manifest 5.45.0 → 6.0.0

package/dist/index.js

@@ -1,12 +1,443 @@
-/* manifest-local — OpenClaw Self-Hosted LLM Router */
-"use strict";var f=require("fs"),l=require("path"),g=require("os"),u=(0,l.join)((0,g.homedir)(),".openclaw","manifest"),h=3e3;async function d(i,t){try{let e=await fetch(`http://${i}:${t}/api/v1/health`,{signal:AbortSignal.timeout(h)});if(!e.ok)return!1;let n=await e.json();return n!==null&&typeof n=="object"&&"status"in n&&n.status==="healthy"}catch{return!1}}function m(i,t,e,n){(0,f.existsSync)(u)||(0,f.mkdirSync)(u,{recursive:!0,mode:448});let a=(0,l.join)(u,"manifest.db");n.debug("[manifest] Starting embedded server...");let o;try{o=require("./server")}catch(r){let s=r instanceof Error?r.message:String(r);n.error(`[manifest] Failed to load embedded server.
-  Error: ${s}
-  This is a packaging error \u2014 please reinstall the manifest plugin.`);return}i.registerService({id:"manifest",start:async()=>{if(n.debug("[manifest] Service start callback invoked"),await d(e,t)){n.info(`[manifest] Reusing existing server at http://${e}:${t}`);return}try{await o.start({port:t,host:e,dbPath:a,quiet:!0}),await d(e,t)?(n.info(`[manifest] Dashboard -> http://${e}:${t}`),n.info(`[manifest]   DB: ${a}`)):(n.warn??n.info)(`[manifest] Server started but health check failed.
-  The dashboard may not be accessible at http://${e}:${t}`)}catch(s){let c=s instanceof Error?s.message:String(s);c.includes("EADDRINUSE")||c.includes("address already in use")?await d(e,t)?n.info(`[manifest] Reusing existing server at http://${e}:${t}`):n.error(`[manifest] Port ${t} is already in use by another process.
-  Change it with: openclaw config set plugins.entries.manifest.config.port ${t+1}
-  Then restart the gateway.`):n.error(`[manifest] Failed to start local server: ${c}
-  Try reinstalling: openclaw plugins install manifest
-  Then restart: openclaw gateway restart`)}}})}module.exports={id:"manifest",name:"Manifest Self-Hosted LLM Router",register(i){let t=i.logger||{info:(...r)=>console.log(...r),debug:()=>{},error:(...r)=>console.error(...r),warn:(...r)=>console.warn(...r)},e=i.pluginConfig||{},n=e&&typeof e=="object"&&"config"in e&&e.config!=null&&typeof e.config=="object"?e.config:e,a=typeof n.port=="number"&&n.port>0?n.port:2099,o=typeof n.host=="string"&&n.host.length>0?n.host:"127.0.0.1";t.info(`
-[\u{1F99A} Manifest] Dashboard: http://${o}:${a}
-[\u{1F99A} Manifest] The plugin starts an embedded server.
