@calltelemetry/cucm-mcp 0.1.7 → 0.2.3

package/dist/packetCapture.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/packetCapture.ts"],
+  "sourcesContent": ["import crypto from \"node:crypto\";\nimport { Client, type ClientChannel } from \"ssh2\";\n\nimport { defaultStateStore, type CaptureStateStore } from \"./state.js\";\n\nexport type SshAuth = { username?: string; password?: string };\n\nexport type PacketCaptureStart = {\n  host: string;\n  sshPort?: number;\n  auth?: SshAuth;\n  iface?: string;\n  fileBase?: string;\n  count?: number;\n  size?: string;\n  hostFilterIp?: string;\n  portFilter?: number;\n  // If set, stop the capture after this long even if packet count isn't reached.\n  maxDurationMs?: number;\n  // Guardrail so packet_capture_start doesn't hang forever.\n  startTimeoutMs?: number;\n};\n\nexport type PacketCaptureSession = {\n  id: string;\n  host: string;\n  startedAt: string;\n  stoppedAt?: string;\n  iface: string;\n  fileBase: string;\n  remoteFilePath: string;\n  remoteFileCandidates: string[];\n  stopTimedOut?: boolean;\n  lastStdout?: string;\n  lastStderr?: string;\n  exitCode?: number | null;\n};\n\nfunction extractCapFilePath(text?: string): string | undefined {\n  if (!text) return undefined;\n  // CUCM typically writes captures to /var/log/active/platform/cli/<name>.cap\n  // Sometimes CLI output includes the final on-disk location.\n  const re = /\\/var\\/log\\/active\\/platform\\/cli\\/[A-Za-z0-9._-]+\\.cap/g;\n  const matches = text.match(re);\n  if (!matches || matches.length === 0) return undefined;\n  return matches[matches.length - 1];\n}\n\nfunction looksLikeCucmPrompt(text?: string): boolean {\n  const t = String(text || \"\");\n  // CUCM CLI commonly ends commands by printing a prompt like:\n  //   admin:\n  // Some environments might show other usernames.\n  // We only look at the tail to avoid false positives.\n  const tail = t.slice(-80);\n  return /(?:^|\\n)[A-Za-z0-9_-]+:\\s*$/.test(tail);\n}\n\nexport function resolveSshAuth(auth?: SshAuth): Required<SshAuth> {\n  const username = auth?.username || process.env.CUCM_SSH_USERNAME;\n  const password = auth?.password || process.env.CUCM_SSH_PASSWORD;\n  if (!username || !password) {\n    throw new Error(\"Missing SSH credentials (provide auth or set CUCM_SSH_USERNAME/CUCM_SSH_PASSWORD)\");\n  }\n  return { username, password };\n}\n\nexport function sanitizeFileBase(s: string): string {\n  // CUCM note: fname should not contain '.'\n  // Keep it conservative.\n  const cleaned = String(s || \"\")\n    .trim()\n    .replaceAll(\".\", \"_\")\n    .replace(/[^A-Za-z0-9_-]+/g, \"_\")\n    .replace(/^_+/, \"\")\n    .replace(/_+$/, \"\");\n  if (!cleaned) throw new Error(\"fileBase is required (after sanitization)\");\n  return cleaned;\n}\n\nexport function buildCaptureCommand(opts: {\n  iface: string;\n  fileBase: string;\n  count: number;\n  size: string;\n  hostFilterIp?: string;\n  portFilter?: number;\n}): string {\n  const iface = String(opts.iface || \"eth0\").trim() || \"eth0\";\n  const fileBase = sanitizeFileBase(opts.fileBase);\n  const count = Number.isFinite(opts.count) ? Math.trunc(opts.count) : 100000;\n  if (count <= 0) throw new Error(\"count must be > 0\");\n  const size = String(opts.size || \"all\").trim() || \"all\";\n\n  const args: string[] = [\n    \"utils\",\n    \"network\",\n    \"capture\",\n    iface,\n    \"file\",\n    fileBase,\n    \"count\",\n    String(count),\n    \"size\",\n    size,\n  ];\n\n  if (opts.portFilter != null) {\n    const p = Math.trunc(opts.portFilter);\n    if (p < 1 || p > 65535) throw new Error(\"portFilter must be 1..65535\");\n    args.push(\"port\", String(p));\n  }\n\n  if (opts.hostFilterIp) {\n    const ip = String(opts.hostFilterIp).trim();\n    if (!ip) throw new Error(\"hostFilterIp must be non-empty\");\n    args.push(\"host\", \"ip\", ip);\n  }\n\n  return args.join(\" \");\n}\n\nexport function remoteCapturePath(fileBase: string): string {\n  const fb = sanitizeFileBase(fileBase);\n  return `/var/log/active/platform/cli/${fb}.cap`;\n}\n\nexport function remoteCaptureCandidates(fileBase: string, maxParts = 10): string[] {\n  const fb = sanitizeFileBase(fileBase);\n  const base = `/var/log/active/platform/cli/${fb}.cap`;\n  const out: string[] = [base];\n  // Some CUCM/VOS versions roll packet capture files as .cap01, .cap02, ...\n  for (let i = 1; i <= maxParts; i++) {\n    const suffix = String(i).padStart(2, \"0\");\n    out.push(`/var/log/active/platform/cli/${fb}.cap${suffix}`);\n  }\n  return out;\n}\n\ntype Active = {\n  session: PacketCaptureSession;\n  client: Client;\n  channel: ClientChannel;\n};\n\nfunction waitFor(\n  channel: ClientChannel,\n  session: PacketCaptureSession,\n  predicate: () => boolean,\n  timeoutMs: number,\n  timeoutMessage: string\n): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (predicate()) return resolve();\n\n    const onData = () => {\n      if (predicate()) cleanup(true);\n    };\n\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    const cleanup = (ok: boolean) => {\n      channel.off(\"data\", onData);\n      channel.stderr.off(\"data\", onData);\n      if (timer) clearTimeout(timer);\n      if (ok) resolve();\n      else {\n        const tail = (session.lastStdout || session.lastStderr || \"\").slice(-400);\n        reject(new Error(`${timeoutMessage}. lastOutput=${JSON.stringify(tail)}`));\n      }\n    };\n\n    channel.on(\"data\", onData);\n    channel.stderr.on(\"data\", onData);\n\n    timer = setTimeout(() => cleanup(false), Math.max(1000, timeoutMs));\n    (timer as any).unref?.