@netkitty/codec 1.0.0

package/dist/headers/GELF.js

@@ -0,0 +1,261 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GELF = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * GELF — Graylog Extended Log Format, the log-shipping payload Graylog and its inputs exchange over
+ * UDP port 12201. A GELF UDP datagram carries a single log message in one of three on-wire forms, told
+ * apart by the first bytes of the payload:
+ *
+ *  - Chunked (magic 0x1E0F): a large message split across datagrams. The 12-byte chunk header is the
+ *    2-byte magic, an 8-byte Message ID (shared by all chunks of one message), a 1-byte Sequence Number
+ *    (this chunk's index) and a 1-byte Sequence Count (total chunks), followed by this chunk's slice of
+ *    the (possibly compressed) message. The receiver reassembles the slices by Message ID / Sequence.
+ *  - GZIP (magic 0x1F8B): the whole datagram is a single gzip-compressed GELF JSON document.
+ *  - Uncompressed: anything else — the datagram is the GELF JSON document as UTF-8 text (a `{ ... }`
+ *    object). (A zlib-deflated document, magic 0x78, also falls here and is kept verbatim.)
+ *
+ * This is the minimal faithful slice: the form is detected from the leading magic and the chunk header
+ * is structured (magic / messageId / sequenceNumber / sequenceCount + chunk `data` hex); the gzip body
+ * and the uncompressed/zlib body are opaque here and kept verbatim (`payload` / `message` hex) — the
+ * chunk-reassembly, gunzip and JSON decoding are a later enrichment layered on top of this byte-perfect
+ * base. Everything is bounded by the enclosing UDP payload length so a trailing FCS/padding is not
+ * absorbed. Nothing is recomputed on encode (the Sequence Count is honored, not derived), so a
+ * well-formed datagram of any form round-trips byte-for-byte. `form` is a decode-time discriminant that
+ * writes no bytes; on encode it is honored when supplied, else inferred from which fields are present.
+ */
+class GELF extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'gelf';
+        this.name = 'Graylog Extended Log Format';
+        this.nickname = 'GELF';
+        this.matchKeys = ['udpport:12201'];
+        //A leaf header — chunk reassembly, gunzip and GELF JSON decoding are deferred to a later slice.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (GELF.#schemaCache ??= GELF.#buildSchema());
+    }
+    /** End of this datagram within the captured bytes: bounded by the parent UDP payload (udp.length − 8). */
+    #payloadEnd() {
+        let end = this.packet.length - this.startPos;
+        const prev = this.prevCodecModule;
+        if (prev && prev.id === 'udp') {
+            const udpLength = prev.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < end)
+                end = udpLength - 8;
+        }
+        return end < 0 ? 0 : end;
+    }
+    /** Detect the on-wire form from the leading magic bytes of the payload. */
+    #detectForm() {
+        const end = this.#payloadEnd();
+        if (end < 2)
+            return 'uncompressed';
+        const lead = this.readBytes(0, 2, true);
+        if (lead[0] === 0x1e && lead[1] === 0x0f)
+            return 'chunked';
+        if (lead[0] === 0x1f && lead[1] === 0x8b)
+            return 'gzip';
+        return 'uncompressed';
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'GELF ${form}',
+            properties: {
+                //Discriminant chosen at decode from the leading magic (chunked / gzip / uncompressed).
+                //It writes no bytes; on encode it is honored when supplied, else inferred from which
+                //form-specific fields are present (a chunk has a Message ID; a gzip form has payload).
+                //No enum: it never gates re-encoding of a decoded value.
+                form: {
+                    type: 'string',
+                    label: 'Form',
+                    decode: function () {
+                        this.instance.form.setValue(this.#detectForm());
+                    },
+                    encode: function () {
+                        let form = this.instance.form.getValue();
+                        if (!form) {
+                            if (this.instance.messageId.getValue() !== undefined)
+                                form = 'chunked';
+                            else if (this.instance.payload.getValue() !== undefined)
+                                form = 'gzip';
+                            else
+                                form = 'uncompressed';
+                        }
+                        this.instance.form.setValue(form);
+                    }
+                },
+                //Chunked form (magic 0x1E0F). The 12-byte chunk header, structured. Each field acts only
+                //when the form is chunked; otherwise it stays unset so it neither decodes phantom values
+                //nor writes bytes for the gzip/uncompressed forms.
+                magic: {
+                    type: 'string',
+                    label: 'Magic',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        if (this.instance.form.getValue() !== 'chunked')
+                            return;
+                        this.instance.magic.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(0, 2)));
+                    },
+                    encode: function () {
+                        if (this.instance.form.getValue() !== 'chunked')
+                            return;
+                        //Honor a supplied magic verbatim (a crafted chunk may lie); else the GELF 0x1E0F.
