@netkitty/codec 1.0.0

package/dist/headers/IGMP.js

@@ -0,0 +1,274 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IGMP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToIP_1 = require("../helper/BufferToIP");
+const IPToBuffer_1 = require("../helper/IPToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * IGMP — Internet Group Management Protocol (IGMPv2 RFC 2236, IGMPv3 RFC 3376), carried directly over
+ * IPv4 as protocol 2. Every message opens with a fixed 4-byte header — Type (1), Max Resp Code (1) and
+ * a 16-bit Checksum (ones-complement over the whole IGMP message) — followed by a type-driven body:
+ *
+ *  - v1/v2 (Membership Query with total length 8 / Report 0x12 / Report 0x16 / Leave 0x17): a single
+ *    4-byte Group Address (dotted-quad).
+ *  - v3 Membership Query (Type 0x11 with an IP payload ≥ 12 bytes): Group Address (4) + Resv/S/QRV (1) +
+ *    QQIC (1) + Number of Sources (2) + that many 4-byte source addresses, kept verbatim as `sources`
+ *    hex (bounded by the source count and the IP payload).
+ *  - v3 Membership Report (Type 0x22): 2 reserved bytes + Number of Group Records (2) + the group
+ *    records, kept verbatim as `records` hex (bounded by the IP payload).
+ *
+ * The Checksum is honored verbatim, never recomputed (encode is a faithful executor); a well-formed
+ * message round-trips byte-for-byte. The message is bounded by the enclosing IPv4 datagram (total
+ * length − IP header length) so trailing padding is left to the codec's recursion / RawData. The v3
+ * source/record counts are honor-else-derive; the v3 record structures are kept as bounded hex.
+ */
+class IGMP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'igmp';
+        this.name = 'Internet Group Management Protocol';
+        this.nickname = 'IGMP';
+        this.matchKeys = ['ipproto:2'];
+        //A leaf header — the v3 group-record structures are kept as bounded hex, nothing demuxes off IGMP.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (IGMP.#schemaCache ??= IGMP.#buildSchema());
+    }
+    /**
+     * Bytes of IGMP the IP layer below says are available: IPv4 carries a total-length field, so the
+     * IGMP payload is (total length − IP header length). Mirrors the GRE/OSPF #available() pattern so
+     * body reads are bounded by the real on-wire length rather than trusting a count field alone.
+     * Returns the captured-bytes remainder when no length is present (0 floor).
+     * @private
+     */
+    #available() {
+        const prev = this.prevCodecModule;
+        if (!prev)
+            return 0;
+        const ipv4TotalLength = prev.instance.length.getValue(0);
+        if (ipv4TotalLength) {
+            const payload = ipv4TotalLength - prev.length;
+            return payload < 0 ? 0 : payload;
+        }
+        const remaining = this.packet.length - this.startPos;
+        return remaining < 0 ? 0 : remaining;
+    }
+    /** True when this is an IGMPv3 Membership Query — Type 0x11 with an IP payload of at least 12 bytes. */
+    #isV3Query() {
+        const type = this.instance.type.getValue(0);
+        return type === 0x11 && this.#available() >= 12;
+    }
+    /** True when this is an IGMPv3 Membership Report (Type 0x22): reserved + group records, no group address. */
+    #isV3Report() {
+        const type = this.instance.type.getValue(0);
+        return type === 0x22;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'IGMP type=${type} group=${groupAddress}',
+            properties: {
+                //==== Fixed 4-byte header (RFC 2236 §2, RFC 3376 §4) ====
+                type: this.fieldUInt('type', 0, 1, 'Type'),
+                maxRespCode: this.fieldUInt('maxRespCode', 1, 1, 'Max Resp Code'),
+                //Honored verbatim: the IGMP checksum (ones-complement over the whole message) is never
+                //recomputed, so a captured packet round-trips byte-for-byte even if it lies.
