manifest 7.0.0 → 7.2.0

package/dist/index.cjs

@@ -81,6 +81,19 @@ function safeUrl(raw) {
   url.search = new URLSearchParams(pairs).toString();
   return url.toString();
 }
+function trackedUrl(raw) {
+  try {
+    const url = new URL(raw);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
 function safeHeaders(headers) {
   return Object.fromEntries([...headers].map(([key, value]) => [
     key,
@@ -328,7 +341,8 @@ async function captureResponse(original, limit = RESPONSE_LIMIT, timeoutMs = CAP
 var import_node_crypto = require("crypto");
 
 // src/api.ts
-var VERSION = "7.0.0";
+var VERSION = "7.2.0";
+var MAX_HEALS_IN_FLIGHT = 8;
 var warn = (message) => process.emitWarning(message, { code: "MNFST" });
 var HealApi = class {
   constructor(rawFetch, key, url, timeoutMs = 6e4, reportTimeoutMs = 5e3) {
@@ -350,16 +364,23 @@ var HealApi = class {
   enabled() {
     return performance.now() >= this.disabledUntil;
   }
+  /**
+   * Whether a heal call would be sent right now: the project is not disabled
+   * and a heal slot is free. A healable failure that cannot be sent is tracked
+   * instead, so it is never lost from both ledgers.
+   */
+  canHeal() {
+    return this.enabled() && this.inFlight < MAX_HEALS_IN_FLIGHT;
+  }
   headers() {
     return {
       authorization: `Bearer ${this.key}`,
       "content-type": "application/json",
-      "user-agent": `mnfst-node/${VERSION}`,
-      "x-mnfst-source": "node-sdk"
+      "user-agent": `mnfst-node/${VERSION}`
     };
   }
   async heal(capture, signal) {
-    if (!this.enabled() || this.inFlight >= 8) return null;
+    if (!this.canHeal()) return null;
     this.inFlight++;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
@@ -376,14 +397,20 @@ var HealApi = class {
         });
         return null;
       }
-      const captured = await captureResponse(response, 1048576, this.timeoutMs);
+      const captured = await captureResponse(
+        response,
+        1048576,
+        this.timeoutMs
+      );
       void captured.response.body?.cancel().catch(() => {
       });
-      if (!captured.complete || !isObject(captured.body) || !boundedJson(captured.body)) return null;
+      if (!captured.complete || !isObject(captured.body) || !boundedJson(captured.body))
+        return null;
       if (response.status === 403 && captured.body.error === "project_disabled") {
         this.disabledUntil = performance.now() + 3e5;
       }
-      if (response.status !== 200 || typeof captured.body.status !== "string") return null;
+      if (response.status !== 200 || typeof captured.body.status !== "string")
+        return null;
       return {
         status: captured.body.status,
         ...typeof captured.body.healAttemptId === "string" ? { healAttemptId: captured.body.healAttemptId } : {},
@@ -397,6 +424,72 @@ var HealApi = class {
       this.inFlight--;
     }
   }
+  /**
+   * Announce this install: "I am installed."
+   *
+   * Without it, a broken install and a healthy app look identical from the
+   * dashboard — both are silence. Four causes hide behind that silence (key
+   * unset, key invalid, app not restarted, SDK never loaded), and an app with
+   * no failing calls produces exactly the same nothing.
+   *
+   * Deliberately fire-and-forget and deliberately quiet. It carries no
+   * application data: the name and version ride in the user-agent this class
+   * already sends, so the body is the runtime and nothing else. A failure is
+   * not warned about — the dashboard showing "not connected" IS the signal,
+   * and an app that cannot reach Manifest must not print on every boot.
+   *
+   * Uses `rawFetch`, so the handshake cannot be intercepted by our own patch.
+   */
+  hello(runtime) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.reportTimeoutMs);
+    void this.rawFetch(new URL("v1/hello", this.url), {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify({ runtime }),
+      signal: controller.signal,
+      redirect: "error"
+    }).then((response) => {
+      void response.body?.cancel().catch(() => {
+      });
+    }).catch(() => {
+    }).finally(() => clearTimeout(timer));
+  }
+  /**
+   * Ship one batch of tracked calls to `POST /v1/requests`. Throws only when a
+   * retry could help (network error, timeout, 429, 5xx), so the buffer retries
+   * once; any other answer, including 404 from a backend that predates the
+   * route, drops the batch quietly. Uses `rawFetch`, so the send is never
+   * tracked or healed by our own patch.
+   */
+  async sendRequests(calls, signal) {
+    if (!this.enabled() || calls.length === 0) return;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.reportTimeoutMs);
+    try {
+      const response = await this.rawFetch(new URL("v1/requests", this.url), {
+        method: "POST",
+        headers: this.headers(),
+        body: JSON.stringify({ requests: calls }),
+        signal: signal ? AbortSignal.any([signal, controller.signal]) : controller.signal,
+        redirect: "error"
+      });
+      if (response.status === 403) {
+        const body = await response.json().catch(() => null);
+        if (isObject(body) && body.error === "project_disabled") {
+          this.disabledUntil = performance.now() + 3e5;
+        }
+        return;
+      }
+      void response.body?.cancel().catch(() => {
+      });
+      if (response.status === 429 || response.status >= 500) {
+        throw new Error(`tracked calls refused (${response.status})`);
+      }
+    } finally {
+      clearTimeout(timer);
+    }
+  }
   report(id, outcome) {
     if (!id) return;
     if (this.pending.size >= 64) {
@@ -411,16 +504,20 @@ var HealApi = class {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.reportTimeoutMs);
     try {
-      const response = await this.rawFetch(new URL(`v1/heal-attempts/${encodeURIComponent(id)}`, this.url), {
-        method: "PATCH",
-        headers: this.headers(),
-        body: JSON.stringify(outcome),
-        signal: controller.signal,
-        redirect: "error"
-      });
+      const response = await this.rawFetch(
+        new URL(`v1/heal-attempts/${encodeURIComponent(id)}`, this.url),
+        {
+          method: "PATCH",
+          headers: this.headers(),
+          body: JSON.stringify(outcome),
+          signal: controller.signal,
+          redirect: "error"
+        }
+      );
       void response.body?.cancel().catch(() => {
       });
-      if (!response.ok) warn("Outcome report rejected; attempt remains unconfirmed");
+      if (!response.ok)
+        warn("Outcome report rejected; attempt remains unconfirmed");
     } catch {
       warn("Outcome report failed; attempt remains unconfirmed");
     } finally {
@@ -429,28 +526,149 @@ var HealApi = class {
   }
 };
 
