@netkitty/codec 1.0.0

package/dist/headers/CoAP.js

@@ -0,0 +1,140 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoAP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * CoAP — Constrained Application Protocol (RFC 7252), a RESTful transfer protocol for constrained nodes
+ * and networks (IoT), riding on UDP port 5683. Every message opens with a 4-byte fixed header: byte 0
+ * holds the 2-bit Version (always 1), a 2-bit Type (0 CON, 1 NON, 2 ACK, 3 RST) and a 4-bit Token
+ * Length (TKL, 0-8); byte 1 is the 8-bit Code (a 3-bit class '.' 5-bit detail, e.g. 0.01 GET = 0x01,
+ * 2.05 Content = 0x45); bytes 2-3 are the big-endian Message ID. The fixed header is followed by a
+ * Token of TKL octets, then a sequence of Options, then optionally a 0xFF payload marker and the
+ * payload.
+ *
+ * This codec decodes the fixed header and the Token structurally and keeps everything after the Token
+ * (the Options plus the optional payload-marker-and-payload) verbatim as `payload` hex — de-structuring
+ * CoAP's option deltas / TLV encoding is a later slice, so those bytes are preserved untouched and the
+ * message round-trips byte-for-byte. The region is bounded by the UDP datagram length so any trailing
+ * padding is not absorbed. version === 1 is the content signature that separates a real CoAP datagram
+ * on port 5683 from arbitrary traffic.
+ */
+class CoAP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'coap';
+        this.name = 'Constrained Application Protocol';
+        this.nickname = 'CoAP';
+        this.matchKeys = ['udpport:5683'];
+        //A leaf header — CoAP option/payload TLV de-structuring is deferred to a later slice.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (CoAP.#schemaCache ??= CoAP.#buildSchema());
+    }
+    /** The UDP payload length bounded by the datagram (so retained padding is not absorbed). */
+    #payloadLength() {
+        let available = this.packet.length - this.startPos;
+        if (this.prevCodecModule && this.prevCodecModule.id === 'udp') {
+            const udpLength = this.prevCodecModule.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < available)
+                available = udpLength - 8;
+        }
+        return available < 0 ? 0 : available;
+    }
+    /** The Token octet count, clamped to the spec's 0-8 range and to the bytes actually available. */
+    #tokenBytes() {
+        let count = this.instance.tokenLength.getValue(0);
+        if (count > 8)
+            count = 8;
+        if (count < 0)
+            count = 0;
+        const available = this.#payloadLength();
+        if (4 + count > available)
+            count = available - 4;
+        return count < 0 ? 0 : count;
+    }
+    /** A fixed-width big-endian bit field within byte 0 (bitOffset 0 = MSB). */
+    static #bitField(name, bitOffset, bitLength, maximum, label) {
+        return {
+            type: 'integer',
+            label: label,
+            minimum: 0,
+            maximum: maximum,
+            decode: function () {
+                this.instance[name].setValue(this.readBits(0, 1, bitOffset, bitLength));
+            },
+            encode: function () {
+                this.writeBits(0, 1, bitOffset, bitLength, this.instance[name].getValue(0));
+            }
+        };
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'CoAP type=${type} code=${code}',
+            properties: {
+                //Byte 0 (MSB first): Version (bits 7:6, always 1), Type (bits 5:4), Token Length (bits 3:0).
+                version: this.#bitField('version', 0, 2, 3, 'Version'),
+                type: this.#bitField('type', 2, 2, 3, 'Type'),
+                tokenLength: this.#bitField('tokenLength', 4, 4, 15, 'Token Length'),
+                //Byte 1: Code — a 3-bit class and 5-bit detail packed as one octet (e.g. 0x01 = 0.01 GET).
+                code: this.fieldUInt('code', 1, 1, 'Code'),
+                //Bytes 2-3: Message ID (big-endian uint16).
+                messageId: this.fieldUInt('messageId', 2, 2, 'Message ID'),
+                //Token: TKL octets immediately after the fixed header, kept verbatim as hex ('' when TKL 0).
+                token: {
+                    type: 'string',
+                    label: 'Token',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const count = this.#tokenBytes();
+                        this.instance.token.setValue(count > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(4, count)) : '');
+                    },
+                    encode: function () {
+                        const token = this.instance.token.getValue('');
+                        if (token)
+                            this.writeBytes(4, (0, HexToBuffer_1.HexToBuffer)(token));
+                    }
+                },
+                //Options + optional payload-marker-and-payload, kept verbatim (TLV de-structuring is a later
+                //slice). Bounded by the UDP datagram, and placed right after the Token (offset 4 + TKL).
+                payload: {
+                    type: 'string',
+                    label: 'Payload',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        const start = 4 + this.#tokenBytes();
+                        this.instance.payload.setValue(start < available ? (0, BufferToHex_1.BufferToHex)(this.readBytes(start, available - start)) : '');
+                    },
+                    encode: function () {
+                        const payload = this.instance.payload.getValue('');
+                        if (payload) {
+                            //The actual token bytes are authoritative for where the payload starts (the
+                            //token field writes its own bytes at offset 4), so the payload cannot overlap
+                            //or gap the token even when a crafted Token Length disagrees with the token.
+                            const tokenBytes = (0, HexToBuffer_1.HexToBuffer)(this.instance.token.getValue('')).length;
+                            this.writeBytes(4 + tokenBytes, (0, HexToBuffer_1.HexToBuffer)(payload));
+                        }
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //CoAP rides on UDP port 5683. Require the 4-byte fixed header within the datagram and the
+        //Version == 1 content signature (bits 7:6 of byte 0) so a non-CoAP datagram on 5683 falls
+        //through to raw rather than claiming an un-decodable layer.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        if (this.#payloadLength() < 4)
+            return false;
+        const version = this.readBits(0, 1, 0, 2);
+        return version === 1;
+    }
+}
+exports.CoAP = CoAP;

