@netkitty/codec 1.0.0

package/dist/headers/HSRP.js

@@ -0,0 +1,173 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HSRP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToIP_1 = require("../helper/BufferToIP");
+const IPToBuffer_1 = require("../helper/IPToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * HSRP — Hot Standby Router Protocol version 1 (RFC 2281, Cisco), carried over UDP port 1985 to the
+ * all-routers multicast group 224.0.0.2. The version-1 message is a fixed 20 bytes: Version (0 for v1),
+ * Op Code (0 Hello / 1 Coup / 2 Resign), State (0 Initial / 1 Learn / 2 Listen / 4 Speak / 8 Standby /
+ * 16 Active), Hellotime and Holdtime (seconds), Priority, Group, a Reserved byte, an 8-byte
+ * Authentication Data field (a plaintext password, default "cisco" — kept verbatim as hex so any value
+ * round-trips), and the 4-byte Virtual IP Address.
+ *
+ * Only version 0 (HSRPv1) is decoded field-by-field; a non-zero Version (HSRPv2 uses a different,
+ * TLV-based layout on this port) falls back to a verbatim `rawBody` hex so the message still round-trips
+ * byte-for-byte. HSRP is a leaf — nothing rides on top of it. The message is bounded by the 20-byte v1
+ * mandatory section; any trailing bytes in the UDP datagram are left to the codec's recursion / RawData.
+ */
+class HSRP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'hsrp';
+        this.name = 'Hot Standby Router Protocol';
+        this.nickname = 'HSRP';
+        this.matchKeys = ['udpport:1985'];
+        //A leaf header — nothing is carried on top of an HSRP message.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (HSRP.#schemaCache ??= HSRP.#buildSchema());
+    }
+    /** The payload length bounded by the UDP datagram (so retained ethernet padding/FCS is not absorbed). */
+    #payloadLength() {
+        let available = this.packet.length - this.startPos;
+        if (this.prevCodecModule && this.prevCodecModule.id === 'udp') {
+            const udpLength = this.prevCodecModule.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < available)
+                available = udpLength - 8;
+        }
+        return available < 0 ? 0 : available;
+    }
+    /**
+     * A single-octet unsigned field of the v1 mandatory section at `offset`, decoded/encoded only when
+     * Version is 0 (HSRPv1). No `enum` constraint: encode is a faithful executor that must be able to
+     * craft any Op Code / State value (including illegal ones), so the field stays a plain [0, 255]
+     * integer. Encode clamps to that range (recording an error, never throwing) — byte-for-byte
+     * identical to a hand-written uint8 for in-range values.
+     */
+    static #v1Uint8(name, offset, label) {
+        return {
+            type: 'integer',
+            label: label,
+            minimum: 0,
+            maximum: 255,
+            decode: function () {
+                if (this.instance.version.getValue(0) !== 0)
+                    return;
+                this.instance[name].setValue(this.readBytes(offset, 1)[0]);
+            },
+            encode: function () {
+                if (this.instance.version.getValue(0) !== 0)
+                    return;
+                const node = this.instance[name];
+                let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                if (value > 255) {
+                    this.recordError(node.getPath(), 'Maximum value is 255');
+                    value = 255;
+                }
+                if (value < 0) {
+                    this.recordError(node.getPath(), 'Minimum value is 0');
+                    value = 0;
+                }
+                node.setValue(value);
+                this.writeBytes(offset, (0, NumberToBuffer_1.UInt8ToBuffer)(value));
+            }
+        };
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'HSRP op=${opCode} state=${state} group=${group}',
+            properties: {
+                //Version — 0 for HSRPv1. Always decoded; it selects the v1 field layout vs the rawBody
+                //fallback (a non-zero version is HSRPv2, which uses a different TLV layout on this port).
+                version: this.fieldUInt('version', 0, 1, 'Version'),
+                //Op Code: 0 Hello, 1 Coup, 2 Resign.
