@netkitty/codec 1.0.0

package/dist/headers/SSDP.js

@@ -0,0 +1,161 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SSDP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/** SSDP request methods (UPnP Device Architecture) used only to recognize a request start-line. */
+const SSDP_METHODS = ['NOTIFY', 'M-SEARCH'];
+/**
+ * SSDP — the Simple Service Discovery Protocol (UPnP Device Architecture), the discovery layer of UPnP
+ * carried over UDP port 1900 (advertisements/searches to the multicast group 239.255.255.250, unicast
+ * search responses). An SSDP message is HTTP/1.1-shaped US-ASCII text but is NOT HTTP: a start-line,
+ * then header lines, and a terminating CRLF. Requests use `NOTIFY * HTTP/1.1` (advertise) or
+ * `M-SEARCH * HTTP/1.1` (search); responses use a `HTTP/1.1 200 OK` Status-Line.
+ *
+ * Like SIP and HTTP, the message body is text whose full internal structure (HOST/NT/NTS/USN/ST/MAN/…
+ * header fields, significant whitespace/header ordering/casing) is far richer than a form needs. So the
+ * ENTIRE raw message is kept verbatim as the authoritative `message` field (hex) and re-emitted
+ * untouched; only the start-line is parsed on decode into display-only metadata (method/uri/version or
+ * status-code/reason). Encode never reconstructs the message from the parsed fields — it writes
+ * `message` back byte-for-byte — so any conformant (or even malformed) SSDP message round-trips exactly.
+ */
+class SSDP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'ssdp';
+        this.name = 'Simple Service Discovery Protocol';
+        this.nickname = 'SSDP';
+        //SSDP is strictly UDP port 1900 — the port bucket alone dispatches. No heuristicFallback: the
+        //start-line signature (NOTIFY/M-SEARCH/HTTP-1.1) overlaps HTTP, so recognition stays confined to the
+        //1900 bucket to avoid claiming HTTP traffic on arbitrary ports.
+        this.matchKeys = ['udpport:1900'];
+        //A leaf header — the referenced device description (LOCATION URL) and the discovery exchange are a
+        //higher-layer concern.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (_a.#schemaCache ??= _a.#buildSchema());
+    }
+    /**
+     * Bytes of this header: SSDP rides on UDP, so it is bounded by the datagram length (so a retained
+     * FCS/padding is not absorbed). Falls back to the rest of the captured buffer if the UDP length is
+     * absent/implausible.
+     */
+    #payloadLength() {
+        let available = this.packet.length - this.startPos;
+        if (this.prevCodecModule && this.prevCodecModule.id === 'udp') {
+            const udpLength = this.prevCodecModule.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < available)
+                available = udpLength - 8;
+        }
+        return available < 0 ? 0 : available;
+    }
+    /** The first line of the message (up to the first CRLF, or the whole payload if none). */
+    static #firstLine(text) {
+        const idx = text.indexOf('\r\n');
+        return idx >= 0 ? text.slice(0, idx) : text;
+    }
+    /**
+     * Parse the start-line into the display-only metadata fields. A Status-Line begins with the
+     * HTTP-Version ("HTTP/1.1"); anything else is treated as a Request-Line. Populated on decode only —
+     * these fields have no encode, so they never affect the re-emitted bytes and never mutate `message`.
+     * Never throws: a non-numeric status yields 0, missing tokens yield empty strings.
+     */
+    #parseStartLine(text) {
+        const line = _a.#firstLine(text);
+        if (line.startsWith('HTTP/')) {
+            //Status-Line: HTTP-Version SP Status-Code SP Reason-Phrase
+            const match = line.match(/^(\S+)\s+(\d{3})\s*(.*)$/);
+            this.instance.isRequest.setValue(false);
+            this.instance.method.setValue('');
+            this.instance.requestUri.setValue('');
+            this.instance.version.setValue(match ? match[1] : (line.split(' ')[0] || ''));
+            this.instance.statusCode.setValue(match ? Number(match[2]) : 0);
+            this.instance.reasonPhrase.setValue(match ? match[3] : '');
+            //Info-column text for a response: "200 OK". Kept separate from the numeric statusCode so the
+            //summary never renders a stray "0" for requests (whose statusCode is 0).
