# Incident report collector

Read-only Node command that gathers one Bex service's deployment context,
paginated app logs, and selected metrics into a local report directory.

**Evidence pin:** Bex `7b049538cb0e4784b4daac8ef62b4935c810a6c4` (`GET /v1/logs`
continuation windows, metric 503 unavailable). Continuations keep RFC3339
**nanosecond** strings — do not round through JavaScript `Date`.

## Fixture demo (no cloud account)

```bash
cd examples/incident-report
npm test
BEX_INCIDENT_FIXTURE=1 BEX_OUT_DIR=./out/demo BEX_PAGE_LIMIT=100 node collect.mjs
npm run demo
```

Scenarios via `BEX_FIXTURE_SCENARIO`: `success`, `empty-logs`,
`metrics-unavailable`, `denied`.

## Live API (already-authorized bearer)

```bash
export BEX_API_ORIGIN=https://api.bex.co
export BEX_ACCESS_TOKEN=…          # never commit
export BEX_SERVICE_ID=svc_…
export BEX_START_TIME=2026-07-05T00:00:00.000000000Z
export BEX_END_TIME=2026-07-05T01:00:00.000000000Z
export BEX_OUT_DIR=./out/incident
node collect.mjs
```

Optional: `BEX_DEPLOY_ID`, `BEX_LOG_TYPE`, `BEX_METRICS=cpu,memory,http-requests`,
budget knobs `BEX_DEADLINE_MS`, `BEX_MAX_PAGES`, `BEX_MAX_ENTRIES`.

## Output

| File | Contents |
| --- | --- |
| `manifest.json` | `complete` / `partial` / `incomplete` + per-source status |
| `REPORT.md` | Chronological summary (exact timestamp strings) |
| `logs.jsonl` | One log object per line |
| `metrics.json` | Per-metric `ok` / `empty` / `unavailable` / `denied` |
| `service.json` | Service identity |

Tokens never appear in output. Application log messages are literal untrusted
content — review before sharing. Unavailable metrics are **not** zero usage.

Exit code `1` when the run is incomplete or collection failed.