manifest 7.0.0 → 7.2.0

package/dist/register.cjs

@@ -68,6 +68,19 @@ function safeUrl(raw) {
   url.search = new URLSearchParams(pairs).toString();
   return url.toString();
 }
+function trackedUrl(raw) {
+  try {
+    const url = new URL(raw);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
 function safeHeaders(headers) {
   return Object.fromEntries([...headers].map(([key, value]) => [
     key,
@@ -315,7 +328,8 @@ async function captureResponse(original, limit = RESPONSE_LIMIT, timeoutMs = CAP
 var import_node_crypto = require("crypto");
 
 // src/api.ts
-var VERSION = "7.0.0";
+var VERSION = "7.2.0";
+var MAX_HEALS_IN_FLIGHT = 8;
 var warn = (message) => process.emitWarning(message, { code: "MNFST" });
 var HealApi = class {
   constructor(rawFetch, key, url, timeoutMs = 6e4, reportTimeoutMs = 5e3) {
@@ -337,16 +351,23 @@ var HealApi = class {
   enabled() {
     return performance.now() >= this.disabledUntil;
   }
+  /**
+   * Whether a heal call would be sent right now: the project is not disabled
+   * and a heal slot is free. A healable failure that cannot be sent is tracked
+   * instead, so it is never lost from both ledgers.
+   */
+  canHeal() {
+    return this.enabled() && this.inFlight < MAX_HEALS_IN_FLIGHT;
+  }
   headers() {
     return {
       authorization: `Bearer ${this.key}`,
       "content-type": "application/json",
-      "user-agent": `mnfst-node/${VERSION}`,
-      "x-mnfst-source": "node-sdk"
+      "user-agent": `mnfst-node/${VERSION}`
     };
   }
   async heal(capture, signal) {
-    if (!this.enabled() || this.inFlight >= 8) return null;
+    if (!this.canHeal()) return null;
     this.inFlight++;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
@@ -363,14 +384,20 @@ var HealApi = class {
         });
         return null;
       }
-      const captured = await captureResponse(response, 1048576, this.timeoutMs);
+      const captured = await captureResponse(
+        response,
+        1048576,
+        this.timeoutMs
+      );
       void captured.response.body?.cancel().catch(() => {
       });
-      if (!captured.complete || !isObject(captured.body) || !boundedJson(captured.body)) return null;
+      if (!captured.complete || !isObject(captured.body) || !boundedJson(captured.body))
+        return null;
       if (response.status === 403 && captured.body.error === "project_disabled") {
         this.disabledUntil = performance.now() + 3e5;
       }
-      if (response.status !== 200 || typeof captured.body.status !== "string") return null;
+      if (response.status !== 200 || typeof captured.body.status !== "string")
+        return null;
       return {
         status: captured.body.status,
         ...typeof captured.body.healAttemptId === "string" ? { healAttemptId: captured.body.healAttemptId } : {},
@@ -384,6 +411,72 @@ var HealApi = class {
       this.inFlight--;
     }
   }
+  /**
+   * Announce this install: "I am installed."
+   *
+   * Without it, a broken install and a healthy app look identical from the
+   * dashboard — both are silence. Four causes hide behind that silence (key
+   * unset, key invalid, app not restarted, SDK never loaded), and an app with
+   * no failing calls produces exactly the same nothing.
+   *
+   * Deliberately fire-and-forget and deliberately quiet. It carries no
+   * application data: the name and version ride in the user-agent this class
+   * already sends, so the body is the runtime and nothing else. A failure is
+   * not warned about — the dashboard showing "not connected" IS the signal,
+   * and an app that cannot reach Manifest must not print on every boot.
+   *
+   * Uses `rawFetch`, so the handshake cannot be intercepted by our own patch.
+   */
+  hello(runtime) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.reportTimeoutMs);
+    void this.rawFetch(new URL("v1/hello", this.url), {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify({ runtime }),
+      signal: controller.signal,
+      redirect: "error"
+    }).then((response) => {
+      void response.body?.cancel().catch(() => {
+      });
+    }).catch(() => {
+    }).finally(() => clearTimeout(timer));
+  }
+  /**
+   * Ship one batch of tracked calls to `POST /v1/requests`. Throws only when a
+   * retry could help (network error, timeout, 429, 5xx), so the buffer retries
+   * once; any other answer, including 404 from a backend that predates the
+   * route, drops the batch quietly. Uses `rawFetch`, so the send is never
+   * tracked or healed by our own patch.
+   */
+  async sendRequests(calls, signal) {
+    if (!this.enabled() || calls.length === 0) return;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.reportTimeoutMs);
+    try {
+      const response = await this.rawFetch(new URL("v1/requests", this.url), {
+        method: "POST",
+        headers: this.headers(),
+        body: JSON.stringify({ requests: calls }),
+        signal: signal ? AbortSignal.any([signal, controller.signal]) : controller.signal,
+        redirect: "error"
+      });
+      if (response.status === 403) {
+        const body = await response.json().catch(() => null);
+        if (isObject(body) && body.error === "project_disabled") {
+          this.disabledUntil = performance.now() + 3e5;
+        }
+        return;
+      }
+      void response.body?.cancel().catch(() => {
+      });
+      if (response.status === 429 || response.status >= 500) {
+        throw new Error(`tracked calls refused (${response.status})`);
+      }
+    } finally {
+      clearTimeout(timer);
+    }
+  }
   report(id, outcome) {
     if (!id) return;
     if (this.pending.size >= 64) {
@@ -398,16 +491,20 @@ var HealApi = class {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.reportTimeoutMs);
     try {
-      const response = await this.rawFetch(new URL(`v1/heal-attempts/${encodeURIComponent(id)}`, this.url), {
-        method: "PATCH",
-        headers: this.headers(),
-        body: JSON.stringify(outcome),
-        signal: controller.signal,
-        redirect: "error"
-      });
+      const response = await this.rawFetch(
+        new URL(`v1/heal-attempts/${encodeURIComponent(id)}`, this.url),
+        {
+          method: "PATCH",
+          headers: this.headers(),
+          body: JSON.stringify(outcome),
+          signal: controller.signal,
+          redirect: "error"
+        }
+      );
       void response.body?.cancel().catch(() => {
       });
-      if (!response.ok) warn("Outcome report rejected; attempt remains unconfirmed");
+      if (!response.ok)
+        warn("Outcome report rejected; attempt remains unconfirmed");
     } catch {
       warn("Outcome report failed; attempt remains unconfirmed");
     } finally {
@@ -416,28 +513,149 @@ var HealApi = class {
   }
 };
 
