@traffic-twin/sdk 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,172 @@
-# Temporary Holding Version
+# @traffic-twin/sdk (Node.js)
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+SDK di cattura di traffic-twin per Node.js ≥ 20. Osserva le chiamate HTTP in ingresso e in
+uscita del processo, le **sanifica nel processo** secondo la policy firmata (specifica
+`docs/spec/sanitizer.md` v1.1.1) e invia a `tt-core` solo forme, token HMAC e valori
+ammessi dalla policy, come log OTLP/HTTP JSON su mTLS.
+
+- **Zero dipendenze a runtime**: solo la libreria standard di Node. Nessun pacchetto
+  `@opentelemetry/*` tra le dipendenze.
+- **Non modifica il traffico dell'app**: nessun `traceparent` iniettato; l'unica eccezione,
+  opzionale e decisa dalla policy, è il membro di baggage `tt.s` verso gli host di
+  `sampling.propagate_to` (mai verso un host esterno della policy).
+- **Fail-closed**: senza policy valida, chiave HMAC o primo heartbeat non cattura nulla;
+  l'app continua a funzionare normalmente. Senza chiave HMAC lo stato è `key_missing` (mai
+  `no_policy`) e l'SDK lo scrive sempre su stderr, anche senza `TT_DEBUG`, con la causa. La
+  chiave è un file dell'installazione distribuito dal team piattaforma (stesso kid di
+  `hmac.kid` della policy, stessa chiave di keyguard): vedi [docs/USER_GUIDE.md](https://github.com/ivseb/traffic-twin/blob/main/docs/USER_GUIDE.md) §4.
+- ESM e CommonJS (`dist/esm`, `dist/cjs`).
+
+## Avvio senza codice
+
+```bash
+npm install @traffic-twin/sdk          # o, finché non è nel registro: npm install ./traffic-twin-sdk-x.y.z.tgz
+TT_ENROLL_URL=https://tt-core.internal:4318 \
+TT_ENROLL_TOKEN=tte_… \
+TT_HMAC_KEY_FILE=/run/secrets/tt-hmac-key \
+TT_SERVICE_NAME=shop-api \
+  node --import @traffic-twin/sdk/register app.js
+```
+
+Per le app CommonJS si può usare anche `node --require @traffic-twin/sdk/register app.js`.
+Gli hook si installano subito; iscrizione, heartbeat e download della policy avvengono in
+background e non ritardano l'avvio dell'app.
+
+| Variabile | Significato |
+|---|---|
+| `TT_ENROLL_URL` | URL del listener Fleet/intake di `tt-core` (sempre `https`) |
+| `TT_ENROLL_TOKEN` | Token di iscrizione `tte_<segreto>.<impronta CA>`, monouso o di gruppo |
+| `TT_HMAC_KEY` / `TT_HMAC_KEY_FILE` | Chiave HMAC locale, una o più righe `<kid>:<base64url>` (§7.1). Non viaggia mai verso `tt-core` |
+| `TT_SERVICE_NAME` | Nome di servizio richiesto all'iscrizione (altrimenti `OTEL_SERVICE_NAME` in minuscolo). Il nome usato negli eventi è quello **assegnato** da `tt-core` |
+| `TT_STATE_DIR` | Cartella dello stato locale (default `~/.traffic-twin/<id>`): certificato, chiave privata, CA, policy firmata, interruttore. Cartella `0700`, file `0600` |
+| `TT_ENROLL_CSR` | `0` per chiedere la chiave a `tt-core` invece di generare una CSR (default: CSR ECDSA P-256, la chiave privata non esce dal processo) |
+| `TT_SANITIZER_THREADS` | Thread di sanificazione (`worker_threads`). Default: `min(2, core − 1)`, usati solo quando il campionamento della policy è ≥ 2 % (sotto, si sanifica nel thread principale: costa meno che svegliare un thread). `0` = sempre nel thread principale |
+| `TT_DISABLED` | `1` disattiva completamente l'SDK |
+| `TT_DEBUG` | `1` scrive su stderr solo codici di stato ed errore (mai valori) |
+| `TT_HEARTBEAT_INTERVAL_MS`, `TT_POLICY_POLL_INTERVAL_MS`, `TT_EXPORT_FLUSH_MS` | Solo per test: sostituiscono gli intervalli ricevuti da `tt-core` |
+
+## API programmatica
+
+```js
+import { start, stop, current } from '@traffic-twin/sdk';
+
+const agent = await start({
+  enrollUrl: 'https://tt-core.internal:4318',
+  enrollToken: process.env.TT_ENROLL_TOKEN,
+  hmacKeyFile: '/run/secrets/tt-hmac-key',
+  serviceName: 'shop-api',
+});
+console.log(agent.status()); // { state: 'capturing', counters: {...}, queue: {...} }
+```
+
+`start()` non lancia mai eccezioni ed è idempotente (un solo agente per processo, anche se
+l'app carica sia la build ESM sia quella CommonJS). La funzione di test dei vettori
+(`runVector`, `parseVector`) e il sanitizer (`Sanitizer`, `Policy`) sono esportati.
