@walkhi/code-relax 0.1.0-beta.30 → 0.1.0-beta.31

package/dist/src/project-remove.mjs

@@ -0,0 +1,55 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { readRecord, writeRecord } from './service-lifecycle.mjs';
+import { withDesktopProjectRegistration } from './platform/desktop-project-registration.mjs';
+
+const pending = new Map();
+const uuid = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i;
+
+export async function removeWorkstationProject(server, stateRoot, codexDataRoot, projectId, body, dependencies = {}) {
+  if (!projectId || !uuid.test(body.idempotencyKey || '')) throw Object.assign(new Error('项目移除标识无效。'), { statusCode: 400 });
+  const record = path.join(stateRoot, 'project-remove-operations', `${body.idempotencyKey}.json`);
+  const running = pending.get(record);
+  if (running) {
+    if (running.projectId !== projectId) throw Object.assign(new Error('同一请求不能移除其他项目。'), { statusCode: 409 });
+    return running.promise;
+  }
+  const promise = perform().finally(() => pending.delete(record));
+  pending.set(record, { projectId, promise });
+  return promise;
+
+  async function perform() {
+    await fs.mkdir(path.dirname(record), { recursive: true });
+    const operation = readRecord(record) || { projectId };
+    if (operation.projectId !== projectId) throw Object.assign(new Error('移除标识已用于其他项目。'), { statusCode: 409 });
+    if (operation.result) return operation.result;
+    const save = () => writeRecord(record, operation);
+    const registration = dependencies.registration || withDesktopProjectRegistration;
+    return registration({ stateRoot, codexDataRoot, operationId: body.idempotencyKey, operation: 'remove',
+      confirmed: body.confirmDesktopRestart === true, serverUrl: server.url }, async desktop => {
+      if (!operation.project) {
+        operation.project = (await server.request('project/read', { projectId })).project;
+        if (operation.project.id !== projectId) throw new Error('项目身份不一致，未执行移除。');
+        save();
+      }
+      const removeNative = async () => {
+        if (operation.nativeDeleted) return;
+        if (operation.deleteAttempted) {
+          // An explicit retry first resolves an earlier unknown response.
+          try { await server.request('project/read', { projectId }); }
+          catch (error) {
+            if (error.message !== `project not found: ${projectId}`) throw error;
+            operation.nativeDeleted = true; save(); return;
+          }
+        }
+        operation.deleteAttempted = true; save();
+        await server.request('project/delete', { projectId });
+        operation.nativeDeleted = true; save();
+      };
+      const desktopRemoval = await desktop.remove(operation.project, operation, save, removeNative);
+      operation.result = { projectId, desktopRemoval };
+      save();
+      return operation.result;
+    });
+  }
+}

package/dist/src/project-update.mjs

@@ -0,0 +1,56 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { readRecord, writeRecord } from './service-lifecycle.mjs';
+import { projectRoots, projectSummary } from './project-management.mjs';
+import { withDesktopProjectRegistration } from './platform/desktop-project-registration.mjs';
+
+const pending = new Map();
+const fail = message => { throw Object.assign(new Error(message), { statusCode: 409 }); };
+const rootKey = roots => JSON.stringify(roots.map(root => process.platform === 'win32' ? path.normalize(root.path).toLowerCase() : path.normalize(root.path)));
+const same = (a, b) => a.name === b.name && rootKey(a.roots) === rootKey(b.roots);
+
+export async function updateWorkstationProject(server, stateRoot, codexDataRoot, projectId, body, dependencies = {}) {
+  const name = typeof body.name === 'string' ? body.name.trim() : '';
+  if (!name || !Array.isArray(body.roots) || body.roots.some(root => typeof root?.path !== 'string' || !path.isAbsolute(root.path.trim()))
+    || !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(body.idempotencyKey || '')) fail('项目名称、文件夹或操作标识无效。');
+  const target = { name, roots: body.roots.map(root => ({ path: path.normalize(root.path.trim()) })) };
+  const signature = createHash('sha256').update(JSON.stringify({ projectId, ...target })).digest('hex');
+  const record = path.join(stateRoot, 'project-update-operations', `${body.idempotencyKey}.json`);
+  const active = pending.get(record);
+  if (active) { if (active.signature !== signature) fail('同一请求不能修改其他项目内容。'); return active.promise; }
+  const promise = perform().finally(() => pending.delete(record));
