trypost/composer.json

170 lines
5.5 KiB
JSON
Raw Normal View History

2026-01-15 01:13:44 +00:00
{
"$schema": "https://getcomposer.org/schema.json",
"name": "trypost-it/trypost",
2026-01-15 01:13:44 +00:00
"type": "project",
"description": "Open-source social media scheduling for creators and teams",
2026-01-15 01:13:44 +00:00
"keywords": [
"open-source",
"self-hosted",
2026-01-15 01:13:44 +00:00
"laravel",
"social-media",
"social-media-scheduler",
"social-media-management",
"content-scheduling",
"twitter",
"linkedin",
"instagram",
"facebook",
"tiktok",
"youtube",
"threads",
"pinterest"
2026-01-15 01:13:44 +00:00
],
"license": "AGPL-3.0-only",
"homepage": "https://trypost.it",
"support": {
"issues": "https://github.com/trypost-it/trypost/issues",
"source": "https://github.com/trypost-it/trypost"
},
"authors": [
{
"name": "Paulo Castellano",
"homepage": "https://github.com/paulocastellano"
}
],
2026-01-15 01:13:44 +00:00
"require": {
"php": "^8.2",
"google/apiclient": "^2.19",
"inertiajs/inertia-laravel": "^3.3.1",
"intervention/image": "^4.0",
Fix OpenRouter via laravel/ai default provider (revises #216) (#220) * Fix OpenRouter support by using laravel/ai default provider config. PR #216 patched Lab::OpenRouter into every agent match, but laravel/ai already resolves config('ai.default') — including openrouter — when agents omit provider(). Those matches also forced unknown providers to Gemini and BrandAnalyzerRunner checked a non-existent services.openrouter key. Remove the duplicated provider() overrides, gate availability on ai.providers.*.key, and document OPENROUTER_API_KEY. Co-authored-by: Paulo Castellano <hello@paulocastellano.com> * chore(deps): bump laravel/ai to v0.10.3 for native OpenRouter support v0.5.1's OpenRouter driver only covered text/embeddings via the legacy Prism gateway. v0.10.3 ships a native OpenRouter gateway with image, audio (TTS/STT), and web search support, and drops prism-php/prism as a dependency. ai-sdk-development skill docs refreshed via boost:update to match the installed version. * fix: honor AI_IMAGE_PROVIDER instead of hardcoding OpenAI's gpt-image-2 AiImageClient always passed model: 'gpt-image-2' to Image::of()->generate(), so AI_IMAGE_PROVIDER silently did nothing for any provider other than OpenAI — gemini/xai/openrouter would fail against an OpenAI-only model id and quietly fall back to a stock photo. Usage recording was hardcoded to provider 'openai' too, so credits were billed against the wrong model whenever a different provider actually ran. Drop the hardcoded model so generation falls through to the SDK's own config('ai.default_for_images') + per-provider default model, and read the actual provider/model back off the response's meta for usage recording and source_meta instead of assuming OpenAI. * refactor: extract AiImageClient into single-purpose steps, fix uncaught exception generate() built the prompt, called the SDK, and unpacked the response all in one block, with bytes extraction happening after the try/catch — so a response with an empty images collection threw an uncaught RuntimeException from ImageResponse::firstImage() instead of returning null as documented. Split into cleanKeywords(), buildPrompt(), resolveBrandContext(), and toResult(), and moved response unpacking inside the try block so any malformed response is treated as a failure like everything else. Added a regression test with an empty-images fake response. * fix: drop hardcoded default_text_model, resolve model per provider default_text_model was the only per-modality model override in ai.php — image, audio, transcription, embeddings, and reranking all just pick a provider and let it use its own default model. Text had a config-pinned model on top, forced into every agent's model() and into every usage log's model field regardless of which provider actually ran. Switching AI_TEXT_PROVIDER (e.g. to openrouter) kept sending OpenAI's model id to whichever provider ended up handling the request. Removed model() from all six agents so laravel/ai resolves the model from the active provider's own default (OpenAI's default is already 'gpt-5.4', so no behavior change there). Usage-recording call sites now read the actual provider/model back off the response's meta instead of assuming config('ai.default')/default_text_model. StreamPostContent needed the then() callback since broadcast()'s StreamableAgentResponse doesn't expose meta directly. * refactor: drop AiConfiguration wrapper, use data_get() for array reads AiConfiguration was a one-line static helper used by only two call sites, with no laravel/ai equivalent to lean on (confirmed AiManager and the Provider base class expose no isConfigured()/hasKey() check — the package's model is try-then-catch, not pre-flight checks). Inlined the filled(config(...)) check directly into HandleInertiaRequests and BrandAnalyzerRunner instead of keeping a class around one line of logic. Also swapped direct array-key reads for data_get() per project convention across every file touched by the recent AI provider/model fixes (agents' budget arrays, RunGenerateNode/StreamPostCreation's humanizer merge, RegeneratePostMediaImage's baseContext/copy/rendered access). Write/assignment sites (`$x['key'] = ...