@camstack/system 1.2.151 → 1.2.154

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CImxMt5h.js");
+const require_dist = require("./dist-BPlfW-CG.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -25,8 +25,8 @@ const require_builtins_system_config_system_config_addon = require("./builtins/s
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DO8KbxCe.js");
-const require_tls$1 = require("./tls-u8QCJCFE.js");
-const require_manifest_python_deps = require("./manifest-python-deps-BqWrDjSN.js");
+const require_tls$1 = require("./tls-BxQlomxd.js");
+const require_manifest_python_deps = require("./manifest-python-deps-COeSr7el.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let zod = require("zod");
@@ -38,11 +38,11 @@ node_path = require_chunk.__toESM(node_path, 1);
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 node_util = require_chunk.__toESM(node_util);
-let node_os = require("node:os");
-node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");
 let node_fs$1 = require_chunk.__toESM(node_fs, 1);
 node_fs = require_chunk.__toESM(node_fs);
+let node_os = require("node:os");
+node_os = require_chunk.__toESM(node_os);
 let node_http = require("node:http");
 let node_vm = require("node:vm");
 node_vm = require_chunk.__toESM(node_vm);
@@ -95322,6 +95322,7 @@ exports.ConsoleDestination = require_builtins_console_logging_index.ConsoleDesti
 exports.ConsoleLoggingAddon = require_builtins_console_logging_index.ConsoleLoggingAddon$1;
 exports.CoreBlocksAddon = require_builtins_core_blocks_core_blocks_addon.CoreBlocksAddon;
 exports.CustomActionRegistry = require_custom_action_registry.CustomActionRegistry;
+exports.DECISIVE_HEAP_SPACES = require_manifest_python_deps.DECISIVE_HEAP_SPACES;
 exports.DEFAULT_DATA_PATH = DEFAULT_DATA_PATH;
 exports.DEFAULT_LAN_HTTP_PORT = require_tls$1.DEFAULT_LAN_HTTP_PORT;
 exports.DEFAULT_LOG_LEVEL = DEFAULT_LOG_LEVEL;
@@ -95331,6 +95332,7 @@ exports.DataPlaneRegistry = DataPlaneRegistry;
 exports.DeviceManagerAddon = require_builtins_device_manager_device_manager_addon.DeviceManagerAddon;
 exports.DeviceRegistry = require_manifest_python_deps.DeviceRegistry;
 exports.DeviceStore = require_builtins_sqlite_storage_index.DeviceStore$1;
+exports.EVENT_PLANE_TOP_N = require_manifest_python_deps.EVENT_PLANE_TOP_N;
 exports.EVENT_TOPIC_PREFIX = require_manifest_python_deps.EVENT_TOPIC_PREFIX;
 exports.EngineManagerResolver = EngineManagerResolver;
 exports.EventBus = EventBus;
@@ -95343,7 +95345,9 @@ exports.HEALTH_MONITOR_GRACE_PERIOD_MS = HEALTH_MONITOR_GRACE_PERIOD_MS;
 exports.HEALTH_MONITOR_RETRY_INTERVALS_MS = HEALTH_MONITOR_RETRY_INTERVALS_MS;
 exports.HEALTH_MONITOR_TICK_MS = HEALTH_MONITOR_TICK_MS;
 exports.HEAP_RECLAIM_MIN_INTERVAL_MS = require_manifest_python_deps.HEAP_RECLAIM_MIN_INTERVAL_MS;
+exports.HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS = require_manifest_python_deps.HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS;
 exports.HEAP_RECLAIM_TRIGGER_MB = require_manifest_python_deps.HEAP_RECLAIM_TRIGGER_MB;
+exports.HEAP_SPACE_REPORT_MIN_MB = require_manifest_python_deps.HEAP_SPACE_REPORT_MIN_MB;
 exports.HEAP_WATCH_INTERVAL_MS = require_manifest_python_deps.HEAP_WATCH_INTERVAL_MS;
 exports.HEAP_WATCH_WARN_RATIO = require_manifest_python_deps.HEAP_WATCH_WARN_RATIO;
 exports.HUB_CAP_FWD_ACTION = require_manifest_python_deps.HUB_CAP_FWD_ACTION;
@@ -95392,6 +95396,7 @@ exports.QUARANTINE_DIRNAME = QUARANTINE_DIRNAME;
 exports.RESTART_MARKER_FILE = RESTART_MARKER_FILE;
 exports.RSS_BUDGET_REANNOUNCE_MIN_MS = require_manifest_python_deps.RSS_BUDGET_REANNOUNCE_MIN_MS;
 exports.RSS_BUDGET_RELEASE_RATIO = require_manifest_python_deps.RSS_BUDGET_RELEASE_RATIO;
+exports.RUNNER_HEAP_SNAPSHOT_ENV = require_manifest_python_deps.RUNNER_HEAP_SNAPSHOT_ENV;
 exports.RUNNER_HEAP_WATCH_INTERVAL_MS = require_manifest_python_deps.RUNNER_HEAP_WATCH_INTERVAL_MS;
 exports.RUNNER_RSS_BUDGET_ENV = require_manifest_python_deps.RUNNER_RSS_BUDGET_ENV;
 exports.RUNTIME_DEFAULTS = require_dist.RUNTIME_DEFAULTS;
@@ -95420,6 +95425,7 @@ exports.UdsLocalTransportServer = require_manifest_python_deps.UdsLocalTransport
 exports.UserManager = require_builtins_local_auth_local_auth_addon.UserManager;
 exports.WinstonDestination = require_builtins_winston_logging_index.WinstonDestination$1;
