@netkitty/codec 1.0.0

package/dist/headers/BACnetIP.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BACnetIP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * BACnet/IP — the BACnet Virtual Link Control (BVLC) layer that carries BACnet over UDP (ANSI/ASHRAE
+ * 135 Annex J), UDP port 47808 (0xBAC0). Every message starts with a 4-byte BVLC header: a Type octet
+ * (0x81 for BACnet/IP), a Function octet (e.g. Original-Unicast-NPDU 0x0A, Original-Broadcast-NPDU 0x0B,
+ * Forwarded-NPDU 0x04, BVLC-Result 0x00), and a 2-byte Length that counts the WHOLE BVLC message
+ * (header + everything after). The bytes after the header are the NPDU and APDU (and, for a few
+ * functions, a BVLC-specific address prefix).
+ *
+ * This codec decodes the BVLC header structurally and keeps the NPDU + APDU verbatim as `payload` hex,
+ * bounded by the BVLC Length (so a trailing/coalesced datagram is left to RawData). The NPDU's
+ * conditional routing fields are intricate enough that structuring them belongs to a later slice. The
+ * Length is honored when supplied, else derived from the payload; a well-formed message round-trips
+ * byte-for-byte.
+ */
+class BACnetIP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'bacnet';
+        this.name = 'BACnet/IP';
+        this.nickname = 'BACnet';
+        this.matchKeys = ['udpport:47808'];
+        //A leaf header — the NPDU/APDU are kept verbatim (structuring them is a later slice).
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (BACnetIP.#schemaCache ??= BACnetIP.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'BACnet/IP func=${function}',
+            properties: {
+                type: this.fieldHex('type', 0, 1, 'Type'),
+                'function': this.fieldUInt('function', 1, 1, 'Function'),
+                length: {
+                    type: 'integer',
+                    label: 'Length',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        this.instance.length.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(2, 2)));
+                    },
+                    encode: function () {
+                        //BVLC Length counts the whole message (4-byte header + payload). Honored when
+                        //supplied (a crafted message may lie); else derived from the payload.
+                        const provided = this.instance.length.getValue();
+                        const value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : 4 + (0, HexToBuffer_1.HexToBuffer)(this.instance.payload.getValue('')).length;
+                        this.instance.length.setValue(value);
+                        this.writeBytes(2, (0, NumberToBuffer_1.UInt16ToBuffer)(value));
+                    }
+                },
+                //NPDU + APDU (and any BVLC address prefix), kept verbatim and bounded by the BVLC Length
+                //so a trailing/coalesced datagram is left to raw.
+                payload: {
+                    type: 'string',
+                    label: 'Payload',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        const length = this.instance.length.getValue(0);
+                        let end = length >= 4 ? length : remaining;
+                        if (end > remaining)
+                            end = remaining;
+                        this.instance.payload.setValue(end > 4 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(4, end - 4)) : '');
+                    },
+                    encode: function () {
+                        const payload = this.instance.payload.getValue('');
+                        if (payload)
+                            this.writeBytes(4, (0, HexToBuffer_1.HexToBuffer)(payload));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //BACnet/IP rides on UDP port 47808. Require the 4-byte BVLC header and the 0x81 type signature so
+        //non-BACnet traffic on that port falls through to raw.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        if (this.packet.length - this.startPos < 4)
+            return false;
+        return this.readBytes(0, 1, true)[0] === 0x81;
+    }
+}
+exports.BACnetIP = BACnetIP;

package/dist/headers/BFD.d.ts

@@ -0,0 +1,28 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * BFD — Bidirectional Forwarding Detection Control (RFC 5880), UDP port 3784 (single-hop) and 4784
+ * (multi-hop). The mandatory section is 24 bytes: a first byte carrying Version[3] (= 1) and a 5-bit
+ * Diagnostic code, a second byte carrying the 2-bit Session State (0 AdminDown / 1 Down / 2 Init /
+ * 3 Up) followed by six flag bits (P Poll, F Final, C Control-Plane-Independent, A Authentication
+ * Present, D Demand, M Multipoint), a Detect Mult (detection-time multiplier), a Length (of the whole
+ * BFD Control packet in bytes), then five 4-byte fields: My Discriminator, Your Discriminator, and the
+ * Desired Min TX / Required Min RX / Required Min Echo RX intervals (all in microseconds).