+// src/tracking.ts
+var MAX_BUFFER = 5e3;
+var MAX_BATCH = 500;
+var CallBuffer = class {
+  constructor(send, options = {}) {
+    this.send = send;
+    this.flushAt = options.flushAt ?? 500;
+    this.minGapMs = options.minGapMs ?? 1e3;
+    this.timer = setInterval(() => void this.kick(), options.intervalMs ?? 5e3);
+    this.timer.unref();
+  }
+  send;
+  queue = [];
+  inFlight = null;
+  lastSentAt = -Infinity;
+  /** Past this instant, nothing is retried or waited for, and a send in flight is aborted. */
+  deadline = Infinity;
+  controller = new AbortController();
+  timer;
+  flushAt;
+  minGapMs;
+  record(call) {
+    if (this.queue.length >= MAX_BUFFER) return;
+    this.queue.push(call);
+    if (this.queue.length >= this.flushAt) void this.kick();
+  }
+  size() {
+    return this.queue.length;
+  }
+  /** Resolves when the send in flight, if any, has settled. */
+  async idle() {
+    await this.inFlight;
+  }
+  /**
+   * Send everything buffered now, one batch at a time through the same
+   * in-flight guard as the timer. With `deadlineMs` (the exit path), it gives
+   * up at the deadline: the send in flight is aborted, nothing is retried, and
+   * what is left is dropped, so a script never hangs on an unreachable server.
+   */
+  async flush(deadlineMs = Infinity) {
+    this.deadline = performance.now() + deadlineMs;
+    const abortAt = Number.isFinite(deadlineMs) ? setTimeout(() => this.controller.abort(), deadlineMs) : null;
+    try {
+      while ((this.queue.length > 0 || this.inFlight) && performance.now() < this.deadline) {
+        await (this.inFlight ?? this.start());
+      }
+    } finally {
+      if (abortAt) clearTimeout(abortAt);
+      if (this.controller.signal.aborted) this.controller = new AbortController();
+      this.deadline = Infinity;
+    }
+  }
+  stop() {
+    clearInterval(this.timer);
+  }
+  kick() {
+    if (this.inFlight || this.queue.length === 0) return;
+    if (performance.now() - this.lastSentAt < this.minGapMs) return;
+    void this.start();
+  }
+  start() {
+    this.inFlight = this.sendOne().finally(() => {
+      this.inFlight = null;
+    });
+    return this.inFlight;
+  }
+  async sendOne() {
+    const batch = this.queue.splice(0, MAX_BATCH);
+    for (let attempt = 0; attempt < 2; attempt++) {
+      if (attempt > 0 && performance.now() >= this.deadline) return;
+      await this.waitForGap();
+      this.lastSentAt = performance.now();
+      try {
+        await this.send(batch, this.controller.signal);
+        return;
+      } catch {
+      }
+      if (this.controller.signal.aborted) {
+        this.controller = new AbortController();
+        return;
+      }
+    }
+  }
+  // Referenced on purpose: this wait only happens while a send or an exit
+  // flush is under way, and an unref'd wait would let the process exit with
+  // the batch unsent. It never outlasts the flush deadline.
+  async waitForGap() {
+    const wait = Math.min(this.lastSentAt + this.minGapMs, this.deadline) - performance.now();
+    if (wait > 0) await new Promise((resolve) => setTimeout(resolve, wait));
+  }
+};
+
 // src/runtime.ts
 var forbidden = /* @__PURE__ */ new Set([401, 402, 403, 429]);
+var bodyless = ["GET", "HEAD", "DELETE", "OPTIONS"];
+var neverBodied = (method) => method === "GET" || method === "HEAD";
 var eligible = (status) => status >= 400 && status < 500 && !forbidden.has(status);
 var Runtime = class {
   constructor(options, original, api) {
     this.options = options;
     this.original = original;
     this.api = api ?? new HealApi(original, options.key, options.url);
+    this.tracker = new CallBuffer((batch, signal) => this.api.sendRequests(batch, signal));
   }
   options;
   original;
   api;
+  /** Calls that did not go to `/v1/heal`, any status, on their way to `/v1/requests`. */
+  tracker;
+  /**
+   * Record a call that is not being healed. An in-memory append: never awaited,
+   * never throws, reads nothing of the response.
+   */
+  track(method, url, statusCode, startedAt, responseTimeMs) {
+    try {
+      const reported = trackedUrl(url());
+      const verb = method.toUpperCase();
+      if (!reported || reported.length > 4096 || !verb || verb.length > 16 || statusCode < 100 || statusCode > 599) return;
