@netkitty/codec 1.0.0

package/dist/headers/ENIP.js

@@ -0,0 +1,164 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENIP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * EtherNet/IP encapsulation (ODVA / IEC 61158, IEC 61784), TCP & UDP port 44818. Every EtherNet/IP
+ * message begins with a fixed 24-byte encapsulation header — Command, Length (the count of bytes that
+ * follow the header), Session Handle, Status, an 8-byte Sender Context echoed back by the target, and an
+ * Options field — followed by `Length` bytes of command-specific data (the CIP Common Packet Format /
+ * encapsulated CIP request or reply).
+ *
+ * ⚠️ Unlike most of the codec's protocols, every multi-byte field in this header is LITTLE-ENDIAN (ODVA
+ * inherits the CIP on-wire byte order). There is no little-endian helper in this codebase, so the uint16
+ * / uint32 fields are read and written byte-by-byte in their closures.
+ *
+ * The command-specific data is the CIP/CPF payload; decoding it (item counts, address/data items, the
+ * embedded CIP service request) is cross-message and command-dependent state, so this single-message
+ * codec keeps it verbatim as `data` hex (byte-perfect). The Length is auto-computed from the data on
+ * encode when not supplied, else honored verbatim (a crafted message may carry any Length); the data is
+ * bounded by the Length field so a pipelined/trailing message is left to the codec's recursion / RawData.
+ * A well-formed message round-trips byte-for-byte.
+ */
+class ENIP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'enip';
+        this.name = 'EtherNet/IP';
+        this.nickname = 'ENIP';
+        this.matchKeys = ['tcpport:44818', 'udpport:44818'];
+        //A leaf header — the CIP/CPF data requires command-dependent, cross-message parsing.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (ENIP.#schemaCache ??= ENIP.#buildSchema());
+    }
+    /** A little-endian unsigned 16-bit field of 2 octets at `offset`. */
+    static #fieldUInt16LE(name, offset, label) {
+        return {
+            type: 'integer',
+            label: label,
+            minimum: 0,
+            maximum: 65535,
+            decode: function () {
+                const b = this.readBytes(offset, 2);
+                this.instance[name].setValue(b[0] | (b[1] << 8));
+            },
+            encode: function () {
+                const node = this.instance[name];
+                let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                if (value > 65535) {
+                    this.recordError(node.getPath(), 'Maximum value is 65535');
+                    value = 65535;
+                }
+                if (value < 0) {
+                    this.recordError(node.getPath(), 'Minimum value is 0');
+                    value = 0;
+                }
+                node.setValue(value);
+                this.writeBytes(offset, Buffer.from([value & 0xff, (value >> 8) & 0xff]));
+            }
+        };
+    }
+    /** A little-endian unsigned 32-bit field of 4 octets at `offset`. */
+    static #fieldUInt32LE(name, offset, label) {
+        return {
+            type: 'integer',
+            label: label,
+            minimum: 0,
+            maximum: 4294967295,
+            decode: function () {
+                const b = this.readBytes(offset, 4);
+                this.instance[name].setValue((b[0] | (b[1] << 8) | (b[2] << 16) | (b[3] << 24)) >>> 0);
+            },
+            encode: function () {
+                const node = this.instance[name];
+                let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                if (value > 4294967295) {
+                    this.recordError(node.getPath(), 'Maximum value is 4294967295');
+                    value = 4294967295;
+                }
+                if (value < 0) {
+                    this.recordError(node.getPath(), 'Minimum value is 0');
+                    value = 0;
+                }
+                node.setValue(value);
+                this.writeBytes(offset, Buffer.from([value & 0xff, (value >> 8) & 0xff, (value >> 16) & 0xff, (value >>> 24) & 0xff]));
+            }
+        };
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'ENIP cmd=${command} session=${sessionHandle}',
+            properties: {
+                //All multi-byte encapsulation-header fields are LITTLE-ENDIAN (CIP on-wire byte order).
+                command: this.#fieldUInt16LE('command', 0, 'Command'),
+                length: {
+                    type: 'integer',
+                    label: 'Length',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        const b = this.readBytes(2, 2);
+                        this.instance.length.setValue(b[0] | (b[1] << 8));
+                    },
+                    encode: function () {
+                        //Length counts only the command-specific data that follows the 24-byte header.
+                        //Honored when supplied (a crafted message may lie); else derived from the data.
+                        const provided = this.instance.length.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : (0, HexToBuffer_1.HexToBuffer)(this.instance.data.getValue('')).length;
+                        if (value > 65535) {
+                            this.recordError(this.instance.length.getPath(), 'Maximum value is 65535');
+                            value = 65535;
+                        }
+                        this.instance.length.setValue(value);
+                        this.writeBytes(2, Buffer.from([value & 0xff, (value >> 8) & 0xff]));
+                    }
+                },
+                sessionHandle: this.#fieldUInt32LE('sessionHandle', 4, 'Session Handle'),
+                status: this.#fieldUInt32LE('status', 8, 'Status'),
+                //An 8-byte value the sender chooses and the target echoes back; opaque, kept verbatim.
+                senderContext: this.fieldHex('senderContext', 12, 8, 'Sender Context'),
+                options: this.#fieldUInt32LE('options', 20, 'Options'),
+                //The command-specific data (CIP Common Packet Format / encapsulated CIP), kept verbatim.
+                //Bounded by the Length field (data ends at offset 24 + Length) and the captured bytes,
+                //so trailing/pipelined data is left to the codec's recursion / RawData.
+                data: {
+                    type: 'string',
+                    label: 'Data',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        const length = this.instance.length.getValue(0);
+                        let end = 24 + length;
+                        if (end > remaining)
+                            end = remaining;
+                        this.instance.data.setValue(end > 24 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(24, end - 24)) : '');
+                    },
+                    encode: function () {
+                        const data = this.instance.data.getValue('');
+                        if (data)
+                            this.writeBytes(24, (0, HexToBuffer_1.HexToBuffer)(data));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //EtherNet/IP rides on TCP/UDP port 44818. The encapsulation header carries no strong content
+        //magic, so the well-known port is the signature: require the full 24-byte header to be present.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'tcp' && this.prevCodecModule.id !== 'udp')
+            return false;
+        return this.packet.length - this.startPos >= 24;
+    }
+}
+exports.ENIP = ENIP;