`) are left as-is — data_get() only reads. * feat: enhance AI configuration with new providers and options Added strict types declaration and updated Azure OpenAI API version. Introduced new 'bedrock' provider configuration with AWS credentials and role assumptions. Enhanced existing providers with additional options, including image deployment for Azure and OpenAI, and updated URLs for Gemini and Ollama. Added support for an 'openai-compatible' driver to broaden integration capabilities. * fix: remove trailing newline in AI configuration file * feat: add support for OpenRouter and ElevenLabs API keys in configuration Updated the production Docker Compose file and example environment file to include commented-out entries for OPENROUTER_API_KEY and ELEVENLABS_API_KEY. This enhances the configuration options for AI providers, allowing for easier integration of additional services. * feat: allow per-provider model overrides for every AI modality Adds a `models` array to each provider block, wired to env vars, so self-hosted operators can pin a specific text/image/audio/transcription/ embeddings/reranking model instead of relying on the package's built-in default for that provider. Only added for the modalities each provider actually implements (verified against laravel/ai's Provider classes). Azure is left untouched — it resolves models via deployment names (AZURE_OPENAI_DEPLOYMENT etc.), not raw model strings, which was already wired before this change. --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>
2026-08-11 00:38:50 +00:00
"laravel/ai": "^0.10.3",
MCP: workspace settings, viewer read access, and token access (#241) * Add workspace MCP settings and token access controls. Ship MCP settings UI, OAuth revoke/list helpers, Passport deploy wiring, and workspace.token:mcp gating so assistants can connect without pulling in welcome/onboarding from the parent epic. Co-authored-by: Cursor <cursoragent@cursor.com> * Type MCP client config shapes instead of string checks. Encode http/config-root on each advanced client and tighten primary client ids so snippet generation does not branch on magic strings. Co-authored-by: Cursor <cursoragent@cursor.com> * Polish MCP settings follow-ups from review. Translate Ukrainian MCP copy, deep-link ChatGPT into connector creation, drop an unused asset and revoke arg, and assert PATs are rejected on the MCP endpoint. Co-authored-by: Cursor <cursoragent@cursor.com> * Harden MCP connected clients, revoke scope, and OAuth consent. List recoverable sessions with live refresh tokens, revoke only PATs, throttle registration alone, and block viewers from authorizing MCP. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify MCP OAuth route throttling to a single middleware group. Co-authored-by: Cursor <cursoragent@cursor.com> * Allow workspace viewers read-only MCP access with web policy writes. Mirror the web app: MCP connects on view + OAuth mcp:use, write tools enforce createPost/update/delete/manageAccounts/manageTeam, and demotion to Viewer keeps grants. Cover role denials, consent, and disconnect. Co-authored-by: Cursor <cursoragent@cursor.com> * Harden MCP tool authz with shared workspace helpers. Route ApiKey tools through AuthorizesMcpTool, fail closed on null user or policy argument, and resolve the current workspace before mutating. Co-authored-by: Cursor <cursoragent@cursor.com> * Drop redundant string casts on validated request data. Enum::from and validated() fields are already strings, so the casts add noise without changing behavior. Co-authored-by: Cursor <cursoragent@cursor.com> * Show only the current user's MCP connections in settings. Match API keys privacy: list and disconnect your own OAuth clients, not teammates' across the account. Co-authored-by: Cursor <cursoragent@cursor.com> * Cover LoadWorkspaceFromToken gaps and harden AuthorizesMcpTool tests. Co-authored-by: Cursor <cursoragent@cursor.com> * Drop redundant is_string guard before UpdatePostTool find. Co-authored-by: Cursor <cursoragent@cursor.com> * Refactor AppSidebar to always show MCP link and simplify route middleware definition in ai.php. The MCP link is now consistently displayed regardless of the current workspace state, and the route middleware syntax has been streamlined. * Refresh MCP connected clients with Inertia usePoll. Co-authored-by: Cursor <cursoragent@cursor.com> * Bump laravel/mcp to 0.9.1 and add the TryPost server icon. Requires laravel/boost 2.5 for the Icon attribute; expose images/trypost/icon.png on TryPostServer. Co-authored-by: Cursor <cursoragent@cursor.com> * Drop no-op ReflectionClass import in TryPostServerTest. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-06 12:54:51 +00:00
"laravel/boost": "^2.5",
2026-01-15 01:13:44 +00:00
"laravel/cashier": "^16.2",
"laravel/framework": "^13.0",
"laravel/horizon": "^5.45",