+      this.tracker.record({
+        traceId: (0, import_node_crypto.randomUUID)(),
+        method: verb,
+        url: reported,
+        statusCode,
+        responseTimeMs: Math.round(responseTimeMs),
+        occurredAt: new Date(startedAt).toISOString()
+      });
+    } catch {
+    }
+  }
   fetch = async (input, init) => {
     const request = new Request(input, init);
     const extras = { ...init };
     delete extras.body;
     delete extras.headers;
     const bodyPromise = captureRequest(request).catch(() => ({ body: null, complete: false }));
+    const startedAt = Date.now();
     const started = performance.now();
     const response = await this.original(request, extras);
     const responseTimeMs = performance.now() - started;
-    if (!eligible(response.status) || response.redirected || !this.api.enabled()) return response;
+    if (!eligible(response.status) || response.redirected || !this.api.canHeal()) {
+      this.track(request.method, () => request.url, response.status, startedAt, responseTimeMs);
+      return response;
+    }
     return this.handleResponse(request, response, await bodyPromise, responseTimeMs, extras);
   };
   async handleResponse(request, response, body, responseTimeMs, extras = {}) {
@@ -526,11 +744,11 @@ function buildRetry(request, originalBody, result) {
       else return null;
     }
     const body = Object.hasOwn(healed, "body") ? mergeBody(originalBody, healed.body) : originalBody;
-    if (body === null && !["GET", "HEAD"].includes(request.method)) return null;
+    if (body === null && !bodyless.includes(request.method)) return null;
     return new Request(url, {
       method: request.method,
       headers,
-      body: ["GET", "HEAD"].includes(request.method) ? void 0 : serializeRequestBody(body, contentType),
+      body: body === null || neverBodied(request.method) ? void 0 : serializeRequestBody(body, contentType),
       signal: request.signal,
       redirect: request.redirect,
       credentials: request.credentials,
@@ -567,6 +785,7 @@ function wrapRequest(original, protocol, runtime) {
   return ((...received) => {
     const args = [...received];
     const callback = typeof args.at(-1) === "function" ? args.pop() : void 0;
+    const startedAt = Date.now();
     const started = performance.now();
     const request = original(...args);
     const capture = captureBody(request);
@@ -575,7 +794,14 @@ function wrapRequest(original, protocol, runtime) {
     request.emit = ((event, ...values) => {
       if (event !== "response") return emit(event, ...values);
       const response = values[0];
-      if (!eligible(response.statusCode ?? 0) || !runtime.api.enabled()) {
+      if (!eligible(response.statusCode ?? 0) || !runtime.api.canHeal()) {
+        runtime.track(
+          request.method,
+          () => requestUrl(request, protocol).toString(),
+          response.statusCode ?? 0,
+          startedAt,
+          performance.now() - started
+        );
         return emit(event, ...values);
       }
       void handleResponse(runtime, request, response, protocol, capture.body(), signal, started).then((healed) => emit("response", healed)).catch((error) => {
@@ -594,6 +820,10 @@ async function handleResponse(runtime, clientRequest, incoming, protocol, body,
   const healed = await runtime.handleResponse(request, response, body, performance.now() - started);
   return incomingResponse(healed, clientRequest);
 }
+function requestUrl(request, protocol) {
+  const authority = String(request.getHeader("host") ?? request.host);
+  return new URL(request.path, `${protocol}//${authority}`);
+}
 function webRequest(request, protocol, captured, signal) {
   const headers = new Headers();
   for (const name of request.getHeaderNames()) {
@@ -602,8 +832,7 @@ function webRequest(request, protocol, captured, signal) {
       if (item !== void 0) headers.append(name, String(item));
     }
   }
-  const authority = String(request.getHeader("host") ?? request.host);
-  const url = new URL(request.path, `${protocol}//${authority}`);
+  const url = requestUrl(request, protocol);
   const method = request.method;
   return new Request(url, {
     method,
@@ -712,6 +941,7 @@ function cancellation(request, external) {
 
