standout 0.5.21 → 0.5.22

package/dist/api.js

@@ -1,4 +1,8 @@
+import { capPayload } from "./payload.js";
 export const STANDOUT_API_URL = process.env.STANDOUT_API_URL || "https://standout.work";
+// Matches the server's request budget so the client doesn't hang forever (the
+// submit handler has no client timeout otherwise) nor abort a still-valid run.
+const SUBMIT_TIMEOUT_MS = 300000;
 export async function enrichProfile(type, value) {
     try {
         const res = await fetch(`${STANDOUT_API_URL}/api/public/agent-enrich`, {
@@ -65,10 +69,14 @@ export async function submitProfile(profile, options = {}) {
         const jobId = process.env.STANDOUT_JOB_ID;
         const mergedProfile = mergeSubmissionProfile(profileData, options.prefetchedProfile);
         const payload = jobId ? { ...mergedProfile, jobId } : mergedProfile;
+        // Trim under Vercel's 4.5MB body cap so a heavy history can't 413 the core
+        // submission before the handler runs.
+        const { payload: capped } = capPayload(payload);
         const res = await fetch(`${STANDOUT_API_URL}/api/public/agent-submit`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
-            body: JSON.stringify(payload),
+            body: JSON.stringify(capped),
+            signal: AbortSignal.timeout(SUBMIT_TIMEOUT_MS),
         });
         if (!res.ok) {
             const error = await res.text();

package/dist/payload.d.ts

@@ -0,0 +1,8 @@
+export interface CapResult {
+    payload: Record<string, unknown>;
+    trimmed: boolean;
+    bytesBefore: number;
+    bytesAfter: number;
+    dropped: string[];
+}
+export declare function capPayload(payload: Record<string, unknown>): CapResult;

package/dist/payload.js

@@ -0,0 +1,150 @@
+// Shapes the outbound profile so a heavy history can't break the request.
+//
+// The bulk is the raw `exchanges` corpus (user<->assistant pairs): up to 500 per
+// tool x ~2.8KB, so a 3-tool user ships ~4.2MB. Two problems with sending it raw:
+//   1. The wrapped cards that consume it (collaboration -> 500, craft -> 50) merge
+//      across tools then stride-sample DOWN, so anything past 500 total is
+//      discarded server-side — pure waste.
+//   2. Vercel rejects a >4.5MB function body with a 413 BEFORE our handler runs,
+//      killing both the wrapped and the core submission.
+//
+// So we (a) always bound combined exchanges to what the cards actually read, and
+// (b) keep a hard byte backstop that sheds the least-valuable raw fields first.
+const MAX_BODY_BYTES = 4_000_000; // headroom under Vercel's 4.5MB hard limit
+// The most any wrapped card consumes (collaboration's ceiling; craft reads 50).
+// Capping here is lossless for card resolution — the server would sample to this
+// anyway — it only changes WHICH evenly-strided subset is read.
+const MAX_UPLOAD_EXCHANGES = 500;
+const TOOLS = ["claude_code", "codex", "cursor"];
+function byteLength(value) {
+    return Buffer.byteLength(JSON.stringify(value), "utf8");
+}
+function asRecord(value) {
+    return value && typeof value === "object"
+        ? value
+        : undefined;
+}
+function exchangesOf(aiUsage, tool) {
+    const ex = asRecord(aiUsage[tool])?.exchanges;
+    return Array.isArray(ex) ? ex : [];
+}
+function totalExchanges(payload) {
+    const aiUsage = asRecord(payload.ai_usage);
+    if (!aiUsage)
+        return 0;
+    return TOOLS.reduce((n, t) => n + exchangesOf(aiUsage, t).length, 0);
+}
+// Evenly stride-sample an array down to `keep` items (representative, not
+// recency-biased — matches how the server reads the corpus).
+function evenSample(arr, keep) {
+    if (arr.length <= keep)
+        return arr;
+    const stride = arr.length / keep;
+    const out = [];
+    for (let i = 0; i < keep; i++)
+        out.push(arr[Math.floor(i * stride)]);
+    return out;
+}
+// Bound combined exchanges to `maxTotal`, proportional per tool, even-sampled.
+function capExchangesInPlace(payload, maxTotal) {
+    const aiUsage = asRecord(payload.ai_usage);
+    if (!aiUsage)
+        return;
+    const present = TOOLS.map((t) => ({
+        t,
+        n: exchangesOf(aiUsage, t).length,
+    })).filter((x) => x.n > 0);
+    const total = present.reduce((s, x) => s + x.n, 0);
+    if (total <= maxTotal)
+        return;
+    for (const { t, n } of present) {
+        const keep = Math.max(1, Math.round((maxTotal * n) / total));
+        const tool = asRecord(aiUsage[t]);
+        if (tool)
+            tool.exchanges = evenSample(tool.exchanges, keep);
+    }
+}
+// Returns a (possibly reshaped) clone — never mutates the caller's object.
+export function capPayload(payload) {
+    const bytesBefore = byteLength(payload);
+    const dropped = [];
+    // Only clone (and pay the cost) if there's actually something to do.
+    const needsExchangeCap = totalExchanges(payload) > MAX_UPLOAD_EXCHANGES;
+    if (!needsExchangeCap && bytesBefore <= MAX_BODY_BYTES) {
+        return {
+            payload,
+            trimmed: false,
+            bytesBefore,
+            bytesAfter: bytesBefore,
+            dropped: [],
+        };
+    }
+    const p = structuredClone(payload);
+    const aiUsage = asRecord(p.ai_usage) ?? {};
+    // 1. Always: bound exchanges to what the cards read (lossless for resolution).
+    if (needsExchangeCap) {
+        capExchangesInPlace(p, MAX_UPLOAD_EXCHANGES);
+        dropped.push(`exchanges->${MAX_UPLOAD_EXCHANGES}`);
+    }
+    // Hard byte backstop — only if still oversized after the exchange cap (rare).
+    // Shed least-valuable raw fields FIRST so the analyzed exchanges are the last
+    // thing we touch.
+    const over = () => byteLength(p) > MAX_BODY_BYTES;
+    // 2. Display-only conversation samples.
+    if (over()) {
+        for (const t of TOOLS) {
+            const tool = asRecord(aiUsage[t]);
+            if (tool &&
+                Array.isArray(tool.conversation_samples) &&
+                tool.conversation_samples.length) {
+                tool.conversation_samples = [];
+                if (!dropped.includes("conversation_samples")) {
+                    dropped.push("conversation_samples");
+                }
+            }
+        }
+    }
+    // 3. Commit subjects + repo README excerpts (contributions/blurbs inputs).
+    if (over()) {
+        const aiCoding = asRecord(p.ai_coding);
+        if (aiCoding &&
+            Array.isArray(aiCoding.commit_subjects) &&
+            aiCoding.commit_subjects.length) {
+            aiCoding.commit_subjects = [];
+            dropped.push("commit_subjects");
+        }
+        const local = asRecord(p.local);
+        if (local && Array.isArray(local.repos)) {
+            let touched = false;
+            for (const repo of local.repos) {
+                const r = asRecord(repo);
+                if (r && r.readme_excerpt) {
+                    r.readme_excerpt = null;
+                    touched = true;
+                }
+            }
+            if (touched)
+                dropped.push("readme_excerpts");
+        }
+    }
+    // 4. Last resort: shrink exchanges further (halve, keeping recent) until it
+    //    fits. Only reached for pathologically large non-exchange data.
+    while (over() && totalExchanges(p) > 0) {
+        for (const t of TOOLS) {
+            const tool = asRecord(aiUsage[t]);
+            const ex = tool?.exchanges;
+            if (tool && Array.isArray(ex) && ex.length > 0) {
+                tool.exchanges = ex.slice(Math.ceil(ex.length / 2));
+            }
+        }
+        if (!dropped.includes("exchanges:backstop"))
+            dropped.push("exchanges:backstop");
+    }
+    return {
+        payload: p,
+        trimmed: true,
+        bytesBefore,
+        bytesAfter: byteLength(p),
+        dropped,
+    };
+}

