@camstack/system 1.2.354 → 1.2.356

package/dist/kernel/event-plane-report.d.ts

@@ -22,27 +22,13 @@
  * on that runner also counts page-cache reads and it owns a vector store, so the
  * correlation is not an attribution. `fanoutTop` turns it into one.
  *
- * ## And the burn-in that has been running forever
- *
- * `event-bus-core.ts:310` states the procedure in its own words: *"Recommended
- * first fleet-wide enable: `shadow` on both, watch the suppressed counters
- * (`getMoleculerEventStats` / `getChildEventStats`), then flip to `filter` once
- * burn-in shows zero would-be-starved deliveries."*
- *
- * The hub runs with `CAMSTACK_MOLECULER_EVENT_FANOUT=shadow` — which computes
- * the drop decision, counts the would-suppresses and **still delivers every
- * event** — and **neither counter has ever had a production caller**: both
- * functions are reachable only from barrel re-exports and unit tests. So the
- * burn-in has no end condition, and the promotion to `filter` never happened
- * because the evidence that would authorise it was never surfaced. This module
- * surfaces it. It changes no default and flips no env: the promotion stays a
- * one-env decision for the operator, and it now has a number behind it.
- *
- * Read the modes with the counts, always. A suppressed count of 0 means
- * "nothing would have been dropped" under `shadow` and "nothing WAS dropped"
- * under `filter`, and those are different claims. A count printed without its
- * regime is unreadable, and the regime is read ONCE at construction — invisible
- * at runtime until now.
+ * ## Both planes always filter
+ *
+ * The cross-node plane ran a `shadow` burn-in (`CAMSTACK_MOLECULER_EVENT_FANOUT`)
+ * with no end condition, and the UDS plane carried the same three-mode switch
+ * (`CAMSTACK_UDS_EVENT_FANOUT`). Both switches were removed on 2026-10-06: a
+ * suppressed count now always means "this many WERE dropped", and the line no
+ * longer prints a regime because there is only one.
  *
  * ## The fail-open nobody can see
  *
@@ -81,16 +67,7 @@
  * `fanoutOrphans` counts what was serialised and walked across every child with
  * zero subscribers. A suppressed pair was measured at **255 ns** — 1.84 ms/s of
  * event loop at this rate — so the filter is not the cost; the emit is.
- *
- * ## What this is NOT evidence of
- *
- * `shadow` is the CROSS-NODE plane. The local UDS plane defaults to `filter` and
- * its env is unset, so it is filtering. hub-main's ~44 000 socket syscalls/s are
- * mostly to LOCAL runners, so the shadow mode is a real defect and is **not**
- * established as the source of that load. Do not read these two facts as one.
  */
-/** Fan-out regime for one plane. Same three values on both. */
-export type EventFanoutMode = 'filter' | 'shadow' | 'broadcast';
 /** One child's fan-out counters, as the registry keeps them (cumulative). */
 export interface ChildFanoutSample {
     readonly childId: string;
@@ -127,7 +104,6 @@ export interface ChildFanoutRegistry {
     readonly listChildren: () => readonly ChildFanoutRegistryChild[];
     readonly getChildEventStats: (childId: string) => ChildFanoutRegistryStats | null;
     readonly undeclaredChildCount: () => number;
-    readonly eventFanoutMode: EventFanoutMode;
     readonly categoryFanout: () => readonly CategoryFanoutSample[];
     readonly categoryCensusOverflow: () => number;
 }
@@ -138,8 +114,6 @@ export interface CrossNodeEventStats {
 }
 /** One cumulative reading of both planes. */
 export interface EventPlaneCounters {
-    readonly udsMode: EventFanoutMode;
-    readonly crossNodeMode: EventFanoutMode;
     readonly children: readonly ChildFanoutSample[];
     readonly childrenConnected: number;
     readonly childrenUndeclared: number;
@@ -156,7 +130,6 @@ export type EventPlaneReader = () => EventPlaneCounters | undefined;
 export interface EventPlaneSources {
     readonly registry: () => ChildFanoutRegistry | null;
     readonly crossNodeStats: () => CrossNodeEventStats | null;
-    readonly crossNodeMode: () => EventFanoutMode;
 }
 /**
  * Build a reader over the two registries.
@@ -183,8 +156,6 @@ export declare function createEventPlaneReader(sources: EventPlaneSources): Even
 export declare const EVENT_PLANE_TOP_N = 5;
 /** Both planes over one heartbeat window. */
 export interface EventPlaneWindow {
-    readonly udsMode: EventFanoutMode;
-    readonly crossNodeMode: EventFanoutMode;
     readonly childrenConnected: number;
     readonly childrenUndeclared: number;
     readonly fanoutSent: number;