-[\u{1F99A} Manifest] Open the dashboard to connect a provider and start routing.`),m(i,a,o,t)}};
+// src/runtime.ts
+import { randomUUID } from "crypto";
+
+// src/wire.ts
+var secretNames = /* @__PURE__ */ new Set([
+  "api_key",
+  "apikey",
+  "api_token",
+  "key",
+  "token",
+  "access_token",
+  "refresh_token",
+  "auth",
+  "authorization",
+  "signature",
+  "sig",
+  "secret",
+  "client_secret",
+  "password",
+  "session",
+  "session_id",
+  "bearer",
+  "jwt",
+  "id_token",
+  "auth_token",
+  "pwd",
+  "passwd",
+  "private_key"
+]);
+var roots = ["auth", "key", "token", "secret", "session", "password", "passwd", "cookie", "signature", "credential", "bearer", "jwt"];
+var normalize = (name) => name.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replaceAll("-", "_").toLowerCase().replace(/^x_/, "");
+var isSecret = (name) => secretNames.has(normalize(name));
+var isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+function safeUrl(raw) {
+  const url = new URL(raw);
+  url.username = "";
+  url.password = "";
+  url.hash = "";
+  const pairs = [...url.searchParams].map(([key, value]) => [key, isSecret(key) ? "REDACTED" : value]);
+  url.search = new URLSearchParams(pairs).toString();
+  return url.toString();
+}
+function safeHeaders(headers) {
+  return Object.fromEntries([...headers].map(([key, value]) => [
+    key,
+    isSecret(key) || roots.some((root) => normalize(key).includes(root)) ? "REDACTED" : value.slice(0, 1024)
+  ]));
+}
+function travelingBody(body) {
+  return isObject(body) ? Object.fromEntries(Object.entries(body).filter(([key]) => !isSecret(key))) : body;
+}
+function mergeBody(original, healed) {
+  if (!isObject(original) || !isObject(healed)) return healed;
+  return { ...Object.fromEntries(Object.entries(original).filter(([key]) => isSecret(key) && !Object.hasOwn(healed, key))), ...healed };
+}
+function boundedJson(value) {
+  const stack = [[value, 0]];
+  let count = 0;
+  while (stack.length) {
+    const [item, depth] = stack.pop();
+    if (++count > 1e5 || depth > 64) return false;
+    if (item !== null && typeof item === "object") {
+      for (const child of Object.values(item)) stack.push([child, depth + 1]);
+    }
+  }
+  return true;
+}
+function parseJson(bytes) {
+  try {
+    const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    return boundedJson(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function errorBody(bytes) {
+  const parsed = parseJson(bytes);
+  const text = Buffer.from(bytes).toString("utf8");
+  return parsed ?? new TextDecoder().decode(Buffer.from(text).subarray(0, 65536), { stream: true });
+}
+var TRANSPORT_ERROR = "Upstream retry failed before an HTTP response";
+
+// src/capture.ts
+var REQUEST_LIMIT = 262144;
+var RESPONSE_LIMIT = 65536;
+var CAPTURE_MS = 1e3;
+async function prefix(reader, limit, timeoutMs) {
+  const chunks = [];
+  let size = 0;
+  let pending;
+  let timer;
+  const deadline = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(null), timeoutMs);
+  });
+  let complete = false;
+  try {
+    while (size <= limit) {
+      pending = reader.read();
+      const read = await Promise.race([pending, deadline]);
+      if (read === null) break;
+      pending = void 0;
+      if (read.done) {
+        complete = true;
+        break;
+      }
+      chunks.push(read.value);
+      size += read.value.byteLength;
+    }
+  } catch {
+  } finally {
+    clearTimeout(timer);
+  }
+  return { chunks, complete, pending, bytes: Buffer.concat(chunks, size).subarray(0, limit) };
+}
+async function captureRequest(request) {
+  if (!request.body) return { body: null, complete: true };
+  const clone = request.clone();
+  const reader = clone.body.getReader();
+  try {
+    const result = await prefix(reader, REQUEST_LIMIT, CAPTURE_MS);
+    return { body: result.complete ? parseJson(result.bytes) : null, complete: result.complete };
+  } finally {
+    void reader.cancel().catch(() => {
+    });
+  }
+}
+function metadata(response, original) {
+  const clone = response.clone.bind(response);
+  Object.defineProperties(response, {
