@kar-mi/spirit-vale-tools-capture 2.4.2 → 2.5.0

package/dist/capture/adapter-selection.d.ts

@@ -5,5 +5,5 @@ export interface AdapterResolution {
     detail?: string;
 }
 export declare function resolveCaptureDevice(devices: readonly NpcapDevice[], requestedName?: string): Promise<AdapterResolution>;
-export declare function chooseDeviceByRouteOutput(devices: readonly NpcapDevice[], output: string): NpcapDevice | undefined;
+export declare function chooseDeviceByRouteAddress(devices: readonly NpcapDevice[], address: string): NpcapDevice | undefined;
 //# sourceMappingURL=adapter-selection.d.ts.map

package/dist/capture/adapter-selection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter-selection.d.ts","sourceRoot":"","sources":["../../src/capture/adapter-selection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,iBAAiB,CAAC,CAa5B;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAYlH"}
+{"version":3,"file":"adapter-selection.d.ts","sourceRoot":"","sources":["../../src/capture/adapter-selection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG9C,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,iBAAiB,CAAC,CAa5B;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,OAAO,EAAE,MAAM,GACd,WAAW,GAAG,SAAS,CAEzB"}

package/dist/capture/npcap.d.ts

@@ -1,4 +1,4 @@
-export type NpcapAvailability = "ready" | "missing" | "admin-only" | "error";
+export type NpcapAvailability = "ready" | "missing" | "error";
 export interface NpcapStatus {
     availability: NpcapAvailability;
     detail: string;
@@ -32,6 +32,7 @@ export declare class SystemNpcapRuntime implements NpcapRuntime {
     private readyStatus?;
     status(): Promise<NpcapStatus>;
     listDevices(): Promise<NpcapDevice[]>;
+    private enumerateDevices;
     open(device: NpcapDevice, filter: string): Promise<NpcapSession>;
     private load;
 }

package/dist/capture/npcap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npcap.d.ts","sourceRoot":"","sources":["../../src/capture/npcap.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,GAAG,OAAO,CAAC;AAE7E,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,iBAAiB,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,IAAI,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,UAAU,IAAI,WAAW,GAAG,SAAS,CAAC;IACtC,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/B,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAClE;AAID,qBAAa,kBAAmB,YAAW,YAAY;IACrD,OAAO,CAAC,GAAG,CAAC,CAAc;IAC1B,OAAO,CAAC,WAAW,CAAC,CAAc;IAE5B,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,CA0BnC;IAEK,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAiC1C;IAEK,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAiCrE;IAED,OAAO,CAAC,IAAI;CAyBb"}
+{"version":3,"file":"npcap.d.ts","sourceRoot":"","sources":["../../src/capture/npcap.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;AAE9D,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,iBAAiB,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,IAAI,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,UAAU,IAAI,WAAW,GAAG,SAAS,CAAC;IACtC,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/B,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAClE;AAKD,qBAAa,kBAAmB,YAAW,YAAY;IACrD,OAAO,CAAC,GAAG,CAAC,CAAc;IAC1B,OAAO,CAAC,WAAW,CAAC,CAAc;IAE5B,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,CA4BnC;IAEK,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAI1C;IAED,OAAO,CAAC,gBAAgB;IAgClB,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAsCrE;IAED,OAAO,CAAC,IAAI;CAyBb"}

package/dist/capture/target-tracker.d.ts

@@ -1,10 +1,6 @@
 import type { CaptureProtocol, CapturedTransportPacket, CaptureTargetStatus } from "../types.ts";
-interface OwnedEndpoint {
-    protocol: CaptureProtocol;
-    address: string;
-    port: number;
-    processId: number;
-}
+import type { WindowsOwnedEndpoint } from "./win32-system.ts";
+type OwnedEndpoint = WindowsOwnedEndpoint;
 export interface TargetSnapshotProvider {
     snapshot(processName: string, protocols: readonly CaptureProtocol[]): Promise<{
         processIds: number[];
@@ -31,7 +27,5 @@ export declare class WindowsTargetTracker {
     private matches;
     private refresh;
 }
-export declare function parseTaskList(output: string): number[];
-export declare function parseNetstat(output: string, protocol: CaptureProtocol): OwnedEndpoint[];
 export {};
 //# sourceMappingURL=target-tracker.d.ts.map