+            this.instance.info.setValue((match ? match[2] : '') + (match && match[3] ? ' ' + match[3] : ''));
+            return;
+        }
+        //Request-Line: METHOD SP Request-URI SP HTTP-Version (Request-URI is "*" for SSDP)
+        const parts = line.split(' ');
+        this.instance.isRequest.setValue(true);
+        this.instance.method.setValue(parts[0] ? parts[0] : '');
+        this.instance.requestUri.setValue(parts.length > 1 ? parts[1] : '');
+        //The HTTP-Version is the last whitespace-delimited token; the Request-URI itself has no spaces.
+        this.instance.version.setValue(parts.length > 2 ? parts[parts.length - 1] : '');
+        this.instance.statusCode.setValue(0);
+        this.instance.reasonPhrase.setValue('');
+        //Info-column text for a request: "M-SEARCH *".
+        this.instance.info.setValue((parts[0] ? parts[0] : '') + (parts.length > 1 && parts[1] ? ' ' + parts[1] : ''));
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'SSDP ${info}',
+            properties: {
+                //The whole raw message is the single source of truth: decoded verbatim to hex and
+                //re-emitted untouched (byte-perfect for any SSDP message). The start-line is parsed into
+                //the display-only metadata below, which carry no codec of their own.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        if (available <= 0) {
+                            this.instance.message.setValue('');
+                            this.#parseStartLine('');
+                            return;
+                        }
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parseStartLine(raw.toString('latin1'));
+                    },
+                    encode: function () {
+                        //Re-emit the authoritative message verbatim — never reconstruct from metadata.
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                },
+                //Display-only metadata parsed from the start-line on decode (no encode — populated by the
+                //message field above, never read back). isRequest distinguishes a Request-Line from a
+                //Status-Line; method/requestUri are for requests, statusCode/reasonPhrase for responses.
+                isRequest: { type: 'boolean', label: 'Is Request' },
+                //Display-only Info-column text ("M-SEARCH *" / "200 OK"), set on decode; no encode, so it
+                //never affects the re-emitted bytes.
+                info: { type: 'string', label: 'Info' },
+                method: { type: 'string', label: 'Method' },
+                requestUri: { type: 'string', label: 'Request URI' },
+                version: { type: 'string', label: 'Version' },
+                statusCode: { type: 'integer', label: 'Status Code', minimum: 0, maximum: 999 },
+                reasonPhrase: { type: 'string', label: 'Reason Phrase' }
+            }
+        };
+    }
+    match() {
+        //SSDP rides on UDP port 1900 as HTTP/1.1-shaped US-ASCII text. Recognize it by the start-line
+        //signature: a known request method followed by a space (the trailing space rejects e.g.
+        //"NOTIFYX"), or the "HTTP/1." response version — so non-SSDP traffic on port 1900 falls through
+        //to raw rather than claiming an un-decodable text layer.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'udp')
+            return false;
+        if (this.#payloadLength() <= 0)
+            return false;
+        const lead = this.readBytes(0, 16, true).toString('latin1');
+        if (lead.startsWith('HTTP/1.'))
+            return true;
+        for (const method of SSDP_METHODS) {
+            if (lead.startsWith(method + ' '))
+                return true;
+        }
+        return false;
+    }
+}
+exports.SSDP = SSDP;
+_a = SSDP;

package/dist/headers/SSH.d.ts

@@ -0,0 +1,44 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * SSH — the Secure Shell Transport Layer Protocol (RFC 4253), carried over TCP well-known port 22.