package/dist/headers/ESP.d.ts

@@ -0,0 +1,27 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * ESP — IP Encapsulating Security Payload (RFC 4303), carried directly over IP as protocol 50 (both
+ * IPv4 `protocol` and IPv6 `nxt`). The cleartext header is just two big-endian 32-bit words: the SPI
+ * (Security Parameters Index — identifies the Security Association, together with the destination
+ * address and protocol) and a monotonic Sequence Number (anti-replay counter). Everything after those
+ * eight bytes — the encapsulated payload, the trailing Pad / Pad Length / Next Header, and the optional
+ * Integrity Check Value — is protected by the SA's cipher/authenticator and is opaque on the wire.
+ *
+ * A dissector cannot split that opaque region without the SA keys (which are out of band), so ESP is a
+ * leaf header: the SPI and Sequence Number are surfaced, and the remaining bytes are kept verbatim as
+ * `encryptedPayload` hex, bounded by the enclosing IP datagram so a trailing FCS/padding is not pulled
+ * in. Nothing is recomputed on encode (a faithful executor carries the ciphertext as-is), so a
+ * well-formed ESP packet round-trips byte-for-byte.
+ */
+export declare class ESP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/ESP.js

@@ -0,0 +1,140 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ESP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * ESP — IP Encapsulating Security Payload (RFC 4303), carried directly over IP as protocol 50 (both
+ * IPv4 `protocol` and IPv6 `nxt`). The cleartext header is just two big-endian 32-bit words: the SPI
+ * (Security Parameters Index — identifies the Security Association, together with the destination
+ * address and protocol) and a monotonic Sequence Number (anti-replay counter). Everything after those
+ * eight bytes — the encapsulated payload, the trailing Pad / Pad Length / Next Header, and the optional
+ * Integrity Check Value — is protected by the SA's cipher/authenticator and is opaque on the wire.
+ *
+ * A dissector cannot split that opaque region without the SA keys (which are out of band), so ESP is a
+ * leaf header: the SPI and Sequence Number are surfaced, and the remaining bytes are kept verbatim as
+ * `encryptedPayload` hex, bounded by the enclosing IP datagram so a trailing FCS/padding is not pulled
+ * in. Nothing is recomputed on encode (a faithful executor carries the ciphertext as-is), so a
+ * well-formed ESP packet round-trips byte-for-byte.
+ */
+class ESP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'esp';
+        this.name = 'IP Encapsulating Security Payload';
+        this.nickname = 'ESP';
+        this.matchKeys = ['ipproto:50'];
+        //A leaf header — the payload is encrypted and cannot be dissected further without the SA keys.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (ESP.#schemaCache ??= ESP.#buildSchema());
+    }
+    /**
+     * Bytes available to ESP within the enclosing IP datagram — so a short IP payload does not let the
+     * verbatim `encryptedPayload` read into a trailing Ethernet FCS or padding. Bounds the payload read.
+     */
+    #available() {
+        let available = this.packet.length - this.startPos;
+        const prev = this.prevCodecModule;
+        if (prev && prev.id === 'ipv4') {
+            const ipPayload = prev.instance.length.getValue(0) - prev.length;
+            if (ipPayload >= 0 && ipPayload < available)
+                available = ipPayload;
+        }
+        else if (prev && prev.id === 'ipv6') {
+            const ipPayload = prev.instance.plen.getValue(0);
+            if (ipPayload >= 0 && ipPayload < available)
+                available = ipPayload;
+        }
+        return available < 0 ? 0 : available;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'ESP spi=${spi} seq=${sequenceNumber}',
+            properties: {
+                //Security Parameters Index — big-endian 32-bit SA selector.
+                spi: {
+                    type: 'integer',
+                    label: 'SPI',
+                    minimum: 0,
+                    maximum: 4294967295,
+                    decode: function () {
+                        this.instance.spi.setValue((0, BufferToNumber_1.BufferToUInt32)(this.readBytes(0, 4)));
+                    },
+                    encode: function () {
+                        const node = this.instance.spi;
+                        let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 4294967295) {
+                            this.recordError(node.getPath(), 'Maximum value is 4294967295');
+                            value = 4294967295;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBytes(0, (0, NumberToBuffer_1.UInt32ToBuffer)(value));
+                    }
+                },
+                //Anti-replay sequence number — big-endian 32-bit, monotonically increasing per SA.
+                sequenceNumber: {
+                    type: 'integer',
+                    label: 'Sequence Number',
+                    minimum: 0,
+                    maximum: 4294967295,
+                    decode: function () {
+                        this.instance.sequenceNumber.setValue((0, BufferToNumber_1.BufferToUInt32)(this.readBytes(4, 4)));
+                    },
+                    encode: function () {
+                        const node = this.instance.sequenceNumber;
+                        let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 4294967295) {
+                            this.recordError(node.getPath(), 'Maximum value is 4294967295');
+                            value = 4294967295;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBytes(4, (0, NumberToBuffer_1.UInt32ToBuffer)(value));
+                    }
+                },
+                //The encrypted payload + padding + Pad Length + Next Header + optional ICV. Opaque without
+                //the SA keys, so it is kept verbatim as hex; bounded by the IP datagram so a trailing FCS/
+                //padding is left to the codec's recursion / RawData.
+                encryptedPayload: {
+                    type: 'string',
+                    label: 'Encrypted Payload',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const end = this.#available();
+                        this.instance.encryptedPayload.setValue(end > 8 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(8, end - 8)) : '');
+                    },
+                    encode: function () {
+                        const data = this.instance.encryptedPayload.getValue('');
+                        if (data)
+                            this.writeBytes(8, (0, HexToBuffer_1.HexToBuffer)(data));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //ESP sits directly above IPv4 (protocol field) or IPv6 (next-header field) with protocol 50, and
+        //needs at least its 8-byte cleartext header (SPI + Sequence Number) within the IP payload.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.instance.protocol.getValue() !== 0x32 && this.prevCodecModule.instance.nxt.getValue() !== 0x32)
+            return false;
+        return this.#available() >= 8;
+    }
+}
+exports.ESP = ESP;

