@netkitty/codec 1.0.0

package/dist/headers/Babel.js

@@ -0,0 +1,224 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Babel = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * Babel routing protocol (RFC 8966), carried in UDP over port 6696 (to the well-known multicast group
+ * or unicast). A Babel packet starts with a fixed 4-byte header — Magic (== 42), Version (== 2) and a
+ * 2-byte Body Length (the octet count of the packet body that follows the header, not counting the
+ * optional packet trailer) — followed by the packet body: a flat sequence of TLVs, then an optional
+ * trailer (which may only carry Pad1/PadN sub-TLVs).
+ *
+ * Each TLV is Type (1 byte) + Length (1 byte, the value byte count, NOT counting the Type/Length pair)
+ * + Value, except Pad1 (Type 0) which is a single byte with no Length/Value. Common types: 0 Pad1,
+ * 1 PadN, 2 Acknowledgment Request, 4 Hello, 5 IHU, 8 Update.
+ *
+ * Byte-perfect strategy (minimal slice): structure Magic / Version / Body Length, then carry the TLVs
+ * generically (Type + verbatim hex Value, Pad1 special-cased as a bare byte) so every TLV — including
+ * types this codec does not sub-decode — round-trips byte-for-byte. The TLV walk is bounded by Body
+ * Length AND the UDP payload (udp.length − 8), so a lying Body Length cannot read past the datagram.
+ * Body Length is honored when supplied (a crafted packet may lie) else derived from the TLVs; any bytes
+ * after the body (the packet trailer, or leftover bytes from a truncated TLV) are kept verbatim in
+ * `trailer` so the datagram is reproduced exactly. A well-formed packet round-trips byte-for-byte.
+ */
+class Babel extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'babel';
+        this.name = 'Babel Routing Protocol';
+        this.nickname = 'Babel';
+        this.matchKeys = ['udpport:6696'];
+        //A leaf header — the per-type TLV bodies are kept verbatim for now.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (Babel.#schemaCache ??= Babel.#buildSchema());
+    }
+    /**
+     * Header-relative end offset of the bytes this Babel layer may consume, so a lying Body Length never
+     * reads past the real UDP payload. Over UDP the bound is (udp.length − 8); clamped to the captured
+     * bytes. Anything beyond is another datagram / Ethernet padding and is left alone.
+     */
+    #payloadEnd() {
+        let end = this.packet.length - this.startPos;
+        const prev = this.prevCodecModule;
+        if (prev && prev.id === 'udp') {
+            const udpLength = prev.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < end)
+                end = udpLength - 8;
+        }
+        return end < 0 ? 0 : end;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'Babel v${version} ${tlvs.length} TLVs',
+            properties: {
+                //The Magic byte, always 42 (0x2a) for Babel — also the match signature on UDP 6696.
+                magic: this.fieldUInt('magic', 0, 1, 'Magic'),
+                //The protocol version, always 2 (RFC 8966).
+                version: this.fieldUInt('version', 1, 1, 'Version'),
+                //The octet count of the packet body (the TLV sequence) following this 4-byte header, NOT
+                //counting the optional packet trailer. Honored when supplied (a crafted packet may lie)
+                //else derived from the TLVs. Derived from the TLV VALUES (not written bytes), so it is
+                //correct even though it encodes before the `tlvs` field writes them.
+                bodyLength: {
+                    type: 'integer',
+                    label: 'Body Length',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        this.instance.bodyLength.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(2, 2)));
+                    },
+                    encode: function () {
+                        const provided = this.instance.bodyLength.getValue();
+                        let value;
+                        if (provided !== undefined && provided !== null) {
+                            value = provided;
+                        }
+                        else {
+                            const tlvs = this.instance.tlvs.getValue([]);
+                            let total = 0;
+                            if (tlvs) {
+                                for (const tlv of tlvs) {
+                                    //Pad1 (Type 0) is a single byte; every other TLV is Type + Length + Value.
+                                    if (tlv && tlv.type === 0)
+                                        total += 1;
+                                    else
+                                        total += 2 + (0, HexToBuffer_1.HexToBuffer)(tlv && tlv.value ? tlv.value : '').length;
+                                }
+                            }
+                            value = total;
+                        }
+                        if (value > 65535) {
+                            this.recordError(this.instance.bodyLength.getPath(), 'Maximum value is 65535');
+                            value = 65535;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.bodyLength.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.bodyLength.setValue(value);
+                        this.writeBytes(2, (0, NumberToBuffer_1.UInt16ToBuffer)(value));
+                    }
+                },
+                //The packet body: a flat sequence of TLVs. This single field owns the whole body walk
+                //(it also sets/writes `trailer`, which is metadata-only). Bounded by Body Length AND the
+                //UDP payload so a truncated / lying packet is contained.
+                tlvs: {
+                    type: 'array',
+                    label: 'TLVs',
+                    items: {
+                        type: 'object',
+                        label: 'TLV',
+                        properties: {
+                            type: { type: 'integer', label: 'Type', minimum: 0, maximum: 255 },
+                            length: { type: 'integer', label: 'Length', minimum: 0, maximum: 255 },
+                            value: { type: 'string', label: 'Value', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX }
+                        }
+                    },
+                    decode: function () {
+                        const payloadEnd = this.#payloadEnd();
+                        let bodyEnd = 4 + this.instance.bodyLength.getValue(0);
+                        if (bodyEnd > payloadEnd)
+                            bodyEnd = payloadEnd;
+                        const tlvs = [];
+                        let offset = 4;
+                        while (offset < bodyEnd) {
+                            const type = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(offset, 1));
+                            //Pad1 (Type 0): a single byte, no Length / Value.
+                            if (type === 0) {
+                                tlvs.push({ type: 0 });
+                                offset += 1;
+                                continue;
+                            }
+                            //Need the Type + Length pair; a truncated header stops the walk.
+                            if (offset + 2 > bodyEnd)
+                                break;
+                            const length = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(offset + 1, 1));
+                            //A Value that overruns the body (truncation) is not consumed — stop and leave
+                            //the remaining bytes to `trailer`, keeping the round-trip exact.
+                            if (offset + 2 + length > bodyEnd)
+                                break;
+                            const value = length > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset + 2, length)) : '';
+                            tlvs.push({ type: type, length: length, value: value });
+                            offset += 2 + length;
+                        }
+                        this.instance.tlvs.setValue(tlvs);
+                        //Everything after the consumed body up to the UDP payload end is the packet trailer
+                        //(Pad1/PadN sub-TLVs) or leftover bytes from a truncated TLV — kept verbatim.
+                        this.instance.trailer.setValue(offset < payloadEnd ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset, payloadEnd - offset)) : '');
+                    },
+                    encode: function () {
+                        const tlvs = this.instance.tlvs.getValue([]);
+                        let offset = 4;
+                        if (tlvs) {
+                            for (let i = 0; i < tlvs.length; i++) {
+                                const tlv = tlvs[i];
+                                const type = tlv && tlv.type ? tlv.type : 0;
+                                //Pad1 (Type 0): emit the bare Type byte, no Length / Value.
+                                if (type === 0) {
+                                    this.writeBytes(offset, (0, NumberToBuffer_1.UInt8ToBuffer)(0));
+                                    offset += 1;
+                                    continue;
+                                }
+                                let value = (0, HexToBuffer_1.HexToBuffer)(tlv && tlv.value ? tlv.value : '');
+                                //The Length is a single byte (max 255). A longer value cannot be represented,
+                                //so clamp it and record the error rather than silently wrapping modulo 256
+                                //(which would corrupt the following TLVs).
+                                if (value.length > 255) {
+                                    this.recordError(`tlvs[${i}].value`, 'Maximum TLV value length is 255 bytes');
+                                    value = value.subarray(0, 255);
+                                }
+                                //Length honored when supplied (a crafted TLV may lie) else derived from the
+                                //value byte count.