+    url: { value: original.url },
+    redirected: { value: original.redirected },
+    type: { value: original.type },
+    clone: { value: () => metadata(clone(), original) }
+  });
+  return response;
+}
+async function captureResponse(original, limit = RESPONSE_LIMIT, timeoutMs = CAPTURE_MS) {
+  if (!original.body) return { response: original, body: null, truncated: false, complete: true };
+  const reader = original.body.getReader();
+  const captured = await prefix(reader, limit, timeoutMs);
+  let index = 0;
+  let pending = captured.pending;
+  const stream = new ReadableStream({
+    async pull(controller) {
+      try {
+        if (index < captured.chunks.length) {
+          controller.enqueue(captured.chunks[index++]);
+          return;
+        }
+        const read = await (pending ?? reader.read());
+        pending = void 0;
+        if (read.done) {
+          reader.releaseLock();
+          controller.close();
+        } else controller.enqueue(read.value);
+      } catch (error) {
+        controller.error(error);
+      }
+    },
+    async cancel(reason) {
+      await reader.cancel(reason);
+    }
+  }, { highWaterMark: 0 });
+  const response = metadata(new Response(stream, {
+    status: original.status,
+    statusText: original.statusText,
+    headers: original.headers
+  }), original);
+  return { response, body: errorBody(captured.bytes), truncated: !captured.complete || Buffer.byteLength(Buffer.from(captured.bytes).toString("utf8")) > limit, complete: captured.complete };
+}
+
+// src/api.ts
+var VERSION = "6.0.0";
+var warn = (message) => process.emitWarning(message, { code: "MNFST" });
+var HealApi = class {
+  constructor(rawFetch, key, url, timeoutMs = 6e4, reportTimeoutMs = 5e3) {
+    this.rawFetch = rawFetch;
+    this.key = key;
+    this.url = url;
+    this.timeoutMs = timeoutMs;
+    this.reportTimeoutMs = reportTimeoutMs;
+  }
+  rawFetch;
+  key;
+  url;
+  timeoutMs;
+  reportTimeoutMs;
+  disabledUntil = 0;
+  inFlight = 0;
+  pending = /* @__PURE__ */ new Set();
+  enabled() {
+    return performance.now() >= this.disabledUntil;
+  }
+  headers() {
+    return {
+      authorization: `Bearer ${this.key}`,
+      "content-type": "application/json",
+      "user-agent": `mnfst-node/${VERSION}`,
+      "x-mnfst-source": "node-sdk"
+    };
+  }
+  async heal(capture, signal) {
+    if (!this.enabled() || this.inFlight >= 8) return null;
+    this.inFlight++;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    try {
+      const response = await this.rawFetch(new URL("v1/heal", this.url), {
+        method: "POST",
+        headers: this.headers(),
+        body: JSON.stringify(capture),
+        signal: AbortSignal.any([signal, controller.signal]),
+        redirect: "error"
+      });
+      if (response.status !== 200 && response.status !== 403) {
+        void response.body?.cancel().catch(() => {
+        });
+        return null;
+      }
+      const captured = await captureResponse(response, 1048576, this.timeoutMs);
+      void captured.response.body?.cancel().catch(() => {
+      });
+      if (!captured.complete || !isObject(captured.body) || !boundedJson(captured.body)) return null;
+      if (response.status === 403 && captured.body.error === "project_disabled") {
+        this.disabledUntil = performance.now() + 3e5;
+      }
+      if (response.status !== 200 || typeof captured.body.status !== "string") return null;
+      return {
+        status: captured.body.status,
+        ...typeof captured.body.healAttemptId === "string" ? { healAttemptId: captured.body.healAttemptId } : {},
+        ...Array.isArray(captured.body.operations) ? { operations: captured.body.operations } : {},
+        ...isObject(captured.body.healedRequest) ? { healedRequest: captured.body.healedRequest } : {}
+      };
+    } catch {
+      return null;
+    } finally {
+      clearTimeout(timer);
+      this.inFlight--;
+    }
+  }
+  report(id, outcome) {
+    if (!id) return;
+    if (this.pending.size >= 64) {
+      warn("Outcome report capacity reached; report dropped");
+      return;
+    }
+    const promise = this.send(id, outcome);
