kiriya 0.1.0

package/dist/src/core/infrastructure/node/run-program.js

@@ -0,0 +1,65 @@
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+/** Runs a program without a shell, so no argument is ever re-parsed. */
+export function runProgram(command, args, options = {}) {
+    return new Promise((resolve, reject) => {
+        const started = performance.now();
+        const output = options.ignoreOutput === true ? "ignore" : "pipe";
+        const child = spawn(command, [...args], {
+            env: options.env === undefined ? process.env : { ...process.env, ...options.env },
+            windowsHide: true,
+            stdio: ["pipe", output, output],
+            ...(options.cwd === undefined ? {} : { cwd: options.cwd }),
+            ...(options.signal === undefined ? {} : { signal: options.signal }),
+        });
+        const out = [];
+        const err = [];
+        const timeoutMs = options.timeoutMs ?? 60_000;
+        const timer = timeoutMs > 0 ? setTimeout(() => child.kill(), timeoutMs) : undefined;
+        const onOutput = options.onOutput;
+        if (onOutput === undefined) {
+            child.stdout?.on("data", (chunk) => out.push(chunk));
+            child.stderr?.on("data", (chunk) => err.push(chunk));
+        }
+        else {
+            // Decoding per stream keeps a character split across two chunks whole.
+            child.stdout?.setEncoding("utf8");
+            child.stderr?.setEncoding("utf8");
+            child.stdout?.on("data", (text) => onOutput(text, "stdout"));
+            child.stderr?.on("data", (text) => onOutput(text, "stderr"));
+        }
+        child.on("error", (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+        const finish = (code) => {
+            clearTimeout(timer);
+            resolve({
+                code: code ?? 1,
+                stdout: Buffer.concat(out).toString("utf8"),
+                stderr: Buffer.concat(err).toString("utf8"),
+                ms: performance.now() - started,
+            });
+        };
+        if (options.ignoreOutput === true)
+            child.on("exit", finish);
+        else
+            child.on("close", finish);
+        // A program may exit without reading its input, and writing to its closed pipe raises
+        // EPIPE. That is not a failure of the run: the exit code and output still tell the result.
+        child.stdin?.on("error", () => undefined);
+        child.stdin?.end(options.input ?? "");
+    });
+}
+export function windowsPowerShell() {
+    const inbox = join(process.env["SystemRoot"] ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+    return existsSync(inbox) ? inbox : "powershell.exe";
+}
+/** A Windows PowerShell script through -EncodedCommand. Data travels in environment variables or stdin, never in the script. */
+export function runPowerShell(script, options = {}) {
+    // Without this, progress records such as "Preparing modules for first use" arrive on stderr as CLIXML.
+    const encoded = Buffer.from(`$ProgressPreference = 'SilentlyContinue'\n${script}`, "utf16le").toString("base64");
+    return runProgram(windowsPowerShell(), ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", encoded], options);
+}
+//# sourceMappingURL=run-program.js.map

package/dist/src/core/infrastructure/node/system-clock.adapter.js

@@ -0,0 +1,22 @@
+import { InterruptedError } from "../../domain/errors.js";
+export class SystemClockAdapter {
+    now() {
+        return Date.now();
+    }
+    sleep(ms, signal) {
+        if (signal.aborted)
+            return Promise.reject(new InterruptedError("core.error.interrupted"));
+        return new Promise((resolve, reject) => {
+            const onAbort = () => {
+                clearTimeout(timer);
+                reject(new InterruptedError("core.error.interrupted"));
+            };
+            const timer = setTimeout(() => {
+                signal.removeEventListener("abort", onAbort);
+                resolve();
+            }, ms);
+            signal.addEventListener("abort", onAbort, { once: true });
+        });
+    }
+}
+//# sourceMappingURL=system-clock.adapter.js.map