();\n  });\n}\n\nexport class PacketCaptureManager {\n  private active = new Map<string, Active>();\n  private state: CaptureStateStore;\n\n  constructor(opts?: { state?: CaptureStateStore }) {\n    this.state = opts?.state || defaultStateStore();\n  }\n\n  list(): PacketCaptureSession[] {\n    return [...this.active.values()].map((a) => a.session);\n  }\n\n  async start(opts: PacketCaptureStart): Promise<PacketCaptureSession> {\n    const iface = String(opts.iface || \"eth0\").trim() || \"eth0\";\n    const fileBase = sanitizeFileBase(opts.fileBase || `cap_${Date.now()}`);\n    const count = opts.count ?? 100000;\n    const size = opts.size ?? \"all\";\n    const cmd = buildCaptureCommand({ iface, fileBase, count, size, hostFilterIp: opts.hostFilterIp, portFilter: opts.portFilter });\n\n    const id = crypto.randomUUID();\n    const sshPort = opts.sshPort ?? (process.env.CUCM_SSH_PORT ? Number.parseInt(process.env.CUCM_SSH_PORT, 10) : 22);\n    const auth = resolveSshAuth(opts.auth);\n\n    const client = new Client();\n    const startedAt = new Date().toISOString();\n    const session: PacketCaptureSession = {\n      id,\n      host: opts.host,\n      startedAt,\n      iface,\n      fileBase,\n      remoteFilePath: remoteCapturePath(fileBase),\n      remoteFileCandidates: remoteCaptureCandidates(fileBase),\n    };\n\n    // Persist early so we can recover/download even if the MCP process restarts.\n    this.state.upsert({\n      ...session,\n      stoppedAt: session.stoppedAt,\n    });\n\n    const startTimeoutMs = Math.max(2000, Math.trunc(opts.startTimeoutMs ?? 30_000));\n\n    let connectTimer: ReturnType<typeof setTimeout> | undefined;\n    const connectTimeout = new Promise<never>((_, reject) => {\n      connectTimer = setTimeout(() => reject(new Error(`SSH connect timed out after ${startTimeoutMs}ms`)), startTimeoutMs);\n      (connectTimer as any).unref?.();\n    });\n\n    try {\n      await Promise.race([\n        new Promise<void>((resolve, reject) => {\n          client\n            .on(\"ready\", () => resolve())\n            .on(\"error\", (e: unknown) => reject(e))\n            .connect({\n              host: opts.host,\n              port: sshPort,\n              username: auth.username,\n              password: auth.password,\n              readyTimeout: 15000,\n            });\n        }),\n        connectTimeout,\n      ]);\n    } finally {\n      if (connectTimer) clearTimeout(connectTimer);\n    }\n\n    // CUCM SSH presents an interactive CLI shell. `exec()` is not reliably supported,\n    // so we open a shell and type commands at the prompt.\n    const channel = await new Promise<ClientChannel>((resolve, reject) => {\n      client.shell({ term: \"vt100\", cols: 120, rows: 40 }, (err: unknown, ch: ClientChannel) => {\n        if (err) return reject(err);\n        resolve(ch);\n      });\n    });\n\n    channel.on(\"data\", (buf: Buffer) => {\n      session.lastStdout = buf.toString(\"utf8\").slice(-2000);\n      this.state.upsert({ ...session, stoppedAt: session.stoppedAt });\n    });\n    channel.stderr.on(\"data\", (buf: Buffer) => {\n      session.lastStderr = buf.toString(\"utf8\").slice(-2000);\n      this.state.upsert({ ...session, stoppedAt: session.stoppedAt });\n    });\n    channel.on(\"close\", (code: number | null) => {\n      session.exitCode = code;\n      session.stoppedAt = session.stoppedAt || new Date().toISOString();\n      // If the capture stopped unexpectedly, drop it from the active map.\n      this.active.delete(id);\n      this.state.upsert({ ...session, stoppedAt: session.stoppedAt });\n      try {\n        client.end();\n        client.destroy();\n      } catch {\n        // ignore\n      }\n    });\n\n    // Wait for prompt before running capture command.\n    // Some CUCM shells don't print a prompt until you send a newline.\n    const promptTimeoutMs = startTimeoutMs;\n    try {\n      try {\n        channel.write(\"\\n\");\n      } catch {\n        // ignore\n      }\n\n      // Nudge a couple times if no prompt yet.\n      void (async () => {\n        const delays = [400, 1200, 2500];\n        for (const d of delays) {\n          await new Promise((r) => setTimeout(r, d));\n          if (looksLikeCucmPrompt(session.lastStdout) || looksLikeCucmPrompt(session.lastStderr)) return;\n          try {\n            channel.write(\"\\n\");\n          } catch {\n            // ignore\n          }\n        }\n      })();\n\n      await waitFor(\n        channel,\n        session,\n        () => looksLikeCucmPrompt(session.lastStdout) || looksLikeCucmPrompt(session.lastStderr),\n        promptTimeoutMs,\n        \"Timeout waiting for CUCM CLI prompt\"\n      );\n      channel.write(`${cmd}\\n`);\n    } catch (e) {\n      try {\n        channel.end();\n        channel.close();\n      } catch {\n        // ignore\n      }\n      try {\n        client.end();\n        client.destroy();\n      } catch {\n        // ignore\n      }\n      throw e;\n    }\n\n    this.active.set(id, { session, client, channel });\n\n    // Optional guard: stop after a duration even if packet count isn't reached.