@camstack/system 1.2.415 → 1.2.417

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvarXqQt.js");
-const require_tls = require("../../tls-BWpwU-d5.js");
+const require_dist = require("../../dist-BMOD9OyH.js");
+const require_tls = require("../../tls-C0TRPfqc.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");
@@ -337,6 +337,163 @@ function parseIpv6Groups(address) {
 	];
 }
 //#endregion
+//#region src/builtins/local-network/hub-mdns.ts
+/**
+* Hub mDNS advertisement (D838) — how `camstack login` / `camstack discover`
+* find a hub on the LAN.
+*
+* The hub publishes ONE `_camstack._tcp` service for its HTTPS endpoint. There
+* is no mesh channel in it (D826 retired mesh UDP discovery on purpose) and
+* nothing secret: the TXT record carries the node id, the version, the role
+* and the address URL — finding a hub grants nothing, every client still signs
+* in.
+*
+* The advertised address is NOT ranked here. It is the `internal` role of the
+* address book (the address flagged for LAN clients, else the automatic LAN
+* pick) — this module only reads the answer `local-network` already gives.
+*
+* The responder is injected so the logic is tested with a fake; the real one
+* wraps `@homebridge/ciao`.
+*/
+/** The announcement for the current address, or null when nothing qualifies. */
+function buildHubAnnouncement(inputs) {
+	if (inputs.internalUrl === null) return null;
+	let url;
+	try {
+		url = new URL(inputs.internalUrl);
+	} catch {
+		return null;
+	}
+	if (url.protocol !== "https:") return null;
+	const port = url.port === "" ? 443 : Number.parseInt(url.port, 10);
+	if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
+	const host = url.hostname.replace(/^\[|\]$/g, "");
+	const txt = {
+		[require_dist.HUB_MDNS_TXT_KEYS.nodeId]: inputs.nodeId,
+		[require_dist.HUB_MDNS_TXT_KEYS.role]: "hub",
+		[require_dist.HUB_MDNS_TXT_KEYS.url]: url.origin
+	};
+	if (inputs.version !== null) txt[require_dist.HUB_MDNS_TXT_KEYS.version] = inputs.version;
+	return {
+		name: `camstack-${inputs.nodeId}`,
+		type: require_dist.HUB_MDNS_SERVICE_TYPE,
+		port,
+		address: (0, node_net.isIP)(host) !== 0 ? host : null,
+		txt
+	};
+}
+function announcementKey(a) {
+	return JSON.stringify([
+		a.name,
+		a.type,
+		a.port,
+		a.address,
+		a.txt
+	]);
+}
+/**
+* Keeps one mDNS service in step with the hub's `internal` address. `sync()`
+* is safe to call on any change; it never throws — a failure to advertise is
+* logged and the boot goes on.
+*/
+var HubMdnsAdvertiser = class {
+	options;
+	current = null;
+	running = false;
+	chain = Promise.resolve();
+	constructor(options) {
+		this.options = options;
+	}
+	async start() {
+		this.running = true;
+		await this.sync();
+	}
+	/** Re-read the address and re-announce when it changed. Serialised. */
+	sync() {
+		this.chain = this.chain.then(() => this.syncOnce());
+		return this.chain;
+	}
+	async stop() {
+		this.running = false;
+		await (this.chain = this.chain.then(() => this.withdraw()));
+	}
+	async syncOnce() {
+		if (!this.running) return;
+		const { logger } = this.options;
+		try {
+			const internalUrl = await this.options.readInternalUrl();
+			const next = buildHubAnnouncement({
+				nodeId: this.options.nodeId,
+				version: this.options.version,
+				internalUrl
+			});
+			if (next === null) {
+				if (this.current !== null) {
+					await this.withdraw();
+					logger.info("hub mDNS: no internal address, advertisement withdrawn");
+				}
+				return;
+			}
+			const key = announcementKey(next);
+			if (this.current?.key === key) return;
+			await this.withdraw();
+			const handle = await this.options.publisher.publish(next);
+			this.current = {
+				key,
+				handle
+			};
+			logger.info("hub mDNS: advertising _camstack._tcp", { meta: {
+				url: next.txt[require_dist.HUB_MDNS_TXT_KEYS.url],
+				port: next.port
+			} });
+		} catch (err) {
+			logger.warn("hub mDNS: could not advertise the hub (logins still work with --server)", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
+	async withdraw() {
+		const held = this.current;
+		this.current = null;
+		if (held === null) return;
+		try {
+			await held.handle.stop();
+		} catch (err) {
+			this.options.logger.warn("hub mDNS: withdraw failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
+};
+/**
+* The address a hub advertises: the `internal` role's answer, exactly as the
+* address book resolved it. Never re-ranked here (D729, D732).
