@netkitty/codec 1.0.0

package/dist/headers/SercosIII.js

@@ -0,0 +1,199 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SercosIII = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * Sercos III — the real-time industrial Ethernet of the Sercos automation bus (IEC 61491 / IEC 61158,
+ * IEC 61784 CPF-16), carried directly in an Ethernet II frame with EtherType 0x88CD (an Ethernet child —
+ * no IP/UDP). Every communication cycle the master emits Master Data Telegrams (MDT) and the slaves answer
+ * with Acknowledge Telegrams (AT); both frame kinds share the same EtherType and are distinguished by the
+ * Telegram Type bit in the first header byte.
+ *
+ * The frame opens with the Sercos III telegram header. This minimal slice structures the fixed leading
+ * bytes and keeps the per-device payload verbatim:
+ *
+ *   Byte 0 — Telegram Type field (a bitfield, MSB-first per the Wireshark `siii` dissector):
+ *     - bit 7 (0x80) channel          — 0 = P-Telegram (primary line), 1 = S-Telegram (secondary line)
+ *     - bit 6 (0x40) telegramType      — 0 = MDT (Master Data Telegram), 1 = AT (Acknowledge Telegram)
+ *     - bit 5 (0x20) cycleCountValid   — the MST cycle count is valid
+ *     - bit 4 (0x10) reserved          — preserved verbatim for a byte-perfect round-trip
+ *     - bits 0..3 (0x0f) telegramNumber— MDT/AT index within the cycle (0..15)
+ *   Byte 1 — Phase field (the Master Sync Telegram, MST):
+ *     - the Phase occupies mask 0x8f (bit 7 = phase switching, bits 0..3 = communication phase CP0..CP4),
+ *       a non-contiguous field kept as one value; the Cycle Count occupies mask 0x70 (bits 4..6).
+ *   Bytes 2..5 — CRC32 of the MST, kept verbatim (little-endian on the wire per the dissector) and never
+ *     recomputed, so a captured frame round-trips byte-for-byte.
+ *
+ * Everything after the 6-byte header (the phase-dependent per-device connection / service-channel data) is
+ * command- and topology-dependent, so this slice keeps it verbatim as `data` hex (byte-perfect), bounded by
+ * the end of the Ethernet payload (Sercos III has no length field of its own — it runs to the end of the
+ * frame, like LLDP/GOOSE). Structuring the per-device bodies (device control/status, service channel, hot
+ * plug) is a deferred slice. The MST header is genuine for the CP0–CP2 scanning phases and MDT0; for a
+ * CP3/CP4 operational device telegram the byte-1..5 labels are nominal but the bytes are still reproduced
+ * exactly because every header field is read and re-emitted verbatim.
+ */
+class SercosIII extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'sercos3';
+        this.name = 'Sercos III';
+        this.nickname = 'SercosIII';
+        this.matchKeys = ['ethertype:88cd'];
+        //A leaf header — the per-device connection / service-channel bodies require phase- and topology-dependent
+        //parsing (deferred slice).
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (SercosIII.#schemaCache ??= SercosIII.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'Sercos III type=${telegramType} tel=${telegramNumber} phase=${phase}',
+            properties: {
+                //==== Byte 0: Telegram Type field ====
+                //Each sub-field owns its own bits of byte 0 via writeBits (which masks each field, so they
+                //never clobber). All 8 bits are accounted for (0x80 channel, 0x40 type, 0x20 cycleCountValid,
+                //0x10 reserved, 0x0f telegramNumber) so byte 0 round-trips exactly.