package/dist/headers/Codesys.d.ts

@@ -0,0 +1,32 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * CODESYS V3 (3S-Smart Software Solutions runtime) communication, TCP port 2455. CODESYS wraps its
+ * multi-layer message stack (an L3 datagram/router layer, an L4 channel layer and an L7 service layer)
+ * inside an outer "block driver" frame: a fixed 8-byte header — a 4-byte magic (`00 01 17 e8`) and a
+ * LITTLE-ENDIAN 32-bit Length — followed by the block-driver payload.
+ *
+ * ⚠️ No authoritative public specification of the CODESYS wire format exists. The block-driver framing
+ * used here (magic + little-endian length) is inferred from the community Wireshark dissector
+ * `fridgebuyer/codesys3-dissector` (and the ICS-pcap CODESYS notes), not from a vendor spec — so this
+ * codec surfaces only the two determinable header fields and keeps the entire block-driver payload
+ * (the L3/L4/L7 stack, which needs cross-message / session context) verbatim as `payload` hex
+ * (byte-perfect). The Length is auto-computed from the payload on encode when not supplied, else honored
+ * verbatim (a crafted frame may carry any Length); the payload is bounded by the Length so a second
+ * pipelined block-driver frame or trailing bytes are left to the codec's recursion / RawData. A
+ * well-formed frame round-trips byte-for-byte.
+ *
+ * Like the other multi-byte CODESYS/CIP-style protocols, the Length is little-endian; there is no
+ * little-endian helper in this codebase, so it is read/written byte-by-byte in its closures.
+ */
+export declare class Codesys extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/Codesys.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Codesys = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * CODESYS V3 (3S-Smart Software Solutions runtime) communication, TCP port 2455. CODESYS wraps its
+ * multi-layer message stack (an L3 datagram/router layer, an L4 channel layer and an L7 service layer)
+ * inside an outer "block driver" frame: a fixed 8-byte header — a 4-byte magic (`00 01 17 e8`) and a
+ * LITTLE-ENDIAN 32-bit Length — followed by the block-driver payload.
+ *
+ * ⚠️ No authoritative public specification of the CODESYS wire format exists. The block-driver framing
+ * used here (magic + little-endian length) is inferred from the community Wireshark dissector
+ * `fridgebuyer/codesys3-dissector` (and the ICS-pcap CODESYS notes), not from a vendor spec — so this
+ * codec surfaces only the two determinable header fields and keeps the entire block-driver payload
+ * (the L3/L4/L7 stack, which needs cross-message / session context) verbatim as `payload` hex
+ * (byte-perfect). The Length is auto-computed from the payload on encode when not supplied, else honored
+ * verbatim (a crafted frame may carry any Length); the payload is bounded by the Length so a second
+ * pipelined block-driver frame or trailing bytes are left to the codec's recursion / RawData. A
+ * well-formed frame round-trips byte-for-byte.
+ *
+ * Like the other multi-byte CODESYS/CIP-style protocols, the Length is little-endian; there is no
+ * little-endian helper in this codebase, so it is read/written byte-by-byte in its closures.
+ */
+class Codesys extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'codesys';
+        this.name = 'CODESYS V3';
+        this.nickname = 'CODESYS';
+        this.matchKeys = ['tcpport:2455'];
+        //A leaf header — the block-driver payload (L3/L4/L7) requires cross-message / session parsing that
+        //has no authoritative public spec, so it is kept as hex rather than demuxed further.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (Codesys.#schemaCache ??= Codesys.#buildSchema());
+    }
+    /** The 4-byte block-driver magic that prefixes every frame, as a wire-order byte sequence. */
+    static #MAGIC = '000117e8';
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'CODESYS len=${length}',
+            properties: {
+                //The 4-byte block-driver magic (00 01 17 e8). Kept verbatim (not enum-constrained) so any
+                //observed frame round-trips even if a variant carries a different signature.
+                magic: this.fieldHex('magic', 0, 4, 'Block Driver Magic'),
+                //Block-driver payload byte count that follows the 8-byte header. LITTLE-ENDIAN 32-bit.
+                //Honored when supplied (a crafted frame may lie); else derived from the payload bytes.
+                length: {
+                    type: 'integer',
+                    label: 'Length',
+                    minimum: 0,
+                    maximum: 4294967295,
+                    decode: function () {