+*/
+function internalUrlOf(book) {
+	return book.roles.internal.resolved;
+}
+//#endregion
+//#region src/builtins/local-network/hub-mdns-ciao.ts
+function createCiaoPublisher() {
+	return { async publish(announcement) {
+		const { getResponder } = await Promise.resolve().then(() => /* @__PURE__ */ require_chunk.__toESM(require("../../lib-DOJ5yyWA.js").default));
+		const responder = getResponder();
+		const service = responder.createService({
+			name: announcement.name,
+			type: announcement.type,
+			port: announcement.port,
+			txt: { ...announcement.txt },
+			...announcement.address !== null ? { restrictedAddresses: [announcement.address] } : {}
+		});
+		try {
+			await service.advertise();
+		} catch (err) {
+			await responder.shutdown().catch(() => void 0);
+			throw err;
+		}
+		return { stop: async () => {
+			await service.destroy();
+			await responder.shutdown();
+		} };
+	} };
+}
+//#endregion
 //#region src/builtins/local-network/local-hostname.ts
 var DNS_NAME = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])$/;
 /**
@@ -419,6 +576,7 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	* `null` when no mesh provider is joined.
 	*/
 	meshEndpoint = null;
+	mdns = null;
 	constructor() {
 		super({
 			allowedAddresses: [],
@@ -430,7 +588,8 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			httpPort: require_tls.DEFAULT_LAN_HTTP_PORT,
 			localHostname: "",
 			internalUrl: "",
-			publicEndpointUrl: ""
+			publicEndpointUrl: "",
+			mdnsAdvertise: true
 		});
 	}
 	/**
@@ -481,6 +640,7 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			customAddresses: changed.custom
 		}, detectedUrls);
 		await this.updateGlobalSettings(addressBookPatch(after));
+		await this.mdns?.sync();
 	}
 	/** The deprecated `getHubAddresses` shape, from the role resolvers. */
 	async snapshotHubAddresses() {
@@ -716,6 +876,7 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		} catch (err) {
 			this.ctx.logger.warn("local-network: LAN HTTP not applied at boot", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		}
+		await this.applyMdnsAdvertisement();
 		return [{
 			capability: require_dist.localNetworkCapability,
 			provider
@@ -749,6 +910,14 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 						equals: true
 					}
 				}),
+				this.field({
+					type: "boolean",
+					key: "mdnsAdvertise",
+					label: "Announce this hub on the LAN (mDNS)",
+					description: "Lets `camstack login` find the hub without an address. Advertises only the HTTPS address, never a secret. Needs UDP 5353 multicast to reach the LAN (host networking or a dedicated container IP).",
+					style: "switch",
+					default: true
+				}),
 				this.field({
 					type: "text",
 					key: "localHostname",
@@ -762,8 +931,29 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	}
 	async onConfigChanged() {
 		await this.applyLanAccessFromSettings();
+		await this.applyMdnsAdvertisement();
+	}
+	/**
+	* Start, re-announce or stop the hub's mDNS service (D838). Never throws:
+	* the advertiser logs its own failures and boot goes on.
