@vlydev/cs2-masked-inspect 1.0.0

package/.github/workflows/tests.yml

@@ -0,0 +1,28 @@
+name: Tests
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+    branches: ["**"]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node: ["18", "20", "22"]
+
+    name: Node.js ${{ matrix.node }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+
+      - name: Run tests
+        run: npm test

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 VlyDev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,262 @@
+# cs2-masked-inspect (JavaScript)
+
+Pure JavaScript library for encoding and decoding CS2 masked inspect links — no external dependencies.
+
+## Installation
+
+```bash
+npm install @vlydev/cs2-masked-inspect
+```
+
+## Usage
+
+### Deserialize a CS2 inspect link
+
+```javascript
+const { InspectLink } = require('@vlydev/cs2-masked-inspect');
+
+// Accepts a full steam:// URL or a raw hex string
+const item = InspectLink.deserialize(
+  'steam://run/730//+csgo_econ_action_preview%20E3F3367440334DE2FBE4C345E0CBE0D3...'
+);
+
+console.log(item.defIndex);   // 7  (AK-47)
+console.log(item.paintIndex); // 422
+console.log(item.paintSeed);  // 922
+console.log(item.paintWear);  // ~0.04121
+console.log(item.itemId);     // 46876117973
+
+item.stickers.forEach(s => console.log(s.stickerId));
+// 7436, 5144, 6970, 8069, 5592
+```
+
+### Serialize an item to a hex payload
+
+```javascript
+const { InspectLink, ItemPreviewData } = require('@vlydev/cs2-masked-inspect');
+
+const data = new ItemPreviewData({
+  defIndex:  60,
+  paintIndex: 440,
+  paintSeed:  353,
+  paintWear:  0.005411375779658556,
+  rarity:     5,
+});
+
+const hex = InspectLink.serialize(data);
+// 00183C20B803280538E9A3C5DD0340E102C246A0D1
+
+const url = `steam://run/730//+csgo_econ_action_preview%20${hex}`;
+```
+
+### Item with stickers and keychains
+
+```javascript
+const { InspectLink, ItemPreviewData, Sticker } = require('@vlydev/cs2-masked-inspect');
+
+const data = new ItemPreviewData({
+  defIndex:  7,
+  paintIndex: 422,
+  paintSeed:  922,
+  paintWear:  0.04121,
+  rarity:     3,
+  quality:    4,
+  stickers: [
+    new Sticker({ slot: 0, stickerId: 7436 }),
+    new Sticker({ slot: 1, stickerId: 5144, wear: 0.1 }),
+  ],
+});
+
+const hex     = InspectLink.serialize(data);
+const decoded = InspectLink.deserialize(hex); // round-trip
+```
+
+---
+
+## Validation
+
+Use `InspectLink.isMasked()` and `InspectLink.isClassic()` to detect the link type without decoding it.
+
+```javascript
+const { InspectLink } = require('@vlydev/cs2-masked-inspect');
+
+// New masked format (pure hex blob) — can be decoded offline
+const maskedUrl = 'steam://run/730//+csgo_econ_action_preview%20E3F3...';
+InspectLink.isMasked(maskedUrl);   // true
+InspectLink.isClassic(maskedUrl);  // false
+
+// Hybrid format (S/A/D prefix with hex proto after D) — also decodable offline
+const hybridUrl = 'steam://rungame/730/.../+csgo_econ_action_preview%20S76561199323320483A50075495125D1101C4C4FCD4AB10...';
+InspectLink.isMasked(hybridUrl);   // true
+InspectLink.isClassic(hybridUrl);  // false
+
+// Classic format — requires Steam Game Coordinator to fetch item info
+const classicUrl = 'steam://rungame/730/.../+csgo_econ_action_preview%20S76561199842063946A49749521570D2751293026650298712';
+InspectLink.isMasked(classicUrl);  // false
+InspectLink.isClassic(classicUrl); // true
+```
+
+---
+
+## How the format works
+
+Three URL formats are handled:
+
+1. **New masked format** — pure hex blob after `csgo_econ_action_preview`:
+   ```
+   steam://run/730//+csgo_econ_action_preview%20<hexbytes>
+   ```
+
+2. **Hybrid format** — old-style `S/A/D` prefix, but with a hex proto appended after `D` (instead of a decimal did):
+   ```
+   steam://rungame/730/.../+csgo_econ_action_preview%20S<steamid>A<assetid>D<hexproto>
+   ```
+
+3. **Classic format** — old-style `S/A/D` with a decimal did; requires Steam GC to resolve item details.
+
+For formats 1 and 2 the library decodes the item offline. For format 3 only URL parsing is possible.
+
+The hex blob (formats 1 and 2) has the following binary layout:
+
+```
+[key_byte] [proto_bytes XOR'd with key] [4-byte checksum XOR'd with key]