+                                const providedLength = tlv ? tlv.length : undefined;
+                                let length = (providedLength !== undefined && providedLength !== null) ? providedLength : value.length;
+                                if (length > 255)
+                                    length = 255;
+                                if (length < 0)
+                                    length = 0;
+                                this.writeBytes(offset, (0, NumberToBuffer_1.UInt8ToBuffer)(type));
+                                this.writeBytes(offset + 1, (0, NumberToBuffer_1.UInt8ToBuffer)(length));
+                                offset += 2;
+                                if (value.length) {
+                                    this.writeBytes(offset, value);
+                                    offset += value.length;
+                                }
+                            }
+                        }
+                        const trailer = this.instance.trailer.getValue('');
+                        if (trailer)
+                            this.writeBytes(offset, (0, HexToBuffer_1.HexToBuffer)(trailer));
+                    }
+                },
+                //The optional packet trailer after the body (Pad1/PadN sub-TLVs), or leftover bytes from a
+                //truncated TLV, kept verbatim. No codec of its own — it is set/written by the `tlvs` field
+                //(which owns the single offset walk); this entry is metadata so the editor sees the bytes.
+                trailer: {
+                    type: 'string',
+                    label: 'Trailer',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX
+                }
+            }
+        };
+    }
+    match() {
+        //Babel rides on UDP port 6696 (selected via the udpport:6696 bucket). Require the 4-byte header
+        //within the UDP payload and the Magic signature (== 42), so non-Babel traffic on 6696 falls
+        //through to raw. Stays a port-bucket protocol: matchKeys only, NO heuristicFallback — a lone
+        //0x2a byte is too weak a signature to claim Babel off its well-known port.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        if (this.#payloadEnd() < 4)
+            return false;
+        return (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(0, 1, true)) === 42;
+    }
+}
+exports.Babel = Babel;

package/dist/headers/BitTorrent.d.ts

@@ -0,0 +1,28 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * BitTorrent — peer wire protocol (BEP 3) handshake, carried over TCP on dynamic/ephemeral ports.
+ * A peer connection opens with a fixed 68-byte handshake: a 1-byte pstrlen (0x13 = 19), the 19-byte
+ * protocol string "BitTorrent protocol" (pstr), 8 reserved bytes (extension bit-flags — DHT, Fast,
+ * Extension Protocol, etc.), the 20-byte SHA-1 info_hash of the torrent, and the 20-byte peer_id.
+ *
+ * This codec handles ONLY the handshake — its 0x13 + "BitTorrent protocol" prefix is an extremely
+ * distinctive 20-byte content signature, so the header is selected by heuristicFallback (no fixed
+ * port). The subsequent length-prefixed peer messages (<length(4)><type(1)><payload>) carry no such
+ * signature and are intentionally NOT claimed here: after the 68-byte handshake is consumed, any
+ * trailing bytes (a pipelined first peer message, etc.) are left to the codec's recursion / RawData.
+ * Every field is kept verbatim (reserved / info_hash / peer_id are opaque hex), nothing is recomputed
+ * on encode, so a well-formed handshake round-trips byte-for-byte.
+ */
+export declare class BitTorrent extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    readonly heuristicFallback: boolean;
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/BitTorrent.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BitTorrent = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+/**
+ * BitTorrent — peer wire protocol (BEP 3) handshake, carried over TCP on dynamic/ephemeral ports.
+ * A peer connection opens with a fixed 68-byte handshake: a 1-byte pstrlen (0x13 = 19), the 19-byte
+ * protocol string "BitTorrent protocol" (pstr), 8 reserved bytes (extension bit-flags — DHT, Fast,
+ * Extension Protocol, etc.), the 20-byte SHA-1 info_hash of the torrent, and the 20-byte peer_id.
+ *
+ * This codec handles ONLY the handshake — its 0x13 + "BitTorrent protocol" prefix is an extremely
+ * distinctive 20-byte content signature, so the header is selected by heuristicFallback (no fixed
+ * port). The subsequent length-prefixed peer messages (<length(4)><type(1)><payload>) carry no such
+ * signature and are intentionally NOT claimed here: after the 68-byte handshake is consumed, any
+ * trailing bytes (a pipelined first peer message, etc.) are left to the codec's recursion / RawData.
+ * Every field is kept verbatim (reserved / info_hash / peer_id are opaque hex), nothing is recomputed
+ * on encode, so a well-formed handshake round-trips byte-for-byte.
+ */
+class BitTorrent extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'bittorrent';
+        this.name = 'BitTorrent Peer Wire Protocol';
+        this.nickname = 'BitTorrent';
+        //No fixed port — BitTorrent peers connect on dynamic/ephemeral ports. Selection is by the
+        //content signature (0x13 + "BitTorrent protocol") via heuristicFallback + match().
+        this.matchKeys = [];
+        this.heuristicFallback = true;
+        //A leaf header — only the handshake is decoded; subsequent peer messages are left to raw.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (BitTorrent.#schemaCache ??= BitTorrent.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'BitTorrent handshake infoHash=${infoHash}',
+            properties: {
+                //Protocol string length — always 0x13 (19) for the BEP 3 handshake. Kept as a plain uint8
+                //(a crafted handshake may lie); the signature match already guards real traffic.
+                pstrlen: this.fieldUInt('pstrlen', 0, 1, 'Protocol String Length'),
+                //The 19-byte protocol identifier "BitTorrent protocol". Kept verbatim as hex so any
+                //byte edit round-trips; the human-readable form is UI enrichment for later.
+                pstr: this.fieldHex('pstr', 1, 19, 'Protocol String'),
+                //8 reserved bytes carrying extension bit-flags (BEP 4/5/6/10: DHT, Fast, Extension
+                //Protocol). Opaque here and re-emitted verbatim.
+                reserved: this.fieldHex('reserved', 20, 8, 'Reserved'),
+                //20-byte SHA-1 hash of the torrent's info dictionary — identifies the swarm. Verbatim hex.
+                infoHash: this.fieldHex('infoHash', 28, 20, 'Info Hash'),
+                //20-byte peer identifier chosen by the connecting client (often an ASCII client tag +
+                //random suffix). Verbatim hex.
+                peerId: this.fieldHex('peerId', 48, 20, 'Peer ID')
+            }
+        };
+    }
+    match() {
+        //Rides on TCP. Require the full 68-byte handshake present so a truncated prefix is not claimed
+        //(it falls through to raw and merely survives). The 0x13 pstrlen + the exact 19-byte
+        //"BitTorrent protocol" string is a distinctive content signature safe to match on any port.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.packet.length - this.startPos < 68)
+            return false;
+        if (this.readBytes(0, 1, true)[0] !== 0x13)
+            return false;
+        return (0, BufferToHex_1.BufferToHex)(this.readBytes(1, 19, true)) === '426974546f7272656e742070726f746f636f6c';
+    }
+}
+exports.BitTorrent = BitTorrent;

package/dist/headers/C37118.d.ts

@@ -0,0 +1,26 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * C37.118 — IEEE Std C37.118.2 synchrophasor data transfer (PMU/PDC), typically TCP port 4712 and UDP
+ * port 4713. Every frame shares a 14-byte common header: SYNC (a 0xAA lead-in byte, then a byte holding
+ * a reserved bit, a 3-bit Frame Type — data / header / config-1 / config-2 / command / config-3 — and a
+ * 4-bit Version), a FRAMESIZE (total frame length including the check word), an IDCODE (data stream id),
+ * a SOC (second-of-century UNIX time), and a FRACSEC (an 8-bit time-quality byte plus a 24-bit fraction
+ * of second). It ends with a 2-byte CHK (CRC-CCITT over the whole frame). Everything is big-endian.
+ *
+ * The frame body between the header and the CHK is frame-type-specific (a configuration frame defines
+ * the data layout for the data frames that follow — cross-frame state, not a single-packet concern), so
+ * this codec keeps the body verbatim as `body` hex, bounded by FRAMESIZE, and keeps the CHK verbatim
+ * (never recomputed). A well-formed frame round-trips byte-for-byte.
+ */
+export declare class C37118 extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/C37118.js

@@ -0,0 +1,147 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.C37118 = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * C37.118 — IEEE Std C37.118.2 synchrophasor data transfer (PMU/PDC), typically TCP port 4712 and UDP
+ * port 4713. Every frame shares a 14-byte common header: SYNC (a 0xAA lead-in byte, then a byte holding
+ * a reserved bit, a 3-bit Frame Type — data / header / config-1 / config-2 / command / config-3 — and a
+ * 4-bit Version), a FRAMESIZE (total frame length including the check word), an IDCODE (data stream id),
+ * a SOC (second-of-century UNIX time), and a FRACSEC (an 8-bit time-quality byte plus a 24-bit fraction
+ * of second). It ends with a 2-byte CHK (CRC-CCITT over the whole frame). Everything is big-endian.
+ *
+ * The frame body between the header and the CHK is frame-type-specific (a configuration frame defines
+ * the data layout for the data frames that follow — cross-frame state, not a single-packet concern), so
+ * this codec keeps the body verbatim as `body` hex, bounded by FRAMESIZE, and keeps the CHK verbatim
+ * (never recomputed). A well-formed frame round-trips byte-for-byte.
+ */
+class C37118 extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'c37118';
+        this.name = 'IEEE C37.118 Synchrophasor';
+        this.nickname = 'C37.118';
+        this.matchKeys = ['tcpport:4712', 'udpport:4713'];
+        //A leaf header — configuration/data frame bodies are stateful (a config frame defines later data
+        //frames), which belongs to a higher layer.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (C37118.#schemaCache ??= C37118.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'C37.118 type=${sync.frameType} id=${idcode}',
+            properties: {
+                leadIn: this.fieldHex('leadIn', 0, 1, 'Lead-in (0xAA)'),
+                //SYNC byte 1 (MSB first): reserved bit, 3-bit Frame Type, 4-bit Version.
+                sync: {
+                    type: 'object',
+                    label: 'SYNC',
+                    properties: {
+                        reserved: {
+                            type: 'integer', label: 'Reserved', minimum: 0, maximum: 1, hidden: true,
+                            decode: function () { this.instance.sync.reserved.setValue(this.readBits(1, 1, 0, 1)); },
+                            encode: function () { this.writeBits(1, 1, 0, 1, this.instance.sync.reserved.getValue(0)); }
+                        },
+                        frameType: {
+                            type: 'integer', label: 'Frame Type', minimum: 0, maximum: 7,
+                            decode: function () { this.instance.sync.frameType.setValue(this.readBits(1, 1, 1, 3)); },
+                            encode: function () { this.writeBits(1, 1, 1, 3, this.instance.sync.frameType.getValue(0)); }
+                        },
+                        version: {
+                            type: 'integer', label: 'Version', minimum: 0, maximum: 15,
+                            decode: function () { this.instance.sync.version.setValue(this.readBits(1, 1, 4, 4)); },
+                            encode: function () { this.writeBits(1, 1, 4, 4, this.instance.sync.version.getValue(1)); }
+                        }
+                    }
+                },
+                framesize: {
+                    type: 'integer',
+                    label: 'Frame Size',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        this.instance.framesize.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(2, 2)));
+                    },
+                    encode: function () {
+                        //Honored when supplied (a crafted frame may lie); else derived from the actual
+                        //body + CHK (FRAMESIZE is the total frame length: 14-byte header + body + CHK).
+                        const provided = this.instance.framesize.getValue();
+                        const value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : 14 + (0, HexToBuffer_1.HexToBuffer)(this.instance.body.getValue('')).length + (0, HexToBuffer_1.HexToBuffer)(this.instance.chk.getValue('')).length;
+                        this.instance.framesize.setValue(value);
+                        this.writeBytes(2, (0, NumberToBuffer_1.UInt16ToBuffer)(value));
+                    }
+                },
+                idcode: this.fieldUInt('idcode', 4, 2, 'ID Code'),
+                soc: this.fieldUInt('soc', 6, 4, 'SOC (Second of Century)'),
+                timeQuality: this.fieldUInt('timeQuality', 10, 1, 'Time Quality'),
+                fractionOfSecond: {
+                    type: 'integer',
+                    label: 'Fraction of Second',
+                    minimum: 0,
+                    maximum: 16777215,
+                    decode: function () { this.instance.fractionOfSecond.setValue(this.readBits(11, 3, 0, 24)); },
+                    encode: function () { this.writeBits(11, 3, 0, 24, this.instance.fractionOfSecond.getValue(0)); }
+                },
+                //Frame-type-specific body, kept verbatim, and the trailing CHK. The body master reads
+                //FRAMESIZE (which includes the 2-byte CHK) to place the CHK at the end of the frame.