package/dist/kernel/fs-utils.d.ts

@@ -26,8 +26,7 @@ export declare function copyDirRecursive(src: string, dest: string): Promise<voi
  * `addons/` stays node_modules-free, which is what lets the backup tar the whole
  * folder with no exclusion list (see ADR-0027). An addon that genuinely needs an
  * un-bundleable runtime dep declares it explicitly in
- * `camstack.runtimeDependencies`; the debug escape hatch
- * `CAMSTACK_INSTALL_FULL_DEPS=1` restores the legacy install-everything path.
+ * `camstack.runtimeDependencies`.
  *
  * (Historically this mirrored the build preset's COMMON_NATIVE_DEPS and
  * per-addon-installed node-av/sharp/onnxruntime-node/ssh2/werift/systeminformation
@@ -49,9 +48,6 @@ export declare const RUNTIME_NATIVE_KEEP: readonly string[];
  * `dependencies` so `--omit=peer` installs can't drop them (pipeline's
  * patched `werift`).
  *
- * Escape hatch: `CAMSTACK_INSTALL_FULL_DEPS=1` restores the legacy behaviour
- * (strip only @camstack/*) for debugging a suspected undeclared runtime dep.
- *
  * Returns a new object (immutable).
  */
 export declare function stripBundledDeps(pkg: Record<string, unknown>): Record<string, unknown>;

package/dist/kernel/heap-spaces.d.ts

@@ -88,22 +88,6 @@ export declare function selectReportedSpaces(spaces: readonly HeapSpaceUsage[],
  * a query someone already wrote.
  */
 export declare function formatHeapSpaces(spaces: readonly HeapSpaceUsage[], minMb?: number): string;
-/**
- * Env var that authorises a heap snapshot on SIGUSR2.
- *
- * A snapshot is an admin mutation on a production hub: `writeHeapSnapshot`
- * streams a file the size of the heap to `/tmp` and stops the world while it
- * walks it — on the recorder that is a multi-GB file and a stall measured in
- * seconds. The per-space breakdown is ~1.2 µs and changes nothing. Welding them
- * to one signal priced the free answer at the cost of the expensive one.
- */
-/**
- * Whether the operator has authorised the snapshot half of SIGUSR2.
- *
- * Explicit `'on'` only. Anything else — unset, empty, `'true'`, `'1'` — is NOT
- * authorisation: a multi-GB stop-the-world write must never be reachable by a
- * value someone set for a different purpose.
- */
 /** What a diagnostic report is ABOUT. */
 export interface HeapDiagnosticRequest {
     /** The runner's nodeId, so the line groups with its `[mem]` heartbeat. */
@@ -115,19 +99,14 @@ export interface HeapDiagnosticRequest {
 export interface HeapDiagnosticDeps {
     readonly readMemory: () => NodeJS.MemoryUsage;
     readonly readSpaces: HeapSpaceReader;
-    readonly env: NodeJS.ProcessEnv;
 }
 /**
- * The SIGUSR2 report — memory + the FULL per-space breakdown, always; the
- * snapshot NEVER — see the note in the body.
+ * The SIGUSR2 report — memory + the FULL per-space breakdown; never a heap
+ * snapshot (D718) — see the note in the body.
  *
  * The breakdown here keeps every non-empty space at 0.1 MB, unlike the
  * heartbeat's filtered whole-MB pair: this is a hand-fired diagnostic read once
  * by a human who asked for it, so completeness costs nothing. The heartbeat runs
  * unattended on every runner forever, so it pays for every field it prints.
- *
- * A refused snapshot SAYS SO. A branch that drops work silently reads as "it was
- * never requested", and this one is fired by an operator who is standing there
- * waiting for a file.
  */
 export declare function emitHeapDiagnosticReport(request: HeapDiagnosticRequest, deps?: HeapDiagnosticDeps): void;