+```
+
+| Section | Size | Description |
+|---------|------|-------------|
+| `key_byte` | 1 byte | XOR key. `0x00` = no obfuscation (tool links). Other values = native CS2 links. |
+| `proto_bytes` | variable | `CEconItemPreviewDataBlock` protobuf, each byte XOR'd with `key_byte`. |
+| `checksum` | 4 bytes | Big-endian uint32, XOR'd with `key_byte`. |
+
+### Checksum algorithm
+
+```javascript
+const buffer  = Buffer.concat([Buffer.from([0x00]), protoBytes]);
+const crc     = crc32(buffer);                          // standard CRC32
+const xored   = ((crc & 0xFFFF) ^ (protoBytes.length * crc)) >>> 0;
+const checksum = Buffer.alloc(4);
+checksum.writeUInt32BE(xored, 0);                       // big-endian uint32
+```
+
+### `paintWear` encoding
+
+`paintWear` is stored as a `uint32` varint whose bit pattern is the IEEE 754 representation
+of a `float32`. The library handles this transparently — callers always work with regular
+JavaScript `number` values.
+
+---
+
+## Proto field reference
+
+### CEconItemPreviewDataBlock
+
+| Field | Number | Type | JS property |
+|-------|--------|------|-------------|
+| `accountid` | 1 | uint32 | `accountId` |
+| `itemid` | 2 | uint64 | `itemId` |
+| `defindex` | 3 | uint32 | `defIndex` |
+| `paintindex` | 4 | uint32 | `paintIndex` |
+| `rarity` | 5 | uint32 | `rarity` |
+| `quality` | 6 | uint32 | `quality` |
+| `paintwear` | 7 | uint32* | `paintWear` (float32 reinterpreted as uint32) |
+| `paintseed` | 8 | uint32 | `paintSeed` |
+| `killeaterscoretype` | 9 | uint32 | `killEaterScoreType` |
+| `killeatervalue` | 10 | uint32 | `killEaterValue` |
+| `customname` | 11 | string | `customName` |
+| `stickers` | 12 | repeated Sticker | `stickers` |
+| `inventory` | 13 | uint32 | `inventory` |
+| `origin` | 14 | uint32 | `origin` |
+| `questid` | 15 | uint32 | `questId` |
+| `dropreason` | 16 | uint32 | `dropReason` |
+| `musicindex` | 17 | uint32 | `musicIndex` |
+| `entindex` | 18 | int32 | `entIndex` |
+| `petindex` | 19 | uint32 | `petIndex` |
+| `keychains` | 20 | repeated Sticker | `keychains` |
+
+### Sticker
+
+| Field | Number | Type | JS property |
+|-------|--------|------|-------------|
+| `slot` | 1 | uint32 | `slot` |
+| `sticker_id` | 2 | uint32 | `stickerId` |
+| `wear` | 3 | float32 | `wear` |
+| `scale` | 4 | float32 | `scale` |
+| `rotation` | 5 | float32 | `rotation` |
+| `tint_id` | 6 | uint32 | `tintId` |
+| `offset_x` | 7 | float32 | `offsetX` |
+| `offset_y` | 8 | float32 | `offsetY` |
+| `offset_z` | 9 | float32 | `offsetZ` |
+| `pattern` | 10 | uint32 | `pattern` |
+
+---
+
+## Known test vectors
+
+### Vector 1 — Native CS2 link (XOR key 0xE3)
+
+```
+E3F3367440334DE2FBE4C345E0CBE0D3E7DB6943400AE0A379E481ECEBE2F36F
+D9DE2BDB515EA6E30D74D981ECEBE3F37BCBDE640D475DA6E35EFCD881ECEBE3
+F359D5DE37E9D75DA6436DD3DD81ECEBE3F366DCDE3F8F9BDDA69B43B6DE81EC
+EBE3F33BC8DEBB1CA3DFA623F7DDDF8B71E293EBFD43382B
+```
+
+| Field | Value |
+|-------|-------|
+| `itemId` | `46876117973` |
+| `defIndex` | `7` (AK-47) |
+| `paintIndex` | `422` |
+| `paintSeed` | `922` |
+| `paintWear` | `≈ 0.04121` |
+| `rarity` | `3` |
+| `quality` | `4` |
+| sticker IDs | `[7436, 5144, 6970, 8069, 5592]` |
+
+### Vector 2 — Tool-generated link (key 0x00)
+
+```javascript
+new ItemPreviewData({ defIndex: 60, paintIndex: 440, paintSeed: 353,
+                      paintWear: 0.005411375779658556, rarity: 5 })
+```
+
+Expected hex:
+
+```
+00183C20B803280538E9A3C5DD0340E102C246A0D1
+```
+
+---
+
+## Running tests
+
+```bash
+npm test
+```
+
+36 tests using the Node.js built-in `node:test` runner — no external test framework required.
+
+---
+
+## Contributing
+
+Bug reports and pull requests are welcome on [GitHub](https://github.com/vlydev/cs2-masked-inspect-js).
+
+1. Fork the repository
+2. Create a branch: `git checkout -b my-fix`
+3. Make your changes and add tests
+4. Ensure all tests pass: `npm test`
+5. Open a Pull Request
+
+All PRs require the CI checks to pass before merging.
+
+---
+
+## Author
+
+[VlyDev](https://github.com/vlydev) — vladdnepr1989@gmail.com
+
+---
+
+## License
+
+MIT © [VlyDev](https://github.com/vlydev)

