@netkitty/codec 1.0.0

package/dist/headers/EtherCAT.js

@@ -0,0 +1,150 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EtherCAT = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * EtherCAT — Ethernet for Control Automation Technology (IEC 61158 Type 12), carried directly in an
+ * Ethernet II frame with EtherType 0x88A4 (an Ethernet child — no IP/UDP). Immediately after the Ethernet
+ * header comes a 2-byte EtherCAT header, then the EtherCAT datagram chain.
+ *
+ * ⚠️ Unlike most of the codec's protocols (which are big-endian), the 2-byte EtherCAT header is a single
+ * LITTLE-ENDIAN uint16. There is no little-endian helper in this codebase, so the header word is read and
+ * written byte-by-byte in the closures (see ENIP for the precedent). Within that 16-bit LE value `h`:
+ *   - Length   = bits 0..10  (11 bits) = byte count of all datagrams that follow the 2-byte header.
+ *   - Reserved = bit 11      (1 bit)   = preserved verbatim for a byte-perfect round-trip.
+ *   - Type     = bits 12..15 (4 bits)  = 1 for EtherCAT commands (DLPDUs); other values exist.
+ * So `length = h & 0x07FF`, `reserved = (h >> 11) & 0x1`, `type = (h >> 12) & 0x0F`; and on encode
+ * `h = (length & 0x07FF) | ((reserved & 1) << 11) | ((type & 0x0F) << 12)`, written LITTLE-ENDIAN as
+ * `[h & 0xff, (h >> 8) & 0xff]`.
+ *
+ * The datagram chain (each datagram: 10-byte header + data + 2-byte working counter) is command-dependent,
+ * addressed, chainable state, so this minimal slice keeps it verbatim as `data` hex (byte-perfect), bounded
+ * by the Length field (data ends at offset 2 + Length, clamped to the captured bytes). Anything after the
+ * Length-bounded region is left to the codec's recursion / RawData (e.g. Ethernet padding). Structuring the
+ * datagram chain (Cmd/Idx/Address/Len/IRQ/WKC per datagram) is a deferred slice. Length is honor-else-derive
+ * on encode: honored when supplied (a crafted frame may carry any Length), else derived from the data.
+ */
+class EtherCAT extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'ecat';
+        this.name = 'EtherCAT';
+        this.nickname = 'EtherCAT';
+        this.matchKeys = ['ethertype:88a4'];
+        //A leaf header — the datagram chain requires command-dependent, addressed parsing (deferred slice).
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (EtherCAT.#schemaCache ??= EtherCAT.#buildSchema());
+    }
+    /** Read the 2-byte EtherCAT header as a little-endian uint16. */
+    static #readHeaderWord(header) {
+        const b = header.readBytes(0, 2);
+        return b[0] | (b[1] << 8);
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'EtherCAT type=${type} len=${length}',
+            properties: {
+                //length/reserved/type all live in the same 2 header bytes (one little-endian uint16), so
+                //each decodes from that single LE word by extracting its bits. Only `length` has an encode:
+                //it re-reads all three instance values, assembles the full word, and writes the 2 bytes once
+                //(so the three fields never clobber each other). reserved/type are decode-only.
+                length: {
+                    type: 'integer',
+                    label: 'Length',
+                    minimum: 0,
+                    //The on-wire field is 11 bits (max 0x7FF); the schema bound is left wider (uint16) so an
+                    //over-range value reaches the encode closure and is clamped+recorded there (an 11-bit
+                    //Ajv cap would silently reject it at the entry point instead).
+                    maximum: 65535,
+                    decode: function () {
+                        this.instance.length.setValue(EtherCAT.#readHeaderWord(this) & 0x07FF);
+                    },
+                    encode: function () {
+                        //Length counts only the datagram bytes that follow the 2-byte header. Honored when
+                        //supplied (a crafted frame may lie); else derived from the data byte count.
+                        const provided = this.instance.length.getValue();
+                        let length = (provided !== undefined && provided !== null)
+                            ? provided
+                            : (0, HexToBuffer_1.HexToBuffer)(this.instance.data.getValue('')).length;
+                        //Length is an 11-bit field (max 0x7FF). A larger value cannot be represented, so
+                        //clamp it and record the error rather than letting it wrap into the Type/Reserved
+                        //bits (which would corrupt the header word).
+                        if (length > 0x7FF) {
+                            this.recordError(this.instance.length.getPath(), 'Maximum value is 2047');
+                            length = 0x7FF;
+                        }
+                        if (length < 0) {
+                            this.recordError(this.instance.length.getPath(), 'Minimum value is 0');
+                            length = 0;
+                        }
+                        this.instance.length.setValue(length);
+                        const reserved = this.instance.reserved.getValue(0) & 0x1;
+                        const type = this.instance.type.getValue(0) & 0x0F;
+                        const h = (length & 0x07FF) | (reserved << 11) | (type << 12);
+                        this.writeBytes(0, Buffer.from([h & 0xff, (h >> 8) & 0xff]));
+                    }
+                },
+                reserved: {
+                    type: 'integer',
+                    label: 'Reserved',
+                    minimum: 0,
+                    maximum: 1,
+                    default: 0,
+                    //Decode-only: bit 11 of the LE header word. Written by `length`'s encode (see above).
+                    decode: function () {
+                        this.instance.reserved.setValue((EtherCAT.#readHeaderWord(this) >> 11) & 0x1);
+                    }
+                },
+                type: {
+                    type: 'integer',
+                    label: 'Type',
+                    minimum: 0,
+                    maximum: 15,
+                    default: 1,
+                    //Decode-only: bits 12..15 of the LE header word. Written by `length`'s encode (see above).
+                    decode: function () {
+                        this.instance.type.setValue((EtherCAT.#readHeaderWord(this) >> 12) & 0x0F);
+                    }
+                },
+                //The EtherCAT datagram chain, kept verbatim (byte-perfect). Bounded by the Length field
+                //(data ends at offset 2 + Length) and the captured bytes, so trailing padding / pipelined
+                //bytes are left to the codec's recursion / RawData. Datagram structuring is a deferred slice.
+                data: {
+                    type: 'string',
+                    label: 'Data',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        const length = this.instance.length.getValue(0);
+                        let end = 2 + length;
+                        if (end > remaining)
+                            end = remaining;
+                        this.instance.data.setValue(end > 2 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(2, end - 2)) : '');
+                    },
+                    encode: function () {
+                        const data = this.instance.data.getValue('');
+                        if (data)
+                            this.writeBytes(2, (0, HexToBuffer_1.HexToBuffer)(data));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //An Ethernet child selected by EtherType 0x88A4 (stored as a lowercase 4-hex string). Require the
+        //2-byte minimum for the EtherCAT header.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'eth')
+            return false;
+        if (this.prevCodecModule.instance.etherType.getValue() !== '88a4')
+            return false;
+        return this.packet.length - this.startPos >= 2;
+    }
+}
+exports.EtherCAT = EtherCAT;