+                checksum: this.fieldUInt('checksum', 2, 2, 'Checksum'),
+                //==== Group Address (offset 4): present for every type except the v3 Report (0x22),
+                //whose bytes 4-7 are reserved + record count instead. ====
+                groupAddress: {
+                    type: 'string',
+                    label: 'Multicast Address',
+                    minLength: 7,
+                    maxLength: 15,
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.IPv4,
+                    decode: function () {
+                        if (this.#isV3Report())
+                            return;
+                        this.instance.groupAddress.setValue((0, BufferToIP_1.BufferToIPv4)(this.readBytes(4, 4)));
+                    },
+                    encode: function () {
+                        if (this.#isV3Report())
+                            return;
+                        const groupAddress = this.instance.groupAddress.getValue('0.0.0.0', (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        this.instance.groupAddress.setValue(groupAddress);
+                        this.writeBytes(4, (0, IPToBuffer_1.IPv4ToBuffer)(groupAddress));
+                    }
+                },
+                //==== IGMPv3 Membership Query body (RFC 3376 §4.1), decoded only when #isV3Query() ====
+                resvSQRV: {
+                    type: 'integer',
+                    label: 'Resv/S/QRV',
+                    minimum: 0,
+                    maximum: 255,
+                    decode: function () {
+                        if (!this.#isV3Query())
+                            return;
+                        this.instance.resvSQRV.setValue(this.readBytes(8, 1)[0] ?? 0);
+                    },
+                    encode: function () {
+                        if (!this.#isV3Query())
+                            return;
+                        this.writeBytes(8, Buffer.from([this.instance.resvSQRV.getValue(0) & 0xff]));
+                    }
+                },
+                qqic: {
+                    type: 'integer',
+                    label: 'QQIC',
+                    minimum: 0,
+                    maximum: 255,
+                    decode: function () {
+                        if (!this.#isV3Query())
+                            return;
+                        this.instance.qqic.setValue(this.readBytes(9, 1)[0] ?? 0);
+                    },
+                    encode: function () {
+                        if (!this.#isV3Query())
+                            return;
+                        this.writeBytes(9, Buffer.from([this.instance.qqic.getValue(0) & 0xff]));
+                    }
+                },
+                numSources: {
+                    type: 'integer',
+                    label: 'Number of Sources',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        if (!this.#isV3Query())
+                            return;
+                        this.instance.numSources.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(10, 2)));
+                    },
+                    encode: function () {
+                        if (!this.#isV3Query())
+                            return;
+                        //honor-else-derive: honored when supplied (a crafted message may lie); else the
+                        //number of 4-byte source addresses carried in the `sources` hex.
+                        const provided = this.instance.numSources.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : Math.floor((0, HexToBuffer_1.HexToBuffer)(this.instance.sources.getValue('')).length / 4);
+                        if (value > 65535) {
+                            this.recordError(this.instance.numSources.getPath(), 'Maximum value is 65535');
+                            value = 65535;
+                        }
+                        if (value < 0)
+                            value = 0;
+                        this.instance.numSources.setValue(value);
+                        this.writeBytes(10, (0, NumberToBuffer_1.UInt16ToBuffer)(value));
+                    }
+                },
+                //Source addresses (offset 12), Number-of-Sources × 4 bytes, kept verbatim. Bounded by
+                //both the source count and the IP payload so a lying count can't read past the datagram;
+                //any surplus is left to the codec's recursion / RawData.
