sagadeck 1.2.0

package/src/runtime/video-player.js

@@ -0,0 +1,35 @@
+for(const player of document.querySelectorAll('.video-player')){
+  const slide=player.closest('.slide'),video=player.querySelector('video'),frame=player.querySelector('iframe');
+  const start=player.querySelector('[data-video-start]'),advance=player.querySelector('[data-video-advance]'),status=player.querySelector('[data-video-status]');
+  let active=false,finished=false,frameId;
+  const handoff=()=>{
+    if(finished||!slide?.classList.contains('current'))return;
+    if(player.hasAttribute('data-video-reveal')){finished=true;active=false;video.pause();player.dataset.revealed='true';slide.dataset.videoRevealed='true';return;}
+    const index=[...document.querySelectorAll('.slide')].indexOf(slide);
+    if(index>=0&&index+1<window.sagadeck.n){finished=true;active=false;video?.pause();window.sagadeck.goto(index+1);}
+  };
+  if(start){
+    start.onclick=async()=>{try{if(video.ended)video.currentTime=0;finished=false;delete player.dataset.revealed;delete slide.dataset.videoRevealed;video.style.opacity='1';await video.play();if(!slide?.classList.contains('current')){video.pause();return;}active=true;start.hidden=true;status.textContent='';if(video.requestVideoFrameCallback)frameId=video.requestVideoFrameCallback(tick);}catch{status.textContent='Não foi possível iniciar o vídeo. Você pode avançar.';}};
+    advance.onclick=handoff;
+    if(player.hasAttribute('data-video-stage')){
+      player.addEventListener('click',event=>{if(event.target.closest('button'))return;event.preventDefault();event.stopPropagation();active?handoff():start.click();});
+      document.addEventListener('keydown',event=>{
+        if(!slide?.classList.contains('current')||finished||event.target.closest('input,textarea,select,[contenteditable=true]'))return;
+        if(![' ','Enter','ArrowRight','PageDown'].includes(event.key))return;
+        event.preventDefault();event.stopImmediatePropagation();active?handoff():start.click();
+      },true);
+    }
+    const check=time=>{if(!active)return;const cue=player.dataset.videoHandoff!=null?Number(player.dataset.videoHandoff):video.duration;const fade=Number(player.dataset.videoFade);if(player.hasAttribute('data-video-reveal')&&Number.isFinite(cue)){video.style.opacity=fade>0?String(Math.max(0,Math.min(1,(cue-time)/fade))):'1';if(time>=cue)handoff();}else if(player.hasAttribute('data-video-next')&&player.dataset.videoHandoff!=null&&time>=cue)handoff();};
+    const tick=(_now,meta)=>{check(meta.mediaTime);if(active&&!finished)frameId=video.requestVideoFrameCallback(tick);};
+    video.addEventListener('timeupdate',()=>{if(!video.requestVideoFrameCallback)check(video.currentTime)});
+    video.addEventListener('ended',()=>{active=false;start.hidden=false;if(player.hasAttribute('data-video-next')||player.hasAttribute('data-video-reveal'))handoff();});
+  }
+  if(frame&&/^https?:$/.test(location.protocol)){
+    const url=new URL(frame.src);url.searchParams.set('enablejsapi','1');url.searchParams.set('origin',location.origin);frame.src=url.href;
+  }
+  if(slide)new MutationObserver(()=>{
+    if(slide.classList.contains('current')){if(video?.loop&&!matchMedia('(prefers-reduced-motion: reduce)').matches)video.play().catch(()=>{});return;}
+    video?.pause();frame?.contentWindow?.postMessage(JSON.stringify({event:'command',func:'pauseVideo',args:[]}),'https://www.youtube-nocookie.com');
+    if(start){active=false;finished=false;video.cancelVideoFrameCallback?.(frameId);start.hidden=false;delete player.dataset.revealed;delete slide.dataset.videoRevealed;video.style.opacity="1";}
+  }).observe(slide,{attributes:true,attributeFilter:['class']});
+}