+    this.pending.add(promise);
+    void promise.then(() => this.pending.delete(promise));
+  }
+  async send(id, outcome) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.reportTimeoutMs);
+    try {
+      const response = await this.rawFetch(new URL(`v1/heal-attempts/${encodeURIComponent(id)}`, this.url), {
+        method: "PATCH",
+        headers: this.headers(),
+        body: JSON.stringify(outcome),
+        signal: controller.signal,
+        redirect: "error"
+      });
+      void response.body?.cancel().catch(() => {
+      });
+      if (!response.ok) warn("Outcome report rejected; attempt remains unconfirmed");
+    } catch {
+      warn("Outcome report failed; attempt remains unconfirmed");
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async flush(timeoutMs = 5e3) {
+    let timer;
+    try {
+      await Promise.race([
+        Promise.allSettled([...this.pending]),
+        new Promise((resolve) => {
+          timer = setTimeout(resolve, Math.max(0, timeoutMs));
+        })
+      ]);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+};
+
+// src/runtime.ts
+var eligible = /* @__PURE__ */ new Set([400, 404, 422]);
+var Runtime = class {
+  constructor(options, original, api) {
+    this.options = options;
+    this.original = original;
+    this.api = api ?? new HealApi(original, options.key, options.url);
+  }
+  options;
+  original;
+  api;
+  fetch = async (input, init) => {
+    const request = new Request(input, init);
+    const extras = { ...init };
+    delete extras.body;
+    delete extras.headers;
+    const bodyPromise = captureRequest(request).catch(() => ({ body: null, complete: false }));
+    const started = performance.now();
+    const response = await this.original(request, extras);
+    const responseTimeMs = performance.now() - started;
+    if (!eligible.has(response.status) || response.redirected || !this.api.enabled()) return response;
+    return this.repair(request, extras, response, await bodyPromise, responseTimeMs);
+  };
+  async repair(request, extras, original, body, responseTimeMs) {
+    let response = original;
+    let result = null;
+    const started = performance.now();
+    let replayStatusCode = null;
+    let replayAttempted = false;
+    try {
+      const captured = await captureResponse(response);
+      response = captured.response;
+      const payload = {
+        traceId: randomUUID(),
+        request: { method: request.method, url: safeUrl(request.url), headers: safeHeaders(request.headers), body: travelingBody(body.body) },
+        response: { statusCode: response.status, body: captured.body, truncated: captured.truncated },
+        responseTimeMs: Math.round(responseTimeMs)
+      };
+      request.signal.throwIfAborted();
+      result = await this.api.heal(payload, request.signal);
+      request.signal.throwIfAborted();
+      const retry = body.complete && captured.complete ? buildRetry(request, body.body, result) : null;
+      if (!retry) {
+        this.api.report(result?.healAttemptId, { failure: { kind: "not_attempted", message: "replay_not_attempted" } });
+        return response;
+      }
+      replayAttempted = true;
+      let retried;
+      try {
+        retried = await this.original(retry, extras);
+      } catch {
+        this.api.report(result?.healAttemptId, { failure: { kind: "transport_error", message: TRANSPORT_ERROR } });
+        request.signal.throwIfAborted();
+        return response;
+      }
+      replayStatusCode = retried.status;
+      if (retried.status >= 400) {
+        const capturedRetry = await captureResponse(retried);
+        retried = capturedRetry.response;
+        this.api.report(result?.healAttemptId, { response: { statusCode: retried.status, body: capturedRetry.body, truncated: capturedRetry.truncated } });
+      } else {
+        this.api.report(result?.healAttemptId, { response: { statusCode: retried.status } });
+      }
+      void response.body?.cancel().catch(() => {
+      });
+      return retried;
+    } catch {
+      request.signal.throwIfAborted();