+                sources: {
+                    type: 'string',
+                    label: 'Source Addresses',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        if (!this.#isV3Query())
+                            return;
+                        const available = this.#available();
+                        let byteLength = this.instance.numSources.getValue(0) * 4;
+                        const max = available - 12;
+                        if (byteLength > max)
+                            byteLength = max;
+                        if (byteLength > 0)
+                            this.instance.sources.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(12, byteLength)));
+                    },
+                    encode: function () {
+                        if (!this.#isV3Query())
+                            return;
+                        const sources = this.instance.sources.getValue('');
+                        if (sources)
+                            this.writeBytes(12, (0, HexToBuffer_1.HexToBuffer)(sources));
+                    }
+                },
+                //==== IGMPv3 Membership Report body (RFC 3376 §4.2), decoded only for Type 0x22 ====
+                reserved: {
+                    type: 'string',
+                    label: 'Reserved',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    hidden: true,
+                    decode: function () {
+                        if (!this.#isV3Report())
+                            return;
+                        this.instance.reserved.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(4, 2)));
+                    },
+                    encode: function () {
+                        if (!this.#isV3Report())
+                            return;
+                        this.writeBytes(4, (0, HexToBuffer_1.HexToBuffer)(this.instance.reserved.getValue('0000')));
+                    }
+                },
+                numGroupRecords: {
+                    type: 'integer',
+                    label: 'Number of Group Records',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        if (!this.#isV3Report())
+                            return;
+                        this.instance.numGroupRecords.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(6, 2)));
+                    },
+                    encode: function () {
+                        if (!this.#isV3Report())
+                            return;
+                        //Honored verbatim (a group record is variable-length, so the count is not derived
+                        //from the bounded `records` hex); defaults to 0 when not supplied.
+                        let value = this.instance.numGroupRecords.getValue(0);
+                        if (value > 65535) {
+                            this.recordError(this.instance.numGroupRecords.getPath(), 'Maximum value is 65535');
+                            value = 65535;
+                        }
+                        if (value < 0)
+                            value = 0;
+                        this.instance.numGroupRecords.setValue(value);
+                        this.writeBytes(6, (0, NumberToBuffer_1.UInt16ToBuffer)(value));
+                    }
+                },
+                //Group records (offset 8), kept verbatim as bounded hex to the end of the IP payload —
+                //the group-record structures (record type, aux data, per-record sources) are not
+                //sub-decoded in this slice.
+                records: {
+                    type: 'string',
+                    label: 'Group Records',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        if (!this.#isV3Report())
+                            return;
+                        const available = this.#available();
+                        if (available > 8)
+                            this.instance.records.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(8, available - 8)));
+                    },
+                    encode: function () {
+                        if (!this.#isV3Report())
+                            return;
+                        const records = this.instance.records.getValue('');
+                        if (records)
+                            this.writeBytes(8, (0, HexToBuffer_1.HexToBuffer)(records));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //IGMP sits directly on IPv4 with protocol 2 (accept an IPv6 next-header of 2 too, for symmetry
+        //with the other IP-borne codecs), and needs at least its fixed 4-byte header plus a group
+        //address (the smallest well-formed v1/v2 message is 8 bytes) within the IP payload.
+        if (!this.prevCodecModule)
+            return false;
+        const protocol = this.prevCodecModule.instance.protocol.getValue(0);
+        const nextHeader = this.prevCodecModule.instance.nxt.getValue(0);
+        if (protocol !== 2 && nextHeader !== 2)
+            return false;
+        return this.#available() >= 8;
+    }
+}
+exports.IGMP = IGMP;

package/dist/headers/IMAP.d.ts

@@ -0,0 +1,32 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * IMAP — the Internet Message Access Protocol version 4rev1 (RFC 3501), carried as US-ASCII text over TCP
+ * well-known port 143 (or 993 for the TLS-wrapped IMAPS bucket). The control channel is line-based and
+ * TAG-prefixed: a client sends `<tag> COMMAND args\r\n` (`a001 LOGIN alice secret\r\n`, `A2 SELECT INBOX\r\n`)
+ * and the server answers with either a tagged status completion (`a001 OK LOGIN completed\r\n`), an
+ * untagged response (`* OK IMAP4rev1 ready\r\n`, `* 18 EXISTS\r\n`), or a command continuation request
+ * (`+ Ready for literal data\r\n`).