+                channel: {
+                    type: 'integer',
+                    label: 'Channel',
+                    minimum: 0,
+                    maximum: 1,
+                    decode: function () {
+                        this.instance.channel.setValue(this.readBits(0, 1, 0, 1));
+                    },
+                    encode: function () {
+                        this.writeBits(0, 1, 0, 1, this.instance.channel.getValue(0) & 0x1);
+                    }
+                },
+                telegramType: {
+                    type: 'integer',
+                    label: 'Telegram Type',
+                    minimum: 0,
+                    maximum: 1,
+                    decode: function () {
+                        this.instance.telegramType.setValue(this.readBits(0, 1, 1, 1));
+                    },
+                    encode: function () {
+                        this.writeBits(0, 1, 1, 1, this.instance.telegramType.getValue(0) & 0x1);
+                    }
+                },
+                cycleCountValid: {
+                    type: 'integer',
+                    label: 'Cycle Count Valid',
+                    minimum: 0,
+                    maximum: 1,
+                    decode: function () {
+                        this.instance.cycleCountValid.setValue(this.readBits(0, 1, 2, 1));
+                    },
+                    encode: function () {
+                        this.writeBits(0, 1, 2, 1, this.instance.cycleCountValid.getValue(0) & 0x1);
+                    }
+                },
+                //Bit 4 (0x10) of byte 0 is unassigned in the dissector — kept verbatim so no bit is lost.
+                reserved: {
+                    type: 'integer',
+                    label: 'Reserved',
+                    minimum: 0,
+                    maximum: 1,
+                    default: 0,
+                    decode: function () {
+                        this.instance.reserved.setValue(this.readBits(0, 1, 3, 1));
+                    },
+                    encode: function () {
+                        this.writeBits(0, 1, 3, 1, this.instance.reserved.getValue(0) & 0x1);
+                    }
+                },
+                telegramNumber: {
+                    type: 'integer',
+                    label: 'Telegram Number',
+                    minimum: 0,
+                    maximum: 15,
+                    decode: function () {
+                        this.instance.telegramNumber.setValue(this.readBits(0, 1, 4, 4));
+                    },
+                    encode: function () {
+                        this.writeBits(0, 1, 4, 4, this.instance.telegramNumber.getValue(0) & 0x0f);
+                    }
+                },
+                //==== Byte 1: Phase field (MST) ====
+                //Phase is a non-contiguous field (mask 0x8f = bit 7 + bits 0..3); Cycle Count is mask 0x70
+                //(bits 4..6). `phase` owns the single write of byte 1, reassembling both values so they never
+                //clobber — phase's 0x8f and cycleCnt's 0x70 are disjoint and together cover all 8 bits.
+                phase: {
+                    type: 'integer',
+                    label: 'Phase',
+                    minimum: 0,
+                    maximum: 143,
+                    decode: function () {
+                        this.instance.phase.setValue(this.readBytes(1, 1)[0] & 0x8f);
+                    },
+                    encode: function () {
+                        const node = this.instance.phase;
+                        let phase = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (phase > 0x8f) {
+                            this.recordError(node.getPath(), 'Maximum value is 143');
+                            phase = 0x8f;
+                        }
+                        if (phase < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            phase = 0;
+                        }
+                        node.setValue(phase);
+                        const cycleCnt = this.instance.cycleCnt.getValue(0) & 0x07;
+                        this.writeBytes(1, Buffer.from([(phase & 0x8f) | (cycleCnt << 4)]));
+                    }
+                },
+                //Decode-only: bits 4..6 of byte 1. Written by `phase`'s encode (see above).
+                cycleCnt: {
+                    type: 'integer',
+                    label: 'Cycle Count',
+                    minimum: 0,
+                    maximum: 7,
+                    default: 0,
+                    decode: function () {
+                        this.instance.cycleCnt.setValue((this.readBytes(1, 1)[0] >> 4) & 0x07);
+                    }
+                },
+                //==== Bytes 2..5: MST CRC32 ====
+                //Honored verbatim (little-endian on the wire) and never recomputed, so a captured frame
+                //round-trips byte-for-byte.
+                crc32: this.fieldHex('crc32', 2, 4, 'CRC32'),
+                //==== Bytes 6..end: per-device payload ====
+                //Kept verbatim (byte-perfect). Sercos III has no length field of its own — it runs to the end
+                //of the Ethernet payload (like LLDP/GOOSE), so the body is bounded by the captured frame.