+  pending.set(record, { signature, promise }); return promise;
+
+  async function perform() {
+    await fs.mkdir(path.dirname(record), { recursive: true });
+    const operation = readRecord(record) || { signature };
+    if (operation.signature !== signature) fail('项目编辑标识已用于其他内容。');
+    if (operation.result) return operation.result;
+    const save = () => writeRecord(record, operation);
+    const rpc = (method, params) => server.request(method, params);
+    try {
+      return await (dependencies.registration || withDesktopProjectRegistration)({ stateRoot, codexDataRoot,
+        operationId: body.idempotencyKey, operation: 'update', confirmed: body.confirmDesktopRestart === true, serverUrl: server.url }, async desktop => {
+        const current = (await rpc('project/read', { projectId })).project;
+        if (current.id !== projectId) fail('项目身份不一致。');
+        operation.previousProject ||= current;
+        if (!same(current, operation.previousProject) && !same(current, target)) fail('项目已被其他操作修改，请刷新后重新编辑。');
+        let project = current;
+        if (!same(current, target)) {
+          const rootsChanged = rootKey(current.roots) !== rootKey(target.roots);
+          const roots = rootsChanged ? await projectRoots(rpc, target.roots) : current.roots;
+          operation.updateAttempted = true; save();
+          project = (await rpc('project/update', { projectId, name, roots })).project;
+        }
+        save();
+        const desktopRegistration = await desktop.register(project, operation, save);
+        operation.result = { project: projectSummary(project), desktopRegistration }; save(); return operation.result;
+      });
+    } catch (error) {
+      error.details = { ...error.details, projectUpdatePending: operation.updateAttempted === true };
+      if (operation.updateAttempted) error.message += ' 请继续完成本次同步，会先核对已有修改。';
+      throw error;
+    }
+  }
+}

package/dist/src/runtime-discovery.mjs

@@ -1,47 +1,47 @@
-import { discoverCodex, resolveCodexRuntime, runtimeFingerprint } from './platform/codex-runtime.mjs';
-
-// Advisory discovery is independent of execution health. Failure here must never
-// disable an already running app-server or cause an automatic process restart.
-export class RuntimeDiscovery {
-  constructor({ stateRoot, host, url, interval = 60000 }) {
-    Object.assign(this, { stateRoot, host, url, interval });
-    this.state = {};
-  }
-  start() { this.stopped = false; void this.tick(); }
-  stop() { this.stopped = true; clearTimeout(this.timer); }
-  async sample() {
-    const errors = [];
-    try {
-      const candidates = discoverCodex();
-      const signature = JSON.stringify(candidates.map(candidate => {
-        try { return [candidate.executable, runtimeFingerprint(candidate.executable)]; }
-        catch (error) { return [candidate.executable, error.message]; }
-      }));
-      if (signature !== this.signature) {
-        await resolveCodexRuntime(this.stateRoot, { refresh: true });
-        this.signature = signature;
-      }
-    } catch (error) { errors.push(error.message); }
-    try {
-      if (this.host.desktopIntegration === false) {
-        this.state = { desktop: { state: 'unsupported', integrationSupported: false }, checkedAt: new Date().toISOString() };
-        if (errors.length) this.state.discoveryError = errors.join('\n');
-        return this.state;
-      }
-      const desktop = await this.host.inspect();
-      const attached = desktop.running && await this.host.sharedServiceUrl() === this.url;
-      this.state = { desktop: { state: !desktop.running ? 'stopped' : attached ? 'managed' : 'ordinary',
-        installed: Boolean(desktop.desktop), attachedToManagedServer: Boolean(attached) },
-        desktopRestartRecommended: Boolean(desktop.running && !attached), checkedAt: new Date().toISOString() };
-    } catch (error) {
-      errors.push(error.message);
-      this.state = { checkedAt: new Date().toISOString() };
-    }
-    if (errors.length) this.state.discoveryError = errors.join('\n');
-    return this.state;
-  }
-  async tick() {
-    await this.sample();
-    if (!this.stopped) { this.timer = setTimeout(() => this.tick(), this.interval); this.timer.unref?.(); }
-  }
-}
+import { discoverCodex, resolveCodexRuntime, runtimeFingerprint } from './platform/codex-runtime.mjs';
+
+// Advisory discovery is independent of execution health. Failure here must never
+// disable an already running app-server or cause an automatic process restart.