+ *
+ * Like FTP, SMTP, POP3, Syslog, SIP and HTTP, the message is text whose full internal structure (arbitrary
+ * arguments, significant whitespace, literals, multi-line untagged responses) is richer than a form needs.
+ * So the ENTIRE raw message is kept verbatim as the authoritative `message` field (hex) and re-emitted
+ * untouched; only the first line is parsed on decode into display-only metadata (kind/tag/command/status/
+ * text). Encode never reconstructs the message from the parsed fields — it writes `message` back
+ * byte-for-byte — so any conformant (or even malformed) IMAP line round-trips exactly.
+ *
+ * Note: a single TCP segment may carry more than one line or only part of a multi-line/literal response;
+ * reassembly across segments is out of scope. This single-segment codec keeps whatever bytes are present
+ * verbatim, which is byte-perfect for the single-packet case.
+ */
+export declare class IMAP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/IMAP.js

@@ -0,0 +1,185 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IMAP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/** IMAP command verbs (RFC 3501 + STARTTLS/IDLE) used only to recognize a `<tag> VERB` command line. */
+const IMAP_COMMANDS = ['CAPABILITY', 'NOOP', 'LOGOUT', 'STARTTLS', 'AUTHENTICATE', 'LOGIN', 'SELECT', 'EXAMINE', 'CREATE', 'DELETE', 'RENAME', 'SUBSCRIBE', 'UNSUBSCRIBE', 'LIST', 'LSUB', 'STATUS', 'APPEND', 'CHECK', 'CLOSE', 'EXPUNGE', 'SEARCH', 'FETCH', 'STORE', 'COPY', 'UID', 'IDLE'];
+/** IMAP status conditions (RFC 3501 §7.1) that a tagged/untagged server response carries after its prefix. */
+const IMAP_STATUSES = ['OK', 'NO', 'BAD', 'PREAUTH', 'BYE'];
+/**
+ * IMAP — the Internet Message Access Protocol version 4rev1 (RFC 3501), carried as US-ASCII text over TCP
+ * well-known port 143 (or 993 for the TLS-wrapped IMAPS bucket). The control channel is line-based and
+ * TAG-prefixed: a client sends `<tag> COMMAND args\r\n` (`a001 LOGIN alice secret\r\n`, `A2 SELECT INBOX\r\n`)
+ * and the server answers with either a tagged status completion (`a001 OK LOGIN completed\r\n`), an
+ * untagged response (`* OK IMAP4rev1 ready\r\n`, `* 18 EXISTS\r\n`), or a command continuation request
+ * (`+ Ready for literal data\r\n`).
+ *
+ * Like FTP, SMTP, POP3, Syslog, SIP and HTTP, the message is text whose full internal structure (arbitrary
+ * arguments, significant whitespace, literals, multi-line untagged responses) is richer than a form needs.
+ * So the ENTIRE raw message is kept verbatim as the authoritative `message` field (hex) and re-emitted
+ * untouched; only the first line is parsed on decode into display-only metadata (kind/tag/command/status/
+ * text). Encode never reconstructs the message from the parsed fields — it writes `message` back
+ * byte-for-byte — so any conformant (or even malformed) IMAP line round-trips exactly.
+ *
+ * Note: a single TCP segment may carry more than one line or only part of a multi-line/literal response;
+ * reassembly across segments is out of scope. This single-segment codec keeps whatever bytes are present
+ * verbatim, which is byte-perfect for the single-packet case.