package/dist/capture/target-tracker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"target-tracker.d.ts","sourceRoot":"","sources":["../../src/capture/target-tracker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEjG,UAAU,aAAa;IACrB,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,eAAe,EAAE,GAAG,OAAO,CAAC;QAC5E,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,SAAS,EAAE,aAAa,EAAE,CAAC;KAC5B,CAAC,CAAC;CACJ;AAED,qBAAa,oBAAoB;IAS7B,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAbpC,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,KAAK,CAAC,CAAiC;IAC/C,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAElC,YACW,WAAW,EAAE,MAAM,EACX,SAAS,EAAE,SAAS,eAAe,EAAE,EACrC,QAAQ,EAAE,CAAC,MAAM,EAAE,mBAAmB,KAAK,IAAI,EAC/C,QAAQ,GAAE,sBAA4D,EACtE,SAAS,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAe,EAC/C,iBAAiB,SAA6B,EAC7D;IAEE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAG3B;IAED,IAAI,IAAI,IAAI,CAGX;IAED,QAAQ,CAAC,MAAM,EAAE,uBAAuB,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAM5E;IAED,OAAO,CAAC,OAAO;YAMD,OAAO;CAgCtB;AA+BD,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAKtD;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,aAAa,EAAE,CAQvF"}
+{"version":3,"file":"target-tracker.d.ts","sourceRoot":"","sources":["../../src/capture/target-tracker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEjG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,KAAK,aAAa,GAAG,oBAAoB,CAAC;AAI1C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,eAAe,EAAE,GAAG,OAAO,CAAC;QAC5E,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,SAAS,EAAE,aAAa,EAAE,CAAC;KAC5B,CAAC,CAAC;CACJ;AAED,qBAAa,oBAAoB;IAS7B,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAbpC,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,KAAK,CAAC,CAAiC;IAC/C,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAElC,YACW,WAAW,EAAE,MAAM,EACX,SAAS,EAAE,SAAS,eAAe,EAAE,EACrC,QAAQ,EAAE,CAAC,MAAM,EAAE,mBAAmB,KAAK,IAAI,EAC/C,QAAQ,GAAE,sBAA4D,EACtE,SAAS,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAe,EAC/C,iBAAiB,SAA6B,EAC7D;IAEE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAG3B;IAED,IAAI,IAAI,IAAI,CAGX;IAED,QAAQ,CAAC,MAAM,EAAE,uBAAuB,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAM5E;IAED,OAAO,CAAC,OAAO;YAMD,OAAO;CAgCtB"}

package/dist/capture/win32-system.d.ts

@@ -0,0 +1,11 @@
+import type { CaptureProtocol } from "../types.ts";
+export interface WindowsOwnedEndpoint {
+    protocol: CaptureProtocol;
+    address: string;
+    port: number;
+    processId: number;
+}
+export declare function findProcessIdsByName(processName: string): number[];
+export declare function listOwnedEndpoints(protocols: readonly CaptureProtocol[]): WindowsOwnedEndpoint[];
+export declare function defaultRouteIpv4Address(): string | undefined;
+//# sourceMappingURL=win32-system.d.ts.map

package/dist/capture/win32-system.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"win32-system.d.ts","sourceRoot":"","sources":["../../src/capture/win32-system.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGnD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAmDD,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAsBlE;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,GAAG,oBAAoB,EAAE,CAIhG;AAED,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,SAAS,CAe5D"}

package/dist/capture.js

@@ -15235,53 +15235,8 @@ function decodeFishNetBundle(payload, options = { reliable: false }) {
   return new FishNetSessionDecoder(options.rpcMap).decode(payload, options);
 }
 