+ *
+ * If the A (Authentication Present) flag is set an optional Authentication Section follows the
+ * mandatory 24 bytes (Auth Type, Auth Len, then type-specific auth data). It is kept verbatim as
+ * `authSection` hex so any auth variant round-trips byte-for-byte; when A is clear it is empty. The
+ * Length field is honoured verbatim (not recomputed) so a captured packet re-encodes byte-for-byte.
+ * BFD Control is a leaf — nothing rides on top of it.
+ */
+export declare class BFD extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/BFD.js

@@ -0,0 +1,155 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BFD = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * BFD — Bidirectional Forwarding Detection Control (RFC 5880), UDP port 3784 (single-hop) and 4784
+ * (multi-hop). The mandatory section is 24 bytes: a first byte carrying Version[3] (= 1) and a 5-bit
+ * Diagnostic code, a second byte carrying the 2-bit Session State (0 AdminDown / 1 Down / 2 Init /
+ * 3 Up) followed by six flag bits (P Poll, F Final, C Control-Plane-Independent, A Authentication
+ * Present, D Demand, M Multipoint), a Detect Mult (detection-time multiplier), a Length (of the whole
+ * BFD Control packet in bytes), then five 4-byte fields: My Discriminator, Your Discriminator, and the
+ * Desired Min TX / Required Min RX / Required Min Echo RX intervals (all in microseconds).
+ *
+ * If the A (Authentication Present) flag is set an optional Authentication Section follows the
+ * mandatory 24 bytes (Auth Type, Auth Len, then type-specific auth data). It is kept verbatim as
+ * `authSection` hex so any auth variant round-trips byte-for-byte; when A is clear it is empty. The
+ * Length field is honoured verbatim (not recomputed) so a captured packet re-encodes byte-for-byte.
+ * BFD Control is a leaf — nothing rides on top of it.
+ */
+class BFD extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'bfd';
+        this.name = 'Bidirectional Forwarding Detection';
+        this.nickname = 'BFD';
+        this.matchKeys = ['udpport:3784', 'udpport:4784'];
+        //A leaf header — nothing is carried on top of a BFD Control packet.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (BFD.#schemaCache ??= BFD.#buildSchema());
+    }
+    /** The payload length bounded by the UDP datagram (so retained padding/FCS is not absorbed). */
+    #payloadLength() {
+        let available = this.packet.length - this.startPos;
+        if (this.prevCodecModule && this.prevCodecModule.id === 'udp') {
+            const udpLength = this.prevCodecModule.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < available)
+                available = udpLength - 8;
+        }
+        return available < 0 ? 0 : available;
+    }
+    /**
+     * A single flag bit of the second byte (byte 1), MSB-first: bitOffset 2 = P, 3 = F, 4 = C,
+     * 5 = A, 6 = D, 7 = M (bitOffsets 0..1 are the 2-bit Session State). Decode reads it as a boolean
+     * into `flags[name]`; encode writes it back — byte-for-byte identical to the hand-written pattern.
+     */
+    static #flagBit(name, bitOffset, label) {
+        return {
+            type: 'boolean',
+            label: label,
+            decode: function () {
+                this.instance.flags[name].setValue(!!this.readBits(1, 1, bitOffset, 1));
+            },
+            encode: function () {
+                const value = !!this.instance.flags[name].getValue();
+                this.instance.flags[name].setValue(value);
+                this.writeBits(1, 1, bitOffset, 1, value ? 1 : 0);
+            }
+        };
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'BFD state=${flags.state} mult=${detectMult}',
+            properties: {
+                //Byte 0: Version (top 3 bits, = 1 for RFC 5880) + Diagnostic (low 5 bits). MSB-first,
+                //so version is bitOffset 0..2 and diagnostic bitOffset 3..7 of a 1-octet window.