 // src/index.ts
 var STATE = /* @__PURE__ */ Symbol.for("mnfst.node.runtime.v1");
+var EXIT_FLUSH_MS = 2e3;
 var globals = globalThis;
 function manifest(options = {}) {
   const key = options.key || process.env.MNFST_KEY;
@@ -719,16 +949,22 @@ function manifest(options = {}) {
     warn("MNFST_KEY is not set; Manifest is disabled");
     return;
   }
-  const url = new URL(options.url || process.env.MNFST_URL || "https://api.manifest.build");
+  const url = new URL(
+    options.url || process.env.MNFST_URL || "https://api.manifest.build"
+  );
   if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
-    throw new TypeError("Manifest URL must be an HTTP(S) base URL without credentials, query or fragment");
+    throw new TypeError(
+      "Manifest URL must be an HTTP(S) base URL without credentials, query or fragment"
+    );
   }
   if (!url.pathname.endsWith("/")) url.pathname += "/";
   const resolved = { ...options, key, url: url.toString() };
   const existing = globals[STATE];
   if (existing) {
     if (existing.options.key !== key || existing.options.url !== resolved.url || existing.options.onHeal !== options.onHeal) {
-      warn("Manifest is already configured; changing configuration requires a process restart");
+      warn(
+        "Manifest is already configured; changing configuration requires a process restart"
+      );
     }
     return;
   }
@@ -736,6 +972,10 @@ function manifest(options = {}) {
   globalThis.fetch = runtime.fetch;
   installHttp(runtime);
   globals[STATE] = runtime;
+  runtime.api.hello(`node-${process.versions.node}`);
+  process.once("beforeExit", () => {
+    if (runtime.tracker.size() > 0) void runtime.tracker.flush(EXIT_FLUSH_MS);
+  });
 }
 