+
+## Cosa viene catturato
+
+| Direzione | Punto di aggancio | Corpo |
+|---|---|---|
+| Ingresso | `diagnostics_channel` `http.server.request.start` / `http.server.response.finish` (node:http, node:https, Express e framework basati su node:http) | richiesta: copia dei byte già de-chunkati dal parser; risposta: copia di `write`/`end` |
+| Uscita, node:http(s) | `http.client.request.created` (o `start` su Node meno recenti), `http.client.response.finish`, `http.client.request.error` | come sopra |
+| Uscita, `fetch`/undici | canali `undici:request:*` | `bodyChunkSent` / `bodyChunkReceived` (byte ancora codificati: la decodifica gzip/deflate la fa il sanitizer) |
+
+Gli unici "wrapper" sono installati sugli **oggetti** richiesta/risposta degli scambi
+campionati (`push`, `write`, `end`): sono sincroni, non cambiano argomenti, valori di
+ritorno né tempi, e non aggiungono listener `error` (che cambierebbero la gestione degli
+errori dell'app). Il resto (normalizzazione, sanificazione, serializzazione, invio) avviene
+dopo la risposta, a blocchi di pochi millisecondi con `setImmediate`.
+
+Contesto: un `AsyncLocalStorage` lega le chiamate in uscita allo scambio in ingresso (stesso
+`trace_id`, campionamento ereditato). Il `traceparent` in ingresso viene letto; se l'app usa
+OpenTelemetry, l'SDK carica `@opentelemetry/api` **dall'albero dell'app** e ne legge solo il
+contesto attivo, senza mai registrare provider, propagatori o context manager.
+
+Sanificazione fuori dal thread delle richieste: con campionamento ≥ 2 % gli scambi
+catturati vengono raggruppati (≈ 8 ms) e inviati a uno o due thread di lavoro, che producono
+direttamente i `logRecord` OTLP già pronti; il thread principale esegue solo la copia dei
+byte, il `postMessage` e l'invio. Il risultato è identico byte per byte a quello
+dell'esecuzione nel thread principale (`test/unit/worker.test.mjs`); se un thread muore si
+torna alla sanificazione in linea e gli scambi in volo vengono contati come scartati. Misure
+e metodo: `BENCHMARKS.md`.
+
+Pressione: code limitate (2 000 scambi da sanificare, 10 000 eventi / 16 MiB da inviare);
+quando sono piene si scartano gli eventi più vecchi e si contano, l'app non aspetta mai.
+Invio a lotti (≤ 512 eventi, ≤ 4 MiB), ripetizioni con attesa esponenziale e `Retry-After`
+su 429/502/503/504 ed errori di rete.
+
+### Host non dichiarati e scoperta automatica (spec v1.5)
+
+Un host esterno che nessuna `base` della policy né `segments.hosts_allow` elenca non esce
+più come `host:unlisted`: con `hosts.discovery: auto` (default, anche quando il campo
+`hosts` manca) il `service` dell'evento è `host:` + **pattern** (sanitizer.md §3.5). Il
+pattern è l'host in minuscolo, senza porta di default e senza un punto finale, in cui ogni
+etichetta resta letterale solo se è `^[a-z][a-z0-9-]{0,62}$`, non ha sei cifre consecutive
+né dodici esadecimali consecutivi, altrimenti diventa `{*}` (`t-3912345678.tenant.example` →
+`host:{*}.tenant.example`). I letterali IP escono solo come `ip:private` / `ip:public`
+(tabella chiusa di §3.6, con parser IPv6 proprio: nessuna funzione di libreria), con la porta
+se non di default; un'etichetta vuota dà `host:invalid`. L'host è passato al sanitizer così
+come lo vede il client (IPv6 tra parentesi, nessun IDN, nessun punto tolto).
+
+`hosts.discovery: off` è la **modalità stretta**: gli host non dichiarati escono come
+`host:unlisted`, byte per byte come prima della v1.5. Lo imposta la policy (`tt-core`, la
+chiusura `auto` → `off` e l'apertura `off` → `auto` sono approvate come per ogni policy);
+l'SDK non ha opzioni locali. Il dominio registrabile e la cardinalità delle etichette sono
+controlli di `tt-core` (zona B): l'SDK non li implementa.