MCP: workspace settings, viewer read access, and token access (#241) * Add workspace MCP settings and token access controls. Ship MCP settings UI, OAuth revoke/list helpers, Passport deploy wiring, and workspace.token:mcp gating so assistants can connect without pulling in welcome/onboarding from the parent epic. Co-authored-by: Cursor <cursoragent@cursor.com> * Type MCP client config shapes instead of string checks. Encode http/config-root on each advanced client and tighten primary client ids so snippet generation does not branch on magic strings. Co-authored-by: Cursor <cursoragent@cursor.com> * Polish MCP settings follow-ups from review. Translate Ukrainian MCP copy, deep-link ChatGPT into connector creation, drop an unused asset and revoke arg, and assert PATs are rejected on the MCP endpoint. Co-authored-by: Cursor <cursoragent@cursor.com> * Harden MCP connected clients, revoke scope, and OAuth consent. List recoverable sessions with live refresh tokens, revoke only PATs, throttle registration alone, and block viewers from authorizing MCP. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify MCP OAuth route throttling to a single middleware group. Co-authored-by: Cursor <cursoragent@cursor.com> * Allow workspace viewers read-only MCP access with web policy writes. Mirror the web app: MCP connects on view + OAuth mcp:use, write tools enforce createPost/update/delete/manageAccounts/manageTeam, and demotion to Viewer keeps grants. Cover role denials, consent, and disconnect. Co-authored-by: Cursor <cursoragent@cursor.com> * Harden MCP tool authz with shared workspace helpers. Route ApiKey tools through AuthorizesMcpTool, fail closed on null user or policy argument, and resolve the current workspace before mutating. Co-authored-by: Cursor <cursoragent@cursor.com> * Drop redundant string casts on validated request data. Enum::from and validated() fields are already strings, so the casts add noise without changing behavior. Co-authored-by: Cursor <cursoragent@cursor.com> * Show only the current user's MCP connections in settings. Match API keys privacy: list and disconnect your own OAuth clients, not teammates' across the account. Co-authored-by: Cursor <cursoragent@cursor.com> * Cover LoadWorkspaceFromToken gaps and harden AuthorizesMcpTool tests. Co-authored-by: Cursor <cursoragent@cursor.com> * Drop redundant is_string guard before UpdatePostTool find. Co-authored-by: Cursor <cursoragent@cursor.com> * Refactor AppSidebar to always show MCP link and simplify route middleware definition in ai.php. The MCP link is now consistently displayed regardless of the current workspace state, and the route middleware syntax has been streamlined. * Refresh MCP connected clients with Inertia usePoll. Co-authored-by: Cursor <cursoragent@cursor.com> * Bump laravel/mcp to 0.9.1 and add the TryPost server icon. Requires laravel/boost 2.5 for the Icon attribute; expose images/trypost/icon.png on TryPostServer. Co-authored-by: Cursor <cursoragent@cursor.com> * Drop no-op ReflectionClass import in TryPostServerTest. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-06 12:54:51 +00:00
"laravel/mcp": "^0.9.1",
"laravel/nightwatch": "^1.22",
"laravel/passport": "^13.7",
2026-01-15 17:24:39 +00:00
"laravel/reverb": "^1.0",
2026-01-15 01:13:44 +00:00
"laravel/socialite": "^5.24",
"laravel/tinker": "^3.0",
2026-01-15 01:13:44 +00:00
"laravel/wayfinder": "^0.1.9",
"league/color-extractor": "^0.4.0",
2026-01-15 01:13:44 +00:00
"league/flysystem-aws-s3-v3": "^3.0",
feat: use LLM to polish brand autofill when provider is configured When config('trypost.ai.text_provider') points to a provider whose API key is populated (services.gemini.api_key or services.openai.api_key), the autofill action pipes the homepage markdown through a BrandAnalyzer agent with structured output to produce higher-quality values for: - brand_description — 2-3 sentences summarizing the company based on the actual page content, not the raw meta description (which is often generic SEO boilerplate) - brand_tone — classified into one of our seven enum values from the writing style on the page - content_language — detected from the actual content (more reliable than <html lang> which is often wrong) - brand_voice_notes — concrete writing guidelines inferred from the site's style, written in the detected language When the LLM provider is NOT configured (open-source self-hosted deploys without API keys), the action keeps the existing deterministic meta-tag-only flow — no crash, no noise, no LLM cost. When the LLM fails mid-request, we log a warning and fall back to the meta-tag values so the user still gets something useful. Stack additions: - league/html-to-markdown ^5.1 converts the main body to clean markdown for the LLM input (truncated to 4000 chars). - BrandAnalyzer agent (Agent + HasStructuredOutput) with schema enums matching our allowed tones and languages. - resources/views/prompts/brand_analyzer.blade.php holds the instructions, including explicit enum lists and examples of good voice_notes. Frontend: Brand.vue now also fills brand_tone and brand_voice_notes from the response when present. Tests (+3): LLM-configured happy path, no-credentials fallback (asserts BrandAnalyzer is never prompted via preventStrayPrompts), and LLM-exception fallback (meta tags win, brand_tone stays null).
