standout 0.5.20 → 0.5.22

package/dist/api.js

@@ -1,4 +1,8 @@
+import { capPayload } from "./payload.js";
 export const STANDOUT_API_URL = process.env.STANDOUT_API_URL || "https://standout.work";
+// Matches the server's request budget so the client doesn't hang forever (the
+// submit handler has no client timeout otherwise) nor abort a still-valid run.
+const SUBMIT_TIMEOUT_MS = 300000;
 export async function enrichProfile(type, value) {
     try {
         const res = await fetch(`${STANDOUT_API_URL}/api/public/agent-enrich`, {
@@ -65,10 +69,14 @@ export async function submitProfile(profile, options = {}) {
         const jobId = process.env.STANDOUT_JOB_ID;
         const mergedProfile = mergeSubmissionProfile(profileData, options.prefetchedProfile);
         const payload = jobId ? { ...mergedProfile, jobId } : mergedProfile;
+        // Trim under Vercel's 4.5MB body cap so a heavy history can't 413 the core
+        // submission before the handler runs.
+        const { payload: capped } = capPayload(payload);
         const res = await fetch(`${STANDOUT_API_URL}/api/public/agent-submit`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
-            body: JSON.stringify(payload),
+            body: JSON.stringify(capped),
+            signal: AbortSignal.timeout(SUBMIT_TIMEOUT_MS),
         });
         if (!res.ok) {
             const error = await res.text();

package/dist/payload.d.ts

@@ -0,0 +1,8 @@
+export interface CapResult {
+    payload: Record<string, unknown>;
+    trimmed: boolean;
+    bytesBefore: number;
+    bytesAfter: number;
+    dropped: string[];
+}
+export declare function capPayload(payload: Record<string, unknown>): CapResult;