package/index.js

@@ -0,0 +1,7 @@
+'use strict';
+
+const InspectLink    = require('./src/InspectLink');
+const ItemPreviewData = require('./src/ItemPreviewData');
+const Sticker        = require('./src/Sticker');
+
+module.exports = { InspectLink, ItemPreviewData, Sticker };

package/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@vlydev/cs2-masked-inspect",
+  "version": "1.0.0",
+  "description": "Offline decoder/encoder for CS2 masked inspect URLs — pure JavaScript, no dependencies",
+  "main": "index.js",
+  "scripts": {
+    "test": "node --test tests/inspect_link.test.js"
+  },
+  "keywords": ["cs2", "csgo", "inspect", "protobuf", "steam"],
+  "author": {
+    "name": "VlyDev",
+    "email": "vladdnepr1989@gmail.com",
+    "url": "https://github.com/vlydev"
+  },
+  "license": "MIT",
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}

package/src/InspectLink.js

@@ -0,0 +1,320 @@
+'use strict';
+
+/**
+ * Encodes and decodes CS2 masked inspect links.
+ *
+ * Binary format:
+ *   [key_byte] [proto_bytes XOR'd with key] [4-byte checksum XOR'd with key]
+ *
+ * For tool-generated links key_byte = 0x00 (no XOR needed).
+ * For native CS2 links key_byte != 0x00 — every byte must be XOR'd before parsing.
+ *
+ * Checksum:
+ *   buffer   = [0x00] + proto_bytes
+ *   crc      = crc32(buffer)
+ *   xored    = (crc & 0xffff) ^ (len(proto_bytes) * crc)  [unsigned 32-bit]
+ *   checksum = big-endian uint32 of (xored & 0xFFFFFFFF)
+ */
+
+const ItemPreviewData = require('./ItemPreviewData');
+const Sticker         = require('./Sticker');
+const { ProtoReader } = require('./proto/reader');
+const { ProtoWriter } = require('./proto/writer');
+
+// ------------------------------------------------------------------
+// CRC32 (standard polynomial 0xEDB88320 — same as zlib/PHP crc32)
+// ------------------------------------------------------------------
+
+/** @type {Uint32Array} */
+const CRC32_TABLE = (() => {
+  const table = new Uint32Array(256);
+  for (let i = 0; i < 256; i++) {
+    let c = i;
+    for (let j = 0; j < 8; j++) {
+      c = (c & 1) ? (0xEDB88320 ^ (c >>> 1)) : (c >>> 1);
+    }
+    table[i] = c;
+  }
+  return table;
+})();
+
+/**
+ * @param {Buffer} buf
+ * @returns {number} unsigned 32-bit CRC32
+ */
+function crc32(buf) {
+  let crc = 0xFFFFFFFF;
+  for (let i = 0; i < buf.length; i++) {
+    crc = (crc >>> 8) ^ CRC32_TABLE[(crc ^ buf[i]) & 0xFF];
+  }
+  return (crc ^ 0xFFFFFFFF) >>> 0;
+}
+
+// ------------------------------------------------------------------
+// Checksum helpers
+// ------------------------------------------------------------------
+
+/**
+ * @param {Buffer} buffer  the [0x00] + proto_bytes buffer
+ * @param {number} protoLen
+ * @returns {Buffer} 4-byte big-endian checksum
+ */
+function computeChecksum(buffer, protoLen) {
+  const crcVal = crc32(buffer);
+  const val = BigInt(((crcVal & 0xFFFF) ^ (protoLen * crcVal)) >>> 0) & 0xFFFFFFFFn;
+  const result = Buffer.alloc(4);
+  result.writeUInt32BE(Number(val), 0);
+  return result;
+}
+
+// ------------------------------------------------------------------
+// float32 <-> uint32 reinterpretation
