@netkitty/codec 1.0.0

package/dist/headers/AMQP.js

@@ -0,0 +1,316 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AMQP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/** The 8-byte literal a client sends first to negotiate the protocol: "AMQP" + 4 version octets. */
+const PROTOCOL_HEADER_MAGIC = Buffer.from('AMQP', 'latin1'); // 41 4d 51 50
+/** AMQP frame end marker — every frame terminates with this octet (AMQP 0-9-1 §2.3.5). */
+const FRAME_END = 0xce;
+/** Valid frame type octets: 1=METHOD, 2=HEADER, 3=BODY, 8=HEARTBEAT (AMQP 0-9-1 §2.3.5). */
+const FRAME_TYPES = [1, 2, 3, 8];
+/**
+ * AMQP 0-9-1 — the Advanced Message Queuing Protocol as spoken by RabbitMQ and friends, carried over TCP
+ * port 5672. A connection opens with an 8-byte protocol header — the literal "AMQP" followed by four
+ * version octets (0 0 9 1 for 0-9-1) — sent once at connection start to negotiate the version. Everything
+ * after that is a stream of frames: a 1-byte type (1=METHOD, 2=HEADER, 3=BODY, 8=HEARTBEAT), a 2-byte
+ * channel, a 4-byte payload length, `length` payload octets, and a single 0xCE frame-end octet.
+ *
+ * This codec handles BOTH forms in one header (they are distinguished on the wire by the leading "AMQP"
+ * literal). The protocol-header handshake decodes to {isProtocolHeader:true, protocol:'AMQP', + the four
+ * version octets}; a frame decodes to type/channel/length/payload/frameEnd. The frame payload carries a
+ * class/method id and its arguments (METHOD), a content-header (HEADER), or opaque bytes (BODY) — decoding
+ * those is cross-frame, class-dependent state, so this minimal slice keeps the payload verbatim as hex
+ * (byte-perfect). The payload is bounded by the length field (the frame ends at offset 7+length, with the
+ * frame-end octet there), so a pipelined second frame or trailing bytes are left to the codec's recursion
+ * / RawData. Length is honored when supplied on encode (a crafted frame may lie), else derived from the
+ * payload bytes. A well-formed handshake or frame round-trips byte-for-byte.
+ */
+class AMQP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'amqp';
+        this.name = 'AMQP 0-9-1';
+        this.nickname = 'AMQP';
+        this.matchKeys = ['tcpport:5672'];
+        //Deliberately NOT a heuristicFallback: an AMQP frame header (type/channel/length) carries no strong
+        //content magic — a bare 1/2/3/8 type octet over a plausible channel/length would collide with all
+        //manner of binary TCP payloads — so recognition is confined to the well-known port bucket (5672).
+        //The "AMQP" literal is a strong signature, but it only appears on the one-shot connection handshake,
+        //not on ongoing frames, so it cannot carry the protocol off-port on its own.
+        this.heuristicFallback = false;
+        //A leaf header — the frame payload (class/method arguments, content headers, body) is cross-frame,
+        //class-dependent state kept as hex, not demuxed further.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (AMQP.#schemaCache ??= AMQP.#buildSchema());
+    }
+    /** True when this instance is (being) decoded/encoded as the 8-byte protocol-header handshake. */
+    #isHandshake() {
+        return Boolean(this.instance.isProtocolHeader.getValue(false));
+    }
+    /**
+     * A version octet of the protocol-header handshake (one of the four bytes after the "AMQP" literal,
+     * at `offset`). Only present in the handshake form: decode reads it when this is a handshake; encode
+     * writes it only when this is a handshake, so a frame never emits these bytes.
+     */
+    static #versionField(name, offset, label, defaultValue) {
+        return {
+            type: 'integer',
+            label: label,
+            minimum: 0,
+            maximum: 255,
+            default: defaultValue,
+            decode: function () {
+                if (!this.#isHandshake())
+                    return;
+                this.instance[name].setValue((0, BufferToNumber_1.BufferToUInt8)(this.readBytes(offset, 1)));
+            },
+            encode: function () {
+                if (!this.#isHandshake())
+                    return;
+                const node = this.instance[name];
+                let value = node.getValue(defaultValue, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                if (value > 255) {
+                    this.recordError(node.getPath(), 'Maximum value is 255');
+                    value = 255;
+                }
+                if (value < 0) {
+                    this.recordError(node.getPath(), 'Minimum value is 0');
+                    value = 0;
+                }
+                node.setValue(value);
+                this.writeBytes(offset, (0, NumberToBuffer_1.UInt8ToBuffer)(value));
+            }
+        };
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            //Two forms share one summary slot; `info` is a decode-only display field set to
+            //'protocol-header' for the handshake or 'type=<n>' for a frame (see the isProtocolHeader
+            //field below), so the rendered Info column reads "AMQP protocol-header" or "AMQP type=1".
+            summary: 'AMQP ${info}',
+            properties: {
+                //Discriminator + display. Decode inspects the first four octets: the "AMQP" literal marks
+                //the handshake, anything else is a frame. This field also fills the decode-only `info`
+                //display string (it needs the raw type octet, which it reads directly). On encode it is
+                //an input value (default false) that every other field branches on; it writes no bytes.
+                isProtocolHeader: {
+                    type: 'boolean',
+                    label: 'Is Protocol Header',
+                    default: false,
+                    decode: function () {
+                        const lead = this.readBytes(0, 4, true);
+                        const handshake = lead.length >= 4 && lead.equals(PROTOCOL_HEADER_MAGIC);
+                        this.instance.isProtocolHeader.setValue(handshake);
+                        this.instance.info.setValue(handshake ? 'protocol-header' : `type=${(0, BufferToNumber_1.BufferToUInt8)(this.readBytes(0, 1, true))}`);
+                    }
+                },
+                //Decode-only display string for the Info summary (populated above); carries no encode, so
+                //it never affects the emitted bytes.
+                info: { type: 'string', label: 'Info' },
+                // ===== Protocol-header handshake form ("AMQP" + four version octets) =====
+                protocol: {
+                    type: 'string',
+                    label: 'Protocol',
+                    default: 'AMQP',
+                    decode: function () {
+                        if (!this.#isHandshake())
+                            return;
+                        this.instance.protocol.setValue(this.readBytes(0, 4).toString('latin1'));
+                    },
+                    encode: function () {
+                        if (!this.#isHandshake())
+                            return;
+                        //Re-emit the 4-char literal verbatim (default "AMQP"); truncate/pad to 4 octets so
+                        //a crafted value can never shift the version octets that follow.
+                        const text = this.instance.protocol.getValue('AMQP');
+                        const bytes = Buffer.alloc(4, 0);
+                        Buffer.from(text, 'latin1').copy(bytes, 0, 0, 4);
+                        this.writeBytes(0, bytes);
+                    }
+                },
+                //The four version octets after the literal: protocol-id, major, minor, revision (0 0 9 1).
+                protocolId: this.#versionField('protocolId', 4, 'Protocol Id', 0),
+                versionMajor: this.#versionField('versionMajor', 5, 'Version Major', 0),
+                versionMinor: this.#versionField('versionMinor', 6, 'Version Minor', 9),
+                versionRevision: this.#versionField('versionRevision', 7, 'Version Revision', 1),
+                // ===== Frame form (type + channel + length + payload + frameEnd) =====
+                type: {
+                    type: 'integer',
+                    label: 'Type',
+                    minimum: 0,
+                    maximum: 255,
+                    default: 1,
+                    decode: function () {
+                        if (this.#isHandshake())
+                            return;
+                        this.instance.type.setValue((0, BufferToNumber_1.BufferToUInt8)(this.readBytes(0, 1)));
+                    },
+                    encode: function () {
+                        if (this.#isHandshake())
+                            return;
+                        const node = this.instance.type;
+                        let value = node.getValue(1, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 255) {
+                            this.recordError(node.getPath(), 'Maximum value is 255');
+                            value = 255;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBytes(0, (0, NumberToBuffer_1.UInt8ToBuffer)(value));
+                    }
+                },
+                channel: {
+                    type: 'integer',
+                    label: 'Channel',
+                    minimum: 0,
+                    maximum: 65535,
+                    default: 0,
+                    decode: function () {
+                        if (this.#isHandshake())
+                            return;
+                        this.instance.channel.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(1, 2)));
+                    },
+                    encode: function () {
+                        if (this.#isHandshake())
+                            return;
+                        const node = this.instance.channel;
+                        let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 65535) {
+                            this.recordError(node.getPath(), 'Maximum value is 65535');
+                            value = 65535;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBytes(1, (0, NumberToBuffer_1.UInt16ToBuffer)(value));
+                    }
+                },
+                //NOTE: Length is honored verbatim on encode (a crafted frame may lie), and the frameEnd is
+                //written at offset 7+Length, which auto-expands the buffer. A deliberately crafted Length near
+                //0xFFFFFFFF therefore drives a multi-GB allocation on re-encode — an instance of the codebase's
+                //general "writeBytes auto-expand vs read-clamp asymmetry on attacker-controlled length fields"
+                //(a scheduled hardening item at the BaseHeader level, wider here because the field is uint32 vs
+                //ENIP's uint16). It does not break the never-throws contract (the RangeError is caught and
+                //recorded), and a well-formed frame (Length == payload bytes) never triggers it.
+                length: {
+                    type: 'integer',
+                    label: 'Length',
+                    minimum: 0,
+                    maximum: 4294967295,
+                    decode: function () {
+                        if (this.#isHandshake())
+                            return;
+                        this.instance.length.setValue((0, BufferToNumber_1.BufferToUInt32)(this.readBytes(3, 4)));
+                    },
+                    encode: function () {
+                        if (this.#isHandshake())
+                            return;
+                        //Length counts the payload octets between the header and the frame-end marker.
+                        //Honored when supplied (a crafted frame may lie); else derived from the payload.
+                        const provided = this.instance.length.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : (0, HexToBuffer_1.HexToBuffer)(this.instance.payload.getValue('')).length;
+                        if (value > 4294967295) {
+                            this.recordError(this.instance.length.getPath(), 'Maximum value is 4294967295');
+                            value = 4294967295;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.length.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.length.setValue(value);
+                        this.writeBytes(3, (0, NumberToBuffer_1.UInt32ToBuffer)(value));
+                    }
+                },
+                //The frame payload, kept verbatim. Bounded by the length field (payload ends at offset
+                //7+length) and the captured bytes, so a pipelined/trailing frame is left to the codec's
+                //recursion / RawData.
+                payload: {
+                    type: 'string',
+                    label: 'Payload',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        if (this.#isHandshake())
+                            return;
+                        const remaining = this.packet.length - this.startPos;
+                        const length = this.instance.length.getValue(0);
+                        let end = 7 + length;
+                        if (end > remaining)
+                            end = remaining;
+                        this.instance.payload.setValue(end > 7 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(7, end - 7)) : '');
+                    },
+                    encode: function () {
+                        if (this.#isHandshake())
+                            return;
+                        const payload = this.instance.payload.getValue('');
+                        if (payload)
+                            this.writeBytes(7, (0, HexToBuffer_1.HexToBuffer)(payload));
+                    }
+                },
+                frameEnd: {
+                    type: 'integer',
+                    label: 'Frame End',
+                    minimum: 0,
+                    maximum: 255,
+                    default: FRAME_END,
+                    decode: function () {
+                        if (this.#isHandshake())
+                            return;
+                        const length = this.instance.length.getValue(0);
+                        this.instance.frameEnd.setValue((0, BufferToNumber_1.BufferToUInt8)(this.readBytes(7 + length, 1)));
+                    },
+                    encode: function () {
+                        if (this.#isHandshake())
+                            return;
+                        //Sits right after the payload; its offset depends on the length written above
+                        //(the length field encodes before this one), so re-derive the same length.
+                        const provided = this.instance.length.getValue();
+                        const length = (provided !== undefined && provided !== null)
+                            ? provided
+                            : (0, HexToBuffer_1.HexToBuffer)(this.instance.payload.getValue('')).length;
+                        const node = this.instance.frameEnd;
+                        let value = node.getValue(FRAME_END, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 255) {
+                            this.recordError(node.getPath(), 'Maximum value is 255');
+                            value = 255;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBytes(7 + length, (0, NumberToBuffer_1.UInt8ToBuffer)(value));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //AMQP rides on TCP port 5672. Accept either the connection-start protocol-header literal ("AMQP")
+        //or a frame whose leading octet is a known frame type with the fixed 7-byte header present.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        const remaining = this.packet.length - this.startPos;
+        if (remaining < 1)
+            return false;
+        if (remaining >= 4 && this.readBytes(0, 4, true).equals(PROTOCOL_HEADER_MAGIC))
+            return true;
+        return remaining >= 8 && FRAME_TYPES.includes((0, BufferToNumber_1.BufferToUInt8)(this.readBytes(0, 1, true)));
+    }
+}
+exports.AMQP = AMQP;

package/dist/headers/ARP.d.ts

@@ -0,0 +1,26 @@
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { BaseHeader } from '../abstracts/BaseHeader';
+/**
+ * ARP — Address Resolution Protocol (RFC 826), carried directly on Ethernet with EtherType 0x0806.
+ * This codec decodes the classic 28-octet IPv4-over-Ethernet ARP packet, whose wire layout is: a 16-bit
+ * Hardware Type (`hardware.type`, offset 0), a 16-bit Protocol Type (`protocol.type`, offset 2, kept as a
+ * 4-hex string e.g. "0800"), an 8-bit Hardware Address Length (`hardware.size`, offset 4), an 8-bit
+ * Protocol Address Length (`protocol.size`, offset 5), a 16-bit Opcode (offset 6; 1 request, 2 reply,
+ * 3 RARP request, 4 RARP reply — other values are flagged as an error but kept), then the four address
+ * fields: Sender MAC (`sender.mac`, 6 octets, offset 8) and Sender IPv4 (`sender.ipv4`, 4 octets, offset
+ * 14), Target MAC (`target.mac`, 6 octets, offset 18) and Target IPv4 (`target.ipv4`, 4 octets, offset
+ * 24). The schema groups the two `hardware`/`protocol` sub-objects and two `sender`/`target` sub-objects
+ * for the UI, but each field reads its own fixed offset, so the on-wire interleaving is preserved.
+ *
+ * The 6-octet MAC and 4-octet IPv4 widths are fixed here (Ethernet + IPv4 ARP), independent of the
+ * declared hardware/protocol sizes. Values are range-clamped rather than rejected. match() keys purely
+ * on the parent's EtherType being 0x0806.
+ */
+export declare class ARP extends BaseHeader {
+    SCHEMA: ProtocolJSONSchema;
+    readonly id: string;
+    readonly matchKeys: string[];
+    readonly name: string;
+    readonly nickname: string;
+    match(): boolean;
+}

package/dist/headers/ARP.js

@@ -0,0 +1,243 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ARP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const NumberToHex_1 = require("../helper/NumberToHex");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+const HexToNumber_1 = require("../helper/HexToNumber");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const BufferToIP_1 = require("../helper/BufferToIP");
+const IPToBuffer_1 = require("../helper/IPToBuffer");
+/**
+ * ARP — Address Resolution Protocol (RFC 826), carried directly on Ethernet with EtherType 0x0806.
+ * This codec decodes the classic 28-octet IPv4-over-Ethernet ARP packet, whose wire layout is: a 16-bit
+ * Hardware Type (`hardware.type`, offset 0), a 16-bit Protocol Type (`protocol.type`, offset 2, kept as a
+ * 4-hex string e.g. "0800"), an 8-bit Hardware Address Length (`hardware.size`, offset 4), an 8-bit
+ * Protocol Address Length (`protocol.size`, offset 5), a 16-bit Opcode (offset 6; 1 request, 2 reply,
+ * 3 RARP request, 4 RARP reply — other values are flagged as an error but kept), then the four address
+ * fields: Sender MAC (`sender.mac`, 6 octets, offset 8) and Sender IPv4 (`sender.ipv4`, 4 octets, offset
+ * 14), Target MAC (`target.mac`, 6 octets, offset 18) and Target IPv4 (`target.ipv4`, 4 octets, offset
+ * 24). The schema groups the two `hardware`/`protocol` sub-objects and two `sender`/`target` sub-objects
+ * for the UI, but each field reads its own fixed offset, so the on-wire interleaving is preserved.
+ *
+ * The 6-octet MAC and 4-octet IPv4 widths are fixed here (Ethernet + IPv4 ARP), independent of the
+ * declared hardware/protocol sizes. Values are range-clamped rather than rejected. match() keys purely
+ * on the parent's EtherType being 0x0806.
+ */
+class ARP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.SCHEMA = {
+            type: 'object',
+            properties: {
+                hardware: {
+                    type: 'object',
+                    label: 'Hardware',
+                    properties: {
+                        type: {
+                            type: 'number',
+                            label: 'Type',
+                            minimum: 0,
+                            maximum: 65535,
+                            decode: () => {
+                                //Hardware type is an unsigned 16-bit field (RFC 826); a signed read would
+                                //turn values >= 0x8000 negative and mismatch the unsigned encode path.
+                                this.instance.hardware.type.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(0, 2)));
+                            },
+                            encode: () => {
+                                let hwType = this.instance.hardware.type.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                                if (hwType > 65535) {
+                                    this.recordError(this.instance.hardware.type.getPath(), 'Maximum value is 65535');
+                                    hwType = 65535;
+                                }
+                                if (hwType < 0) {
+                                    this.recordError(this.instance.hardware.type.getPath(), 'Minimum value is 0');
+                                    hwType = 0;
+                                }
+                                this.instance.hardware.type.setValue(hwType);
+                                this.writeBytes(0, (0, NumberToBuffer_1.UInt16ToBuffer)(hwType));
+                            }
+                        },
+                        size: {
+                            type: 'number',
+                            label: 'Size',
+                            minimum: 0,
+                            maximum: 255,
+                            decode: () => {
+                                this.instance.hardware.size.setValue((0, BufferToNumber_1.BufferToUInt8)(this.readBytes(4, 1)));
+                            },
+                            encode: () => {
+                                let hwSize = this.instance.hardware.size.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                                if (hwSize > 255) {
+                                    this.recordError(this.instance.hardware.size.getPath(), 'Maximum value is 255');
+                                    hwSize = 255;
+                                }
+                                if (hwSize < 0) {
+                                    this.recordError(this.instance.hardware.size.getPath(), 'Minimum value is 0');
+                                    hwSize = 0;
+                                }
+                                this.instance.hardware.size.setValue(hwSize);
+                                this.writeBytes(4, (0, NumberToBuffer_1.UInt8ToBuffer)(hwSize));
+                            }
+                        }
+                    }
+                },
+                protocol: {
+                    type: 'object',
+                    label: 'Protocol',
+                    properties: {
+                        type: {
+                            type: 'string',
+                            label: 'Type',
+                            minLength: 4,
+                            maxLength: 4,
+                            contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                            decode: () => {
