@walkhi/code-relax 0.1.0-beta.5 → 0.1.0-beta.50

package/dist/src/project-create.mjs

@@ -0,0 +1,121 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { readRecord, writeRecord } from './service-lifecycle.mjs';
+import { projectRoots, projectSummary } from './project-management.mjs';
+import { projectLocations } from './platform/project-locations.mjs';
+import { withDesktopProjectRegistration } from './platform/desktop-project-registration.mjs';
+
+const pending = new Map();
+const uuid = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i;
+const fail = message => { throw Object.assign(new Error(message), { statusCode: 400 }); };
+const pathKey = value => process.platform === 'win32' ? path.normalize(value).toLowerCase() : path.normalize(value);
+
+function defaultName(name) {
+  let value = path.basename(name).trim().replace(/[<>:"/\\|?*\x00-\x1f]/g, '_').replace(/[ .]+$/g, '') || 'New project';
+  if (/^(?:con|prn|aux|nul|com[1-9¹²³]|lpt[1-9¹²³])(?:\.|$)/i.test(value)) value = `_${value}`;
+  return value;
+}
+
+export async function createWorkstationProject(server, stateRoot, codexDataRoot, body, dependencies = {}) {
+  if (!uuid.test(body.idempotencyKey || '')) fail('项目创建标识无效。');
+  const name = typeof body.name === 'string' ? body.name.trim() : '';
+  if (!name) fail('请输入项目名称。');
+  if (!Array.isArray(body.roots) || body.roots.some(root => typeof root?.path !== 'string' || !path.isAbsolute(root.path.trim()))) {
+    fail('项目文件夹路径无效。');
+  }
+  const roots = body.roots.map(root => ({ path: path.normalize(root.path.trim()) }));
+  const signature = createHash('sha256').update(JSON.stringify({ name, roots })).digest('hex');
+  const directory = path.join(stateRoot, 'project-create-operations');
+  const record = path.join(directory, `${body.idempotencyKey}.json`);
+  const running = pending.get(record);
+  if (running) {
+    if (running.signature !== signature) fail('同一个创建请求不能修改项目名称或目录。');
+    return running.promise;
+  }
+  const promise = perform().finally(() => pending.delete(record));
+  pending.set(record, { signature, promise });
+  return promise;
+
+  async function perform() {
+    await fs.mkdir(directory, { recursive: true });
+    let operation = readRecord(record);
+    if (operation && operation.signature !== signature) fail('项目创建标识已用于其他内容，请重新打开项目编辑器。');
+    if (operation?.result) return operation.result;
+    operation ||= { signature, name, roots };
+    const save = () => writeRecord(record, operation);
+    const rpc = (method, params) => server.request(method, params);
+    const register = dependencies.registration || withDesktopProjectRegistration;
+    try {
+      return await register({ stateRoot, codexDataRoot, operationId: body.idempotencyKey,
+        confirmed: body.confirmDesktopRestart === true, serverUrl: server.url }, async desktop => {
+        // The restart confirmation and state checks happen before any
+        // directory or project write. Existing folders are never moved or copied.
+        let validatedRoots;
+        if (!operation.resolvedRoots) {
+          validatedRoots = await projectRoots(rpc, roots);
+          operation.resolvedRoots = validatedRoots;
+          if (!operation.resolvedRoots.length) {
+            const locations = await (dependencies.locations || projectLocations)();
+            await rpc('fs/createDirectory', { path: locations.defaultParent, recursive: true });
+            const entries = (await rpc('fs/readDirectory', { path: locations.defaultParent })).entries;
+            const names = new Set(entries.map(entry => entry.fileName.toLowerCase()));