+	*/
+	async applyMdnsAdvertisement() {
+		if (this.config.mdnsAdvertise === false) {
+			await this.mdns?.stop();
+			return;
+		}
+		if (this.mdns === null) this.mdns = new HubMdnsAdvertiser({
+			publisher: createCiaoPublisher(),
+			logger: this.ctx.logger,
+			nodeId: this.ctx.kernel.localNodeId ?? "hub",
+			version: null,
+			readInternalUrl: async () => internalUrlOf(await this.addressBook("https"))
+		});
+		await this.mdns.start();
 	}
 	async onShutdown() {
+		await this.mdns?.stop();
+		this.mdns = null;
 		if (this.pollTimer) {
 			clearInterval(this.pollTimer);
 			this.pollTimer = null;
@@ -959,6 +1149,7 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		} });
 		this.lastSnapshotKey = key;
 		this.persistReconciledAllowlist(interfaces);
+		this.mdns?.sync();
 		this.ctx.eventBus?.emit({
 			id: `local-network-changed-${Date.now()}`,
 			timestamp: /* @__PURE__ */ new Date(),

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,6 @@
-import { Bt as isDefaultAppConnectionEndpoint, Dn as resolveNotificationTapAddress, Lt as isAppLinkBase, Wn as validateCustomAddress, Xt as localNetworkCapability, bn as resolveAppConnections, dr as BaseAddon, pn as pickAppLinkHub, ri as EventCategory, rt as checkRoleAddress, s as CAMSTACK_APP_LINK_ORIGIN, wn as resolveHubAddressRoles } from "../../dist-dEsHYY8m.mjs";
-import { P as readLanHttpState, _ as writeExtraSans, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readTlsAccessStatus, n as regenerateCertificate, p as readExtraSans, r as revertToGeneratedCertificate, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, y as ensureTlsCert } from "../../tls-C2NT-Orr.mjs";
+import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
+import { D as HUB_MDNS_TXT_KEYS, E as HUB_MDNS_SERVICE_TYPE, Gn as validateCustomAddress, Ht as isDefaultAppConnectionEndpoint, On as resolveNotificationTapAddress, Qt as localNetworkCapability, Tn as resolveHubAddressRoles, at as checkRoleAddress, fr as BaseAddon, mn as pickAppLinkHub, ri as EventCategory, s as CAMSTACK_APP_LINK_ORIGIN, xn as resolveAppConnections, zt as isAppLinkBase } from "../../dist-H_RapIeM.mjs";
+import { P as readLanHttpState, _ as writeExtraSans, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readTlsAccessStatus, n as regenerateCertificate, p as readExtraSans, r as revertToGeneratedCertificate, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, y as ensureTlsCert } from "../../tls-D-2dPY-5.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os from "node:os";
@@ -334,6 +335,163 @@ function parseIpv6Groups(address) {
 	];
 }
 //#endregion
+//#region src/builtins/local-network/hub-mdns.ts
+/**
+* Hub mDNS advertisement (D838) — how `camstack login` / `camstack discover`
+* find a hub on the LAN.
+*
+* The hub publishes ONE `_camstack._tcp` service for its HTTPS endpoint. There
+* is no mesh channel in it (D826 retired mesh UDP discovery on purpose) and
+* nothing secret: the TXT record carries the node id, the version, the role
+* and the address URL — finding a hub grants nothing, every client still signs
+* in.
+*
+* The advertised address is NOT ranked here. It is the `internal` role of the
+* address book (the address flagged for LAN clients, else the automatic LAN
+* pick) — this module only reads the answer `local-network` already gives.
+*
+* The responder is injected so the logic is tested with a fake; the real one
+* wraps `@homebridge/ciao`.