-// src/capture/adapter-selection.ts
-async function resolveCaptureDevice(devices, requestedName) {
-  if (requestedName) {
-    const requested = devices.find((device) => device.name === requestedName);
-    if (requested)
-      return { device: requested, usedFallback: false };
-  }
-  const automatic = await defaultRouteDevice(devices) ?? devices.find(isUsable) ?? devices[0];
-  return {
-    device: automatic,
-    usedFallback: Boolean(requestedName),
-    ...requestedName && automatic ? { detail: "The saved adapter is unavailable; capture is using the automatically selected adapter" } : {}
-  };
-}
-function chooseDeviceByRouteOutput(devices, output) {
-  const routes = output.split(/\r?\n/).flatMap((line) => {
-    const columns = line.trim().split(/\s+/);
-    if (columns[0] !== "0.0.0.0" || columns[1] !== "0.0.0.0" || columns.length < 5)
-      return [];
-    const metric = Number(columns[4]);
-    return [{ address: columns[3], metric: Number.isFinite(metric) ? metric : Number.MAX_SAFE_INTEGER }];
-  }).sort((left, right) => left.metric - right.metric);
-  for (const route of routes) {
-    const match = devices.find((device) => device.addresses.includes(route.address));
-    if (match)
-      return match;
-  }
-  return;
-}
-async function defaultRouteDevice(devices) {
-  try {
-    const child = Bun.spawn({
-      cmd: ["route.exe", "PRINT", "0.0.0.0"],
-      stdout: "pipe",
-      stderr: "ignore",
-      windowsHide: true
-    });
-    const output = await new Response(child.stdout).text();
-    return await child.exited === 0 ? chooseDeviceByRouteOutput(devices, output) : undefined;
-  } catch {
-    return;
-  }
-}
-function isUsable(device) {
-  const label = `${device.name} ${device.description}`.toLowerCase();
-  return !device.loopback && device.addresses.length > 0 && !["bluetooth", "wan miniport", "vmware", "hyper-v", "zerotier"].some((value) => label.includes(value));
-}
+// src/capture/win32-system.ts
+import { dlopen, FFIType } from "bun:ffi";
 
 // src/capture/ip-address.ts
 function formatIpv6(data) {
@@ -15309,6 +15264,194 @@ function formatIpv6(data) {
   return `${before}::${after}`;
 }
 
+// src/capture/win32-system.ts
+var ERROR_SUCCESS = 0;
+var ERROR_INSUFFICIENT_BUFFER = 122;
+var TH32CS_SNAPPROCESS = 2;
+var AF_INET = 2;
+var AF_INET6 = 23;
+var TCP_TABLE_OWNER_PID_ALL = 5;
+var UDP_TABLE_OWNER_PID = 1;
+var ENDPOINT_LAYOUTS = [
+  { protocol: "tcp", family: AF_INET, rowSize: 24, addressOffset: 4, portOffset: 8, processIdOffset: 20 },
+  { protocol: "tcp", family: AF_INET6, rowSize: 56, addressOffset: 0, portOffset: 20, processIdOffset: 52 },
+  { protocol: "udp", family: AF_INET, rowSize: 12, addressOffset: 0, portOffset: 4, processIdOffset: 8 },
+  { protocol: "udp", family: AF_INET6, rowSize: 28, addressOffset: 0, portOffset: 20, processIdOffset: 24 }
+];
+var ROUTE_SIZE = 56;
+var ROUTE_INTERFACE_INDEX_OFFSET = 16;
+var ADDRESS_ROW_SIZE = 24;
+var ADDRESS_ROW_INTERFACE_INDEX_OFFSET = 4;
+var PROCESS_ENTRY_SIZE = process.arch === "ia32" ? 556 : 568;
+var PROCESS_ENTRY_ID_OFFSET = 8;
+var PROCESS_ENTRY_NAME_OFFSET = process.arch === "ia32" ? 36 : 44;
+var kernel32;
+var ipHelper;
+function findProcessIdsByName(processName) {
+  requireWindows();
+  const api = loadKernel32();
+  const snapshot = api.CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+  if (snapshot === null || snapshot === -1)
+    throw new Error("Windows could not create a process snapshot");
+  const entry = new Uint8Array(PROCESS_ENTRY_SIZE);
+  const view = new DataView(entry.buffer);
+  view.setUint32(0, PROCESS_ENTRY_SIZE, true);
+  const expected = processName.toLowerCase();
+  const processIds = [];
+  try {
+    let hasEntry = api.Process32FirstW(snapshot, entry) !== 0;
+    while (hasEntry) {
+      if (decodeWideString(entry, PROCESS_ENTRY_NAME_OFFSET).toLowerCase() === expected) {
+        processIds.push(view.getUint32(PROCESS_ENTRY_ID_OFFSET, true));
+      }
+      hasEntry = api.Process32NextW(snapshot, entry) !== 0;
+    }
+  } finally {
+    api.CloseHandle(snapshot);
+  }
+  return processIds.sort((left, right) => left - right);
+}
+function listOwnedEndpoints(protocols) {
+  requireWindows();
+  const selected = new Set(protocols);
+  return ENDPOINT_LAYOUTS.filter((layout) => selected.has(layout.protocol)).flatMap(readEndpoints);
+}
+function defaultRouteIpv4Address() {
+  requireWindows();
+  const api = loadIpHelper();
+  const route = new Uint8Array(ROUTE_SIZE);
+  if (api.GetBestRoute(0, 0, route) !== ERROR_SUCCESS)
+    return;
+  const interfaceIndex = new DataView(route.buffer).getUint32(ROUTE_INTERFACE_INDEX_OFFSET, true);
+  const table = readVariableTable((buffer, size) => api.GetIpAddrTable(buffer, size, 0));
+  const view = tableView(table, ADDRESS_ROW_SIZE);
+  for (let index = 0;index < view.count; index += 1) {
+    const offset = 4 + index * ADDRESS_ROW_SIZE;
+    if (view.data.getUint32(offset + ADDRESS_ROW_INTERFACE_INDEX_OFFSET, true) === interfaceIndex) {
+      return formatIpv4(table, offset);
+    }
+  }
+  return;
+}
+function readEndpoints(layout) {
+  const api = loadIpHelper();
+  const table = readVariableTable((buffer, size) => layout.protocol === "tcp" ? api.GetExtendedTcpTable(buffer, size, 0, layout.family, TCP_TABLE_OWNER_PID_ALL, 0) : api.GetExtendedUdpTable(buffer, size, 0, layout.family, UDP_TABLE_OWNER_PID, 0));
+  const view = tableView(table, layout.rowSize);
+  const endpoints = [];
+  for (let index = 0;index < view.count; index += 1) {
+    const offset = 4 + index * layout.rowSize;
+    endpoints.push({
+      protocol: layout.protocol,
+      address: readAddress(table, offset + layout.addressOffset, layout.family),
+      port: view.data.getUint16(offset + layout.portOffset, false),
+      processId: view.data.getUint32(offset + layout.processIdOffset, true)
+    });
+  }
+  return endpoints;
+}
+function readVariableTable(call) {
+  const size = new Uint32Array(1);
+  const initialResult = call(null, size);
+  if (initialResult !== ERROR_INSUFFICIENT_BUFFER || !size[0]) {
+    throw new Error(`Windows table size query failed with error ${initialResult}`);
+  }
+  for (let attempt = 0;attempt < 3; attempt += 1) {
+    const capacity = size[0] ?? 0;
+    const buffer = new Uint8Array(capacity);
+    size[0] = buffer.byteLength;
+    const result = call(buffer, size);
+    if (result === ERROR_SUCCESS)
+      return buffer.subarray(0, size[0]);
+    if (result !== ERROR_INSUFFICIENT_BUFFER || size[0] === 0) {
+      throw new Error(`Windows table query failed with error ${result}`);
+    }
+  }
+  throw new Error("Windows table changed too frequently to read consistently");
+}
+function tableView(table, rowSize) {
+  if (table.byteLength < 4)
+    throw new Error("Windows returned a truncated table");
+  const data = new DataView(table.buffer, table.byteOffset, table.byteLength);
+  const count = data.getUint32(0, true);
+  if (4 + count * rowSize > table.byteLength)
+    throw new Error("Windows returned an invalid table size");
+  return { count, data };
+}
+function readAddress(buffer, offset, family) {
+  return family === AF_INET ? formatIpv4(buffer, offset) : formatIpv6(Buffer.from(buffer.subarray(offset, offset + 16)));
+}
+function formatIpv4(buffer, offset) {
+  return `${buffer[offset]}.${buffer[offset + 1]}.${buffer[offset + 2]}.${buffer[offset + 3]}`;
+}
+function decodeWideString(buffer, offset) {
+  let end = offset;
+  while (end + 1 < buffer.byteLength && (buffer[end] !== 0 || buffer[end + 1] !== 0))
+    end += 2;
+  return new TextDecoder("utf-16le").decode(buffer.subarray(offset, end));
+}
+function requireWindows() {
+  if (process.platform !== "win32")
+    throw new Error("Windows system APIs are unavailable on this platform");
+}
+function loadKernel32() {
+  if (kernel32)
+    return kernel32;
+  kernel32 = dlopen("kernel32.dll", {
+    CreateToolhelp32Snapshot: { args: [FFIType.u32, FFIType.u32], returns: FFIType.ptr },
+    Process32FirstW: { args: [FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
+    Process32NextW: { args: [FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
+    CloseHandle: { args: [FFIType.ptr], returns: FFIType.i32 }
+  }).symbols;
+  return kernel32;
+}
+function loadIpHelper() {
+  if (ipHelper)
+    return ipHelper;
+  ipHelper = dlopen("iphlpapi.dll", {
+    GetBestRoute: { args: [FFIType.u32, FFIType.u32, FFIType.ptr], returns: FFIType.u32 },
+    GetIpAddrTable: { args: [FFIType.ptr, FFIType.ptr, FFIType.i32], returns: FFIType.u32 },
+    GetExtendedTcpTable: {
+      args: [FFIType.ptr, FFIType.ptr, FFIType.i32, FFIType.u32, FFIType.u32, FFIType.u32],
+      returns: FFIType.u32
+    },
+    GetExtendedUdpTable: {
+      args: [FFIType.ptr, FFIType.ptr, FFIType.i32, FFIType.u32, FFIType.u32, FFIType.u32],
+      returns: FFIType.u32
+    }
+  }).symbols;
+  return ipHelper;
+}
+
+// src/capture/adapter-selection.ts
+async function resolveCaptureDevice(devices, requestedName) {
+  if (requestedName) {
+    const requested = devices.find((device) => device.name === requestedName);
+    if (requested)
+      return { device: requested, usedFallback: false };
+  }
+  const automatic = defaultRouteDevice(devices) ?? devices.find(isUsable) ?? devices[0];
+  return {
+    device: automatic,
+    usedFallback: Boolean(requestedName),
+    ...requestedName && automatic ? { detail: "The saved adapter is unavailable; capture is using the automatically selected adapter" } : {}
+  };
+}
+function chooseDeviceByRouteAddress(devices, address) {
+  return devices.find((device) => device.addresses.includes(address));
+}
+function defaultRouteDevice(devices) {
+  try {
+    const address = defaultRouteIpv4Address();
+    return address ? chooseDeviceByRouteAddress(devices, address) : undefined;
+  } catch {
+    return;
+  }
+}
+function isUsable(device) {
+  const label = `${device.name} ${device.description}`.toLowerCase();
+  return !device.loopback && device.addresses.length > 0 && !["bluetooth", "wan miniport", "vmware", "hyper-v", "zerotier"].some((value) => label.includes(value));
+}
+
 // src/capture/link-layer.ts
 var DATA_LINK = {
   NULL: 0,
@@ -15352,8 +15495,9 @@ function ipVersion(data) {
 // src/capture/npcap.ts
 import { existsSync } from "fs";
 import path from "path";
-import { CString, dlopen, FFIType, read, toArrayBuffer } from "bun:ffi";
+import { CString, dlopen as dlopen2, FFIType as FFIType2, read, toArrayBuffer } from "bun:ffi";
 var ERROR_BUFFER_SIZE = 512;
+var PCAP_ERROR_PERM_DENIED = -8;
 