+            const base = defaultName(name);
+            let folder = base;
+            for (let suffix = 2; names.has(folder.toLowerCase()); suffix++) folder = `${base} ${suffix}`;
+            operation.defaultDirectory = path.join(locations.defaultParent, folder);
+            operation.resolvedRoots = [{ path: operation.defaultDirectory }];
+          }
+          save();
+        }
+        if (operation.defaultDirectory && !operation.directoryCreated) {
+          if (operation.directoryAttempted) {
+            // On an explicit retry, keep the originally allocated directory. Never
+            // allocate another name after an interrupted createDirectory response.
+            await projectRoots(rpc, operation.resolvedRoots);
+          } else {
+            operation.directoryAttempted = true; save();
+            await rpc('fs/createDirectory', { path: operation.defaultDirectory, recursive: false });
+          }
+          operation.directoryCreated = true; save();
+          try {
+            const result = await rpc('command/exec', { command: ['git', 'init'], cwd: operation.defaultDirectory, timeoutMs: 10000 });
+            if (result.exitCode !== 0) throw new Error(result.stderr || result.stdout || `退出码 ${result.exitCode}`);
+          } catch (error) { operation.gitWarning = `项目目录已创建，Git 初始化未完成：${error.message}`; save(); }
+        }
+        const resolvedRoots = validatedRoots?.length ? validatedRoots : await projectRoots(rpc, operation.resolvedRoots);
+        if (!operation.projectId) {
+          operation.createAttempted = true; save();
+          // Native project/create owns idempotency; a retry uses this exact key
+          // and original roots on the same server, never a second transport.
+          const created = await rpc('project/create', { name, roots: resolvedRoots, idempotencyKey: body.idempotencyKey });
+          operation.projectId = created.project.id; save();
+        }
+        const { project } = await rpc('project/read', { projectId: operation.projectId });
+        if (project.id !== operation.projectId || project.name !== name || project.roots.length !== resolvedRoots.length
+          || project.roots.some((root, index) => pathKey(root.path) !== pathKey(resolvedRoots[index].path))) {
+          throw new Error('已创建项目的名称或目录发生变化，未覆盖其内容。');
+        }
+        if (!operation.ordered) {
+          const first = (await rpc('project/list', { limit: 1, sortKey: 'position', sortDirection: 'asc' })).data[0];
+          if (first && first.id !== project.id) await rpc('project/move', { projectId: project.id, beforeProjectId: first.id });
+          operation.ordered = true; save();
+        }
+        const desktopRegistration = await desktop.register(project, operation, save);
+        operation.result = { project: projectSummary(project), desktopRegistration,
+          ...(operation.gitWarning ? { warning: operation.gitWarning } : {}) };
+        save();
+        return operation.result;
+      });
+    } catch (error) {
+      if (operation.projectId || operation.createAttempted || operation.directoryAttempted) {
+        error.details = { ...error.details, projectCreationPending: true,
+          ...(operation.projectId ? { createdProjectId: operation.projectId } : {}) };
+        error.message += operation.projectId
+          ? ' 项目已创建，请继续完成桌面登记；会沿用同一项目，不会重复创建。'
+          : ' 请继续核对本次创建；会沿用原请求标识和目录。';
+      } else error.details = { ...error.details, projectCreationPending: false };
+      throw error;
+    }
+  }
+}