+export class RuntimeDiscovery {
+  constructor({ stateRoot, host, url, interval = 60000 }) {
+    Object.assign(this, { stateRoot, host, url, interval });
+    this.state = {};
+  }
+  start() { this.stopped = false; void this.tick(); }
+  stop() { this.stopped = true; clearTimeout(this.timer); }
+  async sample() {
+    const errors = [];
+    try {
+      const candidates = discoverCodex();
+      const signature = JSON.stringify(candidates.map(candidate => {
+        try { return [candidate.executable, runtimeFingerprint(candidate.executable)]; }
+        catch (error) { return [candidate.executable, error.message]; }
+      }));
+      if (signature !== this.signature) {
+        await resolveCodexRuntime(this.stateRoot, { refresh: true });
+        this.signature = signature;
+      }
+    } catch (error) { errors.push(error.message); }
+    try {
+      if (this.host.desktopIntegration === false) {
+        this.state = { desktop: { state: 'unsupported', integrationSupported: false }, checkedAt: new Date().toISOString() };
+        if (errors.length) this.state.discoveryError = errors.join('\n');
+        return this.state;
+      }
+      const desktop = await this.host.inspect();
+      const attached = desktop.running && await this.host.sharedServiceUrl() === this.url;
+      this.state = { desktop: { state: !desktop.running ? 'stopped' : attached ? 'managed' : 'ordinary',
+        installed: Boolean(desktop.desktop), attachedToManagedServer: Boolean(attached) },
+        desktopRestartRecommended: Boolean(desktop.running && !attached), checkedAt: new Date().toISOString() };
+    } catch (error) {
+      errors.push(error.message);
+      this.state = { checkedAt: new Date().toISOString() };
+    }
+    if (errors.length) this.state.discoveryError = errors.join('\n');
+    return this.state;
+  }
+  async tick() {
+    await this.sample();
+    if (!this.stopped) { this.timer = setTimeout(() => this.tick(), this.interval); this.timer.unref?.(); }
+  }
+}

package/dist/src/self-relay/account-cleanup.mjs

@@ -1,30 +1,30 @@
-// Process one account per transaction; foreign keys keep incomplete deletion atomic.
-export async function purgeCancelledAccounts(pool, scopeHash) {
-  let purged = 0;
-  for (;;) {
-    const db = await pool.getConnection();
-    try {
-      await db.beginTransaction();
-      const [rows] = await db.query(`SELECT id FROM users WHERE status='cancelled'
-        AND cancelled_at <= UTC_TIMESTAMP(3) - INTERVAL 1 DAY
-        ORDER BY cancelled_at LIMIT 1 FOR UPDATE`);
-      if (!rows.length) { await db.commit(); return purged; }
-      const id = rows[0].id;
-      const [identities] = await db.execute("SELECT normalized_value FROM user_login_identities WHERE user_id=? AND kind='email'", [id]);
-      for (const { normalized_value: email } of identities) {
-        await db.execute('DELETE FROM email_login_challenges WHERE email=?', [email]);
-        await db.execute('DELETE FROM email_send_limits WHERE scope_hash=?', [scopeHash(`email:${email}`)]);
-        await db.execute('DELETE FROM relay_admin_emails WHERE email=?', [email]);
-      }
-      for (const table of ['user_sessions', 'relay_usage_actions', 'relay_usage_sessions',
-        'relay_usage_user_days', 'relay_usage_budgets', 'relay_usage_entitlements',
-        'relay_usage_totals', 'user_login_identities']) {
-        await db.execute(`DELETE FROM ${table} WHERE user_id=?`, [id]);
-      }
-      await db.execute('UPDATE computers SET owner_user_id=NULL WHERE owner_user_id=?', [id]);
-      await db.execute('DELETE FROM users WHERE id=?', [id]);
-      await db.commit(); purged++;
-    } catch (error) { await db.rollback(); throw error; }
-    finally { db.release(); }
-  }
-}
+// Process one account per transaction; foreign keys keep incomplete deletion atomic.
