0)(sugarss@5.0.1(postcss@8.5.14))(terser@5.39.0)(tsx@4.21.0)(yaml@2.8.3)
+      vite-plugin-compression2:
+        specifier: 2.5.3
+        version: 2.5.3
      vitest:
        specifier: 4.1.6
        version: 4.1.6(@opentelemetry/api@1.9.0)(@types/node@22.19.1)(@vitest/coverage-v8@4.1.6)(happy-dom@20.8.9)(jsdom@25.0.0)(vite@8.0.5(@types/node@22.19.1)(esbuild@0.28.0)(jiti@2.4.2)(less@4.2.0)(sugarss@5.0.1(postcss@8.5.14))(terser@5.39.0)(tsx@4.21.0)(yaml@2.8.3))
@@ -540,6 +543,9 @@ importers:
      '@docmost/pdf-inspector':
        specifier: 1.9.6
        version: 1.9.6
+      '@fastify/compress':
+        specifier: ^9.0.0
+        version: 9.0.0
      '@fastify/cookie':
        specifier: ^11.0.2
        version: 11.0.2
@@ -2694,6 +2700,9 @@ packages:
  '@fastify/busboy@3.1.1':
    resolution: {integrity: sha512-5DGmA8FTdB2XbDeEwc/5ZXBl6UbBAyBOOLlPuBnZ/N1SwdH9Ii+cOX3tBROlDgcTXxjOYnLMVoKk9+FXAw0CJw==}

+  '@fastify/compress@9.0.0':
+    resolution: {integrity: sha512-PZRg+ut5xd/ubsGPWfoPNryoCOtEdHboIWpDieTUHov1gKdLitF8mRmT3JbqNnRbelQXSNXUsIpakAEKR6AcTQ==}
+
  '@fastify/cookie@11.0.2':
    resolution: {integrity: sha512-GWdwdGlgJxyvNv+QcKiGNevSspMQXncjMZ1J8IvuDQk0jvkzgWWZFNC2En3s+nHndZBGV8IbLwOI/sxCZw/mzA==}

@@ -4487,6 +4496,15 @@ packages:
  '@rolldown/pluginutils@1.0.0-rc.7':
    resolution: {integrity: sha512-qujRfC8sFVInYSPPMLQByRh7zhwkGFS4+tyMQ83srV1qrxL4g8E2tyxVVyxd0+8QeBM1mIk9KbWxkegRr76XzA==}

+  '@rollup/pluginutils@5.4.0':
+    resolution: {integrity: sha512-MfPp06CjRLfXQ3wY0R8vJDYBy/MvVcc9OulEfR0B8Iv9ko+GCNaRZ+EpJYFl27LhKsZK0o420sYCRHCjfCgeUg==}
+    engines: {node: '>=14.0.0'}
+    peerDependencies:
+      rollup: ^1.20.0||^2.0.0||^3.0.0||^4.0.0
+    peerDependenciesMeta:
+      rollup:
+        optional: true
+
  '@selderee/plugin-htmlparser2@0.11.0':
    resolution: {integrity: sha512-P33hHGdldxGabLFjPPpaTxVolMrzrcegejx+0GxjrIb9Zv48D8yAIA/QTDR2dFl7Uz7urX8aX6+5bCZslr+gWQ==}

@@ -5676,6 +5694,10 @@ packages:
    resolution: {integrity: sha512-/XrFJgzQQQHpti1raDJC6m4ws6aNktmjBlhk8Fdlk7LwCEuDoieEJJY9OFHjfiFJFFRM2tK+Ky/IsfbbmlMu1w==}
    engines: {node: ^22.22.2 || ^24.15.0 || >=26.0.0}

+  abort-controller@3.0.0:
+    resolution: {integrity: sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==}
+    engines: {node: '>=6.5'}
+
  abstract-logging@2.0.1:
    resolution: {integrity: sha512-2BjRTZxTPvheOvGbBslFSYOUkr+SjPtOnrLP33f+VIWLzezQpZcqVg7ja3L4dBXmzzgwT+a029jRx5PCi3JuiA==}

@@ -6055,6 +6077,9 @@ packages:
  buffer@5.7.1:
    resolution: {integrity: sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==}

+  buffer@6.0.3:
+    resolution: {integrity: sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==}
+
  bullmq@5.76.10:
    resolution: {integrity: sha512-LWve7SpQjYSpCP2GEsWmoyzTz2H37L8HRmSTu3YihYsTOr5kJxrfEX6aEV7m6eskEMWXSHZYTMZepX6qNaH6CQ==}
    engines: {node: '>=12.22.0'}
@@ -6810,6 +6835,9 @@ packages:
    resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
    engines: {node: '>= 0.4'}