 class SystemNpcapRuntime {
   api;
@@ -15368,18 +15512,20 @@ class SystemNpcapRuntime {
     if (!existsSync(dllPath)) {
       return { availability: "missing", detail: "Npcap is not installed" };
     }
-    if (await isAdminOnlyInstall()) {
-      return {
-        availability: "admin-only",
-        detail: "Npcap is installed for administrators only; reinstall it with that restriction unchecked"
-      };
-    }
     try {
       const api = this.load();
       const version = String(api.symbols.pcap_lib_version());
       if (!version.toLowerCase().includes("npcap")) {
         return { availability: "error", detail: "The loaded packet capture library is not Npcap" };
       }
+      const devices = this.enumerateDevices(api);
+      if (devices.length === 0) {
+        return {
+          availability: "error",
+          detail: "Npcap reported no captureable network adapters; access may require elevation",
+          version
+        };
+      }
       this.readyStatus = { availability: "ready", detail: "Npcap is ready", version };
       return this.readyStatus;
     } catch (error) {
@@ -15390,7 +15536,9 @@ class SystemNpcapRuntime {
     const status = await this.status();
     if (status.availability !== "ready")
       throw new Error(status.detail);
-    const api = this.load();
+    return this.enumerateDevices(this.load());
+  }
+  enumerateDevices(api) {
     const resultPointer = new Uint8Array(8);
     const errorBuffer = new Uint8Array(ERROR_BUFFER_SIZE);
     const result = api.symbols.pcap_findalldevs(resultPointer, errorBuffer);
@@ -15440,6 +15588,9 @@ class SystemNpcapRuntime {
       check(api.symbols.pcap_set_buffer_size(handle, 10 * 1024 * 1024), handle, api, "set capture buffer size");
       check(api.symbols.pcap_set_immediate_mode(handle, 1), handle, api, "enable immediate mode");
       const activated = api.symbols.pcap_activate(handle);
+      if (activated === PCAP_ERROR_PERM_DENIED) {
+        throw new Error(`Npcap denied access to ${device.description}; run elevated or reinstall Npcap without administrator-only access: ${pcapError(api, handle)}`);
+      }
       if (activated < 0)
         throw new Error(`Npcap could not activate ${device.description}: ${pcapError(api, handle)}`);
       const dataLink = api.symbols.pcap_datalink(handle);
@@ -15463,25 +15614,25 @@ class SystemNpcapRuntime {
   load() {
     if (this.api)
       return this.api;
-    const library = dlopen(npcapDllPath(), {
-      pcap_lib_version: { args: [], returns: FFIType.cstring },
-      pcap_findalldevs: { args: [FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
-      pcap_freealldevs: { args: [FFIType.ptr], returns: FFIType.void },
-      pcap_create: { args: [FFIType.cstring, FFIType.ptr], returns: FFIType.ptr },
-      pcap_set_snaplen: { args: [FFIType.ptr, FFIType.i32], returns: FFIType.i32 },
-      pcap_set_promisc: { args: [FFIType.ptr, FFIType.i32], returns: FFIType.i32 },
-      pcap_set_timeout: { args: [FFIType.ptr, FFIType.i32], returns: FFIType.i32 },
-      pcap_set_buffer_size: { args: [FFIType.ptr, FFIType.i32], returns: FFIType.i32 },
-      pcap_set_immediate_mode: { args: [FFIType.ptr, FFIType.i32], returns: FFIType.i32 },
-      pcap_activate: { args: [FFIType.ptr], returns: FFIType.i32 },
-      pcap_datalink: { args: [FFIType.ptr], returns: FFIType.i32 },
-      pcap_compile: { args: [FFIType.ptr, FFIType.ptr, FFIType.cstring, FFIType.i32, FFIType.u32], returns: FFIType.i32 },
-      pcap_setfilter: { args: [FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