2026-04-16 14:33:02 +00:00
"league/html-to-markdown": "^5.1",
2026-03-31 00:18:07 +00:00
"posthog/posthog-php": "^4.1",
2026-01-15 01:13:44 +00:00
"predis/predis": "^3.3",
"sendkit/sendkit-laravel": "^1.1",
"simplepie/simplepie": "^1.9",
"socialiteproviders/facebook": "^4.1",
"socialiteproviders/instagram": "^5.1",
2026-01-15 01:13:44 +00:00
"socialiteproviders/linkedin": "^5.0",
"socialiteproviders/pinterest": "^4.3",
2026-01-15 01:13:44 +00:00
"socialiteproviders/tiktok": "^5.2",
feat: add brand autofill from website URL in onboarding Users on the Brand step can type their website URL and click 'Preencher' (Portuguese) / 'Autofill' (English). The backend fetches their homepage, parses standard meta tags, and returns: - name ← og:site_name | title (suffix stripped at ' | ', ' - ') - description ← meta[name=description] | og:description - language ← <html lang> mapped to en / pt-BR / es - logo ← apple-touch-icon | largest link[rel*=icon] | og:image The logo is downloaded, validated (mime whitelist, 2MB max), and attached to the workspace's 'logo' media collection so the avatar updates immediately. Zero LLM calls, zero external APIs. Uses symfony/dom-crawler + symfony/css-selector (newly required) for meta extraction. Everything else (Http client, workspace media, Intervention) was already in the project. Security: - SSRF guardrail: resolves the host, rejects private / loopback / link-local ranges, enforces http(s) scheme on both the initial page fetch and the logo download. - Rate limited at 10 req/min per user via the throttle middleware alias on the route. - Logo content-type must be one of the allowed image mimes; wrong types are silently dropped so users never see broken images. UX: - 'Autofill' button next to the website input, disabled until there is a URL; shows a spinner while running. - If a logo was captured, a small preview appears below the input so users can see what was pulled before saving. - Success and error paths both surface as vue-sonner toasts, with translations in en / pt-BR / es. - Failures leave the form untouched — nothing is destructively overwritten if parsing gave us nothing. Tests (16 new): action-level coverage for happy path, title-suffix fallback, language code normalization across 6 locales, scheme rejection, private-range SSRF rejection, implicit https prefixing, empty sites, upstream errors, and wrong-mime logo rejection. Plus two controller-level tests for the autofill endpoint.