package/dist/src/project-management.mjs

@@ -0,0 +1,59 @@
+import path from 'node:path';
+
+const fail = (message, statusCode = 400) => { throw Object.assign(new Error(message), { statusCode }); };
+const pathKey = value => process.platform === 'win32' ? value.toLowerCase() : value;
+
+function absoluteDirectory(value) {
+  if (typeof value !== 'string' || !value.trim() || !path.isAbsolute(value.trim())) fail('请输入电脑上的绝对文件夹路径。');
+  return path.normalize(value.trim());
+}
+
+async function directory(rpc, value) {
+  const target = absoluteDirectory(value);
+  const stat = await rpc('fs/getMetadata', { path: target });
+  if (!stat.isDirectory) fail(`此路径不是文件夹：${target}`);
+  return target;
+}
+
+function folderName(value) {
+  if (typeof value !== 'string' || !value.trim() || /[<>:"/\\|?*\x00-\x1f]/.test(value) || /[ .]$/.test(value)
+    || /^(?:con|prn|aux|nul|com[1-9¹²³]|lpt[1-9¹²³])(?:\.|$)/i.test(value) || ['.', '..'].includes(value)) {
+    fail('文件夹名称无效，请勿使用路径分隔符或系统保留名称。');
+  }
+  return value;
+}
+
+export async function projectRoots(rpc, roots) {
+  if (!Array.isArray(roots)) fail('项目文件夹列表无效。');
+  const result = [], seen = new Set();
+  for (const root of roots) {
+    const target = await directory(rpc, root?.path);
+    const key = pathKey(target);
+    if (seen.has(key)) fail(`重复的项目文件夹：${target}`);
+    seen.add(key); result.push({ path: target });
+  }
+  return result;
+}
+
+export function projectSummary(project) {
+  return { projectId: project.id, name: project.name, label: project.name, roots: project.roots,
+    path: project.roots[0]?.path || '', cwd: project.roots[0]?.path || '', hostId: 'local' };
+}
+
+export async function browseProjectFolders(rpc, locations, value) {
+  const target = absoluteDirectory(value || locations?.home);
+  const entries = (await rpc('fs/readDirectory', { path: target })).entries
+    .filter(entry => entry.isDirectory).map(entry => ({ name: entry.fileName, path: path.join(target, entry.fileName) }))
+    .sort((a, b) => a.name.localeCompare(b.name, 'zh-CN', { numeric: true }));
+  return { path: target, parent: path.dirname(target) === target ? null : path.dirname(target), entries, ...(locations || {}) };
+}
+
+export async function createProjectFolder(rpc, body) {
+  const parent = await directory(rpc, body.parent);
+  const name = folderName(body.name);
+  const entries = (await rpc('fs/readDirectory', { path: parent })).entries;
+  if (entries.some(entry => pathKey(entry.fileName) === pathKey(name))) fail('同名文件夹已存在，请选择它或使用其他名称。', 409);
+  const target = path.join(parent, name);
+  await rpc('fs/createDirectory', { path: target, recursive: false });
+  return { path: target };
+}

package/dist/src/project-remove.mjs

@@ -0,0 +1,55 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { readRecord, writeRecord } from './service-lifecycle.mjs';
+import { withDesktopProjectRegistration } from './platform/desktop-project-registration.mjs';
+
+const pending = new Map();
+const uuid = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i;
+
+export async function removeWorkstationProject(server, stateRoot, codexDataRoot, projectId, body, dependencies = {}) {
+  if (!projectId || !uuid.test(body.idempotencyKey || '')) throw Object.assign(new Error('项目移除标识无效。'), { statusCode: 400 });
+  const record = path.join(stateRoot, 'project-remove-operations', `${body.idempotencyKey}.json`);
+  const running = pending.get(record);
+  if (running) {
+    if (running.projectId !== projectId) throw Object.assign(new Error('同一请求不能移除其他项目。'), { statusCode: 409 });
+    return running.promise;
+  }
+  const promise = perform().finally(() => pending.delete(record));
+  pending.set(record, { projectId, promise });
+  return promise;
+
+  async function perform() {
+    await fs.mkdir(path.dirname(record), { recursive: true });
+    const operation = readRecord(record) || { projectId };
+    if (operation.projectId !== projectId) throw Object.assign(new Error('移除标识已用于其他项目。'), { statusCode: 409 });
+    if (operation.result) return operation.result;
+    const save = () => writeRecord(record, operation);
+    const registration = dependencies.registration || withDesktopProjectRegistration;
+    return registration({ stateRoot, codexDataRoot, operationId: body.idempotencyKey, operation: 'remove',
+      confirmed: body.confirmDesktopRestart === true, serverUrl: server.url }, async desktop => {
+      if (!operation.project) {
+        operation.project = (await server.request('project/read', { projectId })).project;
+        if (operation.project.id !== projectId) throw new Error('项目身份不一致，未执行移除。');
+        save();
+      }
+      const removeNative = async () => {
+        if (operation.nativeDeleted) return;
+        if (operation.deleteAttempted) {
+          // An explicit retry first resolves an earlier unknown response.
+          try { await server.request('project/read', { projectId }); }
+          catch (error) {
+            if (error.message !== `project not found: ${projectId}`) throw error;
+            operation.nativeDeleted = true; save(); return;
+          }
+        }
+        operation.deleteAttempted = true; save();
+        await server.request('project/delete', { projectId });
+        operation.nativeDeleted = true; save();
+      };
+      const desktopRemoval = await desktop.remove(operation.project, operation, save, removeNative);
+      operation.result = { projectId, desktopRemoval };
+      save();
+      return operation.result;
+    });
+  }
+}

