pyre-cli 3.4.0 → 3.6.0

package/src/p2p/server.test.ts

@@ -0,0 +1,543 @@
+import { describe, it, after, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import net from 'node:net';
+import { P2PServer, startP2PServer } from './server.js';
+import { hashPassword, generateNonce, signMessage, decodeMessage } from './protocol.js';
+
+const TEST_PASSWORD = 'test-secret-password';
+const TEST_HOST = '127.0.0.1';
+const HEADER_SIZE = 4;
+
+function getFreePort(): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const srv = net.createServer();
+    srv.listen(0, '127.0.0.1', () => {
+      const addr = srv.address();
+      const port = typeof addr === 'object' ? addr.port : 0;
+      srv.close(() => resolve(port));
+    });
+    srv.on('error', reject);
+  });
+}
+
+function delay(ms: number): Promise<void> {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+function readMessage(socket: net.Socket): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    function readHeader(): void {
+      if (socket.readableLength < HEADER_SIZE) {
+        socket.once('readable', readHeader);
+        return;
+      }
+      const header = socket.read(HEADER_SIZE);
+      if (!header || header.length < HEADER_SIZE) {
+        reject(new Error('Failed to read message header'));
+        return;
+      }
+      const length = header.readUInt32BE(0);
+      readBody(length);
+    }
+
+    function readBody(length: number): void {
+      if (socket.readableLength < length) {
+        socket.once('readable', () => readBody(length));
+        return;
+      }
+      const body = socket.read(length);
+      if (!body || body.length < length) {
+        reject(new Error('Failed to read message body'));
+        return;
+      }
+      resolve(body);
+    }
+
+    readHeader();
+  });
+}
+
+function makeAuthMessage(password: string, nonce: string) {
+  const passwordHash = hashPassword(password, nonce);
+  return signMessage('auth', { passwordHash, nonce }, password);
+}
+
+describe('P2PServer - server-side p2p system', () => {
+  let server: P2PServer | null = null;
+  let serverPort: number = 0;
+
+  afterEach(async () => {
+    if (server) {
+      server.stop();
+      server = null;
+    }
+  });
+
+  after(async () => {
+    if (server) {
+      server.stop();
+    }
+  });
+
+  describe('server lifecycle', () => {
+    it('should start and listen on a TCP port', async () => {
+      serverPort = await getFreePort();
+      server = new P2PServer({
+        host: TEST_HOST,
+        port: serverPort,
+        password: TEST_PASSWORD,
+        intervalMs: 1000,
+        detailed: false,
+      });
+      await server.start();
+      assert.strictEqual(server.info.port, serverPort);
+      assert.strictEqual(server.info.host, TEST_HOST);
+      assert.strictEqual(server.info.peersConnected, 0);
+    });
+
+    it('should report correct connection info after start', async () => {
+      serverPort = await getFreePort();
+      server = new P2PServer({
+        host: TEST_HOST,
+        port: serverPort,
+        password: TEST_PASSWORD,
+        intervalMs: 1000,
+        detailed: false,
+      });
+      await server.start();
+      const info = server.info;
+      assert.strictEqual(info.host, TEST_HOST);
+      assert.strictEqual(info.port, serverPort);
+      assert.strictEqual(info.peersConnected, 0);
+    });
+
+    it('should stop and clear all peers', async () => {
+      serverPort = await getFreePort();
+      server = new P2PServer({
+        host: TEST_HOST,
+        port: serverPort,
+        password: TEST_PASSWORD,
+        intervalMs: 1000,
+        detailed: false,
+      });
+      await server.start();
+      server.stop();
+      assert.strictEqual(server.info.peersConnected, 0);
+    });
+
+    it('should emit peer events on startup', async () => {
+      serverPort = await getFreePort();
+      server = new P2PServer({
+        host: TEST_HOST,
+        port: serverPort,
+        password: TEST_PASSWORD,
+        intervalMs: 1000,
+        detailed: false,
+      });
+      await server.start();
+      const events = server.peerEventHistory;
+      assert.ok(events.length > 0, 'Expected at least one peer event');
+      const connectEvent = events.find(e => e.type === 'connect');
+      assert.ok(connectEvent, 'Expected a connect event in history');
+    });
+
+    it('should support startP2PServer convenience function', async () => {
+      serverPort = await getFreePort();
+      server = await startP2PServer({
+        host: TEST_HOST,
