manifest 7.1.0 → 7.2.1

package/dist/register.cjs

@@ -68,6 +68,19 @@ function safeUrl(raw) {
   url.search = new URLSearchParams(pairs).toString();
   return url.toString();
 }
+function trackedUrl(raw) {
+  try {
+    const url = new URL(raw);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
 function safeHeaders(headers) {
   return Object.fromEntries([...headers].map(([key, value]) => [
     key,
@@ -314,8 +327,29 @@ async function captureResponse(original, limit = RESPONSE_LIMIT, timeoutMs = CAP
 // src/runtime.ts
 var import_node_crypto = require("crypto");
 
+// src/serverless.ts
+var CONTEXTS = [/* @__PURE__ */ Symbol.for("@vercel/request-context"), /* @__PURE__ */ Symbol.for("@next/request-context")];
+function isServerless(env = process.env) {
+  return Boolean(env.VERCEL || env.AWS_LAMBDA_FUNCTION_NAME || env.K_SERVICE);
+}
+function keepAlive(promise) {
+  try {
+    const globals2 = globalThis;
+    for (const symbol of CONTEXTS) {
+      const waitUntil = globals2[symbol]?.get?.()?.waitUntil;
+      if (typeof waitUntil === "function") {
+        waitUntil(promise.catch(() => {
+        }));
+        return;
+      }
+    }
+  } catch {
+  }
+}
+
 // src/api.ts
-var VERSION = "7.1.0";
+var VERSION = "7.2.1";
+var MAX_HEALS_IN_FLIGHT = 8;
 var warn = (message) => process.emitWarning(message, { code: "MNFST" });
 var HealApi = class {
   constructor(rawFetch, key, url, timeoutMs = 6e4, reportTimeoutMs = 5e3) {
@@ -337,6 +371,14 @@ var HealApi = class {
   enabled() {
     return performance.now() >= this.disabledUntil;
   }
+  /**
+   * Whether a heal call would be sent right now: the project is not disabled
+   * and a heal slot is free. A healable failure that cannot be sent is tracked
+   * instead, so it is never lost from both ledgers.
+   */
+  canHeal() {
+    return this.enabled() && this.inFlight < MAX_HEALS_IN_FLIGHT;
+  }
   headers() {
     return {
       authorization: `Bearer ${this.key}`,
@@ -345,7 +387,7 @@ var HealApi = class {
     };
   }
   async heal(capture, signal) {
-    if (!this.enabled() || this.inFlight >= 8) return null;
+    if (!this.canHeal()) return null;
     this.inFlight++;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
@@ -420,6 +462,41 @@ var HealApi = class {
     }).catch(() => {
     }).finally(() => clearTimeout(timer));
   }
+  /**
+   * Ship one batch of tracked calls to `POST /v1/requests`. Throws only when a
+   * retry could help (network error, timeout, 429, 5xx), so the buffer retries
+   * once; any other answer, including 404 from a backend that predates the
+   * route, drops the batch quietly. Uses `rawFetch`, so the send is never
+   * tracked or healed by our own patch.
+   */
+  async sendRequests(calls, signal) {
+    if (!this.enabled() || calls.length === 0) return;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.reportTimeoutMs);
+    try {
+      const response = await this.rawFetch(new URL("v1/requests", this.url), {
+        method: "POST",
+        headers: this.headers(),
+        body: JSON.stringify({ requests: calls }),
+        signal: signal ? AbortSignal.any([signal, controller.signal]) : controller.signal,
+        redirect: "error"
+      });
+      if (response.status === 403) {
+        const body = await response.json().catch(() => null);
+        if (isObject(body) && body.error === "project_disabled") {
+          this.disabledUntil = performance.now() + 3e5;
+        }
+        return;
+      }
+      void response.body?.cancel().catch(() => {
+      });
+      if (response.status === 429 || response.status >= 500) {
+        throw new Error(`tracked calls refused (${response.status})`);
+      }
+    } finally {
+      clearTimeout(timer);
+    }
+  }
   report(id, outcome) {
     if (!id) return;
     if (this.pending.size >= 64) {
@@ -429,6 +506,7 @@ var HealApi = class {
     const promise = this.send(id, outcome);
     this.pending.add(promise);
     void promise.then(() => this.pending.delete(promise));
+    keepAlive(promise);
   }
   async send(id, outcome) {
     const controller = new AbortController();
@@ -456,6 +534,119 @@ var HealApi = class {
   }
 };
 