package/dist/src/project-update.mjs

@@ -0,0 +1,59 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { readRecord, writeRecord } from './service-lifecycle.mjs';
+import { projectRoots, projectSummary } from './project-management.mjs';
+import { withDesktopProjectRegistration } from './platform/desktop-project-registration.mjs';
+
+const pending = new Map();
+const fail = message => { throw Object.assign(new Error(message), { statusCode: 409 }); };
+const rootKey = roots => JSON.stringify(roots.map(root => process.platform === 'win32' ? path.normalize(root.path).toLowerCase() : path.normalize(root.path)));
+const same = (a, b) => a.name === b.name && rootKey(a.roots) === rootKey(b.roots);
+
+export async function updateWorkstationProject(server, stateRoot, codexDataRoot, projectId, body, dependencies = {}) {
+  const name = typeof body.name === 'string' ? body.name.trim() : '';
+  if (!name || !Array.isArray(body.roots) || body.roots.some(root => typeof root?.path !== 'string' || !path.isAbsolute(root.path.trim()))
+    || !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(body.idempotencyKey || '')) fail('项目名称、文件夹或操作标识无效。');
+  const target = { name, roots: body.roots.map(root => ({ path: path.normalize(root.path.trim()) })) };
+  const signature = createHash('sha256').update(JSON.stringify({ projectId, ...target })).digest('hex');
+  const record = path.join(stateRoot, 'project-update-operations', `${body.idempotencyKey}.json`);
+  const active = pending.get(record);
+  if (active) { if (active.signature !== signature) fail('同一请求不能修改其他项目内容。'); return active.promise; }
+  const promise = perform().finally(() => pending.delete(record));
+  pending.set(record, { signature, promise }); return promise;
+
+  async function perform() {
+    await fs.mkdir(path.dirname(record), { recursive: true });
+    const operation = readRecord(record) || { signature };
+    if (operation.signature !== signature) fail('项目编辑标识已用于其他内容。');
+    if (operation.result) return operation.result;
+    const save = () => writeRecord(record, operation);
+    const rpc = (method, params) => server.request(method, params);
+    try {
+      return await (dependencies.registration || withDesktopProjectRegistration)({ stateRoot, codexDataRoot,
+        operationId: body.idempotencyKey, operation: 'update', confirmed: body.confirmDesktopRestart === true, serverUrl: server.url }, async desktop => {
+        const current = (await rpc('project/read', { projectId })).project;
+        if (current.id !== projectId) fail('项目身份不一致。');
+        if (current.roots.length && rootKey(current.roots.slice(0, 1)) !== rootKey(target.roots.slice(0, 1))) {
+          fail('编辑项目不能修改或移除主目录。');
+        }
+        operation.previousProject ||= current;
+        if (!same(current, operation.previousProject) && !same(current, target)) fail('项目已被其他操作修改，请刷新后重新编辑。');
+        let project = current;
+        if (!same(current, target)) {
+          const rootsChanged = rootKey(current.roots) !== rootKey(target.roots);
+          const roots = rootsChanged ? await projectRoots(rpc, target.roots) : current.roots;
+          operation.updateAttempted = true; save();
+          project = (await rpc('project/update', { projectId, name, roots })).project;
+        }
+        save();
+        const desktopRegistration = await desktop.register(project, operation, save);
+        operation.result = { project: projectSummary(project), desktopRegistration }; save(); return operation.result;
+      });
+    } catch (error) {
+      error.details = { ...error.details, projectUpdatePending: operation.updateAttempted === true };
+      if (operation.updateAttempted) error.message += ' 请继续完成本次同步，会先核对已有修改。';
+      throw error;
+    }
+  }
+}