 exports.WinstonLoggingAddon = require_builtins_winston_logging_index.WinstonLoggingAddon$1;
+exports.ZERO_LOOP_DELAY = require_manifest_python_deps.ZERO_LOOP_DELAY;
 exports.__resetCapUsageRegistryForTests = require_manifest_python_deps.__resetCapUsageRegistryForTests;
 exports.__resetLoggingGateForTests = __resetLoggingGateForTests;
 exports.adaptBrokerToCluster = require_manifest_python_deps.adaptBrokerToCluster;
@@ -95471,11 +95477,14 @@ exports.createBrokerDeviceManagerApi = require_manifest_python_deps.createBroker
 exports.createCoreCapService = createCoreCapService;
 exports.createDeferredHeapWatchSink = require_manifest_python_deps.createDeferredHeapWatchSink;
 exports.createDoorSettingsView = createDoorSettingsView;
+exports.createEventPlaneMeter = require_manifest_python_deps.createEventPlaneMeter;
+exports.createEventPlaneReader = require_manifest_python_deps.createEventPlaneReader;
 exports.createFileDataPlaneHandler = require_file_data_plane.createFileDataPlaneHandler;
 exports.createHubCapForwardService = require_manifest_python_deps.createHubCapForwardService;
 exports.createHubService = createHubService;
 exports.createKernelHwAccel = require_manifest_python_deps.createKernelHwAccel;
 exports.createLocalTransport = require_manifest_python_deps.createLocalTransport;
+exports.createLoopDelayMeter = require_manifest_python_deps.createLoopDelayMeter;
 exports.createParentUnownedCallHandler = require_manifest_python_deps.createParentUnownedCallHandler;
 exports.createProcessService = createProcessService;
 exports.createReadinessService = createReadinessService;
@@ -95493,6 +95502,7 @@ exports.deriveAgentListenPort = deriveAgentListenPort;
 exports.describeProviderKindDrift = describeProviderKindDrift;
 exports.describeRss = require_manifest_python_deps.describeRss;
 exports.detectWorkspacePackagesDir = detectWorkspacePackagesDir;
+exports.diffEventPlane = require_manifest_python_deps.diffEventPlane;
 Object.defineProperty(exports, "downloadBinary", {
 	enumerable: true,
 	get: function() {
@@ -95502,6 +95512,7 @@ Object.defineProperty(exports, "downloadBinary", {
 exports.downloadFile = require_file_data_plane.downloadFile;
 exports.downloadModel = require_file_data_plane.downloadModel;
 exports.emitDownForOwnedCaps = require_dist.emitDownForOwnedCaps;
+exports.emitHeapDiagnosticReport = require_manifest_python_deps.emitHeapDiagnosticReport;
 exports.encodeFrame = require_manifest_python_deps.encodeFrame;
 exports.ensureAddonNativePrebuilds = ensureAddonNativePrebuilds;
 Object.defineProperty(exports, "ensureBinary", {
@@ -95536,6 +95547,8 @@ Object.defineProperty(exports, "findInPath", {
 		return _camstack_types_node.findInPath;
 	}
 });
+exports.formatEventPlane = require_manifest_python_deps.formatEventPlane;
+exports.formatHeapSpaces = require_manifest_python_deps.formatHeapSpaces;
 exports.formatLogLine = require_formatter.formatLogLine;
 exports.getBrokerEventBus = require_manifest_python_deps.getBrokerEventBus;
 exports.getCapUsageRegistry = require_manifest_python_deps.getCapUsageRegistry;
@@ -95568,6 +95581,8 @@ exports.getSinglePidStats = require_resource_monitor.getSinglePidStats;
 exports.getWorkerDeviceRegistry = require_manifest_python_deps.getWorkerDeviceRegistry;
 exports.hasDotNode = hasDotNode;
 exports.hashClusterSecret = hashClusterSecret;
+exports.heapSnapshotAuthorised = require_manifest_python_deps.heapSnapshotAuthorised;
+exports.heapSpaceField = require_manifest_python_deps.heapSpaceField;
 exports.hubMainRssBudget = require_manifest_python_deps.hubMainRssBudget;
 exports.installManifestNativeDeps = require_manifest_python_deps.installManifestNativeDeps;
 exports.installManifestPythonDeps = require_manifest_python_deps.installManifestPythonDeps;
@@ -95606,11 +95621,14 @@ exports.partitionIsolatedBuiltinIds = partitionIsolatedBuiltinIds;
 exports.proxyToUpstream = proxyToUpstream;
 exports.quarantineAddonResidue = quarantineAddonResidue;
 exports.readExtraSans = require_tls$1.readExtraSans;
+exports.readHeapSpaces = require_manifest_python_deps.readHeapSpaces;
 exports.readLanHttpState = require_tls$1.readLanHttpState;
+exports.readMoleculerFanoutMode = require_manifest_python_deps.readMoleculerFanoutMode;
 exports.readPendingRestart = readPendingRestart;
 exports.readTlsAccessStatus = require_tls$1.readTlsAccessStatus;