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.magic.getValue('1e0f')));
+                    }
+                },
+                //8-byte Message ID shared by every chunk of one logical message.
+                messageId: {
+                    type: 'string',
+                    label: 'Message ID',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        if (this.instance.form.getValue() !== 'chunked')
+                            return;
+                        this.instance.messageId.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(2, 8)));
+                    },
+                    encode: function () {
+                        if (this.instance.form.getValue() !== 'chunked')
+                            return;
+                        this.writeBytes(2, (0, HexToBuffer_1.HexToBuffer)(this.instance.messageId.getValue('0000000000000000')));
+                    }
+                },
+                //This chunk's index (0-based) among the sequence.
+                sequenceNumber: {
+                    type: 'integer',
+                    label: 'Sequence Number',
+                    minimum: 0,
+                    maximum: 255,
+                    decode: function () {
+                        if (this.instance.form.getValue() !== 'chunked')
+                            return;
+                        this.instance.sequenceNumber.setValue((0, BufferToNumber_1.BufferToUInt8)(this.readBytes(10, 1)));
+                    },
+                    encode: function () {
+                        if (this.instance.form.getValue() !== 'chunked')
+                            return;
+                        const node = this.instance.sequenceNumber;
+                        let value = node.getValue(0);
+                        if (value > 255) {
+                            this.recordError(node.getPath(), 'Maximum value is 255');
+                            value = 255;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBytes(10, (0, NumberToBuffer_1.UInt8ToBuffer)(value));
+                    }
+                },
+                //Total number of chunks in the sequence. Honored verbatim (not derived) — a crafted chunk
+                //may carry any count.
+                sequenceCount: {
+                    type: 'integer',
+                    label: 'Sequence Count',
+                    minimum: 0,
+                    maximum: 255,
+                    decode: function () {
+                        if (this.instance.form.getValue() !== 'chunked')
+                            return;
+                        this.instance.sequenceCount.setValue((0, BufferToNumber_1.BufferToUInt8)(this.readBytes(11, 1)));
+                    },
+                    encode: function () {
+                        if (this.instance.form.getValue() !== 'chunked')
+                            return;
+                        const node = this.instance.sequenceCount;
+                        let value = node.getValue(0);
+                        if (value > 255) {
+                            this.recordError(node.getPath(), 'Maximum value is 255');
+                            value = 255;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBytes(11, (0, NumberToBuffer_1.UInt8ToBuffer)(value));
+                    }
+                },
+                //This chunk's slice of the (possibly compressed) message, after the 12-byte chunk header.
+                //Opaque here (reassembly is deferred); kept verbatim, bounded by the UDP payload.
+                data: {
+                    type: 'string',
+                    label: 'Chunk Data',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        if (this.instance.form.getValue() !== 'chunked')
+                            return;
+                        const end = this.#payloadEnd();
+                        this.instance.data.setValue(end > 12 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(12, end - 12)) : '');
+                    },
+                    encode: function () {
+                        if (this.instance.form.getValue() !== 'chunked')
+                            return;
+                        const data = this.instance.data.getValue('');
+                        if (data)
+                            this.writeBytes(12, (0, HexToBuffer_1.HexToBuffer)(data));
+                    }
+                },
+                //GZIP form (magic 0x1F8B): the whole gzip-compressed GELF document, opaque, kept verbatim
+                //(magic included) and bounded by the UDP payload.