+                version: {
+                    type: 'integer',
+                    label: 'Version',
+                    minimum: 0,
+                    maximum: 7,
+                    decode: function () { this.instance.version.setValue(this.readBits(0, 1, 0, 3)); },
+                    encode: function () { this.writeBits(0, 1, 0, 3, this.instance.version.getValue(1)); }
+                },
+                diagnostic: {
+                    type: 'integer',
+                    label: 'Diagnostic',
+                    minimum: 0,
+                    maximum: 31,
+                    decode: function () { this.instance.diagnostic.setValue(this.readBits(0, 1, 3, 5)); },
+                    encode: function () { this.writeBits(0, 1, 3, 5, this.instance.diagnostic.getValue(0)); }
+                },
+                //Byte 1: 2-bit Session State + six single-bit flags (P F C A D M), MSB-first.
+                flags: {
+                    type: 'object',
+                    label: 'Flags',
+                    properties: {
+                        state: {
+                            type: 'integer',
+                            label: 'Session State',
+                            minimum: 0,
+                            maximum: 3,
+                            decode: function () { this.instance.flags.state.setValue(this.readBits(1, 1, 0, 2)); },
+                            encode: function () { this.writeBits(1, 1, 0, 2, this.instance.flags.state.getValue(0)); }
+                        },
+                        poll: this.#flagBit('poll', 2, 'Poll'),
+                        final: this.#flagBit('final', 3, 'Final'),
+                        controlPlaneIndependent: this.#flagBit('controlPlaneIndependent', 4, 'Control Plane Independent'),
+                        authPresent: this.#flagBit('authPresent', 5, 'Authentication Present'),
+                        demand: this.#flagBit('demand', 6, 'Demand'),
+                        multipoint: this.#flagBit('multipoint', 7, 'Multipoint')
+                    }
+                },
+                detectMult: this.fieldUInt('detectMult', 2, 1, 'Detect Mult'),
+                //Length of the entire BFD Control packet in bytes. Honoured verbatim (a real no-auth
+                //packet carries 24) — not recomputed, so a captured packet re-encodes byte-for-byte.
+                length: this.fieldUInt('length', 3, 1, 'Length'),
+                myDiscriminator: this.fieldUInt('myDiscriminator', 4, 4, 'My Discriminator'),
+                yourDiscriminator: this.fieldUInt('yourDiscriminator', 8, 4, 'Your Discriminator'),
+                desiredMinTxInterval: this.fieldUInt('desiredMinTxInterval', 12, 4, 'Desired Min TX Interval'),
+                requiredMinRxInterval: this.fieldUInt('requiredMinRxInterval', 16, 4, 'Required Min RX Interval'),
+                requiredMinEchoRxInterval: this.fieldUInt('requiredMinEchoRxInterval', 20, 4, 'Required Min Echo RX Interval'),
+                //Optional Authentication Section (present only when the A flag is set). Kept verbatim so
+                //any auth type (simple password, keyed MD5/SHA1, meticulous) round-trips byte-for-byte;
+                //bounded by the UDP datagram. Runs after `flags` so authPresent is known.
+                authSection: {
+                    type: 'string',
+                    label: 'Authentication Section',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const authPresent = !!this.instance.flags.authPresent.getValue();
+                        const available = this.#payloadLength();
+                        if (!authPresent || available <= 24) {
+                            this.instance.authSection.setValue('');
+                            return;
+                        }
+                        //The auth section runs to the BFD Length (which includes it) when Length is sane;
+                        //anything past that inside the UDP datagram is trailing padding, left to raw (so
+                        //the A-set path matches the A-clear path, which routes such bytes to a raw layer).
+                        const length = this.instance.length.getValue(0);
+                        const authLength = (length >= 24 && length <= available) ? length - 24 : available - 24;
+                        this.instance.authSection.setValue(authLength > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(24, authLength)) : '');
+                    },
+                    encode: function () {
+                        const authSection = this.instance.authSection.getValue('');
+                        if (authSection)
+                            this.writeBytes(24, (0, HexToBuffer_1.HexToBuffer)(authSection));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Require the 24-byte mandatory section within the UDP payload (a shorter datagram on the BFD
+        //ports is not a BFD Control packet and must fall through to raw rather than claim a layer).