package/dist/headers/Elasticsearch.d.ts

@@ -0,0 +1,30 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * Elasticsearch transport protocol (internal node-to-node cluster traffic), TCP port 9300. Every
+ * transport message begins with a fixed prefix — the two ASCII bytes 'ES' (0x4553), a 4-byte
+ * big-endian Message Length (the count of bytes that follow the Length field: Request Id + Status +
+ * Version + the variable header + body), an 8-byte Request Id echoed between request and response, a
+ * 1-byte Status bitfield (bit0 request/response, bit1 error, bit2 compressed) and a 4-byte Version —
+ * followed by the message body (the variable header — feature set / action name — plus the serialized
+ * request or response object).
+ *
+ * The body layout is version-, action- and compression-dependent (StreamInput/StreamOutput vInt/vLong
+ * framing, optional DEFLATE, the action-specific TransportRequest/TransportResponse), so this
+ * single-message codec keeps it verbatim as `body` hex (byte-perfect) and does not sub-decode it. The
+ * Message Length is auto-computed from the fixed fields + body on encode when not supplied, else
+ * honored verbatim (a crafted message may lie); the message is bounded by the Length (total = 6 +
+ * messageLength) so a second pipelined message or trailing bytes are left to the codec's recursion /
+ * RawData. A well-formed message round-trips byte-for-byte.
+ */
+export declare class Elasticsearch extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/Elasticsearch.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Elasticsearch = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * Elasticsearch transport protocol (internal node-to-node cluster traffic), TCP port 9300. Every
+ * transport message begins with a fixed prefix — the two ASCII bytes 'ES' (0x4553), a 4-byte
+ * big-endian Message Length (the count of bytes that follow the Length field: Request Id + Status +
+ * Version + the variable header + body), an 8-byte Request Id echoed between request and response, a
+ * 1-byte Status bitfield (bit0 request/response, bit1 error, bit2 compressed) and a 4-byte Version —
+ * followed by the message body (the variable header — feature set / action name — plus the serialized
+ * request or response object).
+ *
+ * The body layout is version-, action- and compression-dependent (StreamInput/StreamOutput vInt/vLong
+ * framing, optional DEFLATE, the action-specific TransportRequest/TransportResponse), so this
+ * single-message codec keeps it verbatim as `body` hex (byte-perfect) and does not sub-decode it. The
+ * Message Length is auto-computed from the fixed fields + body on encode when not supplied, else
+ * honored verbatim (a crafted message may lie); the message is bounded by the Length (total = 6 +
+ * messageLength) so a second pipelined message or trailing bytes are left to the codec's recursion /
+ * RawData. A well-formed message round-trips byte-for-byte.
+ */
+class Elasticsearch extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'elasticsearch';
+        this.name = 'Elasticsearch Transport';
+        this.nickname = 'Elasticsearch';
+        this.matchKeys = ['tcpport:9300'];
+        //A leaf header — the body requires version/action/compression-dependent StreamInput parsing.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (Elasticsearch.#schemaCache ??= Elasticsearch.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'Elasticsearch reqId=${requestId} len=${messageLength}',
+            properties: {
+                //The 'ES' magic (0x4553) — kept verbatim as hex so any prefix still round-trips.
+                magic: this.fieldHex('magic', 0, 2, 'Magic'),
+                messageLength: {
+                    type: 'integer',
+                    label: 'Message Length',
+                    //Wire field: never constrain below the true lower bound. A truncated/crafted message