+        port: serverPort,
+        password: TEST_PASSWORD,
+        intervalMs: 1000,
+        detailed: false,
+      });
+      assert.strictEqual(server.info.port, serverPort);
+    });
+  });
+
+  describe('challenge-response authentication', () => {
+    it('should send a challenge with a nonce on new connection', async () => {
+      serverPort = await getFreePort();
+      server = new P2PServer({
+        host: TEST_HOST,
+        port: serverPort,
+        password: TEST_PASSWORD,
+        intervalMs: 1000,
+        detailed: false,
+      });
+      await server.start();
+
+      const client = new net.Socket();
+      client.connect(serverPort, TEST_HOST);
+
+      const body = await readMessage(client);
+      const msg = decodeMessage(body);
+      assert.strictEqual(msg.kind, 'challenge');
+      const payload = msg.payload as { nonce: string };
+      assert.ok(payload.nonce, 'Expected a nonce in the challenge message');
+      client.destroy();
+    });
+
+    it('should authenticate a client with the correct password', async () => {
+      serverPort = await getFreePort();
+      server = new P2PServer({
+        host: TEST_HOST,
+        port: serverPort,
+        password: TEST_PASSWORD,
+        intervalMs: 1000,
+        detailed: false,
+      });
+      await server.start();
+
+      const client = new net.Socket();
+      client.connect(serverPort, TEST_HOST);
+
+      const challengeBody = await readMessage(client);
+      const challengeMsg = decodeMessage(challengeBody);
+      const nonce = (challengeMsg.payload as { nonce: string }).nonce;
+      client.write(makeAuthMessage(TEST_PASSWORD, nonce));
+
+      const authBody = await readMessage(client);
+      const authMsg = decodeMessage(authBody);
+      assert.strictEqual(authMsg.kind, 'auth-ok');
+      assert.strictEqual((authMsg.payload as { ok: boolean }).ok, true);
+      assert.strictEqual(server!.info.peersConnected, 1);
+      assert.ok(server!.peerEventHistory.some(e => e.type === 'auth'), 'Expected auth event in history');
+
+      client.destroy();
+    });
+
+    it('should reject authentication with wrong password', async () => {
+      serverPort = await getFreePort();
+      server = new P2PServer({
+        host: TEST_HOST,
+        port: serverPort,
+        password: TEST_PASSWORD,
+        intervalMs: 1000,
+        detailed: false,
+      });
+      await server.start();
+
+      const client = new net.Socket();
+      client.connect(serverPort, TEST_HOST);
+
+      const challengeBody = await readMessage(client);
+      const challengeMsg = decodeMessage(challengeBody);
+      const nonce = (challengeMsg.payload as { nonce: string }).nonce;
+      client.write(makeAuthMessage('wrong-password', nonce));
+
+      const failBody = await readMessage(client);
+      const failMsg = decodeMessage(failBody);
+      assert.strictEqual(failMsg.kind, 'auth-fail');
+      const failPayload = failMsg.payload as { reason: string };
+      assert.ok(
+        failPayload.reason.toLowerCase().includes('password') || failPayload.reason.toLowerCase().includes('invalid'),
+        `Expected password-related failure reason, got: ${failPayload.reason}`
+      );
+      assert.strictEqual(server!.info.peersConnected, 0, 'No peers should be connected after failed auth');
+
+      client.destroy();
+    });
+
+    it('should reject auth message with empty nonce', async () => {
+      serverPort = await getFreePort();
+      server = new P2PServer({
+        host: TEST_HOST,
+        port: serverPort,
+        password: TEST_PASSWORD,
+        intervalMs: 1000,
+        detailed: false,
+      });
+      await server.start();
+
+      const client = new net.Socket();
+      client.connect(serverPort, TEST_HOST);
+
+      const challengeBody = await readMessage(client);
+      const challengeMsg = decodeMessage(challengeBody);
+      const nonce = (challengeMsg.payload as { nonce: string }).nonce;
+
+      client.write(signMessage('auth', { passwordHash: 'somehash', nonce: '' }, TEST_PASSWORD));
+
+      const failBody = await readMessage(client);
+      const failMsg = decodeMessage(failBody);
+      assert.strictEqual(failMsg.kind, 'auth-fail');
+
+      client.destroy();
+    });
+
+    it('should reject non-auth messages sent before authentication', async () => {
+      serverPort = await getFreePort();
+      server = new P2PServer({
+        host: TEST_HOST,
+        port: serverPort,
+        password: TEST_PASSWORD,
+        intervalMs: 1000,
+        detailed: false,
+      });