 exports.readTlsMode = require_tls$1.readTlsMode;
 exports.readinessKey = require_dist.readinessKey;
+exports.reclaimIntervalMs = require_manifest_python_deps.reclaimIntervalMs;
 exports.registerEventBusService = require_manifest_python_deps.registerEventBusService;
 exports.registerLanHttpHandler = require_tls$1.registerLanHttpHandler;
 exports.reissueTlsLeaf = require_tls$1.reissueTlsLeaf;
@@ -95624,6 +95642,7 @@ exports.scopeKey = require_dist.scopeKey;
 exports.scopesAllowAddon = require_dist.scopesAllowAddon;
 exports.scopesAllowDeviceCap = require_dist.scopesAllowDeviceCap;
 exports.selectAddonResidue = selectAddonResidue;
+exports.selectReportedSpaces = require_manifest_python_deps.selectReportedSpaces;
 exports.serializeTypedArrays = require_manifest_python_deps.serializeTypedArrays;
 exports.setHubConnected = require_manifest_python_deps.setHubConnected;
 exports.setNodeEventInterest = require_manifest_python_deps.setNodeEventInterest;

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $ as isVoidInput, $t as scopeKey, At as DATAPLANE_SECRET_HEADER$1, Bt as asNumber, C as addonSettingsCapability, G as extractNestedAddonId, Gt as expandCapMethods, Ht as createEvent, It as ReadinessRegistry, J as isArrayOutputSchema, Lt as ReadinessTimeoutError, Mt as DEVICE_STATUS_METHOD, Ot as errMsg$1, Qt as resolveCapMount, Ut as emitDownForOwnedCaps, Vt as asString$1, X as isObjectInput, Xt as parseJsonUnknown$1, Y as isCollectionArrayMethod, Yt as parseJsonObject, Zt as readinessKey, _t as scopesAllowDeviceCap, at as looseSchema, ct as objectInputDeclaresAddonId, dt as procedureAuthKey, et as kebabToCamel, f as LOG_LEVEL_RANK, gt as scopesAllowAddon, it as logLevelAtMost, jt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, m as RUNTIME_DEFAULTS, mt as resolveMethodAuth, p as METHOD_ACCESS_MAP, t as ALL_CAPABILITY_DEFINITIONS, tn as EventCategory$1, tt as lifecycleJobSchema, zt as asJsonObject$1 } from "./dist-CbRciAbu.mjs";
+import { $ as isVoidInput, $t as scopeKey, At as DATAPLANE_SECRET_HEADER$1, Bt as asNumber, C as addonSettingsCapability, G as extractNestedAddonId, Gt as expandCapMethods, Ht as createEvent, It as ReadinessRegistry, J as isArrayOutputSchema, Lt as ReadinessTimeoutError, Mt as DEVICE_STATUS_METHOD, Ot as errMsg$1, Qt as resolveCapMount, Ut as emitDownForOwnedCaps, Vt as asString$1, X as isObjectInput, Xt as parseJsonUnknown$1, Y as isCollectionArrayMethod, Yt as parseJsonObject, Zt as readinessKey, _t as scopesAllowDeviceCap, at as looseSchema, ct as objectInputDeclaresAddonId, dt as procedureAuthKey, et as kebabToCamel, f as LOG_LEVEL_RANK, gt as scopesAllowAddon, it as logLevelAtMost, jt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, m as RUNTIME_DEFAULTS, mt as resolveMethodAuth, p as METHOD_ACCESS_MAP, t as ALL_CAPABILITY_DEFINITIONS, tn as EventCategory$1, tt as lifecycleJobSchema, zt as asJsonObject$1 } from "./dist-D_NyUV6Y.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -24,8 +24,8 @@ import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-BhKdxJgf.mjs";
-import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-CQhPGSJm.mjs";
-import { $ as buildUdsNativeCapProxy, A as createParentUnownedCallHandler, At as HUB_RSS_BUDGET_ENV, B as AGENT_CAP_FWD_SERVICE, Bt as nextRssBudgetState, C as brokerTransportLink, Ct as createAddonDataPlaneFacility, D as HUB_CAP_FWD_ACTION, Dt as HEAP_WATCH_WARN_RATIO, E as localProviderLink, Et as HEAP_WATCH_INTERVAL_MS, F as createUdsLoggerWithControl, Ft as buildHeapSample, G as createLocalTransport, Gt as strandedMb, H as CapRouteError, Ht as shouldReclaim, I as LocalChildClient, It as createDeferredHeapWatchSink, J as SocketChannel, K as UdsLocalTransportClient, L as LocalChildRegistry, Lt as createV8Reclaimer, M as createUdsEventBus, Mt as RSS_BUDGET_RELEASE_RATIO, N as udsChildLogToWorkerEntry, Nt as RUNNER_HEAP_WATCH_INTERVAL_MS, O as HUB_CAP_FWD_SERVICE, Ot as HUB_MAIN_HEAP_WATCH_LABEL, P as createUdsLogger, Pt as RUNNER_RSS_BUDGET_ENV, Q as buildNativeCapProxy, R as UDS_NO_ROUTE_PREFIX, Rt as describeRss, S as brokerCallForCap, St as runNpm, T as ipcParentLink, Tt as HEAP_RECLAIM_TRIGGER_MB, U as classifyCapRoute, Ut as startHeapWatch, V as CapRouteResolver, Vt as parseRssBudgetMb, W as callWithServiceDiscovery, Wt as startRunnerHeapWatch, X as FrameDecoder, Y as