@netkitty/codec 1.0.0

package/dist/headers/VXLAN.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VXLAN = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+/**
+ * VXLAN — Virtual eXtensible LAN (RFC 7348), a Layer-2-over-UDP overlay on UDP port 4789. An 8-byte
+ * header — Flags(1, the 'I' bit marks the VNI valid), 3 reserved bytes, the 24-bit VNI (VXLAN Network
+ * Identifier), and 1 reserved byte — is followed by a COMPLETE inner Ethernet frame.
+ *
+ * This codec decodes only its own 8-byte header (headerLength = 8); the inner Ethernet frame is left to
+ * the codec's normal recursion, which decodes it as a fresh eth/ip/… stack. That works because
+ * EthernetII.match() already accepts a tunnel (vxlan/gre/geneve/…) as its parent — the demux
+ * generalization anticipates tunnels — so an inner Ethernet frame after VXLAN is dispatched to
+ * EthernetII automatically. The whole nested packet round-trips byte-for-byte layer by layer.
+ */
+class VXLAN extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'vxlan';
+        this.name = 'Virtual eXtensible Local Area Network';
+        this.nickname = 'VXLAN';
+        this.matchKeys = ['udpport:4789'];
+        //Produces no demux key of its own; the inner Ethernet frame is matched by EthernetII's tunnel-aware
+        //match() (which lists 'vxlan' as an accepted parent), so recursion decodes the inner stack.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (VXLAN.#schemaCache ??= VXLAN.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'VXLAN vni=${vni}',
+            properties: {
+                flags: this.fieldUInt('flags', 0, 1, 'Flags'),
+                reserved1: this.fieldHex('reserved1', 1, 3, 'Reserved'),
+                vni: {
+                    type: 'integer',
+                    label: 'VNI',
+                    minimum: 0,
+                    maximum: 16777215,
+                    decode: function () {
+                        this.instance.vni.setValue(this.readBits(4, 3, 0, 24));
+                    },
+                    encode: function () {
+                        let vni = this.instance.vni.getValue(0);
+                        if (vni > 16777215) {
+                            this.recordError(this.instance.vni.getPath(), 'Maximum value is 16777215');
+                            vni = 16777215;
+                        }
+                        if (vni < 0) {
+                            this.recordError(this.instance.vni.getPath(), 'Minimum value is 0');
+                            vni = 0;
+                        }
+                        this.instance.vni.setValue(vni);
+                        this.writeBits(4, 3, 0, 24, vni);
+                    }
+                },
+                reserved2: this.fieldHex('reserved2', 7, 1, 'Reserved')
+            }
+        };
+    }
+    match() {
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        //Require the 8-byte header within the UDP payload (not just the captured frame — see RADIUS).
+        let available = this.packet.length - this.startPos;
+        const udpLength = this.prevCodecModule.instance.length.getValue(0);
+        if (udpLength >= 8 && udpLength - 8 < available)
+            available = udpLength - 8;
+        return available >= 8;
+    }
+}
+exports.VXLAN = VXLAN;

package/dist/headers/WCCP.d.ts

@@ -0,0 +1,29 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * WCCP v2 — Web Cache Communication Protocol version 2 (Cisco, draft-wilson-wrec-wccp-v2), carried over
+ * UDP port 2048. Every WCCP v2 message begins with a fixed 8-byte header — a 4-byte message Type
+ * (0x0000000A Here-I-Am, 0x0000000B I-See-You, 0x0000000C Redirect-Assign, 0x0000000D Removal-Query),
+ * a 2-byte Version (0x0200 for WCCP v2) and a 2-byte Length (the octet count of the component data that
+ * follows the header, NOT including these 8 bytes) — followed by a sequence of component TLVs (each a
+ * 2-byte component Type, a 2-byte component Length, and a value).
+ *
+ * The component layout differs per message type and per component (Security Info, Service Info,
+ * Web-Cache/Router Identity, Assignment, Capabilities, Command Extension) and several sub-structures
+ * need cross-message context, so this codec keeps the component region verbatim as `components` hex
+ * (byte-perfect) and does not sub-decode it. The Length is honored when supplied (a crafted message may
+ * lie) and derived from the component bytes only when absent; the message is bounded by BOTH Length and
+ * the UDP payload so a trailing datagram / padding is left to the codec's recursion / RawData. A
+ * well-formed message round-trips byte-for-byte. This is a leaf header — nothing demuxes off WCCP.
+ */
+export declare class WCCP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/WCCP.js