package/src/science.js

@@ -0,0 +1,162 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import katex from 'katex';
+import { esc } from './markup.js';
+import { parseCSV } from './csv.js';
+import './runtime/formula.js';
+
+const F = globalThis.SagaFormula;
+
+export function mathHTML(equations = []) {
+  if (!Array.isArray(equations) || equations.length > 5) throw new Error('Use até cinco equações por slide.');
+  return equations.map((eq,i) => {
+    const e = typeof eq === 'string' ? {latex:eq} : eq;
+    const html = katex.renderToString(String(e.latex || ''), {displayMode:true,throwOnError:false,strict:"ignore",trust:false,maxExpand:1000,maxSize:20});
+    return `<article class="science-equation raster"><span class="science-number">${String(i+1).padStart(2,'0')}</span><div>${e.label ? `<p class="t f-label">${esc(e.label)}</p>` : ''}${html}</div></article>`;
+  }).join('');
+}
+
+// ---- gráfico do slide "Fórmulas e funções" ----
+//   plot: { functions: ["a*sin(b*x)", {fn: "cos(x)", name: "cosseno"}], x: [-10, 10], y: [-3, 3],
+//           params: {a: {value: 1, min: 0, max: 5, step: 0.1, label: "amplitude"}},
+//           points: "x;y\n1;2\n…" | [[1, 2], …] | "dados/medidas.csv", pointsName: "medições",
+//           surface: "sin(sqrt(x^2+y^2))", data: [traces Plotly], layout: {…} }
+// Letra da fórmula que não é x (ou y na superfície) vira controle deslizante (valor 1, de -5 a 5, se não vier em params).
+const PRESETS = { wave: {functions:['sin(x)'], x:[-6.3,6.3]}, parabola: {functions:['x^2'], x:[-4,4]}, surface: {surface:'sin(sqrt(x^2+y^2))', x:[-4,4]} };
+const num = (v, d) => (Number.isFinite(Number(v)) && v !== '' && v != null ? Number(v) : d);
+const range = (r, d) => (Array.isArray(r) && r.length === 2 && r.every((v) => Number.isFinite(Number(v))) && Number(r[0]) < Number(r[1]) ? [Number(r[0]), Number(r[1])] : d);
+
+// tabela colada do Excel/CSV (tab, ponto e vírgula ou vírgula) -> linhas de células; vírgula decimal vira ponto
+// tabela colada ou lida de arquivo: separador descoberto (vírgula, ponto e vírgula, tab), aspas respeitadas (src/csv.js)
+export function parseTable(text) {
+  return parseCSV(text).rows.filter((r) => r.some((c) => c.trim())).map((r) => r.map((c) => c.trim()));
+}
+// número de planilha: 40% · R$ 10 · 1.234,5 · -3
+const toNum = (c) => { const s = String(c ?? '').trim().replace(/^R\$/i, '').replace(/%$/, '').replace(/\s/g, ''); const n = Number(/^-?\d{1,3}(\.\d{3})+(,\d+)?$/.test(s) ? s.replace(/\./g, '').replace(',', '.') : s.replace(',', '.')); return s !== '' && Number.isFinite(n) ? n : null; };
+export { toNum };
+
+function readPoints(points, ctx) {
+  if (points == null || points === '') return null;
+  let rows;
+  if (Array.isArray(points)) rows = points.map((p) => (Array.isArray(p) ? p : [p.x, p.y]));
+  else {
+    let text = String(points);
+    if (/\.(csv|tsv|txt)$/i.test(text.trim()) && !text.includes('\n')) {
+      const file = path.resolve(ctx?.baseDir || process.cwd(), text.trim());
+      try { text = fs.readFileSync(file, 'utf8'); }
+      catch { ctx?.warnings?.push(`pontos do gráfico: "${points}" não encontrado ao lado do deck`); return null; }
+    }
+    rows = parseTable(text);
+  }
+  const pts = rows.map((r) => [toNum(r[0]), toNum(r[1])]).filter(([x, y]) => x != null && y != null);
+  const head = rows[0] && toNum(rows[0][1]) == null ? String(rows[0][1] || '') : '';
+  return pts.length ? { x: pts.map((p) => p[0]), y: pts.map((p) => p[1]), head } : null;
+}
+
+// o que a apresentação precisa para desenhar (e redesenhar quando um controle deslizante muda)
+export function plotModel(plot = {}, ctx) {
+  const p = { ...(PRESETS[plot.preset] || {}), ...plot };
+  if (Array.isArray(p.data) && p.data.length) return { kind: 'plotly', data: p.data, layout: p.layout || {} };
+  const errors = [];
