manifest 6.0.0 → 7.0.0

package/dist/index.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,19 +17,30 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
   VERSION: () => VERSION,
-  flush: () => flush,
   manifest: () => manifest
 });
 module.exports = __toCommonJS(index_exports);
 
-// src/runtime.ts
-var import_node_crypto = require("crypto");
+// src/http.ts
+var import_node_http = __toESM(require("http"), 1);
+var import_node_https = __toESM(require("https"), 1);
+var import_node_module = require("module");
+var import_node_stream = require("stream");
+var import_node_zlib = require("zlib");
 
 // src/wire.ts
 var secretNames = /* @__PURE__ */ new Set([
@@ -101,6 +114,118 @@ function parseJson(bytes) {
     return null;
   }
 }
+var unsafeFormKeys = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var arrayIndex = (value) => /^(0|[1-9]\d*)$/.test(value) && Number(value) <= 1e5;
+var formEncoded = (contentType) => contentType?.split(";", 1)[0]?.trim().toLowerCase() === "application/x-www-form-urlencoded";
+function formPath(key) {
+  const bracket = key.indexOf("[");
+  const root = bracket === -1 ? key : key.slice(0, bracket);
+  if (!root || root.includes("]")) return null;
+  const path = [root];
+  let offset = root.length;
+  while (offset < key.length) {
+    if (key[offset] !== "[") return null;
+    const end = key.indexOf("]", offset + 1);
+    if (end === -1) return null;
+    const part = key.slice(offset + 1, end);
+    if (part.includes("[")) return null;
+    path.push(part);
+    offset = end + 1;
+  }
+  return path.length <= 64 && path.every((part) => !unsafeFormKeys.has(part)) ? path : null;
+}
+function putFormValue(root, path, value) {
+  let current = root;
+  for (let index = 0; index < path.length; index++) {
+    const part = path[index];
+    const last = index === path.length - 1;
+    if (Array.isArray(current)) {
+      if (part !== "" && !arrayIndex(part)) return false;
+      const position = part === "" ? current.length : Number(part);
+      if (last) {
+        const existing3 = Object.hasOwn(current, position) ? current[position] : void 0;
+        if (existing3 === void 0) current[position] = value;
+        else if (typeof existing3 === "string") current[position] = [existing3, value];
+        else if (Array.isArray(existing3) && existing3.every((item) => typeof item === "string")) existing3.push(value);
+        else return false;
+        continue;
+      }
+      const next2 = path[index + 1];
+      const needsArray2 = next2 === "" || arrayIndex(next2);
+      const existing2 = Object.hasOwn(current, position) ? current[position] : void 0;
+      if (existing2 === void 0) current[position] = needsArray2 ? [] : {};
+      else if (typeof existing2 !== "object" || existing2 === null || Array.isArray(existing2) !== needsArray2) return false;
+      current = current[position];
+      continue;
+    }
+    if (!part) return false;
+    if (last) {
+      const existing2 = Object.hasOwn(current, part) ? current[part] : void 0;
+      if (existing2 === void 0) current[part] = value;
+      else if (typeof existing2 === "string") current[part] = [existing2, value];
+      else if (Array.isArray(existing2) && existing2.every((item) => typeof item === "string")) existing2.push(value);
+      else return false;
+      continue;
+    }
+    const next = path[index + 1];
+    const needsArray = next === "" || arrayIndex(next);
+    const existing = Object.hasOwn(current, part) ? current[part] : void 0;
+    if (existing === void 0) current[part] = needsArray ? [] : {};
+    else if (typeof existing !== "object" || existing === null || Array.isArray(existing) !== needsArray) return false;
+    current = current[part];
+  }
+  return true;
+}
+function parseForm(bytes) {
+  try {
+    const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    const body = {};
+    let fields = 0;
+    for (const pair of text.split("&")) {
+      if (!pair) continue;
+      if (++fields > 1e5) return { body: null, valid: false };
+      const separator = pair.indexOf("=");
+      const rawKey = separator === -1 ? pair : pair.slice(0, separator);
+      const rawValue = separator === -1 ? "" : pair.slice(separator + 1);
+      const key = decodeURIComponent(rawKey.replaceAll("+", " "));
+      const value = decodeURIComponent(rawValue.replaceAll("+", " "));
+      const path = formPath(key);
+      if (!path || !putFormValue(body, path, value)) return { body: null, valid: false };
+    }
+    return boundedJson(body) ? { body, valid: true } : { body: null, valid: false };
+  } catch {
+    return { body: null, valid: false };
+  }
+}
+function parseRequestBody(bytes, contentType) {
+  return formEncoded(contentType) ? parseForm(bytes) : { body: parseJson(bytes), valid: true };
+}
+function serializeRequestBody(body, contentType) {
+  if (!formEncoded(contentType)) return JSON.stringify(body);
+  if (!isObject(body)) throw new TypeError("Form body must be an object");
+  const params = new URLSearchParams();
+  let fields = 0;
+  const append = (value, key, depth) => {
+    if (++fields > 1e5 || depth > 64) throw new TypeError("Form body exceeds structural limits");
+    if (Array.isArray(value)) {
+      for (let index = 0; index < value.length; index++) {
+        if (Object.hasOwn(value, index)) append(value[index], `${key}[${index}]`, depth + 1);
+      }
+    } else if (isObject(value)) {
+      for (const [name, child] of Object.entries(value)) {
+        if (unsafeFormKeys.has(name)) throw new TypeError("Form body contains an unsafe key");
+        append(child, key ? `${key}[${name}]` : name, depth + 1);
+      }
+    } else if (value === null) params.append(key, "");
+    else if (typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) params.append(key, String(value));
+    else throw new TypeError("Form body contains an unsupported value");
+  };
+  for (const [key, value] of Object.entries(body)) {
+    if (unsafeFormKeys.has(key)) throw new TypeError("Form body contains an unsafe key");
+    append(value, key, 1);
+  }
+  return params.toString();
+}
 function errorBody(bytes) {
   const parsed = parseJson(bytes);
   const text = Buffer.from(bytes).toString("utf8");
@@ -146,7 +271,9 @@ async function captureRequest(request) {
   const reader = clone.body.getReader();
   try {
     const result = await prefix(reader, REQUEST_LIMIT, CAPTURE_MS);
-    return { body: result.complete ? parseJson(result.bytes) : null, complete: result.complete };
+    if (!result.complete) return { body: null, complete: false };
+    const parsed = parseRequestBody(result.bytes, request.headers.get("content-type"));
+    return { body: parsed.body, complete: parsed.valid };
   } finally {
     void reader.cancel().catch(() => {
     });
@@ -197,8 +324,11 @@ async function captureResponse(original, limit = RESPONSE_LIMIT, timeoutMs = CAP
   return { response, body: errorBody(captured.bytes), truncated: !captured.complete || Buffer.byteLength(Buffer.from(captured.bytes).toString("utf8")) > limit, complete: captured.complete };
 }
 