localEndpointPath, Z as encodeFrame, _ as createKernelHwAccel, _t as CapabilityUnavailableError, a as getWorkerDeviceRegistry, at as createAddonService, b as __resetCapUsageRegistryForTests, bt as resolveAddonClass, c as setHubConnected, ct as capActionName, d as getBrokerEventBus, dt as capServiceName, et as createBrokerDeviceManagerApi, f as getMoleculerEventStats, ft as parseCapAction, g as AddonDepsManager, gt as CapabilityHandle, h as subscribePassthrough, ht as DeviceRegistry, i as createUdsAddonContext, j as createUdsEventBridge, jt as RSS_BUDGET_REANNOUNCE_MIN_MS, k as createHubCapForwardService, kt as HUB_MAIN_RSS_BUDGET_MB, l as EVENT_TOPIC_PREFIX, lt as capActionSuffix, m as setNodeEventInterest, mt as serializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as validateProviderRegistrations, p as registerEventBusService, pt as deserializeTypedArrays, q as UdsLocalTransportServer, r as createAddonContext, rt as mountNativeCapService, s as getOrInitReadinessRegistryForClient, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestPythonDeps, u as clusterEventTopic, ut as capBareAction, v as resolveHwAccel, vt as copyBundledNativeModules, w as buildLinkChain, wt as HEAP_RECLAIM_MIN_INTERVAL_MS, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as installManifestNativeDeps, z as AGENT_CAP_FWD_ACTION, zt as hubMainRssBudget } from "./manifest-python-deps-DuQ3Uqoq.mjs";
+import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-DOTmtLCW.mjs";
+import { $ as buildNativeCapProxy, $t as RUNNER_HEAP_SNAPSHOT_ENV, A as createParentUnownedCallHandler, At as HUB_MAIN_HEAP_WATCH_LABEL, B as AGENT_CAP_FWD_SERVICE, Bt as createLoopDelayMeter, C as brokerTransportLink, Ct as runNpm, D as HUB_CAP_FWD_ACTION, Dt as HEAP_RECLAIM_TRIGGER_MB, E as localProviderLink, Et as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, F as createUdsLoggerWithControl, Ft as RUNNER_HEAP_WATCH_INTERVAL_MS, G as readMoleculerFanoutMode, Gt as parseRssBudgetMb, H as CapRouteError, Ht as describeRss, I as LocalChildClient, It as RUNNER_RSS_BUDGET_ENV, J as UdsLocalTransportServer, Jt as startHeapWatch, K as createLocalTransport, Kt as reclaimIntervalMs, L as LocalChildRegistry, Lt as ZERO_LOOP_DELAY, M as createUdsEventBus, Mt as HUB_RSS_BUDGET_ENV, N as udsChildLogToWorkerEntry, Nt as RSS_BUDGET_REANNOUNCE_MIN_MS, O as HUB_CAP_FWD_SERVICE, Ot as HEAP_WATCH_INTERVAL_MS, P as createUdsLogger, Pt as RSS_BUDGET_RELEASE_RATIO, Q as encodeFrame, Qt as HEAP_SPACE_REPORT_MIN_MB, R as UDS_NO_ROUTE_PREFIX, Rt as buildHeapSample, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcParentLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as classifyCapRoute, Ut as hubMainRssBudget, V as CapRouteResolver, Vt as createV8Reclaimer, W as callWithServiceDiscovery, Wt as nextRssBudgetState, X as localEndpointPath, Xt as strandedMb, Y as SocketChannel, Yt as startRunnerHeapWatch, Z as FrameDecoder, Zt as DECISIVE_HEAP_SPACES, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, an as selectReportedSpaces, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, cn as createEventPlaneReader, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, en as emitHeapDiagnosticReport, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, in as readHeapSpaces, it as mountNativeCapService, j as createUdsEventBridge, jt as HUB_MAIN_RSS_BUDGET_MB, k as createHubCapForwardService, kt as HEAP_WATCH_WARN_RATIO, l as EVENT_TOPIC_PREFIX, ln as diffEventPlane, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, nn as heapSnapshotAuthorised, o as getOrInitReadinessRegistry, on as EVENT_PLANE_TOP_N, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, qt as shouldReclaim, r as createAddonContext, rn as heapSpaceField, s as getOrInitReadinessRegistryForClient, sn as createEventPlaneMeter, st as validateProviderRegistrations, t as installManifestPythonDeps, tn as formatHeapSpaces, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, un as formatEventPlane, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as AGENT_CAP_FWD_ACTION, zt as createDeferredHeapWatchSink } from "./manifest-python-deps-BILJm2mI.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { z } from "zod";
@@ -37,9 +37,9 @@ import { dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import * as util$10 from "node:util";