package/dist/payload.js

@@ -0,0 +1,150 @@
+// Shapes the outbound profile so a heavy history can't break the request.
+//
+// The bulk is the raw `exchanges` corpus (user<->assistant pairs): up to 500 per
+// tool x ~2.8KB, so a 3-tool user ships ~4.2MB. Two problems with sending it raw:
+//   1. The wrapped cards that consume it (collaboration -> 500, craft -> 50) merge
+//      across tools then stride-sample DOWN, so anything past 500 total is
+//      discarded server-side — pure waste.
+//   2. Vercel rejects a >4.5MB function body with a 413 BEFORE our handler runs,
+//      killing both the wrapped and the core submission.
+//
+// So we (a) always bound combined exchanges to what the cards actually read, and
+// (b) keep a hard byte backstop that sheds the least-valuable raw fields first.
+const MAX_BODY_BYTES = 4_000_000; // headroom under Vercel's 4.5MB hard limit
+// The most any wrapped card consumes (collaboration's ceiling; craft reads 50).
+// Capping here is lossless for card resolution — the server would sample to this
+// anyway — it only changes WHICH evenly-strided subset is read.
+const MAX_UPLOAD_EXCHANGES = 500;
+const TOOLS = ["claude_code", "codex", "cursor"];
+function byteLength(value) {
+    return Buffer.byteLength(JSON.stringify(value), "utf8");
+}
+function asRecord(value) {
+    return value && typeof value === "object"
+        ? value
+        : undefined;
+}
+function exchangesOf(aiUsage, tool) {
+    const ex = asRecord(aiUsage[tool])?.exchanges;
+    return Array.isArray(ex) ? ex : [];
+}
+function totalExchanges(payload) {
+    const aiUsage = asRecord(payload.ai_usage);
+    if (!aiUsage)
+        return 0;
+    return TOOLS.reduce((n, t) => n + exchangesOf(aiUsage, t).length, 0);
+}
+// Evenly stride-sample an array down to `keep` items (representative, not
+// recency-biased — matches how the server reads the corpus).
+function evenSample(arr, keep) {
+    if (arr.length <= keep)
+        return arr;
+    const stride = arr.length / keep;
+    const out = [];
+    for (let i = 0; i < keep; i++)
+        out.push(arr[Math.floor(i * stride)]);
+    return out;
+}
+// Bound combined exchanges to `maxTotal`, proportional per tool, even-sampled.
+function capExchangesInPlace(payload, maxTotal) {
+    const aiUsage = asRecord(payload.ai_usage);
+    if (!aiUsage)
+        return;
+    const present = TOOLS.map((t) => ({
+        t,
+        n: exchangesOf(aiUsage, t).length,
+    })).filter((x) => x.n > 0);
+    const total = present.reduce((s, x) => s + x.n, 0);
+    if (total <= maxTotal)
+        return;
+    for (const { t, n } of present) {
+        const keep = Math.max(1, Math.round((maxTotal * n) / total));
+        const tool = asRecord(aiUsage[t]);
+        if (tool)
+            tool.exchanges = evenSample(tool.exchanges, keep);
+    }
+}
+// Returns a (possibly reshaped) clone — never mutates the caller's object.
+export function capPayload(payload) {
+    const bytesBefore = byteLength(payload);
+    const dropped = [];
+    // Only clone (and pay the cost) if there's actually something to do.
+    const needsExchangeCap = totalExchanges(payload) > MAX_UPLOAD_EXCHANGES;
+    if (!needsExchangeCap && bytesBefore <= MAX_BODY_BYTES) {
+        return {
+            payload,
+            trimmed: false,
+            bytesBefore,
+            bytesAfter: bytesBefore,
+            dropped: [],
+        };
+    }
+    const p = structuredClone(payload);
+    const aiUsage = asRecord(p.ai_usage) ?? {};
+    // 1. Always: bound exchanges to what the cards read (lossless for resolution).
+    if (needsExchangeCap) {
+        capExchangesInPlace(p, MAX_UPLOAD_EXCHANGES);
+        dropped.push(`exchanges->${MAX_UPLOAD_EXCHANGES}`);
+    }
+    // Hard byte backstop — only if still oversized after the exchange cap (rare).
+    // Shed least-valuable raw fields FIRST so the analyzed exchanges are the last
+    // thing we touch.
+    const over = () => byteLength(p) > MAX_BODY_BYTES;
+    // 2. Display-only conversation samples.
+    if (over()) {
+        for (const t of TOOLS) {
+            const tool = asRecord(aiUsage[t]);
+            if (tool &&
+                Array.isArray(tool.conversation_samples) &&
+                tool.conversation_samples.length) {
+                tool.conversation_samples = [];
+                if (!dropped.includes("conversation_samples")) {
+                    dropped.push("conversation_samples");
+                }
+            }
+        }
+    }
+    // 3. Commit subjects + repo README excerpts (contributions/blurbs inputs).
+    if (over()) {
+        const aiCoding = asRecord(p.ai_coding);
+        if (aiCoding &&
+            Array.isArray(aiCoding.commit_subjects) &&
+            aiCoding.commit_subjects.length) {
+            aiCoding.commit_subjects = [];
+            dropped.push("commit_subjects");
+        }
+        const local = asRecord(p.local);
+        if (local && Array.isArray(local.repos)) {
+            let touched = false;
+            for (const repo of local.repos) {
+                const r = asRecord(repo);
+                if (r && r.readme_excerpt) {
+                    r.readme_excerpt = null;
+                    touched = true;
+                }
+            }
+            if (touched)
+                dropped.push("readme_excerpts");
+        }
+    }
+    // 4. Last resort: shrink exchanges further (halve, keeping recent) until it
+    //    fits. Only reached for pathologically large non-exchange data.
+    while (over() && totalExchanges(p) > 0) {
+        for (const t of TOOLS) {
+            const tool = asRecord(aiUsage[t]);
+            const ex = tool?.exchanges;
+            if (tool && Array.isArray(ex) && ex.length > 0) {
+                tool.exchanges = ex.slice(Math.ceil(ex.length / 2));
+            }
+        }
+        if (!dropped.includes("exchanges:backstop"))
+            dropped.push("exchanges:backstop");
+    }
+    return {
+        payload: p,
+        trimmed: true,
+        bytesBefore,
+        bytesAfter: byteLength(p),
+        dropped,
+    };
+}

package/dist/wrapped/preview.js

@@ -1,5 +1,5 @@
 // Dev preview of the proficiency finale card for every score tier.
-//   npm run preview:tiers            (from packages/agent)
+//   npm run preview:tiers            (from packages/standout)
 // One representative profile per tier so you can eyeball figures, copy, and fit.
 import { cardProficiency } from "./render.js";
 import { TIERS } from "./tiers.js";