package/dist/headers/EthernetII.d.ts

@@ -0,0 +1,28 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { DemuxProducer } from '../types/DemuxProducer';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+/**
+ * Ethernet II — the DIX/Ethernet II MAC frame header, the usual L2 root of a captured packet. This codec
+ * decodes the 14-octet header: a 6-octet Destination MAC (`dmac`, offset 0) and 6-octet Source MAC
+ * (`smac`, offset 6), both formatted as colon-separated lowercase hex, and a 16-bit EtherType
+ * (`etherType`, offset 12, kept as a 4-hex string e.g. "0800"). The EtherType is published as a demux
+ * key (namespace `ethertype`) so the next layer (IPv4/IPv6/ARP/VLAN/GOOSE/SV…) is selected by it.
+ *
+ * As the link-layer root it registers `linktype:1` (DLT_EN10MB) so decode(packet, 1) dispatches here, and
+ * `heuristicFallback` keeps Ethernet the default root: match() returns true when there is no parent. When
+ * there IS a parent it only claims the payload of tunnels that carry a bare inner Ethernet frame —
+ * unconditionally for TRILL / VXLAN / NVGRE / MPLS / QinQ, and for GENEVE / GRE only when their Protocol
+ * Type is 0x6558 (Transparent Ethernet Bridging); other GENEVE/GRE payloads route elsewhere rather than
+ * being mislabeled as a fabricated Ethernet layer.
+ */
+export declare class EthernetII extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly demuxProducers: DemuxProducer[];
+    readonly matchKeys: string[];
+    readonly heuristicFallback: boolean;
+    match(): boolean;
+}

package/dist/headers/EthernetII.js

@@ -0,0 +1,117 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EthernetII = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const NumberToHex_1 = require("../helper/NumberToHex");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * Ethernet II — the DIX/Ethernet II MAC frame header, the usual L2 root of a captured packet. This codec
+ * decodes the 14-octet header: a 6-octet Destination MAC (`dmac`, offset 0) and 6-octet Source MAC
+ * (`smac`, offset 6), both formatted as colon-separated lowercase hex, and a 16-bit EtherType
+ * (`etherType`, offset 12, kept as a 4-hex string e.g. "0800"). The EtherType is published as a demux
+ * key (namespace `ethertype`) so the next layer (IPv4/IPv6/ARP/VLAN/GOOSE/SV…) is selected by it.
+ *
+ * As the link-layer root it registers `linktype:1` (DLT_EN10MB) so decode(packet, 1) dispatches here, and
+ * `heuristicFallback` keeps Ethernet the default root: match() returns true when there is no parent. When
+ * there IS a parent it only claims the payload of tunnels that carry a bare inner Ethernet frame —
+ * unconditionally for TRILL / VXLAN / NVGRE / MPLS / QinQ, and for GENEVE / GRE only when their Protocol
+ * Type is 0x6558 (Transparent Ethernet Bridging); other GENEVE/GRE payloads route elsewhere rather than
+ * being mislabeled as a fabricated Ethernet layer.
+ */
+class EthernetII extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'eth';
+        this.name = 'Ethernet II';
+        this.nickname = 'ETH';
+        this.demuxProducers = [{ field: 'etherType', namespace: 'ethertype', kind: 'string' }];
+        //DLT_EN10MB = 1. Lets decode(packet, 1) dispatch to Ethernet by link type; heuristicFallback keeps
+        //Ethernet as the default no-linktype root (its match() still succeeds when there is no parent).
+        this.matchKeys = ['linktype:1'];
+        this.heuristicFallback = true;
+    }
+    static #schemaCache;
+    //Class-cached SCHEMA (④): field closures are plain functions taking dynamic `this` via .call(this),
+    //so they capture no instance and the structure is built once and shared.
+    get SCHEMA() {
+        return (EthernetII.#schemaCache ??= EthernetII.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            properties: {
+                dmac: {
+                    type: 'string',
+                    minLength: 17,
+                    maxLength: 17,
+                    label: 'Destination',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.MAC,
+                    decode: function () {
+                        this.instance.dmac.setValue(Array.from(this.readBytes(0, 6)).map((value) => value.toString(16).padStart(2, '0')).join(':'));
+                    },
+                    encode: function () {
+                        const dmac = this.instance.dmac
+                            .getValue('00:00:00:00:00:00', (nodePath) => this.recordError(nodePath, 'Not Found'))
+                            .toString()
+                            .split(':')
+                            .map((value) => parseInt(value, 16))
+                            .map((value) => value ? value : 0);
+                        this.writeBytes(0, Buffer.alloc(6, Buffer.from(dmac)));
+                    }
+                },
+                smac: {
+                    type: 'string',
+                    minLength: 17,
+                    maxLength: 17,
+                    label: 'Source',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.MAC,
+                    decode: function () {
+                        this.instance.smac.setValue(Array.from(this.readBytes(6, 6)).map((value) => value.toString(16).padStart(2, '0')).join(':'));
+                    },
+                    encode: function () {
+                        const smac = this.instance.smac
+                            .getValue('00:00:00:00:00:00', (nodePath) => this.recordError(nodePath, 'Not Found'))
+                            .toString()
+                            .split(':')
+                            .map((value) => parseInt(value, 16))
+                            .map((value) => value ? value : 0);
+                        this.writeBytes(6, Buffer.alloc(6, Buffer.from(smac)));
+                    }
+                },
+                etherType: {
+                    type: 'string',
+                    minLength: 4,
+                    maxLength: 4,
+                    label: 'EtherType',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        this.instance.etherType.setValue(this.readBytes(12, 2).toString('hex').padStart(4, '0'));
+                    },
+                    encode: function () {
+                        const etherType = this.instance.etherType.getValue((0, NumberToHex_1.UInt16ToHex)(0x0000), (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        const typeBuffer = Buffer.from(etherType, 'hex');
+                        if (typeBuffer.length < 2)
+                            typeBuffer.fill(0, 0, 1);
+                        this.writeBytes(12, typeBuffer.subarray(0, 2));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        if (!this.prevCodecModule)
+            return true;
+        //Tunnels that carry a bare Ethernet frame with no inner protocol-type field: claim their payload
+        //as Ethernet unconditionally.
+        const specialScenes = ['trill', 'vxlan', 'nvgre', 'mpls', 'qinq'];
+        if (specialScenes.includes(this.prevCodecModule.id))
+            return true;
+        //GENEVE and GRE carry a Protocol Type: only their Transparent Ethernet Bridging payload (0x6558)
+        //is an inner Ethernet frame. Other types route to IPv4/IPv6 (ethertype demux) or fall through to
+        //Raw — so an unknown type is not mislabeled as a fabricated Ethernet layer.
+        if (this.prevCodecModule.id === 'geneve' || this.prevCodecModule.id === 'gre')
+            return this.prevCodecModule.instance.protocolType.getValue() === (0, NumberToHex_1.UInt16ToHex)(0x6558);
+        return false;
+    }
+}
+exports.EthernetII = EthernetII;

package/dist/headers/FCoE.d.ts

@@ -0,0 +1,38 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * FCoE — Fibre Channel over Ethernet (FC-BB-5 / T11), carried directly in an Ethernet II frame with
+ * EtherType 0x8906 (an Ethernet child — no IP/UDP). An FCoE frame encapsulates a full native Fibre
+ * Channel frame between a 14-byte FCoE header and a 4-byte FCoE trailer:
+ *
+ *   +--------------------------------------------------------------+
+ *   | FCoE header (14 bytes): Version (high 4 bits of byte 0) +     |
+ *   |   Reserved (low 4 bits of byte 0 + 12 bytes) + SOF (byte 13)  |
+ *   +--------------------------------------------------------------+
+ *   | Encapsulated FC frame: 24-byte FC header (R_CTL/D_ID/CS_CTL/  |
+ *   |   S_ID/TYPE/F_CTL/SEQ_ID/DF_CTL/SEQ_CNT/OX_ID/RX_ID/Parameter)|
+ *   |   + FC payload + 4-byte FC CRC                                |
+ *   +--------------------------------------------------------------+
+ *   | FCoE trailer (4 bytes): EOF (1 byte) + Reserved (3 bytes)     |
+ *   +--------------------------------------------------------------+
+ *
+ * The Version nibble and the SOF/EOF delimiter codes are surfaced structurally; the encapsulated FC
+ * frame (FC header + payload + FC CRC) needs FC-level, cross-frame class-of-service context and its own
+ * CRC handling, so this codec keeps it verbatim as `fcFrame` hex (byte-perfect) rather than sub-decoding
+ * it — the FC dissection is a later enrichment. FCoE carries no length field of its own: like other
+ * Ethernet children it runs to the end of the frame, so the encapsulated FC frame is bounded by the
+ * frame's last 4 bytes (the EOF trailer). Nothing (CRC, SOF/EOF) is recomputed on encode — a faithful
+ * executor carries the delimiters and the FC CRC as-is — so a well-formed FCoE frame round-trips
+ * byte-for-byte.
+ */
+export declare class FCoE extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/FCoE.js