+                payload: {
+                    type: 'string',
+                    label: 'GZIP Payload',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        if (this.instance.form.getValue() !== 'gzip')
+                            return;
+                        const end = this.#payloadEnd();
+                        this.instance.payload.setValue(end > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(0, end)) : '');
+                    },
+                    encode: function () {
+                        if (this.instance.form.getValue() !== 'gzip')
+                            return;
+                        const payload = this.instance.payload.getValue('');
+                        if (payload)
+                            this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(payload));
+                    }
+                },
+                //Uncompressed form: the GELF JSON document as text (or a zlib-deflated body). Kept verbatim
+                //as hex and bounded by the UDP payload, so any body round-trips byte-for-byte.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        if (this.instance.form.getValue() !== 'uncompressed')
+                            return;
+                        const end = this.#payloadEnd();
+                        this.instance.message.setValue(end > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(0, end)) : '');
+                    },
+                    encode: function () {
+                        if (this.instance.form.getValue() !== 'uncompressed')
+                            return;
+                        const message = this.instance.message.getValue('');
+                        if (message)
+                            this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(message));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //GELF rides on UDP well-known port 12201 (the matchKeys bucket selects it). The uncompressed
+        //form is arbitrary JSON with no fixed magic, so the port is the signature; require at least one
+        //payload byte so an empty datagram falls through to raw rather than claiming an empty layer.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        return this.#payloadEnd() >= 1;
+    }
+}
+exports.GELF = GELF;

package/dist/headers/GENEVE.d.ts

@@ -0,0 +1,26 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * GENEVE — Generic Network Virtualization Encapsulation (RFC 8926), a network-virtualization overlay on
+ * UDP port 6081. The 8-byte base header is: Version(2 bits) + Opt Len(6 bits, options length in 4-byte
+ * units), O(OAM) + C(Critical) + 6 reserved bits, a 16-bit Protocol Type (the EtherType of the payload:
+ * 0x6558 = Transparent Ethernet Bridging, 0x0800 = IPv4, 0x86dd = IPv6), a 24-bit VNI, and a reserved
+ * byte. It is followed by Opt Len*4 bytes of variable-length options, then the inner frame.
+ *
+ * Like VXLAN, this codec decodes only its own header + options (headerLength = 8 + Opt Len*4); the inner
+ * frame is left to the codec's recursion. Protocol Type is declared as an `ethertype` demux producer so
+ * an inner IPv4/IPv6 packet is dispatched to IPv4/IPv6 (which accept a 'geneve' tunnel parent), while a
+ * Transparent-Ethernet-Bridging (0x6558) payload falls through to EthernetII (which already accepts a
+ * 'geneve' parent). The whole nested packet round-trips byte-for-byte layer by layer.
+ */
+export declare class GENEVE extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/GENEVE.js

@@ -0,0 +1,209 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GENEVE = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * GENEVE — Generic Network Virtualization Encapsulation (RFC 8926), a network-virtualization overlay on
+ * UDP port 6081. The 8-byte base header is: Version(2 bits) + Opt Len(6 bits, options length in 4-byte
+ * units), O(OAM) + C(Critical) + 6 reserved bits, a 16-bit Protocol Type (the EtherType of the payload:
+ * 0x6558 = Transparent Ethernet Bridging, 0x0800 = IPv4, 0x86dd = IPv6), a 24-bit VNI, and a reserved
+ * byte. It is followed by Opt Len*4 bytes of variable-length options, then the inner frame.
+ *
+ * Like VXLAN, this codec decodes only its own header + options (headerLength = 8 + Opt Len*4); the inner
+ * frame is left to the codec's recursion. Protocol Type is declared as an `ethertype` demux producer so
+ * an inner IPv4/IPv6 packet is dispatched to IPv4/IPv6 (which accept a 'geneve' tunnel parent), while a
+ * Transparent-Ethernet-Bridging (0x6558) payload falls through to EthernetII (which already accepts a
+ * 'geneve' parent). The whole nested packet round-trips byte-for-byte layer by layer.
+ */
+class GENEVE extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'geneve';
+        this.name = 'Generic Network Virtualization Encapsulation';
+        this.nickname = 'GENEVE';
+        this.matchKeys = ['udpport:6081'];
+        //Protocol Type is an EtherType; declaring it in the 'ethertype' namespace dispatches the inner IPv4/
+        //IPv6 packet to the O(1) bucket (which accepts a 'geneve' parent), while a 0x6558 Ethernet payload
+        //falls through to EthernetII's tunnel-aware match.
+        this.demuxProducers = [{ field: 'protocolType', namespace: 'ethertype', kind: 'string' }];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (GENEVE.#schemaCache ??= GENEVE.#buildSchema());
+    }
+    /** The payload length bounded by the UDP datagram (so a retained FCS/padding is not absorbed). */
+    #available() {
+        let available = this.packet.length - this.startPos;
+        if (this.prevCodecModule && this.prevCodecModule.id === 'udp') {
+            const udpLength = this.prevCodecModule.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < available)
+                available = udpLength - 8;
+        }
+        return available < 0 ? 0 : available;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'GENEVE vni=${vni} proto=${protocolType}',
+            properties: {
+                version: {
+                    type: 'integer', label: 'Version', minimum: 0, maximum: 3,
+                    decode: function () { this.instance.version.setValue(this.readBits(0, 1, 0, 2)); },
+                    encode: function () { this.writeBits(0, 1, 0, 2, this.instance.version.getValue(0)); }
+                },
+                //Opt Len (options length in 4-byte units) — metadata; the value is derived from the
+                //options list by the `body` master on encode and read from the wire on decode.