+                        const b = this.readBytes(4, 4);
+                        //`|` yields a signed int32, so `>>> 0` over the WHOLE expression keeps it unsigned.
+                        this.instance.length.setValue((b[0] | (b[1] << 8) | (b[2] << 16) | (b[3] << 24)) >>> 0);
+                    },
+                    encode: function () {
+                        const provided = this.instance.length.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : (0, HexToBuffer_1.HexToBuffer)(this.instance.payload.getValue('')).length;
+                        if (value > 4294967295) {
+                            this.recordError(this.instance.length.getPath(), 'Maximum value is 4294967295');
+                            value = 4294967295;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.length.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.length.setValue(value);
+                        this.writeBytes(4, Buffer.from([value & 0xff, (value >> 8) & 0xff, (value >> 16) & 0xff, (value >>> 24) & 0xff]));
+                    }
+                },
+                //The block-driver payload (the CODESYS L3/L4/L7 stack), kept verbatim. Bounded by the
+                //Length field (payload ends at offset 8 + Length) when the Length is sane and the captured
+                //bytes, so a trailing / pipelined frame is left to the codec's recursion / RawData.
+                payload: {
+                    type: 'string',
+                    label: 'Payload',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.packet.length - this.startPos;
+                        const length = this.instance.length.getValue(0);
+                        //Honor the Length to bound the payload when it fits within the captured bytes;
+                        //otherwise (0, or a lying/oversized Length) consume the rest so nothing is lost.
+                        let end = 8 + length;
+                        if (length <= 0 || end > available)
+                            end = available;
+                        this.instance.payload.setValue(end > 8 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(8, end - 8)) : '');
+                    },
+                    encode: function () {
+                        const payload = this.instance.payload.getValue('');
+                        if (payload)
+                            this.writeBytes(8, (0, HexToBuffer_1.HexToBuffer)(payload));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //CODESYS V3 rides on TCP port 2455 (an observed runtime/gateway port). Require the full 8-byte
+        //block-driver header and the 4-byte magic signature (00 01 17 e8) so non-CODESYS 2455 traffic
+        //falls through to raw. The magic is a strong 32-bit content signature, but selection stays
+        //port-bucketed (matchKeys) like the other length-bounded TCP-payload codecs.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.packet.length - this.startPos < 8)
+            return false;
+        return (0, BufferToHex_1.BufferToHex)(this.readBytes(0, 4, true)) === Codesys.#MAGIC;
+    }
+}
+exports.Codesys = Codesys;

package/dist/headers/Collectd.d.ts

@@ -0,0 +1,29 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * collectd binary network protocol (the monitoring daemon's UDP transport, well-known UDP port 25826,
+ * default multicast group 239.192.74.66). A collectd datagram is a flat sequence of parts; each part is
+ * a 4-byte header — a 2-byte Type and a 2-byte Length, both big-endian — followed by Length − 4 value
+ * bytes (the Length field COUNTS its own 4-byte header). Common part types: 0x0000 Host, 0x0001 Time,
+ * 0x0002 Plugin, 0x0004 PluginInstance, 0x0008 Type, 0x0009 Values. There is no top-level length — the
+ * datagram owns the whole UDP payload and parts run to its end.
+ *
+ * Parts are carried generically (Type + on-wire Length + verbatim hex value) so every part — string,
+ * numeric, values, or unknown — round-trips byte-for-byte; per-type semantic decoding (string bodies,
+ * uint64 times, the Values type/count/data layout) is a later enrichment. The walk peeks each 4-byte
+ * header (dry-run), stops at a part that overruns the payload or declares a Length < 4 (its own header),
+ * and keeps any bytes after the last complete part verbatim in `trailer` so the datagram is reproduced
+ * exactly. Each part's Length is honored verbatim on encode (a crafted part may lie) or derived from the
+ * value byte count when absent; the part layout always advances by the actual value bytes written.
+ */
+export declare class Collectd extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/Collectd.js