package/dist/src/runtime-discovery.mjs

@@ -0,0 +1,47 @@
+import { discoverCodex, resolveCodexRuntime, runtimeFingerprint } from './platform/codex-runtime.mjs';
+
+// Advisory discovery is independent of execution health. Failure here must never
+// disable an already running app-server or cause an automatic process restart.
+export class RuntimeDiscovery {
+  constructor({ stateRoot, host, url, interval = 60000 }) {
+    Object.assign(this, { stateRoot, host, url, interval });
+    this.state = {};
+  }
+  start() { this.stopped = false; void this.tick(); }
+  stop() { this.stopped = true; clearTimeout(this.timer); }
+  async sample() {
+    const errors = [];
+    try {
+      const candidates = discoverCodex();
+      const signature = JSON.stringify(candidates.map(candidate => {
+        try { return [candidate.executable, runtimeFingerprint(candidate.executable)]; }
+        catch (error) { return [candidate.executable, error.message]; }
+      }));
+      if (signature !== this.signature) {
+        await resolveCodexRuntime(this.stateRoot, { refresh: true });
+        this.signature = signature;
+      }
+    } catch (error) { errors.push(error.message); }
+    try {
+      if (this.host.desktopIntegration === false) {
+        this.state = { desktop: { state: 'unsupported', integrationSupported: false }, checkedAt: new Date().toISOString() };
+        if (errors.length) this.state.discoveryError = errors.join('\n');
+        return this.state;
+      }
+      const desktop = await this.host.inspect();
+      const attached = desktop.running && await this.host.sharedServiceUrl() === (typeof this.url === 'function' ? this.url() : this.url);
+      this.state = { desktop: { state: !desktop.running ? 'stopped' : attached ? 'managed' : 'ordinary',
+        installed: Boolean(desktop.desktop), version: desktop.version || '', attachedToManagedServer: Boolean(attached) },
+        desktopRestartRecommended: Boolean(desktop.running && !attached), checkedAt: new Date().toISOString() };
+    } catch (error) {
+      errors.push(error.message);
+      this.state = { checkedAt: new Date().toISOString() };
+    }
+    if (errors.length) this.state.discoveryError = errors.join('\n');
+    return this.state;
+  }
+  async tick() {
+    await this.sample();
+    if (!this.stopped) { this.timer = setTimeout(() => this.tick(), this.interval); this.timer.unref?.(); }
+  }
+}

package/dist/src/self-relay/account-cleanup.mjs

@@ -0,0 +1,30 @@
+// Process one account per transaction; foreign keys keep incomplete deletion atomic.
+export async function purgeCancelledAccounts(pool, scopeHash) {
+  let purged = 0;
+  for (;;) {
+    const db = await pool.getConnection();
+    try {
+      await db.beginTransaction();
+      const [rows] = await db.query(`SELECT id FROM users WHERE status='cancelled'
+        AND cancelled_at <= UTC_TIMESTAMP(3) - INTERVAL 1 DAY
+        ORDER BY cancelled_at LIMIT 1 FOR UPDATE`);
+      if (!rows.length) { await db.commit(); return purged; }
+      const id = rows[0].id;
+      const [identities] = await db.execute("SELECT normalized_value FROM user_login_identities WHERE user_id=? AND kind='email'", [id]);
+      for (const { normalized_value: email } of identities) {
+        await db.execute('DELETE FROM email_login_challenges WHERE email=?', [email]);
+        await db.execute('DELETE FROM email_send_limits WHERE scope_hash=?', [scopeHash(`email:${email}`)]);
+        await db.execute('DELETE FROM relay_admin_emails WHERE email=?', [email]);
+      }
+      for (const table of ['user_sessions', 'relay_usage_actions', 'relay_usage_sessions',
+        'relay_usage_user_days', 'relay_usage_budgets', 'relay_usage_entitlements',
+        'relay_usage_totals', 'user_login_identities']) {
+        await db.execute(`DELETE FROM ${table} WHERE user_id=?`, [id]);
+      }
+      await db.execute('UPDATE computers SET owner_user_id=NULL WHERE owner_user_id=?', [id]);
+      await db.execute('DELETE FROM users WHERE id=?', [id]);
+      await db.commit(); purged++;
+    } catch (error) { await db.rollback(); throw error; }
+    finally { db.release(); }
+  }
+}