+                optLen: { type: 'integer', label: 'Option Length', minimum: 0, maximum: 63 },
+                oam: {
+                    type: 'boolean', label: 'OAM',
+                    decode: function () { this.instance.oam.setValue(!!this.readBits(1, 1, 0, 1)); },
+                    encode: function () {
+                        const oam = !!this.instance.oam.getValue();
+                        this.instance.oam.setValue(oam);
+                        this.writeBits(1, 1, 0, 1, oam ? 1 : 0);
+                    }
+                },
+                critical: {
+                    type: 'boolean', label: 'Critical Options Present',
+                    decode: function () { this.instance.critical.setValue(!!this.readBits(1, 1, 1, 1)); },
+                    encode: function () {
+                        const critical = !!this.instance.critical.getValue();
+                        this.instance.critical.setValue(critical);
+                        this.writeBits(1, 1, 1, 1, critical ? 1 : 0);
+                    }
+                },
+                //Reserved 6 bits of byte 1, kept verbatim for a byte-perfect round-trip.
+                reserved1: {
+                    type: 'integer', label: 'Reserved', minimum: 0, maximum: 63, hidden: true,
+                    decode: function () { this.instance.reserved1.setValue(this.readBits(1, 1, 2, 6)); },
+                    encode: function () { this.writeBits(1, 1, 2, 6, this.instance.reserved1.getValue(0)); }
+                },
+                //Protocol Type is the EtherType of the inner frame — stored as a lowercase hex string
+                //(like eth.etherType) so it can drive the `ethertype` demux dimension to the inner codec.
+                protocolType: {
+                    type: 'string', label: 'Protocol Type', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () { this.instance.protocolType.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(2, 2))); },
+                    encode: function () {
+                        const hex = this.instance.protocolType.getValue('6558');
+                        this.writeBytes(2, (0, HexToBuffer_1.HexToBuffer)(hex.padStart(4, '0').slice(-4)));
+                    }
+                },
+                vni: {
+                    type: 'integer', label: 'VNI', minimum: 0, maximum: 16777215,
+                    decode: function () { this.instance.vni.setValue(this.readBits(4, 3, 0, 24)); },
+                    encode: function () {
+                        let vni = this.instance.vni.getValue(0);
+                        if (vni > 16777215) {
+                            this.recordError(this.instance.vni.getPath(), 'Maximum value is 16777215');
+                            vni = 16777215;
+                        }
+                        if (vni < 0) {
+                            this.recordError(this.instance.vni.getPath(), 'Minimum value is 0');
+                            vni = 0;
+                        }
+                        this.instance.vni.setValue(vni);
+                        this.writeBits(4, 3, 0, 24, vni);
+                    }
+                },
+                //Reserved byte 7, kept verbatim.
+                reserved2: {
+                    type: 'string', label: 'Reserved', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX, hidden: true,
+                    decode: function () { this.instance.reserved2.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(7, 1))); },
+                    encode: function () { this.writeBytes(7, (0, HexToBuffer_1.HexToBuffer)(this.instance.reserved2.getValue('00'))); }
+                },
+                options: {
+                    type: 'array', label: 'Options',
+                    items: {
+                        type: 'object', label: 'Option',
+                        properties: {
+                            optionClass: { type: 'integer', label: 'Option Class', minimum: 0, maximum: 65535 },
+                            type: { type: 'integer', label: 'Type', minimum: 0, maximum: 255 },
+                            critical: { type: 'boolean', label: 'Critical' },
+                            reserved: { type: 'integer', label: 'Reserved', minimum: 0, maximum: 7, hidden: true },
+                            data: { type: 'string', label: 'Data', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX }
+                        }
+                    }
+                },
+                //Any bytes in the option region the option walk could not structure (malformed) are kept
+                //verbatim so the header always round-trips and the inner frame starts at the right offset.
+                optionsTail: { type: 'string', label: 'Options Tail', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX, hidden: true },
+                //Master field: parses/emits the Opt Len field and the option region (runs after the fixed
+                //header fields — property order — so the fixed bytes are already read/written).