+ *
+ * An SSH connection has two shapes on the wire, and this codec handles BOTH:
+ *
+ *  1. Identification string. The very first thing each side sends is a US-ASCII line
+ *     `SSH-protoversion-softwareversion[ SP comments]` terminated by CR LF (a lone LF is tolerated),
+ *     e.g. `SSH-2.0-OpenSSH_9.6\r\n` (also seen: `SSH-1.99-…` for 2.0 servers that also speak 1.x, and
+ *     legacy `SSH-1.5-…`). Like the other US-ASCII line protocols in this codec (HTTP/SIP/FTP), the
+ *     structure a form needs is far poorer than the exact bytes a peer sees, so the ENTIRE line is kept
+ *     verbatim as the authoritative `message` field (hex) and re-emitted untouched; only the first line
+ *     is parsed on decode into display-only metadata (protoVersion/softwareVersion/identString). Encode
+ *     never reconstructs the line from those fields — it writes `message` back byte-for-byte.
+ *
+ *  2. Binary Packet Protocol. After the identifications comes the framed protocol:
+ *     `packet_length(4, BE) · padding_length(1) · payload(packet_length - padding_length - 1) ·
+ *     padding(padding_length) · MAC(mac_len)`. The MAC is present only once keys are exchanged; the
+ *     first binary packet (SSH_MSG_KEXINIT) is sent in cleartext and is readable. This codec keeps the
+ *     framing minimal and byte-exact: `packet_length` and `padding_length` are structured, editable
+ *     fields, and everything they bound (payload + padding) is kept verbatim as `data` hex. The packet
+ *     is bounded by `packet_length + 4` bytes; any MAC/trailing/pipelined bytes are left to the codec's
+ *     recursion / RawData (decoding the MAC needs cross-message negotiated cipher/MAC state, which is
+ *     out of scope for a single-message codec). A well-formed message round-trips byte-for-byte.
+ *
+ * Matching rationale (NO heuristicFallback): SSH is claimed ONLY on the tcp:22 bucket. The
+ * identification line has a strong, distinctive signature ("SSH-") — but the Binary Packet Protocol has
+ * NO content magic at all (a 4-byte length + a padding byte is indistinguishable from arbitrary binary
+ * data), so recognizing binary SSH packets relies entirely on the well-known port. Joining the global
+ * content-heuristic chain would therefore let SSH mislabel arbitrary binary TCP payloads on any port.
+ * Confining SSH to tcp:22 keeps that impossible; alt-port SSH is rare and falls losslessly to raw.
+ */
+export declare class SSH extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/SSH.js

@@ -0,0 +1,274 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SSH = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * SSH — the Secure Shell Transport Layer Protocol (RFC 4253), carried over TCP well-known port 22.
+ *
+ * An SSH connection has two shapes on the wire, and this codec handles BOTH:
+ *
+ *  1. Identification string. The very first thing each side sends is a US-ASCII line
+ *     `SSH-protoversion-softwareversion[ SP comments]` terminated by CR LF (a lone LF is tolerated),
+ *     e.g. `SSH-2.0-OpenSSH_9.6\r\n` (also seen: `SSH-1.99-…` for 2.0 servers that also speak 1.x, and
+ *     legacy `SSH-1.5-…`). Like the other US-ASCII line protocols in this codec (HTTP/SIP/FTP), the
+ *     structure a form needs is far poorer than the exact bytes a peer sees, so the ENTIRE line is kept
+ *     verbatim as the authoritative `message` field (hex) and re-emitted untouched; only the first line
+ *     is parsed on decode into display-only metadata (protoVersion/softwareVersion/identString). Encode
+ *     never reconstructs the line from those fields — it writes `message` back byte-for-byte.
+ *
+ *  2. Binary Packet Protocol. After the identifications comes the framed protocol:
+ *     `packet_length(4, BE) · padding_length(1) · payload(packet_length - padding_length - 1) ·
+ *     padding(padding_length) · MAC(mac_len)`. The MAC is present only once keys are exchanged; the
+ *     first binary packet (SSH_MSG_KEXINIT) is sent in cleartext and is readable. This codec keeps the
+ *     framing minimal and byte-exact: `packet_length` and `padding_length` are structured, editable
+ *     fields, and everything they bound (payload + padding) is kept verbatim as `data` hex. The packet
+ *     is bounded by `packet_length + 4` bytes; any MAC/trailing/pipelined bytes are left to the codec's
+ *     recursion / RawData (decoding the MAC needs cross-message negotiated cipher/MAC state, which is
+ *     out of scope for a single-message codec). A well-formed message round-trips byte-for-byte.