+        return !!this.prevCodecModule && this.prevCodecModule.id === 'udp' && this.#payloadLength() >= 24;
+    }
+}
+exports.BFD = BFD;

package/dist/headers/BGP.d.ts

@@ -0,0 +1,27 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * Border Gateway Protocol (BGP-4, RFC 4271), TCP port 179. Every BGP message begins with a fixed
+ * 19-byte header — a 16-byte Marker (all ones, 0xFF, in modern BGP without authentication), a 2-byte
+ * Length (the total message octet count including this header), and a 1-byte Type (1 OPEN, 2 UPDATE,
+ * 3 NOTIFICATION, 4 KEEPALIVE) — followed by the type-specific body.
+ *
+ * The body layout differs per message type (OPEN's capabilities, UPDATE's withdrawn routes / path
+ * attributes / NLRI, NOTIFICATION's error code) and several sub-structures need cross-message and
+ * capability-negotiation context, so this single-message codec keeps the body verbatim as `body` hex
+ * (byte-perfect) and does not sub-decode it. The Length is auto-computed from the body on encode when
+ * not supplied, else honored verbatim (a crafted message may lie); the message is bounded by Length so
+ * a second pipelined BGP message or trailing bytes are left to the codec's recursion / RawData. A
+ * well-formed message round-trips byte-for-byte.
+ */
+export declare class BGP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/BGP.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BGP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * Border Gateway Protocol (BGP-4, RFC 4271), TCP port 179. Every BGP message begins with a fixed
+ * 19-byte header — a 16-byte Marker (all ones, 0xFF, in modern BGP without authentication), a 2-byte
+ * Length (the total message octet count including this header), and a 1-byte Type (1 OPEN, 2 UPDATE,
+ * 3 NOTIFICATION, 4 KEEPALIVE) — followed by the type-specific body.
+ *
+ * The body layout differs per message type (OPEN's capabilities, UPDATE's withdrawn routes / path
+ * attributes / NLRI, NOTIFICATION's error code) and several sub-structures need cross-message and
+ * capability-negotiation context, so this single-message codec keeps the body verbatim as `body` hex
+ * (byte-perfect) and does not sub-decode it. The Length is auto-computed from the body on encode when
+ * not supplied, else honored verbatim (a crafted message may lie); the message is bounded by Length so
+ * a second pipelined BGP message or trailing bytes are left to the codec's recursion / RawData. A
+ * well-formed message round-trips byte-for-byte.
+ */
+class BGP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'bgp';
+        this.name = 'Border Gateway Protocol';
+        this.nickname = 'BGP';
+        this.matchKeys = ['tcpport:179'];
+        //A leaf header — the type-specific body requires per-type, capability-dependent parsing.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (BGP.#schemaCache ??= BGP.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'BGP type=${type} len=${length}',
+            properties: {
+                //The 16-byte Marker. In RFC 4271 (no authentication) it is all ones (0xFF); kept
+                //verbatim so any legacy/authenticated marker still round-trips.
+                marker: this.fieldHex('marker', 0, 16, 'Marker'),
+                length: {
+                    type: 'integer',
+                    label: 'Length',
+                    minimum: 19,
+                    maximum: 65535,
+                    decode: function () {
+                        this.instance.length.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(16, 2)));
+                    },
+                    encode: function () {
+                        //Length counts the whole message = 19-byte header + body. Honored when supplied
+                        //(a crafted message may lie); else derived from the body.
+                        const provided = this.instance.length.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : 19 + (0, HexToBuffer_1.HexToBuffer)(this.instance.body.getValue('')).length;
+                        if (value > 65535) {
+                            this.recordError(this.instance.length.getPath(), 'Maximum value is 65535');
+                            value = 65535;
+                        }
+                        this.instance.length.setValue(value);
+                        this.writeBytes(16, (0, NumberToBuffer_1.UInt16ToBuffer)(value));
+                    }
+                },
+                type: this.fieldUInt('type', 18, 1, 'Type'),
+                //The type-specific body after the 19-byte header, kept verbatim. Bounded by the message
+                //Length (the message ends at offset Length) and the captured bytes, so trailing /
+                //pipelined data is left to the codec's recursion / RawData.