@@ -0,0 +1,154 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Collectd = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * collectd binary network protocol (the monitoring daemon's UDP transport, well-known UDP port 25826,
+ * default multicast group 239.192.74.66). A collectd datagram is a flat sequence of parts; each part is
+ * a 4-byte header — a 2-byte Type and a 2-byte Length, both big-endian — followed by Length − 4 value
+ * bytes (the Length field COUNTS its own 4-byte header). Common part types: 0x0000 Host, 0x0001 Time,
+ * 0x0002 Plugin, 0x0004 PluginInstance, 0x0008 Type, 0x0009 Values. There is no top-level length — the
+ * datagram owns the whole UDP payload and parts run to its end.
+ *
+ * Parts are carried generically (Type + on-wire Length + verbatim hex value) so every part — string,
+ * numeric, values, or unknown — round-trips byte-for-byte; per-type semantic decoding (string bodies,
+ * uint64 times, the Values type/count/data layout) is a later enrichment. The walk peeks each 4-byte
+ * header (dry-run), stops at a part that overruns the payload or declares a Length < 4 (its own header),
+ * and keeps any bytes after the last complete part verbatim in `trailer` so the datagram is reproduced
+ * exactly. Each part's Length is honored verbatim on encode (a crafted part may lie) or derived from the
+ * value byte count when absent; the part layout always advances by the actual value bytes written.
+ */
+class Collectd extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'collectd';
+        this.name = 'collectd Network Protocol';
+        this.nickname = 'collectd';
+        this.matchKeys = ['udpport:25826'];
+        //A leaf header — the per-type part bodies are kept verbatim for now.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (Collectd.#schemaCache ??= Collectd.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'collectd ${parts.length} parts',
+            properties: {
+                parts: {
+                    type: 'array',
+                    label: 'Parts',
+                    items: {
+                        type: 'object',
+                        label: 'Part',
+                        properties: {
+                            type: { type: 'integer', label: 'Type', minimum: 0, maximum: 65535 },
+                            //On-wire Length INCLUDING the 4-byte part header (Type + Length). Honored
+                            //verbatim on encode; derived as 4 + value bytes when omitted.
+                            length: { type: 'integer', label: 'Length', minimum: 0, maximum: 65535 },
+                            value: { type: 'string', label: 'Value', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX }
+                        }
+                    },
+                    decode: function () {
+                        //The datagram owns the whole UDP payload — there is no outer length, so bound the
+                        //walk by the remaining payload bytes. Each part is Type(2) Length(2) Value(Length−4).
+                        const available = this.packet.length - this.startPos;
+                        const parts = [];
+                        let offset = 0;
+                        while (offset + 4 <= available) {
+                            //Peek the 4-byte header (dry-run) before committing so a truncated / malformed
+                            //part is NOT consumed by the header length — its bytes fall through to `trailer`.
+                            const header = this.readBytes(offset, 4, true);
+                            const type = header.readUInt16BE(0);
+                            const length = header.readUInt16BE(2);
+                            //Length counts its own 4-byte header: a value below 4 cannot delimit the part
+                            //(and would not advance the offset), so stop and keep the rest as trailer.
+                            if (length < 4)
+                                break;
+                            //A part that overruns the payload (truncation) is not consumed — stop and leave
+                            //the remaining bytes to `trailer`, keeping the round-trip exact.
+                            if (offset + length > available)
+                                break;
+                            //Commit-read the whole part so the header length covers exactly what is consumed.
+                            const partBuffer = this.readBytes(offset, length);
+                            const value = length > 4 ? (0, BufferToHex_1.BufferToHex)(partBuffer.subarray(4)) : '';
+                            parts.push({ type: type, length: length, value: value });
+                            offset += length;
+                        }
+                        this.instance.parts.setValue(parts);
+                        //Any bytes after the last complete part (a truncated / malformed final part, or
+                        //padding) are kept verbatim and consumed, so the datagram is reproduced exactly and
+                        //collectd always advances to the end of its UDP payload.
+                        this.instance.trailer.setValue(offset < available ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset, available - offset)) : '');
+                    },
+                    encode: function () {
+                        const parts = this.instance.parts.getValue([]);
+                        let offset = 0;
+                        if (parts) {
+                            for (let i = 0; i < parts.length; i++) {
+                                const part = parts[i];
+                                let type = part.type ? part.type : 0;
+                                if (type > 65535) {
+                                    this.recordError(`parts[${i}].type`, 'Maximum value is 65535');
+                                    type = 65535;
+                                }
+                                if (type < 0) {
+                                    this.recordError(`parts[${i}].type`, 'Minimum value is 0');
+                                    type = 0;
+                                }
+                                const value = (0, HexToBuffer_1.HexToBuffer)(part.value ? part.value : '');
+                                //Length is honored when supplied (a crafted part may lie); else derived as
+                                //the 4-byte header + value bytes. The layout always advances by the actual
+                                //value bytes written, so a lying Length does not shift the next part.
+                                const provided = part.length;
+                                let length = (provided !== undefined && provided !== null) ? provided : 4 + value.length;
+                                if (length > 65535) {
+                                    this.recordError(`parts[${i}].length`, 'Maximum value is 65535');
+                                    length = 65535;
+                                }
+                                if (length < 0) {
+                                    this.recordError(`parts[${i}].length`, 'Minimum value is 0');
+                                    length = 0;
+                                }
+                                this.writeBytes(offset, (0, NumberToBuffer_1.UInt16ToBuffer)(type));
+                                this.writeBytes(offset + 2, (0, NumberToBuffer_1.UInt16ToBuffer)(length));
+                                offset += 4;
+                                if (value.length) {
+                                    this.writeBytes(offset, value);
+                                    offset += value.length;
+                                }
+                            }
+                        }
+                        const trailer = this.instance.trailer.getValue('');
+                        if (trailer)
+                            this.writeBytes(offset, (0, HexToBuffer_1.HexToBuffer)(trailer));
+                    }
+                },
+                //Bytes after the last complete part (a truncated/malformed final part, or padding), kept
+                //verbatim. No codec of its own — it is set/read by the `parts` field (which owns the single
+                //offset walk); this entry is metadata so the editor sees the trailing bytes.
+                trailer: {
+                    type: 'string',
+                    label: 'Trailer',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX
+                }
+            }
+        };
+    }
+    match() {
+        //collectd rides on UDP port 25826 (selected via the udpport:25826 bucket). Require the 4-byte
+        //minimum for one part header. The binary header carries no strong content magic, so the
+        //well-known port is the signature — stays a port-bucket protocol (matchKeys only, NO
+        //heuristicFallback: a 2-byte part type is far too weak to claim collectd off its port).
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        return this.packet.length - this.startPos >= 4;
+    }
+}
+exports.Collectd = Collectd;