+  const fns = [].concat(p.functions ?? p.function ?? []).map((f) => (typeof f === 'string' ? { fn: f } : f || {})).filter((f) => String(f.fn ?? '').trim());
+  const surface = String(p.surface ?? '').trim();
+  const names = new Set();
+  const compiled = fns.map((f, i) => {
+    try { const c = F.compile(f.fn, ['x']); c.params.forEach((n) => names.add(n)); return c; }
+    catch (e) { errors.push(`fórmula ${i + 1} ("${f.fn}"): ${e.message}`); return null; }
+  });
+  let surf = null;
+  if (surface) {
+    try { surf = F.compile(surface, ['x', 'y']); surf.params.forEach((n) => names.add(n)); }
+    catch (e) { errors.push(`superfície ("${surface}"): ${e.message}`); }
+  }
+  const given = p.params && typeof p.params === 'object' ? p.params : {};
+  const params = {};
+  for (const n of [...names]) {
+    const g = typeof given[n] === 'number' ? { value: given[n] } : given[n] || {};
+    const value = num(g.value, 1);
+    params[n] = { value, min: num(g.min, Math.min(-5, value)), max: num(g.max, Math.max(5, value)), step: num(g.step, 0.1), ...(g.label ? { label: String(g.label) } : {}) };
+  }
+  const points = readPoints(p.points, ctx);
+  return {
+    kind: 'formula', errors,
+    functions: fns.map((f, i) => ({ fn: String(f.fn), name: String(f.name || `y = ${f.fn}`), ...(f.color ? { color: String(f.color) } : {}), ok: !!compiled[i] })),
+    surface: surf ? surface : '',
+    x: range(p.x, [-10, 10]), ...(range(p.y, null) ? { y: range(p.y, null) } : {}), ...(p.xlog ? { xlog: true } : {}), ...(p.ylog ? { ylog: true } : {}),
+    params, ...(points ? { points: { x: points.x, y: points.y, name: String(p.pointsName || points.head || 'dados') } } : {}),
+    layout: p.layout || {}, _compiled: compiled, _surf: surf,
+  };
+}
+
+// traces do Plotly de um modelo (a apresentação usa a mesma conta em src/runtime/science.js)
+export function plotData(plot = {}, ctx) {
+  const m = plotModel(plot, ctx);
+  if (m.kind === 'plotly') return m.data;
+  const vals = Object.fromEntries(Object.entries(m.params).map(([k, v]) => [k, v.value]));
+  const out = m._compiled.map((c, i) => c && { type: 'scatter', mode: 'lines', name: m.functions[i].name, ...F.sample(c, m.x, vals, 400, m.xlog) }).filter(Boolean);
+  if (m.points) out.push({ type: 'scatter', mode: 'markers', name: m.points.name, x: m.points.x, y: m.points.y });
+  return out;
+}
+
+// prévia desenhada no próprio slide: aparece na miniatura, na galeria, no PDF e até o Plotly carregar
+function previewSVG(m) {
+  const W = 800, H = 480, L = 50, R = 20, T = 20, B = 40;
+  const vals = Object.fromEntries(Object.entries(m.params).map(([k, v]) => [k, v.value]));
+  if (m._surf) {
+    const n = 22, cells = [];
+    const zs = [];
+    for (let j = 0; j < n; j++) for (let i = 0; i < n; i++) {
+      const x = m.x[0] + ((m.x[1] - m.x[0]) * i) / (n - 1), y = m.x[0] + ((m.x[1] - m.x[0]) * j) / (n - 1);
+      zs.push(m._surf.eval({ ...vals, x, y }));
+    }
+    const fin = zs.filter((z) => z != null), lo = Math.min(...fin), hi = Math.max(...fin);
+    zs.forEach((z, k) => {
+      const t = z == null ? 0 : (z - lo) / ((hi - lo) || 1);
+      cells.push(`<rect x="${L + ((k % n) * (W - L - R)) / n}" y="${T + (Math.floor(k / n) * (H - T - B)) / n}" width="${(W - L - R) / n + 0.5}" height="${(H - T - B) / n + 0.5}" style="fill:color-mix(in srgb,var(--s1) ${Math.round(t * 100)}%,var(--s2))"/>`);
+    });
+    return `<svg class="science-preview" viewBox="0 0 ${W} ${H}" preserveAspectRatio="none" aria-hidden="true">${cells.join('')}</svg>`;
+  }
+  const series = m._compiled.map((c, i) => c && { i, ...F.sample(c, m.x, vals, 160, m.xlog) }).filter(Boolean);
+  const ys = [...series.flatMap((s) => s.y), ...(m.points?.y || [])].filter((v) => v != null).sort((a, b) => a - b);
+  let [y0, y1] = m.y || (ys.length ? [ys[Math.floor(ys.length * 0.02)], ys[Math.ceil(ys.length * 0.98) - 1]] : [-1, 1]);