+
+### Codici alfanumerici, XML/SOAP, multipart, documenti e corpi grandi (spec v1.19)
+
+L'SDK implementa la v1.19 del sanitizer (sanitizer.md §5.6 e §22; vettori 2200–2453):
+
+- `{"action":"code","shape":"alnum"}`: codici con cifre e punti, `^[A-Za-z0-9_.-]{1,16}$`
+  entro `keep_max_bytes`; le guardie H1/H2 la trattano come `code`.
+- L'oggetto `bodies` della policy (assente = tutto spento, uscita identica alle versioni precedenti):
+  `xml` analizza i corpi XML e SOAP con un lettore scritto a mano, sottoinsieme rigoroso di
+  XML 1.0 (`src/sanitizer/bodies.ts`: nessuna libreria XML, nessuna DTD né entità oltre le
+  cinque predefinite, al massimo 256 elementi annidati) e aggiunge `fmt`, `xmlns` e
+  `soap_action`; `multipart` analizza `multipart/form-data` (le parti file escono solo come
+  `drop:file:<tipo>:<classe>`); `docs` dà la forma `drop:doc:<tipo>:<classe>` alle stringhe
+  che sono il base64 di un documento; `max_large_body_bytes`, `large_array` e
+  `large_nested_array` attivano la modalità «corpo grande».
+- Con `max_large_body_bytes` > 0 la cattura (ingresso, `http`/`https` e `fetch`/undici in
+  uscita) conserva `max(max_body_bytes, max_large_body_bytes) + 1` byte di ogni corpo
+  campionato invece di `max_body_bytes + 1`.
+
+## Fleet
+
+- Iscrizione con token: prima connessione TLS senza fiducia, verifica che la radice della
+  catena presentata da `tt-core` abbia l'impronta SHA-256 contenuta nel token, poi richiesta
+  di iscrizione con quella radice come unica CA. Certificato e chiave restano nello stato
+  locale e si riusano ai riavvii.
+- Heartbeat **prima** di qualsiasi cattura; interruttore di emergenza, revoca e
+  `min_issued_seq` sono salvati e restano validi dopo un riavvio.
+- Policy: firma Ed25519 su `"tt.policy.body/v1" || 0x00 || corpo` con chiavi fissate e non
+  revocate, schema completo del corpo, coerenza busta/corpo, gruppo, `not_after`,
+  `issued_seq` crescente e ≥ `min_issued_seq`. Una policy rifiutata non sostituisce mai la
+  precedente valida. Nuove chiavi di firma solo se approvate da una chiave già fissata.
+
+## Limiti noti
+
+- Versioni: Node ≥ 20; il corpo completo delle risposte di `fetch` solo da Node ≥ 24.
+  Node 20 e 22: il corpo delle risposte di `fetch` non è visibile (i canali `bodyChunk*` di
+  undici mancano) e l'evento riporta `trunc:size`; per le richieste node:http create e
+  chiuse prima dell'assegnazione del socket il corpo risulta di lunghezza ignota.
+- `framework_route` si passa solo per Express e solo per le route definite direttamente
+  sull'app (senza router montati, il cui prefisso non è ricostruibile come template);
+  altrimenti valgono i template della policy (§3.3 punto 2).
+- HTTP/2 (`node:http2`) non è ancora agganciato.
+
+- **SDK oppure tt-egress per ogni chiamata in uscita.** Se l'app chiama un servizio esterno attraverso [tt-egress](https://github.com/ivseb/traffic-twin/blob/main/internal/egress/README.md), l'SDK registra anche il salto verso il proxy (servizio `host:…`) e la chiamata è catturata due volte. Non mettere l'indirizzo del proxy in `hosts_allow`; la Fleet segnala `double_capture` quando lo vede.
+
+## Sviluppo
+
+```bash
+npm ci
+npm run vectors     # vettori di conformità (conformance/vectors), confronto byte per byte
+npm test            # unit test + integrazione (app, carrier finto, tt-core finto con mTLS)
+node bench/hooks.mjs  # costo del solo percorso degli hook (opz. --subject none|cookie|jwt, --out 1)
+npm run bench       # overhead con SDK spento/acceso (opzioni: --rate-bp, --steady-rps, --seconds, --rounds, --threads, --endpoint orders|health, --io-ms)
+```
+
+Le dipendenze di sviluppo (TypeScript, `@types/node`, OpenTelemetry per il test di
+convivenza) sono fissate a versioni esatte.