package/dist/headers/DCCP.d.ts

@@ -0,0 +1,30 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * DCCP — Datagram Congestion Control Protocol (RFC 4340), carried directly over IP as protocol 33. The
+ * generic header begins with Source Port (2), Destination Port (2), Data Offset (1, in 32-bit words —
+ * the length of the whole DCCP header including options), a byte split into CCVal (high 4 bits) and
+ * CsCov (low 4 bits), a 2-byte Checksum, and a byte split into Res (3 bits), Type (4 bits — 0 Request,
+ * 1 Response, 2 Data, 3 Ack, 4 DataAck, 5 CloseReq, 6 Close, 7 Reset) and X (1 bit, Extended Sequence
+ * Numbers). After that byte come the (X-dependent-width) Reserved + Sequence Number and any type-specific
+ * fields / options — everything up to Data Offset*4.
+ *
+ * To sidestep the X sequence-width branch and stay byte-perfect, this codec structures only the fixed
+ * 9-byte prefix (ports / data offset / ccval+cscov / checksum / res+type+x) and keeps the remainder of
+ * the header — Reserved, the Sequence/Ack numbers, per-type fields and options — verbatim as
+ * `headerOptions` hex (bytes 9 .. DataOffset*4). Application data after the header is kept as `payload`
+ * hex, bounded by the enclosing IP datagram so an inflated Data Offset can't read past the IP payload.
+ * The Checksum is honored verbatim, never recomputed; Data Offset is honored when supplied, else derived
+ * from the actual bytes. A well-formed datagram round-trips byte-for-byte.
+ */
+export declare class DCCP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}