+  duplexify@3.7.1:
+    resolution: {integrity: sha512-07z8uv2wMyS51kKhD1KsdXJg5WQ6t93RneqRxUHnskXVtlYYkLqM0gqStQZ3pj073g687jPCHrqNfCzawLYh5g==}
+
  ecdsa-sig-formatter@1.0.11:
    resolution: {integrity: sha512-nagl3RYrbNv6kQkeJIpt6NJZy8twLB/2vtz6yN9Z4vRKHN4/QZJIEbqohALSgwKdnksuY3k5Addp5lg8sVoVcQ==}

@@ -7053,6 +7081,9 @@ packages:
    resolution: {integrity: sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==}
    engines: {node: '>=4.0'}

+  estree-walker@2.0.2:
+    resolution: {integrity: sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==}
+
  estree-walker@3.0.3:
    resolution: {integrity: sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==}

@@ -7064,6 +7095,10 @@ packages:
    resolution: {integrity: sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==}
    engines: {node: '>= 0.6'}

+  event-target-shim@5.0.1:
+    resolution: {integrity: sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==}
+    engines: {node: '>=6'}
+
  eventemitter2@6.4.9:
    resolution: {integrity: sha512-JEPTiaOt9f04oa6NOkc4aH+nVp5I3wEjpHbIPqfgCdD5v5bUzy7xQqwcVO2aDQgOWhI28da57HksMrzK9HlRxg==}

@@ -9073,6 +9108,9 @@ packages:
  peberminta@0.9.0:
    resolution: {integrity: sha512-XIxfHpEuSJbITd1H3EeQwpcZbTLHc+VVr8ANI9t5sit565tsI4/xK3KWTUFE2e6QiangUkh3B0jihzmGnNrRsQ==}

+  peek-stream@1.1.3:
+    resolution: {integrity: sha512-FhJ+YbOSBb9/rIl2ZeE/QHEsWn7PqNYt8ARAY3kIgNGOk13g9FGyIY6JIl/xB/3TFRVoTv5as0l11weORrTekA==}
+
  pend@1.2.0:
    resolution: {integrity: sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg==}

@@ -9318,6 +9356,10 @@ packages:
  process-warning@5.0.0:
    resolution: {integrity: sha512-a39t9ApHNx2L4+HBnQKqxxHNs1r7KF+Intd8Q/g1bUh6q0WIp9voPXJ/x0j+ZL45KF1pJd9+q2jLIRMfvEshkA==}

+  process@0.11.10:
+    resolution: {integrity: sha512-cdGef/drWFoydD1JsMzuFf8100nZl+GT+yacc2bEced5f9Rjk4z+WtFUTBu9PhOi9j/jfmBPu0mMEY4wIdAF8A==}
+    engines: {node: '>= 0.6.0'}
+
  prompts@2.4.2:
    resolution: {integrity: sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q==}
    engines: {node: '>= 6'}
@@ -9609,6 +9651,10 @@ packages:
    resolution: {integrity: sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==}
    engines: {node: '>= 6'}

+  readable-stream@4.7.0:
+    resolution: {integrity: sha512-oIGGmcpTLwPga8Bn6/Z75SVaH1z5dUut2ibSyAMVhmUggWpmDn2dapB0n7f8nwaSiRtepAsfJyfXIO5DCVAODg==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+
  readdirp@3.6.0:
    resolution: {integrity: sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==}
    engines: {node: '>=8.10.0'}
@@ -9997,6 +10043,9 @@ packages:
  stream-browserify@3.0.0:
    resolution: {integrity: sha512-H73RAHsVBapbim0tU2JwwOiXUj+fikfiaoYAKHF3VJfA0pe2BCzkhAHBlLG6REzE+2WNZcxOXjK7lkso+9euLA==}

+  stream-shift@1.0.3:
+    resolution: {integrity: sha512-76ORR0DO1o1hlKwTbi/DM3EXWGf3ZJYO8cXX5RJwnul2DEg2oyoZyjLNoQM8WsvZiFKCRfC1O0J7iCvie3RZmQ==}
+
  strict-event-emitter-types@2.0.0:
    resolution: {integrity: sha512-Nk/brWYpD85WlOgzw5h173aci0Teyv8YdIAEtV+N88nDB0dLlazZyJMIsN6eo1/AR61l+p6CJTG1JIyFaoNEEA==}