package/dist/kernel/index.d.ts

@@ -45,8 +45,6 @@ export { createCoreCapService, CORE_CAP_SERVICE_NAME } from './moleculer/core-ca
 export type { CoreCapAction, CoreCapCallOrigin, CoreCapServiceOptions, } from './moleculer/core-cap-service.js';
 export { createAddonContext, createUdsAddonContext, setHubConnected, adaptBrokerToCluster, registerEventBusService, setNodeEventInterest, getMoleculerEventStats, subscribePassthrough, getBrokerEventBus, clusterEventTopic, EVENT_TOPIC_PREFIX, } from './moleculer/addon-context-factory.js';
 export type { MoleculerEventStats } from './moleculer/addon-context-factory.js';
-export type { MoleculerEventFanoutMode } from './moleculer/event-bus-core.js';
-export { readMoleculerFanoutMode } from './moleculer/event-bus-core.js';
 export { HubLogForwarder } from './moleculer/hub-log-forwarder.js';
 export type { AddonContextOptions } from './moleculer/addon-context-factory.js';
 export { createHubService } from './moleculer/hub-service.js';

package/dist/kernel/moleculer/event-bus-core.d.ts

@@ -142,31 +142,12 @@ export declare const RING_BUFFER_DENY_PATTERNS: readonly string[];
 export declare const MAX_RECENT_EVENTS = 1000;
 export declare function isHighFrequencyCategory(category: string): boolean;
 /**
- * Fan-out mode for cross-node (Moleculer) event delivery, read from the
- * `CAMSTACK_MOLECULER_EVENT_FANOUT` env. The inter-node analogue of the
- * intra-host `CAMSTACK_UDS_EVENT_FANOUT` gate (`local-child-registry.ts`):
- *   - `filter`    (default) — drop an inbound cross-node event whose category
- *     no local subscriber on THIS node wants (the union of its children's
- *     declared patterns).
- *   - `shadow`    — compute the drop decision + count would-suppresses, but
- *     STILL deliver every event (burn-in: prove zero would-be-starved deliveries
- *     before flipping to `filter`).
- *   - `broadcast` — ignore the gate entirely (pre-D2 behaviour).
- *
- * ROLLBACK CONTRACT (operators, read this): this env governs ONLY the inter-node
- * (Moleculer) gate. The intra-host UDS fan-out has a SEPARATE, independent
- * kill-switch, `CAMSTACK_UDS_EVENT_FANOUT` (see `local-child-registry.ts`). A
- * FULL rollback to pre-D2 / pre-#44 delivery therefore requires BOTH env vars
- * set to `broadcast` AND a process restart on EVERY node (hub + all agents) —
- * each is read ONCE at registration/construction, so a running process will not
- * pick up a change. Flipping only one leg leaves the other filtering and yields
- * inconsistent behaviour. Recommended first fleet-wide enable: `shadow` on both,
- * watch the suppressed counters (`getMoleculerEventStats` /
- * `getChildEventStats`), then flip to `filter` once burn-in shows zero
- * would-be-starved deliveries.
+ * Cross-node (Moleculer) inbound gate: an inbound cross-node event whose
+ * category no local subscriber on THIS node wants (the union of its children's
+ * declared patterns) is dropped and counted (`suppressed`). It always filters —
+ * the `CAMSTACK_MOLECULER_EVENT_FANOUT` shadow/broadcast modes were removed on
+ * 2026-10-06; the intra-host analogue is `LocalChildRegistry.childWantsEvent`.
  */
-export type MoleculerEventFanoutMode = 'filter' | 'shadow' | 'broadcast';
-export declare function readMoleculerFanoutMode(): MoleculerEventFanoutMode;
 /**
  * A node's inbound-interest snapshot used by {@link crossNodeAcceptsCategory}.
  *  - `retainRecent` — the receiving bus retains events for `getRecent`/audit
@@ -185,16 +166,13 @@ export interface CrossNodeInterestSnapshot {
 /**
  * Does this node want to accept an inbound cross-node event in `category`?
  * The receiving-side mirror of `LocalChildRegistry.childWantsEvent`:
- *   - `broadcast` mode → always (gate disabled).
  *   - a retaining bus (hub main) → always (it serves `getRecent` + admin-ui;
  *     its interest is genuinely everything).
  *   - undeclared interest (`null`) → always (fail-open).
  *   - else the declared union must match via `matchesPattern` — the SAME
  *     function the local subscriber map-key gate uses, giving delivery parity.
- * `shadow` is handled by the caller (it counts the would-suppress but still
- * delivers), exactly like the UDS fan-out.
  */
-export declare function crossNodeAcceptsCategory(mode: MoleculerEventFanoutMode, snapshot: CrossNodeInterestSnapshot, category: string): boolean;
+export declare function crossNodeAcceptsCategory(snapshot: CrossNodeInterestSnapshot, category: string): boolean;
 /**
  * Deliver `event` to all matching local subscribers and — ONLY on a bus that
  * opted into retention (`state.retainRecent`, i.e. the hub main process) and