@@ -0,0 +1,117 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WCCP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * WCCP v2 — Web Cache Communication Protocol version 2 (Cisco, draft-wilson-wrec-wccp-v2), carried over
+ * UDP port 2048. Every WCCP v2 message begins with a fixed 8-byte header — a 4-byte message Type
+ * (0x0000000A Here-I-Am, 0x0000000B I-See-You, 0x0000000C Redirect-Assign, 0x0000000D Removal-Query),
+ * a 2-byte Version (0x0200 for WCCP v2) and a 2-byte Length (the octet count of the component data that
+ * follows the header, NOT including these 8 bytes) — followed by a sequence of component TLVs (each a
+ * 2-byte component Type, a 2-byte component Length, and a value).
+ *
+ * The component layout differs per message type and per component (Security Info, Service Info,
+ * Web-Cache/Router Identity, Assignment, Capabilities, Command Extension) and several sub-structures
+ * need cross-message context, so this codec keeps the component region verbatim as `components` hex
+ * (byte-perfect) and does not sub-decode it. The Length is honored when supplied (a crafted message may
+ * lie) and derived from the component bytes only when absent; the message is bounded by BOTH Length and
+ * the UDP payload so a trailing datagram / padding is left to the codec's recursion / RawData. A
+ * well-formed message round-trips byte-for-byte. This is a leaf header — nothing demuxes off WCCP.
+ */
+class WCCP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'wccp';
+        this.name = 'Web Cache Communication Protocol';
+        this.nickname = 'WCCP';
+        //Port-defined (udp:2048). WCCP v2 does carry a content signature (Version = 0x0200), but that alone
+        //is weak, so it stays a plain bucket entry (no heuristicFallback): WCCP only when it rides UDP/2048.
+        this.matchKeys = ['udpport:2048'];
+        //A leaf header — the component TLVs require per-type, cross-message parsing and are kept verbatim.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (WCCP.#schemaCache ??= WCCP.#buildSchema());
+    }
+    /** Bytes available for this WCCP message: the frame end, clamped by the UDP payload length. */
+    #available() {
+        let available = this.packet.length - this.startPos;
+        if (this.prevCodecModule && this.prevCodecModule.id === 'udp') {
+            const udpLength = this.prevCodecModule.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < available)
+                available = udpLength - 8;
+        }
+        return available < 0 ? 0 : available;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'WCCP type=${type} len=${length}',
+            properties: {
+                type: this.fieldUInt('type', 0, 4, 'Type'),
+                version: this.fieldUInt('version', 4, 2, 'Version'),
+                length: {
+                    type: 'integer',
+                    label: 'Length',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        this.instance.length.setValue(this.readBytes(6, 2).readUInt16BE(0));
+                    },
+                    encode: function () {
+                        //Length counts only the component data after the 8-byte header. Honored when
+                        //supplied (a crafted message may lie); else derived from the component bytes.
+                        const provided = this.instance.length.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : (0, HexToBuffer_1.HexToBuffer)(this.instance.components.getValue('')).length;
+                        if (value > 65535) {
+                            this.recordError(this.instance.length.getPath(), 'Maximum value is 65535');
+                            value = 65535;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.length.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.length.setValue(value);
+                        this.writeBytes(6, (0, NumberToBuffer_1.UInt16ToBuffer)(value));
+                    }
+                },
+                //The component TLV region after the 8-byte header, kept verbatim. Bounded by BOTH the
+                //message Length (the message ends at 8 + Length) and the UDP payload, so trailing /
+                //pipelined data is left to the codec's recursion / RawData.
+                components: {
+                    type: 'string',
+                    label: 'Components',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#available();
+                        const length = this.instance.length.getValue(0);
+                        let end = 8 + length;
+                        if (end > available)
+                            end = available;
+                        this.instance.components.setValue(end > 8 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(8, end - 8)) : '');
+                    },
+                    encode: function () {
+                        const components = this.instance.components.getValue('');
+                        if (components)
+                            this.writeBytes(8, (0, HexToBuffer_1.HexToBuffer)(components));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //WCCP rides on UDP port 2048. Require the full 8-byte header within the UDP payload (bounded by
+        //udp.length, not the whole frame remainder, so Ethernet padding is not mis-claimed).
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        return this.#available() >= 8;
+    }
+}
+exports.WCCP = WCCP;

package/dist/headers/WHOIS.d.ts

@@ -0,0 +1,37 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * WHOIS — the WHOIS Protocol (RFC 3912), carried over TCP well-known port 43. WHOIS is deliberately
+ * trivial on the wire: the client opens the connection and sends a single US-ASCII request line
+ * `<query>\r\n` (e.g. `example.com\r\n`); the server replies with free-form US-ASCII text (the registry
+ * record, terminated by the server closing the connection). There is no framing, no length prefix, and
+ * no content magic in either direction — a request is just a line of text and a response is just text.
+ *
+ * MINIMAL slice (mirrors the SSH-identification / Telnet verbatim-message pattern): the stream has no
+ * per-message structure, so the ENTIRE payload is the single source of truth — decoded verbatim to hex
+ * in the authoritative `message` field and re-emitted byte-for-byte on encode. On top of that, the first
+ * line of the payload is parsed into a DISPLAY-ONLY `query` field (the request domain, or the first line
+ * of a response) and an `isQuery` flag (true when the whole payload is a single CR-LF-terminated line —
+ * the classic request shape). Those display fields carry no codec of their own and never reconstruct the
+ * bytes — the `message` owns them. So any WHOIS payload (a request line, a multi-line response record, or
+ * a truncated fragment) round-trips exactly.
+ *
+ * Matching rationale (NO heuristicFallback): WHOIS is claimed ONLY on the tcp:43 bucket. WHOIS has NO
+ * distinctive off-port content signature — a request is an arbitrary domain line and a response is
+ * arbitrary text, indistinguishable from any other line-oriented TCP payload — so recognizing it relies
+ * entirely on the well-known port. Joining the global content-heuristic chain would let WHOIS mislabel
+ * arbitrary TCP payloads on any port. Confining WHOIS to tcp:43 keeps that impossible; alt-port WHOIS is
+ * rare and falls losslessly to raw. For the same reason match() does NOT gate on printable text: on the
+ * port-43 bucket every payload IS WHOIS, so any non-empty payload is kept verbatim rather than dropped.
+ */
+export declare class WHOIS extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/WHOIS.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WHOIS = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * WHOIS — the WHOIS Protocol (RFC 3912), carried over TCP well-known port 43. WHOIS is deliberately
+ * trivial on the wire: the client opens the connection and sends a single US-ASCII request line
+ * `<query>\r\n` (e.g. `example.com\r\n`); the server replies with free-form US-ASCII text (the registry
+ * record, terminated by the server closing the connection). There is no framing, no length prefix, and
+ * no content magic in either direction — a request is just a line of text and a response is just text.
+ *
+ * MINIMAL slice (mirrors the SSH-identification / Telnet verbatim-message pattern): the stream has no
+ * per-message structure, so the ENTIRE payload is the single source of truth — decoded verbatim to hex
+ * in the authoritative `message` field and re-emitted byte-for-byte on encode. On top of that, the first
+ * line of the payload is parsed into a DISPLAY-ONLY `query` field (the request domain, or the first line
+ * of a response) and an `isQuery` flag (true when the whole payload is a single CR-LF-terminated line —
+ * the classic request shape). Those display fields carry no codec of their own and never reconstruct the
+ * bytes — the `message` owns them. So any WHOIS payload (a request line, a multi-line response record, or
+ * a truncated fragment) round-trips exactly.
+ *
+ * Matching rationale (NO heuristicFallback): WHOIS is claimed ONLY on the tcp:43 bucket. WHOIS has NO
+ * distinctive off-port content signature — a request is an arbitrary domain line and a response is
+ * arbitrary text, indistinguishable from any other line-oriented TCP payload — so recognizing it relies
+ * entirely on the well-known port. Joining the global content-heuristic chain would let WHOIS mislabel
+ * arbitrary TCP payloads on any port. Confining WHOIS to tcp:43 keeps that impossible; alt-port WHOIS is
+ * rare and falls losslessly to raw. For the same reason match() does NOT gate on printable text: on the
+ * port-43 bucket every payload IS WHOIS, so any non-empty payload is kept verbatim rather than dropped.
+ */
+class WHOIS extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'whois';
+        this.name = 'WHOIS';
+        this.nickname = 'WHOIS';
+        //WHOIS is recognized ONLY on the well-known port 43 — deliberately NOT via heuristicFallback. WHOIS
+        //is a line-oriented text stream with no distinctive off-port content signature (a request is an
+        //arbitrary domain and a response is arbitrary text), so its recognition depends entirely on the port
+        //bucket; joining the global heuristic chain would mislabel arbitrary TCP traffic. See the class doc.
+        this.matchKeys = ['tcpport:43'];
+        //A leaf header — a WHOIS request/response is the application data itself; nothing demuxes off it.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (WHOIS.#schemaCache ??= WHOIS.#buildSchema());
+    }
+    /** Bytes available to this header: WHOIS rides on TCP, which has no per-message length. */
+    #payloadLength() {
+        const available = this.packet.length - this.startPos;
+        return available < 0 ? 0 : available;
+    }
+    /**
+     * Parse the display-only metadata from the verbatim payload. `query` is the first line with its
+     * trailing CR/LF stripped (the request domain, or the opening line of a response). `isQuery` is true
+     * when the whole payload is exactly one CR-LF-terminated line — the classic client request shape.
+     * Populated on decode only — these fields have no encode, so they never affect the re-emitted bytes
+     * and never mutate `message`. Never throws: an empty or line-less payload yields an empty query.
+     */
+    #parseQuery(raw) {
+        const text = raw.toString('latin1');
+        let firstLine = text;
+        const lf = firstLine.indexOf('\n');
+        if (lf >= 0)
+            firstLine = firstLine.slice(0, lf);
+        if (firstLine.endsWith('\r'))
+            firstLine = firstLine.slice(0, -1);
+        this.instance.query.setValue(firstLine);
+        //The classic request is a single `<query>\r\n` line: exactly one line ending, at the very end.
+        const isQuery = (text.endsWith('\r\n') || text.endsWith('\n')) && text.indexOf('\n') === text.length - 1;
+        this.instance.isQuery.setValue(isQuery);
+        this.instance.summaryInfo.setValue(firstLine ? firstLine : (raw.length > 0 ? 'response' : ''));
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'WHOIS ${summaryInfo}',
+            properties: {
+                //Display-only metadata parsed from the verbatim payload on decode (no encode — populated
+                //by the `message` field below, never read back). `query` is the first line (the request
+                //domain or a response's opening line); `isQuery` flags the single-line request shape.
+                isQuery: { type: 'boolean', label: 'Is Query', default: false },
+                query: { type: 'string', label: 'Query', default: '' },
+                //Drives the one-line summary: the first line of the payload, else 'response'.
+                summaryInfo: { type: 'string', label: 'Summary', hidden: true, default: '' },
+                //The whole raw payload is the single source of truth: decoded verbatim to hex and
+                //re-emitted untouched (byte-perfect for any WHOIS payload). The first line is parsed into
+                //the display-only metadata above, which carry no codec of their own.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    default: '',
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        if (available <= 0) {
+                            this.instance.message.setValue('');
+                            this.#parseQuery(Buffer.alloc(0));
+                            return;
+                        }
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parseQuery(raw);
+                    },
+                    encode: function () {
+                        //Re-emit the authoritative payload verbatim — never reconstruct from metadata.
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Reached only on the tcp:43 bucket. Port 43 IS WHOIS's, so any non-empty payload over TCP is
+        //claimed and kept verbatim (byte-perfect) — deliberately without a printable-text gate, so a
+        //non-ASCII fragment is never wrongly dropped to raw. An empty payload is not claimed.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'tcp')
+            return false;
+        return this.#payloadLength() >= 1;
+    }
+}
+exports.WHOIS = WHOIS;