package/dist/wrapped-client.js

@@ -2,6 +2,7 @@
 // "version" in package.json in the same PR — that bump is the ONLY trigger for the
 // npm publish on merge. Land a change without it and the fix never reaches users.
 import { STANDOUT_API_URL } from "./api.js";
+import { capPayload } from "./payload.js";
 import { aggregateView } from "./wrapped/aggregate.js";
 const HEADERS = {
     "Content-Type": "application/json",
@@ -12,8 +13,10 @@ const HEADERS = {
 // The request holds a connection open while the backend runs the wrapped's
 // LLM cards, so a transient blip shouldn't permanently drop the wrapped.
 const MAX_ATTEMPTS = 3;
-// Comfortably above the backend's worst-case critical path, below its 300s cap.
-const REQUEST_TIMEOUT_MS = 120000;
+// Matches the server route's 300s maxDuration: the client only gives up once the
+// server itself would have. A shorter client timeout would abort a still-valid
+// slow run and orphan the wrapped the server goes on to create.
+const REQUEST_TIMEOUT_MS = 300000;
 const RETRY_BASE_DELAY_MS = 1000;
 // Wrapped creation is NOT idempotent — each POST makes a new row + LLM run. Only
 // retry failures that prove the request never reached the backend; a timeout or a
@@ -36,8 +39,11 @@ function isPreConnectError(err) {
 }
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 export async function createWrapped(args) {
+    // Keep the request under Vercel's 4.5MB body cap (else a heavy history 413s
+    // before the handler runs). Trims the bulkiest raw fields only when oversized.
+    const { payload: profile } = capPayload(args.profile);
     const body = JSON.stringify({
-        profile: args.profile,
+        profile,
         submission_id: args.submissionId ?? undefined,
     });
     for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "standout",
-  "version": "0.5.21",
+  "version": "0.5.22",
   "description": "Build your developer profile with AI. One command, zero friction.",
   "type": "module",
   "main": "./dist/cli.js",