+*/
+/** The announcement for the current address, or null when nothing qualifies. */
+function buildHubAnnouncement(inputs) {
+	if (inputs.internalUrl === null) return null;
+	let url;
+	try {
+		url = new URL(inputs.internalUrl);
+	} catch {
+		return null;
+	}
+	if (url.protocol !== "https:") return null;
+	const port = url.port === "" ? 443 : Number.parseInt(url.port, 10);
+	if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
+	const host = url.hostname.replace(/^\[|\]$/g, "");
+	const txt = {
+		[HUB_MDNS_TXT_KEYS.nodeId]: inputs.nodeId,
+		[HUB_MDNS_TXT_KEYS.role]: "hub",
+		[HUB_MDNS_TXT_KEYS.url]: url.origin
+	};
+	if (inputs.version !== null) txt[HUB_MDNS_TXT_KEYS.version] = inputs.version;
+	return {
+		name: `camstack-${inputs.nodeId}`,
+		type: HUB_MDNS_SERVICE_TYPE,
+		port,
+		address: isIP(host) !== 0 ? host : null,
+		txt
+	};
+}
+function announcementKey(a) {
+	return JSON.stringify([
+		a.name,
+		a.type,
+		a.port,
+		a.address,
+		a.txt
+	]);
+}
+/**
+* Keeps one mDNS service in step with the hub's `internal` address. `sync()`
+* is safe to call on any change; it never throws — a failure to advertise is
+* logged and the boot goes on.
+*/
+var HubMdnsAdvertiser = class {
+	options;
+	current = null;
+	running = false;
+	chain = Promise.resolve();
+	constructor(options) {
+		this.options = options;
+	}
+	async start() {
+		this.running = true;
+		await this.sync();
+	}
+	/** Re-read the address and re-announce when it changed. Serialised. */
+	sync() {
+		this.chain = this.chain.then(() => this.syncOnce());
+		return this.chain;
+	}
+	async stop() {
+		this.running = false;
+		await (this.chain = this.chain.then(() => this.withdraw()));
+	}
+	async syncOnce() {
+		if (!this.running) return;
+		const { logger } = this.options;
+		try {
+			const internalUrl = await this.options.readInternalUrl();
+			const next = buildHubAnnouncement({
+				nodeId: this.options.nodeId,
+				version: this.options.version,
+				internalUrl
+			});
+			if (next === null) {
+				if (this.current !== null) {
+					await this.withdraw();
+					logger.info("hub mDNS: no internal address, advertisement withdrawn");
+				}
+				return;
+			}
+			const key = announcementKey(next);
+			if (this.current?.key === key) return;
+			await this.withdraw();
+			const handle = await this.options.publisher.publish(next);
+			this.current = {
+				key,
+				handle
+			};
+			logger.info("hub mDNS: advertising _camstack._tcp", { meta: {
+				url: next.txt[HUB_MDNS_TXT_KEYS.url],
+				port: next.port
+			} });
+		} catch (err) {
+			logger.warn("hub mDNS: could not advertise the hub (logins still work with --server)", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
+	async withdraw() {
+		const held = this.current;
+		this.current = null;
+		if (held === null) return;
+		try {
+			await held.handle.stop();
+		} catch (err) {
+			this.options.logger.warn("hub mDNS: withdraw failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
+};
+/**
+* The address a hub advertises: the `internal` role's answer, exactly as the
+* address book resolved it. Never re-ranked here (D729, D732).
+*/
+function internalUrlOf(book) {
+	return book.roles.internal.resolved;
+}
+//#endregion
+//#region src/builtins/local-network/hub-mdns-ciao.ts
+function createCiaoPublisher() {
+	return { async publish(announcement) {
+		const { getResponder } = await import("../../lib-B_R6sPC3.mjs").then((m) => /* @__PURE__ */ __toESM(m.default));
+		const responder = getResponder();
+		const service = responder.createService({
+			name: announcement.name,
+			type: announcement.type,
+			port: announcement.port,
+			txt: { ...announcement.txt },
+			...announcement.address !== null ? { restrictedAddresses: [announcement.address] } : {}
+		});
+		try {
+			await service.advertise();
+		} catch (err) {
+			await responder.shutdown().catch(() => void 0);
+			throw err;
+		}
+		return { stop: async () => {
+			await service.destroy();
+			await responder.shutdown();
+		} };
+	} };
+}
+//#endregion
 //#region src/builtins/local-network/local-hostname.ts
 var DNS_NAME = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])$/;
 /**
@@ -416,6 +574,7 @@ var LocalNetworkAddon = class extends BaseAddon {
 	* `null` when no mesh provider is joined.