+                data: {
+                    type: 'string',
+                    label: 'Data',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        this.instance.data.setValue(remaining > 6 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(6, remaining - 6)) : '');
+                    },
+                    encode: function () {
+                        const data = this.instance.data.getValue('');
+                        if (data)
+                            this.writeBytes(6, (0, HexToBuffer_1.HexToBuffer)(data));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //An Ethernet child selected by EtherType 0x88CD (stored as a lowercase 4-hex string). 0x88CD is
+        //assigned exclusively to Sercos III, so the EtherType alone is a reliable discriminator. Require the
+        //full 6-byte MST header (Telegram Type + Phase field + CRC32) to be present so a tiny truncated
+        //fragment falls through to raw instead of being claimed.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'eth')
+            return false;
+        if (this.prevCodecModule.instance.etherType.getValue() !== '88cd')
+            return false;
+        return this.packet.length - this.startPos >= 6;
+    }
+}
+exports.SercosIII = SercosIII;

package/dist/headers/Skinny.d.ts

@@ -0,0 +1,32 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * Skinny Client Control Protocol (SCCP / "Skinny", Cisco IP phone signalling), TCP port 2000. Every
+ * Skinny message begins with a fixed 12-byte header — Data Length, Header Version (a reserved field,
+ * conventionally 0) and Message Id — followed by the message-id-specific body. The whole message
+ * occupies `8 + dataLength` bytes: the Data Length counts every byte after the Data Length and Header
+ * Version fields, i.e. the 4-byte Message Id plus the body (so an empty-body KeepAlive carries
+ * dataLength = 4).
+ *
+ * ⚠️ Like EtherNet/IP, every multi-byte Skinny field is LITTLE-ENDIAN. There is no little-endian helper
+ * in this codebase, so the uint32 fields are read and written byte-by-byte in their closures (the `|`
+ * expression is coerced with `>>> 0` to avoid the sign-extension of a high bit).
+ *
+ * The body layout differs per Message Id (0x0000 KeepAlive, 0x0001 Register, 0x0002 IpPort, 0x0003
+ * KeypadButton, …) and several messages need cross-message device/call context, so this single-message
+ * codec keeps the body verbatim as `body` hex (byte-perfect) and does not sub-decode it. The Data Length
+ * is auto-computed from the body on encode when not supplied, else honored verbatim (a crafted message
+ * may lie); the message is bounded by Data Length so a second pipelined message or trailing bytes are
+ * left to the codec's recursion / RawData. A well-formed message round-trips byte-for-byte.
+ */
+export declare class Skinny extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/Skinny.js

@@ -0,0 +1,139 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Skinny = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * Skinny Client Control Protocol (SCCP / "Skinny", Cisco IP phone signalling), TCP port 2000. Every
+ * Skinny message begins with a fixed 12-byte header — Data Length, Header Version (a reserved field,
+ * conventionally 0) and Message Id — followed by the message-id-specific body. The whole message
+ * occupies `8 + dataLength` bytes: the Data Length counts every byte after the Data Length and Header
+ * Version fields, i.e. the 4-byte Message Id plus the body (so an empty-body KeepAlive carries
+ * dataLength = 4).
+ *
+ * ⚠️ Like EtherNet/IP, every multi-byte Skinny field is LITTLE-ENDIAN. There is no little-endian helper
+ * in this codebase, so the uint32 fields are read and written byte-by-byte in their closures (the `|`
+ * expression is coerced with `>>> 0` to avoid the sign-extension of a high bit).
+ *
+ * The body layout differs per Message Id (0x0000 KeepAlive, 0x0001 Register, 0x0002 IpPort, 0x0003
+ * KeypadButton, …) and several messages need cross-message device/call context, so this single-message
+ * codec keeps the body verbatim as `body` hex (byte-perfect) and does not sub-decode it. The Data Length
+ * is auto-computed from the body on encode when not supplied, else honored verbatim (a crafted message
+ * may lie); the message is bounded by Data Length so a second pipelined message or trailing bytes are
+ * left to the codec's recursion / RawData. A well-formed message round-trips byte-for-byte.