+// src/tracking.ts
+var MAX_BUFFER = 5e3;
+var MAX_BATCH = 500;
+var CallBuffer = class {
+  constructor(send, options = {}) {
+    this.send = send;
+    this.flushAt = options.flushAt ?? 500;
+    this.minGapMs = options.minGapMs ?? 1e3;
+    this.timer = setInterval(() => void this.kick(), options.intervalMs ?? 5e3);
+    this.timer.unref();
+  }
+  send;
+  queue = [];
+  inFlight = null;
+  lastSentAt = -Infinity;
+  /** Past this instant, nothing is retried or waited for, and a send in flight is aborted. */
+  deadline = Infinity;
+  controller = new AbortController();
+  timer;
+  flushAt;
+  minGapMs;
+  record(call) {
+    if (this.queue.length >= MAX_BUFFER) return;
+    this.queue.push(call);
+    if (this.queue.length >= this.flushAt) void this.kick();
+  }
+  size() {
+    return this.queue.length;
+  }
+  /** Resolves when the send in flight, if any, has settled. */
+  async idle() {
+    await this.inFlight;
+  }
+  /**
+   * Send everything buffered now, one batch at a time through the same
+   * in-flight guard as the timer. With `deadlineMs` (the exit path), it gives
+   * up at the deadline: the send in flight is aborted, nothing is retried, and
+   * what is left is dropped, so a script never hangs on an unreachable server.
+   */
+  async flush(deadlineMs = Infinity) {
+    this.deadline = performance.now() + deadlineMs;
+    const abortAt = Number.isFinite(deadlineMs) ? setTimeout(() => this.controller.abort(), deadlineMs) : null;
+    try {
+      while ((this.queue.length > 0 || this.inFlight) && performance.now() < this.deadline) {
+        await (this.inFlight ?? this.start());
+      }
+    } finally {
+      if (abortAt) clearTimeout(abortAt);
+      if (this.controller.signal.aborted) this.controller = new AbortController();
+      this.deadline = Infinity;
+    }
+  }
+  stop() {
+    clearInterval(this.timer);
+  }
+  kick() {
+    if (this.inFlight || this.queue.length === 0) return;
+    if (performance.now() - this.lastSentAt < this.minGapMs) return;
+    void this.start();
+  }
+  start() {
+    this.inFlight = this.sendOne().finally(() => {
+      this.inFlight = null;
+    });
+    return this.inFlight;
+  }
+  async sendOne() {
+    const batch = this.queue.splice(0, MAX_BATCH);
+    for (let attempt = 0; attempt < 2; attempt++) {
+      if (attempt > 0 && performance.now() >= this.deadline) return;
+      await this.waitForGap();
+      this.lastSentAt = performance.now();
+      try {
+        await this.send(batch, this.controller.signal);
+        return;
+      } catch {
+      }
+      if (this.controller.signal.aborted) {
+        this.controller = new AbortController();
+        return;
+      }
+    }
+  }
+  // Referenced on purpose: this wait only happens while a send or an exit
+  // flush is under way, and an unref'd wait would let the process exit with
+  // the batch unsent. It never outlasts the flush deadline.
+  async waitForGap() {
+    const wait = Math.min(this.lastSentAt + this.minGapMs, this.deadline) - performance.now();
+    if (wait > 0) await new Promise((resolve) => setTimeout(resolve, wait));
+  }
+};
+
 // src/runtime.ts
 var forbidden = /* @__PURE__ */ new Set([401, 402, 403, 429]);
+var bodyless = ["GET", "HEAD", "DELETE", "OPTIONS"];
+var neverBodied = (method) => method === "GET" || method === "HEAD";
 var eligible = (status) => status >= 400 && status < 500 && !forbidden.has(status);
 var Runtime = class {
   constructor(options, original, api) {
     this.options = options;
     this.original = original;
     this.api = api ?? new HealApi(original, options.key, options.url);
+    this.tracker = new CallBuffer((batch, signal) => this.api.sendRequests(batch, signal));
   }
   options;
   original;
   api;
+  /** Calls that did not go to `/v1/heal`, any status, on their way to `/v1/requests`. */
+  tracker;
+  /**
+   * Record a call that is not being healed. An in-memory append: never awaited,
+   * never throws, reads nothing of the response.
+   */
+  track(method, url, statusCode, startedAt, responseTimeMs) {
+    try {
+      const reported = trackedUrl(url());
+      const verb = method.toUpperCase();
+      if (!reported || reported.length > 4096 || !verb || verb.length > 16 || statusCode < 100 || statusCode > 599) return;