+      this.api.report(result?.healAttemptId, { failure: { kind: "not_attempted", message: "replay_not_attempted" } });
+      return response;
+    } finally {
+      if (this.options.onHeal) {
+        try {
+          void Promise.resolve(this.options.onHeal({
+            url: safeUrl(request.url),
+            statusCode: original.status,
+            healStatus: replayAttempted && replayStatusCode === null ? "replay_failed" : result?.status ?? "heal_unreachable",
+            replayStatusCode,
+            healMs: Math.round(performance.now() - started),
+            operations: result?.operations
+          })).catch(() => warn("onHeal callback failed"));
+        } catch {
+          warn("onHeal callback failed");
+        }
+      }
+    }
+  }
+};
+function buildRetry(request, originalBody, result) {
+  if (!result || !["patched", "unverified"].includes(result.status) || !isObject(result.healedRequest)) return null;
+  const healed = result.healedRequest;
+  if (!["url", "headers", "body"].some((key) => Object.hasOwn(healed, key))) return null;
+  try {
+    const url = new URL(healed.url ?? request.url);
+    if (url.origin !== new URL(request.url).origin || url.username || url.password) return null;
+    const headers = new Headers(request.headers);
+    headers.delete("content-length");
+    if (healed.headers !== void 0 && !isObject(healed.headers)) return null;
+    for (const [name, value] of Object.entries(healed.headers ?? {})) {
+      if (value === null) headers.delete(name);
+      else if (typeof value === "string") headers.set(name, value);
+      else return null;
+    }
+    const body = Object.hasOwn(healed, "body") ? mergeBody(originalBody, healed.body) : originalBody;
+    if (body === null && !["GET", "HEAD"].includes(request.method)) return null;
+    return new Request(url, {
+      method: request.method,
+      headers,
+      body: ["GET", "HEAD"].includes(request.method) ? void 0 : JSON.stringify(body),
+      signal: request.signal,
+      redirect: request.redirect,
+      credentials: request.credentials,
+      cache: request.cache,
+      integrity: request.integrity,
+      keepalive: request.keepalive,
+      mode: request.mode,
+      referrer: request.referrer,
+      referrerPolicy: request.referrerPolicy
+    });
+  } catch {
+    return null;
+  }
+}
+
+// src/index.ts
+var STATE = /* @__PURE__ */ Symbol.for("mnfst.node.runtime.v1");
+var globals = globalThis;
+function manifest(options = {}) {
+  const key = options.key || process.env.MNFST_KEY;
+  if (!key) {
+    warn("MNFST_KEY is not set; Manifest is disabled");
+    return;
+  }
+  const url = new URL(options.url || process.env.MNFST_URL || "https://api.manifest.build");
+  if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
+    throw new TypeError("Manifest URL must be an HTTP(S) base URL without credentials, query or fragment");
+  }
+  if (!url.pathname.endsWith("/")) url.pathname += "/";
+  const resolved = { ...options, key, url: url.toString() };
+  const existing = globals[STATE];
+  if (existing) {
+    if (existing.options.key !== key || existing.options.url !== resolved.url || existing.options.onHeal !== options.onHeal) {
+      warn("Manifest is already configured; changing configuration requires a process restart");
+    }
+    return;
+  }
+  const runtime = new Runtime(resolved, globalThis.fetch.bind(globalThis));
+  globalThis.fetch = runtime.fetch;
+  globals[STATE] = runtime;
+}
+async function flush(options = {}) {
+  await globals[STATE]?.api.flush(options.timeoutMs ?? 5e3);
+}
+export {
+  VERSION,
+  flush,
+  manifest
+};

package/docs/guide.md

@@ -0,0 +1,77 @@
+# SDK guide
+
+[← Quick start](../README.md)
+
+## Configuration
+
+Call `manifest()` once at startup, before other libraries save a reference to `fetch`.
+
+| Option | Environment | Default |
+| --- | --- | --- |
+| `key` | `MNFST_KEY` | Disabled with a warning if missing |
+| `url` | `MNFST_URL` | `https://api.manifest.build` |
+| `onHeal` | — | Optional local callback |
+
+Explicit options take precedence. Reconfiguration requires a restart. ESM and CommonJS imports share one process-wide installation.
+
+```ts
+manifest({
+  url: 'http://127.0.0.1:5310',
+  onHeal(event) {
+    console.log(event.healStatus, event.replayStatusCode);
+  },
+});
+```
+
+`onHeal` receives `url`, `statusCode`, `healStatus`, `replayStatusCode`, `healMs` and optional `operations`. URLs have known credential query fields masked. Callback errors do not fail application requests.
+
+## Supported traffic
+
+- Built-in global `fetch`, including `Request` inputs and libraries that call global fetch after installation.
+- Failures after automatic redirects pass through: the original method/body may not describe the failing hop.
+- Captures HTTP 400, 404 and 422. Other statuses and network failures before an HTTP response pass through.
+- Generic JSON APIs, including LLM APIs. No provider-specific request format is required.
+- One retry per capture. Same-origin URL and header repairs are supported by the SDK; the current app returns JSON body repairs.
+- Successful calls and successful retries remain streamed. Failed responses retain their bytes, status, headers, URL and redirect metadata.
+
+**Not covered:** browser JavaScript, `node:http`/`node:https`, the default Axios HTTP adapter, directly imported `undici.fetch`/`node-fetch`, and fetch references saved before initialization. Those transports need separate integration. This SDK does not claim to intercept every Node HTTP client.
+
+## Limits and failure behavior
+
+- Request capture is bounded to 256 KiB and JSON depth 64. It tees the upload alongside the original call, reading for at most one second. Oversized or slow uploads travel as `null` and are not retried.
+- Error capture reads at most 64 KiB plus one transport chunk, within one second. The prefix and remaining stream are preserved for the caller. Incomplete errors are reported without retry. One unusually large transport chunk can exceed that memory estimate.
+- The Manifest heal call has a 60-second deadline and at most eight concurrent requests. Capacity exhaustion and service errors return the original API error response.
+- Caller abort signals apply during healing and retry; cancellation remains observable to the caller.
+- A transport failure on retry returns the original error response and reports inconclusive evidence. If the retry returns another HTTP error, its raw body is reported so the app can distinguish recurrence from a new issue.
+- Automatic retries can repeat side effects. Use APIs with safe retry semantics and caller-managed idempotency keys; these headers are preserved unless explicitly changed by a repair.
+- A disabled project's HTTP 403 response suppresses healing for five minutes.
+
+Outcome reports are best effort, limited to 64 concurrent requests with five-second deadlines. Failures and drops emit Node warnings with code `MNFST`. Before a short-lived process exits, flush reports explicitly:
+
+```ts
+import { flush } from 'manifest';
+await flush({ timeoutMs: 5000 });
+```
+
+`flush` waits within one total deadline; it does not uninstall the SDK or guarantee delivery. Abrupt termination can lose reports.
+
+## Data sent to Manifest
+
+Failed URLs, request headers, JSON bodies and raw error responses go to the configured server. Known credential names in query parameters and headers are masked; credential-named top-level request body fields are withheld and restored on retry. Exception prose is not sent for transport failures.
+
+This is not general secret detection: nested fields, arbitrary secret names, business data and response bodies may contain sensitive information. Enable it only for traffic you permit Manifest to process and store. The SDK makes the actual retry locally.
+
+## Development
+
+```sh
+npm ci
+npm run typecheck
+npm test
+npm pack
+# Optional: creates a synthetic customer/project in a disposable app.
+MNFST_TEST_APP_URL=http://127.0.0.1:5310 npm run test:live
+```
+
+CI runs Node 22, 24 and 26, checks both declaration formats, and installs the packed artifact. The live app test runs locally because cross-repository CI access to the private app is not configured.
+
+Deploy the outcome contract in [app PR #3](https://github.com/mnfst/app/pull/3) before using this SDK. See [CONTRACT.md](../CONTRACT.md) for the shared Python/Node wire protocol.