+ */
+class Skinny extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'skinny';
+        this.name = 'Skinny Client Control Protocol';
+        this.nickname = 'Skinny';
+        this.matchKeys = ['tcpport:2000'];
+        //A leaf header — the message-id-specific body requires per-message, cross-message context parsing.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (Skinny.#schemaCache ??= Skinny.#buildSchema());
+    }
+    /** A little-endian unsigned 32-bit field of 4 octets at `offset`. */
+    static #fieldUInt32LE(name, offset, label) {
+        return {
+            type: 'integer',
+            label: label,
+            minimum: 0,
+            maximum: 4294967295,
+            decode: function () {
+                const b = this.readBytes(offset, 4);
+                this.instance[name].setValue((b[0] | (b[1] << 8) | (b[2] << 16) | (b[3] << 24)) >>> 0);
+            },
+            encode: function () {
+                const node = this.instance[name];
+                let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                if (value > 4294967295) {
+                    this.recordError(node.getPath(), 'Maximum value is 4294967295');
+                    value = 4294967295;
+                }
+                if (value < 0) {
+                    this.recordError(node.getPath(), 'Minimum value is 0');
+                    value = 0;
+                }
+                node.setValue(value);
+                this.writeBytes(offset, Buffer.from([value & 0xff, (value >> 8) & 0xff, (value >> 16) & 0xff, (value >>> 24) & 0xff]));
+            }
+        };
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'Skinny msg=${messageId} len=${dataLength}',
+            properties: {
+                //All multi-byte Skinny fields are LITTLE-ENDIAN.
+                dataLength: {
+                    type: 'integer',
+                    label: 'Data Length',
+                    minimum: 0,
+                    maximum: 4294967295,
+                    decode: function () {
+                        const b = this.readBytes(0, 4);
+                        this.instance.dataLength.setValue((b[0] | (b[1] << 8) | (b[2] << 16) | (b[3] << 24)) >>> 0);
+                    },
+                    encode: function () {
+                        //Data Length counts the Message Id (4 bytes) plus the body — every byte after the
+                        //Data Length and Header Version fields. Honored when supplied (a crafted message
+                        //may lie); else derived from the body.
+                        const provided = this.instance.dataLength.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : 4 + (0, HexToBuffer_1.HexToBuffer)(this.instance.body.getValue('')).length;
+                        if (value > 4294967295) {
+                            this.recordError(this.instance.dataLength.getPath(), 'Maximum value is 4294967295');
+                            value = 4294967295;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.dataLength.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.dataLength.setValue(value);
+                        this.writeBytes(0, Buffer.from([value & 0xff, (value >> 8) & 0xff, (value >> 16) & 0xff, (value >>> 24) & 0xff]));
+                    }
+                },
+                //A reserved field, conventionally 0; some builds carry a header/protocol version here.
+                headerVersion: this.#fieldUInt32LE('headerVersion', 4, 'Header Version'),
+                messageId: this.#fieldUInt32LE('messageId', 8, 'Message Id'),
+                //The message-id-specific body after the 12-byte header, kept verbatim. Bounded by the
+                //Data Length (the message ends at offset 8 + dataLength) and the captured bytes, so
+                //trailing / pipelined data is left to the codec's recursion / RawData.
+                body: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        const dataLength = this.instance.dataLength.getValue(0);
+                        let end = 8 + dataLength;
+                        if (end > remaining)
+                            end = remaining;
+                        this.instance.body.setValue(end > 12 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(12, end - 12)) : '');
+                    },
+                    encode: function () {
+                        const body = this.instance.body.getValue('');
+                        if (body)
+                            this.writeBytes(12, (0, HexToBuffer_1.HexToBuffer)(body));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Skinny rides on TCP port 2000. The header carries no strong content magic (the Header Version
+        //is conventionally 0 but not guaranteed), so the well-known port is the signature: require the
+        //full 12-byte header to be present.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        return this.packet.length - this.startPos >= 12;
+    }
+}
+exports.Skinny = Skinny;

package/dist/headers/StatsD.d.ts

@@ -0,0 +1,27 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * StatsD — the Etsy/Graphite metrics line protocol, carried as plain text over UDP (well-known port
+ * 8125). A datagram carries one or more newline-separated metrics, each of the form
+ * `name:value|type[|@sampleRate]` (e.g. `gorets:1|c` a counter, `glork:320|ms` a timer). The type is a
+ * short tag: `c` counter, `g` gauge, `ms` timer, `s` set, `h` histogram.