 	*/
 	meshEndpoint = null;
+	mdns = null;
 	constructor() {
 		super({
 			allowedAddresses: [],
@@ -427,7 +586,8 @@ var LocalNetworkAddon = class extends BaseAddon {
 			httpPort: DEFAULT_LAN_HTTP_PORT,
 			localHostname: "",
 			internalUrl: "",
-			publicEndpointUrl: ""
+			publicEndpointUrl: "",
+			mdnsAdvertise: true
 		});
 	}
 	/**
@@ -478,6 +638,7 @@ var LocalNetworkAddon = class extends BaseAddon {
 			customAddresses: changed.custom
 		}, detectedUrls);
 		await this.updateGlobalSettings(addressBookPatch(after));
+		await this.mdns?.sync();
 	}
 	/** The deprecated `getHubAddresses` shape, from the role resolvers. */
 	async snapshotHubAddresses() {
@@ -713,6 +874,7 @@ var LocalNetworkAddon = class extends BaseAddon {
 		} catch (err) {
 			this.ctx.logger.warn("local-network: LAN HTTP not applied at boot", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		}
+		await this.applyMdnsAdvertisement();
 		return [{
 			capability: localNetworkCapability,
 			provider
@@ -746,6 +908,14 @@ var LocalNetworkAddon = class extends BaseAddon {
 						equals: true
 					}
 				}),
+				this.field({
+					type: "boolean",
+					key: "mdnsAdvertise",
+					label: "Announce this hub on the LAN (mDNS)",
+					description: "Lets `camstack login` find the hub without an address. Advertises only the HTTPS address, never a secret. Needs UDP 5353 multicast to reach the LAN (host networking or a dedicated container IP).",
+					style: "switch",
+					default: true
+				}),
 				this.field({
 					type: "text",
 					key: "localHostname",
@@ -759,8 +929,29 @@ var LocalNetworkAddon = class extends BaseAddon {
 	}
 	async onConfigChanged() {
 		await this.applyLanAccessFromSettings();
+		await this.applyMdnsAdvertisement();
+	}
+	/**
+	* Start, re-announce or stop the hub's mDNS service (D838). Never throws:
+	* the advertiser logs its own failures and boot goes on.
+	*/
+	async applyMdnsAdvertisement() {
+		if (this.config.mdnsAdvertise === false) {
+			await this.mdns?.stop();
+			return;
+		}
+		if (this.mdns === null) this.mdns = new HubMdnsAdvertiser({
+			publisher: createCiaoPublisher(),
+			logger: this.ctx.logger,
+			nodeId: this.ctx.kernel.localNodeId ?? "hub",
+			version: null,
+			readInternalUrl: async () => internalUrlOf(await this.addressBook("https"))
+		});
+		await this.mdns.start();
 	}
 	async onShutdown() {
+		await this.mdns?.stop();
+		this.mdns = null;
 		if (this.pollTimer) {
 			clearInterval(this.pollTimer);
 			this.pollTimer = null;
@@ -956,6 +1147,7 @@ var LocalNetworkAddon = class extends BaseAddon {
 		} });
 		this.lastSnapshotKey = key;
 		this.persistReconciledAllowlist(interfaces);
+		this.mdns?.sync();
 		this.ctx.eventBus?.emit({
 			id: `local-network-changed-${Date.now()}`,
 			timestamp: /* @__PURE__ */ new Date(),

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvarXqQt.js");
+const require_dist = require("../../dist-BMOD9OyH.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Qt as logDestinationCapability, dr as BaseAddon } from "../../dist-dEsHYY8m.mjs";
