feat: Download PDF + Copy Markdown on the scan-run page

Two new actions in the scan-run header, rendered as soon as any
engine reaches complete (no point hitting them while everything is
still running).

- PdfButton hits /api/audits/<first-audit>/pdf, which the recent
  consolidated-PDF change already makes scan-run-aware: returns the
  exec summary + every engine's full report stitched into one PDF.
- New CopyMarkdownButton fetches a fresh markdown endpoint and
  writes the body to the clipboard. Designed for pasting the full
  consolidated report into another LLM.
- New /api/projects/[id]/runs/[runId]/markdown route — owner-only,
  returns the same consolidated Markdown the email-summary PDF and
  /r/<token>/report.md serve, via the shared buildScanRunMarkdown
  helper.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ralyodio

app/(app)/projects/[id]/runs/[runId]/page.tsx

@@ -3,6 +3,8 @@ import { createClient } from "@/lib/supabase/server";
 import { type Engine } from "@/lib/credits";
 import { ScanRunResults, type RunAudit } from "@/components/scan-run-results";
 import { ScanRunRefresh } from "@/components/scan-run-refresh";
+import { PdfButton } from "@/components/pdf-button";
+import { CopyMarkdownButton } from "@/components/copy-markdown-button";
 
 export const dynamic = "force-dynamic";
 
@@ -48,13 +50,25 @@ export default async function ScanRunPage({
     summary: r.summary,
   }));
 
+  const anyComplete = typedRows.some((r) => r.status === "complete");
+
   return (
     <>
       <ScanRunResults
         rows={typedRows}
         targetUrl={rows[0].target_url}
         backHref={`/projects/${projectId}`}
         backLabel={project.name}
+        ownerActions={
+          anyComplete ? (
+            <div className="flex flex-col gap-2 sm:flex-row">
+              <PdfButton auditId={rows[0].id} />
+              <CopyMarkdownButton
+                href={`/api/projects/${projectId}/runs/${runId}/markdown`}
+              />
+            </div>
+          ) : undefined
+        }
       />
       <ScanRunRefresh projectId={projectId} runId={runId} done={allDone} />
     </>

app/api/projects/[id]/runs/[runId]/markdown/route.ts

@@ -0,0 +1,56 @@
+import { NextResponse } from "next/server";
+import { createClient } from "@/lib/supabase/server";
+import {
+  buildScanRunMarkdown,
+  type SummaryRow,
+} from "@/lib/audit/summary-markdown";
+
+export const runtime = "nodejs";
+
+// Owner-only consolidated Markdown for a scan run — executive summary
+// followed by each engine's full report. Used by the Copy Markdown
+// button on the scan-run page; safe to paste into another LLM.
+export async function GET(
+  _req: Request,
+  { params }: { params: Promise<{ id: string; runId: string }> },
+) {
+  const { id: projectId, runId } = await params;
+  const supabase = await createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+  if (!user) return new Response("Not authenticated", { status: 401 });
+
+  const { data: project } = await supabase
+    .from("projects")
+    .select("id, owner_id")
+    .eq("id", projectId)
+    .maybeSingle();
+  if (!project || project.owner_id !== user.id) {
+    return new Response("Not found", { status: 404 });
+  }
+
+  const { data: audits } = await supabase
+    .from("audits")
+    .select(
+      "id, engine, status, score, share_token, summary, report_markdown, failed_reason, created_at, target_url",
+    )
+    .eq("scan_run_id", runId)
+    .eq("project_id", projectId)
+    .order("created_at", { ascending: true });
+  const rows = (audits ?? []) as (SummaryRow & { target_url: string })[];
+  if (rows.length === 0) {
+    return new Response("Not found", { status: 404 });
+  }
+
+  const md = buildScanRunMarkdown({
+    targetUrl: rows[0].target_url,
+    rows,
+  });
+  return new Response(md, {
+    headers: {
+      "content-type": "text/markdown; charset=utf-8",
+      "cache-control": "no-store",
+    },
+  });
+}

components/copy-markdown-button.tsx

@@ -0,0 +1,54 @@
+"use client";
+
+import { useState } from "react";
+
+// Fetches a Markdown endpoint and copies the response body to the
+// clipboard. Used on the scan-run page to grab the consolidated
+// "executive summary + per-engine reports" document for pasting into
+// another LLM.
+export function CopyMarkdownButton({
+  href,
+  label = "Copy Markdown",
+}: {
+  href: string;
+  label?: string;
+}) {
+  const [state, setState] = useState<"idle" | "loading" | "copied" | "error">(
+    "idle",
+  );
+
+  async function onClick() {
+    setState("loading");
+    try {
+      const res = await fetch(href, { cache: "no-store" });
+      if (!res.ok) {
+        setState("error");
+        return;
+      }
+      const md = await res.text();
+      await navigator.clipboard.writeText(md);
+      setState("copied");
+      setTimeout(() => setState("idle"), 2000);
+    } catch {
+      setState("error");
+      setTimeout(() => setState("idle"), 3000);
+    }
+  }
+
+  return (
+    <button
+      className="btn"
+      onClick={onClick}
+      disabled={state === "loading"}
+      title="Copy the full report as Markdown — paste into another LLM"
+    >
+      {state === "loading"
+        ? "Copying…"
+        : state === "copied"
+          ? "Copied ✓"
+          : state === "error"
+            ? "Failed — retry"
+            : label}
+    </button>
+  );
+}