package/package.json

@@ -1,93 +1,50 @@
 {
   "name": "manifest",
-  "version": "5.45.0",
-  "description": "Self-hosted Manifest LLM router with embedded server, SQLite database, and dashboard",
-  "main": "dist/index.js",
-  "license": "MIT",
-  "author": "MNFST Inc.",
-  "homepage": "https://manifest.build",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/mnfst/manifest",
-    "directory": "packages/openclaw-plugins/manifest"
-  },
-  "bugs": {
-    "url": "https://github.com/mnfst/manifest/issues"
+  "version": "6.0.0",
+  "description": "Repair eligible failed JSON API calls made with Node fetch.",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
   },
   "files": [
-    "dist/index.js",
-    "dist/server.js",
-    "dist/server.d.ts",
-    "dist/backend",
-    "dist/package.json",
-    "dist/node_modules",
-    "public",
-    "openclaw.plugin.json",
+    "dist",
     "README.md",
-    "LICENSE.md"
+    "CONTRACT.md",
+    "docs"
   ],
-  "openclaw": {
-    "extensions": [
-      "./dist/index.js"
-    ]
-  },
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=22"
   },
   "scripts": {
-    "prebuild": "rm -rf dist public",
-    "build": "tsx build.ts && tsc -p tsconfig.server.json && node scripts/copy-assets.js",
-    "prepublishOnly": "npm run build && cp ../../../README.md README.md",
+    "build": "tsup src/index.ts --format esm,cjs --dts --clean",
     "typecheck": "tsc --noEmit",
-    "test": "jest"
-  },
-  "keywords": [
-    "openclaw",
-    "openclaw-plugin",
-    "manifest",
-    "manifest-local",
-    "llm-router",
-    "self-hosted",
-    "local-first",
-    "sqlite",
-    "ai-dashboard",
-    "embedded-server"
-  ],
-  "dependencies": {
-    "@nestjs/cache-manager": "^3.1.0",
-    "@nestjs/common": "^11.0.0",
-    "@nestjs/config": "^4.0.0",
-    "@nestjs/core": "^11.0.0",
-    "@nestjs/platform-express": "^11.0.0",
-    "@nestjs/schedule": "^6.1.1",
-    "@nestjs/serve-static": "^5.0.4",
-    "@nestjs/throttler": "^6.0.0",
-    "@nestjs/typeorm": "^11.0.0",
-    "@react-email/components": "^1.0.7",
-    "@react-email/render": "^2.0.4",
-    "better-auth": "^1.4.18",
-    "cache-manager": "^7.2.8",
-    "class-transformer": "^0.5.1",
-    "class-validator": "^0.14.0",
-    "compression": "^1.8.1",
-    "express-rate-limit": "^8.3.1",
-    "helmet": "^8.1.0",
-    "pg": "^8.13.0",
-    "protobufjs": "^8.0.0",
-    "react": "^19.2.4",
-    "react-dom": "^19.2.4",
-    "reflect-metadata": "^0.2.0",
-    "rxjs": "^7.8.0",
-    "sql.js": "^1.12.0",
-    "typeorm": "^0.3.0",
-    "uuid": "^11.0.0"
+    "test": "tsx --test tests/*.test.ts",
+    "test:live": "tsx --test tests/live.test.ts",
+    "prepare": "npm run build"
   },
   "devDependencies": {
-    "esbuild": "^0.25.0",
-    "tsx": "^4.19.0",
-    "typescript": "^5.7.0",
-    "@types/jest": "^29.5.0",
-    "jest": "^29.7.0",
-    "ts-jest": "^29.2.0"
+    "@types/node": "^22.0.0",
+    "tsup": "^8.5.0",
+    "tsx": "^4.20.0",
+    "typescript": "^5.9.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mnfst/manifest-node.git"
+  },
+  "overrides": {
+    "esbuild": "^0.28.2"
   }
 }