@@ -10137,6 +10186,9 @@ packages:
    resolution: {integrity: sha512-g9ljZiwki/LfxmQADO3dEY1CbpmXT5Hm2fJ+QaGKwSXUylMybePR7/67YW7jOrrvjEgL1Fmz5kzyAjWVWLlucg==}
    engines: {node: '>=6'}

+  tar-mini@0.2.0:
+    resolution: {integrity: sha512-+qfUHz700DWnRutdUsxRRVZ38G1Qr27OetwaMYTdg8hcPxf46U0S1Zf76dQMWRBmusOt2ZCK5kbIaiLkoGO7WQ==}
+
  tar-stream@2.2.0:
    resolution: {integrity: sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==}
    engines: {node: '>=6'}
@@ -10177,6 +10229,9 @@ packages:
    resolution: {integrity: sha512-nt6AMGKW1p/70DF/hGBdJB57B8Tspmbp5gfJ8ilhLnt7kkr2ye7hzD6NVG8GGErk2HWF34igrL2CXmNIkzKqKw==}
    engines: {node: '>=18'}

+  through2@2.0.5:
+    resolution: {integrity: sha512-/mrRod8xqpA+IHSLyGCQ2s8SPHiCDEeQJSep1jqLYeEUClOFG2Qsh+4FU6G9VeqpZnGW/Su8LQGc4YKni5rYSQ==}
+
  tiny-invariant@1.3.3:
    resolution: {integrity: sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg==}

@@ -10582,6 +10637,9 @@ packages:
    resolution: {integrity: sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==}
    engines: {node: '>= 0.8'}

+  vite-plugin-compression2@2.5.3:
+    resolution: {integrity: sha512-ItPgqQWkcnBbVw7is9OKwiZ8v6+ju9rYROl5Lp6QfQDEx/d55AwJQb/KLpsQqsU9HoigYBsZ8tK6I02UwJNvEw==}
+
  vite@8.0.5:
    resolution: {integrity: sha512-nmu43Qvq9UopTRfMx2jOYW5l16pb3iDC1JH6yMuPkpVbzK0k+L7dfsEDH4jRgYFmsg0sTAqkojoZgzLMlwHsCQ==}
    engines: {node: ^20.19.0 || >=22.12.0}
@@ -12921,6 +12979,15 @@ snapshots:

  '@fastify/busboy@3.1.1': {}

+  '@fastify/compress@9.0.0':
+    dependencies:
+      '@fastify/accept-negotiator': 2.0.1
+      fastify-plugin: 5.1.0
+      mime-db: 1.54.0
+      minipass: 7.1.3
+      peek-stream: 1.1.3
+      readable-stream: 4.7.0
+
  '@fastify/cookie@11.0.2':
    dependencies:
      cookie: 1.1.1
@@ -14936,6 +15003,12 @@ snapshots:

  '@rolldown/pluginutils@1.0.0-rc.7': {}

+  '@rollup/pluginutils@5.4.0':
+    dependencies:
+      '@types/estree': 1.0.9
+      estree-walker: 2.0.2
+      picomatch: 4.0.4
+
  '@selderee/plugin-htmlparser2@0.11.0':
    dependencies:
      domhandler: 5.0.3
@@ -16153,7 +16226,7 @@ snapshots:
      obug: 2.1.1
      std-env: 4.1.0
      tinyrainbow: 3.1.0
-      vitest: 4.1.6(@opentelemetry/api@1.9.0)(@types/node@25.5.0)(@vitest/coverage-v8@4.1.6)(happy-dom@20.8.9)(jsdom@27.4.0(@noble/hashes@2.0.1))(vite@8.0.5(@types/node@25.5.0)(esbuild@0.28.0)(jiti@2.4.2)(less@4.2.0)(sugarss@5.0.1(postcss@8.5.14))(terser@5.39.0)(tsx@4.21.0)(yaml@2.8.3))
+      vitest: 4.1.6(@opentelemetry/api@1.9.0)(@types/node@22.19.1)(@vitest/coverage-v8@4.1.6)(happy-dom@20.8.9)(jsdom@25.0.0)(vite@8.0.5(@types/node@22.19.1)(esbuild@0.28.0)(jiti@2.4.2)(less@4.2.0)(sugarss@5.0.1(postcss@8.5.14))(terser@5.39.0)(tsx@4.21.0)(yaml@2.8.3))

