failproofai 0.0.11-beta.1 → 0.0.11-beta.3

package/.next/standalone/lib/client-telemetry.ts

@@ -1,4 +1,5 @@
 import type { TelemetryConfig } from "@/app/actions/get-telemetry-config";
+import { POSTHOG_PRODUCT } from "@/src/posthog-key";
 
 let config: TelemetryConfig | null = null;
 
@@ -21,6 +22,7 @@ export function captureClientEvent(
       ...properties,
       $lib: "failproofai-web",
       failproofai_version: config.version,
+      product: POSTHOG_PRODUCT,
       $current_url: window.location.href,
       $pathname: window.location.pathname,
     },

package/.next/standalone/lib/fetch-with-timeout.ts

@@ -0,0 +1,42 @@
+/**
+ * Shared fetch wrapper with per-request timeout via AbortController.
+ *
+ * Replaces three byte-equivalent implementations that had drifted on the
+ * default timeout (15s in two client components, 10s in the server-side
+ * api-server-client). Co-locates the `isAbortError` predicate so callers
+ * can classify timeout vs network failures consistently.
+ *
+ * Server-side uses `AbortSignal.timeout` where available (cheaper); this
+ * helper uses the AbortController+setTimeout form because the client
+ * code-paths need a guaranteed cleanup hook.
+ */
+
+/** Hard cap on every fetch using this helper unless overridden. Picked to
+ *  exceed the server-side `REQUEST_TIMEOUT_MS` (10s) in `api-server-client.ts`
+ *  so a slow but successful upstream response still lands. */
+export const DEFAULT_FETCH_TIMEOUT_MS = 15_000;
+
+export async function fetchWithTimeout(
+  input: RequestInfo | URL,
+  init: RequestInit = {},
+  timeoutMs: number = DEFAULT_FETCH_TIMEOUT_MS,
+): Promise<Response> {
+  const controller = new AbortController();
+  const id = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetch(input, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(id);
+  }
+}
+
+/** True when an error came from an AbortController.abort() OR a
+ *  `AbortSignal.timeout` firing. Both surface as `Error` with `name`
+ *  set to "AbortError" or "TimeoutError" respectively. Keeping the two
+ *  in one predicate prevents the "I forgot TimeoutError" drift class. */
+export function isAbortError(err: unknown): boolean {
+  return (
+    err instanceof Error
+    && (err.name === "AbortError" || err.name === "TimeoutError")
+  );
+}

package/.next/standalone/lib/share-card.ts

@@ -0,0 +1,120 @@
+/**
+ * Helpers for attaching the audit-card PNG to a social share.
+ *
+ *   X and LinkedIn intent URLs cannot carry image attachments — only text
+ *   and a target URL. To actually get an image into a post we have three
+ *   options at different levels of "automatic":
+ *
+ *     1. `shareCardNative` → `navigator.share({ files })` — the system
+ *        share sheet handles the image + text in one step. Works on
+ *        iOS, Android, recent Safari, recent Chrome desktop. When the
+ *        user picks their target (X / LinkedIn / …) the image is
+ *        already attached.
+ *     2. `copyOrDownloadCard` → clipboard + open intent URL — the user
+ *        pastes (⌘/Ctrl+V) in the share dialog and the image attaches.
+ *     3. `downloadCard` → straight download to disk, no other side
+ *        effects. Used by the dedicated "save audit-card" button so
+ *        the user gets a file every time, regardless of clipboard
+ *        permissions.
+ */
+
+export type ShareCardMethod = "native" | "clipboard" | "download" | "failed";
+
+/**
+ * Try the native Web Share API with a file attachment. Returns `true` on
+ * success, `false` if the API is unavailable, files-sharing isn't
+ * supported, or the user dismissed the sheet. Caller should fall back to
+ * `copyOrDownloadCard` on `false`.
+ */
+export async function shareCardNative(
+  blob: Blob,
+  filename: string,
+  text: string,
+): Promise<boolean> {
+  if (typeof navigator === "undefined" || typeof navigator.share !== "function") {
+    return false;
+  }
+  const file = new File([blob], filename, { type: "image/png" });
+  // Some browsers (older Chrome desktop) expose `navigator.share` but reject
+  // file payloads. `canShare({ files })` gates that cleanly.
+  type CanShareNav = Navigator & { canShare?: (data: ShareData) => boolean };
+  const navWithCan = navigator as CanShareNav;
+  if (typeof navWithCan.canShare === "function" && !navWithCan.canShare({ files: [file] })) {
+    return false;
+  }
+  try {
+    await navigator.share({ files: [file], text });
+    return true;
+  } catch (err) {
+    // AbortError → user dismissed the sheet. Treat as a soft failure so the
+    // caller can decide whether to open the intent URL anyway.
+    if (err instanceof Error && err.name === "AbortError") return false;
+    return false;
+  }
+}
+
+/**
+ * Copy a captured share-card PNG to the system clipboard, or fall back to a
+ * download if the browser doesn't support image clipboard writes (or the
+ * user denied permission). The caller MUST be inside an active user gesture
+ * (click handler) — Chromium gates `navigator.clipboard.write` on user
+ * activation.
+ */
+export async function copyOrDownloadCard(
+  blob: Blob,
+  filename: string,
+): Promise<Exclude<ShareCardMethod, "native">> {
+  if (
+    typeof ClipboardItem !== "undefined"
+    && typeof navigator !== "undefined"
+    && navigator.clipboard
+    && typeof navigator.clipboard.write === "function"
+  ) {
+    try {
+      await navigator.clipboard.write([
+        new ClipboardItem({ "image/png": blob }),
+      ]);
+      return "clipboard";
+    } catch {
+      /* permission denied, secure-context issue, browser fence, … */
+    }
+  }
+  return downloadCard(blob, filename) ? "download" : "failed";
+}
+
+/**
+ * Trigger a local download of the PNG. Returns `true` on success. No
+ * clipboard interaction — used by the explicit "save audit-card" CTA so the
+ * user reliably gets a file even when clipboard write would succeed.
+ */
+export function downloadCard(blob: Blob, filename: string): boolean {
+  try {
+    if (typeof document === "undefined" || typeof URL === "undefined") return false;
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement("a");
+    a.href = url;
+    a.download = filename;
+    a.style.display = "none";
+    document.body.appendChild(a);
+    a.click();
+    a.remove();
+    queueMicrotask(() => URL.revokeObjectURL(url));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Human-readable toast copy keyed by share method. */
+export function shareCardToastMessage(method: ShareCardMethod): string {
+  switch (method) {
+    case "native":
+      return "✅ image attached — pick where to post";
+    case "clipboard":
+      return "📋 image copied — paste it in the post (⌘/Ctrl+V)";
+    case "download":
+      return "⬇ image downloaded — attach it to your post";
+    case "failed":
+      return "couldn't capture image — opening text-only share";
+  }
+}