-      pcap_freecode: { args: [FFIType.ptr], returns: FFIType.void },
-      pcap_setnonblock: { args: [FFIType.ptr, FFIType.i32, FFIType.ptr], returns: FFIType.i32 },
-      pcap_next_ex: { args: [FFIType.ptr, FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
-      pcap_geterr: { args: [FFIType.ptr], returns: FFIType.cstring },
-      pcap_close: { args: [FFIType.ptr], returns: FFIType.void }
+    const library = dlopen2(npcapDllPath(), {
+      pcap_lib_version: { args: [], returns: FFIType2.cstring },
+      pcap_findalldevs: { args: [FFIType2.ptr, FFIType2.ptr], returns: FFIType2.i32 },
+      pcap_freealldevs: { args: [FFIType2.ptr], returns: FFIType2.void },
+      pcap_create: { args: [FFIType2.cstring, FFIType2.ptr], returns: FFIType2.ptr },
+      pcap_set_snaplen: { args: [FFIType2.ptr, FFIType2.i32], returns: FFIType2.i32 },
+      pcap_set_promisc: { args: [FFIType2.ptr, FFIType2.i32], returns: FFIType2.i32 },
+      pcap_set_timeout: { args: [FFIType2.ptr, FFIType2.i32], returns: FFIType2.i32 },
+      pcap_set_buffer_size: { args: [FFIType2.ptr, FFIType2.i32], returns: FFIType2.i32 },
+      pcap_set_immediate_mode: { args: [FFIType2.ptr, FFIType2.i32], returns: FFIType2.i32 },
+      pcap_activate: { args: [FFIType2.ptr], returns: FFIType2.i32 },
+      pcap_datalink: { args: [FFIType2.ptr], returns: FFIType2.i32 },
+      pcap_compile: { args: [FFIType2.ptr, FFIType2.ptr, FFIType2.cstring, FFIType2.i32, FFIType2.u32], returns: FFIType2.i32 },
+      pcap_setfilter: { args: [FFIType2.ptr, FFIType2.ptr], returns: FFIType2.i32 },
+      pcap_freecode: { args: [FFIType2.ptr], returns: FFIType2.void },
+      pcap_setnonblock: { args: [FFIType2.ptr, FFIType2.i32, FFIType2.ptr], returns: FFIType2.i32 },
+      pcap_next_ex: { args: [FFIType2.ptr, FFIType2.ptr, FFIType2.ptr], returns: FFIType2.i32 },
+      pcap_geterr: { args: [FFIType2.ptr], returns: FFIType2.cstring },
+      pcap_close: { args: [FFIType2.ptr], returns: FFIType2.void }
     });
     this.api = library;
     return this.api;
@@ -15575,20 +15726,6 @@ function readCStringBuffer(buffer) {
 function npcapDllPath() {
   return path.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "Npcap", "wpcap.dll");
 }
-async function isAdminOnlyInstall() {
-  try {
-    const child = Bun.spawn({
-      cmd: ["reg.exe", "query", "HKLM\\SYSTEM\\CurrentControlSet\\Services\\npcap\\Parameters", "/v", "AdminOnly"],
-      stdout: "pipe",
-      stderr: "ignore",
-      windowsHide: true
-    });
-    const output = await new Response(child.stdout).text();
-    return await child.exited === 0 && /AdminOnly\s+REG_DWORD\s+0x1\b/i.test(output);
-  } catch {
-    return false;
-  }
-}
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
@@ -15614,7 +15751,7 @@ function parseIpv4(data, context) {
   const declaredLength = data.readUInt16BE(2);
   if (declaredLength < headerLength)
     return;
-  return parseTransport(data, headerLength, Math.min(declaredLength, data.length), declaredLength > data.length, data[9], 4, formatIpv4(data, 12), formatIpv4(data, 16), context);
+  return parseTransport(data, headerLength, Math.min(declaredLength, data.length), declaredLength > data.length, data[9], 4, formatIpv42(data, 12), formatIpv42(data, 16), context);
 }
 function parseIpv6(data, context) {
   if (data.length < 40)
@@ -15685,7 +15822,7 @@ function parseTransport(data, offset, packetEnd, truncated, protocol, ipVersion2
   }
   return;
 }
-function formatIpv4(data, offset) {
+function formatIpv42(data, offset) {
   return `${data[offset]}.${data[offset + 1]}.${data[offset + 2]}.${data[offset + 3]}`;
 }
 