+// src/runtime.ts
+var import_node_crypto = require("crypto");
+
 // src/api.ts
-var VERSION = "6.0.0";
+var VERSION = "7.0.0";
 var warn = (message) => process.emitWarning(message, { code: "MNFST" });
 var HealApi = class {
   constructor(rawFetch, key, url, timeoutMs = 6e4, reportTimeoutMs = 5e3) {
@@ -215,6 +345,7 @@ var HealApi = class {
   reportTimeoutMs;
   disabledUntil = 0;
   inFlight = 0;
+  /** @internal In-flight outcome reports; exposed so tests can await delivery. */
   pending = /* @__PURE__ */ new Set();
   enabled() {
     return performance.now() >= this.disabledUntil;
@@ -296,23 +427,11 @@ var HealApi = class {
       clearTimeout(timer);
     }
   }
-  async flush(timeoutMs = 5e3) {
-    let timer;
-    try {
-      await Promise.race([
-        Promise.allSettled([...this.pending]),
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, Math.max(0, timeoutMs));
-        })
-      ]);
-    } finally {
-      clearTimeout(timer);
-    }
-  }
 };
 
 // src/runtime.ts
-var eligible = /* @__PURE__ */ new Set([400, 404, 422]);
+var forbidden = /* @__PURE__ */ new Set([401, 402, 403, 429]);
+var eligible = (status) => status >= 400 && status < 500 && !forbidden.has(status);
 var Runtime = class {
   constructor(options, original, api) {
     this.options = options;
@@ -331,9 +450,13 @@ var Runtime = class {
     const started = performance.now();
     const response = await this.original(request, extras);
     const responseTimeMs = performance.now() - started;
-    if (!eligible.has(response.status) || response.redirected || !this.api.enabled()) return response;
-    return this.repair(request, extras, response, await bodyPromise, responseTimeMs);
+    if (!eligible(response.status) || response.redirected || !this.api.enabled()) return response;
+    return this.handleResponse(request, response, await bodyPromise, responseTimeMs, extras);
   };
+  async handleResponse(request, response, body, responseTimeMs, extras = {}) {
+    if (!eligible(response.status) || response.redirected || !this.api.enabled()) return response;
+    return this.repair(request, extras, response, body, responseTimeMs);
+  }
   async repair(request, extras, original, body, responseTimeMs) {
     let response = original;
     let result = null;
@@ -407,6 +530,7 @@ function buildRetry(request, originalBody, result) {
     const url = new URL(healed.url ?? request.url);
     if (url.origin !== new URL(request.url).origin || url.username || url.password) return null;
     const headers = new Headers(request.headers);
+    const contentType = headers.get("content-type");
     headers.delete("content-length");
     if (healed.headers !== void 0 && !isObject(healed.headers)) return null;
     for (const [name, value] of Object.entries(healed.headers ?? {})) {
@@ -419,7 +543,7 @@ function buildRetry(request, originalBody, result) {
     return new Request(url, {
       method: request.method,
       headers,
-      body: ["GET", "HEAD"].includes(request.method) ? void 0 : JSON.stringify(body),
+      body: ["GET", "HEAD"].includes(request.method) ? void 0 : serializeRequestBody(body, contentType),
       signal: request.signal,
       redirect: request.redirect,
       credentials: request.credentials,
@@ -435,6 +559,170 @@ function buildRetry(request, originalBody, result) {
   }
 }
 