+// src/tracking.ts
+var MAX_BUFFER = 5e3;
+var MAX_BATCH = 500;
+var CallBuffer = class {
+  constructor(send, options = {}) {
+    this.send = send;
+    this.flushAt = options.flushAt ?? 500;
+    this.minGapMs = options.minGapMs ?? 1e3;
+    this.immediate = options.immediate ?? false;
+    this.keepAlive = options.keepAlive ?? keepAlive;
+    this.timer = setInterval(() => void this.kick(), options.intervalMs ?? 5e3);
+    this.timer.unref();
+  }
+  send;
+  queue = [];
+  inFlight = null;
+  lastSentAt = -Infinity;
+  /** Past this instant, nothing is retried or waited for, and a send in flight is aborted. */
+  deadline = Infinity;
+  controller = new AbortController();
+  timer;
+  flushAt;
+  minGapMs;
+  immediate;
+  keepAlive;
+  draining = null;
+  record(call) {
+    if (this.queue.length >= MAX_BUFFER) return;
+    this.queue.push(call);
+    if (this.immediate) this.drain();
+    else if (this.queue.length >= this.flushAt) void this.kick();
+  }
+  size() {
+    return this.queue.length;
+  }
+  /** Resolves when the send in flight, if any, has settled. */
+  async idle() {
+    await this.inFlight;
+  }
+  /**
+   * Send everything buffered now, one batch at a time through the same
+   * in-flight guard as the timer. With `deadlineMs` (the exit path), it gives
+   * up at the deadline: the send in flight is aborted, nothing is retried, and
+   * what is left is dropped, so a script never hangs on an unreachable server.
+   */
+  async flush(deadlineMs = Infinity) {
+    this.deadline = performance.now() + deadlineMs;
+    const abortAt = Number.isFinite(deadlineMs) ? setTimeout(() => this.controller.abort(), deadlineMs) : null;
+    try {
+      while ((this.queue.length > 0 || this.inFlight) && performance.now() < this.deadline) {
+        await (this.inFlight ?? this.start());
+      }
+    } finally {
+      if (abortAt) clearTimeout(abortAt);
+      if (this.controller.signal.aborted) this.controller = new AbortController();
+      this.deadline = Infinity;
+    }
+  }
+  stop() {
+    clearInterval(this.timer);
+  }
+  /**
+   * Serverless: the function may freeze as soon as its response is sent, before
+   * any timer fires. So send now, through `flush()` (same gap, same single send
+   * in flight), and let the platform wait for it. Calls recorded meanwhile ride
+   * the same drain; one that lands as it settles starts the next.
+   */
+  drain() {
+    if (this.draining) return;
+    const run = this.flush().finally(() => {
+      this.draining = null;
+      if (this.queue.length > 0) this.drain();
+    });
+    this.draining = run;
+    this.keepAlive(run);
+  }
+  kick() {
+    if (this.inFlight || this.queue.length === 0) return;
+    if (performance.now() - this.lastSentAt < this.minGapMs) return;
+    void this.start();
+  }
+  start() {
+    this.inFlight = this.sendOne().finally(() => {
+      this.inFlight = null;
+    });
+    return this.inFlight;
+  }
+  async sendOne() {
+    const batch = this.queue.splice(0, MAX_BATCH);
+    for (let attempt = 0; attempt < 2; attempt++) {
+      if (attempt > 0 && performance.now() >= this.deadline) return;
+      await this.waitForGap();
+      this.lastSentAt = performance.now();
+      try {
+        await this.send(batch, this.controller.signal);
+        return;
+      } catch {
+      }
+      if (this.controller.signal.aborted) {
+        this.controller = new AbortController();
+        return;
+      }
+    }
+  }
+  // Referenced on purpose: this wait only happens while a send or an exit
+  // flush is under way, and an unref'd wait would let the process exit with
+  // the batch unsent. It never outlasts the flush deadline.
+  async waitForGap() {
+    const wait = Math.min(this.lastSentAt + this.minGapMs, this.deadline) - performance.now();
+    if (wait > 0) await new Promise((resolve) => setTimeout(resolve, wait));
+  }
+};
+
 // src/runtime.ts
 var forbidden = /* @__PURE__ */ new Set([401, 402, 403, 429]);
 var bodyless = ["GET", "HEAD", "DELETE", "OPTIONS"];
@@ -466,20 +657,50 @@ var Runtime = class {
     this.options = options;
     this.original = original;
     this.api = api ?? new HealApi(original, options.key, options.url);
