Address PR review feedback: improve error handling and dependency management

[Copilot]

Addresses review comments from PR #264 regarding error handling robustness, dependency version constraints, and runtime environment variable access.

Error Handling

save-token route: Added ECONNRESET and ENETUNREACH to network error detection. Implemented isAxiosError type guard for safer error property access:

if (isAxiosError(err) && err.code && ['ECONNABORTED', 'ETIMEDOUT', 'ENOTFOUND', 'EHOSTUNREACH', 'ECONNRESET', 'ENETUNREACH'].includes(err.code)) {
  return NextResponse.json({ message: "Authentication service unavailable. Please try again." }, { status: 504 });
}

middleware: Distinguish auth errors from transient failures. Only clear session cookies for invalid/expired tokens, preserve them for network issues:

const isAuthError = lowerErrorMsg.includes('invalid') || 
                   lowerErrorMsg.includes('expired') ||
                   lowerErrorMsg.includes('jwt') ||
                   (lowerErrorMsg.includes('token') && (
                     lowerErrorMsg.includes('refresh') || lowerErrorMsg.includes('access')
                   ));

Dependencies

• @redocly/cli: 2.15.1 → ^2.15.1 (enable patch/minor updates)
• jsdom: 28.0.0 → ^28.0.0 (enable security patches)
• source-map: ^0.8.0-beta.0 → ^0.7.4 (avoid beta in production)

Service Worker

Changed ENABLE_SW_IN_DEV to NEXT_PUBLIC_ENABLE_SW_IN_DEV. Next.js requires NEXT_PUBLIC_ prefix for client-side environment variables. Removed redundant typeof process checks.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

This pull request addresses feedback from PR #264 by improving error handling robustness, updating dependency version constraints, and fixing environment variable access for client-side code. The changes focus on distinguishing between authentication errors and transient network failures, using proper type guards for error handling, and ensuring service worker configuration is accessible in the browser environment.

Changes:

• Enhanced error handling in middleware to distinguish authentication errors (which clear cookies) from transient network failures (which preserve cookies)
• Improved error handling in save-token route with proper isAxiosError type guard and expanded network error code detection
• Fixed service worker environment variable to use NEXT_PUBLIC_ prefix for browser access
• Updated dependency versions from pinned to caret ranges for @redocly/cli and jsdom, and migrated source-map from deprecated beta version to stable release

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/lib/supabase/middleware.ts	Implements logic to distinguish auth errors from transient failures with selective cookie clearing
src/components/sw-register.tsx	Updates environment variable to NEXT_PUBLIC_ENABLE_SW_IN_DEV for proper client-side access
src/app/api/auth/save-token/route.ts	Adds isAxiosError type guard and expands network error code handling
package.json	Updates dependency versions to use caret ranges and migrates source-map to stable version
package-lock.json	Reflects dependency version updates with consistent lock file changes

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The nested condition contains redundant checks for 'invalid' and 'expired'. Lines 57-58 check for lowerErrorMsg.includes('invalid') and lowerErrorMsg.includes('expired') within a block that only executes when lowerErrorMsg.includes('token') is true. However, these same checks are already performed at the top level on lines 50-51. This means if the error message contains 'invalid' or 'expired' without 'token', it would already be caught. If it contains 'token' AND 'invalid'/'expired', the top-level check would have already succeeded. These nested checks can never add value and should be removed for clarity.

Suggested change

	lowerErrorMsg.includes('access') ||
	lowerErrorMsg.includes('invalid') ||
	lowerErrorMsg.includes('expired')
	lowerErrorMsg.includes('access')

[Copilot]

The package.json specifies source-map version ^0.7.4, but package-lock.json resolves to 0.7.6. While this is technically correct behavior for semver (^ allows compatible updates), it suggests version 0.7.4 may not exist or is not the latest patch version. Consider updating package.json to specify ^0.7.6 for clarity and to match what's actually being installed, or verify that 0.7.4 exists as a valid version.

Suggested change

	"source-map": "^0.7.4",
	"source-map": "^0.7.6",