\n    if (opts.maxDurationMs != null) {\n      const dur = Math.max(250, Math.trunc(opts.maxDurationMs));\n      const t = setTimeout(() => {\n        void this.stop(id).catch(() => {\n          // ignore\n        });\n      }, dur);\n      (t as any).unref?.();\n    }\n\n    return session;\n  }\n\n  async stop(captureId: string, timeoutMs = 90_000): Promise<PacketCaptureSession> {\n    const a = this.active.get(captureId);\n    if (!a) throw new Error(`Unknown captureId: ${captureId}`);\n\n    const { channel, client, session } = a;\n    const done = new Promise<void>((resolve) => {\n      if (looksLikeCucmPrompt(session.lastStdout) || looksLikeCucmPrompt(session.lastStderr)) {\n        return resolve();\n      }\n      // CUCM CLI can keep the SSH channel open after the command finishes\n      // (it returns to a prompt rather than exiting). Treat prompt as \"stopped\".\n      const onData = () => {\n        if (looksLikeCucmPrompt(session.lastStdout) || looksLikeCucmPrompt(session.lastStderr)) {\n          cleanup();\n          resolve();\n        }\n      };\n      const cleanup = () => {\n        channel.off(\"data\", onData);\n        channel.stderr.off(\"data\", onData);\n      };\n\n      const finish = () => {\n        cleanup();\n        resolve();\n      };\n\n      channel.once(\"exit\", finish);\n      channel.once(\"close\", finish);\n      channel.once(\"end\", finish);\n      channel.on(\"data\", onData);\n      channel.stderr.on(\"data\", onData);\n    });\n\n    const sendInterrupt = () => {\n      // Best-effort interrupt.\n      try {\n        if (typeof (channel as any).signal === \"function\") (channel as any).signal(\"INT\");\n        // Always also write Ctrl-C for PTY sessions.\n        channel.write(\"\\x03\");\n      } catch {\n        try {\n          channel.write(\"\\x03\");\n        } catch {\n          // ignore\n        }\n      }\n    };\n\n    // CUCM can take a while to flush/close captures (especially big buffers).\n    // Also, some CLI flows require a second Ctrl-C or a newline to return to prompt.\n    const resolvedTimeoutMs = Math.max(5000, timeoutMs || 0);\n    const deadline = Date.now() + resolvedTimeoutMs;\n    sendInterrupt();\n\n    // Nudge again a couple times if it doesn't exit quickly.\n    void (async () => {\n      const delays = [750, 1500, 3000];\n      for (const d of delays) {\n        await new Promise((r) => setTimeout(r, d));\n        if (Date.now() >= deadline) return;\n        // If channel already closed, no-op.\n        sendInterrupt();\n        try {\n          channel.write(\"\\n\");\n        } catch {\n          // ignore\n        }\n      }\n    })();\n\n    try {\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    const timeout = new Promise<void>((_, reject) => {\n      timer = setTimeout(() => reject(new Error(\"Timeout waiting for capture to stop\")), resolvedTimeoutMs);\n      // Don't keep the process alive just because we're waiting.\n      (timer as any).unref?.();\n    });\n\n    try {\n      await Promise.race([done, timeout]);\n    } finally {\n      if (timer) clearTimeout(timer);\n    }\n    } catch (e) {\n      // Don't hard-fail: if the CLI doesn't emit a prompt/exit, we still want to:\n      // - close SSH resources\n      // - let the caller try DIME downloads (.cap, .cap01, etc)\n      session.stopTimedOut = true;\n      session.stoppedAt = session.stoppedAt || new Date().toISOString();\n      this.state.upsert({ ...session, stoppedAt: session.stoppedAt });\n      try {\n        channel.close();\n      } catch {\n        // ignore\n      }\n    }\n\n    session.stoppedAt = new Date().toISOString();\n    this.state.upsert({ ...session, stoppedAt: session.stoppedAt });\n\n    // If we're back at a CUCM prompt, try to close the session cleanly.\n    if (looksLikeCucmPrompt(session.lastStdout) || looksLikeCucmPrompt(session.lastStderr)) {\n      try {\n        channel.write(\"exit\\n\");\n      } catch {\n        // ignore\n      }\n    }\n\n    // Ensure the channel is closed so the SSH client can terminate promptly.\n    try {\n      channel.end();\n    } catch {\n      // ignore\n    }\n    try {\n      channel.close();\n    } catch {\n      // ignore\n    }\n\n    // Attempt to learn the actual remote file path from CLI output.\n    // This helps when CUCM appends suffixes or reports a different on-disk location.\n    const inferred = extractCapFilePath(session.lastStdout) || extractCapFilePath(session.lastStderr);\n    if (inferred) {\n      session.remoteFilePath = inferred;\n      if (!session.remoteFileCandidates.includes(inferred)) {\n        session.remoteFileCandidates = [inferred, ...session.remoteFileCandidates];\n      }\n    }\n\n    this.state.upsert({ ...session, stoppedAt: session.stoppedAt });\n\n    // stop() implies cleanup\n    this.active.delete(captureId);\n    try {\n      client.end();\n      client.destroy();\n    } catch {\n      // ignore\n    }\n    return session;\n  }\n}\n"],