+ */
+class IMAP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'imap';
+        this.name = 'Internet Message Access Protocol';
+        this.nickname = 'IMAP';
+        //IMAP is recognized ONLY on its well-known port buckets 143 (cleartext) and 993 (TLS-wrapped IMAPS) —
+        //deliberately NOT via heuristicFallback. Like SMTP/POP3, and unlike HTTP/RTSP (whose method sets are
+        //distinctive), IMAP's line signature is a generic `<tag> VERB`/`<tag> OK` shape whose second token
+        //(LOGIN/SELECT/LIST/STATUS/SEARCH/OK/NO/BAD/…) is SHARED with other US-ASCII line protocols this codec
+        //models — FTP (LIST/STATUS as STAT-family, generic verbs) and the plain OK/NO/BAD status words appear
+        //in many text protocols. Joining the global heuristic chain would let IMAP mislabel such a line on
+        //another protocol's port as IMAP (and vice-versa). Confining IMAP to its tcp:143/tcp:993 buckets keeps
+        //that collision impossible; alt-port IMAP is rare and falls losslessly to raw. (IMAPS on 993 is
+        //normally TLS-wrapped, so the bucket rarely carries plain IMAP text, but is listed for completeness.)
+        this.matchKeys = ['tcpport:143', 'tcpport:993'];
+        //A leaf header — the IMAP session it belongs to is a higher-layer concern.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (_a.#schemaCache ??= _a.#buildSchema());
+    }
+    /**
+     * Bytes of this header: IMAP rides on TCP, which has no per-message length, so take the rest of the
+     * segment. Reassembly across segments is out of scope (see class doc).
+     */
+    #payloadLength() {
+        const available = this.packet.length - this.startPos;
+        return available < 0 ? 0 : available;
+    }
+    /** The first line of the message (up to the first CRLF, or the whole payload if none). */
+    static #firstLine(text) {
+        const idx = text.indexOf('\r\n');
+        return idx >= 0 ? text.slice(0, idx) : text;
+    }
+    /**
+     * Parse the first line into the display-only metadata fields. The first token selects the shape:
+     * `*` → an untagged server response; `+` → a continuation request; anything else is a TAG, and the
+     * second token then decides between a tagged RESPONSE (when it is an OK/NO/BAD/PREAUTH/BYE status) and
+     * a client COMMAND (when it is a verb). Populated on decode only — these fields have no encode, so they
+     * never affect the re-emitted bytes and never mutate `message`. Never throws: missing/garbage tokens
+     * yield empty strings.
+     */
+    #parseFirstLine(text) {
+        const line = _a.#firstLine(text);
+        const sp1 = line.indexOf(' ');
+        const first = sp1 >= 0 ? line.slice(0, sp1) : line;
+        const rest = sp1 >= 0 ? line.slice(sp1 + 1) : '';
+        if (first === '*') {
+            //Untagged server response: `* <status?> <text>` (e.g. `* OK ...`, `* 18 EXISTS`).
+            const sp2 = rest.indexOf(' ');
+            const second = (sp2 >= 0 ? rest.slice(0, sp2) : rest).toUpperCase();
+            const isStatus = IMAP_STATUSES.includes(second);
+            this.instance.kind.setValue('untagged');
+            this.instance.tag.setValue('');
+            this.instance.command.setValue('');
+            this.instance.status.setValue(isStatus ? second : '');
+            this.instance.text.setValue(isStatus ? (sp2 >= 0 ? rest.slice(sp2 + 1) : '') : rest);
+            return;
+        }
+        if (first === '+') {
+            //Continuation request: `+ <text>` — the server asks the client to send more (e.g. a literal).
+            this.instance.kind.setValue('continuation');
+            this.instance.tag.setValue('');
+            this.instance.command.setValue('');
+            this.instance.status.setValue('');
+            this.instance.text.setValue(rest);
+            return;
+        }
+        //Tagged line: the first token is the TAG. The second token is either a status (tagged response) or
+        //a verb (client command).