+                opCode: this.#v1Uint8('opCode', 1, 'Op Code'),
+                //State: 0 Initial, 1 Learn, 2 Listen, 4 Speak, 8 Standby, 16 Active.
+                state: this.#v1Uint8('state', 2, 'State'),
+                helloTime: this.#v1Uint8('helloTime', 3, 'Hellotime'),
+                holdTime: this.#v1Uint8('holdTime', 4, 'Holdtime'),
+                priority: this.#v1Uint8('priority', 5, 'Priority'),
+                group: this.#v1Uint8('group', 6, 'Group'),
+                //Reserved byte — kept verbatim and re-emitted so a non-canonical frame stays byte-perfect.
+                reserved: this.#v1Uint8('reserved', 7, 'Reserved'),
+                //Authentication Data (8 bytes) — a plaintext password (default "cisco", NUL-padded). Kept
+                //verbatim as hex so any value (or binary garbage) round-trips byte-for-byte.
+                authData: {
+                    type: 'string',
+                    label: 'Authentication Data',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        if (this.instance.version.getValue(0) !== 0)
+                            return;
+                        this.instance.authData.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(8, 8)));
+                    },
+                    encode: function () {
+                        if (this.instance.version.getValue(0) !== 0)
+                            return;
+                        this.writeBytes(8, (0, HexToBuffer_1.HexToBuffer)(this.instance.authData.getValue('0000000000000000')));
+                    }
+                },
+                //Virtual IP Address — the group's shared gateway address.
+                virtualIP: {
+                    type: 'string',
+                    label: 'Virtual IP Address',
+                    minLength: 7,
+                    maxLength: 15,
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.IPv4,
+                    decode: function () {
+                        if (this.instance.version.getValue(0) !== 0)
+                            return;
+                        this.instance.virtualIP.setValue((0, BufferToIP_1.BufferToIPv4)(this.readBytes(16, 4)));
+                    },
+                    encode: function () {
+                        if (this.instance.version.getValue(0) !== 0)
+                            return;
+                        const value = this.instance.virtualIP.getValue('0.0.0.0', (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        this.instance.virtualIP.setValue(value);
+                        this.writeBytes(16, (0, IPToBuffer_1.IPv4ToBuffer)(value));
+                    }
+                },
+                //Raw-body fallback for a non-zero Version (HSRPv2, different layout). Kept verbatim from
+                //just after the Version byte to the end of the UDP payload, byte-perfect.
+                rawBody: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        if (this.instance.version.getValue(0) === 0)
+                            return;
+                        const end = this.#payloadLength();
+                        if (end <= 1)
+                            return;
+                        this.instance.rawBody.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(1, end - 1)));
+                    },
+                    encode: function () {
+                        if (this.instance.version.getValue(0) === 0)
+                            return;
+                        if (this.instance.rawBody.isUndefined())
+                            return;
+                        this.writeBytes(1, (0, HexToBuffer_1.HexToBuffer)(this.instance.rawBody.getValue('')));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //HSRP rides on UDP port 1985. Require the full 20-byte v1 mandatory section within the UDP
+        //payload (bounded by the datagram length, not the frame, so ethernet padding is not miscounted);
+        //a shorter datagram is not an HSRP message and falls through to raw.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        return this.#payloadLength() >= 20;
+    }
+}
+exports.HSRP = HSRP;

package/dist/headers/HTTP.d.ts

@@ -0,0 +1,32 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * HTTP/1.x — the Hypertext Transfer Protocol (RFC 7230), carried as US-ASCII text over TCP (well-known
+ * port 80, commonly 8080/8000). A message is a start-line, then header lines, a CRLF, and an optional
+ * body. The start-line is either a Request-Line (`METHOD SP Request-URI SP HTTP-Version CRLF`) or a
+ * Status-Line (`HTTP-Version SP Status-Code SP Reason-Phrase CRLF`).
+ *
+ * Like Syslog and SIP, the message body is text whose full internal structure (arbitrary header fields,
+ * a body of any content-type, significant whitespace/header ordering/casing) is far richer than a form
+ * needs. So the ENTIRE raw message is kept verbatim as the authoritative `message` field (hex) and
+ * re-emitted untouched; only the start-line is parsed on decode into display-only metadata
+ * (method/uri/version or status-code/reason). Encode never reconstructs the message from the parsed
+ * fields — it writes `message` back byte-for-byte — so any conformant (or even malformed) HTTP message
+ * round-trips exactly.
+ *
+ * Note: HTTP bodies can be chunked (`Transfer-Encoding: chunked`) or span multiple TCP segments;
+ * reassembly across segments is out of scope. This single-segment codec keeps whatever bytes are
+ * present in the current segment verbatim, which is byte-perfect for the single-packet case.
+ */
+export declare class HTTP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    readonly heuristicFallback: boolean;
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/HTTP.js

@@ -0,0 +1,153 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HTTP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/** HTTP request methods (RFC 7231 + PATCH) used only to recognize a request start-line. */
+const HTTP_METHODS = ['GET', 'POST', 'PUT', 'DELETE', 'HEAD', 'OPTIONS', 'PATCH', 'TRACE', 'CONNECT'];
+/**
+ * HTTP/1.x — the Hypertext Transfer Protocol (RFC 7230), carried as US-ASCII text over TCP (well-known
+ * port 80, commonly 8080/8000). A message is a start-line, then header lines, a CRLF, and an optional
+ * body. The start-line is either a Request-Line (`METHOD SP Request-URI SP HTTP-Version CRLF`) or a
+ * Status-Line (`HTTP-Version SP Status-Code SP Reason-Phrase CRLF`).
+ *
+ * Like Syslog and SIP, the message body is text whose full internal structure (arbitrary header fields,
+ * a body of any content-type, significant whitespace/header ordering/casing) is far richer than a form
+ * needs. So the ENTIRE raw message is kept verbatim as the authoritative `message` field (hex) and
+ * re-emitted untouched; only the start-line is parsed on decode into display-only metadata
+ * (method/uri/version or status-code/reason). Encode never reconstructs the message from the parsed
+ * fields — it writes `message` back byte-for-byte — so any conformant (or even malformed) HTTP message
+ * round-trips exactly.
+ *
+ * Note: HTTP bodies can be chunked (`Transfer-Encoding: chunked`) or span multiple TCP segments;
+ * reassembly across segments is out of scope. This single-segment codec keeps whatever bytes are
+ * present in the current segment verbatim, which is byte-perfect for the single-packet case.
+ */
+class HTTP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'http';
+        this.name = 'Hypertext Transfer Protocol';
+        this.nickname = 'HTTP';
+        //The well-known ports give O(1) bucket dispatch, but HTTP runs on arbitrary ports (3000, 8888, proxy
+        //ports, …). heuristicFallback lets a non-listed port still be recognized by the start-line signature
+        //in match() below — the ports are a fast path, not a whitelist. (STUN uses the same pattern for its
+        //Magic Cookie.) The signature is specific enough (a known method + space, or "HTTP/1.") that this
+        //does not claim arbitrary TCP traffic.
+        this.matchKeys = ['tcpport:80', 'tcpport:8080', 'tcpport:8000'];
+        this.heuristicFallback = true;
+        //A leaf header — the HTTP body and the exchange it belongs to are a higher-layer concern.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (_a.#schemaCache ??= _a.#buildSchema());
+    }
+    /**
+     * Bytes of this header: HTTP rides on TCP, which has no per-message length, so take the rest of the
+     * segment. Body reassembly across segments is out of scope (see class doc).
+     */
+    #payloadLength() {
+        const available = this.packet.length - this.startPos;
+        return available < 0 ? 0 : available;
+    }
+    /** The first line of the message (up to the first CRLF, or the whole payload if none). */
+    static #firstLine(text) {
+        const idx = text.indexOf('\r\n');
+        return idx >= 0 ? text.slice(0, idx) : text;
+    }
+    /**
+     * Parse the start-line into the display-only metadata fields. A Status-Line begins with the
+     * HTTP-Version ("HTTP/1.1"); anything else is treated as a Request-Line. Populated on decode only —
+     * these fields have no encode, so they never affect the re-emitted bytes and never mutate `message`.
+     * Never throws: a non-numeric status yields 0, missing tokens yield empty strings.
+     */
+    #parseStartLine(text) {
+        const line = _a.#firstLine(text);
+        if (line.startsWith('HTTP/')) {
+            //Status-Line: HTTP-Version SP Status-Code SP Reason-Phrase
+            const match = line.match(/^(\S+)\s+(\d{3})\s*(.*)$/);
+            this.instance.isRequest.setValue(false);
+            this.instance.method.setValue('');
+            this.instance.requestUri.setValue('');
+            this.instance.version.setValue(match ? match[1] : (line.split(' ')[0] || ''));
+            this.instance.statusCode.setValue(match ? Number(match[2]) : 0);
+            this.instance.reasonPhrase.setValue(match ? match[3] : '');
+            return;
+        }
+        //Request-Line: METHOD SP Request-URI SP HTTP-Version
+        const parts = line.split(' ');
+        this.instance.isRequest.setValue(true);
+        this.instance.method.setValue(parts[0] ? parts[0] : '');
+        this.instance.requestUri.setValue(parts.length > 1 ? parts[1] : '');
+        //The HTTP-Version is the last whitespace-delimited token; the Request-URI itself has no spaces.
+        this.instance.version.setValue(parts.length > 2 ? parts[parts.length - 1] : '');
+        this.instance.statusCode.setValue(0);
+        this.instance.reasonPhrase.setValue('');
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'HTTP ${method}${statusCode}',
+            properties: {
+                //The whole raw message is the single source of truth: decoded verbatim to hex and
+                //re-emitted untouched (byte-perfect for any HTTP message). The start-line is parsed into
+                //the display-only metadata below, which carry no codec of their own.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        if (available <= 0) {
+                            this.instance.message.setValue('');
+                            this.#parseStartLine('');
+                            return;
+                        }
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parseStartLine(raw.toString('latin1'));
+                    },
+                    encode: function () {
+                        //Re-emit the authoritative message verbatim — never reconstruct from metadata.
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                },
+                //Display-only metadata parsed from the start-line on decode (no encode — populated by the
+                //message field above, never read back). isRequest distinguishes a Request-Line from a
+                //Status-Line; method/requestUri are for requests, statusCode/reasonPhrase for responses.
+                isRequest: { type: 'boolean', label: 'Is Request' },
+                method: { type: 'string', label: 'Method' },
+                requestUri: { type: 'string', label: 'Request URI' },
+                version: { type: 'string', label: 'Version' },
+                statusCode: { type: 'integer', label: 'Status Code', minimum: 0, maximum: 999 },
+                reasonPhrase: { type: 'string', label: 'Reason Phrase' }
+            }
+        };
+    }
+    match() {
+        //HTTP rides on TCP as US-ASCII text. Recognize it by the start-line signature: a known request
+        //method followed by a space (the trailing space rejects e.g. "GETX"), or the "HTTP/1." response
+        //version — so non-HTTP traffic on these ports falls through to raw rather than claiming an
+        //un-decodable text layer.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.#payloadLength() < 4)
+            return false;
+        const lead = this.readBytes(0, 16, true).toString('latin1');
+        if (lead.startsWith('HTTP/1.'))