+                body: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        const framesize = this.instance.framesize.getValue(0);
+                        let frameEnd = framesize;
+                        if (frameEnd > remaining || frameEnd < 16)
+                            frameEnd = remaining;
+                        const chkStart = frameEnd - 2;
+                        if (chkStart >= 14) {
+                            this.instance.body.setValue(chkStart > 14 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(14, chkStart - 14)) : '');
+                            this.instance.chk.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(chkStart, 2)));
+                        }
+                        else {
+                            //Too short for a CHK: keep whatever remains as body, no check word.
+                            this.instance.body.setValue(remaining > 14 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(14, remaining - 14)) : '');
+                            this.instance.chk.setValue('');
+                        }
+                    },
+                    encode: function () {
+                        const body = this.instance.body.getValue('');
+                        const bodyBuffer = (0, HexToBuffer_1.HexToBuffer)(body);
+                        if (bodyBuffer.length)
+                            this.writeBytes(14, bodyBuffer);
+                        const chk = this.instance.chk.getValue('');
+                        if (chk)
+                            this.writeBytes(14 + bodyBuffer.length, (0, HexToBuffer_1.HexToBuffer)(chk));
+                    }
+                },
+                //The check word (CRC-CCITT), honored verbatim (never recomputed) — populated by the body
+                //master since its offset (FRAMESIZE - 2) is frame-length dependent.
+                chk: { type: 'string', label: 'Check', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX }
+            }
+        };
+    }
+    match() {
+        //C37.118 rides on TCP 4712 / UDP 4713. Require the common header + CHK (16 bytes) and the 0xAA
+        //SYNC lead-in signature so non-C37.118 traffic on those ports falls through to raw.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'tcp' && this.prevCodecModule.id !== 'udp')
+            return false;
+        if (this.packet.length - this.startPos < 16)
+            return false;
+        return this.readBytes(0, 1, true)[0] === 0xaa;
+    }
+}
+exports.C37118 = C37118;

package/dist/headers/CAPWAP.d.ts

@@ -0,0 +1,38 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * CAPWAP — Control And Provisioning of Wireless Access Points (RFC 5415), UDP port 5246 (control) and
+ * 5247 (data). Every CAPWAP message begins with a fixed 8-byte header whose layout is a preamble octet
+ * followed by tightly bit-packed fields:
+ *
+ *   - Preamble (octet 0): Version (high nibble) + Type (low nibble). Type 0 = a CAPWAP header follows,
+ *     Type 1 = the payload is a DTLS record (the header below is then not present).
+ *   - Octets 1-3 (24 bits): HLEN (5 bits, the whole CAPWAP header length in units of 4 octets),
+ *     RID (5 bits, Radio ID), WBID (5 bits, Wireless Binding ID), then the flag bits T, F, L, W, M, K
+ *     (1 bit each) and a 3-bit reserved Flags remainder.
+ *   - Octets 4-5: Fragment ID (16 bits).
+ *   - Octets 6-7: Fragment Offset (13 bits) + a 3-bit reserved field.
+ *
+ * When the M/W flags are set the header carries optional Radio MAC Address / Wireless Specific
+ * Information fields; HLEN delimits the whole header (HLEN × 4 octets), after which the payload begins
+ * (the control-plane Control Header + message elements, or the tunneled 802.3/802.11 data frame).
+ *
+ * This is the minimal, byte-faithful slice: the preamble and every bit-packed field are modelled so an
+ * editor can see/round-trip them, the optional per-flag header fields are kept verbatim as
+ * `headerRemainder` hex (bounded by HLEN × 4), and everything after the header is kept verbatim as
+ * `payload` hex (bounded by the UDP datagram so a retained trailer is not absorbed). Sub-decoding the
+ * Control Header / message elements or the tunneled frame is deferred, so CAPWAP is effectively a leaf.
+ * HLEN is honored verbatim when supplied (a crafted header may lie) else derived from the header bytes;
+ * a well-formed message round-trips byte-for-byte.
+ */
+export declare class CAPWAP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}