+      await server.start();
+
+      const client = new net.Socket();
+      client.connect(serverPort, TEST_HOST);
+
+      const challengeBody = await readMessage(client);
+      const challengeMsg = decodeMessage(challengeBody);
+      const nonce = (challengeMsg.payload as { nonce: string }).nonce;
+
+      client.write(signMessage('data', { stats: {} }, TEST_PASSWORD));
+
+      const failBody = await readMessage(client);
+      const failMsg = decodeMessage(failBody);
+      assert.strictEqual(failMsg.kind, 'auth-fail');
+
+      client.destroy();
+    });
+
+    it('should disconnect client after wrong password attempt', async () => {
+      serverPort = await getFreePort();
+      server = new P2PServer({
+        host: TEST_HOST,
+        port: serverPort,
+        password: TEST_PASSWORD,
+        intervalMs: 1000,
+        detailed: false,
+      });
+      await server.start();
+
+      const client = new net.Socket();
+      client.connect(serverPort, TEST_HOST);
+
+      const challengeBody = await readMessage(client);
+      const challengeMsg = decodeMessage(challengeBody);
+      const nonce = (challengeMsg.payload as { nonce: string }).nonce;
+      client.write(makeAuthMessage('wrong-password', nonce));
+
+      const failBody = await readMessage(client);
+      decodeMessage(failBody);
+
+      await delay(200);
+      assert.ok(server!.info.peersConnected === 0, 'Server should have no connected peers after failed auth');
+
+      client.destroy();
+    });
+  });
+
+  describe('data streaming', () => {
+    it('should stream StatsData to an authenticated client', async () => {
+      serverPort = await getFreePort();
+      server = new P2PServer({
+        host: TEST_HOST,
+        port: serverPort,
+        password: TEST_PASSWORD,
+        intervalMs: 200,
+        detailed: false,
+      });
+      await server.start();
+
+      const client = new net.Socket();
+      client.connect(serverPort, TEST_HOST);
+
+      const challengeBody = await readMessage(client);
+      const challengeMsg = decodeMessage(challengeBody);
+      const nonce = (challengeMsg.payload as { nonce: string }).nonce;
+      client.write(makeAuthMessage(TEST_PASSWORD, nonce));
+
+      const authBody = await readMessage(client);
+      const authMsg = decodeMessage(authBody);
+      assert.strictEqual(authMsg.kind, 'auth-ok');
+
+      const dataBody = await readMessage(client);
+      const dataMsg = decodeMessage(dataBody);
+      assert.strictEqual(dataMsg.kind, 'data');
+
+      client.destroy();
+    });
+
+    it('should send multiple data messages on interval', async () => {
+      serverPort = await getFreePort();
+      server = new P2PServer({
+        host: TEST_HOST,
+        port: serverPort,
+        password: TEST_PASSWORD,
+        intervalMs: 150,
+        detailed: false,
+      });
+      await server.start();
+
+      const client = new net.Socket();
+      client.connect(serverPort, TEST_HOST);
+
+      const challengeBody = await readMessage(client);
+      const challengeMsg = decodeMessage(challengeBody);
+      const nonce = (challengeMsg.payload as { nonce: string }).nonce;
+      client.write(makeAuthMessage(TEST_PASSWORD, nonce));
+
+      const authBody = await readMessage(client);
+      const authMsg = decodeMessage(authBody);
+      assert.strictEqual(authMsg.kind, 'auth-ok');
+
+      const dataBody1 = await readMessage(client);
+      assert.strictEqual(decodeMessage(dataBody1).kind, 'data');
+
+      const dataBody2 = await readMessage(client);
+      assert.strictEqual(decodeMessage(dataBody2).kind, 'data');
+
+      client.destroy();
+    });
+  });
+
+  describe('ping/pong', () => {
+    it('should exchange ping and pong after authentication', async () => {
+      serverPort = await getFreePort();
+      server = new P2PServer({
+        host: TEST_HOST,
+        port: serverPort,
+        password: TEST_PASSWORD,
+        intervalMs: 1000,
+        detailed: false,
+      });
+      await server.start();
+
+      const client = new net.Socket();
+      client.connect(serverPort, TEST_HOST);
+
+      const challengeBody = await readMessage(client);
+      const challengeMsg = decodeMessage(challengeBody);
+      const nonce = (challengeMsg.payload as { nonce: string }).nonce;
+      client.write(makeAuthMessage(TEST_PASSWORD, nonce));
+
+      const authBody = await readMessage(client);
+      assert.strictEqual(decodeMessage(authBody).kind, 'auth-ok');
+
+      const dataBody = await readMessage(client);
+      assert.strictEqual(decodeMessage(dataBody).kind, 'data');
+
+      let pingCount = 0;
+      const deadline = Date.now() + 12000;
+      while (Date.now() < deadline && pingCount < 1) {
+        const msg = await readMessage(client);
+        const kind = decodeMessage(msg).kind;
+        if (kind === 'ping') {
+          pingCount++;
+          const ts = (decodeMessage(msg).payload as { ts: number }).ts;
+          client.write(signMessage('pong', { ts }, TEST_PASSWORD));
+        }
+      }
+      assert.ok(pingCount >= 1, 'Expected at least 1 ping after authentication');
+
+      client.destroy();
+    });
+
+    it('should continue pinging a long-lived connection', async () => {
+      serverPort = await getFreePort();
+      server = new P2PServer({
+        host: TEST_HOST,
+        port: serverPort,
+        password: TEST_PASSWORD,
+        intervalMs: 1000,
+        detailed: false,
+      });
+      await server.start();
+
+      const client = new net.Socket();
+      client.connect(serverPort, TEST_HOST);
+
+      const challengeBody = await readMessage(client);
+      const challengeMsg = decodeMessage(challengeBody);
+      const nonce = (challengeMsg.payload as { nonce: string }).nonce;
+      client.write(makeAuthMessage(TEST_PASSWORD, nonce));
+
+      const authBody = await readMessage(client);
+      assert.strictEqual(decodeMessage(authBody).kind, 'auth-ok');
+
+      const firstData = await readMessage(client);
+      assert.strictEqual(decodeMessage(firstData).kind, 'data');
+
+      let pingCount = 0;
+      const deadline = Date.now() + 16000;
+      while (Date.now() < deadline && pingCount < 3) {
+        const msg = await readMessage(client);
+        const kind = decodeMessage(msg).kind;
+        if (kind === 'ping') {
+          pingCount++;
+          const ts = (decodeMessage(msg).payload as { ts: number }).ts;
+          client.write(signMessage('pong', { ts }, TEST_PASSWORD));
+        }
+      }
+      assert.ok(pingCount >= 3, `Expected at least 3 pings, got ${pingCount}`);
+
+      client.destroy();
+    });
+  });
+
+  describe('peer event history', () => {
+    it('should track connect, auth, and disconnect events', async () => {
+      serverPort = await getFreePort();
+      server = new P2PServer({
+        host: TEST_HOST,
+        port: serverPort,
+        password: TEST_PASSWORD,
+        intervalMs: 1000,
+        detailed: false,
+      });
+      await server.start();
+
+      const client = new net.Socket();
+      client.connect(serverPort, TEST_HOST);
+
+      const challengeBody = await readMessage(client);
+      const challengeMsg = decodeMessage(challengeBody);
+      const nonce = (challengeMsg.payload as { nonce: string }).nonce;
+      client.write(makeAuthMessage(TEST_PASSWORD, nonce));
+
+      const authBody = await readMessage(client);
+      assert.strictEqual(decodeMessage(authBody).kind, 'auth-ok');
+
+      assert.ok(
+        server!.peerEventHistory.some(e => e.type === 'connect'),
+        'Expected connect event in history'
+      );
+      assert.ok(
+        server!.peerEventHistory.some(e => e.type === 'auth'),
+        'Expected auth event in history'
+      );
+
+      client.destroy();
+
+      await delay(200);
+
+      assert.ok(
+        server!.peerEventHistory.some(e => e.type === 'disconnect'),
+        'Expected disconnect event in history'
+      );
+    });
+
+    it('should cap peer event history at 200 entries', async () => {
+      serverPort = await getFreePort();
+      server = new P2PServer({
+        host: TEST_HOST,
+        port: serverPort,
+        password: TEST_PASSWORD,
+        intervalMs: 1000,
+        detailed: false,
+      });
+      await server.start();
+
+      assert.ok(server.peerEventHistory.length <= 200, 'Expected event history to be capped at 200');
+    });
+  });
+
+  describe('convenience start function', () => {
+    it('startP2PServer should create and start a server', async () => {
+      serverPort = await getFreePort();
+      server = await startP2PServer({
+        host: TEST_HOST,
+        port: serverPort,
+        password: TEST_PASSWORD,
+        intervalMs: 1000,
+        detailed: false,
+      });
+      assert.strictEqual(server.info.port, serverPort);
+      assert.strictEqual(server.info.host, TEST_HOST);
+    });
+  });
+});

package/src/rest.md

@@ -0,0 +1,129 @@
+# src/ — Top-Level Module Files
+
+These files live directly in `src/` (not in subdirectories) and provide shared utilities and the main CLI entry point for pyre.
+
+## Files
+
+| File | Purpose |
+|------|---------|
+| `index.ts` | Main CLI entry point — argument parsing, mode dispatch, snapshot output |
+| `sparkline.ts` | Unicode block-character sparkline renderer |
+| `splash.ts` | ASCII fire-effect splash screen shown on startup |
+| `history.ts` | Rolling window of metric samples for graph rendering |
+
+## `index.ts` — Main CLI Entry Point
+
+The primary entry point for the pyre application. Parses CLI arguments with `commander`, dispatches to the appropriate mode (live dashboard, one-shot snapshot, P2P server/client), and handles output formatting.
+
+### CLI Options
+
+| Option | Description |
+|--------|-------------|
+| `-j, --json` | Output as JSON |
+| `-c, --csv` | Output as CSV |
+| `-t, --tsv` | Output as TSV |
+| `--detailed` | Include detailed system info and sensor readings |
+| `--theme <name>` | Default theme for live mode (default, dracula, cyberpunk, monochrome, nord, gruvbox) |
+| `--interval <seconds>` | Refresh interval for live mode (default 2) |
+| `--once` | Show a single static snapshot instead of live feed |
+| `--out <file>` | Also write snapshot output to a file |
+| `--export-dir <dir>` | Directory for live-mode snapshot exports and logs |
+| `--log` | Start continuous CSV logging immediately when live mode starts |
+| `--tree` | Show process tree view instead of flat list |
+| `--sort <key>` | Sort processes by: cpu, mem, pid, user, command, state, threads, runtime |
+| `--packets` | Include packet monitor panel in output |
+| `--limit <n>` | Max processes in snapshot (0 = all) |
+| `--p2p-host <host>` | P2P host address |
+| `--p2p-port <port>` | P2P port number (default 9876) |
+| `--p2p-password <password>` | P2P authentication password |
+| `--p2p-tls` | Enable TLS for P2P connections |
+| `--p2p-cert <file>` | TLS certificate file (PEM) |
+| `--p2p-key <file>` | TLS private key file (PEM) |
+| `--p2p-ca <file>` | TLS CA certificate file (PEM) |
+| `--p2p-insecure` | Skip TLS certificate verification |
+| `--p2p-rate-limit <n>` | Max auth attempts per IP per minute (default 5) |
+| `--p2p-allow <ips>` | Comma-separated allowed IPs |
+| `--p2p-deny <ips>` | Comma-separated denied IPs |
+| `--p2p-audit-log <dir>` | Directory for P2P audit logs |
+| `--p2p-hmac-key <key>` | HMAC key for message signing |
+
+### Mode Dispatch
+
+1. **Live mode** (`pyre live` or default without export/once flags) — starts the interactive dashboard via `startLive()`.
+2. **P2P mode** (`pyre p2p <server|connect>`) — starts a P2P server or connects as a client.
+3. **Export/once mode** (`--json`, `--csv`, `--tsv`, or `--once`) — collects a single snapshot and outputs it.
+
+### Snapshot Output Flow
+
+For one-shot modes:
+1. Calls `collectAll()` to gather system metrics.
+2. Formats output via `formatTable()`, `formatJson()`, `formatCsv()`, or `formatTsv()` depending on flags.
+3. Writes to stdout and optionally to a file (`--out`).
+
+### Imports
+
+- `collectAll` from `./monitors/index.js`
+- `formatTable`, `formatJson`, `formatCsv`, `formatTsv` from `./formatters/index.js`
+- `startLive`, `stopLive` from `./live/index.js`
+- `showSplash` from `./splash.js`
+- `P2PServer`, `P2PClient` from `./p2p/index.js`
+
+## `sparkline.ts` — Sparkline Renderer
+
+Renders a series of numbers as a compact Unicode block-character sparkline suitable for inline terminal graphs.
+
+### `sparkline(values, opts?): string`
+
+- `values: number[]` — numeric series to render
+- `opts.min?: number` — minimum value for normalisation (auto-computed if omitted)
+- `opts.max?: number` — maximum value for normalisation (auto-computed if omitted)
+- Returns a string of block characters (`▁▂▃▄▅▆█`) whose length equals `values.length`
+
+Uses 8 Unicode block characters to represent the range. Values are normalised against `min`/`max` (auto-computed from the data if not supplied). Returns an empty string for an empty input array.
+
+## `splash.ts` — ASCII Splash Screen
+
+Displays an animated ASCII fire-effect splash screen on startup, based on the Doom fire effect algorithm.
+
+### `showSplash(): Promise<void>`
+
+Renders a 60×15 fire animation using:
+- A `Uint8Array` heat grid with random ignition at the bottom row
+- Fire propagation with decay and horizontal drift
+- A 36-level colour palette mapping heat values to RGB colours
+- Unicode character ramp (` ` → `.` → `` ` `` → `,` → `:` → `;` → `+` → `*` → `?` → `%` → `#` → `@`) for intensity representation
+- Centered "🔥 pyre — system monitor (warming up sensors...)" text
+- Auto-exits after 5 seconds or on any keypress
+
+Uses ANSI escape sequences to clear the screen and position the output. Returns a Promise that resolves when the splash is dismissed.
+
+## `history.ts` — Rolling Metric Window
+
+Maintains a rolling window of recent metric samples used to render sparkline graphs in the live dashboard. Network rates (bytes/sec) are derived from cumulative counters by computing deltas between consecutive samples.
+
+### `History` Class
+
+#### Constructor
+`new History(maxLen?)` — creates a rolling window retaining up to `maxLen` samples (default 40).
+
+#### Properties
+- `maxLen: number` — maximum samples retained
+- `cpuUsage: number[]` — rolling window of CPU usage percentages (0–100)
+- `memUsage: number[]` — rolling window of memory usage percentages (0–100)
+- `temp: number[]` — rolling window of CPU die temperatures in °C
+- `netRxRate: number[]` — rolling window of network receive rates in bytes/sec
+- `netTxRate: number[]` — rolling window of network transmit rates in bytes/sec
+- `gpuUtil: number[]` — rolling window of GPU utilization percentages (0–100)
+- `powerWatts: number[]` — rolling window of combined power draw in watts
+- `rxPacketRate: number[]` — rolling window of network receive packet rates in packets/sec
+- `txPacketRate: number[]` — rolling window of network transmit packet rates in packets/sec
+- `connections: number[]` — rolling window of active TCP connections
+
+#### Methods
+
+- `push(sample)` — pushes a new sample into the rolling window. Computes network rates as bytes/sec from cumulative counters. The first sample always reports 0 for rates.
+  - `sample` fields: `cpuUsage`, `memUsage`, `temp` (nullable), `rxBytes`, `txBytes`, `gpuUtil?`, `powerWatts?`, `rxPackets?`, `txPackets?`, `connections?`
+
+- `reset()` — clears all rolling windows and resets cumulative byte counters.
+
+- `setMaxLen(n)` — grows or shrinks the rolling window, trimming oldest samples. `n` is clamped to at least 1.

package/src/sparkline.ts

@@ -20,8 +20,14 @@ const BLOCKS = '▁▂▃▄▅▆▇█';
  */
 export function sparkline(values: number[], opts: { min?: number; max?: number } = {}): string {
   if (!values.length) return '';
-  const min = opts.min ?? Math.min(...values);
-  const max = opts.max ?? Math.max(...values);
+  let min = opts.min ?? Infinity;
+  let max = opts.max ?? -Infinity;
+  if (opts.min === undefined || opts.max === undefined) {
+    for (const v of values) {
+      if (v < min) min = v;
+      if (v > max) max = v;
+    }
+  }
   const range = max - min || 1;
 
   return values