+  if (y0 === y1) { y0 -= 1; y1 += 1; }
+  const pad = m.y ? 0 : (y1 - y0) * 0.08; y0 -= pad; y1 += pad;
+  const lg = (v) => Math.log10(Math.max(v, 1e-12));
+  if (m.ylog) { const pos = ys.filter((v) => v > 0); if (pos.length) { y0 = Math.min(...pos); y1 = Math.max(...pos); } }
+  const X = (x) => L + (m.xlog ? (lg(x) - lg(m.x[0])) / (lg(m.x[1]) - lg(m.x[0])) : (x - m.x[0]) / (m.x[1] - m.x[0])) * (W - L - R);
+  const Y = (y) => T + (1 - (m.ylog ? (lg(y) - lg(y0)) / ((lg(y1) - lg(y0)) || 1) : (y - y0) / (y1 - y0))) * (H - T - B);
+  let g = `<line x1="${L}" x2="${W - R}" y1="${H - B}" y2="${H - B}" class="sp-axis"/><line x1="${L}" x2="${L}" y1="${T}" y2="${H - B}" class="sp-axis"/>`;
+  if (y0 < 0 && y1 > 0) g += `<line x1="${L}" x2="${W - R}" y1="${Y(0)}" y2="${Y(0)}" class="sp-zero"/>`;
+  if (m.x[0] < 0 && m.x[1] > 0) g += `<line x1="${X(0)}" x2="${X(0)}" y1="${T}" y2="${H - B}" class="sp-zero"/>`;
+  series.forEach((s, k) => {
+    let d = '', pen = false;
+    s.x.forEach((x, i) => { const y = s.y[i]; if (y == null || y < y0 - (y1 - y0) || y > y1 + (y1 - y0)) { pen = false; return; } d += `${pen ? 'L' : 'M'}${X(x).toFixed(1)} ${Y(y).toFixed(1)}`; pen = true; });
+    const color = m.functions[s.i].color ? `var(--${m.functions[s.i].color})` : `var(--s${(k % 5) + 1})`;
+    g += `<path d="${d}" fill="none" style="stroke:${color}" stroke-width="5" stroke-linejoin="round" stroke-linecap="round"/>`;
+  });
+  (m.points?.x || []).forEach((x, i) => { g += `<circle cx="${X(x).toFixed(1)}" cy="${Y(m.points.y[i]).toFixed(1)}" r="6" style="fill:var(--s${(series.length % 5) + 1})"/>`; });
+  const lab = (v) => (Math.abs(v) >= 100 ? Math.round(v) : +v.toFixed(2)).toLocaleString('pt-BR');
+  g += `<text x="${L}" y="${H - 12}" class="sp-tick">${lab(m.x[0])}</text><text x="${W - R}" y="${H - 12}" text-anchor="end" class="sp-tick">${lab(m.x[1])}</text>`;
+  g += `<text x="${L - 8}" y="${T + 12}" text-anchor="end" class="sp-tick">${lab(y1)}</text><text x="${L - 8}" y="${H - B}" text-anchor="end" class="sp-tick">${lab(y0)}</text>`;
+  return `<svg class="science-preview" viewBox="0 0 ${W} ${H}" preserveAspectRatio="xMidYMid meet" aria-hidden="true">${g}</svg>`;
+}
+
+function slidersHTML(params) {
+  const ks = Object.keys(params);
+  if (!ks.length) return '';
+  return `<div class="science-params">${ks.map((k) => {
+    const p = params[k];
+    return `<label class="science-param"><span class="sp-name f-label">${esc(p.label ? `${p.label} (${k})` : k)}</span><input type="range" data-param="${esc(k)}" min="${p.min}" max="${p.max}" step="${p.step}" value="${p.value}" aria-label="${esc(p.label || k)}"><output class="sp-val">${esc(String(+p.value.toFixed(3)).replace('.', ','))}</output></label>`;
+  }).join('')}</div>`;
+}
+
+export function plotHTML(plot = {}, ctx) {
+  const m = plotModel(plot, ctx);
+  if (m.kind === 'formula' && m.errors.length) ctx?.warnings?.push(...m.errors.map((e) => `gráfico: ${e}`));
+  const { _compiled, _surf, ...pub } = m;
+  const payload = JSON.stringify(pub).replace(/</g, '\\u003c');
+  const empty = m.kind === 'formula' && !m.functions.length && !m.surface && !m.points;
+  const help = m.kind === 'formula' && m.errors.length ? `Fórmula com erro: ${m.errors[0]}` : empty ? 'Escreva uma fórmula, como a*sin(b*x), ou cole pontos (x e y)' : 'Arraste para explorar · passe o mouse para ver valores · duplo clique para restaurar';
+  const preview = m.kind === 'formula' && !empty ? previewSVG(m) : '';
+  return `<div class="science-plot raster${m.errors?.length ? ' has-error' : ''}" aria-label="Gráfico interativo"><div class="science-plot-target">${preview}</div><script type="application/json" class="science-data">${payload}</script>${m.kind === 'formula' ? slidersHTML(m.params) : ''}<p class="science-help f-label">${esc(help)}</p></div>`;
+}