package/.next/standalone/lib/telemetry.ts

@@ -10,7 +10,7 @@
 
 import { getInstanceId } from "./telemetry-id";
 import { version } from "../package.json";
-import { POSTHOG_API_KEY } from "../src/posthog-key";
+import { POSTHOG_API_KEY, POSTHOG_PRODUCT } from "../src/posthog-key";
 
 const DEFAULT_API_KEY = POSTHOG_API_KEY;
 const DEFAULT_HOST = "https://us.i.posthog.com";
@@ -81,13 +81,18 @@ export function isTelemetryEnabled(): boolean {
 
 /**
  * Lazily import posthog-node and create a client.
- * No-op when telemetry is disabled.
+ *
+ * No-op when telemetry is disabled. **Never throws** — callers (the
+ * Next.js API routes and the CLI subcommands) can `await initTelemetry()`
+ * unguarded and a posthog init failure can't 500 a valid auth response.
+ * The outer try/catch is the single source of truth; do NOT add a
+ * per-call wrapper at the call sites.
  */
 export async function initTelemetry(): Promise<void> {
-  if (!isTelemetryEnabled()) return;
-  if (globalThis.__FAILPROOFAI_POSTHOG__) return;
-
   try {
+    if (!isTelemetryEnabled()) return;
+    if (globalThis.__FAILPROOFAI_POSTHOG__) return;
+
     const mod: { PostHog: new (key: string, opts: PostHogOptions) => PostHogClient } =
       await import("posthog-node");
     const apiKey = process.env.FAILPROOFAI_POSTHOG_KEY ?? DEFAULT_API_KEY;
@@ -110,7 +115,7 @@ export async function initTelemetry(): Promise<void> {
     process.on("SIGINT", onExit);
   } catch (err) {
     // Always log init failures — silent swallowing makes standalone debugging impossible
-    console.warn("[failproofai:telemetry] PostHog init failed:", err instanceof Error ? err.message : err);
+    console.warn("[failproofai:telemetry] init failed:", err instanceof Error ? err.message : err);
   }
 }
 
@@ -129,7 +134,7 @@ export function trackEvent(
   client.capture({
     distinctId: getInstanceId(),
     event: name,
-    properties: { ...properties, $lib: "failproofai", failproofai_version: version },
+    properties: { ...properties, $lib: "failproofai", failproofai_version: version, product: POSTHOG_PRODUCT },
   });
 }
 

package/.next/standalone/node_modules/@next/env/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next/env",
-  "version": "16.2.6",
+  "version": "16.2.7",
   "keywords": [
     "react",
     "next",

package/.next/standalone/node_modules/next/dist/build/swc/index.js

@@ -134,7 +134,7 @@ var HmrTarget = /*#__PURE__*/ function(HmrTarget) {
     HmrTarget["Server"] = "server";
     return HmrTarget;
 }({});
-const nextVersion = "16.2.6";
+const nextVersion = "16.2.7";
 const ArchName = (0, _os.arch)();
 const PlatformName = (0, _os.platform)();
 function infoLog(...args) {