+ *
+ * Like Syslog/SIP/HTTP, a StatsD datagram is free-form text whose full internal structure (multiple
+ * metrics, tag extensions, significant separators) is richer than a form needs, and the exact bytes are
+ * authoritative. So the ENTIRE raw payload is kept verbatim as the `message` field (hex) and re-emitted
+ * untouched — byte-perfect for any datagram, well-formed or not; only the FIRST metric line is parsed on
+ * decode into display-only metadata (name/value/type/sampleRate). Encode never reconstructs the message
+ * from the parsed fields — it writes `message` back byte-for-byte — so any StatsD datagram round-trips
+ * exactly. The payload is bounded by the UDP datagram length so a retained FCS/padding is not absorbed.
+ */
+export declare class StatsD extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/StatsD.js

@@ -0,0 +1,134 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StatsD = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * StatsD — the Etsy/Graphite metrics line protocol, carried as plain text over UDP (well-known port
+ * 8125). A datagram carries one or more newline-separated metrics, each of the form
+ * `name:value|type[|@sampleRate]` (e.g. `gorets:1|c` a counter, `glork:320|ms` a timer). The type is a
+ * short tag: `c` counter, `g` gauge, `ms` timer, `s` set, `h` histogram.
+ *
+ * Like Syslog/SIP/HTTP, a StatsD datagram is free-form text whose full internal structure (multiple
+ * metrics, tag extensions, significant separators) is richer than a form needs, and the exact bytes are
+ * authoritative. So the ENTIRE raw payload is kept verbatim as the `message` field (hex) and re-emitted
+ * untouched — byte-perfect for any datagram, well-formed or not; only the FIRST metric line is parsed on
+ * decode into display-only metadata (name/value/type/sampleRate). Encode never reconstructs the message
+ * from the parsed fields — it writes `message` back byte-for-byte — so any StatsD datagram round-trips
+ * exactly. The payload is bounded by the UDP datagram length so a retained FCS/padding is not absorbed.
+ */
+class StatsD extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'statsd';
+        this.name = 'StatsD Metrics Protocol';
+        this.nickname = 'StatsD';
+        //StatsD rides on UDP, well-known port 8125. Port-bucketed only (no heuristicFallback): the line
+        //format has no distinctive magic, so claiming it off-port would risk stealing arbitrary UDP text.
+        this.matchKeys = ['udpport:8125'];
+        //A leaf header — a datagram may carry several metrics, but they are all held verbatim in `message`.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (_a.#schemaCache ??= _a.#buildSchema());
+    }
+    /**
+     * Bytes of this header: bounded by the UDP datagram length (payload = udpLength - 8) so a retained
+     * Ethernet FCS / padding is not absorbed into the message; never negative.
+     */
+    #payloadLength() {
+        let available = this.packet.length - this.startPos;
+        if (this.prevCodecModule && this.prevCodecModule.id === 'udp') {
+            const udpLength = this.prevCodecModule.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < available)
+                available = udpLength - 8;
+        }
+        return available < 0 ? 0 : available;
+    }
+    /** The first line of the payload (up to the first newline, or the whole payload if none). */
+    static #firstLine(text) {
+        const idx = text.indexOf('\n');
+        return idx >= 0 ? text.slice(0, idx) : text;
+    }
+    /**
+     * Parse the first metric line into display-only metadata. Format: `name:value|type[|@rate]`.
+     * Populated on decode only — these fields have no encode, so they never affect the re-emitted bytes.
+     * Never throws: missing tokens yield empty strings / 0.
+     */
+    #parseFirstMetric(text) {
+        const line = _a.#firstLine(text).replace(/\r$/, '');
+        const colon = line.indexOf(':');
+        const name = colon >= 0 ? line.slice(0, colon) : line;
+        const rest = colon >= 0 ? line.slice(colon + 1) : '';
+        const fields = rest.split('|');
+        this.instance.metricName.setValue(name);
+        this.instance.metricValue.setValue(fields[0] ? fields[0] : '');
+        this.instance.metricType.setValue(fields.length > 1 && fields[1] ? fields[1] : '');
+        //An optional sampling-rate field is "@<rate>" (counters, RFC-less convention). Keep the raw text.