package/dist/headers/WSDiscovery.d.ts

@@ -0,0 +1,29 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * WS-Discovery — Web Services Dynamic Discovery (OASIS, WS-Discovery 1.0/1.1), the multicast SOAP
+ * protocol devices use to announce themselves and find each other on a local link. Messages are SOAP
+ * 1.2 envelopes (XML) carried in UDP datagrams to the multicast group 239.255.255.250:3702 (IPv4) or
+ * [FF02::C]:3702 (IPv6). The five message kinds — Hello / Bye / Probe / ProbeMatches / Resolve /
+ * ResolveMatches — are distinguished only by the WS-Addressing `Action` URI inside the envelope, not by
+ * any binary framing.
+ *
+ * Like SIP and HTTP, the message body is XML whose full internal structure (namespaces, header blocks,
+ * an arbitrary SOAP body) is far richer than a form needs — and byte-exact whitespace/attribute ordering
+ * is significant to some peers and to any signature. So the ENTIRE raw datagram payload is kept verbatim
+ * as the authoritative `message` field (hex) and re-emitted untouched; only the WS-Addressing `Action`
+ * URI is parsed on decode into display-only metadata (the full Action and its short message type). Encode
+ * never reconstructs the XML from the parsed fields — it writes `message` back byte-for-byte — so any
+ * conformant (or even malformed) WS-Discovery datagram round-trips exactly.
+ */
+export declare class WSDiscovery extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/WSDiscovery.js