+      this.tracker.record({
+        traceId: (0, import_node_crypto.randomUUID)(),
+        method: verb,
+        url: reported,
+        statusCode,
+        responseTimeMs: Math.round(responseTimeMs),
+        occurredAt: new Date(startedAt).toISOString()
+      });
+    } catch {
+    }
+  }
   fetch = async (input, init) => {
     const request = new Request(input, init);
     const extras = { ...init };
     delete extras.body;
     delete extras.headers;
     const bodyPromise = captureRequest(request).catch(() => ({ body: null, complete: false }));
+    const startedAt = Date.now();
     const started = performance.now();
     const response = await this.original(request, extras);
     const responseTimeMs = performance.now() - started;
-    if (!eligible(response.status) || response.redirected || !this.api.enabled()) return response;
+    if (!eligible(response.status) || response.redirected || !this.api.canHeal()) {
+      this.track(request.method, () => request.url, response.status, startedAt, responseTimeMs);
+      return response;
+    }
     return this.handleResponse(request, response, await bodyPromise, responseTimeMs, extras);
   };
   async handleResponse(request, response, body, responseTimeMs, extras = {}) {
@@ -539,11 +757,11 @@ function buildRetry(request, originalBody, result) {
       else return null;
     }
     const body = Object.hasOwn(healed, "body") ? mergeBody(originalBody, healed.body) : originalBody;
-    if (body === null && !["GET", "HEAD"].includes(request.method)) return null;
+    if (body === null && !bodyless.includes(request.method)) return null;
     return new Request(url, {
       method: request.method,
       headers,
-      body: ["GET", "HEAD"].includes(request.method) ? void 0 : serializeRequestBody(body, contentType),
+      body: body === null || neverBodied(request.method) ? void 0 : serializeRequestBody(body, contentType),
       signal: request.signal,
       redirect: request.redirect,
       credentials: request.credentials,
@@ -580,6 +798,7 @@ function wrapRequest(original, protocol, runtime) {
   return ((...received) => {
     const args = [...received];
     const callback = typeof args.at(-1) === "function" ? args.pop() : void 0;
+    const startedAt = Date.now();
     const started = performance.now();
     const request = original(...args);
     const capture = captureBody(request);
@@ -588,7 +807,14 @@ function wrapRequest(original, protocol, runtime) {
     request.emit = ((event, ...values) => {
       if (event !== "response") return emit(event, ...values);
       const response = values[0];
-      if (!eligible(response.statusCode ?? 0) || !runtime.api.enabled()) {
+      if (!eligible(response.statusCode ?? 0) || !runtime.api.canHeal()) {
+        runtime.track(
+          request.method,
+          () => requestUrl(request, protocol).toString(),
+          response.statusCode ?? 0,
+          startedAt,
+          performance.now() - started
+        );
         return emit(event, ...values);
       }
       void handleResponse(runtime, request, response, protocol, capture.body(), signal, started).then((healed) => emit("response", healed)).catch((error) => {
@@ -607,6 +833,10 @@ async function handleResponse(runtime, clientRequest, incoming, protocol, body,
   const healed = await runtime.handleResponse(request, response, body, performance.now() - started);
   return incomingResponse(healed, clientRequest);
 }
+function requestUrl(request, protocol) {
+  const authority = String(request.getHeader("host") ?? request.host);
+  return new URL(request.path, `${protocol}//${authority}`);
+}
 function webRequest(request, protocol, captured, signal) {
   const headers = new Headers();
   for (const name of request.getHeaderNames()) {
@@ -615,8 +845,7 @@ function webRequest(request, protocol, captured, signal) {
       if (item !== void 0) headers.append(name, String(item));
     }
   }
-  const authority = String(request.getHeader("host") ?? request.host);
-  const url = new URL(request.path, `${protocol}//${authority}`);
+  const url = requestUrl(request, protocol);
   const method = request.method;
   return new Request(url, {
     method,
@@ -725,6 +954,7 @@ function cancellation(request, external) {
 