+                    //may decode any value in [0, 0xffffffff]; keep the full uint32 range so a decoded
+                    //value always re-encodes (clamped in the closure, never rejected by Ajv).
+                    minimum: 0,
+                    maximum: 4294967295,
+                    decode: function () {
+                        this.instance.messageLength.setValue((0, BufferToNumber_1.BufferToUInt32)(this.readBytes(2, 4)));
+                    },
+                    encode: function () {
+                        //Length counts everything after the Length field = requestId(8) + status(1) +
+                        //version(4) + body = 13 + body bytes. Honored when supplied (a crafted message
+                        //may lie); else derived from the body.
+                        const provided = this.instance.messageLength.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : 13 + (0, HexToBuffer_1.HexToBuffer)(this.instance.body.getValue('')).length;
+                        if (value > 4294967295) {
+                            this.recordError(this.instance.messageLength.getPath(), 'Maximum value is 4294967295');
+                            value = 4294967295;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.messageLength.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.messageLength.setValue(value);
+                        this.writeBytes(2, (0, NumberToBuffer_1.UInt32ToBuffer)(value));
+                    }
+                },
+                //An 8-byte correlation id (a Java long) matched across a request/response pair; opaque,
+                //kept verbatim so any value round-trips (no JS-number precision loss on 64 bits).
+                requestId: this.fieldHex('requestId', 6, 8, 'Request Id'),
+                //Status bitfield (bit0 request=0/response=1, bit1 error, bit2 compressed, bit3 handshake).
+                //Kept as a plain uint8 — byte-perfect and editable; the bit split is UI enrichment for later.
+                status: this.fieldUInt('status', 14, 1, 'Status'),
+                //Transport protocol version (an Elasticsearch internal version id).
+                version: this.fieldUInt('version', 15, 4, 'Version'),
+                //The variable header + serialized request/response body, kept verbatim. Bounded by the
+                //Message Length (message ends at offset 6 + messageLength) and the captured bytes, so
+                //trailing / pipelined data is left to the codec's recursion / RawData.
+                body: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        const messageLength = this.instance.messageLength.getValue(0);
+                        let end = 6 + messageLength;
+                        if (end > remaining)
+                            end = remaining;
+                        this.instance.body.setValue(end > 19 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(19, end - 19)) : '');
+                    },
+                    encode: function () {
+                        const body = this.instance.body.getValue('');
+                        if (body)
+                            this.writeBytes(19, (0, HexToBuffer_1.HexToBuffer)(body));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Elasticsearch transport rides on TCP port 9300. The 'ES' magic (0x4553) is only a 2-byte
+        //signature — too weak to claim traffic on any port — so selection stays port-bucketed
+        //(matchKeys) and the magic is an additional guard here. Require the full 19-byte fixed header
+        //(magic + length + requestId + status + version) so a short frame does not break byte-perfect
+        //round-trip, and reject a 9300 payload that is not 'ES' (falls through to raw).
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.packet.length - this.startPos < 19)
+            return false;
+        const magic = this.readBytes(0, 2, true);
+        return magic[0] === 0x45 && magic[1] === 0x53;
+    }
+}
+exports.Elasticsearch = Elasticsearch;