+  "mappings": "AAAA,OAAO,YAAY;AACnB,SAAS,cAAkC;AAE3C,SAAS,yBAAiD;AAmC1D,SAAS,mBAAmB,MAAmC;AAC7D,MAAI,CAAC,KAAM,QAAO;AAGlB,QAAM,KAAK;AACX,QAAM,UAAU,KAAK,MAAM,EAAE;AAC7B,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;AAC7C,SAAO,QAAQ,QAAQ,SAAS,CAAC;AACnC;AAEA,SAAS,oBAAoB,MAAwB;AACnD,QAAM,IAAI,OAAO,QAAQ,EAAE;AAK3B,QAAM,OAAO,EAAE,MAAM,GAAG;AACxB,SAAO,8BAA8B,KAAK,IAAI;AAChD;AAEO,SAAS,eAAe,MAAmC;AAChE,QAAM,WAAW,MAAM,YAAY,QAAQ,IAAI;AAC/C,QAAM,WAAW,MAAM,YAAY,QAAQ,IAAI;AAC/C,MAAI,CAAC,YAAY,CAAC,UAAU;AAC1B,UAAM,IAAI,MAAM,mFAAmF;AAAA,EACrG;AACA,SAAO,EAAE,UAAU,SAAS;AAC9B;AAEO,SAAS,iBAAiB,GAAmB;AAGlD,QAAM,UAAU,OAAO,KAAK,EAAE,EAC3B,KAAK,EACL,WAAW,KAAK,GAAG,EACnB,QAAQ,oBAAoB,GAAG,EAC/B,QAAQ,OAAO,EAAE,EACjB,QAAQ,OAAO,EAAE;AACpB,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,2CAA2C;AACzE,SAAO;AACT;AAEO,SAAS,oBAAoB,MAOzB;AACT,QAAM,QAAQ,OAAO,KAAK,SAAS,MAAM,EAAE,KAAK,KAAK;AACrD,QAAM,WAAW,iBAAiB,KAAK,QAAQ;AAC/C,QAAM,QAAQ,OAAO,SAAS,KAAK,KAAK,IAAI,KAAK,MAAM,KAAK,KAAK,IAAI;AACrE,MAAI,SAAS,EAAG,OAAM,IAAI,MAAM,mBAAmB;AACnD,QAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,EAAE,KAAK,KAAK;AAElD,QAAM,OAAiB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,KAAK;AAAA,IACZ;AAAA,IACA;AAAA,EACF;AAEA,MAAI,KAAK,cAAc,MAAM;AAC3B,UAAM,IAAI,KAAK,MAAM,KAAK,UAAU;AACpC,QAAI,IAAI,KAAK,IAAI,MAAO,OAAM,IAAI,MAAM,6BAA6B;AACrE,SAAK,KAAK,QAAQ,OAAO,CAAC,CAAC;AAAA,EAC7B;AAEA,MAAI,KAAK,cAAc;AACrB,UAAM,KAAK,OAAO,KAAK,YAAY,EAAE,KAAK;AAC1C,QAAI,CAAC,GAAI,OAAM,IAAI,MAAM,gCAAgC;AACzD,SAAK,KAAK,QAAQ,MAAM,EAAE;AAAA,EAC5B;AAEA,SAAO,KAAK,KAAK,GAAG;AACtB;AAEO,SAAS,kBAAkB,UAA0B;AAC1D,QAAM,KAAK,iBAAiB,QAAQ;AACpC,SAAO,gCAAgC,EAAE;AAC3C;AAEO,SAAS,wBAAwB,UAAkB,WAAW,IAAc;AACjF,QAAM,KAAK,iBAAiB,QAAQ;AACpC,QAAM,OAAO,gCAAgC,EAAE;AAC/C,QAAM,MAAgB,CAAC,IAAI;AAE3B,WAAS,IAAI,GAAG,KAAK,UAAU,KAAK;AAClC,UAAM,SAAS,OAAO,CAAC,EAAE,SAAS,GAAG,GAAG;AACxC,QAAI,KAAK,gCAAgC,EAAE,OAAO,MAAM,EAAE;AAAA,EAC5D;AACA,SAAO;AACT;AAQA,SAAS,QACP,SACA,SACA,WACA,WACA,gBACe;AACf,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,UAAU,EAAG,QAAO,QAAQ;AAEhC,UAAM,SAAS,MAAM;AACnB,UAAI,UAAU,EAAG,SAAQ,IAAI;AAAA,IAC/B;AAEA,QAAI;AACJ,UAAM,UAAU,CAAC,OAAgB;AAC/B,cAAQ,IAAI,QAAQ,MAAM;AAC1B,cAAQ,OAAO,IAAI,QAAQ,MAAM;AACjC,UAAI,MAAO,cAAa,KAAK;AAC7B,UAAI,GAAI,SAAQ;AAAA,WACX;AACH,cAAM,QAAQ,QAAQ,cAAc,QAAQ,cAAc,IAAI,MAAM,IAAI;AACxE,eAAO,IAAI,MAAM,GAAG,cAAc,gBAAgB,KAAK,UAAU,IAAI,CAAC,EAAE,CAAC;AAAA,MAC3E;AAAA,IACF;AAEA,YAAQ,GAAG,QAAQ,MAAM;AACzB,YAAQ,OAAO,GAAG,QAAQ,MAAM;AAEhC,YAAQ,WAAW,MAAM,QAAQ,KAAK,GAAG,KAAK,IAAI,KAAM,SAAS,CAAC;AAClE,IAAC,MAAc,QAAQ;AAAA,EACzB,CAAC;AACH;AAEO,MAAM,qBAAqB;AAAA,EACxB,SAAS,oBAAI,IAAoB;AAAA,EACjC;AAAA,EAER,YAAY,MAAsC;AAChD,SAAK,QAAQ,MAAM,SAAS,kBAAkB;AAAA,EAChD;AAAA,EAEA,OAA+B;AAC7B,WAAO,CAAC,GAAG,KAAK,OAAO,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO;AAAA,EACvD;AAAA,EAEA,MAAM,MAAM,MAAyD;AACnE,UAAM,QAAQ,OAAO,KAAK,SAAS,MAAM,EAAE,KAAK,KAAK;AACrD,UAAM,WAAW,iBAAiB,KAAK,YAAY,OAAO,KAAK,IAAI,CAAC,EAAE;AACtE,UAAM,QAAQ,KAAK,SAAS;AAC5B,UAAM,OAAO,KAAK,QAAQ;AAC1B,UAAM,MAAM,oBAAoB,EAAE,OAAO,UAAU,OAAO,MAAM,cAAc,KAAK,cAAc,YAAY,KAAK,WAAW,CAAC;AAE9H,UAAM,KAAK,OAAO,WAAW;AAC7B,UAAM,UAAU,KAAK,YAAY,QAAQ,IAAI,gBAAgB,OAAO,SAAS,QAAQ,IAAI,eAAe,EAAE,IAAI;AAC9G,UAAM,OAAO,eAAe,KAAK,IAAI;AAErC,UAAM,SAAS,IAAI,OAAO;AAC1B,UAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,UAAM,UAAgC;AAAA,MACpC;AAAA,MACA,MAAM,KAAK;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA,gBAAgB,kBAAkB,QAAQ;AAAA,MAC1C,sBAAsB,wBAAwB,QAAQ;AAAA,IACxD;AAGA,SAAK,MAAM,OAAO;AAAA,MAChB,GAAG;AAAA,MACH,WAAW,QAAQ;AAAA,IACrB,CAAC;AAED,UAAM,iBAAiB,KAAK,IAAI,KAAM,KAAK,MAAM,KAAK,kBAAkB,GAAM,CAAC;AAE/E,QAAI;AACJ,UAAM,iBAAiB,IAAI,QAAe,CAAC,GAAG,WAAW;AACvD,qBAAe,WAAW,MAAM,OAAO,IAAI,MAAM,+BAA+B,cAAc,IAAI,CAAC,GAAG,cAAc;AACpH,MAAC,aAAqB,QAAQ;AAAA,IAChC,CAAC;AAED,QAAI;AACF,YAAM,QAAQ,KAAK;AAAA,QACjB,IAAI,QAAc,CAAC,SAAS,WAAW;AACrC,iBACG,GAAG,SAAS,MAAM,QAAQ,CAAC,EAC3B,GAAG,SAAS,CAAC,MAAe,OAAO,CAAC,CAAC,EACrC,QAAQ;AAAA,YACP,MAAM,KAAK;AAAA,YACX,MAAM;AAAA,YACN,UAAU,KAAK;AAAA,YACf,UAAU,KAAK;AAAA,YACf,cAAc;AAAA,UAChB,CAAC;AAAA,QACL,CAAC;AAAA,QACD;AAAA,MACF,CAAC;AAAA,IACH,UAAE;AACA,UAAI,aAAc,cAAa,YAAY;AAAA,IAC7C;AAIA,UAAM,UAAU,MAAM,IAAI,QAAuB,CAAC,SAAS,WAAW;AACpE,aAAO,MAAM,EAAE,MAAM,SAAS,MAAM,KAAK,MAAM,GAAG,GAAG,CAAC,KAAc,OAAsB;AACxF,YAAI,IAAK,QAAO,OAAO,GAAG;AAC1B,gBAAQ,EAAE;AAAA,MACZ,CAAC;AAAA,IACH,CAAC;AAED,YAAQ,GAAG,QAAQ,CAAC,QAAgB;AAClC,cAAQ,aAAa,IAAI,SAAS,MAAM,EAAE,MAAM,IAAK;AACrD,WAAK,MAAM,OAAO,EAAE,GAAG,SAAS,WAAW,QAAQ,UAAU,CAAC;AAAA,IAChE,CAAC;AACD,YAAQ,OAAO,GAAG,QAAQ,CAAC,QAAgB;AACzC,cAAQ,aAAa,IAAI,SAAS,MAAM,EAAE,MAAM,IAAK;AACrD,WAAK,MAAM,OAAO,EAAE,GAAG,SAAS,WAAW,QAAQ,UAAU,CAAC;AAAA,IAChE,CAAC;AACD,YAAQ,GAAG,SAAS,CAAC,SAAwB;AAC3C,cAAQ,WAAW;AACnB,cAAQ,YAAY,QAAQ,cAAa,oBAAI,KAAK,GAAE,YAAY;AAEhE,WAAK,OAAO,OAAO,EAAE;AACrB,WAAK,MAAM,OAAO,EAAE,GAAG,SAAS,WAAW,QAAQ,UAAU,CAAC;AAC9D,UAAI;AACF,eAAO,IAAI;AACX,eAAO,QAAQ;AAAA,MACjB,QAAQ;AAAA,MAER;AAAA,IACF,CAAC;AAID,UAAM,kBAAkB;AACxB,QAAI;AACF,UAAI;AACF,gBAAQ,MAAM,IAAI;AAAA,MACpB,QAAQ;AAAA,MAER;AAGA,YAAM,YAAY;AAChB,cAAM,SAAS,CAAC,KAAK,MAAM,IAAI;AAC/B,mBAAW,KAAK,QAAQ;AACtB,gBAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC;AACzC,cAAI,oBAAoB,QAAQ,UAAU,KAAK,oBAAoB,QAAQ,UAAU,EAAG;AACxF,cAAI;AACF,oBAAQ,MAAM,IAAI;AAAA,UACpB,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,GAAG;AAEH,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA,MAAM,oBAAoB,QAAQ,UAAU,KAAK,oBAAoB,QAAQ,UAAU;AAAA,QACvF;AAAA,QACA;AAAA,MACF;AACA,cAAQ,MAAM,GAAG,GAAG;AAAA,CAAI;AAAA,IAC1B,SAAS,GAAG;AACV,UAAI;AACF,gBAAQ,IAAI;AACZ,gBAAQ,MAAM;AAAA,MAChB,QAAQ;AAAA,MAER;AACA,UAAI;AACF,eAAO,IAAI;AACX,eAAO,QAAQ;AAAA,MACjB,QAAQ;AAAA,MAER;AACA,YAAM;AAAA,IACR;AAEA,SAAK,OAAO,IAAI,IAAI,EAAE,SAAS,QAAQ,QAAQ,CAAC;AAGhD,QAAI,KAAK,iBAAiB,MAAM;AAC9B,YAAM,MAAM,KAAK,IAAI,KAAK,KAAK,MAAM,KAAK,aAAa,CAAC;AACxD,YAAM,IAAI,WAAW,MAAM;AACzB,aAAK,KAAK,KAAK,EAAE,EAAE,MAAM,MAAM;AAAA,QAE/B,CAAC;AAAA,MACH,GAAG,GAAG;AACN,MAAC,EAAU,QAAQ;AAAA,IACrB;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,KAAK,WAAmB,YAAY,KAAuC;AAC/E,UAAM,IAAI,KAAK,OAAO,IAAI,SAAS;AACnC,QAAI,CAAC,EAAG,OAAM,IAAI,MAAM,sBAAsB,SAAS,EAAE;AAEzD,UAAM,EAAE,SAAS,QAAQ,QAAQ,IAAI;AACrC,UAAM,OAAO,IAAI,QAAc,CAAC,YAAY;AAC1C,UAAI,oBAAoB,QAAQ,UAAU,KAAK,oBAAoB,QAAQ,UAAU,GAAG;AACtF,eAAO,QAAQ;AAAA,MACjB;AAGA,YAAM,SAAS,MAAM;AACnB,YAAI,oBAAoB,QAAQ,UAAU,KAAK,oBAAoB,QAAQ,UAAU,GAAG;AACtF,kBAAQ;AACR,kBAAQ;AAAA,QACV;AAAA,MACF;AACA,YAAM,UAAU,MAAM;AACpB,gBAAQ,IAAI,QAAQ,MAAM;AAC1B,gBAAQ,OAAO,IAAI,QAAQ,MAAM;AAAA,MACnC;AAEA,YAAM,SAAS,MAAM;AACnB,gBAAQ;AACR,gBAAQ;AAAA,MACV;AAEA,cAAQ,KAAK,QAAQ,MAAM;AAC3B,cAAQ,KAAK,SAAS,MAAM;AAC5B,cAAQ,KAAK,OAAO,MAAM;AAC1B,cAAQ,GAAG,QAAQ,MAAM;AACzB,cAAQ,OAAO,GAAG,QAAQ,MAAM;AAAA,IAClC,CAAC;AAED,UAAM,gBAAgB,MAAM;AAE1B,UAAI;AACF,YAAI,OAAQ,QAAgB,WAAW,WAAY,CAAC,QAAgB,OAAO,KAAK;AAEhF,gBAAQ,MAAM,GAAM;AAAA,MACtB,QAAQ;AACN,YAAI;AACF,kBAAQ,MAAM,GAAM;AAAA,QACtB,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAIA,UAAM,oBAAoB,KAAK,IAAI,KAAM,aAAa,CAAC;AACvD,UAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,kBAAc;AAGd,UAAM,YAAY;AAChB,YAAM,SAAS,CAAC,KAAK,MAAM,GAAI;AAC/B,iBAAW,KAAK,QAAQ;AACtB,cAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC;AACzC,YAAI,KAAK,IAAI,KAAK,SAAU;AAE5B,sBAAc;AACd,YAAI;AACF,kBAAQ,MAAM,IAAI;AAAA,QACpB,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF,GAAG;AAEH,QAAI;AACJ,UAAI;AACJ,YAAM,UAAU,IAAI,QAAc,CAAC,GAAG,WAAW;AAC/C,gBAAQ,WAAW,MAAM,OAAO,IAAI,MAAM,qCAAqC,CAAC,GAAG,iBAAiB;AAEpG,QAAC,MAAc,QAAQ;AAAA,MACzB,CAAC;AAED,UAAI;AACF,cAAM,QAAQ,KAAK,CAAC,MAAM,OAAO,CAAC;AAAA,MACpC,UAAE;AACA,YAAI,MAAO,cAAa,KAAK;AAAA,MAC/B;AAAA,IACA,SAAS,GAAG;AAIV,cAAQ,eAAe;AACvB,cAAQ,YAAY,QAAQ,cAAa,oBAAI,KAAK,GAAE,YAAY;AAChE,WAAK,MAAM,OAAO,EAAE,GAAG,SAAS,WAAW,QAAQ,UAAU,CAAC;AAC9D,UAAI;AACF,gBAAQ,MAAM;AAAA,MAChB,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,YAAQ,aAAY,oBAAI,KAAK,GAAE,YAAY;AAC3C,SAAK,MAAM,OAAO,EAAE,GAAG,SAAS,WAAW,QAAQ,UAAU,CAAC;AAG9D,QAAI,oBAAoB,QAAQ,UAAU,KAAK,oBAAoB,QAAQ,UAAU,GAAG;AACtF,UAAI;AACF,gBAAQ,MAAM,QAAQ;AAAA,MACxB,QAAQ;AAAA,MAER;AAAA,IACF;AAGA,QAAI;AACF,cAAQ,IAAI;AAAA,IACd,QAAQ;AAAA,IAER;AACA,QAAI;AACF,cAAQ,MAAM;AAAA,IAChB,QAAQ;AAAA,IAER;AAIA,UAAM,WAAW,mBAAmB,QAAQ,UAAU,KAAK,mBAAmB,QAAQ,UAAU;AAChG,QAAI,UAAU;AACZ,cAAQ,iBAAiB;AACzB,UAAI,CAAC,QAAQ,qBAAqB,SAAS,QAAQ,GAAG;AACpD,gBAAQ,uBAAuB,CAAC,UAAU,GAAG,QAAQ,oBAAoB;AAAA,MAC3E;AAAA,IACF;AAEA,SAAK,MAAM,OAAO,EAAE,GAAG,SAAS,WAAW,QAAQ,UAAU,CAAC;AAG9D,SAAK,OAAO,OAAO,SAAS;AAC5B,QAAI;AACF,aAAO,IAAI;AACX,aAAO,QAAQ;AAAA,IACjB,QAAQ;AAAA,IAER;AACA,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/pcap-analyze.js

@@ -0,0 +1,601 @@
+import { execFile } from "node:child_process";
+import { existsSync, statSync } from "node:fs";
+const TSHARK_CANDIDATES = [
+  process.env.TSHARK_PATH,
+  "tshark",
+  "/Applications/Wireshark.app/Contents/MacOS/tshark",
+  "/usr/local/bin/tshark",
+  "/usr/bin/tshark",
+  "/opt/homebrew/bin/tshark"
+].filter(Boolean);
+let cachedTsharkPath = null;
+function findTshark() {
+  if (cachedTsharkPath) return cachedTsharkPath;
+  for (const candidate of TSHARK_CANDIDATES) {
+    try {
+      if (existsSync(candidate)) {
+        cachedTsharkPath = candidate;
+        return candidate;
+      }
+    } catch {
+    }
+  }
+  return "tshark";
+}
+const TSHARK_TIMEOUT_MS = Number(process.env.CUCM_MCP_TSHARK_TIMEOUT_MS) || 6e4;
+function runTshark(args, timeoutMs) {
+  const bin = findTshark();
+  const timeout = timeoutMs ?? TSHARK_TIMEOUT_MS;
+  return new Promise((resolve, reject) => {
+    execFile(bin, args, { timeout, maxBuffer: 50 * 1024 * 1024 }, (err, stdout, stderr) => {
+      if (err) {
+        const msg = stderr?.trim() || err.message;
+        if (msg.includes("No such file") || msg.includes("doesn't exist")) {
+          reject(new Error(`File not found: ${args.find((a) => a.endsWith(".cap") || a.endsWith(".pcap")) || "unknown"}`));
+        } else if (msg.includes("not found") || msg.includes("ENOENT")) {
+          reject(
+            new Error(
+              `tshark not found. Install Wireshark or set TSHARK_PATH. Tried: ${TSHARK_CANDIDATES.join(", ")}`
+            )
+          );
+        } else {
+          reject(new Error(`tshark error: ${msg}`));
+        }
+        return;
+      }
+      resolve(stdout);
+    });
+  });
+}
+function validateCapFile(filePath) {
+  if (!existsSync(filePath)) {
+    throw new Error(`Capture file not found: ${filePath}`);
+  }
+  const stat = statSync(filePath);