 // src/index.ts
 var STATE = /* @__PURE__ */ Symbol.for("mnfst.node.runtime.v1");
+var EXIT_FLUSH_MS = 2e3;
 var globals = globalThis;
 function manifest(options = {}) {
   const key = options.key || process.env.MNFST_KEY;
@@ -732,16 +962,22 @@ function manifest(options = {}) {
     warn("MNFST_KEY is not set; Manifest is disabled");
     return;
   }
-  const url = new URL(options.url || process.env.MNFST_URL || "https://api.manifest.build");
+  const url = new URL(
+    options.url || process.env.MNFST_URL || "https://api.manifest.build"
+  );
   if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
-    throw new TypeError("Manifest URL must be an HTTP(S) base URL without credentials, query or fragment");
+    throw new TypeError(
+      "Manifest URL must be an HTTP(S) base URL without credentials, query or fragment"
+    );
   }
   if (!url.pathname.endsWith("/")) url.pathname += "/";
   const resolved = { ...options, key, url: url.toString() };
   const existing = globals[STATE];
   if (existing) {
     if (existing.options.key !== key || existing.options.url !== resolved.url || existing.options.onHeal !== options.onHeal) {
-      warn("Manifest is already configured; changing configuration requires a process restart");
+      warn(
+        "Manifest is already configured; changing configuration requires a process restart"
+      );
     }
     return;
   }
@@ -749,6 +985,10 @@ function manifest(options = {}) {
   globalThis.fetch = runtime.fetch;
   installHttp(runtime);
   globals[STATE] = runtime;
+  runtime.api.hello(`node-${process.versions.node}`);
+  process.once("beforeExit", () => {
+    if (runtime.tracker.size() > 0) void runtime.tracker.flush(EXIT_FLUSH_MS);
+  });
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/index.d.cts

@@ -12,7 +12,7 @@ interface HealEvent {
     operations?: unknown[];
 }
 
-declare const VERSION = "7.0.0";
+declare const VERSION = "7.2.0";
 
 /** Install once, before libraries capture their own reference to global fetch. */
 declare function manifest(options?: ManifestOptions): void;

package/dist/index.d.ts

@@ -12,7 +12,7 @@ interface HealEvent {
     operations?: unknown[];
 }
 
-declare const VERSION = "7.0.0";
+declare const VERSION = "7.2.0";
 
 /** Install once, before libraries capture their own reference to global fetch. */
 declare function manifest(options?: ManifestOptions): void;

package/dist/index.js

@@ -1,7 +1,9 @@
 import {
-  VERSION,
   manifest
-} from "./chunk-DP2C4E42.js";
+} from "./chunk-GC5H22R2.js";
+import {
+  VERSION
+} from "./chunk-NHEF7GUP.js";
 export {
   VERSION,
   manifest