package/dist/kernel/moleculer/process-service.d.ts

@@ -95,9 +95,8 @@ export declare const HEAVY_MAX_OLD_MB_DEFAULT = 1024;
  *   --v8-pool-size=2    9 threads
  *   --v8-pool-size=0   18 threads
  *
- * So a value below 1 omits the flag entirely rather than being passed through —
- * the same trap as `MALLOC_ARENA_MAX=0` in `runner-native-allocator.ts`. To turn
- * the tuning off, use `CAMSTACK_RUNNER_HEAP_TUNING=off`.
+ * So the flag is only ever passed with a value of at least 1 — the same trap as
+ * `MALLOC_ARENA_MAX=0` in `runner-native-allocator.ts`.
  *
  * ## What is deliberately NOT bounded
  *
@@ -110,8 +109,6 @@ export declare const HEAVY_MAX_OLD_MB_DEFAULT = 1024;
  * ~58 more threads for serialized filesystem I/O in runners whose I/O profile
  * has not been measured, on a media system. A thread saving is not worth a
  * media gap.
- *
- * Override: `CAMSTACK_RUNNER_LIGHT_V8_POOL_SIZE`.
  */
 export declare const LIGHT_V8_POOL_SIZE_DEFAULT = 2;
 interface SpawnedProcess {

package/dist/kernel/moleculer/runner-native-allocator.d.ts

@@ -85,12 +85,7 @@ export interface RunnerNativeAllocatorEnv {
  *      restores the glibc/sharp defaults. Recoverable without a rebuild.
  *   2. A value the operator already put in the environment (`MALLOC_ARENA_MAX`,
  *      `VIPS_CONCURRENCY`) — inherited verbatim, never overwritten.
- *   3. `CAMSTACK_RUNNER_MALLOC_ARENA_MAX` — the CamStack override.
- *   4. The defaults above.
- *
- * A nonsense override falls back to the default rather than being passed through:
- * glibc reads `MALLOC_ARENA_MAX=0` as "unbounded", which is the very state this
- * exists to leave.
+ *   3. The defaults above.
  */
 export declare function runnerNativeAllocatorEnv(parentEnv: NodeJS.ProcessEnv, platform?: NodeJS.Platform): RunnerNativeAllocatorEnv;
 /**