+export async function purgeCancelledAccounts(pool, scopeHash) {
+  let purged = 0;
+  for (;;) {
+    const db = await pool.getConnection();
+    try {
+      await db.beginTransaction();
+      const [rows] = await db.query(`SELECT id FROM users WHERE status='cancelled'
+        AND cancelled_at <= UTC_TIMESTAMP(3) - INTERVAL 1 DAY
+        ORDER BY cancelled_at LIMIT 1 FOR UPDATE`);
+      if (!rows.length) { await db.commit(); return purged; }
+      const id = rows[0].id;
+      const [identities] = await db.execute("SELECT normalized_value FROM user_login_identities WHERE user_id=? AND kind='email'", [id]);
+      for (const { normalized_value: email } of identities) {
+        await db.execute('DELETE FROM email_login_challenges WHERE email=?', [email]);
+        await db.execute('DELETE FROM email_send_limits WHERE scope_hash=?', [scopeHash(`email:${email}`)]);
+        await db.execute('DELETE FROM relay_admin_emails WHERE email=?', [email]);
+      }
+      for (const table of ['user_sessions', 'relay_usage_actions', 'relay_usage_sessions',
+        'relay_usage_user_days', 'relay_usage_budgets', 'relay_usage_entitlements',
+        'relay_usage_totals', 'user_login_identities']) {
+        await db.execute(`DELETE FROM ${table} WHERE user_id=?`, [id]);
+      }
+      await db.execute('UPDATE computers SET owner_user_id=NULL WHERE owner_user_id=?', [id]);
+      await db.execute('DELETE FROM users WHERE id=?', [id]);
+      await db.commit(); purged++;
+    } catch (error) { await db.rollback(); throw error; }
+    finally { db.release(); }
+  }
+}

package/dist/src/self-relay/account-connections.mjs

@@ -1,52 +1,52 @@
-import { digest } from './wire.mjs';
-
-// Register before the asynchronous database check so logout also invalidates
-// handshakes whose successful authentication response has not arrived yet.
-export function accountConnections() {
-  const sessions = new Map();
-  return {
-    track(token, onInvalid) {
-      const key = digest(token);
-      const entries = sessions.get(key) || new Set();
-      sessions.set(key, entries);
-      let active = true, expires = Infinity, timer;
-      function dispose() {
-        active = false;
-        clearTimeout(timer);
-        entries.delete(entry);
-        if (!entries.size && sessions.get(key) === entries) sessions.delete(key);
-      }
-      function invalidate() {
-        if (!active) return;
-        dispose();
-        onInvalid();
-      }
-      function valid() {
-        if (active && Date.now() >= expires) invalidate();
-        return active;
-      }
-      function schedule() {
-        if (!valid()) return;
-        // Login lasts 30 days, longer than Node's maximum timer delay.
-        timer = setTimeout(schedule, Math.min(expires - Date.now(), 0x7fffffff));
-        timer.unref();
-      }
-      const entry = {
-        activate(expiresAt) {
-          if (!active) return false;
-          expires = Date.parse(expiresAt);
-          if (!Number.isFinite(expires)) { invalidate(); return false; }
-          schedule();
-          return active;
-        },
-        valid, dispose, invalidate,
-      };
-      entries.add(entry);
-      return entry;
-    },
-    revoke(token) {
-      const entries = sessions.get(digest(token));
-      if (entries) for (const entry of [...entries]) entry.invalidate();
-    },
-  };
-}
+import { digest } from './wire.mjs';
+
+// Register before the asynchronous database check so logout also invalidates
+// handshakes whose successful authentication response has not arrived yet.