 import { promisify } from "node:util";
-import * as os$18 from "node:os";
 import * as fs$17 from "node:fs";
 import { accessSync, constants, existsSync } from "node:fs";
+import * as os$18 from "node:os";
 import { request } from "node:http";
 import * as vm from "node:vm";
 import { asJsonObject, errMsg, parseJsonUnknown } from "@camstack/types/addon";
@@ -95283,4 +95283,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_LEAF_VALIDITY_DAYS, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readLanHttpState, readPendingRestart, readTlsAccessStatus, readTlsMode, readinessKey, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_LEAF_VALIDITY_DAYS, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_SNAPSHOT_ENV, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, diffEventPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatEventPlane, formatHeapSpaces, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSnapshotAuthorised, heapSpaceField, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readMoleculerFanoutMode, readPendingRestart, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/event-plane-report.d.ts

@@ -0,0 +1,202 @@
+/**
+ * event-plane-report — the fan-out counters this cluster has always kept and
+ * never read, on the line it already emits.
+ *
+ * ## Why this exists
+ *
+ * hub-main's memory is a RATE, not a set. Measured 2026-08-29 over the first 25
+ * minutes of telemetry this process has ever produced: every forced compaction
+ * drops `arrayBuffers` to **12–29 MB** — ten passes out of ten — so a reading of
+ * 726 MB is 707 MB of dead Buffers not yet swept, not a retained set. The real
+ * quantity is the slope: **181–330 MB/min steady, with one burst of ≥1.3 GB in
+ * ≤11 s**.
+ *
+ * And it is sockets, not media. `/proc/<pid>/io` over the same windows: ~21 800
+ * reads/s and ~22 500 writes/s at a **0.33 KB mean**, with regular-file reads at
+ * 0.73 MB/min. A 64 KB proxy chunk or a 200 KB JPEG cannot hide inside a 0.33 KB
+ * mean, so the cost is per MESSAGE on a fan-out plane nobody has ever counted —
+ * an IDLE addon still reads 82 messages/s of it, across ~38 runners.
+ *
+ * The strongest single number available is that **78–82% of hub-main's outbound
+ * bytes correlate with `hub/pipeline-analytics`, in both windows** — but `rchar`
+ * on that runner also counts page-cache reads and it owns a vector store, so the
+ * correlation is not an attribution. `fanoutTop` turns it into one.
+ *
+ * ## And the burn-in that has been running forever
+ *
+ * `event-bus-core.ts:310` states the procedure in its own words: *"Recommended
+ * first fleet-wide enable: `shadow` on both, watch the suppressed counters
+ * (`getMoleculerEventStats` / `getChildEventStats`), then flip to `filter` once
+ * burn-in shows zero would-be-starved deliveries."*
+ *
+ * The hub runs with `CAMSTACK_MOLECULER_EVENT_FANOUT=shadow` — which computes
+ * the drop decision, counts the would-suppresses and **still delivers every
+ * event** — and **neither counter has ever had a production caller**: both
+ * functions are reachable only from barrel re-exports and unit tests. So the
+ * burn-in has no end condition, and the promotion to `filter` never happened
+ * because the evidence that would authorise it was never surfaced. This module
+ * surfaces it. It changes no default and flips no env: the promotion stays a
+ * one-env decision for the operator, and it now has a number behind it.
+ *
+ * Read the modes with the counts, always. A suppressed count of 0 means
+ * "nothing would have been dropped" under `shadow` and "nothing WAS dropped"
+ * under `filter`, and those are different claims. A count printed without its
+ * regime is unreadable, and the regime is read ONCE at construction — invisible
+ * at runtime until now.
+ *
+ * ## The fail-open nobody can see
+ *
+ * A child that never declares its pattern set (`eventPatterns === null`,
+ * `local-child-registry.ts:170`) makes the per-child gate fail OPEN, and per
+ * `setNodeEventInterest` ANY undeclared child makes the whole node's inbound
+ * cross-node gate fail open too. **One legacy runner silently disables the
+ * filtering on both planes**, and nothing reported it. `childrenUndeclared` is
+ * printed even at zero for the same reason `largeObjectSpace=0MB` is: absence
+ * must never be ambiguous.