package/src/studio/ai-response.js

@@ -0,0 +1,36 @@
+import {errorDiagnostic} from './errors.js';
+
+export function cancellable(work, signal) {
+  return new Promise((resolve, reject) => {
+    const abort = () => reject(Object.assign(new Error('Parado a pedido.'),{aborted:true}));
+    signal.addEventListener('abort', abort, { once: true });
+    Promise.resolve().then(() => { signal.throwIfAborted(); return work(); }).then(resolve, reject).finally(() => signal.removeEventListener('abort', abort));
+  });
+}
+export async function respond(res, stream, work) {
+  if (!stream) {
+    try {
+      const data = await work(() => {});
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify(data));
+    } catch (e) {
+      res.writeHead(500, { "Content-Type": "application/json" });
+      res.end(JSON.stringify(errorDiagnostic(e)));
+    }
+    return;
+  }
+  res.writeHead(200, { "Content-Type": "application/x-ndjson; charset=utf-8", "Cache-Control": "no-cache", "X-Accel-Buffering": "no" });
+  const send = (obj) => res.write(JSON.stringify(obj) + "\n");
+  const started = Date.now();
+  const heartbeat = setInterval(() => send({ type: "tick", elapsed: Date.now() - started }), 1000);
+  try {
+    const data = await work((ev) => send({ type: "progress", elapsed: Date.now() - started, ...ev }));
+    send({ type: "result", data });
+  } catch (e) {
+    console.error("[Studio] tarefa de IA falhou:", e.message);
+    send({ type: "error", ...errorDiagnostic(e) });
+  } finally {
+    clearInterval(heartbeat);
+    res.end();
+  }
+}