package/dist/wrapped-client.js

@@ -1,4 +1,8 @@
+// PUBLISHING: this is shipped npm package code. Any runtime change here must bump
+// "version" in package.json in the same PR — that bump is the ONLY trigger for the
+// npm publish on merge. Land a change without it and the fix never reaches users.
 import { STANDOUT_API_URL } from "./api.js";
+import { capPayload } from "./payload.js";
 import { aggregateView } from "./wrapped/aggregate.js";
 const HEADERS = {
     "Content-Type": "application/json",
@@ -6,31 +10,73 @@ const HEADERS = {
     // node-fetch UAs on certain paths. Set a clear identity.
     "User-Agent": "Standout/0.4.0 (node)",
 };
+// The request holds a connection open while the backend runs the wrapped's
+// LLM cards, so a transient blip shouldn't permanently drop the wrapped.
+const MAX_ATTEMPTS = 3;
+// Matches the server route's 300s maxDuration: the client only gives up once the
+// server itself would have. A shorter client timeout would abort a still-valid
+// slow run and orphan the wrapped the server goes on to create.
+const REQUEST_TIMEOUT_MS = 300000;
+const RETRY_BASE_DELAY_MS = 1000;
+// Wrapped creation is NOT idempotent — each POST makes a new row + LLM run. Only
+// retry failures that prove the request never reached the backend; a timeout or a
+// mid-flight drop may mean the server already created it, so replaying would
+// duplicate the wrapped.
+const RETRYABLE_CONNECT_CODES = new Set([
+    "ECONNREFUSED",
+    "ENOTFOUND",
+    "EAI_AGAIN",
+    "UND_ERR_CONNECT_TIMEOUT",
+]);
+function isPreConnectError(err) {
+    for (const node of [err, err?.cause]) {
+        const code = node?.code;
+        if (typeof code === "string" && RETRYABLE_CONNECT_CODES.has(code)) {
+            return true;
+        }
+    }
+    return false;
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 export async function createWrapped(args) {
-    try {
-        const res = await fetch(`${STANDOUT_API_URL}/api/public/wrapped`, {
-            method: "POST",
-            headers: HEADERS,
-            body: JSON.stringify({
+    // Keep the request under Vercel's 4.5MB body cap (else a heavy history 413s
+    // before the handler runs). Trims the bulkiest raw fields only when oversized.
+    const { payload: profile } = capPayload(args.profile);
+    const body = JSON.stringify({
+        profile,
+        submission_id: args.submissionId ?? undefined,
+    });
+    for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
+        try {
+            const res = await fetch(`${STANDOUT_API_URL}/api/public/wrapped`, {
+                method: "POST",
+                headers: HEADERS,
+                body,
+                signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+            });
+            // Any HTTP response means the request reached the server; don't replay it
+            // (a 5xx could land after the row was already created).
+            if (!res.ok) {
+                const text = await res.text().catch(() => "");
+                process.stderr.write(`[wrapped] backend returned ${res.status}${text ? `: ${text.slice(0, 200)}` : ""}\n`);
+                return null;
+            }
+            const data = (await res.json());
+            const view = aggregateView({
                 profile: args.profile,
-                submission_id: args.submissionId ?? undefined,
-            }),
-        });
-        if (!res.ok) {
-            const text = await res.text().catch(() => "");
-            process.stderr.write(`[wrapped] backend returned ${res.status}${text ? `: ${text.slice(0, 200)}` : ""}\n`);
+                computed: data.computed,
+                share_url: data.share_url,
+            });
+            return { id: data.id, share_url: data.share_url, view };
+        }
+        catch (err) {
+            if (isPreConnectError(err) && attempt < MAX_ATTEMPTS) {
+                await sleep(RETRY_BASE_DELAY_MS * attempt);
+                continue;
+            }
+            process.stderr.write(`[wrapped] failed to reach backend: ${err instanceof Error ? err.message : err}\n`);
             return null;
         }
-        const data = (await res.json());
-        const view = aggregateView({
-            profile: args.profile,
-            computed: data.computed,
-            share_url: data.share_url,
-        });
-        return { id: data.id, share_url: data.share_url, view };
-    }
-    catch (err) {
-        process.stderr.write(`[wrapped] failed to reach backend: ${err instanceof Error ? err.message : err}\n`);
-        return null;
     }
+    return null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "standout",
-  "version": "0.5.20",
+  "version": "0.5.22",
   "description": "Build your developer profile with AI. One command, zero friction.",
   "type": "module",
   "main": "./dist/cli.js",