@@ -0,0 +1,210 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FCoE = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * FCoE — Fibre Channel over Ethernet (FC-BB-5 / T11), carried directly in an Ethernet II frame with
+ * EtherType 0x8906 (an Ethernet child — no IP/UDP). An FCoE frame encapsulates a full native Fibre
+ * Channel frame between a 14-byte FCoE header and a 4-byte FCoE trailer:
+ *
+ *   +--------------------------------------------------------------+
+ *   | FCoE header (14 bytes): Version (high 4 bits of byte 0) +     |
+ *   |   Reserved (low 4 bits of byte 0 + 12 bytes) + SOF (byte 13)  |
+ *   +--------------------------------------------------------------+
+ *   | Encapsulated FC frame: 24-byte FC header (R_CTL/D_ID/CS_CTL/  |
+ *   |   S_ID/TYPE/F_CTL/SEQ_ID/DF_CTL/SEQ_CNT/OX_ID/RX_ID/Parameter)|
+ *   |   + FC payload + 4-byte FC CRC                                |
+ *   +--------------------------------------------------------------+
+ *   | FCoE trailer (4 bytes): EOF (1 byte) + Reserved (3 bytes)     |
+ *   +--------------------------------------------------------------+
+ *
+ * The Version nibble and the SOF/EOF delimiter codes are surfaced structurally; the encapsulated FC
+ * frame (FC header + payload + FC CRC) needs FC-level, cross-frame class-of-service context and its own
+ * CRC handling, so this codec keeps it verbatim as `fcFrame` hex (byte-perfect) rather than sub-decoding
+ * it — the FC dissection is a later enrichment. FCoE carries no length field of its own: like other
+ * Ethernet children it runs to the end of the frame, so the encapsulated FC frame is bounded by the
+ * frame's last 4 bytes (the EOF trailer). Nothing (CRC, SOF/EOF) is recomputed on encode — a faithful
+ * executor carries the delimiters and the FC CRC as-is — so a well-formed FCoE frame round-trips
+ * byte-for-byte.
+ */
+class FCoE extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'fcoe';
+        this.name = 'Fibre Channel over Ethernet';
+        this.nickname = 'FCoE';
+        this.matchKeys = ['ethertype:8906'];
+        //A leaf header — the encapsulated FC frame requires FC-level, cross-frame parsing.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (FCoE.#schemaCache ??= FCoE.#buildSchema());
+    }
+    /** Header length of the fixed FCoE header (Version + Reserved + SOF). */
+    static #HEADER_LEN = 14;
+    /** Trailer length of the fixed FCoE trailer (EOF + 3 reserved bytes). */
+    static #TRAILER_LEN = 4;
+    /**
+     * Bytes available to FCoE within the Ethernet frame. FCoE has no length field — it runs to the end
+     * of the frame — so the whole captured Ethernet payload is FCoE content (header + FC frame + trailer).
+     */
+    #available() {
+        const available = this.packet.length - this.startPos;
+        return available < 0 ? 0 : available;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'FCoE ver=${version} sof=${sof} eof=${eof}',
+            properties: {
+                //Version — the high 4 bits of byte 0 (FC-BB-5 defines version 0).
+                version: {
+                    type: 'integer',
+                    label: 'Version',
+                    minimum: 0,
+                    maximum: 15,
+                    decode: function () {
+                        this.instance.version.setValue(this.readBits(0, 1, 0, 4));
+                    },
+                    encode: function () {
+                        const node = this.instance.version;
+                        let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 15) {
+                            this.recordError(node.getPath(), 'Maximum value is 15');
+                            value = 15;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBits(0, 1, 0, 4, value);
+                    }
+                },
+                //Reserved — the low 4 bits of byte 0 (kept verbatim so any non-zero reserved nibble
+                //round-trips). Shares byte 0 with Version; writeBits masks so the two never clobber.
+                reservedFlags: {
+                    type: 'integer',
+                    label: 'Reserved',
+                    minimum: 0,
+                    maximum: 15,
+                    decode: function () {
+                        this.instance.reservedFlags.setValue(this.readBits(0, 1, 4, 4));
+                    },
+                    encode: function () {
+                        const node = this.instance.reservedFlags;
+                        let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 15) {
+                            this.recordError(node.getPath(), 'Maximum value is 15');
+                            value = 15;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBits(0, 1, 4, 4, value);
+                    }
+                },
+                //The 12 reserved bytes (bytes 1..12) of the FCoE header, kept verbatim.
+                reserved: this.fieldHex('reserved', 1, 12, 'Reserved'),
+                //Start Of Frame delimiter code (byte 13) — e.g. SOFi3 0x2e, SOFn3 0x36. Kept verbatim.
+                sof: this.fieldUInt('sof', 13, 1, 'SOF'),
+                //The encapsulated Fibre Channel frame: 24-byte FC header + FC payload + 4-byte FC CRC,
+                //kept verbatim. Bounded by the frame's last 4 bytes (the EOF trailer) so the trailer is
+                //not pulled into the FC frame; FCoE runs to the end of the Ethernet frame.
+                fcFrame: {
+                    type: 'string',
+                    label: 'FC Frame',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#available();
+                        //A trailer (EOF + 3 reserved) is present only when there is room for both the
+                        //14-byte header and the 4-byte trailer; otherwise everything after the header is
+                        //the (truncated) FC frame and there is no trailer.
+                        const fcEnd = available >= FCoE.#HEADER_LEN + FCoE.#TRAILER_LEN
+                            ? available - FCoE.#TRAILER_LEN
+                            : available;
+                        this.instance.fcFrame.setValue(fcEnd > FCoE.#HEADER_LEN
+                            ? (0, BufferToHex_1.BufferToHex)(this.readBytes(FCoE.#HEADER_LEN, fcEnd - FCoE.#HEADER_LEN))
+                            : '');
+                    },
+                    encode: function () {
+                        const fcFrame = this.instance.fcFrame.getValue('');
+                        if (fcFrame)
+                            this.writeBytes(FCoE.#HEADER_LEN, (0, HexToBuffer_1.HexToBuffer)(fcFrame));
+                    }
+                },
+                //End Of Frame delimiter code (first trailer byte) — e.g. EOFn 0x41, EOFt 0x42. Kept
+                //verbatim. Sits at a frame-length-dependent offset (right after the FC frame), so it is
+                //located from the frame end on decode and from the FC frame length on encode.
+                eof: {
+                    type: 'integer',
+                    label: 'EOF',
+                    minimum: 0,
+                    maximum: 255,
+                    decode: function () {
+                        const available = this.#available();
+                        if (available < FCoE.#HEADER_LEN + FCoE.#TRAILER_LEN)
+                            return;
+                        this.instance.eof.setValue((0, BufferToNumber_1.BufferToUInt8)(this.readBytes(available - FCoE.#TRAILER_LEN, 1)));
+                    },
+                    encode: function () {
+                        const raw = this.instance.eof.getValue();
+                        if (raw === undefined || raw === null)
+                            return;
+                        const node = this.instance.eof;
+                        let value = raw;
+                        if (value > 255) {
+                            this.recordError(node.getPath(), 'Maximum value is 255');
+                            value = 255;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        const fcLen = (0, HexToBuffer_1.HexToBuffer)(this.instance.fcFrame.getValue('')).length;
+                        this.writeBytes(FCoE.#HEADER_LEN + fcLen, (0, NumberToBuffer_1.UInt8ToBuffer)(value));
+                    }
+                },
+                //The 3 reserved bytes after EOF, kept verbatim. Located from the frame end on decode and
+                //from the FC frame length on encode (right after the EOF byte).
+                eofReserved: {
+                    type: 'string',
+                    label: 'Reserved',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#available();
+                        if (available < FCoE.#HEADER_LEN + FCoE.#TRAILER_LEN)
+                            return;
+                        this.instance.eofReserved.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(available - 3, 3)));
+                    },
+                    encode: function () {
+                        const eofReserved = this.instance.eofReserved.getValue('');
+                        if (!eofReserved)
+                            return;
+                        const fcLen = (0, HexToBuffer_1.HexToBuffer)(this.instance.fcFrame.getValue('')).length;
+                        this.writeBytes(FCoE.#HEADER_LEN + fcLen + 1, (0, HexToBuffer_1.HexToBuffer)(eofReserved));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //An Ethernet child selected by EtherType 0x8906 (stored as a lowercase 4-hex string). Require at
+        //least the fixed 14-byte FCoE header to be present.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'eth')
+            return false;
+        if (this.prevCodecModule.instance.etherType.getValue() !== '8906')
+            return false;
+        return this.packet.length - this.startPos >= FCoE.#HEADER_LEN;
+    }
+}
+exports.FCoE = FCoE;