+            return true;
+        for (const method of HTTP_METHODS) {
+            if (lead.startsWith(method + ' '))
+                return true;
+        }
+        return false;
+    }
+}
+exports.HTTP = HTTP;
+_a = HTTP;

package/dist/headers/HTTP2.d.ts

@@ -0,0 +1,34 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * HTTP/2 over cleartext TCP — "h2c" (RFC 7540), well-known ports 80 / 8080. (HTTP/2 over TLS is
+ * negotiated by the ALPN identifier "h2" and lives INSIDE the TLS record layer, so it is not decoded
+ * here.) A client opens an h2c connection with the 24-byte connection preface
+ * `PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n` (RFC 7540 §3.5) — an extremely distinctive signature — immediately
+ * followed by frames. Every frame is a 9-byte header: Length (24-bit, the payload octet count), Type
+ * (1 = HEADERS, 4 = SETTINGS, 6 = PING, 8 = WINDOW_UPDATE, 0 = DATA, …), Flags (1 byte), a 1-bit
+ * Reserved and a 31-bit Stream Identifier (RFC 7540 §4.1), then Length bytes of payload.
+ *
+ * This is a MINIMAL first-slice codec: it matches only the connection-preface packet (the preface is
+ * the sole reliable content signature — a bare 9-byte frame header is not distinctive enough to claim
+ * arbitrary TCP traffic) and structures the preface plus exactly the FIRST frame that follows it. The
+ * frame's payload is kept verbatim as `payload` hex (its internal structure — HPACK header blocks,
+ * per-type SETTINGS/PING/WINDOW_UPDATE fields — is per-type, and HPACK is cross-frame connection state,
+ * out of scope for a single-packet slice). The frame is bounded by its Length, so any further pipelined
+ * frames in the same segment are left to the codec's recursion / RawData (they carry no preface, so
+ * this header does not re-match them). Length is honored when supplied else derived from the payload;
+ * Reserved and Stream Identifier are preserved verbatim. A well-formed preface packet round-trips
+ * byte-for-byte.
+ */
+export declare class HTTP2 extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    readonly heuristicFallback: boolean;
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/HTTP2.js

@@ -0,0 +1,190 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HTTP2 = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * HTTP/2 over cleartext TCP — "h2c" (RFC 7540), well-known ports 80 / 8080. (HTTP/2 over TLS is
+ * negotiated by the ALPN identifier "h2" and lives INSIDE the TLS record layer, so it is not decoded
+ * here.) A client opens an h2c connection with the 24-byte connection preface
+ * `PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n` (RFC 7540 §3.5) — an extremely distinctive signature — immediately
+ * followed by frames. Every frame is a 9-byte header: Length (24-bit, the payload octet count), Type
+ * (1 = HEADERS, 4 = SETTINGS, 6 = PING, 8 = WINDOW_UPDATE, 0 = DATA, …), Flags (1 byte), a 1-bit
+ * Reserved and a 31-bit Stream Identifier (RFC 7540 §4.1), then Length bytes of payload.
+ *
+ * This is a MINIMAL first-slice codec: it matches only the connection-preface packet (the preface is
+ * the sole reliable content signature — a bare 9-byte frame header is not distinctive enough to claim
+ * arbitrary TCP traffic) and structures the preface plus exactly the FIRST frame that follows it. The
+ * frame's payload is kept verbatim as `payload` hex (its internal structure — HPACK header blocks,
+ * per-type SETTINGS/PING/WINDOW_UPDATE fields — is per-type, and HPACK is cross-frame connection state,
+ * out of scope for a single-packet slice). The frame is bounded by its Length, so any further pipelined
+ * frames in the same segment are left to the codec's recursion / RawData (they carry no preface, so
+ * this header does not re-match them). Length is honored when supplied else derived from the payload;
+ * Reserved and Stream Identifier are preserved verbatim. A well-formed preface packet round-trips
+ * byte-for-byte.
+ */
+class HTTP2 extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'http2';
+        this.name = 'Hypertext Transfer Protocol 2';
+        this.nickname = 'HTTP2';
+        //Well-known h2c ports for O(1) bucket dispatch, plus heuristicFallback so a preface on any other
+        //port is still recognized via match(). The 24-byte connection preface is a strong, unique content
+        //signature (STUN/HTTP use the same dual pattern), so this cannot claim arbitrary TCP traffic.