  '@vitest/expect@4.1.6':
    dependencies:
@@ -16309,6 +16382,10 @@ snapshots:

  abbrev@5.0.0: {}

+  abort-controller@3.0.0:
+    dependencies:
+      event-target-shim: 5.0.1
+
  abstract-logging@2.0.1: {}

  accepts@1.3.8:
@@ -16755,6 +16832,11 @@ snapshots:
      base64-js: 1.5.1
      ieee754: 1.2.1

+  buffer@6.0.3:
+    dependencies:
+      base64-js: 1.5.1
+      ieee754: 1.2.1
+
  bullmq@5.76.10:
    dependencies:
      cron-parser: 4.9.0
@@ -17508,6 +17590,13 @@ snapshots:
      es-errors: 1.3.0
      gopd: 1.2.0

+  duplexify@3.7.1:
+    dependencies:
+      end-of-stream: 1.4.4
+      inherits: 2.0.4
+      readable-stream: 2.3.8
+      stream-shift: 1.0.3
+
  ecdsa-sig-formatter@1.0.11:
    dependencies:
      safe-buffer: 5.2.1
@@ -17934,6 +18023,8 @@ snapshots:

  estraverse@5.3.0: {}

+  estree-walker@2.0.2: {}
+
  estree-walker@3.0.3:
    dependencies:
      '@types/estree': 1.0.9
@@ -17942,6 +18033,8 @@ snapshots:

  etag@1.8.1: {}

+  event-target-shim@5.0.1: {}
+
  eventemitter2@6.4.9: {}

  eventemitter3@4.0.7: {}
@@ -20205,6 +20298,12 @@ snapshots:

  peberminta@0.9.0: {}

+  peek-stream@1.1.3:
+    dependencies:
+      buffer-from: 1.1.2
+      duplexify: 3.7.1
+      through2: 2.0.5
+
  pend@1.2.0: {}

  perfect-freehand@1.2.0: {}
@@ -20476,6 +20575,8 @@ snapshots:

  process-warning@5.0.0: {}

+  process@0.11.10: {}
+
  prompts@2.4.2:
    dependencies:
      kleur: 3.0.3
@@ -20892,6 +20993,14 @@ snapshots:
      string_decoder: 1.3.0
      util-deprecate: 1.0.2

+  readable-stream@4.7.0:
+    dependencies:
+      abort-controller: 3.0.0
+      buffer: 6.0.3
+      events: 3.3.0
+      process: 0.11.10
+      string_decoder: 1.3.0
+
  readdirp@3.6.0:
    dependencies:
      picomatch: 2.3.2
@@ -21345,6 +21454,8 @@ snapshots:
      inherits: 2.0.4
      readable-stream: 3.6.2

+  stream-shift@1.0.3: {}
+
  strict-event-emitter-types@2.0.0: {}

  string-length@4.0.2:
@@ -21505,6 +21616,8 @@ snapshots:

  tapable@2.3.0: {}

+  tar-mini@0.2.0: {}
+
  tar-stream@2.2.0:
    dependencies:
      bl: 4.1.0
@@ -21550,6 +21663,11 @@ snapshots:

  throttleit@2.1.0: {}

+  through2@2.0.5:
+    dependencies:
+      readable-stream: 2.3.8
+      xtend: 4.0.2
+
  tiny-invariant@1.3.3: {}

  tinybench@2.9.0: {}
@@ -21954,6 +22072,13 @@ snapshots:

  vary@1.1.2: {}

+  vite-plugin-compression2@2.5.3:
+    dependencies:
+      '@rollup/pluginutils': 5.4.0
+      tar-mini: 0.2.0
+    transitivePeerDependencies:
+      - rollup
+
  vite@8.0.5(@types/node@20.19.43)(esbuild@0.28.0)(jiti@2.4.2)(less@4.2.0)(sugarss@5.0.1(postcss@8.5.14))(terser@5.39.0)(tsx@4.21.0)(yaml@2.8.3):
    dependencies:
      lightningcss: 1.32.0
@@ -22334,8 +22459,7 @@ snapshots:

  xpath@0.0.34: {}

-  xtend@4.0.2:
-    optional: true
+  xtend@4.0.2: {}

  y-indexeddb@9.0.12(yjs@13.6.30(patch_hash=1ceeb66dba1f86545c98a3ff7f5152aff9b35caf409091cef9caedb5e65c8810)):
    dependencies: