/** One observation of a running process, taken from a single read. */
export interface ProcessInstance {
    pid: number;
    /** Start-time token; with the PID it names this process across PID reuse. */
    start: string;
    ppid: number;
    /**
     * The exact argv where the platform exposes it (`/proc`), or null where
     * only display text is available (`ps`, which joins argv with spaces).
     */
    argv: readonly string[] | null;
    /** argv joined by single spaces, for logs. */
    command: string;
}
/**
 * What one read of a PID found. `gone` is confirmed absence: no such
 * process, or a zombie. `unknown` is a read that failed (a timeout, a
 * permission error, output that does not parse), which never proves that
 * the process exited.
 */
export type ProcessLookup = {
    state: 'running';
    process: ProcessInstance;
} | {
    state: 'gone';
} | {
    state: 'unknown';
    reason: string;
};
export type ProcessTreeWalker = (rootPid: number) => Promise<Set<number>>;
export type ProcessInspector = (pid: number) => Promise<ProcessLookup>;
/**
 * Whether one of a process's open descriptors points at a target `matches`
 * accepts (Linux). Stops at the first match; a process that exits or cannot
 * be read has none.
 */
export declare function procHasFdTarget(pid: number, matches: (target: string) => boolean): Promise<boolean>;
/**
 * Every process (Linux) with an open descriptor whose target `matches`
 * accepts, reading at most PROC_FD_SCAN_CONCURRENCY processes at once so a
 * host with thousands of processes is scanned without a burst of open
 * directory handles.
 */
export declare function procPidsWithFdTarget(matches: (target: string) => boolean): Promise<number[]>;
export declare const linuxProcessTree: ProcessTreeWalker;
/** Descendants from one `ps` snapshot, for Unix hosts without `/proc`. */
export declare const psProcessTree: ProcessTreeWalker;
/** Reads one `/proc` file as text; rejects like `fs.readFile`. */
export type ProcReader = (path: string) => Promise<string>;
/**
 * Inspect a process through `/proc` (Linux). Fields after `(comm)`, which may
 * itself contain spaces and parens: state is field 3, ppid field 4, starttime
 * field 22 (clock ticks since boot). A zombie has exited even though its
 * entry remains.
 */
export declare function procProcessInspector(read?: ProcReader): ProcessInspector;
export declare const procInspectProcess: ProcessInspector;
/** Runs `ps` with these arguments; rejects like `execFile` (`code`, `killed`, `stdout`, `stderr`). */
export type PsRunner = (args: readonly string[]) => Promise<{
    stdout: string;
}>;
/**
 * Inspect a process with one `ps` call. `ps -p` exits 1 with no output when
 * no such process exists; any other failure (a timeout, a missing `ps`, a
 * message on stderr, output that does not parse) is not proof of exit.
 */
export declare function psProcessInspector(run?: PsRunner): ProcessInspector;
export declare const psInspectProcess: ProcessInspector;
/** An identifier of the current boot, or null when the host offers none. */
export type BootIdReader = () => Promise<string | null>;
/** Runs `sysctl` with these arguments; rejects like `execFile`. */
export type SysctlRunner = (args: readonly string[]) => Promise<{
    stdout: string;
}>;
/**
 * The current boot's identifier, which scopes a recorded PID and start time
 * to the boot it was taken in: after a reboot, both can recur for another
 * process. Linux: `/proc/sys/kernel/random/boot_id`; macOS:
 * `kern.bootsessionuuid`; other BSDs: `kern.boottime`. Null when it cannot be
 * read.
 */
export declare function bootIdReader(platform: NodeJS.Platform, io?: {
    read?: ProcReader;
    run?: SysctlRunner;
}): BootIdReader;
export declare function processTreeWalker(platform: NodeJS.Platform): ProcessTreeWalker;
export declare function processInspector(platform: NodeJS.Platform): ProcessInspector;
//# sourceMappingURL=process-probe.d.ts.map