@@ -0,0 +1,118 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WSDiscovery = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * WS-Discovery — Web Services Dynamic Discovery (OASIS, WS-Discovery 1.0/1.1), the multicast SOAP
+ * protocol devices use to announce themselves and find each other on a local link. Messages are SOAP
+ * 1.2 envelopes (XML) carried in UDP datagrams to the multicast group 239.255.255.250:3702 (IPv4) or
+ * [FF02::C]:3702 (IPv6). The five message kinds — Hello / Bye / Probe / ProbeMatches / Resolve /
+ * ResolveMatches — are distinguished only by the WS-Addressing `Action` URI inside the envelope, not by
+ * any binary framing.
+ *
+ * Like SIP and HTTP, the message body is XML whose full internal structure (namespaces, header blocks,
+ * an arbitrary SOAP body) is far richer than a form needs — and byte-exact whitespace/attribute ordering
+ * is significant to some peers and to any signature. So the ENTIRE raw datagram payload is kept verbatim
+ * as the authoritative `message` field (hex) and re-emitted untouched; only the WS-Addressing `Action`
+ * URI is parsed on decode into display-only metadata (the full Action and its short message type). Encode
+ * never reconstructs the XML from the parsed fields — it writes `message` back byte-for-byte — so any
+ * conformant (or even malformed) WS-Discovery datagram round-trips exactly.
+ */
+class WSDiscovery extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'wsdiscovery';
+        this.name = 'Web Services Dynamic Discovery';
+        this.nickname = 'WS-Discovery';
+        this.matchKeys = ['udpport:3702'];
+        //A leaf header — the SOAP envelope's internals and the discovery exchange it belongs to are a
+        //higher-layer concern.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (WSDiscovery.#schemaCache ??= WSDiscovery.#buildSchema());
+    }
+    /**
+     * Bytes of this header: WS-Discovery rides on UDP, so the payload is bounded by the datagram length
+     * (so a retained FCS/padding is not absorbed); falls back to the rest of the packet if the UDP length
+     * is implausible. Never negative.
+     */
+    #payloadLength() {
+        let available = this.packet.length - this.startPos;
+        if (this.prevCodecModule && this.prevCodecModule.id === 'udp') {
+            const udpLength = this.prevCodecModule.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < available)
+                available = udpLength - 8;
+        }
+        return available < 0 ? 0 : available;
+    }
+    /**
+     * Parse the WS-Addressing Action URI into the display-only metadata. The Action element is
+     * namespace-prefixed (e.g. `<wsa:Action>` or `<a:Action>`), so the prefix is matched loosely; the
+     * short message type is the last path segment of the URI (Probe / Hello / Bye / ProbeMatches / …).
+     * Populated on decode only — these fields have no encode, so they never affect the re-emitted bytes.
+     * Never throws: a missing Action yields empty strings.
+     */
+    #parseAction(text) {
+        const match = text.match(/<(?:[\w.-]+:)?Action\b[^>]*>([\s\S]*?)<\/(?:[\w.-]+:)?Action\s*>/);
+        const action = match ? match[1].trim() : '';
+        this.instance.action.setValue(action);
+        //Short message type = last non-empty path segment of the Action URI.
+        const segments = action.split('/').filter((segment) => segment.length > 0);
+        this.instance.messageType.setValue(segments.length > 0 ? segments[segments.length - 1] : '');
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'WS-Discovery ${messageType}',
+            properties: {
+                //The whole raw datagram payload is the single source of truth: decoded verbatim to hex and
+                //re-emitted untouched (byte-perfect for any WS-Discovery message). The WS-Addressing
+                //Action is parsed into the display-only metadata below, which carry no codec of their own.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        if (available <= 0) {
+                            this.instance.message.setValue('');
+                            this.#parseAction('');
+                            return;
+                        }
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parseAction(raw.toString('latin1'));
+                    },
+                    encode: function () {
+                        //Re-emit the authoritative message verbatim — never reconstruct from metadata.
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                },
+                //Display-only metadata parsed from the WS-Addressing Action on decode (no encode —
+                //populated by the message field above, never read back). action is the full Action URI;
+                //messageType is its short trailing segment (Probe / Hello / Bye / …).
+                action: { type: 'string', label: 'Action' },
+                messageType: { type: 'string', label: 'Message Type' }
+            }
+        };
+    }
+    match() {
+        //WS-Discovery rides on UDP port 3702 as a SOAP/XML datagram. Recognize it by the XML signature:
+        //the payload's first non-whitespace byte is '<' (an XML declaration or the SOAP Envelope) — so
+        //non-XML traffic on port 3702 falls through to raw rather than claiming an un-decodable layer.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'udp')
+            return false;
+        if (this.#payloadLength() <= 0)
+            return false;
+        const lead = this.readBytes(0, 16, true).toString('latin1').replace(/^[\s\uFEFF]+/, '');
+        return lead.startsWith('<');
+    }
+}
+exports.WSDiscovery = WSDiscovery;

package/dist/headers/WakeOnLAN.d.ts

@@ -0,0 +1,30 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * Wake-on-LAN "magic packet" (AMD Magic Packet Technology), carried directly in an Ethernet II frame
+ * with EtherType 0x0842 (an Ethernet child — no IP/UDP). The magic packet has a fixed shape: a 6-byte
+ * synchronization stream of all ones (0xFF ×6), followed by the target adapter's 6-byte MAC address
+ * repeated exactly 16 times (96 bytes), optionally followed by a 0/4/6-byte SecureOn password. There is
+ * no length field — the payload runs to the end of the frame.
+ *
+ * The 16 MAC repetitions are, by definition, identical, so the target MAC is surfaced once (decoded from
+ * the first repetition) and re-emitted 16× on encode — a well-formed magic packet round-trips
+ * byte-for-byte. The 6-byte sync stream is kept verbatim as hex (so an odd/crafted stream still
+ * reproduces) and any trailing SecureOn password bytes are kept verbatim as hex (0/4/6 bytes; taken to
+ * the end of the frame). Nothing is recomputed on encode. WoL is a leaf header — nothing rides above it.
+ *
+ * Note: WoL magic packets are also frequently sent as the payload of a UDP datagram (well-known ports 9
+ * and 7, or 0). This codec handles only the EtherType 0x0842 direct-on-Ethernet framing; the UDP-carried
+ * form is a separate demux (udpport) and is not attempted here.
+ */
+export declare class WakeOnLAN extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}