+ *
+ * ## Deltas, never totals
+ *
+ * Both registries count cumulatively for the life of the process. A cumulative
+ * number on a heartbeat answers "how much since boot", which nobody asked; the
+ * question is "which peer receives the 22 500 writes/s", and that is a rate. So
+ * the meter is read ONCE PER LINE and reports the window since the previous read
+ * — the same discipline the loop-delay histogram already follows, for the same
+ * reason.
+ *
+ * ## What this is NOT evidence of
+ *
+ * `shadow` is the CROSS-NODE plane. The local UDS plane defaults to `filter` and
+ * its env is unset, so it is filtering. hub-main's ~44 000 socket syscalls/s are
+ * mostly to LOCAL runners, so the shadow mode is a real defect and is **not**
+ * established as the source of that load. Do not read these two facts as one.
+ */
+/** Fan-out regime for one plane. Same three values on both. */
+export type EventFanoutMode = 'filter' | 'shadow' | 'broadcast';
+/** One child's fan-out counters, as the registry keeps them (cumulative). */
+export interface ChildFanoutSample {
+    readonly childId: string;
+    readonly sent: number;
+    readonly suppressed: number;
+}
+/** One child's fan-out over the window since the previous read. */
+export interface ChildFanoutDelta {
+    readonly childId: string;
+    readonly sent: number;
+    readonly suppressed: number;
+}
+/** What `LocalChildRegistry` exposes, structurally — the kernel's heartbeat
+ *  must not depend on the transport layer's class. */
+export interface ChildFanoutRegistryChild {
+    readonly childId: string;
+}
+export interface ChildFanoutRegistryStats {
+    readonly sent: number;
+    readonly suppressed: number;
+}
+export interface ChildFanoutRegistry {
+    readonly listChildren: () => readonly ChildFanoutRegistryChild[];
+    readonly getChildEventStats: (childId: string) => ChildFanoutRegistryStats | null;
+    readonly undeclaredChildCount: () => number;
+    readonly eventFanoutMode: EventFanoutMode;
+}
+/** What `getMoleculerEventStats` returns, structurally. */
+export interface CrossNodeEventStats {
+    readonly delivered: number;
+    readonly suppressed: number;
+}
+/** One cumulative reading of both planes. */
+export interface EventPlaneCounters {
+    readonly udsMode: EventFanoutMode;
+    readonly crossNodeMode: EventFanoutMode;
+    readonly children: readonly ChildFanoutSample[];
+    readonly childrenConnected: number;
+    readonly childrenUndeclared: number;
+    readonly crossNodeDelivered: number;
+    readonly crossNodeSuppressed: number;
+}
+/** `undefined` = this process has no event plane to report (every forked
+ *  runner, and hub-main before the registry exists). */
+export type EventPlaneReader = () => EventPlaneCounters | undefined;
+/** Where a reader gets each part. Every one is late-bound, because the
+ *  heartbeat starts before any of them exist. */
+export interface EventPlaneSources {
+    readonly registry: () => ChildFanoutRegistry | null;
+    readonly crossNodeStats: () => CrossNodeEventStats | null;
+    readonly crossNodeMode: () => EventFanoutMode;
+}
+/**
+ * Build a reader over the two registries.
+ *
+ * Returns `undefined` until the child registry exists — the heartbeat starts as
+ * the FIRST statement of `bootstrap()` (a process that dies early still leaves
+ * samples) and `LocalChildRegistry` is built hundreds of lines later inside
+ * `MoleculerService.onModuleInit`. Printing zeros in that window would report a
+ * silent plane where there is no plane at all.
+ *
+ * Wrapped: a registry mid-teardown may throw, and a diagnostic that can crash
+ * the process it watches is worse than none.
+ */
+export declare function createEventPlaneReader(sources: EventPlaneSources): EventPlaneReader;
+/**
+ * How many children get named on the line.
+ *
+ * Five, because the question is which peer DOMINATES and the measured
+ * distribution is not flat: one peer accounted for 78–82% of outbound bytes and
+ * the runner-up for ~6%. Five names the dominant peer, its challenger and enough
+ * of the tail to see the shape change; naming all ~38 would put a kilobyte-long
+ * line in the hub's shared log every minute, which is how a log stops being read.