+import { en as logDestinationCapability, fr as BaseAddon } from "../../dist-H_RapIeM.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,8 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvarXqQt.js");
-const require_proc_stat = require("../../proc-stat-DL-WUOhl.js");
+const require_dist = require("../../dist-BMOD9OyH.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
@@ -2126,7 +2125,7 @@ var NativeMetricsProvider = class {
 		return getCpuTemperatureInternal();
 	}
 	async getProcessStats(input) {
-		const { getPidStats } = await Promise.resolve().then(() => require("../../resource-monitor-BgWGRxN5.js")).then((n) => n.resource_monitor_exports);
+		const { getPidStats } = await Promise.resolve().then(() => require("../../resource-monitor-mio9dSCT.js")).then((n) => n.resource_monitor_exports);
 		const raw = await getPidStats(input.pids);
 		const result = [];
 		for (const [pid, s] of raw) result.push({
@@ -2462,6 +2461,95 @@ function execAsync(cmd, args, timeoutMs = 5e3) {
 		});
 	});
 }
+/**
+* Parse one `/proc/<pid>/stat` line. `null` for a line that does not parse —
+* a process that exited between the readdir and the read leaves a truncated
+* or empty file, and that is normal, not an error.
+*/
+function parseProcStat(line) {
+	const close = line.lastIndexOf(")");
+	const open = line.indexOf("(");
+	if (close < 0 || open < 0 || close < open) return null;
+	const pid = Number(line.slice(0, open).trim());
+	const comm = line.slice(open + 1, close);
+	const rest = line.slice(close + 1).trim().split(/\s+/);
+	const state = rest[0];
+	const ppid = Number(rest[1]);
+	const pgid = Number(rest[2]);
+	const utime = Number(rest[11]);
+	const stime = Number(rest[12]);
+	const startTicks = Number(rest[19]);
+	const rssPages = Number(rest[21]);
+	if (state === void 0 || state === "") return null;
+	if (![
+		pid,
+		ppid,
+		pgid,
+		utime,
+		stime,
+		startTicks,
+		rssPages
+	].every(Number.isFinite)) return null;
+	return {
+		pid,
+		comm,
+		state,
+		ppid,
+		pgid,
+		ticks: utime + stime,
+		startTicks,
+		rssPages
+	};
+}
+function statusKb(status, key) {
+	const match = status.match(new RegExp(`^${key}:\\s+(\\d+)`, "m"));
+	return match ? parseInt(match[1], 10) * 1024 : void 0;
+}
+/** Read `VmRSS` / `RssAnon` / `RssFile` (kB in the file) out of `/proc/<pid>/status`. */
+function parseProcStatusRss(status) {
+	return {
+		rssBytes: statusKb(status, "VmRSS"),
+		privateBytes: statusKb(status, "RssAnon"),
+		sharedBytes: statusKb(status, "RssFile")
+	};
+}
+/** Seconds the process has been alive — `ps etime`, whole seconds. */
+function elapsedSecSince(input) {
+	return Math.max(0, Math.floor(input.uptimeSec - input.startTicks / 100));
+}
+/**
+* `ps pcpu`: CPU time over elapsed time, as a percentage with one decimal.
+*
+* This is deliberately the LIFETIME average `ps` prints, not an instantaneous
+* rate: the columns fed from it have always shown that quantity, and the
+* instantaneous split is a different number with a different owner
+* (`cpuMainPercent` / `cpuGcPercent` from `thread-cpu-sampler.ts`). A process
+* with no elapsed window yet reports 0, never a division by zero.