+  if (stat.size === 0) {
+    throw new Error(`Capture file is empty: ${filePath}`);
+  }
+}
+const SKINNY_MESSAGE_NAMES = {
+  0: "KeepAliveMessage",
+  1: "RegisterMessage",
+  2: "IpPortMessage",
+  3: "KeypadButtonMessage",
+  4: "EnblocCallMessage",
+  5: "StimulusMessage",
+  6: "OffHookMessage",
+  7: "OnHookMessage",
+  8: "HookFlashMessage",
+  9: "ForwardStatReqMessage",
+  10: "SpeedDialStatReqMessage",
+  11: "LineStatReqMessage",
+  12: "ConfigStatReqMessage",
+  13: "TimeDateReqMessage",
+  14: "ButtonTemplateReqMessage",
+  15: "VersionReqMessage",
+  16: "CapabilitiesResMessage",
+  32: "AlarmMessage",
+  34: "MulticastMediaReceptionAck",
+  35: "OpenReceiveChannelAck",
+  36: "ConnectionStatisticsRes",
+  37: "OffHookWithCgpnMessage",
+  38: "SoftKeySetReqMessage",
+  39: "SoftKeyEventMessage",
+  41: "UnregisterMessage",
+  42: "SoftKeyTemplateReqMessage",
+  43: "RegisterTokenReq",
+  44: "MediaTransmissionFailure",
+  45: "HeadsetStatusMessage",
+  46: "MediaResourceNotification",
+  47: "RegisterAvailableLinesMessage",
+  48: "DeviceToUserDataMessage",
+  49: "DeviceToUserDataResponseMessage",
+  50: "UpdateCapabilitiesMessage",
+  52: "ServiceURLStatReqMessage",
+  53: "FeatureStatReqMessage",
+  72: "DeviceToUserDataVersion1Message",
+  73: "DeviceToUserDataResponseVersion1Message",
+  // Station → CallManager
+  129: "RegisterAckMessage",
+  130: "StartToneMessage",
+  131: "StopToneMessage",
+  133: "SetRingerMessage",
+  134: "SetLampMessage",
+  135: "SetHkFDetectMessage",
+  136: "SetSpeakerModeMessage",
+  137: "SetMicroModeMessage",
+  138: "StartMediaTransmission",
+  139: "StopMediaTransmission",
+  143: "CallInfoMessage",
+  144: "ForwardStatMessage",
+  145: "SpeedDialStatMessage",
+  146: "LineStatMessage",
+  147: "ConfigStatMessage",
+  148: "DefineTimeDate",
+  149: "StartSessionTransmission",
+  150: "StopSessionTransmission",
+  151: "ButtonTemplateMessage",
+  152: "VersionMessage",
+  153: "DisplayTextMessage",
+  154: "ClearDisplay",
+  155: "CapabilitiesReqMessage",
+  157: "RegisterRejectMessage",
+  158: "ServerResMessage",
+  159: "Reset",
+  256: "KeepAliveAckMessage",
+  257: "StartMulticastMediaReception",
+  258: "StartMulticastMediaTransmission",
+  259: "StopMulticastMediaReception",
+  260: "StopMulticastMediaTransmission",
+  261: "OpenReceiveChannel",
+  262: "CloseReceiveChannel",
+  263: "ConnectionStatisticsReq",
+  264: "SoftKeyTemplateResMessage",
+  265: "SoftKeySetResMessage",
+  272: "SelectSoftKeysMessage",
+  273: "CallStateMessage",
+  274: "DisplayPromptStatusMessage",
+  275: "ClearPromptStatusMessage",
+  276: "DisplayNotifyMessage",
+  277: "ClearNotifyMessage",
+  278: "ActivateCallPlaneMessage",
+  279: "DeactivateCallPlaneMessage",
+  280: "UnregisterAckMessage",
+  281: "BackSpaceReqMessage",
+  282: "RegisterTokenAck",
+  283: "RegisterTokenReject",
+  284: "StartMediaFailureDetection",
+  285: "DialedNumberMessage",
+  286: "UserToDeviceDataMessage",
+  287: "FeatureStatMessage",
+  288: "DisplayPriNotifyMessage",
+  289: "ClearPriNotifyMessage",
+  290: "StartAnnouncementMessage",
+  291: "StopAnnouncementMessage",
+  292: "AnnouncementFinishMessage",
+  295: "NotifyDtmfToneMessage",
+  296: "SendDtmfToneMessage",
+  298: "SubscribeDtmfPayloadReqMessage",
+  299: "SubscribeDtmfPayloadResMessage",
+  300: "SubscribeDtmfPayloadErrMessage",
+  301: "UnSubscribeDtmfPayloadReqMessage",
+  302: "UnSubscribeDtmfPayloadResMessage",
+  303: "UnSubscribeDtmfPayloadErrMessage",
+  304: "ServiceURLStatMessage",
+  314: "UserToDeviceDataVersion1Message",
+  319: "DialedPhoneBookMessage",
+  321: "XMLAlarmMessage",
+  323: "SpeedDialStatDynamicMessage",
+  338: "CallInfoMessage2"
+};
+function skinnyMessageName(id) {
+  return SKINNY_MESSAGE_NAMES[id] ?? `Unknown(0x${id.toString(16).padStart(4, "0")})`;
+}
+const RTP_PAYLOAD_TYPES = {
+  0: "PCMU (G.711 u-law)",
+  3: "GSM",
+  4: "G.723",
+  8: "PCMA (G.711 A-law)",
+  9: "G.722",
+  10: "L16 stereo",
+  11: "L16 mono",
+  13: "CN (comfort noise)",
+  18: "G.729",
+  31: "H.261",
+  32: "MPV (MPEG video)",
+  33: "MP2T (MPEG transport)",
+  34: "H.263",
+  96: "dynamic (96)",
+  97: "dynamic (97)",
+  98: "dynamic (98)",
+  99: "dynamic (99)",
+  100: "dynamic (100)",
+  101: "telephone-event (DTMF)",
+  110: "dynamic (110)",
+  111: "dynamic (111)",
+  112: "dynamic (112)",
+  114: "iLBC",
+  116: "dynamic (116)",
+  118: "dynamic (118)",
+  119: "dynamic (119)",
+  120: "dynamic (120)",
+  121: "dynamic (121)",
+  122: "dynamic (122)",
+  123: "dynamic (123)",
+  124: "dynamic (124)",
+  125: "dynamic (125)",
+  126: "dynamic (126)",
+  127: "dynamic (127)"
+};
+function rtpCodecName(pt) {
+  return RTP_PAYLOAD_TYPES[pt] ?? `PT ${pt}`;
+}
+async function pcapCallSummary(filePath) {
+  validateCapFile(filePath);
+  const stat = statSync(filePath);
+  const phsRaw = await runTshark(["-r", filePath, "-q", "-z", "io,phs"]);
+  const protocols = {};
+  for (const line of phsRaw.split("\n")) {
+    const match = line.match(/^\s*([\w:]+)\s+frames:(\d+)\s+bytes:(\d+)/);
+    if (match) {
+      const proto = match[1].split(":").pop().toLowerCase();
+      if (["sip", "skinny", "rtp", "rtcp", "sdp", "stun", "tcp", "udp", "ip", "eth"].includes(proto)) {
+        protocols[proto] = { frames: parseInt(match[2]), bytes: parseInt(match[3]) };
+      }
+    }
+  }
+  let sipCallIds = [];
+  try {
+    const sipRaw = await runTshark([
+      "-r",
+      filePath,
+      "-Y",
+      "sip",
+      "-T",
+      "fields",
+      "-e",
+      "sip.Call-ID",
+      "-E",
+      "header=n"
+    ]);
+    sipCallIds = [...new Set(sipRaw.split("\n").map((l) => l.trim()).filter(Boolean))];
+  } catch {
+  }
+  let rtpStreamCount = 0;
+  try {
+    const rtpRaw = await runTshark(["-r", filePath, "-q", "-z", "rtp,streams"]);
+    const rtpLines = rtpRaw.split("\n").filter((l) => /^\s*\d+\.\d+/.test(l));
+    rtpStreamCount = rtpLines.length;
+  } catch {
+  }
+  let endpoints = [];
+  try {
+    const convRaw = await runTshark(["-r", filePath, "-q", "-z", "conv,ip"]);
+    const ips = /* @__PURE__ */ new Set();
+    for (const line of convRaw.split("\n")) {
+      const m = line.match(/(\d+\.\d+\.\d+\.\d+)\s+<->\s+(\d+\.\d+\.\d+\.\d+)/);
+      if (m) {
+        ips.add(m[1]);
+        ips.add(m[2]);
+      }
+    }
+    endpoints = [...ips].sort();
+  } catch {
+  }
+  let durationSec = 0;
+  try {
+    const capRaw = await runTshark([
+      "-r",
+      filePath,
+      "-T",
+      "fields",
+      "-e",
+      "frame.time_relative",
+      "-E",
+      "header=n",
+      "-c",
+      "1",
+      "-Y",
+      "frame.number == 0"
+    ]);
+    const durRaw = await runTshark([
+      "-r",
+      filePath,
+      "-q",
+      "-z",
+      "io,stat,0"
+    ]);
+    const durMatch = durRaw.match(/Duration:\s+([\d.]+)/);
+    if (durMatch) durationSec = parseFloat(durMatch[1]);
+  } catch {
+  }
+  let totalPackets = 0;
+  for (const p of Object.values(protocols)) {
+    if (p.frames > totalPackets) totalPackets = p.frames;
+  }
+  totalPackets = protocols["ip"]?.frames ?? protocols["eth"]?.frames ?? totalPackets;
+  return {
+    file: filePath,
+    bytes: stat.size,
+    packets: totalPackets,
+    duration: `${durationSec.toFixed(1)}s`,
+    protocols: {
+      sip: protocols["sip"]?.frames ?? 0,
+      skinny: protocols["skinny"]?.frames ?? 0,
+      rtp: protocols["rtp"]?.frames ?? 0,
+      rtcp: protocols["rtcp"]?.frames ?? 0,
+      sdp: protocols["sdp"]?.frames ?? 0
+    },
+    endpoints,
+    sipCalls: sipCallIds.length,
+    sipCallIds: sipCallIds.length <= 20 ? sipCallIds : sipCallIds.slice(0, 20),
+    rtpStreams: rtpStreamCount
+  };
+}
+async function pcapSipCalls(filePath, callId) {
+  validateCapFile(filePath);
+  const filter = callId ? `sip and sip.Call-ID == "${callId}"` : "sip";
+  const raw = await runTshark([
+    "-r",
+    filePath,
+    "-Y",
+    filter,
+    "-T",
+    "fields",
+    "-e",
+    "frame.time_relative",
+    "-e",
+    "ip.src",
+    "-e",
+    "ip.dst",
+    "-e",
+    "sip.Method",
+    "-e",
+    "sip.Status-Code",
+    "-e",
+    "sip.Status-Line",
+    "-e",
+    "sip.Call-ID",
+    "-e",
+    "sip.from.addr",
+    "-e",
+    "sip.to.addr",
+    "-e",
+    "sip.CSeq",
+    "-e",
+    "sip.r-uri",
+    "-e",
+    "sdp.media",
+    "-e",
+    "sdp.connection_info",
+    "-E",
+    "header=n",
+    "-E",
+    "separator=	",
+    "-E",
+    "occurrence=f"
+  ]);
+  const callMap = /* @__PURE__ */ new Map();
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    const fields = line.split("	");
+    const [time, src, dst, method, statusCodeStr, statusLine, cid, from, to, cseq, ruri, sdpMedia, sdpConn] = fields;
+    if (!cid) continue;
+    const msg = {
+      time: time || "0",
+      src: src || "",
+      dst: dst || "",
+      callId: cid,
+      from: from || "",
+      to: to || "",
+      cseq: cseq || ""
+    };
+    if (method) msg.method = method;
+    if (statusCodeStr) msg.statusCode = parseInt(statusCodeStr);
+    if (statusLine) msg.statusLine = statusLine;
+    if (ruri) msg.requestUri = ruri;
+    if (sdpMedia) msg.sdpMedia = sdpMedia;
+    if (sdpConn) msg.sdpConnectionInfo = sdpConn;
+    if (!callMap.has(cid)) callMap.set(cid, []);
+    callMap.get(cid).push(msg);
+  }
+  const flows = [];
+  for (const [cid, messages] of callMap) {
+    const firstMsg = messages[0];
+    const lastMsg = messages[messages.length - 1];
+    const answered = messages.some((m) => m.statusCode === 200 && m.cseq?.includes("INVITE"));
+    let setupTimeMs;
+    const invite = messages.find((m) => m.method === "INVITE");
+    const ok200 = messages.find((m) => m.statusCode === 200 && m.cseq?.includes("INVITE"));
+    if (invite && ok200) {
+      setupTimeMs = Math.round((parseFloat(ok200.time) - parseFloat(invite.time)) * 1e3);
+    }
+    flows.push({
+      callId: cid,
+      from: firstMsg.from,
+      to: firstMsg.to,
+      messages,
+      metrics: {
+        firstSeen: firstMsg.time,
+        lastSeen: lastMsg.time,
+        messageCount: messages.length,
+        answered,
+        setupTimeMs
+      }
+    });
+  }
+  return flows;
+}
+async function pcapScppMessages(filePath, deviceFilter) {
+  validateCapFile(filePath);
+  const filter = deviceFilter ? `skinny and ip.addr == ${deviceFilter}` : "skinny";
+  const raw = await runTshark([
+    "-r",