+        this.matchKeys = ['tcpport:80', 'tcpport:8080'];
+        this.heuristicFallback = true;
+        //A leaf header — the frame payload (HPACK header blocks, per-type fields) needs cross-frame
+        //connection state and per-type parsing, out of scope for this single-packet slice.
+        this.demuxProducers = [];
+    }
+    /** The 24-byte HTTP/2 connection preface (RFC 7540 §3.5): "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n". */
+    static #PREFACE_HEX = '505249202a20485454502f322e300d0a0d0a534d0d0a0d0a';
+    /** Preface (24) + fixed 9-byte frame header — the bytes this header always structures and re-emits. */
+    static #MIN_LENGTH = 33;
+    static #schemaCache;
+    get SCHEMA() {
+        return (HTTP2.#schemaCache ??= HTTP2.#buildSchema());
+    }
+    /** Bytes available to this header within the current TCP segment. */
+    #available() {
+        const available = this.packet.length - this.startPos;
+        return available < 0 ? 0 : available;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'HTTP2 type=${type} stream=${streamId} len=${length}',
+            properties: {
+                //The 24-byte connection preface, kept verbatim. match() requires it, so it is always
+                //present on decode; the default lets a crafted frame re-emit the standard preface.
+                preface: {
+                    type: 'string',
+                    label: 'Connection Preface',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        this.instance.preface.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(0, 24)));
+                    },
+                    encode: function () {
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.preface.getValue(HTTP2.#PREFACE_HEX)));
+                    }
+                },
+                //Frame payload Length: a 24-bit big-endian octet count (RFC 7540 §4.1). There is no
+                //uint24 helper, so it is read/written byte-by-byte. Honored when supplied (a crafted
+                //frame may lie); else derived from the payload byte length.
+                length: {
+                    type: 'integer',
+                    label: 'Length',
+                    minimum: 0,
+                    maximum: 16777215,
+                    decode: function () {
+                        const b = this.readBytes(24, 3);
+                        this.instance.length.setValue((b[0] << 16) | (b[1] << 8) | b[2]);
+                    },
+                    encode: function () {
+                        const provided = this.instance.length.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : (0, HexToBuffer_1.HexToBuffer)(this.instance.payload.getValue('')).length;
+                        if (value > 16777215) {
+                            this.recordError(this.instance.length.getPath(), 'Maximum value is 16777215');
+                            value = 16777215;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.length.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.length.setValue(value);
+                        this.writeBytes(24, Buffer.from([(value >> 16) & 0xff, (value >> 8) & 0xff, value & 0xff]));
+                    }
+                },
+                //Frame Type (RFC 7540 §6): 0 DATA, 1 HEADERS, 4 SETTINGS, 6 PING, 8 WINDOW_UPDATE, … Kept
+                //as a plain uint8 (no hard enum) so any unknown/experimental type still round-trips.
+                type: this.fieldUInt('type', 27, 1, 'Type'),
+                //Frame Flags (RFC 7540 §4.1): a type-specific bit set (END_STREAM, END_HEADERS, ACK, …).
+                flags: this.fieldUInt('flags', 28, 1, 'Flags'),
+                //Reserved 1-bit field (RFC 7540 §4.1): the high bit of the 4-byte Stream-Identifier word.
+                //"MUST remain unset when sending"; preserved verbatim so a set bit still round-trips.
+                reserved: {
+                    type: 'integer',
+                    label: 'Reserved',
+                    minimum: 0,
+                    maximum: 1,
+                    decode: function () {
+                        this.instance.reserved.setValue(this.readBits(29, 4, 0, 1));
+                    },
+                    encode: function () {
+                        const node = this.instance.reserved;
+                        let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 1)
+                            value = 1;
+                        if (value < 0)
+                            value = 0;
+                        node.setValue(value);
+                        this.writeBits(29, 4, 0, 1, value);
+                    }
+                },
+                //Stream Identifier (RFC 7540 §4.1): the low 31 bits of the same word. 0 = connection
+                //control (SETTINGS/PING/WINDOW_UPDATE); odd = client-initiated, even = server-initiated.