+*/
+function lifetimeCpuPercent(input) {
+	const elapsedSec = input.uptimeSec - input.startTicks / 100;
+	if (!(elapsedSec > 0)) return 0;
+	const cpuSec = input.ticks / 100;
+	return Math.round(cpuSec / elapsedSec * 1e3) / 10;
+}
+var PID_RE = /^\d+$/;
+var nodeProcReader = {
+	listPids: async () => (await (0, node_fs_promises.readdir)("/proc")).filter((entry) => PID_RE.test(entry)).map((entry) => Number(entry)),
+	readStat: (pid) => (0, node_fs_promises.readFile)(`/proc/${pid}/stat`, "latin1"),
+	readStatus: (pid) => (0, node_fs_promises.readFile)(`/proc/${pid}/status`, "latin1"),
+	readCmdline: (pid) => (0, node_fs_promises.readFile)(`/proc/${pid}/cmdline`, "latin1"),
+	readUptimeSec: async () => {
+		const [first] = (await (0, node_fs_promises.readFile)("/proc/uptime", "latin1")).trim().split(/\s+/);
+		const seconds = Number(first);
+		if (!Number.isFinite(seconds)) throw new Error(`/proc/uptime unreadable: ${String(first)}`);
+		return seconds;
+	}
+};
+/** `ps command=`: argv joined by spaces, or `[comm]` when there is no argv. */
+function commandFromCmdline(cmdline, comm) {
+	const joined = cmdline.split("\0").filter((part) => part.length > 0).join(" ");
+	return joined.length > 0 ? joined : `[${comm}]`;
+}
 //#endregion
 //#region src/builtins/native-metrics/proc-process-table.ts
 /**
@@ -2493,28 +2581,28 @@ async function readProcRow(pid, uptimeSec, reader) {
 	} catch {
 		return null;
 	}
-	const parsed = require_proc_stat.parseProcStat(stat);
+	const parsed = parseProcStat(stat);
 	if (parsed === null) return null;
-	const rss = require_proc_stat.parseProcStatusRss(status);
+	const rss = parseProcStatusRss(status);
 	return {
 		pid: parsed.pid,
 		ppid: parsed.ppid,
 		pgid: parsed.pgid,
-		cpuPercent: require_proc_stat.lifetimeCpuPercent({
+		cpuPercent: lifetimeCpuPercent({
 			ticks: parsed.ticks,
 			startTicks: parsed.startTicks,
 			uptimeSec
 		}),
 		memoryRssBytes: rss.rssBytes ?? 0,
-		uptimeSec: require_proc_stat.elapsedSecSince({
+		uptimeSec: elapsedSecSince({
 			startTicks: parsed.startTicks,
 			uptimeSec
 		}),
-		command: require_proc_stat.commandFromCmdline(cmdline, parsed.comm)
+		command: commandFromCmdline(cmdline, parsed.comm)
 	};
 }
 /** Every process in `/proc`, as the rows `ps -eo …` would have printed. */
-async function readProcProcessTable(reader = require_proc_stat.nodeProcReader) {
+async function readProcProcessTable(reader = nodeProcReader) {
 	const [pids, uptimeSec] = await Promise.all([reader.listPids(), reader.readUptimeSec()]);
 	return (await Promise.all(pids.map((pid) => readProcRow(pid, uptimeSec, reader)))).filter((row) => row !== null);
 }
@@ -2569,7 +2657,7 @@ async function spawnPsTable() {
 }
 var defaultDeps = {
 	platform: (0, node_os.platform)(),
-	reader: require_proc_stat.nodeProcReader,
+	reader: nodeProcReader,
 	spawnPs: spawnPsTable
 };
 /**
@@ -3481,3 +3569,7 @@ var NativeMetricsAddon = class NativeMetricsAddon extends require_dist.BaseAddon
 //#endregion
 exports.NativeMetricsProvider = NativeMetricsProvider;
 exports.default = NativeMetricsAddon;
+exports.lifetimeCpuPercent = lifetimeCpuPercent;
+exports.nodeProcReader = nodeProcReader;
+exports.parseProcStat = parseProcStat;
+exports.parseProcStatusRss = parseProcStatusRss;