package/.next/standalone/node_modules/next/dist/client/dev/debug-channel.js

@@ -23,16 +23,97 @@ _export(exports, {
 const _approuterheaders = require("../components/app-router-headers");
 const _invarianterror = require("../../shared/lib/invariant-error");
 const pairs = new Map();
+const DEBUG_CHANNEL_STORAGE_KEY_PREFIX = '__next_debug_channel:';
+// Buffer for the initial document's debug channel data. Written to
+// sessionStorage once complete so it can be restored when the browser serves
+// the page from HTTP cache (back-forward navigation, tab duplication, etc.).
+let initialDocumentDebugChunks = [];
+function persistDebugChannelToSessionStorage(requestId) {
+    const key = DEBUG_CHANNEL_STORAGE_KEY_PREFIX + requestId;
+    const value = JSON.stringify(initialDocumentDebugChunks.map((chunk)=>{
+        let binary = '';
+        for(let i = 0; i < chunk.byteLength; i++){
+            binary += String.fromCharCode(chunk[i]);
+        }
+        return btoa(binary);
+    }));
+    try {
+        sessionStorage.setItem(key, value);
+    } catch  {
+        // Likely a quota error. Drop entries from previous documents in this tab
+        // (we only need to restore the current one's entry on cache restore) and
+        // retry once. If it still fails, skip silently — the location.reload()
+        // fallback in createDebugChannel handles this case.
+        for(let i = sessionStorage.length - 1; i >= 0; i--){
+            const k = sessionStorage.key(i);
+            if (k?.startsWith(DEBUG_CHANNEL_STORAGE_KEY_PREFIX) && k !== key) {
+                sessionStorage.removeItem(k);
+            }
+        }
+        try {
+            sessionStorage.setItem(key, value);
+        } catch  {}
+    }
+}
+function wasServedFromCache() {
+    try {
+        // There is exactly one PerformanceNavigationTiming entry per page load.
+        const entry = performance.getEntriesByType('navigation')[0];
+        return entry?.transferSize === 0;
+    } catch  {
+        return false;
+    }
+}
+function restoreDebugChannelFromSessionStorage(requestId) {
+    try {
+        const serializedData = sessionStorage.getItem(DEBUG_CHANNEL_STORAGE_KEY_PREFIX + requestId);
+        if (!serializedData) {
+            return undefined;
+        }
+        const chunks = JSON.parse(serializedData).map((base64)=>{
+            const binary = atob(base64);
+            const bytes = new Uint8Array(binary.length);
+            for(let i = 0; i < binary.length; i++){
+                bytes[i] = binary.charCodeAt(i);
+            }
+            return bytes;
+        });
+        return new ReadableStream({
+            start (controller) {
+                for (const chunk of chunks){
+                    controller.enqueue(chunk);
+                }
+                controller.close();
+            }
+        });
+    } catch  {
+        return undefined;
+    }
+}
 function getOrCreateDebugChannelReadableWriterPair(requestId) {
     let pair = pairs.get(requestId);
     if (!pair) {
-        const { readable, writable } = new TransformStream();
+        // Only buffer chunks for the initial document's debug channel, not for
+        // client-side navigation requests.
+        const shouldBuffer = requestId === self.__next_r;
+        const { readable, writable } = new TransformStream({
+            transform (chunk, controller) {
+                if (shouldBuffer) {
+                    initialDocumentDebugChunks.push(chunk.slice());
+                }
+                controller.enqueue(chunk);
+            }
+        });
         pair = {
             readable,
             writer: writable.getWriter()
         };
         pairs.set(requestId, pair);
-        pair.writer.closed.finally(()=>pairs.delete(requestId));
+        pair.writer.closed.then(()=>{
+            if (shouldBuffer) {
+                persistDebugChannelToSessionStorage(requestId);
+            }
+        }).finally(()=>pairs.delete(requestId));
     }
     return pair;
 }
@@ -57,6 +138,25 @@ function createDebugChannel(requestHeaders) {
             });
         }
     }
+    // Only attempt to restore the sessionStorage debug channel entry for the
+    // initial document load (no request headers). Client-side navigations pass
+    // request headers and should always use the WebSocket-backed debug channel.
+    if (!requestHeaders && wasServedFromCache()) {
+        const readable = restoreDebugChannelFromSessionStorage(requestId);
+        if (readable) {
+            return {
+                readable
+            };
+        }
+        // Debug channel can't be restored — debug deps would block hydration.
+        // Force a fresh page load from the server. Return a never-closing stream
+        // so the Flight client stays parked until the reload tears the document
+        // down, instead of synchronously erroring with "Connection closed.".
+        location.reload();
+        return {
+            readable: new ReadableStream()
+        };
+    }
     const { readable } = getOrCreateDebugChannelReadableWriterPair(requestId);
     return {
         readable