+export function accountConnections() {
+  const sessions = new Map();
+  return {
+    track(token, onInvalid) {
+      const key = digest(token);
+      const entries = sessions.get(key) || new Set();
+      sessions.set(key, entries);
+      let active = true, expires = Infinity, timer;
+      function dispose() {
+        active = false;
+        clearTimeout(timer);
+        entries.delete(entry);
+        if (!entries.size && sessions.get(key) === entries) sessions.delete(key);
+      }
+      function invalidate() {
+        if (!active) return;
+        dispose();
+        onInvalid();
+      }
+      function valid() {
+        if (active && Date.now() >= expires) invalidate();
+        return active;
+      }
+      function schedule() {
+        if (!valid()) return;
+        // Login lasts 30 days, longer than Node's maximum timer delay.
+        timer = setTimeout(schedule, Math.min(expires - Date.now(), 0x7fffffff));
+        timer.unref();
+      }
+      const entry = {
+        activate(expiresAt) {
+          if (!active) return false;
+          expires = Date.parse(expiresAt);
+          if (!Number.isFinite(expires)) { invalidate(); return false; }
+          schedule();
+          return active;
+        },
+        valid, dispose, invalidate,
+      };
+      entries.add(entry);
+      return entry;
+    },
+    revoke(token) {
+      const entries = sessions.get(digest(token));
+      if (entries) for (const entry of [...entries]) entry.invalidate();
+    },
+  };
+}

package/dist/src/self-relay/admin-cloud.mjs

@@ -1,101 +1,101 @@
-import fs from 'node:fs';
-import tencentcloud from 'tencentcloud-sdk-nodejs-common';
-
-const INSTANCE_ID = 'lhins-byrs7n8o';
-const REGION = 'ap-beijing';
-const { CommonClient } = tencentcloud;
-const METRICS = [
-  ['LighthouseOutratio', 'outRatioPercent', 10],
-  ['LighthouseOuttraffic', 'outMbps', 10],
-  ['LighthouseIntraffic', 'inMbps', 10],
-  ['CpuUsage', 'cpuPercent', 10],
-  ['MemUsage', 'memoryPercent', 10],
-  ['DiskUsage', 'diskPercent', 60],
-  ['CpuLoad1', 'cpuLoad1', 10],
-];
-
-function latestPoint(result) {
-  const point = result?.DataPoints?.[0];
-  if (!point?.Values?.length || !point?.Timestamps?.length) return null;
-  const index = point.Values.length - 1;
-  const value = Number(point.Values[index]);
-  const timestamp = Number(point.Timestamps[index]);
-  return Number.isFinite(value) && Number.isFinite(timestamp)
-    ? { value, sampledAt: new Date(timestamp * 1000).toISOString() } : null;
-}
-
-export function startAdminCloud({ credentialFile = process.env.CREDENTIALS_DIRECTORY
-  ? `${process.env.CREDENTIALS_DIRECTORY}/tencent-monitor.json` : null,
-  metricIntervalMs = 60000, trafficIntervalMs = 300000 } = {}) {
-  if (!credentialFile) return { read: () => ({ configured: false }), close() {} };
-  const { secretId, secretKey } = JSON.parse(fs.readFileSync(credentialFile, 'utf8'));
-  if (!secretId || !secretKey) throw new Error('Tencent monitor credentials are incomplete');
-  const credential = { secretId, secretKey };
-  const profile = { httpProfile: { reqTimeout: 8 } };
-  const monitor = new CommonClient('monitor.tencentcloudapi.com', '2018-07-24',
-    { credential, region: REGION, profile });
-  const lighthouse = new CommonClient('lighthouse.tencentcloudapi.com', '2020-03-24',
-    { credential, region: REGION, profile });
-  let closed = false;
-  let metricBusy = false;
-  let trafficBusy = false;
-  const current = { configured: true, metricAvailable: false, trafficAvailable: false,
-    outRatioPercent: null, outMbps: null, inMbps: null, metricSampledAt: null,
-    cpuPercent: null, memoryPercent: null, diskPercent: null, cpuLoad1: null,
-    trafficUsedBytes: null, trafficTotalBytes: null, trafficRemainingBytes: null,
-    trafficStartAt: null, trafficEndAt: null, trafficSampledAt: null };
-