package/src/studio/api-routes.js

@@ -0,0 +1,152 @@
+// Rotas do slide API (/api/http/*): ambientes e variáveis (com segredos protegidos), envio do pedido, tempo real
+// (WebSocket), streaming e gravação da última resposta. Saiu de server.js; o servidor passa o estado (ctx).
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import { spawn } from "node:child_process";
+import YAML from "yaml";
+import { writeRecording, readRecordings, mimeOf } from "../api-client.js";
+
+// Modelo do ~/.sagadeck/ambientes.yaml, para quem ainda não tem um (tela Ambientes do Studio).
+const AMBIENTES_MODELO = `# Ambientes do slide "api": endereços e credenciais ficam aqui, na sua máquina, nunca no deck.
+# Nos slides, {{base}} vira o valor de vars.base do ambiente escolhido (o selo DEV/HOM no slide troca).
+# Segredo nunca vai em vars: use secrets (e, melhor ainda, uma variável de ambiente com env:).
+current: dev
+environments:
+  dev:
+    vars: { base: "https://api-dev.exemplo.com/v1" }
+    # token:                               # token que expira (client credentials), renovado sozinho
+    #   url: "https://identidade-dev.exemplo.com/token"
+    #   client_id: "meu-id"
+    #   client_secret_env: MINHA_SECRET    # nome da variável de ambiente com o segredo
+    #   field: "$.access_token"
+    # secrets: { client_secret: { env: MINHA_SECRET } }   # {{secret.client_secret}} nos slides
+    # OpenRouter: o ambiente OPENROUTER embutido usa OPENROUTER_API_KEY para o exemplo gratuito NVIDIA Nemotron.
+    # ca: "C:/certs/empresa.pem"           # certificado da empresa (inspeção TLS)
+  hom:
+    vars: { base: "https://api-hom.exemplo.com/v1" }
+`;
+
+export async function apiRoutes({ req, res, pathname, url, W, apiEnv, rtSessions, apiBlocked, ensureEnsaio, readJSON, isBundledTemplate }) {
+  const reply = (code, obj) => { res.writeHead(code, { "Content-Type": "application/json; charset=utf-8" }); res.end(JSON.stringify(obj)); };
+  const blocked = apiBlocked(req);
+  if (!blocked) await ensureEnsaio();
+  if (pathname === "/api/http/state" && req.method === "GET") {
+    let st;
+    try { st = apiEnv.state(); } catch (e) { st = { error: e.message, envs: [] }; }
+    const tokens = Object.fromEntries((st.envs || []).map((e) => [e.name, apiEnv.tokenInfo(e.name)]));
+    return reply(200, { live: !blocked, reason: blocked?.message || null, ...(blocked ? { envs: [], current: null } : st), tokens, recordings: { ...readRecordings(W.file), ...(W.apiRecordings || {}) } });
+  }
+  if (blocked) return reply(blocked.code, { error: blocked.message, live: false });
+  // conversa em tempo real: os eventos do serviço chegam ao navegador por aqui (SSE)
+  if (pathname === "/api/http/rt/events" && req.method === "GET") {
+    const s = rtSessions.get(url.searchParams.get("sid") || "");
+    if (!s) return reply(404, { error: "conversa não existe (já terminou?)" });
+    res.writeHead(200, { "Content-Type": "text/event-stream; charset=utf-8", "Cache-Control": "no-cache", "X-Accel-Buffering": "no" });
+    s.res = res;
+    for (const ev of s.buffer.splice(0)) res.write(`data: ${JSON.stringify(ev)}\n\n`);
+    req.on("close", () => { if (s.res === res) { s.conn.close(); rtSessions.delete(s.sid); } });
+    return;
+  }
+  // tela Ambientes: o arquivo como texto (ou um modelo comentado, se ainda não existe)
+  if (pathname === "/api/http/ambientes" && req.method === "GET") {
+    const exists = fs.existsSync(apiEnv.file);
+    return reply(200, { file: apiEnv.file, exists, text: exists ? fs.readFileSync(apiEnv.file, "utf8") : AMBIENTES_MODELO, builtin: Object.keys(apiEnv.builtin) });
+  }
+  if (req.method !== "POST") return reply(405, { error: "use POST" });
+  if (!/^application\/json/i.test(req.headers["content-type"] || "")) return reply(415, { error: "envie JSON" });
+  let body;
+  try { body = await readJSON(req); } catch (e) { return reply(400, { error: e.message }); }
+  if (pathname === "/api/http/ambientes" || pathname === "/api/http/ambientes/validar") {
+    const text = String(body.text ?? "");
+    let data;
+    try { data = YAML.parse(text) || {}; } catch (e) { return reply(400, { error: `YAML inválido: ${e.message}` }); }
+    if (typeof data !== "object" || Array.isArray(data)) return reply(400, { error: "O arquivo precisa ter current: e environments:" });
+    const envs = data.environments;
+    if (envs != null && (typeof envs !== "object" || Array.isArray(envs))) return reply(400, { error: "environments precisa ser uma lista de nomes (dev:, hom:…), não uma lista com traços" });
+    for (const [name, e] of Object.entries(envs || {})) {
+      if (!e || typeof e !== "object") return reply(400, { error: `O ambiente "${name}" está vazio: ponha pelo menos vars: { base: "…" }` });
+      if (e.vars != null && (typeof e.vars !== "object" || Array.isArray(e.vars))) return reply(400, { error: `vars do ambiente "${name}" precisa ser nome: valor` });
+      if (e.secrets != null && (typeof e.secrets !== "object" || Array.isArray(e.secrets))) return reply(400, { error: `secrets do ambiente "${name}" precisa ser um mapa de nomes para configurações de segredos` });
+    }
+    if (data.current != null && (typeof data.current !== "string" || (!Object.hasOwn(envs || {}, data.current) && !Object.hasOwn(apiEnv.builtin, data.current)))) {