+                body: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        const length = this.instance.length.getValue(0);
+                        let end = length;
+                        if (end > remaining)
+                            end = remaining;
+                        this.instance.body.setValue(end > 19 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(19, end - 19)) : '');
+                    },
+                    encode: function () {
+                        const body = this.instance.body.getValue('');
+                        if (body)
+                            this.writeBytes(19, (0, HexToBuffer_1.HexToBuffer)(body));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //BGP rides on TCP port 179. Require the full 19-byte header and the all-ones Marker signature
+        //(16 bytes of 0xFF) so non-BGP 179 traffic falls through to raw. The marker is a strong,
+        //distinctive content signature, but selection stays port-bucketed (matchKeys) to stay
+        //conservative like the other length-bounded TCP payload codecs.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.packet.length - this.startPos < 19)
+            return false;
+        const marker = this.readBytes(0, 16, true);
+        for (let i = 0; i < 16; i++) {
+            if (marker[i] !== 0xff)
+                return false;
+        }
+        return true;
+    }
+}
+exports.BGP = BGP;

package/dist/headers/BSAPIP.d.ts

@@ -0,0 +1,33 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * BSAP-IP — Bristol/Emerson (Bristol Babcock) BSAP over UDP, well-known UDP port 1234. BSAP (Bristol
+ * Standard Asynchronous/Synchronous Protocol) is a proprietary master/slave SCADA protocol for Network
+ * 3000 (DPC 33xx) and ControlWave devices; ControlWave Ethernet nodes encapsulate it in UDP and default
+ * to port 1234 (documented by the Emerson/Kepware/PTC-TOPServer/AUTOSOL driver manuals).
+ *
+ * ⚠️ There is NO public authoritative on-wire byte layout for the BSAP-IP encapsulation. The serial BSAP
+ * link protocol (DLE/STX framing, 16-bit CRC-CCITT) is documented in Emerson's "BSAP Communications
+ * Application Programmer's Reference", but the IP framing (message flags / local-address / NPDU sequence
+ * & function fields) is not publicly specified, and Wireshark's built-in `bsap` dissector is an unrelated
+ * name collision (BSSAP, the GSM/ANSI A-interface over SCCP — fields `bsap.dlci.sapi`, `bsap.pdu_type`
+ * routing to `ansi_a_bsmap`/`ansi_a_dtap`), NOT this Bristol SCADA protocol.
+ *
+ * Because no field offsets can be pinned down with confidence, this is a deliberately conservative
+ * minimal slice: it claims BSAP-IP by its well-known UDP port (like ENIP claims 44818 with no content
+ * magic) and carries the entire UDP payload verbatim as `payload` hex (byte-perfect). The payload is
+ * bounded by the UDP datagram (the codec has already advanced past the UDP header), so nothing beyond
+ * the datagram is absorbed. A frame round-trips byte-for-byte, and decode never throws. Sub-decoding the
+ * BSAP message (sequence / function / routing fields) is left for when an authoritative spec is available.
+ */
+export declare class BSAPIP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/BSAPIP.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BSAPIP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * BSAP-IP — Bristol/Emerson (Bristol Babcock) BSAP over UDP, well-known UDP port 1234. BSAP (Bristol
+ * Standard Asynchronous/Synchronous Protocol) is a proprietary master/slave SCADA protocol for Network
+ * 3000 (DPC 33xx) and ControlWave devices; ControlWave Ethernet nodes encapsulate it in UDP and default
+ * to port 1234 (documented by the Emerson/Kepware/PTC-TOPServer/AUTOSOL driver manuals).
+ *
+ * ⚠️ There is NO public authoritative on-wire byte layout for the BSAP-IP encapsulation. The serial BSAP
+ * link protocol (DLE/STX framing, 16-bit CRC-CCITT) is documented in Emerson's "BSAP Communications
+ * Application Programmer's Reference", but the IP framing (message flags / local-address / NPDU sequence
+ * & function fields) is not publicly specified, and Wireshark's built-in `bsap` dissector is an unrelated
+ * name collision (BSSAP, the GSM/ANSI A-interface over SCCP — fields `bsap.dlci.sapi`, `bsap.pdu_type`
+ * routing to `ansi_a_bsmap`/`ansi_a_dtap`), NOT this Bristol SCADA protocol.