+ */
+export declare const EVENT_PLANE_TOP_N = 5;
+/** Both planes over one heartbeat window. */
+export interface EventPlaneWindow {
+    readonly udsMode: EventFanoutMode;
+    readonly crossNodeMode: EventFanoutMode;
+    readonly childrenConnected: number;
+    readonly childrenUndeclared: number;
+    readonly fanoutSent: number;
+    readonly fanoutSuppressed: number;
+    readonly crossNodeDelivered: number;
+    readonly crossNodeSuppressed: number;
+    /** Largest `sent` first, at most {@link EVENT_PLANE_TOP_N} entries. */
+    readonly top: readonly ChildFanoutDelta[];
+}
+/** Previous cumulative reading, kept between lines. */
+export interface EventPlaneBaseline {
+    readonly children: ReadonlyMap<string, ChildFanoutSample>;
+    readonly crossNodeDelivered: number;
+    readonly crossNodeSuppressed: number;
+}
+/** A process that has never read a plane. */
+export declare const EMPTY_EVENT_PLANE_BASELINE: EventPlaneBaseline;
+/**
+ * Subtract the previous cumulative reading from the current one.
+ *
+ * A child that RESTARTED has counters that went backwards — the registry keys by
+ * childId and a respawned runner reconnects under the same id with a fresh
+ * entry. Clamping at 0 reports the restart as a quiet window rather than as a
+ * negative rate: the window's traffic is genuinely unknown, and a negative
+ * number on a rate reads as a broken meter.
+ */
+export declare function diffEventPlane(baseline: EventPlaneBaseline, current: EventPlaneCounters, topN?: number): EventPlaneWindow;
+/** Reads the delta since the PREVIOUS read. Same contract as the loop meter. */
+export interface EventPlaneMeter {
+    readonly read: () => EventPlaneWindow | undefined;
+}
+export declare function createEventPlaneMeter(reader: EventPlaneReader, topN?: number): EventPlaneMeter;
+/**
+ * The suffix appended to a `[mem]` line — leading space included, empty when
+ * this process has no event plane.
+ *
+ * Only two processes in the cluster have one (hub-main, and an agent's main), so
+ * these fields never appear on the ~38 runner lines that share the same log
+ * stream. On the two that do, every field is printed on every line INCLUDING at
+ * zero: the modes because a suppressed count without its regime is unreadable,
+ * `childrenUndeclared` because one undeclared child silently disables both
+ * gates, and the deltas because "the plane went quiet for a minute" is a
+ * reading, not a blank.
+ *
+ * `fanoutTop` is the one conditional field — a ranked list of nothing is noise —
+ * and it is a single comma-separated value so the field COUNT does not change
+ * from line to line: `childId:sent/suppressed`, largest first.
+ */
+export declare function formatEventPlane(window: EventPlaneWindow | undefined): string;

package/dist/kernel/heap-spaces.d.ts

@@ -0,0 +1,138 @@
+import { HeapWatchSink } from './heap-watch.js';
+/** One V8 space, as V8 names it, with the bytes it is holding. */
+export interface HeapSpaceUsage {
+    /** V8's own `space_name`, e.g. `old_space`. Never renamed here. */
+    readonly name: string;
+    readonly usedBytes: number;
+}
+/** A reading of every space. Injectable so a test can pose a known heap state. */
+export type HeapSpaceReader = () => readonly HeapSpaceUsage[];
+/**
+ * The two spaces that ANSWER the question, printed always — including at zero.
+ *
+ * Node 24 reports thirteen spaces (measured on 24.17: `read_only_space`,
+ * `new_space`, `old_space`, `code_space`, `shared_space`, `trusted_space`,
+ * `shared_trusted_space`, `new_large_object_space`, `large_object_space`,
+ * `code_large_object_space`, `shared_large_object_space`,
+ * `shared_trusted_large_object_space`, `trusted_large_object_space`). Printing
+ * all thirteen once a minute per process would add ~13 fields to a line that
+ * already carries eleven, on every runner, forever — and eleven of the thirteen
+ * cannot be the answer to a 1.4 GB retained-set question.
+ *
+ * These two are printed unconditionally because **absence must never be
+ * ambiguous**. A threshold-only rule would drop `large_object_space` at 20 MB,
+ * and a reader would not be able to tell "small" from "this build does not
+ * report it" — which is the same class of mistake as a heartbeat with no
+ * destination (D285). `largeObjectSpace=0MB` is a load-bearing reading: it says
+ * the retainer is NOT a handful of huge objects.
+ */
+export declare const DECISIVE_HEAP_SPACES: readonly string[];
+/**
+ * A non-decisive space is printed only once it holds at least this many MB.
+ *
+ * 32 MB, and the number comes from the smallest heap this line is ever asked to
+ * explain: the control in the 2026-08-29 pass is an idle `recorder` runner at
+ * **52 MB** of `heapUsed`. A threshold below that means no space that could
+ * dominate even the smallest watched process is ever hidden, while a quiet
+ * process — measured on a bare Node 24.17: `new_space` 0.7 MB, `code_space`
+ * 0.25 MB, `trusted_space` 0.9 MB — prints nothing but the decisive pair.
+ *
+ * What this drops, and why it is right to drop it: `new_space` is the scavenger's
+ * semi-space and is bounded by `--max-semi-space-size`, so it can never be a
+ * retained set; `code_space` and `read_only_space` are JIT output and V8's own
+ * immutable roots, both bounded by the code that exists rather than by the data
+ * it touches; the `shared_*` spaces are empty outside a worker-threads
+ * deployment, which this cluster does not run. None of them has ever been the
+ * answer to "what is this process holding", and each would cost a field on
+ * every `[mem]` line in the fleet.