-  async function sampleMetrics() {
-    if (metricBusy || closed) return;
-    metricBusy = true;
-    const end = new Date();
-    const base = { Namespace: 'QCE/LIGHTHOUSE',
-      StartTime: new Date(end.getTime() - 180000).toISOString(), EndTime: end.toISOString(),
-      Instances: [{ Dimensions: [{ Name: 'InstanceId', Value: INSTANCE_ID }] }] };
-    try {
-      const values = await Promise.allSettled(METRICS.map(([MetricName, , Period]) =>
-        monitor.request('GetMonitorData', { ...base, MetricName, Period })));
-      if (closed) return;
-      const samples = values.map(result => result.status === 'fulfilled' ? latestPoint(result.value) : null);
-      for (let index = 0; index < METRICS.length; index++) {
-        const [, field] = METRICS[index];
-        const value = samples[index]?.value ?? null;
-        current[field] = value !== null && (field === 'outMbps' || field === 'inMbps') ? value * 8 : value;
-      }
-      current.metricSampledAt = samples.reduce((latest, sample) => sample?.sampledAt > latest
-        ? sample.sampledAt : latest, '') || null;
-      current.metricAvailable = Boolean(current.metricSampledAt);
-    } catch {
-      current.metricAvailable = false;
-    } finally { metricBusy = false; }
-  }
-
-  async function sampleTraffic() {
-    if (trafficBusy || closed) return;
-    trafficBusy = true;
-    try {
-      const data = await lighthouse.request('DescribeInstancesTrafficPackages', { InstanceIds: [INSTANCE_ID] });
-      if (closed) return;
-      const packages = data?.InstanceTrafficPackageSet?.find(item => item.InstanceId === INSTANCE_ID)?.TrafficPackageSet || [];
-      const active = packages.find(item => Date.parse(item.StartTime) <= Date.now()
-        && Date.parse(item.EndTime) >= Date.now()) || packages[0];
-      current.trafficUsedBytes = active?.TrafficUsed ?? null;
-      current.trafficTotalBytes = active?.TrafficPackageTotal ?? null;
-      current.trafficRemainingBytes = active?.TrafficPackageRemaining ?? null;
-      current.trafficStartAt = active?.StartTime ?? null;
-      current.trafficEndAt = active?.EndTime ?? null;
-      current.trafficSampledAt = active ? new Date().toISOString() : null;
-      current.trafficAvailable = Boolean(active);
-    } catch {
-      current.trafficAvailable = false;
-    } finally { trafficBusy = false; }
-  }
-
-  void sampleMetrics();
-  void sampleTraffic();
-  const metricTimer = setInterval(sampleMetrics, metricIntervalMs);
-  const trafficTimer = setInterval(sampleTraffic, trafficIntervalMs);
-  metricTimer.unref();
-  trafficTimer.unref();
-  return { read: () => ({ ...current }), close() { closed = true; clearInterval(metricTimer); clearInterval(trafficTimer); } };
-}
+import fs from 'node:fs';
+import tencentcloud from 'tencentcloud-sdk-nodejs-common';
+
+const INSTANCE_ID = 'lhins-byrs7n8o';
+const REGION = 'ap-beijing';
+const { CommonClient } = tencentcloud;
+const METRICS = [
+  ['LighthouseOutratio', 'outRatioPercent', 10],
+  ['LighthouseOuttraffic', 'outMbps', 10],
+  ['LighthouseIntraffic', 'inMbps', 10],
+  ['CpuUsage', 'cpuPercent', 10],
+  ['MemUsage', 'memoryPercent', 10],
+  ['DiskUsage', 'diskPercent', 60],
+  ['CpuLoad1', 'cpuLoad1', 10],
+];
+
+function latestPoint(result) {
+  const point = result?.DataPoints?.[0];
+  if (!point?.Values?.length || !point?.Timestamps?.length) return null;
+  const index = point.Values.length - 1;
+  const value = Number(point.Values[index]);
+  const timestamp = Number(point.Timestamps[index]);
+  return Number.isFinite(value) && Number.isFinite(timestamp)
+    ? { value, sampledAt: new Date(timestamp * 1000).toISOString() } : null;
+}
+
+export function startAdminCloud({ credentialFile = process.env.CREDENTIALS_DIRECTORY
+  ? `${process.env.CREDENTIALS_DIRECTORY}/tencent-monitor.json` : null,
+  metricIntervalMs = 60000, trafficIntervalMs = 300000 } = {}) {