+      return reply(400, { error: `O ambiente current "${String(data.current)}" não está definido em environments nem é um ambiente embutido.` });
+    }
+    if (pathname.endsWith("/validar")) return reply(200, { valid: true });
+    const backupCreated = fs.existsSync(apiEnv.file);
+    if (backupCreated) {
+      fs.copyFileSync(apiEnv.file, `${apiEnv.file}.bak`);
+      fs.chmodSync(`${apiEnv.file}.bak`, 0o600);
+    }
+    fs.mkdirSync(path.dirname(apiEnv.file), { recursive: true });
+    fs.writeFileSync(apiEnv.file, text.endsWith("\n") ? text : text + "\n", "utf8");
+    apiEnv.tokens.clear(); // credencial pode ter mudado: o próximo pedido pega um token novo
+    return reply(200, { ...apiEnv.state(), backupCreated });
+  }
+  // o arquivo do slide: o que foi arrastado na hora, ou o padrão (file:), só de dentro da pasta do deck
+  const fileOf = (b) => {
+    if (b.file && b.file.base64) return { name: String(b.file.name || "arquivo"), type: String(b.file.type || mimeOf(b.file.name)), data: Buffer.from(b.file.base64, "base64") };
+    if (!b.fileRef) return null;
+    const dir = W.file ? path.dirname(W.file) : null;
+    if (!dir) throw Object.assign(new Error("Salve o deck numa pasta para usar um arquivo padrão (file:)."), { kind: "config" });
+    const abs = path.resolve(dir, String(b.fileRef));
+    if (!abs.startsWith(dir + path.sep)) throw Object.assign(new Error("O arquivo precisa estar dentro da pasta do deck."), { kind: "config" });
+    if (!fs.existsSync(abs)) throw Object.assign(new Error(`Não achei ${b.fileRef} na pasta do deck (${dir}).`), { kind: "config" });
+    return { name: path.basename(abs), type: mimeOf(abs), data: fs.readFileSync(abs) };
+  };
+  try {
+    if (pathname === "/api/http/env") return reply(200, apiEnv.use(String(body.name || "")));
+    // painel Variáveis: criar/editar (normal ou protegida), revelar pelo olhinho, apagar, abrir a pasta do arquivo
+    if (pathname === "/api/http/vars/set") return reply(200, apiEnv.setVar(String(body.name || ""), body.value ?? "", { protected: !!body.protected }));
+    if (pathname === "/api/http/vars/reveal") return reply(200, { value: apiEnv.reveal(String(body.name || "")) });
+    if (pathname === "/api/http/vars/delete") return reply(200, apiEnv.deleteVar(String(body.name || "")));
+    if (pathname === "/api/http/vars/folder") {
+      const dir = path.dirname(apiEnv.file);
+      fs.mkdirSync(dir, { recursive: true });
+      if (process.platform === "win32") spawn("explorer.exe", [dir], { detached: true, stdio: "ignore" }).unref();
+      return reply(200, { dir });
+    }
+    if (pathname === "/api/http/send") return reply(200, await apiEnv.send({ ...(body.request || {}), file: fileOf(body) }));
+    if (pathname === "/api/http/rt/open") {
+      const r = await apiEnv.openRealtime(body.realtime || {});
+      const sid = crypto.randomUUID();
+      const s = { sid, conn: r.conn, buffer: [], res: null };
+      const push = (ev) => { if (s.res) s.res.write(`data: ${JSON.stringify(ev)}\n\n`); else s.buffer.push(ev); };
+      r.conn.on("message", (m, isText) => push(isText ? { dir: "in", text: r.mask(m) } : { dir: "in", bin: m.toString("base64") }));
+      r.conn.on("close", (code, why) => { push({ type: "close", code, why: String(why || "") }); if (s.res) s.res.end(); rtSessions.delete(sid); });
+      rtSessions.set(sid, s);
+      for (const m of [].concat(body.open || [])) r.conn.send(typeof m === "string" ? m : JSON.stringify(m));
+      return reply(200, { sid, url: r.url, env: r.env });
+    }
+    if (pathname === "/api/http/rt/send") {
+      const s = rtSessions.get(String(body.sid || ""));
+      if (!s) return reply(404, { error: "conversa não existe (já terminou?)" });
+      for (const m of [].concat(body.messages || [])) s.conn.send(typeof m === "string" ? m : JSON.stringify(m));
+      return reply(200, { ok: true });
+    }
+    if (pathname === "/api/http/rt/close") {
+      const s = rtSessions.get(String(body.sid || ""));
+      if (s) { s.conn.close(); rtSessions.delete(s.sid); }
+      return reply(200, { ok: true });
+    }
+    if (pathname === "/api/http/record") {
+      if (!body.key || !body.record) return reply(400, { error: "faltou key/record" });
+      const f = W.file && !isBundledTemplate(W.file) ? writeRecording(W.file, String(body.key), body.record) : null;
+      if (!f) (W.apiRecordings = W.apiRecordings || {})[body.key] = { ...body.record, at: new Date().toISOString() };
+      return reply(200, { ok: true, file: f });
+    }
+    if (pathname === "/api/http/stream") {
+      const up = await apiEnv.open({ ...(body.request || {}), file: fileOf(body) });
+      res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "no-cache", "X-Api-Status": String(up.res.statusCode), "X-Api-Type": up.res.headers["content-type"] || "" });
+      up.res.on("data", (c) => res.write(up.mask(c.toString("utf8"))));
+      up.res.on("end", () => res.end());
+      up.res.on("error", () => res.end());
+      req.on("close", () => up.res.destroy());
+      return;
+    }
+  } catch (e) {
+    return reply(e.kind === "config" ? 400 : 502, { error: e.message, kind: e.kind || "error" });
+  }
+  return reply(404, { error: "não existe" });
+}