+    this.tracker = new CallBuffer(
+      (batch, signal) => this.api.sendRequests(batch, signal),
+      { immediate: isServerless() }
+    );
   }
   options;
   original;
   api;
+  /** Calls that did not go to `/v1/heal`, any status, on their way to `/v1/requests`. */
+  tracker;
+  /**
+   * Record a call that is not being healed. An in-memory append: never awaited,
+   * never throws, reads nothing of the response.
+   */
+  track(method, url, statusCode, startedAt, responseTimeMs) {
+    try {
+      const reported = trackedUrl(url());
+      const verb = method.toUpperCase();
+      if (!reported || reported.length > 4096 || !verb || verb.length > 16 || statusCode < 100 || statusCode > 599) return;
+      this.tracker.record({
+        traceId: (0, import_node_crypto.randomUUID)(),
+        method: verb,
+        url: reported,
+        statusCode,
+        responseTimeMs: Math.round(responseTimeMs),
+        occurredAt: new Date(startedAt).toISOString()
+      });
+    } catch {
+    }
+  }
   fetch = async (input, init) => {
     const request = new Request(input, init);
     const extras = { ...init };
     delete extras.body;
     delete extras.headers;
     const bodyPromise = captureRequest(request).catch(() => ({ body: null, complete: false }));
+    const startedAt = Date.now();
     const started = performance.now();
     const response = await this.original(request, extras);
     const responseTimeMs = performance.now() - started;
-    if (!eligible(response.status) || response.redirected || !this.api.enabled()) return response;
+    if (!eligible(response.status) || response.redirected || !this.api.canHeal()) {
+      this.track(request.method, () => request.url, response.status, startedAt, responseTimeMs);
+      return response;
+    }
     return this.handleResponse(request, response, await bodyPromise, responseTimeMs, extras);
   };
   async handleResponse(request, response, body, responseTimeMs, extras = {}) {
@@ -609,6 +830,7 @@ function wrapRequest(original, protocol, runtime) {
   return ((...received) => {
     const args = [...received];
     const callback = typeof args.at(-1) === "function" ? args.pop() : void 0;
+    const startedAt = Date.now();
     const started = performance.now();
     const request = original(...args);
     const capture = captureBody(request);
@@ -617,7 +839,14 @@ function wrapRequest(original, protocol, runtime) {
     request.emit = ((event, ...values) => {
       if (event !== "response") return emit(event, ...values);
       const response = values[0];
-      if (!eligible(response.statusCode ?? 0) || !runtime.api.enabled()) {
+      if (!eligible(response.statusCode ?? 0) || !runtime.api.canHeal()) {
+        runtime.track(
+          request.method,
+          () => requestUrl(request, protocol).toString(),
+          response.statusCode ?? 0,
+          startedAt,
+          performance.now() - started
+        );
         return emit(event, ...values);
       }
       void handleResponse(runtime, request, response, protocol, capture.body(), signal, started).then((healed) => emit("response", healed)).catch((error) => {
@@ -636,6 +865,10 @@ async function handleResponse(runtime, clientRequest, incoming, protocol, body,
   const healed = await runtime.handleResponse(request, response, body, performance.now() - started);
   return incomingResponse(healed, clientRequest);
 }
+function requestUrl(request, protocol) {
+  const authority = String(request.getHeader("host") ?? request.host);
+  return new URL(request.path, `${protocol}//${authority}`);
+}
 function webRequest(request, protocol, captured, signal) {
   const headers = new Headers();
   for (const name of request.getHeaderNames()) {
@@ -644,8 +877,7 @@ function webRequest(request, protocol, captured, signal) {
       if (item !== void 0) headers.append(name, String(item));
     }
   }
-  const authority = String(request.getHeader("host") ?? request.host);
-  const url = new URL(request.path, `${protocol}//${authority}`);
+  const url = requestUrl(request, protocol);
   const method = request.method;
   return new Request(url, {
     method,
@@ -754,6 +986,7 @@ function cancellation(request, external) {
 