+ *
+ * Matching rationale (NO heuristicFallback): SSH is claimed ONLY on the tcp:22 bucket. The
+ * identification line has a strong, distinctive signature ("SSH-") — but the Binary Packet Protocol has
+ * NO content magic at all (a 4-byte length + a padding byte is indistinguishable from arbitrary binary
+ * data), so recognizing binary SSH packets relies entirely on the well-known port. Joining the global
+ * content-heuristic chain would therefore let SSH mislabel arbitrary binary TCP payloads on any port.
+ * Confining SSH to tcp:22 keeps that impossible; alt-port SSH is rare and falls losslessly to raw.
+ */
+class SSH extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'ssh';
+        this.name = 'SSH';
+        this.nickname = 'SSH';
+        //SSH is recognized ONLY on the well-known port 22 — deliberately NOT via heuristicFallback. The
+        //Binary Packet Protocol has no content magic, so its recognition depends entirely on the port
+        //bucket; joining the global heuristic chain would mislabel arbitrary binary TCP traffic. See the
+        //class doc for the full rationale.
+        this.matchKeys = ['tcpport:22'];
+        //A leaf header — the SSH payload (KEXINIT contents, encrypted records, MACs) requires cross-message
+        //negotiated cipher state and is a higher-layer concern.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (SSH.#schemaCache ??= SSH.#buildSchema());
+    }
+    /** Bytes available to this header: SSH rides on TCP, which has no per-message length. */
+    #payloadLength() {
+        const available = this.packet.length - this.startPos;
+        return available < 0 ? 0 : available;
+    }
+    /** True when the payload begins with the ASCII identification signature "SSH-". */
+    #isIdentification() {
+        if (this.#payloadLength() < 4)
+            return false;
+        return this.readBytes(0, 4, true).toString('latin1') === 'SSH-';
+    }
+    /**
+     * Parse the identification line into the display-only metadata fields. The line is
+     * `SSH-<protoversion>-<softwareversion>[ SP comments]` and neither protoversion nor softwareversion
+     * may contain '-' (RFC 4253 §4.2), so splitting on '-' is exact. Populated on decode only — these
+     * fields have no encode, so they never affect the re-emitted bytes and never mutate `message`.
+     * Never throws: a malformed banner yields empty strings.
+     */
+    #parseIdent(text) {
+        //The identification is a single line ended by CR LF (or a lone LF). Keep only up to the first
+        //line ending for the display parse; `message` still holds the verbatim bytes.
+        let line = text;
+        const lf = line.indexOf('\n');
+        if (lf >= 0)
+            line = line.slice(0, lf);
+        if (line.endsWith('\r'))
+            line = line.slice(0, -1);
+        this.instance.identString.setValue(line);
+        //`SSH-` then protoversion up to the next '-', then softwareversion up to a space or end-of-line.
+        const match = line.match(/^SSH-([^-]*)-([^ ]*)/);
+        const protoVersion = match ? match[1] : '';
+        const softwareVersion = match ? match[2] : '';
+        this.instance.protoVersion.setValue(protoVersion);
+        this.instance.softwareVersion.setValue(softwareVersion);
+        this.instance.summaryInfo.setValue(softwareVersion ? softwareVersion : 'identification');
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'SSH ${summaryInfo}',
+            properties: {
+                //Discriminator between the two on-wire shapes (see class doc). Decoded from the payload
+                //signature; on encode it is supplied by the input (default false = a Binary Packet) and
+                //read by every field below to decide which bytes it owns.
+                isIdentification: {
+                    type: 'boolean',
+                    label: 'Is Identification',
+                    default: false,
+                    decode: function () {
+                        this.instance.isIdentification.setValue(this.#isIdentification());
+                    }
+                },
+                //Display-only metadata parsed from the identification line on decode (no encode —
+                //populated by `message` below for the identification shape, empty for a binary packet).