+// src/http.ts
+function installHttp(runtime) {
+  const httpRequest = wrapRequest(import_node_http.default.request, "http:", runtime);
+  const httpsRequest = wrapRequest(import_node_https.default.request, "https:", runtime);
+  import_node_http.default.request = httpRequest;
+  import_node_https.default.request = httpsRequest;
+  import_node_http.default.get = wrapGet(httpRequest);
+  import_node_https.default.get = wrapGet(httpsRequest);
+  (0, import_node_module.syncBuiltinESMExports)();
+}
+function wrapGet(request) {
+  return ((...args) => {
+    const result = request(...args);
+    result.end();
+    return result;
+  });
+}
+function wrapRequest(original, protocol, runtime) {
+  return ((...received) => {
+    const args = [...received];
+    const callback = typeof args.at(-1) === "function" ? args.pop() : void 0;
+    const started = performance.now();
+    const request = original(...args);
+    const capture = captureBody(request);
+    const signal = cancellation(request, requestSignal(args));
+    const emit = request.emit.bind(request);
+    request.emit = ((event, ...values) => {
+      if (event !== "response") return emit(event, ...values);
+      const response = values[0];
+      if (!eligible(response.statusCode ?? 0) || !runtime.api.enabled()) {
+        return emit(event, ...values);
+      }
+      void handleResponse(runtime, request, response, protocol, capture.body(), signal, started).then((healed) => emit("response", healed)).catch((error) => {
+        response.destroy();
+        if (!request.destroyed) request.destroy(error instanceof Error ? error : void 0);
+      });
+      return true;
+    });
+    if (callback) request.once("response", callback);
+    return request;
+  });
+}
+async function handleResponse(runtime, clientRequest, incoming, protocol, body, signal, started) {
+  const request = webRequest(clientRequest, protocol, body, signal);
+  const response = webResponse(incoming, request.url);
+  const healed = await runtime.handleResponse(request, response, body, performance.now() - started);
+  return incomingResponse(healed, clientRequest);
+}
+function webRequest(request, protocol, captured, signal) {
+  const headers = new Headers();
+  for (const name of request.getHeaderNames()) {
+    const value = request.getHeader(name);
+    for (const item of Array.isArray(value) ? value : [value]) {
+      if (item !== void 0) headers.append(name, String(item));
+    }
+  }
+  const authority = String(request.getHeader("host") ?? request.host);
+  const url = new URL(request.path, `${protocol}//${authority}`);
+  const method = request.method;
+  return new Request(url, {
+    method,
+    headers,
+    signal,
+    body: ["GET", "HEAD"].includes(method) || !captured.complete || captured.body === null ? void 0 : serializeRequestBody(captured.body, headers.get("content-type"))
+  });
+}
+function webResponse(response, url) {
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(response.headers)) {
+    for (const item of Array.isArray(value) ? value : [value]) {
+      if (item !== void 0) headers.append(name, String(item));
+    }
+  }
+  const encoding = headers.get("content-encoding")?.toLowerCase();
+  let body = response;
+  if (encoding === "gzip" || encoding === "x-gzip" || encoding === "deflate") {
+    body = response.pipe((0, import_node_zlib.createUnzip)());
+    headers.delete("content-encoding");
+    headers.delete("content-length");
+  } else if (encoding === "br") {
+    body = response.pipe((0, import_node_zlib.createBrotliDecompress)());
+    headers.delete("content-encoding");
+    headers.delete("content-length");
+  }
+  const converted = new Response(
+    import_node_stream.Readable.toWeb(body),
+    { status: response.statusCode, statusText: response.statusMessage, headers }
+  );
+  Object.defineProperty(converted, "url", { value: url });
+  return converted;
+}
+function incomingResponse(response, request) {
+  const stream = response.body ? import_node_stream.Readable.fromWeb(response.body) : import_node_stream.Readable.from([]);
+  const headers = {};
+  for (const [name, value] of response.headers) headers[name] = value;
+  if (["gzip", "x-gzip", "deflate", "br"].includes(String(headers["content-encoding"]).toLowerCase())) {
+    delete headers["content-encoding"];
+    delete headers["content-length"];
+  }
+  const cookies = response.headers.getSetCookie();
+  if (cookies.length) headers["set-cookie"] = cookies;
+  const rawHeaders = Object.entries(headers).flatMap(([name, value]) => (Array.isArray(value) ? value : [value]).flatMap((item) => item === void 0 ? [] : [name, String(item)]));
+  return Object.assign(stream, {
+    statusCode: response.status,
+    statusMessage: response.statusText,
+    headers,
+    rawHeaders,
+    trailers: {},
+    rawTrailers: [],
+    httpVersion: "1.1",
+    httpVersionMajor: 1,
+    httpVersionMinor: 1,
+    complete: true,
+    req: request
+  });
+}
+function captureBody(request) {
+  let chunks = [];
+  let size = 0;
+  let complete = true;
+  const record = (chunk, encoding) => {
+    if (chunk === void 0 || chunk === null || typeof chunk === "function" || !complete) return;
+    const bytes = typeof chunk === "string" ? Buffer.from(chunk, encoding) : Buffer.from(chunk);
+    size += bytes.byteLength;
+    if (size > REQUEST_LIMIT) {
+      complete = false;
+      chunks = [];
+      return;
+    }
+    chunks.push(bytes);
+  };
+  const write = request.write;
+  request.write = ((...args) => {
+    record(args[0], typeof args[1] === "string" ? args[1] : void 0);
+    return Reflect.apply(write, request, args);
+  });
+  const end = request.end;
+  request.end = ((...args) => {
+    record(args[0], typeof args[1] === "string" ? args[1] : void 0);
+    return Reflect.apply(end, request, args);
+  });
+  return { body: () => {
+    if (!complete) return { body: null, complete: false };
+    const header = request.getHeader("content-type");
+    const contentType = Array.isArray(header) ? header[0] : header === void 0 ? void 0 : String(header);
+    const parsed = parseRequestBody(Buffer.concat(chunks, size), contentType);
+    return { body: parsed.body, complete: parsed.valid };
+  } };
+}
+function requestSignal(args) {
+  for (const value of args.slice(0, 2)) {
+    if (value && typeof value === "object" && "signal" in value && value.signal instanceof AbortSignal) return value.signal;
+  }
+}
+function cancellation(request, external) {
+  const controller = new AbortController();
+  const destroy = request.destroy.bind(request);
+  request.destroy = ((error) => {
+    if (!controller.signal.aborted) controller.abort(error);
+    return destroy(error);
+  });
+  return external ? AbortSignal.any([external, controller.signal]) : controller.signal;
+}
+
 // src/index.ts
 var STATE = /* @__PURE__ */ Symbol.for("mnfst.node.runtime.v1");
 var globals = globalThis;
@@ -459,14 +747,11 @@ function manifest(options = {}) {
   }
   const runtime = new Runtime(resolved, globalThis.fetch.bind(globalThis));
   globalThis.fetch = runtime.fetch;
+  installHttp(runtime);
   globals[STATE] = runtime;
 }
-async function flush(options = {}) {
-  await globals[STATE]?.api.flush(options.timeoutMs ?? 5e3);
-}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   VERSION,
-  flush,
   manifest
 });