+                body: {
+                    type: 'string', label: 'Body', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX, hidden: true,
+                    decode: function () {
+                        const available = this.#available();
+                        const optLen = this.readBits(0, 1, 2, 6);
+                        this.instance.optLen.setValue(optLen);
+                        const end = Math.min(8 + optLen * 4, available);
+                        let offset = 8;
+                        const options = [];
+                        while (offset + 4 <= end) {
+                            const optionClass = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(offset, 2));
+                            const type = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(offset + 2, 1));
+                            const b3 = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(offset + 3, 1));
+                            const reserved = (b3 >> 5) & 0x07;
+                            const dataBytes = (b3 & 0x1f) * 4;
+                            if (offset + 4 + dataBytes > end)
+                                break;
+                            options.push({
+                                optionClass: optionClass,
+                                type: type,
+                                critical: !!(type & 0x80),
+                                reserved: reserved,
+                                data: dataBytes > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset + 4, dataBytes)) : ''
+                            });
+                            offset += 4 + dataBytes;
+                        }
+                        this.instance.options.setValue(options);
+                        //Consume the rest of the (optLen-defined) option region verbatim so headerLength
+                        //= 8 + optLen*4 and the inner frame is dispatched at the right offset.
+                        this.instance.optionsTail.setValue(offset < end ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset, end - offset)) : '');
+                    },
+                    encode: function () {
+                        let offset = 8;
+                        const options = this.instance.options.getValue([]);
+                        if (options)
+                            for (let i = 0; i < options.length; i++) {
+                                const option = options[i];
+                                const data = (0, HexToBuffer_1.HexToBuffer)(option.data ? option.data : '');
+                                //Option data is a 5-bit length in 4-byte units, so it must be a multiple of 4
+                                //bytes and at most 124 — record rather than silently wrap a malformed length.
+                                if (data.length % 4 !== 0 || data.length > 124)
+                                    this.recordError(this.instance.options.getPath() + `[${i}].data`, 'Option data must be a multiple of 4 bytes and at most 124');
+                                this.writeBytes(offset, (0, NumberToBuffer_1.UInt16ToBuffer)(option.optionClass ? option.optionClass : 0));
+                                offset += 2;
+                                this.writeBytes(offset, Buffer.from([(option.type ? option.type : 0) & 0xff]));
+                                offset += 1;
+                                const reserved = (option.reserved ? option.reserved : 0) & 0x07;
+                                this.writeBytes(offset, Buffer.from([(reserved << 5) | ((data.length / 4) & 0x1f)]));
+                                offset += 1;
+                                if (data.length) {
+                                    this.writeBytes(offset, data);
+                                    offset += data.length;
+                                }
+                            }
+                        const tail = (0, HexToBuffer_1.HexToBuffer)(this.instance.optionsTail.getValue(''));
+                        if (tail.length) {
+                            this.writeBytes(offset, tail);
+                            offset += tail.length;
+                        }
+                        //Opt Len = the whole option region in 4-byte units.
+                        this.writeBits(0, 1, 2, 6, ((offset - 8) / 4) & 0x3f);
+                        this.instance.optLen.setValue((offset - 8) / 4);
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Require the 8-byte base header within the UDP payload (see RADIUS: bound by payload).
+        return !!this.prevCodecModule && this.prevCodecModule.id === 'udp' && this.#available() >= 8;
+    }
+}
+exports.GENEVE = GENEVE;

package/dist/headers/GESRTP.d.ts

@@ -0,0 +1,32 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * GE-SRTP — GE Fanuc (GE Intelligent Platforms) Service Request Transport Protocol, TCP port 18245.
+ * The proprietary Ethernet protocol spoken by GE Series 90 / PACSystems / VersaMax PLCs. GE publishes
+ * no specification; the on-wire layout used here is the community reverse-engineering (Collin Matthews'
+ * `TheMadHatt3r/ge-ethernet-SRTP`; the New Haven "Leveraging the SRTP protocol …" paper).
+ *
+ * Every message begins with a fixed 56-byte header. Only a subset of those 56 bytes has a confidently
+ * documented meaning — the message Type, sequence numbers, a controller timestamp, the message-type
+ * byte, the mailbox source/destination, packet counters, and the service-request block (Service Request
+ * Code, segment selector / memory type, memory offset, data length). Everything else in the header is
+ * "reserved/unknown" and is kept verbatim as hex so it round-trips untouched. A READ request is exactly
+ * the 56-byte header; a response carries the read data after the header, so any bytes captured past the
+ * 56-byte header are kept verbatim as `payload` hex (bounded by the captured TCP payload).
+ *
+ * ⚠️ The two-octet memory-offset and data-length fields are LITTLE-ENDIAN (segment selector / SNP
+ * addressing convention: LSB first). There is no little-endian helper in this codebase, so those uint16
+ * fields are read/written byte-by-byte in their closures. Every numeric field is a clamped uint (never a
+ * hard enum) so any value that decodes off the wire re-encodes without an Ajv rejection.
+ */
+export declare class GESRTP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}