package/dist/src/core/infrastructure/node/typed-programs.js

@@ -0,0 +1,45 @@
+import { spawn } from "node:child_process";
+import { CapabilityUnavailableError, InterruptedError } from "../../domain/errors.js";
+import { runPowerShell, runProgram } from "./run-program.js";
+function cannotStart(program, error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return new CapabilityUnavailableError("core.process.cannot-start", { program, detail }, { cause: error });
+}
+/** The first line of a program's error output, for a message. */
+export function firstLine(text) {
+    return text.trim().split(/\r?\n/)[0] ?? "";
+}
+/** runProgram with kiriya's errors: InterruptedError when the signal stopped it, CapabilityUnavailableError when it could not start. */
+export async function runTyped(command, args, options = {}) {
+    try {
+        return await runProgram(command, args, options);
+    }
+    catch (error) {
+        if (options.signal?.aborted === true)
+            throw new InterruptedError("core.error.interrupted", {}, { cause: error });
+        throw cannotStart(command, error);
+    }
+}
+/** runPowerShell with the same errors as runTyped. */
+export async function runPowerShellTyped(script, options = {}) {
+    try {
+        return await runPowerShell(script, options);
+    }
+    catch (error) {
+        if (options.signal?.aborted === true)
+            throw new InterruptedError("core.error.interrupted", {}, { cause: error });
+        throw cannotStart("powershell.exe", error);
+    }
+}
+/** Starts a program that outlives kiriya, such as the application a file opens in, and returns once it has started. */
+export function launchDetached(command, args) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, [...args], { detached: true, stdio: "ignore" });
+        child.once("error", (error) => reject(cannotStart(command, error)));
+        child.once("spawn", () => {
+            child.unref();
+            resolve();
+        });
+    });
+}
+//# sourceMappingURL=typed-programs.js.map

package/dist/src/core/infrastructure/platform/linux/freedesktop-trash.adapter.js

@@ -0,0 +1,115 @@
+import { constants } from "node:fs";
+import { access, cp, lstat, mkdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { message } from "../../../domain/message.js";
+const NEWLINE = String.fromCharCode(10);
+async function exists(path) {
+    try {
+        await access(path, constants.F_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function localTime(date) {
+    const pad = (value) => String(value).padStart(2, "0");
+    return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}T${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}`;
+}
+/**
+ * The freedesktop.org trash specification implemented directly, so files on other
+ * mounts work where `gio trash` refuses them. Verified in the phase 0 spike.
+ */
+export class FreedesktopTrashAdapter {
+    environment;
+    location = "core.trash.location.freedesktop";
+    constructor(environment) {
+        this.environment = environment;
+    }
+    async send(paths) {
+        const outcomes = [];
+        for (const path of paths)
+            outcomes.push(await this.sendOne(path));
+        return outcomes;
+    }
+    homeTrash() {
+        const dataHome = this.environment.variable("XDG_DATA_HOME");
+        return join(dataHome !== undefined && isAbsolute(dataHome)
+            ? dataHome
+            : join(this.environment.homeDirectory, ".local", "share"), "Trash");
+    }
+    async prepare(root) {
+        await mkdir(join(root, "files"), { recursive: true, mode: 0o700 });
+        await mkdir(join(root, "info"), { recursive: true, mode: 0o700 });
+    }
+    async directoryFor(path) {
+        const home = this.homeTrash();
+        await this.prepare(home);
+        const device = (await lstat(path)).dev;
+        if (device === (await stat(home)).dev)
+            return { root: home, topdir: null, copy: false };
+        let topdir = resolve(dirname(path));
+        while (dirname(topdir) !== topdir && (await stat(dirname(topdir))).dev === device)
+            topdir = dirname(topdir);
+        const uid = process.getuid?.() ?? 0;
+        try {
+            const shared = await lstat(join(topdir, ".Trash"));
+            if (shared.isDirectory() && !shared.isSymbolicLink() && (shared.mode & 0o1000) !== 0) {
+                const root = join(topdir, ".Trash", String(uid));
+                await this.prepare(root);
+                return { root, topdir, copy: false };
+            }
+        }
+        catch {
+            // no shared trash on this mount
+        }
+        try {
+            const root = join(topdir, `.Trash-${uid}`);
+            await this.prepare(root);
+            return { root, topdir, copy: false };
+        }
+        catch {
+            return { root: home, topdir: null, copy: true };
+        }
+    }
+    async freeName(root, name) {
+        const extension = extname(name);
+        const stem = name.slice(0, name.length - extension.length);
+        for (let attempt = 1;; attempt += 1) {
+            const candidate = attempt === 1 ? name : `${stem}.${attempt}${extension}`;
+            if (!(await exists(join(root, "files", candidate))) &&
+                !(await exists(join(root, "info", `${candidate}.trashinfo`)))) {
+                return candidate;
+            }
+        }
+    }
+    async sendOne(path) {
+        let info;
+        try {
+            const target = await this.directoryFor(path);
+            const name = await this.freeName(target.root, basename(path));
+            info = join(target.root, "info", `${name}.trashinfo`);
+            const recorded = target.topdir === null ? resolve(path) : relative(target.topdir, resolve(path));
+            const encoded = recorded.split(sep).map(encodeURIComponent).join("/");
+            await writeFile(info, ["[Trash Info]", `Path=${encoded}`, `DeletionDate=${localTime(new Date())}`, ""].join(NEWLINE), {
+                flag: "wx",
+            });
+            const destination = join(target.root, "files", name);
+            if (target.copy) {
+                await cp(path, destination, { recursive: true, preserveTimestamps: true, verbatimSymlinks: true });
+                await rm(path, { recursive: true, force: true });
+            }
+            else {
+                await rename(path, destination);
+            }
+            return { path, ok: true };
+        }
+        catch (error) {
+            if (info !== undefined)
+                await rm(info, { force: true });
+            const code = error.code ?? error.message;
+            return { path, ok: false, reason: message("core.trash.failed", { detail: code }) };
+        }
+    }
+}
+//# sourceMappingURL=freedesktop-trash.adapter.js.map

package/dist/src/core/infrastructure/platform/linux/linux-clipboard.adapter.js

@@ -0,0 +1,70 @@
+import { CapabilityUnavailableError, OperationFailedError } from "../../../domain/errors.js";
+import { firstLine, runTyped } from "../../node/typed-programs.js";
+/** What xclip, xsel and wl-paste say about a clipboard with no text on it. */
+const EMPTY = /not available|nothing is copied|no selection/i;
+/**
+ * wl-clipboard in a Wayland session, then xclip or xsel under X11. A session with no
+ * display has no clipboard at all, which is reported rather than faked.
+ */
+export class LinuxClipboardAdapter {
+    environment;
+    processRunner;
+    constructor(environment, processRunner) {
+        this.environment = environment;
+        this.processRunner = processRunner;
+    }
+    async backend() {
+        return (await this.program()).name;
+    }
+    async write(text, signal) {
+        const program = await this.program();
+        const [command, args] = program.copy;
+        // These programs stay in the background to serve the clipboard, holding their output open, so only their exit counts.
+        const result = await runTyped(command, args, { input: text, signal, ignoreOutput: true, timeoutMs: 30_000 });
+        if (result.code !== 0) {
+            throw new OperationFailedError("core.clipboard.failed", { program: program.name, code: result.code, detail: "" });
+        }
+    }
+    async read(signal) {
+        const program = await this.program();
+        const [command, args] = program.paste;
+        const result = await runTyped(command, args, { signal, timeoutMs: 30_000 });
+        if (result.code === 0)
+            return result.stdout;
+        if (EMPTY.test(result.stderr))
+            return "";
+        const detail = firstLine(result.stderr);
+        throw new OperationFailedError("core.clipboard.failed", { program: program.name, code: result.code, detail });
+    }
+    async program() {
+        const wayland = (this.environment.variable("WAYLAND_DISPLAY") ?? "") !== "";
+        const x11 = (this.environment.variable("DISPLAY") ?? "") !== "";
+        if (wayland) {
+            const [copy, paste] = await Promise.all([
+                this.processRunner.find("wl-copy"),
+                this.processRunner.find("wl-paste"),
+            ]);
+            if (copy !== null && paste !== null) {
+                return { name: "wl-clipboard", copy: [copy, []], paste: [paste, ["--no-newline"]] };
+            }
+        }
+        if (x11) {
+            const xclip = await this.processRunner.find("xclip");
+            if (xclip !== null) {
+                return {
+                    name: "xclip",
+                    copy: [xclip, ["-selection", "clipboard", "-in"]],
+                    paste: [xclip, ["-selection", "clipboard", "-out"]],
+                };
+            }
+            const xsel = await this.processRunner.find("xsel");
+            if (xsel !== null) {
+                return { name: "xsel", copy: [xsel, ["--clipboard", "--input"]], paste: [xsel, ["--clipboard", "--output"]] };
+            }
+        }
+        if (wayland || x11)
+            throw new CapabilityUnavailableError("core.clipboard.no-program");
+        throw new CapabilityUnavailableError("core.clipboard.no-display");
+    }
+}
+//# sourceMappingURL=linux-clipboard.adapter.js.map

package/dist/src/core/infrastructure/platform/linux/linux-opener.adapter.js

@@ -0,0 +1,21 @@
+import { CapabilityUnavailableError } from "../../../domain/errors.js";
+import { launchDetached } from "../../node/typed-programs.js";
+/** xdg-open, started without waiting, because some desktops keep it running until the application closes. */
+export class LinuxOpenerAdapter {
+    environment;
+    processRunner;
+    constructor(environment, processRunner) {
+        this.environment = environment;
+        this.processRunner = processRunner;
+    }
+    async open(target) {
+        const hasDisplay = [this.environment.variable("WAYLAND_DISPLAY"), this.environment.variable("DISPLAY")].some((value) => (value ?? "") !== "");
+        if (!hasDisplay)
+            throw new CapabilityUnavailableError("core.open.no-display", { target });
+        const xdgOpen = await this.processRunner.find("xdg-open");
+        if (xdgOpen === null)
+            throw new CapabilityUnavailableError("core.open.no-xdg-open");
+        await launchDetached(xdgOpen, [target]);
+    }
+}
+//# sourceMappingURL=linux-opener.adapter.js.map

package/dist/src/core/infrastructure/platform/linux/linux-port-table.adapter.js

@@ -0,0 +1,97 @@
+import { readdir, readFile, readlink } from "node:fs/promises";
+import { CapabilityUnavailableError } from "../../../domain/errors.js";
+import { canListen } from "../../node/can-listen.js";
+function compressIpv6(groups) {
+    let bestStart = -1;
+    let bestLength = 0;
+    for (let index = 0; index < groups.length;) {
+        if (groups[index] !== "0") {
+            index += 1;
+            continue;
+        }
+        let end = index;
+        while (end < groups.length && groups[end] === "0")
+            end += 1;
+        if (end - index >= 2 && end - index > bestLength) {
+            bestStart = index;
+            bestLength = end - index;
+        }
+        index = end;
+    }
+    if (bestStart < 0)
+        return groups.join(":");
+    return `${groups.slice(0, bestStart).join(":")}::${groups.slice(bestStart + bestLength).join(":")}`;
+}
+/** A hexadecimal address from /proc/net/tcp: IPv4 as one little-endian 32-bit word, IPv6 as four. */
+export function decodeProcAddress(hex) {
+    const pairs = (word) => word.match(/../g) ?? [];
+    if (hex.length === 8) {
+        return pairs(hex)
+            .reverse()
+            .map((byte) => parseInt(byte, 16))
+            .join(".");
+    }
+    if (hex.length !== 32)
+        return hex;
+    const bytes = (hex.match(/.{8}/g) ?? []).flatMap((word) => pairs(word).reverse());
+    const groups = [];
+    for (let index = 0; index < bytes.length; index += 2) {
+        groups.push(parseInt(`${bytes[index] ?? "00"}${bytes[index + 1] ?? "00"}`, 16).toString(16));
+    }
+    return compressIpv6(groups);
+}
+/** Listening sockets from /proc/net/tcp or tcp6: state 0A is LISTEN, and the inode names the socket. */
+export function parseProcNetTcp(text) {
+    return text
+        .split("\n")
+        .slice(1)
+        .flatMap((line) => {
+        const parts = line.trim().split(/\s+/);
+        if (parts.length < 10 || parts[3] !== "0A")
+            return [];
+        const [address = "", port = ""] = (parts[1] ?? "").split(":");
+        return [{ address: decodeProcAddress(address), port: parseInt(port, 16), inode: parts[9] ?? "" }];
+    });
+}
+/** Socket inodes and the processes holding them, from every /proc/<pid>/fd this user may read. */
+async function socketOwners() {
+    const owners = new Map();
+    const pids = (await readdir("/proc")).filter((entry) => /^\d+$/.test(entry));
+    for (const pid of pids) {
+        const descriptors = await readdir(`/proc/${pid}/fd`).catch(() => []);
+        const links = await Promise.all(descriptors.map((descriptor) => readlink(`/proc/${pid}/fd/${descriptor}`).catch(() => "")));
+        for (const link of links) {
+            if (link.startsWith("socket:["))
+                owners.set(link.slice(8, -1), Number(pid));
+        }
+    }
+    return owners;
+}
+/**
+ * /proc/net/tcp and tcp6 read with node:fs. Another user's socket has no visible owner
+ * without elevation, because /proc/<pid>/fd needs ptrace access; kiriya never elevates.
+ */
+export class LinuxPortTableAdapter {
+    async listeners() {
+        const reads = await Promise.allSettled(["/proc/net/tcp", "/proc/net/tcp6"].map((file) => readFile(file, "utf8")));
+        const texts = reads.flatMap((read) => (read.status === "fulfilled" ? [read.value] : []));
+        const firstFailure = reads.find((read) => read.status === "rejected");
+        if (texts.length === 0 && firstFailure !== undefined) {
+            const detail = firstFailure.reason instanceof Error ? firstFailure.reason.message : String(firstFailure.reason);
+            throw new CapabilityUnavailableError("core.ports.unreadable", { source: "/proc/net/tcp", detail });
+        }
+        const sockets = texts.flatMap(parseProcNetTcp);
+        if (sockets.length === 0)
+            return [];
+        const owners = await socketOwners();
+        return sockets.map((socket) => ({
+            address: socket.address,
+            port: socket.port,
+            pid: owners.get(socket.inode) ?? null,
+        }));
+    }
+    canListen(port) {
+        return canListen(port);
+    }
+}
+//# sourceMappingURL=linux-port-table.adapter.js.map

package/dist/src/core/infrastructure/platform/linux/linux-process-table.adapter.js

@@ -0,0 +1,61 @@
+import { readdir, readFile, readlink } from "node:fs/promises";
+import path from "node:path";
+import { CapabilityUnavailableError } from "../../../domain/errors.js";
+import { endProcesses } from "../../node/process-signals.js";
+const NUL = String.fromCharCode(0);
+/** The name and parent id in /proc/<pid>/stat, where the name sits in parentheses and may hold spaces and parentheses. */
+export function parseProcStat(stat) {
+    const open = stat.indexOf("(");
+    const close = stat.lastIndexOf(")");
+    if (open < 0 || close < open)
+        return null;
+    const ppid = Number(stat.slice(close + 2).split(" ")[1]);
+    return Number.isInteger(ppid) ? { comm: stat.slice(open + 1, close), ppid } : null;
+}
+/** VmRSS from /proc/<pid>/status in bytes; null for kernel threads, which have none. */
+export function residentMemory(status) {
+    const match = /^VmRSS:\s+(\d+)\s+kB$/m.exec(status);
+    return match === null ? null : Number(match[1]) * 1024;
+}
+async function readProcess(pid) {
+    const folder = `/proc/${pid}`;
+    const stat = await readFile(`${folder}/stat`, "utf8").then(parseProcStat, () => null);
+    // The process ended while the listing was read.
+    if (stat === null)
+        return null;
+    const parts = (await readFile(`${folder}/cmdline`, "utf8").catch(() => "")).split(NUL).filter((part) => part !== "");
+    // Programs may rename their main thread, as Node.js 24 does to MainThread, so the name comes from the executable.
+    const executable = await readlink(`${folder}/exe`).catch(() => null);
+    const program = parts[0];
+    let name = stat.comm;
+    if (executable !== null)
+        name = path.posix.basename(executable.replace(/ \(deleted\)$/, ""));
+    else if (program !== undefined)
+        name = path.posix.basename(program);
+    const memoryBytes = await readFile(`${folder}/status`, "utf8").then(residentMemory, () => null);
+    return { pid, ppid: stat.ppid, name, command: parts.length > 0 ? parts.join(" ") : null, memoryBytes };
+}
+/** /proc read with node:fs: no program starts, and parent ids and command lines cost nothing extra. */
+export class LinuxProcessTableAdapter {
+    selfPid = process.pid;
+    async list() {
+        let entries;
+        try {
+            entries = await readdir("/proc");
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            throw new CapabilityUnavailableError("core.processes.unreadable", { source: "/proc", detail });
+        }
+        const pids = entries.filter((entry) => /^\d+$/.test(entry)).map(Number);
+        const processes = (await Promise.all(pids.map(readProcess))).filter((entry) => entry !== null);
+        return { processes, detailed: true };
+    }
+    end(pids, force) {
+        return endProcesses(pids, force);
+    }
+    protectedPids() {
+        return new Set([0, 1, process.pid, process.ppid]);
+    }
+}
+//# sourceMappingURL=linux-process-table.adapter.js.map

package/dist/src/core/infrastructure/platform/macos/macos-clipboard.adapter.js

@@ -0,0 +1,29 @@
+import { OperationFailedError } from "../../../domain/errors.js";
+import { firstLine, runTyped } from "../../node/typed-programs.js";
+/** pbcopy garbles UTF-8 under the C locale, as the phase 0 spike found, so both programs get a UTF-8 one. */
+const UTF8_LOCALE = { LANG: "en_US.UTF-8", LC_ALL: "en_US.UTF-8", LC_CTYPE: "en_US.UTF-8" };
+function failed(program, result) {
+    return new OperationFailedError("core.clipboard.failed", {
+        program,
+        code: result.code,
+        detail: firstLine(result.stderr),
+    });
+}
+export class MacosClipboardAdapter {
+    backend() {
+        return Promise.resolve("pbcopy");
+    }
+    async write(text, signal) {
+        const options = { input: text, env: UTF8_LOCALE, signal, timeoutMs: 30_000 };
+        const result = await runTyped("/usr/bin/pbcopy", [], options);
+        if (result.code !== 0)
+            throw failed("pbcopy", result);
+    }
+    async read(signal) {
+        const result = await runTyped("/usr/bin/pbpaste", [], { env: UTF8_LOCALE, signal, timeoutMs: 30_000 });
+        if (result.code !== 0)
+            throw failed("pbpaste", result);
+        return result.stdout;
+    }
+}
+//# sourceMappingURL=macos-clipboard.adapter.js.map

package/dist/src/core/infrastructure/platform/macos/macos-opener.adapter.js

@@ -0,0 +1,13 @@
+import { OperationFailedError } from "../../../domain/errors.js";
+import { firstLine, runTyped } from "../../node/typed-programs.js";
+/** open returns once Launch Services has the target, and fails when no application can open it. */
+export class MacosOpenerAdapter {
+    async open(target, signal) {
+        const result = await runTyped("/usr/bin/open", [target], { signal, timeoutMs: 60_000 });
+        if (result.code !== 0) {
+            const detail = firstLine(result.stderr);
+            throw new OperationFailedError("core.open.failed", { program: "open", target, code: result.code, detail });
+        }
+    }
+}
+//# sourceMappingURL=macos-opener.adapter.js.map

package/dist/src/core/infrastructure/platform/macos/macos-port-table.adapter.js

@@ -0,0 +1,86 @@
+import { CapabilityUnavailableError } from "../../../domain/errors.js";
+import { canListen } from "../../node/can-listen.js";
+/** `netstat -an -p tcp`: every listening socket, with the port after the address's last dot and * for any address. */
+export function parseMacosNetstat(output) {
+    const listeners = [];
+    for (const line of output.split("\n")) {
+        const parts = line.trim().split(/\s+/);
+        const protocol = parts[0] ?? "";
+        if (parts.length < 6 || !protocol.startsWith("tcp") || parts[5] !== "LISTEN")
+            continue;
+        const local = parts[3] ?? "";
+        const dot = local.lastIndexOf(".");
+        const port = Number(local.slice(dot + 1));
+        if (dot < 0 || !Number.isInteger(port))
+            continue;
+        const host = local.slice(0, dot);
+        const address = host === "*" ? (protocol === "tcp4" ? "0.0.0.0" : "::") : host;
+        listeners.push({ address, port, pid: null });
+    }
+    return listeners;
+}
+/** `lsof -nP -iTCP -sTCP:LISTEN -Fpn`: a p line names the process, and each n line after it a socket. */
+export function parseLsofListeners(output) {
+    const sockets = [];
+    let pid = null;
+    for (const line of output.split("\n").map((text) => text.trim())) {
+        if (line.startsWith("p")) {
+            pid = Number(line.slice(1));
+        }
+        else if (line.startsWith("n") && pid !== null) {
+            const match = /^n(.*):(\d+)$/.exec(line);
+            if (match === null)
+                continue;
+            sockets.push({ pid, address: (match[1] ?? "").replace(/^\[(.*)\]$/, "$1"), port: Number(match[2]) });
+        }
+    }
+    return sockets;
+}
+const ANY_ADDRESS = new Set(["*", "0.0.0.0", "::"]);
+/**
+ * netstat sees every listener but no owner; lsof sees owners, but without root only the
+ * user's own. Each listener takes its owners from lsof, and a socket only lsof saw is kept.
+ */
+export function mergeListeners(all, owned) {
+    const used = new Set();
+    const merged = [];
+    for (const listener of all) {
+        const owners = owned.filter((socket) => socket.port === listener.port &&
+            (socket.address === listener.address || (ANY_ADDRESS.has(socket.address) && ANY_ADDRESS.has(listener.address))));
+        if (owners.length === 0)
+            merged.push(listener);
+        for (const owner of owners) {
+            used.add(owner);
+            merged.push({ ...listener, pid: owner.pid });
+        }
+    }
+    for (const socket of owned) {
+        if (used.has(socket))
+            continue;
+        merged.push({ address: socket.address === "*" ? "0.0.0.0" : socket.address, port: socket.port, pid: socket.pid });
+    }
+    return merged;
+}
+export class MacosPortTableAdapter {
+    processRunner;
+    constructor(processRunner) {
+        this.processRunner = processRunner;
+    }
+    async listeners(signal) {
+        const options = { signal, timeoutMs: 30_000 };
+        const [netstat, lsof] = await Promise.all([
+            this.processRunner.run("/usr/sbin/netstat", ["-an", "-p", "tcp"], options),
+            this.processRunner.run("/usr/sbin/lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-Fpn"], options),
+        ]);
+        // lsof exits 1 when it finds none of the user's sockets.
+        if (netstat.code !== 0 && lsof.code > 1) {
+            const detail = netstat.stderr.trim().split("\n")[0] ?? "";
+            throw new CapabilityUnavailableError("core.ports.failed", { program: "netstat", code: netstat.code, detail });
+        }
+        return mergeListeners(netstat.code === 0 ? parseMacosNetstat(netstat.stdout) : [], parseLsofListeners(lsof.stdout));
+    }
+    canListen(port) {
+        return canListen(port);
+    }
+}
+//# sourceMappingURL=macos-port-table.adapter.js.map