package/dist/cjs/agent.d.ts

@@ -0,0 +1,143 @@
+import type { CaptureHost, RawExchange } from './capture/common.js';
+import { Sanitizer } from './sanitizer/sanitizer.js';
+export type SourceState = 'starting' | 'capturing' | 'no_policy' | 'policy_rejected' | 'expired_policy' | 'key_missing' | 'key_mismatch' | 'killed';
+export interface AgentOptions {
+    /** Fleet base URL used for enrollment (TT_ENROLL_URL). */
+    enrollUrl?: string;
+    /** Enrollment token `tte_<secret>.<pin>` (TT_ENROLL_TOKEN). */
+    enrollToken?: string;
+    /** Content of the HMAC key (TT_HMAC_KEY). */
+    hmacKey?: string;
+    /** File holding the HMAC key (TT_HMAC_KEY_FILE). */
+    hmacKeyFile?: string;
+    /** Service name requested at enrollment (TT_SERVICE_NAME, else OTEL_SERVICE_NAME). */
+    serviceName?: string;
+    /** Where certificates, keys and the policy cache are kept (TT_STATE_DIR). */
+    stateDir?: string;
+    /** Informational instance name (TT_INSTANCE, default hostname). */
+    instance?: string;
+    /** Send a CSR at enrollment so the private key never leaves the process (default true). */
+    useCsr?: boolean;
+    debug?: boolean;
+    /** Overrides for tests and benchmarks. */
+    heartbeatIntervalMs?: number;
+    policyPollIntervalMs?: number;
+    exportFlushMs?: number;
+    /** Sanitizer worker threads: 0 = always inline, default min(2, cores - 1) (TT_SANITIZER_THREADS). */
+    sanitizerThreads?: number;
+    /** Sampling rate (basis points) from which sanitization moves to the workers (default 200 = 2%). */
+    workerMinBp?: number;
+}
+export declare function serviceNameFromEnv(env: NodeJS.ProcessEnv): string | undefined;
+export declare function optionsFromEnv(env?: NodeJS.ProcessEnv): AgentOptions;
+export declare class Agent implements CaptureHost {
+    readonly opts: AgentOptions;
+    readonly counters: {
+        exchanges_seen: number;
+        exchanges_sampled: number;
+        events_sent: number;
+        events_dropped_queue: number;
+        events_rejected: number;
+        send_errors: number;
+        sanitizer_errors: number;
+    };
+    state: SourceState;
+    private san;
+    private policy;
+    private policyKid;
+    private rejected;
+    private ring;
+    private keyState;
+    private heartbeatOk;
+    private lastContact;
+    private persisted;
+    private overrideBp;
+    private decisionNames;
+    private readonly overhead;
+    private overheadN;
+    private lastErrors;
+    private pending;
+    private pendingBytes;
+    private drainScheduled;
+    private pool;
+    /** The last drain handed its work to the workers: the next one is batched on a timer. */
+    private workerMode;
+    private inflight;
+    private inflightBytes;
+    private uninstall;
+    private timers;
+    private stopped;
+    private store;
+    private enrollment;
+    private keyPem;
+    private httpsAgent;
+    private fleet;
+    private exporter;
+    private etag;
+    private switching;
+    private acceptedHashes;
+    private polling;
+    private pollAgain;
+    constructor(opts: AgentOptions);
+    active(): Sanitizer | null;
+    serviceName(): string;
+    decisionHeaders(): ReadonlySet<string>;
+    propagates(): boolean;
+    mayPropagate(urlBase: string): boolean;
+    private propMemoFor;
+    private readonly propMemo;
+    private mayPropagateUncached;
+    noteSeen(): void;
+    noteSampled(): void;
+    noteOverhead(ns: number): void;
+    noteError(code: string): void;
+    submit(raw: RawExchange): void;
+    private threads;
+    /** Worker threads pay off only when many exchanges are sampled (high rate). */
+    private wantWorkers;
+    private onWorkerOut;
+    /**
+     * Inline sanitization runs right after the response (setImmediate). With worker threads
+     * the exchanges are collected for a few milliseconds and posted as one batch: one message
+     * and one thread wake-up for many exchanges instead of one each.
+     */
+    private scheduleDrain;
+    private drain;
+    /** Posts up to WORKER_BATCH pending exchanges to a worker. False when none could be posted. */
+    private drainToWorkers;
+    private process;
+    /** Installs the hooks and runs the first Fleet cycle. Never throws. */
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    /** Sanitizes what is pending and sends everything queued (tests, graceful shutdown). */
+    flush(): Promise<void>;
+    status(): {
+        state: SourceState;
+        counters: Agent['counters'];
+        queue: {
+            events: number;
+            bytes: number;
+        };
+    };
+    private enrollWithRetry;
+    private connect;
+    private schedule;
+    private loadKeys;
+    /** Said once per cause, whatever TT_DEBUG: without the key nothing is captured. Never prints key material or paths. */
+    private keyWarned;
+    private warnKeyMissing;
+    private signingKeys;
+    private persist;
+    private tryAccept;
+    private pollPolicy;
+    private pollOnce;
+    private overheadUs;
+    private heartbeat;
+    private applyHeartbeat;
+    private addSigningKeys;
+    private renew;
+    private revoke;
+    private dropQueues;
+    /** Recomputes the state and the capture gate. */
+    private recompute;
+}