 // src/register.ts

package/dist/register.js

@@ -1,6 +1,7 @@
 import {
   manifest
-} from "./chunk-DP2C4E42.js";
+} from "./chunk-GC5H22R2.js";
+import "./chunk-NHEF7GUP.js";
 
 // src/register.ts
 manifest();

package/docs/guide.md

@@ -4,13 +4,7 @@
 
 ## Configuration
 
-Call `manifest()` once at startup, before other libraries save a reference to `fetch`, `node:http` or `node:https`. Some clients, the OpenAI and Anthropic SDKs among them, read global `fetch` once when constructed, and a client built at import time runs before any `manifest()` call in your code. Preload the register entry to install first:
-
-```sh
-node --import manifest/register app.js
-# or, for a process you do not launch yourself:
-NODE_OPTIONS="--import manifest/register" some-agent
-```
+Call `manifest()` once at startup, before other libraries save a reference to `fetch`, `node:http` or `node:https`. Where a client is built at import time and would capture the original `fetch` first, [preload the register entry](#preloading) instead.
 
 It reads `MNFST_KEY` and `MNFST_URL` and takes no options.
 
@@ -35,9 +29,72 @@ manifest({
 
 `onHeal` receives `url`, `statusCode`, `healStatus`, `replayStatusCode`, `healMs` and optional `operations`. URLs have known credential query fields masked. Callback errors do not fail application requests.
 
+## Preloading
+
+Calling `manifest()` from the first import of your entry file covers clients that read `fetch` after it runs, which is most of them. Some clients, the OpenAI and Anthropic SDKs among them, read global `fetch` once when constructed, and a client built at import time runs before any `manifest()` call in your code. Preload the register entry to install first:
+
+```sh
+node -r manifest/register app.js
+```
+
+`-r` is CommonJS `require`; `--import manifest/register` is the ESM loader form. Both resolve the same entry and install before the app module evaluates, in CJS and ESM apps alike. Prefer `-r` where you launch the process: it takes no quoting and works on Windows.
+
+For a process you do not launch yourself — a framework CLI such as `nest start`, or a host dashboard that owns the command — pass it through `NODE_OPTIONS`:
+
+```sh
+NODE_OPTIONS="--require manifest/register" nest start
+```
+
+The register entry reads `MNFST_KEY` **once, at load**. Setting or changing the key without restarting the process does nothing. Without a key it warns once, leaves `fetch`, `node:http` and `node:https` untouched, and the app runs to exit 0.
+
+### Next.js
+
+Serverless deployments such as Vercel have no start command, so neither preload flag applies. Install from `instrumentation.ts`:
+
+```ts
+// src/instrumentation.ts
+export async function register() {
+  if (process.env.NEXT_RUNTIME === 'nodejs') {
+    const { manifest } = await import('manifest');
+    manifest();
+  }
+}
+```
+
+Guard inside an `if` block, as above, rather than returning early, and import `manifest` dynamically. A top-level import is resolved for both runtimes, and the Edge build fails with `Can't resolve 'http'`. On Next.js 14, set `experimental.instrumentationHook: true` in `next.config.js`.
+
+### Edge runtime
+
+Not supported. The SDK needs `node:crypto`, `node:http` and `node:https`, none of which exist on Edge. Next.js `middleware.ts` always runs on Edge and is therefore never covered.
+
 ## Verifying the installation
 
-Send a JSON request that your test API rejects with 400, 404, 422 or any other request-side 4xx. The failure appears in your project's dashboard, and the `onHeal` callback reports the repair result. A successful request alone does not contact Manifest. Outcome reports are asynchronous, so a short-lived script may exit before the report is delivered.
+Run the doctor from the project directory. It checks the install without guessing from source:
+
+```sh
+npx manifest doctor
+```
+
+```
+  ✅ SDK installed          manifest 7.0.0
+  ✅ MNFST_KEY set          mnfst_proj_…DZDw
+  ✅ Key valid              project "Find Concierge"
+  ⚠️ Loads before your app  cannot tell from here whether manifest() runs; check
+                            Requests received
+  ⚠️ Requests received      no requests received yet
+
+Runtime coverage
+  Node.js runtime   fetch, http.request, https.request, http.get are patched
+  Edge runtime      not supported — middleware.ts and Edge route handlers are never covered
+```
+
+**Loads before your app** recognizes a preload flag in a script and `instrumentation.ts` on a Next.js project. It does not read your source, so the ordinary `manifest()` call in an entry file is invisible to it: that is a warning, not a failure, and **Requests received** is what settles it. The one failure it reports is a Next.js project with no instrumentation file, where nothing can install Manifest at all.
+
+`doctor` resolves the installed version, masks the key (it is never printed in full), and makes one round trip to the handshake endpoint — the only check that tells a good key from a typo'd or revoked one, which both look like silence otherwise. A non-zero exit code means a check failed.
+
+The key check is a probe: it proves the key works without registering an install, so a diagnostic run never makes the dashboard claim your app is connected. Only a real boot does that.
+
+You can also verify by hand: send a JSON request that your test API rejects with 400, 404, 422 or any other request-side 4xx. The failure appears in your project's dashboard, and the `onHeal` callback reports the repair result. A successful request alone does not contact Manifest. Outcome reports are asynchronous, so a short-lived script may exit before the report is delivered.
 