+  if (!credentialFile) return { read: () => ({ configured: false }), close() {} };
+  const { secretId, secretKey } = JSON.parse(fs.readFileSync(credentialFile, 'utf8'));
+  if (!secretId || !secretKey) throw new Error('Tencent monitor credentials are incomplete');
+  const credential = { secretId, secretKey };
+  const profile = { httpProfile: { reqTimeout: 8 } };
+  const monitor = new CommonClient('monitor.tencentcloudapi.com', '2018-07-24',
+    { credential, region: REGION, profile });
+  const lighthouse = new CommonClient('lighthouse.tencentcloudapi.com', '2020-03-24',
+    { credential, region: REGION, profile });
+  let closed = false;
+  let metricBusy = false;
+  let trafficBusy = false;
+  const current = { configured: true, metricAvailable: false, trafficAvailable: false,
+    outRatioPercent: null, outMbps: null, inMbps: null, metricSampledAt: null,
+    cpuPercent: null, memoryPercent: null, diskPercent: null, cpuLoad1: null,
+    trafficUsedBytes: null, trafficTotalBytes: null, trafficRemainingBytes: null,
+    trafficStartAt: null, trafficEndAt: null, trafficSampledAt: null };
+
+  async function sampleMetrics() {
+    if (metricBusy || closed) return;
+    metricBusy = true;
+    const end = new Date();
+    const base = { Namespace: 'QCE/LIGHTHOUSE',
+      StartTime: new Date(end.getTime() - 180000).toISOString(), EndTime: end.toISOString(),
+      Instances: [{ Dimensions: [{ Name: 'InstanceId', Value: INSTANCE_ID }] }] };
+    try {
+      const values = await Promise.allSettled(METRICS.map(([MetricName, , Period]) =>
+        monitor.request('GetMonitorData', { ...base, MetricName, Period })));
+      if (closed) return;
+      const samples = values.map(result => result.status === 'fulfilled' ? latestPoint(result.value) : null);
+      for (let index = 0; index < METRICS.length; index++) {
+        const [, field] = METRICS[index];
+        const value = samples[index]?.value ?? null;
+        current[field] = value !== null && (field === 'outMbps' || field === 'inMbps') ? value * 8 : value;
+      }
+      current.metricSampledAt = samples.reduce((latest, sample) => sample?.sampledAt > latest
+        ? sample.sampledAt : latest, '') || null;
+      current.metricAvailable = Boolean(current.metricSampledAt);
+    } catch {
+      current.metricAvailable = false;
+    } finally { metricBusy = false; }
+  }
+
+  async function sampleTraffic() {
+    if (trafficBusy || closed) return;
+    trafficBusy = true;
+    try {
+      const data = await lighthouse.request('DescribeInstancesTrafficPackages', { InstanceIds: [INSTANCE_ID] });
+      if (closed) return;
+      const packages = data?.InstanceTrafficPackageSet?.find(item => item.InstanceId === INSTANCE_ID)?.TrafficPackageSet || [];
+      const active = packages.find(item => Date.parse(item.StartTime) <= Date.now()
+        && Date.parse(item.EndTime) >= Date.now()) || packages[0];
+      current.trafficUsedBytes = active?.TrafficUsed ?? null;
+      current.trafficTotalBytes = active?.TrafficPackageTotal ?? null;
+      current.trafficRemainingBytes = active?.TrafficPackageRemaining ?? null;
+      current.trafficStartAt = active?.StartTime ?? null;
+      current.trafficEndAt = active?.EndTime ?? null;
+      current.trafficSampledAt = active ? new Date().toISOString() : null;
+      current.trafficAvailable = Boolean(active);
+    } catch {
+      current.trafficAvailable = false;
+    } finally { trafficBusy = false; }
+  }
+
+  void sampleMetrics();
+  void sampleTraffic();
+  const metricTimer = setInterval(sampleMetrics, metricIntervalMs);
+  const trafficTimer = setInterval(sampleTraffic, trafficIntervalMs);
+  metricTimer.unref();
+  trafficTimer.unref();
+  return { read: () => ({ ...current }), close() { closed = true; clearInterval(metricTimer); clearInterval(trafficTimer); } };
+}