package/dist/src/self-relay/account-connections.mjs

@@ -0,0 +1,52 @@
+import { digest } from './wire.mjs';
+
+// Register before the asynchronous database check so logout also invalidates
+// handshakes whose successful authentication response has not arrived yet.
+export function accountConnections() {
+  const sessions = new Map();
+  return {
+    track(token, onInvalid) {
+      const key = digest(token);
+      const entries = sessions.get(key) || new Set();
+      sessions.set(key, entries);
+      let active = true, expires = Infinity, timer;
+      function dispose() {
+        active = false;
+        clearTimeout(timer);
+        entries.delete(entry);
+        if (!entries.size && sessions.get(key) === entries) sessions.delete(key);
+      }
+      function invalidate() {
+        if (!active) return;
+        dispose();
+        onInvalid();
+      }
+      function valid() {
+        if (active && Date.now() >= expires) invalidate();
+        return active;
+      }
+      function schedule() {
+        if (!valid()) return;
+        // Login lasts 30 days, longer than Node's maximum timer delay.
+        timer = setTimeout(schedule, Math.min(expires - Date.now(), 0x7fffffff));
+        timer.unref();
+      }
+      const entry = {
+        activate(expiresAt) {
+          if (!active) return false;
+          expires = Date.parse(expiresAt);
+          if (!Number.isFinite(expires)) { invalidate(); return false; }
+          schedule();
+          return active;
+        },
+        valid, dispose, invalidate,
+      };
+      entries.add(entry);
+      return entry;
+    },
+    revoke(token) {
+      const entries = sessions.get(digest(token));
+      if (entries) for (const entry of [...entries]) entry.invalidate();
+    },
+  };
+}