+                protoVersion: { type: 'string', label: 'Protocol Version', default: '' },
+                softwareVersion: { type: 'string', label: 'Software Version', default: '' },
+                identString: { type: 'string', label: 'Identification String', default: '' },
+                //Drives the one-line summary: the software version for an identification, else 'packet'.
+                summaryInfo: { type: 'string', label: 'Summary', hidden: true, default: '' },
+                //IDENTIFICATION shape: the whole line kept verbatim (byte-perfect) and re-emitted
+                //untouched. The display metadata above is parsed from it on decode; encode never
+                //reconstructs the line from that metadata.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    default: '',
+                    decode: function () {
+                        if (!this.instance.isIdentification.getValue(false)) {
+                            //Binary Packet shape: no verbatim line; clear the identification metadata.
+                            this.instance.message.setValue('');
+                            this.instance.protoVersion.setValue('');
+                            this.instance.softwareVersion.setValue('');
+                            this.instance.identString.setValue('');
+                            this.instance.summaryInfo.setValue('packet');
+                            return;
+                        }
+                        const available = this.#payloadLength();
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parseIdent(raw.toString('latin1'));
+                    },
+                    encode: function () {
+                        //Only the identification shape owns the whole payload; re-emit it verbatim.
+                        if (!this.instance.isIdentification.getValue(false))
+                            return;
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                },
+                //BINARY PACKET shape: packet_length counts padding_length(1) + payload + padding, so the
+                //whole message spans packet_length + 4 bytes. Big-endian (unlike ENIP's CIP order).
+                packetLength: {
+                    type: 'integer',
+                    label: 'Packet Length',
+                    minimum: 0,
+                    maximum: 4294967295,
+                    decode: function () {
+                        if (this.instance.isIdentification.getValue(false)) {
+                            this.instance.packetLength.setValue(0);
+                            return;
+                        }
+                        this.instance.packetLength.setValue(this.readBytes(0, 4).readUInt32BE(0));
+                    },
+                    encode: function () {
+                        if (this.instance.isIdentification.getValue(false))
+                            return;
+                        //Honored when supplied (a crafted message may lie); else derived from the data —
+                        //packet_length = 1 (padding_length byte) + payload + padding = 1 + data.length.
+                        const provided = this.instance.packetLength.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : (0, HexToBuffer_1.HexToBuffer)(this.instance.data.getValue('')).length + 1;
+                        if (value > 4294967295) {
+                            this.recordError(this.instance.packetLength.getPath(), 'Maximum value is 4294967295');
+                            value = 4294967295;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.packetLength.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.packetLength.setValue(value);
+                        const buffer = Buffer.alloc(4);
+                        buffer.writeUInt32BE(value, 0);
+                        this.writeBytes(0, buffer);
+                    }
+                },
+                paddingLength: {
+                    type: 'integer',
+                    label: 'Padding Length',
+                    minimum: 0,
+                    maximum: 255,
+                    default: 0,
+                    decode: function () {
+                        if (this.instance.isIdentification.getValue(false)) {
+                            this.instance.paddingLength.setValue(0);
+                            return;
+                        }
+                        this.instance.paddingLength.setValue(this.readBytes(4, 1).readUInt8(0));
+                    },
+                    encode: function () {
+                        if (this.instance.isIdentification.getValue(false))
+                            return;
+                        const node = this.instance.paddingLength;
+                        let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 255) {
+                            this.recordError(node.getPath(), 'Maximum value is 255');
+                            value = 255;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBytes(4, Buffer.from([value]));
+                    }
+                },
+                //The payload + padding, kept verbatim. Bounded by packet_length (data ends at offset
+                //4 + packet_length) and the captured bytes, so a MAC / trailing / pipelined packet is
+                //left to the codec's recursion / RawData.
+                data: {
+                    type: 'string',
+                    label: 'Data',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    default: '',
+                    decode: function () {
+                        if (this.instance.isIdentification.getValue(false)) {
+                            this.instance.data.setValue('');
+                            return;
+                        }
+                        const remaining = this.#payloadLength();
+                        const packetLength = this.instance.packetLength.getValue(0);
+                        //data spans from offset 5 to 4 + packet_length (i.e. packet_length - 1 bytes).