+ *
+ * They are not censored, though — a space over the threshold prints, whatever it
+ * is. If `code_space` ever reaches 32 MB that is itself the finding.
+ */
+export declare const HEAP_SPACE_REPORT_MIN_MB = 32;
+/**
+ * Read every space from V8.
+ *
+ * Wrapped: a diagnostic that can crash the process it watches is worse than
+ * none, and this is called from a heartbeat whose whole contract is that it
+ * survives whatever it is measuring. An empty reading prints no fields, which
+ * is exactly what a heartbeat that could not read the heap should say.
+ */
+export declare function readHeapSpaces(): readonly HeapSpaceUsage[];
+/**
+ * `old_space` → `oldSpace`. Mechanical and total, so a space V8 adds tomorrow
+ * gets a field name without anyone editing a table.
+ *
+ * camelCase because that is the vocabulary of every other field on this line
+ * (`heapUsed`, `heapTotal`, `arrayBuffers`, `rssBudget`, `loopP99`). A line that
+ * mixed `heapUsed=` with `old_space=` would be two conventions for one record.
+ */
+export declare function heapSpaceField(v8Name: string): string;
+/**
+ * The spaces worth a field on this line: the decisive pair (in that order,
+ * always), then every other space at or above `minMb`, largest first.
+ *
+ * Largest-first for the tail because the tail only ever appears when something
+ * unexpected is holding memory, and the biggest surprise should be the first
+ * thing read. The decisive pair keeps a FIXED position so the two numbers a
+ * reader is comparing are always in the same place on every line.
+ */
+export declare function selectReportedSpaces(spaces: readonly HeapSpaceUsage[], minMb?: number): readonly HeapSpaceUsage[];
+/**
+ * The suffix appended to a `[mem]` line — leading space included, empty when
+ * there is nothing to say.
+ *
+ * APPENDED, never interleaved: every existing field keeps its name AND its
+ * position, so a `hl loki-query` pipeline written against the old line still
+ * matches. Prefix stability is the only change to a log line that cannot break
+ * a query someone already wrote.
+ */
+export declare function formatHeapSpaces(spaces: readonly HeapSpaceUsage[], minMb?: number): string;
+/**
+ * Env var that authorises a heap snapshot on SIGUSR2.
+ *
+ * A snapshot is an admin mutation on a production hub: `writeHeapSnapshot`
+ * streams a file the size of the heap to `/tmp` and stops the world while it
+ * walks it — on the recorder that is a multi-GB file and a stall measured in
+ * seconds. The per-space breakdown is ~1.2 µs and changes nothing. Welding them
+ * to one signal priced the free answer at the cost of the expensive one.
+ */
+export declare const RUNNER_HEAP_SNAPSHOT_ENV = "CAMSTACK_RUNNER_HEAP_SNAPSHOT";
+/**
+ * Whether the operator has authorised the snapshot half of SIGUSR2.
+ *
+ * Explicit `'on'` only. Anything else — unset, empty, `'true'`, `'1'` — is NOT
+ * authorisation: a multi-GB stop-the-world write must never be reachable by a
+ * value someone set for a different purpose.
+ */
+export declare function heapSnapshotAuthorised(env?: NodeJS.ProcessEnv): boolean;
+/** What a diagnostic report is ABOUT. */
+export interface HeapDiagnosticRequest {
+    /** The runner's nodeId, so the line groups with its `[mem]` heartbeat. */
+    readonly label: string;
+    readonly addons: readonly string[];
+    readonly sink: HeapWatchSink;
+    /** Where a snapshot would be written, if one is authorised. */
+    readonly snapshotPath: string;
+}
+/** Everything the report READS. Injected so the split itself is testable. */
+export interface HeapDiagnosticDeps {
+    readonly readMemory: () => NodeJS.MemoryUsage;
+    readonly readSpaces: HeapSpaceReader;
+    readonly writeSnapshot: (path: string) => void;
+    readonly env: NodeJS.ProcessEnv;
+}
+/**
+ * The SIGUSR2 report — memory + the FULL per-space breakdown, always; the
+ * snapshot only when {@link heapSnapshotAuthorised}.
+ *
+ * The breakdown here keeps every non-empty space at 0.1 MB, unlike the
+ * heartbeat's filtered whole-MB pair: this is a hand-fired diagnostic read once
+ * by a human who asked for it, so completeness costs nothing. The heartbeat runs
+ * unattended on every runner forever, so it pays for every field it prints.
+ *
+ * A refused snapshot SAYS SO. A branch that drops work silently reads as "it was
+ * never requested", and this one is fired by an operator who is standing there
+ * waiting for a file.
+ */
+export declare function emitHeapDiagnosticReport(request: HeapDiagnosticRequest, deps?: HeapDiagnosticDeps): void;