+    filePath,
+    "-Y",
+    filter,
+    "-T",
+    "fields",
+    "-e",
+    "frame.time_relative",
+    "-e",
+    "ip.src",
+    "-e",
+    "ip.dst",
+    "-e",
+    "skinny.messageId",
+    "-e",
+    "skinny.CallingPartyName",
+    "-e",
+    "skinny.CallingPartyNumber",
+    "-e",
+    "skinny.calledPartyName",
+    "-e",
+    "skinny.calledPartyNumber",
+    "-e",
+    "skinny.callIdentifier",
+    "-e",
+    "skinny.lineInstance",
+    "-e",
+    "skinny.callState",
+    "-E",
+    "header=n",
+    "-E",
+    "separator=	",
+    "-E",
+    "occurrence=f"
+  ]);
+  const messages = [];
+  const devices = /* @__PURE__ */ new Set();
+  const typeCounts = {};
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    const fields = line.split("	");
+    const [time, src, dst, msgIdStr, callingName, callingNum, calledName, calledNum, callIdStr, lineInst, callSt] = fields;
+    const messageId = parseInt(msgIdStr || "0");
+    const messageName = skinnyMessageName(messageId);
+    devices.add(src || "");
+    devices.add(dst || "");
+    typeCounts[messageName] = (typeCounts[messageName] || 0) + 1;
+    const msg = {
+      time: time || "0",
+      src: src || "",
+      dst: dst || "",
+      messageId,
+      messageName
+    };
+    if (callingName) msg.callingPartyName = callingName;
+    if (callingNum) msg.callingPartyNumber = callingNum;
+    if (calledName) msg.calledPartyName = calledName;
+    if (calledNum) msg.calledPartyNumber = calledNum;
+    if (callIdStr) msg.callId = callIdStr;
+    if (lineInst) msg.lineInstance = lineInst;
+    if (callSt) msg.callState = callSt;
+    messages.push(msg);
+  }
+  devices.delete("");
+  return {
+    messages,
+    devices: [...devices].sort(),
+    messageTypes: typeCounts,
+    totalMessages: messages.length
+  };
+}
+async function pcapRtpStreams(filePath, ssrcFilter) {
+  validateCapFile(filePath);
+  const raw = await runTshark(["-r", filePath, "-q", "-z", "rtp,streams"]);
+  const streams = [];
+  const lines = raw.split("\n");
+  let inTable = false;
+  for (const line of lines) {
+    if (line.includes("========================")) {
+      inTable = !inTable;
+      continue;
+    }
+    if (!inTable) continue;
+    if (!line.trim() || line.startsWith("  Src")) continue;
+    const parts = line.trim().split(/\s+/);
+    if (parts.length < 10) continue;
+    const srcAddr = parts[0];
+    const srcPort = parts[1];
+    const dstAddr = parts[2];
+    const dstPort = parts[3];
+    const ssrc = parts[4];
+    const ptStr = parts[5];
+    const packets = parseInt(parts[6]) || 0;
+    const lost = parseInt(parts[7]) || 0;
+    const maxDelta = parseFloat(parts[8]) || 0;
+    const maxJitter = parseFloat(parts[9]) || 0;
+    const meanJitter = parseFloat(parts[10]) || 0;
+    const pt = parseInt(ptStr) || 0;
+    if (ssrcFilter && ssrc !== ssrcFilter) continue;
+    streams.push({
+      src: `${srcAddr}:${srcPort}`,
+      dst: `${dstAddr}:${dstPort}`,
+      ssrc,
+      payloadType: pt,
+      codec: rtpCodecName(pt),
+      packets,
+      lost,
+      lossPercent: packets > 0 ? Math.round(lost / packets * 1e4) / 100 : 0,
+      maxDelta,
+      maxJitter,
+      meanJitter
+    });
+  }
+  const worstLoss = streams.length ? Math.max(...streams.map((s) => s.lossPercent)) : 0;
+  const worstJitter = streams.length ? Math.max(...streams.map((s) => s.maxJitter)) : 0;
+  return {
+    streams,
+    summary: {
+      totalStreams: streams.length,
+      worstLoss: `${worstLoss}%`,
+      worstJitter: `${worstJitter}ms`
+    }
+  };
+}
+async function pcapProtocolFilter(filePath, displayFilter, fields, maxPackets) {
+  validateCapFile(filePath);
+  const max = Math.min(maxPackets ?? 100, 1e3);
+  const args = ["-r", filePath, "-Y", displayFilter, "-c", String(max)];
+  if (fields && fields.length > 0) {
+    args.push("-T", "fields", "-E", "header=n", "-E", "separator=	");
+    for (const f of fields) {
+      args.push("-e", f);
+    }
+    const raw2 = await runTshark(args);
+    const results2 = [];
+    for (const line of raw2.split("\n")) {
+      if (!line.trim()) continue;
+      const values = line.split("	");
+      const obj = {};
+      fields.forEach((f, i) => {
+        obj[f] = values[i] || "";
+      });
+      results2.push(obj);
+    }
+    return results2;
+  }
+  args.push(
+    "-T",
+    "fields",
+    "-E",
+    "header=n",
+    "-E",
+    "separator=	",
+    "-e",
+    "frame.number",
+    "-e",
+    "frame.time_relative",
+    "-e",
+    "ip.src",
+    "-e",
+    "ip.dst",
+    "-e",
+    "frame.protocols",
+    "-e",
+    "frame.len"
+  );
+  const raw = await runTshark(args);
+  const defaultFields = ["frame.number", "frame.time_relative", "ip.src", "ip.dst", "frame.protocols", "frame.len"];
+  const results = [];
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    const values = line.split("	");
+    const obj = {};
+    defaultFields.forEach((f, i) => {
+      obj[f] = values[i] || "";
+    });
+    results.push(obj);
+  }
+  return results;
+}
+export {
+  pcapCallSummary,
+  pcapProtocolFilter,
+  pcapRtpStreams,
+  pcapScppMessages,
+  pcapSipCalls,
+  runTshark
+};
+//# sourceMappingURL=pcap-analyze.js.map