2026-04-16 14:13:54 +00:00
"socialiteproviders/twitter": "^4.1",
"symfony/css-selector": "^8.0",
"symfony/dom-crawler": "^8.0"
2026-01-15 01:13:44 +00:00
},
"require-dev": {
"fakerphp/faker": "^1.23",
"laravel/pail": "^1.2.2",
"laravel/pint": "^1.24",
"laravel/sail": "*",
"laravel/telescope": "^5.19",
2026-01-15 01:13:44 +00:00
"mockery/mockery": "^1.6",
"nunomaduro/collision": "^8.6",
"pestphp/pest": "^5.0",
"pestphp/pest-plugin-browser": "^5.0",
"pestphp/pest-plugin-laravel": "^5.0"
2026-01-15 01:13:44 +00:00
},
"autoload": {
"files": [
2026-03-31 14:35:49 +00:00
"app/Helpers/Upload.php"
2026-01-15 01:13:44 +00:00
],
"psr-4": {
"App\\": "app/",
"Database\\Factories\\": "database/factories/",
"Database\\Seeders\\": "database/seeders/"
}
},
"autoload-dev": {
"psr-4": {
"Tests\\": "tests/"
}
},
"scripts": {
"setup": [
"composer install",
"@php -r \"file_exists('.env') || copy('.env.example', '.env');\"",
"@php artisan key:generate",
"@php artisan migrate --force",
"npm install",
"npm run build"
],
"dev": [
"Composer\\Config::disableProcessTimeout",
"npx concurrently -c \"#93c5fd,#c4b5fd,#fb7185,#fdba74\" \"php artisan serve\" \"php artisan queue:listen --tries=1\" \"php artisan pail --timeout=0\" \"npm run dev\" --names=server,queue,logs,vite --kill-others"
],
"dev:ssr": [
"npm run build:ssr",
"Composer\\Config::disableProcessTimeout",
"npx concurrently -c \"#93c5fd,#c4b5fd,#fb7185,#fdba74\" \"php artisan serve\" \"php artisan queue:listen --tries=1\" \"php artisan pail --timeout=0\" \"php artisan inertia:start-ssr\" --names=server,queue,logs,ssr --kill-others"
],
"lint": [
"pint --parallel"
],
"test:lint": [
"pint --parallel --test"
],
"test": [
"@php artisan config:clear --ansi",
"@test:lint",
"@php artisan test"
],
"test:all": [
"@test",
"@php artisan test tests/Browser"
],
ci: local TIA test runs; simplify e2e (drop sharding + e2e-gate) (#262) * ci: name e2e shards descriptively and add time-balanced sharding - e2e job now shows as "e2e (shard 1/2)" / "e2e (shard 2/2)" in checks instead of the unlabeled matrix "(1)" / "(2)" suffix - add scheduled/manual "Update Shards" workflow that generates and commits tests/.pest/shards.json so Pest balances the two e2e shards by real execution time instead of file count * ci: enable Pest TIA for local test runs Scoped to local via locally() so CI keeps running the full suite on every commit. Add composer test:tia script using herd coverage, since Herd bundles Xdebug but doesn't load it by default. * ci: drop Herd-specific prefix from test:tia composer script trypost is open-source and self-hosted; not every contributor runs Herd. The script now just needs a coverage driver (Xdebug/PCOV) active however the environment provides it — Herd users can run it via "herd coverage composer test:tia". * ci: revert e2e sharding, drop Update Shards workflow Sharding across 2 runners added complexity (unbalanced shards without timing data, plus an Update Shards workflow that can't push straight to main under branch protection) that isn't worth it here. e2e now runs tests/Browser as a single job again; e2e-gate stays as a pass-through so the required branch protection check name is unchanged. * ci: drop redundant e2e-gate job e2e-gate only mirrored e2e's own result once sharding was removed. Updated main's branch protection required_status_checks to require "e2e" directly instead of "e2e-gate".
2026-08-09 15:24:10 +00:00
"test:tia": [
"vendor/bin/pest --parallel --tia"
],
2026-01-15 01:13:44 +00:00
"post-autoload-dump": [
"Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",
"@php artisan package:discover --ansi"
],
"post-update-cmd": [
"@php artisan vendor:publish --tag=laravel-assets --ansi --force",
"@php artisan boost:update --ansi"
],
"post-root-package-install": [
"@php -r \"file_exists('.env') || copy('.env.example', '.env');\""
],
"post-create-project-cmd": [
"@php artisan key:generate --ansi",
"@php -r \"file_exists('database/database.sqlite') || touch('database/database.sqlite');\"",
"@php artisan migrate --graceful --ansi"
],
"pre-package-uninstall": [
"Illuminate\\Foundation\\ComposerScripts::prePackageUninstall"
]
},
"extra": {
"laravel": {
"dont-discover": [
"laravel/telescope"
]
2026-01-15 01:13:44 +00:00
}
},
"config": {
"optimize-autoloader": true,
"preferred-install": "dist",
"sort-packages": true,
"allow-plugins": {
"pestphp/pest-plugin": true,
"php-http/discovery": true
}
},
"minimum-stability": "stable",
"prefer-stable": true
}