@failproofai/sdk 0.0.1-beta.1

Features

• OpenTelemetry spans to FailproofAI Cloud, without a network call in your
  process. OtelSpanExporter, or instrument("otel", { spanProcessors }) before
  you construct your provider, writes each finished batch of spans as OTLP/JSON to
  the local spool (~/.failproofai/state/spool-otlp); the failproofai daemon
  delivers it to Cloud with the machine's key and retries if Cloud is unreachable.
  @opentelemetry/sdk-trace-base is only loaded when you call it.

Fixes

• A blank FAILPROOFAI_HOME no longer means the current directory. An empty or
  whitespace-only value made the exporter and the custom-agents resolver write
  under the working directory, where the daemon never reads. Blank now means unset.

• The integration fixtures stop carrying 32 open security advisories. Nothing
  the published package ships changed — every fixture under integration/fixtures/
  is "private": true and exists only to run the adapters against real framework
  releases — but their committed lockfiles are read by GitHub's dependency graph,
  and the old majors those fixtures deliberately pin (ai@4.3.19,
  @langchain/core@0.3.80, @mastra/core@0.24.9) pin their transitive deps
  exactly, so nothing moved in range. Five fixtures now carry a minimal overrides
  entry — undici, langsmith, uuid, jsondiffpatch and five OpenTelemetry
  packages — clearing 32 of them with every framework pin, and
  langchain-dup-core's two-copies-of-@langchain/core shape, unchanged.
  Four alerts remain, from two low-severity advisories: one against ai@4.3.19
  (GHSA-rwvc-j5jr-mgvh) and one against the @ai-sdk/provider-utils@2.2.8 that
  ships inside it (GHSA-866g-f22w-33x8). Both are fixed only in the major these
  fixtures exist to stay below, so SECURITY.md records them and the rule for
  the next one. (nextjs's postcss is handled in #838.) (#837)

• The last four fixture advisories clear, and no fixture leaves its pinned
  major to do it. nextjs carried postcss@8.4.31 (GHSA-qx2v-qp2m-jg93,
  GHSA-6g55-p6wh-862q, GHSA-r28c-9q8g-f849, GHSA-fxqj-rqcc-2cmp) under a second
  next@15.5.26 that npm installed only to satisfy @llamaindex/workflow-core@1.3.3's
  next@^15.2.2 peer against the fixture's root next@16.3.6. Nothing imports it,
  so regenerating the lockfile drops that peer tree and nothing else — 274 lines,
  deletions only, npm audit 5 findings → 0. Dependabot had reached the same
  advisories by moving the pins instead: ai-4 to ai@5.0.52 and mastra-0 to
  @mastra/core@1.70.0, the two releases those fixtures exist to hold, and the one
  move SECURITY.md names as never the answer. mastra-0 then stopped installing
  altogether — @mastra/mcp@0.14.5 peers on @mastra/core@">=0.20.1-0 <0.25.0-0",
  so npm ci failed ERESOLVE — and because the global setup installs every fixture
  before any test runs, that one fixture took down all three non-nextjs shards,
  runtimes included, which has no Mastra test in it. Both pins are restored, and
  ai stays at 7.0.111 in nextjs so the fixture still matches the ai-7 twin
  whose trace nextjs.test.ts compares each route against. (#838)