package/dist/kernel/transport/index.d.ts

@@ -10,7 +10,7 @@ export { PeerAnsweredError } from './peer-answered-error.js';
 export { UdsLocalTransportServer, UdsLocalTransportClient } from './uds-local-transport.js';
 export { createLocalTransport } from './create-local-transport.js';
 export type { ChildCapDescriptor, RegisterMessage, ChildLogMessage, ChildEventMessage, ChildToParentRequest, CapCallMessage, CapCallInput, CapCallOutMessage, AddonCallMessage, AddonCallInput, AddonCallTarget, AddonSettingsMethod, ParentToChildRequest, RegisteredChild, SetLogLevelMessage, } from './child-cap-protocol.js';
-export { LocalChildRegistry, afterWorkerOnlineAnnounce, UDS_NO_ROUTE_PREFIX } from './local-child-registry.js';
+export { LocalChildRegistry, afterWorkerOnlineAnnounce, UDS_NO_ROUTE_PREFIX, } from './local-child-registry.js';
 export type { LocalChildRegistryOptions, LocalChildRegistryLogger, ChildLifecycleEvents, } from './local-child-registry.js';
 export type { LocalChildClientOptions, AddonCallHandler } from './local-child-client.js';
 export { LocalChildClient } from './local-child-client.js';

package/dist/kernel/transport/local-child-registry.d.ts

@@ -29,17 +29,6 @@ export interface ForwardCensus {
  * check.
  */
 export declare const PRE_REGISTER_PEER_ID = "(pre-register)";
-/**
- * Fan-out mode for parent→child event delivery, from the
- * `CAMSTACK_UDS_EVENT_FANOUT` env (read once at registry construction):
- *   - `filter`    (default) — apply the subscription gate; a child receives a
- *     category only if one of its declared patterns matches.
- *   - `shadow`    — compute the gate decision + count would-suppresses, but
- *     STILL send every event (burn-in: prove zero would-be-starved deliveries).
- *   - `broadcast` — ignore the gate entirely (today's behaviour); the operator's
- *     one-env rollback without redeploying runners.
- */
-export type UdsEventFanoutMode = 'filter' | 'shadow' | 'broadcast';
 /** Per-child event fan-out counters (sent = delivered, suppressed = gated/would-gate). */
 export interface ChildEventStats {
     sent: number;
@@ -56,8 +45,7 @@ export interface ChildEventStats {
  * sums them concludes the cluster emits an order of magnitude more than it does.
  *
  * `wanted` is the number of (event × child) pairs whose SUBSCRIPTION matched —
- * the gate answer, not the delivery answer, so `broadcast`/`shadow` mode (which
- * deliver regardless) still report the truth. `wanted === 0` over a window means
+ * the gate answer, which is also the delivery answer. `wanted === 0` over a window means
  * the category was serialised and walked across every child and **nobody asked
  * for it**: pure waste, and the one finding worth acting on.
  */
@@ -340,8 +328,6 @@ export declare class LocalChildRegistry {
     private readonly capUsageObserver?;
     /** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
     private readonly egressRoutedCaps;
-    /** Active event fan-out mode, read once from `CAMSTACK_UDS_EVENT_FANOUT`. */
-    private readonly fanoutMode;
     /** Per-child event fan-out counters (sent / suppressed). */
     private readonly childEventStats;
     /** D467: per-category production census (cumulative). See {@link CategoryFanoutSample}. */
@@ -374,7 +360,7 @@ export declare class LocalChildRegistry {
     /**
      * Per-child event fan-out counters (`{ sent, suppressed }`) or `null` if the
      * child has no recorded events yet. Exposed for the starvation-verification
-     * surface (shadow burn-in + operator debug).
+     * surface (operator debug).
      */
     getChildEventStats(childId: string): ChildEventStats | null;
     /**
@@ -420,16 +406,6 @@ export declare class LocalChildRegistry {
      * `decoded` half of an entry, next to the bytes it carried.
      */
     readActionCensus(): CapActionReading;
-    /**
-     * The regime the counters above were produced under, read once from
-     * `CAMSTACK_UDS_EVENT_FANOUT` at construction.
-     *
-     * A suppressed count means "nothing WAS dropped" under `filter` and "nothing
-     * WOULD have been dropped" under `shadow`. Those are different claims, and
-     * until this getter existed the mode was invisible at runtime — the counters
-     * were readable and the regime that produced them was not.
-     */
-    get eventFanoutMode(): UdsEventFanoutMode;
     /**
      * Connected children that never declared a subscription pattern set.
      *
@@ -443,27 +419,18 @@ export declare class LocalChildRegistry {
      */
     undeclaredChildCount(): number;
     /**
-     * Does `entry` want to receive an event in `category`? Honours the fan-out
-     * mode: `broadcast` → always; undeclared patterns (`null`) → always
-     * (fail-open); else the child's declared set must match via `matchesPattern`
-     * — the SAME function the child's own `deliverShared` map-key gate uses,
-     * giving provable delivery parity. `shadow` is handled by the caller (it
-     * counts the would-suppress but still sends).
+     * Does `entry` want to receive an event in `category`? Undeclared patterns
+     * (`null`) → always (fail-open, counted by {@link undeclaredChildCount});
+     * else the child's declared set must match via `matchesPattern` — the SAME
+     * function the child's own `deliverShared` map-key gate uses, giving provable
+     * delivery parity. The parent always filters: the `CAMSTACK_UDS_EVENT_FANOUT`
+     * shadow/broadcast modes were removed on 2026-10-06.
      *
      * NOTE: this gate must NOT consult `RING_BUFFER_DENY_PATTERNS` /
      * `isHighFrequencyCategory` — those are ring-buffer STORAGE policy; a child
      * that explicitly subscribes to a ring-denied category must still RECEIVE it.
      */
     private childWantsEvent;
-    /**
-     * The SUBSCRIPTION answer alone, with no fan-out-mode override.
-     *
-     * {@link childWantsEvent} answers "will this child be sent the event", which
-     * under `broadcast` is `true` for everything and therefore cannot say whether
-     * anyone actually asked. The D467 census needs the second question, so the
-     * two are separate functions and `broadcast` mode overrides only the first.
-     */
-    private childSubscribesTo;
     /**
      * D2: this node's aggregate cross-node event interest — the UNION of every
      * connected child's declared category patterns. Consumed by the parent's