+ *
+ * Because no field offsets can be pinned down with confidence, this is a deliberately conservative
+ * minimal slice: it claims BSAP-IP by its well-known UDP port (like ENIP claims 44818 with no content
+ * magic) and carries the entire UDP payload verbatim as `payload` hex (byte-perfect). The payload is
+ * bounded by the UDP datagram (the codec has already advanced past the UDP header), so nothing beyond
+ * the datagram is absorbed. A frame round-trips byte-for-byte, and decode never throws. Sub-decoding the
+ * BSAP message (sequence / function / routing fields) is left for when an authoritative spec is available.
+ */
+class BSAPIP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'bsap';
+        this.name = 'Bristol/Emerson BSAP over IP';
+        this.nickname = 'BSAP-IP';
+        //Well-known UDP port 1234 (ControlWave / Network 3000 default). No content magic exists for BSAP-IP,
+        //so selection is port-bucketed only (no heuristicFallback) — the same conservative stance as ENIP.
+        this.matchKeys = ['udpport:1234'];
+        //A leaf header — the BSAP message body has no public on-wire spec to demux further.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (BSAPIP.#schemaCache ??= BSAPIP.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'BSAP-IP over UDP/1234',
+            properties: {
+                //The whole UDP payload, kept verbatim. No public on-wire layout exists to sub-decode it,
+                //so it is carried as opaque hex. Bounded by the captured bytes (= the UDP datagram, since
+                //the codec advanced startPos past the UDP header), so trailing frames are not absorbed.
+                payload: {
+                    type: 'string',
+                    label: 'Payload',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        this.instance.payload.setValue(remaining > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(0, remaining)) : '');
+                    },
+                    encode: function () {
+                        const payload = this.instance.payload.getValue('');
+                        if (payload)
+                            this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(payload));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //BSAP-IP rides on UDP port 1234. There is no content signature to validate, so the well-known
+        //port is the signature; require at least one payload byte so an empty datagram falls through to
+        //raw rather than being claimed as an empty BSAP-IP layer.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        return this.packet.length - this.startPos >= 1;
+    }
+}
+exports.BSAPIP = BSAPIP;

package/dist/headers/Babel.d.ts

@@ -0,0 +1,32 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * Babel routing protocol (RFC 8966), carried in UDP over port 6696 (to the well-known multicast group
+ * or unicast). A Babel packet starts with a fixed 4-byte header — Magic (== 42), Version (== 2) and a
+ * 2-byte Body Length (the octet count of the packet body that follows the header, not counting the
+ * optional packet trailer) — followed by the packet body: a flat sequence of TLVs, then an optional
+ * trailer (which may only carry Pad1/PadN sub-TLVs).
+ *
+ * Each TLV is Type (1 byte) + Length (1 byte, the value byte count, NOT counting the Type/Length pair)
+ * + Value, except Pad1 (Type 0) which is a single byte with no Length/Value. Common types: 0 Pad1,
+ * 1 PadN, 2 Acknowledgment Request, 4 Hello, 5 IHU, 8 Update.
+ *
+ * Byte-perfect strategy (minimal slice): structure Magic / Version / Body Length, then carry the TLVs
+ * generically (Type + verbatim hex Value, Pad1 special-cased as a bare byte) so every TLV — including
+ * types this codec does not sub-decode — round-trips byte-for-byte. The TLV walk is bounded by Body
+ * Length AND the UDP payload (udp.length − 8), so a lying Body Length cannot read past the datagram.
+ * Body Length is honored when supplied (a crafted packet may lie) else derived from the TLVs; any bytes
+ * after the body (the packet trailer, or leftover bytes from a truncated TLV) are kept verbatim in
+ * `trailer` so the datagram is reproduced exactly. A well-formed packet round-trips byte-for-byte.
+ */
+export declare class Babel extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}