+        let sampleRate = '';
+        for (let i = 2; i < fields.length; i++) {
+            if (fields[i] && fields[i].startsWith('@')) {
+                sampleRate = fields[i].slice(1);
+                break;
+            }
+        }
+        this.instance.sampleRate.setValue(sampleRate);
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'StatsD ${metricName}|${metricType}',
+            properties: {
+                //The whole raw payload is the single source of truth: decoded verbatim to hex and
+                //re-emitted untouched (byte-perfect for any datagram). The first metric line is parsed
+                //into the display-only metadata below, which carry no codec of their own.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        if (available <= 0) {
+                            this.instance.message.setValue('');
+                            this.#parseFirstMetric('');
+                            return;
+                        }
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parseFirstMetric(raw.toString('latin1'));
+                    },
+                    encode: function () {
+                        //Re-emit the authoritative message verbatim — never reconstruct from metadata.
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                },
+                //Display-only metadata parsed from the first metric line on decode (no encode — populated
+                //by the message field above, never read back). sampleRate is empty when absent.
+                metricName: { type: 'string', label: 'Metric Name' },
+                metricValue: { type: 'string', label: 'Metric Value' },
+                metricType: { type: 'string', label: 'Metric Type' },
+                sampleRate: { type: 'string', label: 'Sample Rate' }
+            }
+        };
+    }
+    match() {
+        //StatsD rides on UDP port 8125 as plain text. Recognize it by the metric-line signature —
+        //`name:value|type` (a colon, then a value, then a pipe followed by a type letter) — so non-StatsD
+        //traffic on 8125 falls through to raw rather than claiming an un-decodable text layer. match()
+        //does not affect the re-emitted bytes; only the message field (verbatim) does.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        if (this.#payloadLength() <= 0)
+            return false;
+        const lead = this.readBytes(0, 64, true).toString('latin1');
+        const line = _a.#firstLine(lead);
+        //name (no colon/pipe/newline) ':' value (no pipe/newline) '|' type-letter.
+        return /^[^:|\r\n]+:[^|\r\n]*\|[a-zA-Z]/.test(line);
+    }
+}
+exports.StatsD = StatsD;
+_a = StatsD;

package/dist/headers/SunRPC.d.ts

@@ -0,0 +1,34 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * ONC RPC / SunRPC (RFC 5531), the portmapper transport on TCP + UDP port 111. Every RPC message is a
+ * 4-byte XID followed by a 4-byte Message Type (0 CALL, 1 REPLY). A CALL body continues with the RPC
+ * version (== 2), the program number, the program version, the procedure, then the credential and
+ * verifier auth structures (each a 4-byte flavor + 4-byte length + body) and the procedure arguments.
+ * The portmapper program is 100000.
+ *
+ * Transport framing differs by L4 (RFC 5531 §11): over UDP the RPC message is the whole datagram; over
+ * TCP a 4-byte Record Marking prefix precedes it — the high bit is the last-fragment flag and the low 31
+ * bits are the fragment length. This header detects the transport via prevCodecModule.id and structures
+ * accordingly: TCP → recordMark (lastFragment + fragmentLength) then the message at offset 4; UDP → the
+ * message directly at offset 0.
+ *
+ * Byte-perfect strategy (minimal slice): structure the XID and Message Type, and for a CALL the four
+ * fixed program-identity words (rpcVersion / program / programVersion / procedure); the remainder — the
+ * credential, verifier and procedure arguments for a CALL, or the whole REPLY body — is kept verbatim as
+ * `body` hex, bounded by the transport payload (UDP length − 8, or the TCP Record Marking fragment
+ * length). The TCP fragmentLength is honored when supplied (a crafted frame may lie) else derived as the
+ * encoded message length; a well-formed message round-trips byte-for-byte. Trailing / pipelined bytes are
+ * left to the codec's recursion / RawData.
+ */
+export declare class SunRPC extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}