+                        let end = 4 + packetLength;
+                        if (end > remaining)
+                            end = remaining;
+                        this.instance.data.setValue(end > 5 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(5, end - 5)) : '');
+                    },
+                    encode: function () {
+                        if (this.instance.isIdentification.getValue(false))
+                            return;
+                        const data = this.instance.data.getValue('');
+                        if (data)
+                            this.writeBytes(5, (0, HexToBuffer_1.HexToBuffer)(data));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Port-bucket + "SSH-" signature. Reached only on the tcp:22 bucket.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'tcp')
+            return false;
+        const available = this.#payloadLength();
+        if (available < 1)
+            return false;
+        //Identification string: the strong ASCII signature.
+        if (this.#isIdentification())
+            return true;
+        //Binary Packet Protocol (e.g. a cleartext KEXINIT). No content magic — validate the framing is
+        //plausible so genuinely unrelated binary payloads on port 22 still fall through to raw.
+        if (available < 6)
+            return false;
+        const head = this.readBytes(0, 5, true);
+        const packetLength = head.readUInt32BE(0);
+        const paddingLength = head.readUInt8(4);
+        //packet_length counts padding_length(1) + payload + padding; padding is 4..255 (RFC 4253 §6),
+        //and 35000 is the minimum max-packet a receiver must support — a generous plausibility ceiling.
+        if (packetLength < 5 || packetLength > 35000)
+            return false;
+        if (paddingLength < 4 || paddingLength > packetLength - 1)
+            return false;
+        return true;
+    }
+}
+exports.SSH = SSH;

package/dist/headers/STOMP.d.ts

@@ -0,0 +1,48 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * STOMP — the Simple (or Streaming) Text Oriented Messaging Protocol (STOMP 1.2), a text framing for
+ * message brokers, carried over TCP (well-known port 61613, the ActiveMQ default). A STOMP frame is
+ * US-ASCII text: a COMMAND line, then zero or more `header:value` lines, a blank line, an optional body,
+ * and a terminating NUL (0x00):
+ *
+ *   COMMAND{EOL}
+ *   header1:value1{EOL}
+ *   header2:value2{EOL}
+ *   {EOL}
+ *   body^@
+ *
+ * where {EOL} is a line feed (STOMP 1.2 also permits CR LF) and ^@ is the NUL octet. Between frames a
+ * client/server may send a bare {EOL} as a heartbeat.
+ *
+ * Like SIP/Ident/HTTP (the verbatim-message pattern): a frame is free-form text — arbitrary header
+ * ordering, header-value escaping (\c \n \r \\), and a body of any content-type whose length may be an
+ * explicit `content-length` header or run to the NUL — so the exact bytes a peer sees are richer than a
+ * form needs and whitespace/ordering is significant. The ENTIRE raw payload is therefore the single
+ * source of truth: decoded verbatim to hex in the authoritative `message` field and re-emitted
+ * byte-for-byte on encode. On top of that the frame's COMMAND line and a few common display headers
+ * (destination, content-type, content-length) are parsed into DISPLAY-ONLY metadata; those carry no
+ * codec of their own and never reconstruct the bytes — the message owns them. So any STOMP frame
+ * round-trips exactly.
+ *
+ * Framing: STOMP frames are NUL-terminated and several may be pipelined in one TCP segment, but — like
+ * the other text verbatim leaves (SIP/HTTP/Ident) and because TCP carries no per-message length here —
+ * this terminal layer consumes to the end of the segment and keeps it as one verbatim `message`. A
+ * well-formed single-frame segment round-trips byte-for-byte.
+ *
+ * Matching rationale (NO heuristicFallback): STOMP is claimed ONLY on the tcp:61613 bucket, and only
+ * when the first line is a known STOMP command — a defensive content gate (like SIP's start-line) so
+ * non-STOMP traffic on 61613 falls losslessly to raw. Joining the global content-heuristic chain would
+ * risk mislabeling arbitrary text TCP payloads on any port, so selection stays port-bucketed.
+ */
+export declare class STOMP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}