@@ -15705,7 +15842,7 @@ class WindowsTargetTracker {
   refreshing = false;
   published = false;
   lastRefreshError;
-  constructor(processName, protocols, onStatus, provider = new CommandTargetSnapshotProvider, onWarning = () => {}, refreshIntervalMs = TARGET_REFRESH_INTERVAL_MS) {
+  constructor(processName, protocols, onStatus, provider = new WindowsTargetSnapshotProvider, onWarning = () => {}, refreshIntervalMs = TARGET_REFRESH_INTERVAL_MS) {
     this.processName = processName;
     this.protocols = protocols;
     this.onStatus = onStatus;
@@ -15766,58 +15903,18 @@ class WindowsTargetTracker {
   }
 }
 
-class CommandTargetSnapshotProvider {
+class WindowsTargetSnapshotProvider {
   async snapshot(processName, protocols) {
-    const process2 = Bun.spawn({
-      cmd: ["tasklist.exe", "/FI", `IMAGENAME eq ${processName}`, "/FO", "CSV", "/NH"],
-      stdout: "pipe",
-      stderr: "ignore",
-      windowsHide: true
-    });
-    const processOutput = await new Response(process2.stdout).text();
-    const processIds = await process2.exited === 0 ? parseTaskList(processOutput) : [];
+    const processIds = findProcessIdsByName(processName);
     if (processIds.length === 0)
       return { processIds, endpoints: [] };
-    const outputs = await Promise.all(protocols.map(async (protocol) => {
-      const child = Bun.spawn({
-        cmd: ["netstat.exe", "-ano", "-p", protocol.toUpperCase()],
-        stdout: "pipe",
-        stderr: "ignore",
-        windowsHide: true
-      });
-      const output = await new Response(child.stdout).text();
-      return await child.exited === 0 ? parseNetstat(output, protocol) : [];
-    }));
     const selected = new Set(processIds);
-    return { processIds, endpoints: outputs.flat().filter((endpoint) => selected.has(endpoint.processId)) };
+    return {
+      processIds,
+      endpoints: listOwnedEndpoints(protocols).filter((endpoint) => selected.has(endpoint.processId))
+    };
   }
 }
-function parseTaskList(output) {
-  return output.split(/\r?\n/).flatMap((line) => {
-    const match = line.match(/^"(?:[^"]|"")*","(\d+)"/);
-    return match ? [Number(match[1])] : [];
-  }).sort((left, right) => left - right);
-}
-function parseNetstat(output, protocol) {
-  return output.split(/\r?\n/).flatMap((line) => {
-    const columns = line.trim().split(/\s+/);
-    if (columns[0]?.toLowerCase() !== protocol || columns.length < (protocol === "tcp" ? 5 : 4))
-      return [];
-    const local = parseEndpoint(columns[1]);
-    const processId = Number(columns[protocol === "tcp" ? 4 : 3]);
-    return local && Number.isInteger(processId) ? [{ protocol, ...local, processId }] : [];
-  });
-}
-function parseEndpoint(value) {
-  const bracketed = value.match(/^\[(.*)]:(\d+)$/);
-  if (bracketed)
-    return { address: bracketed[1], port: Number(bracketed[2]) };
-  const split = value.lastIndexOf(":");
-  if (split < 0)
-    return;
-  const port = Number(value.slice(split + 1));
-  return Number.isInteger(port) ? { address: value.slice(0, split), port } : undefined;
-}
 function endpointKey(protocol, address, port) {
   return `${protocol}|${address}|${port}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kar-mi/spirit-vale-tools-capture",
-  "version": "2.4.2",
+  "version": "2.5.0",
   "description": "Passive Windows packet capture and Spirit Vale protocol decoding for Bun.",
   "license": "AGPL-3.0-only",
   "repository": {