+                                this.instance.protocol.type.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(2, 2)));
+                            },
+                            encode: () => {
+                                const protoTypeHex = this.instance.protocol.type.getValue('0000', (nodePath) => this.recordError(nodePath, 'Not Found'));
+                                let protoType = (0, HexToNumber_1.HexToUInt16)(protoTypeHex);
+                                if (isNaN(protoType)) {
+                                    this.recordError(this.instance.protocol.type.getPath(), 'Invalid hex value');
+                                    protoType = 0;
+                                }
+                                this.instance.protocol.type.setValue(protoType);
+                                this.writeBytes(2, (0, NumberToBuffer_1.UInt16ToBuffer)(protoType));
+                            }
+                        },
+                        size: {
+                            type: 'number',
+                            label: 'Size',
+                            minimum: 0,
+                            maximum: 255,
+                            decode: () => {
+                                this.instance.protocol.size.setValue((0, BufferToNumber_1.BufferToUInt8)(this.readBytes(5, 1)));
+                            },
+                            encode: () => {
+                                let protoSize = this.instance.protocol.size.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                                if (protoSize > 255) {
+                                    this.recordError(this.instance.protocol.size.getPath(), 'Maximum value is 255');
+                                    protoSize = 255;
+                                }
+                                if (protoSize < 0) {
+                                    this.recordError(this.instance.protocol.size.getPath(), 'Minimum value is 0');
+                                    protoSize = 0;
+                                }
+                                this.instance.protocol.size.setValue(protoSize);
+                                this.writeBytes(5, (0, NumberToBuffer_1.UInt8ToBuffer)(protoSize));
+                            }
+                        }
+                    }
+                },
+                opcode: {
+                    type: 'number',
+                    label: 'Opcode',
+                    enum: [1, 2, 3, 4],
+                    decode: () => {
+                        this.instance.opcode.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(6, 2)));
+                        if (![1, 2, 3, 4].includes(this.instance.opcode.getValue()))
+                            this.recordError(this.instance.opcode.getPath(), 'Opcode should be 1, 2, 3 or 4');
+                    },
+                    encode: () => {
+                        const opcode = this.instance.opcode.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (![1, 2, 3, 4].includes(opcode))
+                            this.recordError(this.instance.opcode.getPath(), 'Opcode should be 1, 2, 3 or 4');
+                        this.instance.opcode.setValue(opcode);
+                        this.writeBytes(6, (0, NumberToBuffer_1.UInt16ToBuffer)(opcode));
+                    }
+                },
+                sender: {
+                    type: 'object',
+                    label: 'Sender',
+                    properties: {
+                        mac: {
+                            type: 'string',
+                            label: 'MAC address',
+                            minLength: 17,
+                            maxLength: 17,
+                            contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.UTF8,
+                            decode: () => {
+                                const macAddrBuffer = Buffer.alloc(6, this.readBytes(8, 6));
+                                this.instance.sender.mac.setValue(Array.from(macAddrBuffer).map((value) => (0, NumberToHex_1.UInt8ToHex)(value)).join(':'));
+                            },
+                            encode: () => {
+                                const macStr = this.instance.sender.mac.getValue();
+                                const rawMacBuffer = Buffer.from(macStr.split(':').map((value) => parseInt(value, 16)).map((value) => value ? value : 0));
+                                if (rawMacBuffer.length !== 6)
+                                    this.recordError(this.instance.sender.mac.getPath(), 'Invalid MAC address length');
+                                this.writeBytes(8, Buffer.alloc(6, rawMacBuffer));
+                            }
+                        },