package/src/studio/assets/contexto/leia-me.md

@@ -0,0 +1,12 @@
+# Novidades do SagaDeck
+
+Este projeto é a pasta da apresentação. Tudo o que está em `contexto/` vai como material para a IA.
+
+## Para experimentar
+
+- Abra `vendas.csv` aqui na aba **Arquivos**: o Studio mostra o tipo de cada coluna e sugere gráficos. **Inserir no slide** cria o gráfico ligado à planilha.
+- Mude um número em `vendas.csv` e use **Atualizar da planilha** no slide do gráfico.
+- Cole um print com **Ctrl+V** na aba Arquivos: ele vai para `contexto/`.
+- Abra o `.yaml` da apresentação: o slide ao lado muda enquanto você digita.
+- No slide de fórmulas, troque `a*sin(b*x)` por outra fórmula no Formatar.
+- No gráfico de dados, cole uma tabela do Excel direto na planilha do Formatar.

package/src/studio/assets/contexto/vendas.csv

@@ -0,0 +1,7 @@
+Mês;Norte;Sul;Nordeste
+jan;10,5;7;6
+fev;12;9;7,5
+mar;15;8;9
+abr;17;11;10
+mai;16;13;12
+jun;19;14;13,5

package/src/studio/code-routes.js

@@ -0,0 +1,32 @@
+import path from 'node:path';
+import { runCommand, logCommand } from '../ai/commands.js';
+import { downloadYoutube } from './video-download.js';
+import { pollVideoJobs } from '../ai/video-generation.js';
+
+// O botão Executar é a autorização do apresentador. Mesmas permissões do chat.
+export async function codeRoutes({ req, res, pathname, W, readJSON, commandsAllowed, commandEnv, isBundledTemplate }) {
+  if (!['/api/code/state','/api/code/run','/api/video/download','/api/video/jobs'].includes(pathname)) return false;
+  const send = (status, data) => { res.writeHead(status, {'Content-Type':'application/json'});res.end(JSON.stringify(data)); };
+  const allowed = commandsAllowed(req, W) && !!W.file && !isBundledTemplate(W.file);
+  // vigia de clipes: leitura + download do que já foi pago; nunca pede aprovação
+  if (pathname === '/api/video/jobs' && req.method === 'GET') {
+    if (!allowed) { send(200, { jobs: [] }); return true; }
+    try { send(200, { jobs: await pollVideoJobs(path.dirname(W.file)) }); }
+    catch (e) { send(200, { jobs: [], error: e.message }); }
+    return true;
+  }
+  if (pathname.endsWith('/state') && req.method === 'GET') {send(200,{allowed, engines:['python','javascript']});return true;}
+  if (req.method !== 'POST') {send(405,{error:'Use POST para executar.'});return true;}
+  if (!allowed) {send(403,{error:'Execução nativa indisponível neste workspace.'});return true;}
+  try {
+    const b = await readJSON(req);
+    if (pathname === '/api/video/download') {send(200,await downloadYoutube(b.url,path.dirname(W.file)));return true;}
+    if (!['python','javascript'].includes(b.language)) throw new Error('Escolha Python ou JavaScript.');
+    const {env,mask} = await commandEnv(W);
+    const started = Date.now();
+    const result = await runCommand({language:b.language,code:b.code,why:'Execução no laboratório da apresentação'}, {cwd:path.dirname(W.file),env,mask});
+    logCommand({language:b.language,code:b.code,output:result.stdout+'\n'+result.stderr,exitCode:result.exitCode,source:'codelab'},{mask});
+    send(200,{...result,elapsedMs:Date.now()-started});
+  } catch (e) {send(400,{error:e.message});}
+  return true;
+}

package/src/studio/command-approval.js

@@ -0,0 +1,48 @@
+// Política de aprovação dos comandos da IA (quem pede o quê, e o que roda direto).
+// Ações gratuitas (ex.: consultar status do vídeo) nunca pedem; só o que pode
+// custar tempo sensível, gastar dinheiro ou mexer fora da pasta pede clique.
+import crypto from "node:crypto";
+import { videoFreeRun, envName } from "../ai/commands.js";
+
+export const needsApproval = ({ autoRun, command }) => !autoRun && !videoFreeRun(command);
+
+export const approvalLabel = ({ autoRun, command }) =>
+  autoRun ? "liberado" : videoFreeRun(command) ? "livre" : "aprovado";
+
+// variáveis, segredos e token do ambiente ativo para o comando (a IA só conhece
+// os nomes; a saída volta mascarada)
+export async function commandEnv(W, apiEnv) {
+  try {
+    const e = apiEnv.env(), env = {};
+    for (const [k, v] of Object.entries({ ...(W.apiVars || {}), ...(e.vars || {}) })) if (v != null && typeof v !== "object") env[`SAGA_VAR_${envName(k)}`] = String(v);
+    for (const [k, v] of Object.entries(apiEnv.secretVars(e))) env[`SAGA_SECRET_${envName(k.replace(/^secret\./, ""))}`] = v;
+    try { const t = await apiEnv.token(e); if (t) env.SAGA_TOKEN = String(t); } catch {}
+    return { env, mask: (s) => apiEnv.maskText(e, s) };
+  } catch { return { env: {}, mask: (s) => s }; }
+}
+
+// preço estimado de um submit de vídeo (catálogo é de graça; null se não der)
+export async function estimateSubmitCost(command, { commandEnv, W }) {
+  try {
+    const req = typeof command.code === "object" && command.code !== null ? command.code : JSON.parse(String(command.code || "{}"));
+    if (String(command.language || "").toLowerCase() !== "video" || req?.action !== "submit") return null;
+    const { estimateVideoCost } = await import("../ai/video-generation.js");
+    const { env } = await commandEnv(W).catch(() => ({ env: {} }));
+    const key = env.SAGADECK_VIDEO_KEY || env.OPENROUTER_API_KEY || process.env.SAGADECK_VIDEO_KEY || process.env.OPENROUTER_API_KEY;
+    return await estimateVideoCost({ model: req.model, duration: req.duration, resolution: req.resolution }, { key });
+  } catch { return null; }
+}
+
+// espera a pessoa no chat (10 min sem resposta = recusado); aborta junto com o pedido.
+// cost (opcional): texto de custo estimado exibido junto ao pedido ("~$4.00").
+export async function awaitApproval({ command, cost, user, signal, emit, approvals }) {
+  const id = crypto.randomUUID();
+  const decision = await new Promise((resolve) => {
+    const timer = setTimeout(() => { approvals.delete(id); resolve("deny"); }, 10 * 60 * 1000);
+    const abort = () => { clearTimeout(timer); approvals.delete(id); resolve("deny"); };
+    signal?.addEventListener("abort", abort, { once: true });
+    approvals.set(id, { user: user || "", answer: (d) => { clearTimeout(timer); approvals.delete(id); resolve(d); } });
+    emit({ phase: "approve", id, command, cost: cost || null, text: "Esperando você autorizar o comando…" });
+  });
+  return decision;
+}