+        const sp2 = rest.indexOf(' ');
+        const second = (sp2 >= 0 ? rest.slice(0, sp2) : rest).toUpperCase();
+        const remainder = sp2 >= 0 ? rest.slice(sp2 + 1) : '';
+        this.instance.tag.setValue(first);
+        if (IMAP_STATUSES.includes(second)) {
+            this.instance.kind.setValue('tagged');
+            this.instance.command.setValue('');
+            this.instance.status.setValue(second);
+            this.instance.text.setValue(remainder);
+            return;
+        }
+        this.instance.kind.setValue('command');
+        this.instance.command.setValue(second);
+        this.instance.status.setValue('');
+        this.instance.text.setValue(remainder);
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'IMAP ${command}${status}',
+            properties: {
+                //The whole raw message is the single source of truth: decoded verbatim to hex and
+                //re-emitted untouched (byte-perfect for any IMAP control text). The first line is parsed
+                //into the display-only metadata below, which carry no codec of their own.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        if (available <= 0) {
+                            this.instance.message.setValue('');
+                            this.#parseFirstLine('');
+                            return;
+                        }
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parseFirstLine(raw.toString('latin1'));
+                    },
+                    encode: function () {
+                        //Re-emit the authoritative message verbatim — never reconstruct from metadata.
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                },
+                //Display-only metadata parsed from the first line on decode (no encode — populated by the
+                //message field above, never read back). kind distinguishes the four line shapes; tag is the
+                //command/response tag (empty for untagged/continuation); command/status/text describe the
+                //recognized tokens.
+                kind: { type: 'string', label: 'Kind' },
+                tag: { type: 'string', label: 'Tag' },
+                command: { type: 'string', label: 'Command' },
+                status: { type: 'string', label: 'Status' },
+                text: { type: 'string', label: 'Text' }
+            }
+        };
+    }
+    match() {
+        //IMAP rides on TCP as US-ASCII, TAG-prefixed text. Recognize it by the line signature: an `* `
+        //(untagged) or `+ ` (continuation) server prefix, or a `<tag> <VERB-or-status>` shape whose second
+        //token is a known IMAP verb or an OK/NO/BAD/PREAUTH/BYE status — so non-IMAP traffic on port
+        //143/993 falls through to raw rather than claiming an un-decodable text layer.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.#payloadLength() < 3)
+            return false;
+        const lead = this.readBytes(0, 32, true).toString('latin1');
+        if (/^\* /.test(lead))
+            return true;
+        if (/^\+ /.test(lead))
+            return true;
+        const line = _a.#firstLine(lead);
+        const sp1 = line.indexOf(' ');
+        if (sp1 < 0)
+            return false;
+        const second = (line.slice(sp1 + 1).split(/[ \r]/)[0] || '').toUpperCase();
+        return IMAP_COMMANDS.includes(second) || IMAP_STATUSES.includes(second);
+    }
+}
+exports.IMAP = IMAP;
+_a = IMAP;

package/dist/headers/IPFIX.d.ts

@@ -0,0 +1,29 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * IPFIX — IP Flow Information Export (RFC 7011, also known as NetFlow v10), UDP port 4739. Every IPFIX
+ * Message begins with a fixed 16-byte Message Header (all big-endian) — Version (always 10), Length (the
+ * total message octet count including this header), Export Time, Sequence Number and Observation Domain
+ * ID — followed by one or more Sets. Each Set is a 4-byte header — Set ID (2 = Template Set, 3 = Options
+ * Template Set, >= 256 = a Data Set keyed by the Template ID) plus Set Length (the octet count of the
+ * whole Set including its 4-byte header) — followed by the Set records.
+ *
+ * The record layout of a Set is template-driven: a Data Set can only be parsed against the Template Set
+ * that defined its Template ID, which is cross-message, session-scoped state. So this single-message
+ * codec keeps each Set structured only down to {Set ID, Set Length, verbatim hex body} — byte-perfect —
+ * and does not sub-decode the records. The message Length is auto-computed on encode when not supplied,
+ * else honored verbatim (a crafted message may lie); each Set Length is honored verbatim, and the Sets
+ * walk is bounded by BOTH the message Length and the captured UDP payload, so trailing bytes are left to
+ * the codec's recursion / RawData. A well-formed message round-trips byte-for-byte.
+ */
+export declare class IPFIX extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}