+                streamId: {
+                    type: 'integer',
+                    label: 'Stream Identifier',
+                    minimum: 0,
+                    maximum: 2147483647,
+                    decode: function () {
+                        this.instance.streamId.setValue(this.readBits(29, 4, 1, 31));
+                    },
+                    encode: function () {
+                        const node = this.instance.streamId;
+                        let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 2147483647) {
+                            this.recordError(node.getPath(), 'Maximum value is 2147483647');
+                            value = 2147483647;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBits(29, 4, 1, 31, value);
+                    }
+                },
+                //The first frame's payload after the 9-byte frame header (offset 33 = preface 24 + header
+                //9), kept verbatim. Bounded by the frame Length AND the captured bytes, so any pipelined
+                //trailing frame is left to the codec's recursion / RawData.
+                payload: {
+                    type: 'string',
+                    label: 'Payload',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#available();
+                        const length = this.instance.length.getValue(0);
+                        let end = 33 + length;
+                        if (end > available)
+                            end = available;
+                        this.instance.payload.setValue(end > 33 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(33, end - 33)) : '');
+                    },
+                    encode: function () {
+                        const payload = this.instance.payload.getValue('');
+                        if (payload)
+                            this.writeBytes(33, (0, HexToBuffer_1.HexToBuffer)(payload));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //h2c rides on TCP. Recognize ONLY the connection-preface packet: the exact 24-byte preface plus
+        //enough bytes for the fixed 9-byte frame header this codec always structures and re-emits (so a
+        //preface-only segment is not claimed and left byte-imperfect). A bare mid-stream frame carries
+        //no preface and is intentionally not matched (it falls through to raw).
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.#available() < HTTP2.#MIN_LENGTH)
+            return false;
+        return (0, BufferToHex_1.BufferToHex)(this.readBytes(0, 24, true)) === HTTP2.#PREFACE_HEX;
+    }
+}
+exports.HTTP2 = HTTP2;

package/dist/headers/IAX2.d.ts

@@ -0,0 +1,33 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * IAX2 — Inter-Asterisk eXchange version 2 (RFC 5456), the Asterisk VoIP signalling + media trunking
+ * protocol, UDP port 4569. Every IAX2 datagram carries exactly one frame whose first bit (the F bit,
+ * the MSB of octet 0) selects the frame format:
+ *
+ *  - Full frame (F = 1) — a 12-byte header: F(1) + Source Call Number(15) | R(1, retransmit) +
+ *    Destination Call Number(15) | Timestamp(32) | OSeqno(8) | ISeqno(8) | Frame Type(8) | C(1) +
+ *    Subclass(7), followed by the frame data (the Information Elements of a NEW/AUTHREQ/… command, or a
+ *    media payload). Full frames are reliably delivered and carry the call-control state.
+ *  - Mini frame (F = 0) — a 4-byte header: F(1) + Source Call Number(15) | Timestamp(16), followed by
+ *    the media payload. Mini frames carry audio with a truncated 16-bit timestamp to save bandwidth.
+ *
+ * Byte-perfect strategy (minimal slice): the format is chosen by peeking the MSB of octet 0; the fixed
+ * header is bit-unpacked field by field and the frame data is kept verbatim as `data` hex. IAX2 has no
+ * in-frame length field — one frame occupies the whole UDP payload — so `data` runs to the transport
+ * payload end (udp.length − 8, clamped to the captured bytes so Ethernet padding is not consumed). Every
+ * wire field is a plain clamped integer (no Ajv enum), so a crafted / non-conformant value decoded off
+ * the wire re-encodes without being rejected — decode never fails and encode is a faithful executor. A
+ * well-formed frame round-trips byte-for-byte.
+ */
+export declare class IAX2 extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}