package/dist/kernel/transport/uds-event-bridge.d.ts

@@ -7,8 +7,8 @@ import { IEventBus, SystemEvent } from '@camstack/types';
  * fans an event only to children whose declared category-pattern set matches
  * `event.category` (mirror of each child's local `SharedBusState.handlers`
  * keys). A child that never declared a set (legacy/undeclared) fails OPEN and
- * receives everything. The `CAMSTACK_UDS_EVENT_FANOUT` env (`filter` default /
- * `shadow` / `broadcast`) is the registry-side kill-switch. The bridge itself
+ * receives everything. There is no kill-switch any more (the
+ * `CAMSTACK_UDS_EVENT_FANOUT` modes were removed on 2026-10-06). The bridge itself
  * needs no per-event logic change — both fan-out call sites here go through the
  * filtered `broadcastEventToChildren`. `sendEventToChild` (targeted push) is
  * NOT filtered — an explicit single-child send expresses intent.

package/dist/{retired-settings-keys-BTKZdPn6.js → retired-settings-keys-CRlTzxaS.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DePB7uwU.js");
+const require_dist = require("./dist-CFVOy8VT.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-DFur4hJF.mjs → retired-settings-keys-DKRjfz0U.mjs}

@@ -1,4 +1,4 @@
-import { ir as asJsonObject } from "./dist-DVyXxn41.mjs";
+import { ar as asJsonObject } from "./dist-B7WRgEZY.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.354",
+  "version": "1.2.356",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",