package/dist/headers/EtherCAT.d.ts

@@ -0,0 +1,35 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * EtherCAT — Ethernet for Control Automation Technology (IEC 61158 Type 12), carried directly in an
+ * Ethernet II frame with EtherType 0x88A4 (an Ethernet child — no IP/UDP). Immediately after the Ethernet
+ * header comes a 2-byte EtherCAT header, then the EtherCAT datagram chain.
+ *
+ * ⚠️ Unlike most of the codec's protocols (which are big-endian), the 2-byte EtherCAT header is a single
+ * LITTLE-ENDIAN uint16. There is no little-endian helper in this codebase, so the header word is read and
+ * written byte-by-byte in the closures (see ENIP for the precedent). Within that 16-bit LE value `h`:
+ *   - Length   = bits 0..10  (11 bits) = byte count of all datagrams that follow the 2-byte header.
+ *   - Reserved = bit 11      (1 bit)   = preserved verbatim for a byte-perfect round-trip.
+ *   - Type     = bits 12..15 (4 bits)  = 1 for EtherCAT commands (DLPDUs); other values exist.
+ * So `length = h & 0x07FF`, `reserved = (h >> 11) & 0x1`, `type = (h >> 12) & 0x0F`; and on encode
+ * `h = (length & 0x07FF) | ((reserved & 1) << 11) | ((type & 0x0F) << 12)`, written LITTLE-ENDIAN as
+ * `[h & 0xff, (h >> 8) & 0xff]`.
+ *
+ * The datagram chain (each datagram: 10-byte header + data + 2-byte working counter) is command-dependent,
+ * addressed, chainable state, so this minimal slice keeps it verbatim as `data` hex (byte-perfect), bounded
+ * by the Length field (data ends at offset 2 + Length, clamped to the captured bytes). Anything after the
+ * Length-bounded region is left to the codec's recursion / RawData (e.g. Ethernet padding). Structuring the
+ * datagram chain (Cmd/Idx/Address/Len/IRQ/WKC per datagram) is a deferred slice. Length is honor-else-derive
+ * on encode: honored when supplied (a crafted frame may carry any Length), else derived from the data.
+ */
+export declare class EtherCAT extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}