• Two more fixture advisories clear, and again no fixture leaves its pinned
  major. Both were reachable the whole time; nothing had looked. ai-5 pinned
  undici at 7.29.0 through the override added in #837, and GHSA-3wwx-pv8p-q78v
  (medium) is fixed in 7.29.1 — the root package.json's own undici override
  moved there, the fixture's did not. mastra-0 carried eleven copies of
  @ai-sdk/provider-utils, which split in two: nine parents on that fixture's 5.x
  side (ai-v5, @ai-sdk/gateway, @ai-sdk/openai-v5 and six siblings) pinned
  exact 3.0.10–3.0.17, every one below the 3.0.28 that fixes
  GHSA-866g-f22w-33x8, while the other two are the 2.2.8 that ships inside
  ai@4.3.19 under @mastra/core and @mastra/memory. The accepted row above
  describes only that second pair, so the 3.x half was never covered by it — a
  plain "@ai-sdk/provider-utils": "3.0.28" would have forced both halves and
  broken the pin. The entry is spec-scoped instead — "@ai-sdk/provider-utils@3",
  which npm applies only where the requested range already resolves inside 3.x —
  so the 3.x copies collapse to one patched copy, the two 2.2.8 copies are
  untouched, and @mastra/core@0.24.9, @mastra/mcp@0.14.5,
  @mastra/memory@0.15.13 and ai@4.3.19 all resolve exactly as before. That
  dedupe is most of the ~110 deleted lockfile lines.

  One of the nine hid behind an npm alias, and that is the part worth
  remembering. @mastra/core@0.24.9 does not ask for @ai-sdk/provider-utils
  by name — it asks for "@ai-sdk/provider-utils-v5": "npm:@ai-sdk/provider-utils@3.0.12",
  one of ten -v5 aliases in that lockfile. npm keys overrides on the name the
  dependent requests, not on the name that ends up installed, so
  "@ai-sdk/provider-utils@3" never applied to it and an affected 3.0.12 stayed
  in the tree looking, from every path-keyed check, exactly like a package that had
  been patched. It needed its own alias-keyed entry,
  "@ai-sdk/provider-utils-v5": "npm:@ai-sdk/provider-utils@3.0.28". Verifying an
  override by globbing lockfile paths for the real package name is what missed it;
  npm audit names the alias directly. The other nine aliases are unaffected —
  ai-v5 resolves 5.0.60 and 5.0.97, both above GHSA-rwvc-j5jr-mgvh's 5.0.52
  floor. Dependabot had reached the same two alerts by moving
  ai-4 to ai@5.0.52, ai-5 to ai@7.0.122 and mastra-0 to
  @mastra/core@1.71.0 (#867) — the third time in as many days that its fix for a
  fixture advisory was the one SECURITY.md forbids, and it failed the same
  ERESOLVE on the same @mastra/mcp peer as #838. ai-4 needed no change: both
  advisories still open against it are the accepted kind, and the table above
  already carries them. (#869)

• mastra-1 clears its one fixture advisory without moving a pin.
  GHSA-6qxp-vccf-f47h (high) is against @modelcontextprotocol/client@2.0.0,
  which @mastra/mcp@2.0.0 pins exactly. The fixture now carries an overrides
  entry for the patched 2.2.0. That release brings its own
  @modelcontextprotocol/core@2.2.0, nested under it, and every other package
  resolves as before. Dependabot's fix (#884) moved @mastra/mcp to 2.3.0
  instead. That release peers on @mastra/core >=1.75.0-0, so it cannot install
  beside the fixture's 1.68.0. The mcp and mcp-toolsets scenarios pass
  against the override. This package's own dev lockfile also moves
  source-map-js to 1.2.2 (GHSA-68fv-2mgg-jv7q). (#901)

• nextjs and mastra-0 clear their fixable advisories, again without moving
  a pin. nextjs moves next to 16.4.1 (six advisories, fixed in 16.3.8),
  sharp to 0.35.5 (GHSA-wq5f-xc86-pv6w) and source-map-js to 1.2.2
  (GHSA-68fv-2mgg-jv7q). mastra-0 moves @modelcontextprotocol/sdk from
  1.30.1 to 1.32.1 (GHSA-6qxp-vccf-f47h), inside the ^1.17.5 range
  @mastra/mcp@0.14.5 declares, so only the lockfile changes. Dependabot's
  version of this PR also moved ai-4 to ai@5.0.52 and mastra-0 to
  @mastra/core@1.77.0, which cannot install beside @mastra/mcp@0.14.5 and
  failed every integration shard, and nextjs's ai to 7.0.141, off the
  ai-7 twin its routes' traces are compared against. None of those are
  applied. (#902)