+                        ipv4: {
+                            type: 'string',
+                            label: 'IP address',
+                            minLength: 7,
+                            maxLength: 15,
+                            contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.UTF8,
+                            decode: () => {
+                                const ipv4Buffer = Buffer.alloc(4, this.readBytes(14, 4));
+                                this.instance.sender.ipv4.setValue((0, BufferToIP_1.BufferToIPv4)(ipv4Buffer));
+                            },
+                            encode: () => {
+                                const ipv4Str = this.instance.sender.ipv4.getValue();
+                                this.writeBytes(14, (0, IPToBuffer_1.IPv4ToBuffer)(ipv4Str));
+                            }
+                        }
+                    }
+                },
+                target: {
+                    type: 'object',
+                    label: 'Target',
+                    properties: {
+                        mac: {
+                            type: 'string',
+                            label: 'MAC address',
+                            minLength: 17,
+                            maxLength: 17,
+                            contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.UTF8,
+                            decode: () => {
+                                const macAddrBuffer = Buffer.alloc(6, this.readBytes(18, 6));
+                                this.instance.target.mac.setValue(Array.from(macAddrBuffer).map((value) => (0, NumberToHex_1.UInt8ToHex)(value)).join(':'));
+                            },
+                            encode: () => {
+                                const macStr = this.instance.target.mac.getValue();
+                                const rawMacBuffer = Buffer.from(macStr.split(':').map((value) => parseInt(value, 16)).map((value) => value ? value : 0));
+                                if (rawMacBuffer.length !== 6)
+                                    this.recordError(this.instance.target.mac.getPath(), 'Invalid MAC address length');
+                                this.writeBytes(18, Buffer.alloc(6, rawMacBuffer));
+                            }
+                        },
+                        ipv4: {
+                            type: 'string',
+                            label: 'IP address',
+                            minLength: 7,
+                            maxLength: 15,
+                            contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.UTF8,
+                            decode: () => {
+                                const ipv4Buffer = Buffer.alloc(4, this.readBytes(24, 4));
+                                this.instance.target.ipv4.setValue((0, BufferToIP_1.BufferToIPv4)(ipv4Buffer));
+                            },
+                            encode: () => {
+                                const ipv4Str = this.instance.target.ipv4.getValue();
+                                this.writeBytes(24, (0, IPToBuffer_1.IPv4ToBuffer)(ipv4Str));
+                            }
+                        }
+                    }
+                }
+            }
+        };
+        this.id = 'arp';
+        this.matchKeys = ['ethertype:0806'];
+        this.name = 'Address Resolution Protocol';
+        this.nickname = 'ARP';
+    }
+    match() {
+        if (!this.prevCodecModule)
+            return false;
+        return this.prevCodecModule.instance.etherType.getValue() === (0, NumberToHex_1.UInt16ToHex)(0x0806);
+    }
+}
+exports.ARP = ARP;

package/dist/headers/BACnetIP.d.ts

@@ -0,0 +1,27 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * BACnet/IP — the BACnet Virtual Link Control (BVLC) layer that carries BACnet over UDP (ANSI/ASHRAE
+ * 135 Annex J), UDP port 47808 (0xBAC0). Every message starts with a 4-byte BVLC header: a Type octet
+ * (0x81 for BACnet/IP), a Function octet (e.g. Original-Unicast-NPDU 0x0A, Original-Broadcast-NPDU 0x0B,
+ * Forwarded-NPDU 0x04, BVLC-Result 0x00), and a 2-byte Length that counts the WHOLE BVLC message
+ * (header + everything after). The bytes after the header are the NPDU and APDU (and, for a few
+ * functions, a BVLC-specific address prefix).
+ *
+ * This codec decodes the BVLC header structurally and keeps the NPDU + APDU verbatim as `payload` hex,
+ * bounded by the BVLC Length (so a trailing/coalesced datagram is left to RawData). The NPDU's
+ * conditional routing fields are intricate enough that structuring them belongs to a later slice. The
+ * Length is honored when supplied, else derived from the payload; a well-formed message round-trips
+ * byte-for-byte.
+ */
+export declare class BACnetIP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}