 ## Supported traffic
 
@@ -48,6 +105,7 @@ Send a JSON request that your test API rejects with 400, 404, 422 or any other r
 - JSON and `application/x-www-form-urlencoded` APIs, including nested form fields. No provider-specific request format is required.
 - One retry per capture. Same-origin URL and header repairs are supported by the SDK; the current app returns structured body repairs.
 - Successful calls and successful retries remain streamed. Failed responses retain their bytes, status, headers, URL and redirect metadata.
+- Every call that is not healed, whatever its status, is tracked as metadata only and sent in batches, off the request path (see "Data sent to Manifest").
 
 **Not covered:** browser JavaScript, HTTP/2, directly imported `undici.fetch`, and `fetch` references saved before initialization (see `manifest/register` above). Those transports need separate integration. This SDK does not claim to intercept every Node HTTP client.
 
@@ -56,7 +114,7 @@ Send a JSON request that your test API rejects with 400, 404, 422 or any other r
 - Request capture is bounded to 256 KiB and structure depth 64. Fetch uploads are teed for at most one second; Node HTTP writes are copied as they are sent. Oversized, malformed or slow fetch uploads travel as `null` and are not retried.
 - Form-urlencoded retries are re-encoded from the parsed structure, so repeated keys such as `expand=a&expand=b` return as `expand[0]=a&expand[1]=b`. Servers that reject indexed keys see the retry fail like any other unsuccessful repair.
 - Error capture reads at most 64 KiB plus one transport chunk, within one second. The prefix and remaining stream are preserved for the caller. Incomplete errors are reported without retry. One unusually large transport chunk can exceed that memory estimate.
-- The Manifest heal call has a 60-second deadline and at most eight concurrent requests. Capacity exhaustion and service errors return the original API error response.
+- The Manifest heal call has a 60-second deadline and at most eight concurrent requests. Capacity exhaustion and service errors return the original API error response. If the configured server is unreachable, the heal attempt fails in about 10 ms and the app's original error response surfaces unchanged.
 - Caller abort signals apply during healing and retry; cancellation remains observable to the caller.
 - A transport failure on retry returns the original error response and reports inconclusive evidence. If the retry returns another HTTP error, its raw body is reported so the app can distinguish recurrence from a new issue.
 - Automatic retries can repeat side effects. Use APIs with safe retry semantics and caller-managed idempotency keys; these headers are preserved unless explicitly changed by a repair.
@@ -66,7 +124,9 @@ Outcome reports are best effort, limited to 64 concurrent requests with five-sec
 
 ## Data sent to Manifest
 
-Failed URLs, request headers, JSON or form-urlencoded bodies, and raw error responses go to the configured server. Known credential names in query parameters and headers are masked; credential-named top-level request body fields are withheld and restored on retry. Exception prose is not sent for transport failures.
+**Every call (metadata only).** For each call that is not healed, whatever its status, the SDK sends its method, URL without the query string, userinfo or fragment, status code, response time and time of the call. No headers and no bodies. Calls are batched and sent in the background, at most once per second; recording one never slows the call. Calls still buffered when a serverless runtime freezes the process can be lost.
+
+**Healable failures (full capture).** Failed URLs, request headers, JSON or form-urlencoded bodies, and raw error responses go to the configured server. Known credential names in query parameters and headers are masked; credential-named top-level request body fields are withheld and restored on retry. Exception prose is not sent for transport failures.
 
 This is not general secret detection: nested fields, arbitrary secret names, business data and response bodies may contain sensitive information. Enable it only for traffic you permit Manifest to process and store. The SDK makes the actual retry locally.
 

package/package.json

@@ -1,11 +1,14 @@
 {
   "name": "manifest",
-  "version": "7.0.0",
+  "version": "7.2.0",
   "description": "Repair eligible failed API calls made by Node HTTP clients.",
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "bin": {
+    "manifest": "./dist/bin.js"
+  },
   "exports": {
     ".": {
       "import": {
@@ -32,13 +35,15 @@
     "dist",
     "README.md",
     "CONTRACT.md",
-    "docs"
+    "docs",
+    "!docs/github-sdk.png",
+    "!docs/sdk-flow-diagram.svg"
   ],
   "engines": {
     "node": ">=22"
   },
   "scripts": {
-    "build": "tsup src/index.ts src/register.ts --format esm,cjs --dts --clean",
+    "build": "tsup src/index.ts src/register.ts src/bin.ts --format esm,cjs --dts --clean",
     "changeset": "changeset",
     "typecheck": "tsc --noEmit",
     "test": "tsx --test tests/*.test.ts",