package/dist/headers/FTP.d.ts

@@ -0,0 +1,34 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * FTP — the File Transfer Protocol control channel (RFC 959), carried as US-ASCII text over TCP
+ * well-known port 21. The control channel is line-based: a client sends commands
+ * (`USER anonymous\r\n`, `PASS x\r\n`, `RETR file\r\n`, …) and a server sends replies
+ * (`220 Service ready\r\n`, `331 …\r\n`); a multi-line reply repeats the code with a '-' after the
+ * first line (`220-…\r\n…\r\n220 …\r\n`). The bulk data transfer runs on a separate dynamic-port
+ * connection which is out of scope — only the control channel on port 21 is claimed here (like TFTP,
+ * whose data channel is likewise not claimed).
+ *
+ * Like Syslog, SIP and HTTP, the message is text whose full internal structure (arbitrary arguments,
+ * significant whitespace, multi-line reply continuations) is richer than a form needs. So the ENTIRE
+ * raw message is kept verbatim as the authoritative `message` field (hex) and re-emitted untouched;
+ * only the first line is parsed on decode into display-only metadata (command/argument for a command,
+ * replyCode/replyText for a reply). Encode never reconstructs the message from the parsed fields — it
+ * writes `message` back byte-for-byte — so any conformant (or even malformed) FTP line round-trips
+ * exactly.
+ *
+ * Note: a single TCP segment may carry more than one control line (pipelined commands) or only part of
+ * a multi-line reply; reassembly across segments is out of scope. This single-segment codec keeps
+ * whatever bytes are present verbatim, which is byte-perfect for the single-packet case.
+ */
+export declare class FTP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}