package/dist/src/self-relay/admin-cloud.mjs

@@ -0,0 +1,101 @@
+import fs from 'node:fs';
+import tencentcloud from 'tencentcloud-sdk-nodejs-common';
+
+const INSTANCE_ID = 'lhins-byrs7n8o';
+const REGION = 'ap-beijing';
+const { CommonClient } = tencentcloud;
+const METRICS = [
+  ['LighthouseOutratio', 'outRatioPercent', 10],
+  ['LighthouseOuttraffic', 'outMbps', 10],
+  ['LighthouseIntraffic', 'inMbps', 10],
+  ['CpuUsage', 'cpuPercent', 10],
+  ['MemUsage', 'memoryPercent', 10],
+  ['DiskUsage', 'diskPercent', 60],
+  ['CpuLoad1', 'cpuLoad1', 10],
+];
+
+function latestPoint(result) {
+  const point = result?.DataPoints?.[0];
+  if (!point?.Values?.length || !point?.Timestamps?.length) return null;
+  const index = point.Values.length - 1;
+  const value = Number(point.Values[index]);
+  const timestamp = Number(point.Timestamps[index]);
+  return Number.isFinite(value) && Number.isFinite(timestamp)
+    ? { value, sampledAt: new Date(timestamp * 1000).toISOString() } : null;
+}
+
+export function startAdminCloud({ credentialFile = process.env.CREDENTIALS_DIRECTORY
+  ? `${process.env.CREDENTIALS_DIRECTORY}/tencent-monitor.json` : null,
+  metricIntervalMs = 60000, trafficIntervalMs = 300000 } = {}) {
+  if (!credentialFile) return { read: () => ({ configured: false }), close() {} };
+  const { secretId, secretKey } = JSON.parse(fs.readFileSync(credentialFile, 'utf8'));
+  if (!secretId || !secretKey) throw new Error('Tencent monitor credentials are incomplete');
+  const credential = { secretId, secretKey };
+  const profile = { httpProfile: { reqTimeout: 8 } };
+  const monitor = new CommonClient('monitor.tencentcloudapi.com', '2018-07-24',
+    { credential, region: REGION, profile });
+  const lighthouse = new CommonClient('lighthouse.tencentcloudapi.com', '2020-03-24',
+    { credential, region: REGION, profile });
+  let closed = false;
+  let metricBusy = false;
+  let trafficBusy = false;
+  const current = { configured: true, metricAvailable: false, trafficAvailable: false,
+    outRatioPercent: null, outMbps: null, inMbps: null, metricSampledAt: null,
+    cpuPercent: null, memoryPercent: null, diskPercent: null, cpuLoad1: null,
+    trafficUsedBytes: null, trafficTotalBytes: null, trafficRemainingBytes: null,
+    trafficStartAt: null, trafficEndAt: null, trafficSampledAt: null };
+
+  async function sampleMetrics() {
+    if (metricBusy || closed) return;
+    metricBusy = true;
+    const end = new Date();
+    const base = { Namespace: 'QCE/LIGHTHOUSE',
+      StartTime: new Date(end.getTime() - 180000).toISOString(), EndTime: end.toISOString(),
+      Instances: [{ Dimensions: [{ Name: 'InstanceId', Value: INSTANCE_ID }] }] };
+    try {
+      const values = await Promise.allSettled(METRICS.map(([MetricName, , Period]) =>
+        monitor.request('GetMonitorData', { ...base, MetricName, Period })));
+      if (closed) return;
+      const samples = values.map(result => result.status === 'fulfilled' ? latestPoint(result.value) : null);
+      for (let index = 0; index < METRICS.length; index++) {
+        const [, field] = METRICS[index];
+        const value = samples[index]?.value ?? null;
+        current[field] = value !== null && (field === 'outMbps' || field === 'inMbps') ? value * 8 : value;
+      }
+      current.metricSampledAt = samples.reduce((latest, sample) => sample?.sampledAt > latest
+        ? sample.sampledAt : latest, '') || null;
+      current.metricAvailable = Boolean(current.metricSampledAt);
+    } catch {
+      current.metricAvailable = false;
+    } finally { metricBusy = false; }
+  }
+
+  async function sampleTraffic() {
+    if (trafficBusy || closed) return;
+    trafficBusy = true;
+    try {
+      const data = await lighthouse.request('DescribeInstancesTrafficPackages', { InstanceIds: [INSTANCE_ID] });
+      if (closed) return;
+      const packages = data?.InstanceTrafficPackageSet?.find(item => item.InstanceId === INSTANCE_ID)?.TrafficPackageSet || [];
+      const active = packages.find(item => Date.parse(item.StartTime) <= Date.now()
+        && Date.parse(item.EndTime) >= Date.now()) || packages[0];
+      current.trafficUsedBytes = active?.TrafficUsed ?? null;
+      current.trafficTotalBytes = active?.TrafficPackageTotal ?? null;
+      current.trafficRemainingBytes = active?.TrafficPackageRemaining ?? null;
+      current.trafficStartAt = active?.StartTime ?? null;
+      current.trafficEndAt = active?.EndTime ?? null;
+      current.trafficSampledAt = active ? new Date().toISOString() : null;
+      current.trafficAvailable = Boolean(active);
+    } catch {
+      current.trafficAvailable = false;
+    } finally { trafficBusy = false; }
+  }
+
+  void sampleMetrics();
+  void sampleTraffic();
+  const metricTimer = setInterval(sampleMetrics, metricIntervalMs);
+  const trafficTimer = setInterval(sampleTraffic, trafficIntervalMs);
+  metricTimer.unref();
+  trafficTimer.unref();
+  return { read: () => ({ ...current }), close() { closed = true; clearInterval(metricTimer); clearInterval(trafficTimer); } };
+}