package/dist/kernel/heap-allocation-sample.d.ts

@@ -1,107 +0,0 @@
-/**
- * WHERE the bytes come from, without stopping the process.
- *
- * A heap SNAPSHOT answers "what is retained" and costs a stop-the-world walk
- * plus a multi-gigabyte write. On this hub that took the machine down twice;
- * the second attempt did not even finish — it left a 0-byte file and an
- * unresponsive host that had to be rebooted. The remotely-triggerable command
- * is gone (`scripts/check-no-heap-dump-command.ts`).
- *
- * V8's SAMPLING heap profiler answers a cheaper, different question: which
- * allocation SITES the bytes came from, statistically, with no pause and
- * nothing written. Measured locally: 51 ms for a window that allocated 200 000
- * objects.
- *
- * ## What this is NOT
- *
- * It is not retention analysis. It says where bytes were BORN, not what is
- * holding them alive, and a leak is about the second. It is still the right
- * first instrument for the recorder's ~900 MB of large objects that "no
- * allocation site in its tree can produce" — because naming the sites is
- * exactly the claim under test, and if the sites turn out to be ordinary, the
- * retention question is the one that survives.
- *
- * This module is the PURE half: it folds the profile V8 hands back. The
- * sampling belongs to the caller, so the fold is testable without a profiler.
- */
-/** One frame as the inspector protocol reports it. */
-export interface AllocationCallFrame {
-    readonly functionName: string;
-    readonly url: string;
-    readonly lineNumber: number;
-}
-/** One node of `HeapProfiler.stopSampling`'s profile tree. */
-export interface AllocationProfileNode {
-    readonly selfSize: number;
-    readonly callFrame: AllocationCallFrame;
-    readonly children?: readonly AllocationProfileNode[];
-}
-export interface AllocationSite {
-    readonly functionName: string;
-    /** `file.js:line` — what a human reads in a log line. */
-    readonly site: string;
-    readonly bytes: number;
-}
-/**
- * Fold the tree into the biggest allocation sites.
- *
- * Sites are SUMMED across call paths: one site reached from two callers is one
- * site, and reporting it twice at half the size is how a dominant allocator
- * hides in a long tail. Identity is (function, url, line) — the same line of
- * two files is two sites.
- */
-export declare function summariseAllocationProfile(head: AllocationProfileNode, limit: number): readonly AllocationSite[];
-/**
- * The inspector session slice this needs. Injected so the sampler is testable
- * without an inspector, and so nothing here reaches for a global.
- */
-export interface HeapProfilerSession {
-    connect: () => void;
-    disconnect: () => void;
-    post: (method: string, paramsOrCb: unknown, maybeCb?: unknown) => void;
-}
-export interface SampleHeapAllocationsInput {
-    readonly session: HeapProfilerSession;
-    /** How long to sample. Bounded by the caller; this module never loops. */
-    readonly durationMs: number;
-    readonly limit: number;
-    readonly wait: (ms: number) => Promise<void>;
-    /** Bytes between samples. Larger = cheaper and coarser. */
-    readonly samplingInterval?: number;
-}
-/**
- * Sample allocations for a bounded window and answer with the top sites.
- *
- * Writes NOTHING and pauses nothing. The profiler is stopped and the session
- * disconnected in a `finally`, because a sampler left running is a tax on the
- * process that outlives whoever enabled it — and the failure that made this
- * module necessary was a diagnostic nobody could turn off from outside.
- */
-export declare function sampleHeapAllocations(input: SampleHeapAllocationsInput): Promise<readonly AllocationSite[]>;
-/**
- * Per-runner opt-in for allocation sampling.
- *
- * Explicit `'on'` only — the same discipline the snapshot flag had. The
- * DIFFERENCE is what it authorises: that flag allowed a stop-the-world walk and
- * a multi-gigabyte write, so leaving it on in production (which is exactly what
- * happened) was an outage waiting for a signal. This one allows ~50 ms of
- * statistical sampling and one log line, so a runner left with it on is simply
- * a runner that reports where its bytes come from.
- */
-export declare const RUNNER_ALLOC_SAMPLE_ENV = "CAMSTACK_RUNNER_ALLOC_SAMPLE";
-export declare function allocationSamplingEnabled(env?: NodeJS.ProcessEnv): boolean;
-/** Sample on every Nth heartbeat — one sample per ~10 minutes at a 60 s beat. */
-export declare const ALLOCATION_SAMPLE_EVERY_N_BEATS = 10;
-/** How long one sample runs. Short enough that two can never overlap. */
-export declare const ALLOCATION_SAMPLE_WINDOW_MS = 5000;
-/** How many sites one log line carries. */
-export declare const ALLOCATION_SAMPLE_TOP_N = 8;
-/**
- * Is this the beat that samples?
- *
- * Beat 0 never samples: a runner that has just booted has allocated nothing
- * worth ranking. A non-positive cadence samples NEVER rather than always — a
- * misconfigured `0` must not turn a diagnostic into a permanent load, which is
- * the failure mode this whole module exists because of.
- */
-export declare function shouldSampleAllocations(beat: number, everyN: number): boolean;