 // src/index.ts
 var STATE = /* @__PURE__ */ Symbol.for("mnfst.node.runtime.v1");
+var EXIT_FLUSH_MS = 2e3;
 var globals = globalThis;
 function manifest(options = {}) {
   const key = options.key || process.env.MNFST_KEY;
@@ -785,6 +1018,9 @@ function manifest(options = {}) {
   installHttp(runtime);
   globals[STATE] = runtime;
   runtime.api.hello(`node-${process.versions.node}`);
+  process.once("beforeExit", () => {
+    if (runtime.tracker.size() > 0) void runtime.tracker.flush(EXIT_FLUSH_MS);
+  });
 }
 
 // src/register.ts

package/dist/register.js

@@ -1,7 +1,7 @@
 import {
   manifest
-} from "./chunk-4OVLT3PO.js";
-import "./chunk-AR23I2QK.js";
+} from "./chunk-RO6CIYR2.js";
+import "./chunk-OXOZQLZ3.js";
 
 // src/register.ts
 manifest();

package/docs/guide.md

@@ -105,6 +105,7 @@ You can also verify by hand: send a JSON request that your test API rejects with
 - JSON and `application/x-www-form-urlencoded` APIs, including nested form fields. No provider-specific request format is required.
 - One retry per capture. Same-origin URL and header repairs are supported by the SDK; the current app returns structured body repairs.
 - Successful calls and successful retries remain streamed. Failed responses retain their bytes, status, headers, URL and redirect metadata.
+- Every call that is not healed, whatever its status, is tracked as metadata only and sent in batches, off the request path (see "Data sent to Manifest").
 
 **Not covered:** browser JavaScript, HTTP/2, directly imported `undici.fetch`, and `fetch` references saved before initialization (see `manifest/register` above). Those transports need separate integration. This SDK does not claim to intercept every Node HTTP client.
 
@@ -123,7 +124,9 @@ Outcome reports are best effort, limited to 64 concurrent requests with five-sec
 
 ## Data sent to Manifest
 
-Failed URLs, request headers, JSON or form-urlencoded bodies, and raw error responses go to the configured server. Known credential names in query parameters and headers are masked; credential-named top-level request body fields are withheld and restored on retry. Exception prose is not sent for transport failures.
+**Every call (metadata only).** For each call that is not healed, whatever its status, the SDK sends its method, URL without the query string, userinfo or fragment, status code, response time and time of the call. No headers and no bodies. Calls are batched and sent in the background, at most once per second; recording one never slows the call. On Vercel, AWS Lambda and Cloud Run, each call is sent as soon as it is recorded, and the function is kept alive until it is delivered.
+
+**Healable failures (full capture).** Failed URLs, request headers, JSON or form-urlencoded bodies, and raw error responses go to the configured server. Known credential names in query parameters and headers are masked; credential-named top-level request body fields are withheld and restored on retry. Exception prose is not sent for transport failures.
 
 This is not general secret detection: nested fields, arbitrary secret names, business data and response bodies may contain sensitive information. Enable it only for traffic you permit Manifest to process and store. The SDK makes the actual retry locally.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "manifest",
-  "version": "7.1.0",
+  "version": "7.2.1",
   "description": "Repair eligible failed API calls made by Node HTTP clients.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -35,7 +35,9 @@
     "dist",
     "README.md",
     "CONTRACT.md",
-    "docs"
+    "docs",
+    "!docs/github-sdk.png",
+    "!docs/sdk-flow-diagram.svg"
   ],
   "engines": {
     "node": ">=22"