package/dist/index.d.cts

@@ -12,13 +12,9 @@ interface HealEvent {
     operations?: unknown[];
 }
 
-declare const VERSION = "6.0.0";
+declare const VERSION = "7.0.0";
 
 /** Install once, before libraries capture their own reference to global fetch. */
 declare function manifest(options?: ManifestOptions): void;
-/** Wait for queued outcome reports within one total deadline. Does not uninstall. */
-declare function flush(options?: {
-    timeoutMs?: number;
-}): Promise<void>;
 
-export { type HealEvent, type ManifestOptions, VERSION, flush, manifest };
+export { type HealEvent, type ManifestOptions, VERSION, manifest };

package/dist/index.d.ts

@@ -12,13 +12,9 @@ interface HealEvent {
     operations?: unknown[];
 }
 
-declare const VERSION = "6.0.0";
+declare const VERSION = "7.0.0";
 
 /** Install once, before libraries capture their own reference to global fetch. */
 declare function manifest(options?: ManifestOptions): void;
-/** Wait for queued outcome reports within one total deadline. Does not uninstall. */
-declare function flush(options?: {
-    timeoutMs?: number;
-}): Promise<void>;
 
-export { type HealEvent, type ManifestOptions, VERSION, flush, manifest };
+export { type HealEvent, type ManifestOptions, VERSION, manifest };