+// ------------------------------------------------------------------
+
+/** @param {number} f @returns {number} */
+function float32ToUint32(f) {
+  const dv = new DataView(new ArrayBuffer(4));
+  dv.setFloat32(0, f, true); // little-endian
+  return dv.getUint32(0, true);
+}
+
+/** @param {number} u @returns {number} */
+function uint32ToFloat32(u) {
+  const dv = new DataView(new ArrayBuffer(4));
+  dv.setUint32(0, u >>> 0, true);
+  return dv.getFloat32(0, true);
+}
+
+// ------------------------------------------------------------------
+// URL extraction
+// ------------------------------------------------------------------
+
+const INSPECT_URL_RE = /(?:%20|\s|\+)A([0-9A-Fa-f]+)/i;
+const HYBRID_URL_RE  = /S\d+A\d+D([0-9A-Fa-f]+)$/i;
+const CLASSIC_URL_RE = /csgo_econ_action_preview(?:%20|\s)[SM]\d+A\d+D\d+$/i;
+const MASKED_URL_RE  = /csgo_econ_action_preview(?:%20|\s)[0-9A-Fa-f]{10,}$/i;
+
+/** @param {string} input @returns {string} */
+function extractHex(input) {
+  const stripped = input.trim();
+
+  // Hybrid format: S\d+A\d+D<hexproto>
+  const mh = stripped.match(HYBRID_URL_RE);
+  if (mh && /[A-Fa-f]/.test(mh[1])) return mh[1];
+
+  // Classic/market URL: A<hex> preceded by %20, space, or + (A is a prefix marker, not hex)
+  const m = stripped.match(INSPECT_URL_RE);
+  if (m) return m[1];
+
+  // Pure masked format: csgo_econ_action_preview%20<hexblob> (no S/A/M prefix)
+  const mm = stripped.match(/csgo_econ_action_preview(?:%20|\s|\+)([0-9A-Fa-f]{10,})$/i);
+  if (mm) return mm[1];
+
+  // Bare hex — strip whitespace
+  return stripped.replace(/\s+/g, '');
+}
+
+// ------------------------------------------------------------------
+// Sticker encode / decode
+// ------------------------------------------------------------------
+
+/** @param {Sticker} s @returns {Buffer} */
+function encodeSticker(s) {
+  const w = new ProtoWriter();
+  w.writeUint32(1, s.slot);
+  w.writeUint32(2, s.stickerId);
+  if (s.wear     !== null) w.writeFloat32Fixed(3, s.wear);
+  if (s.scale    !== null) w.writeFloat32Fixed(4, s.scale);
+  if (s.rotation !== null) w.writeFloat32Fixed(5, s.rotation);
+  w.writeUint32(6, s.tintId);
+  if (s.offsetX  !== null) w.writeFloat32Fixed(7, s.offsetX);
+  if (s.offsetY  !== null) w.writeFloat32Fixed(8, s.offsetY);
+  if (s.offsetZ  !== null) w.writeFloat32Fixed(9, s.offsetZ);
+  w.writeUint32(10, s.pattern);
+  return w.toBytes();
+}
+
+/** @param {Buffer} data @returns {Sticker} */
+function decodeSticker(data) {
+  const reader = new ProtoReader(data);
+  const s = new Sticker();
+
+  for (const f of reader.readAllFields()) {
+    switch (f.field) {
+      case 1:  s.slot      = Number(f.value); break;
+      case 2:  s.stickerId = Number(f.value); break;
+      case 3:  s.wear      = f.value.readFloatLE(0); break;
+      case 4:  s.scale     = f.value.readFloatLE(0); break;
+      case 5:  s.rotation  = f.value.readFloatLE(0); break;
+      case 6:  s.tintId    = Number(f.value); break;
+      case 7:  s.offsetX   = f.value.readFloatLE(0); break;
+      case 8:  s.offsetY   = f.value.readFloatLE(0); break;
+      case 9:  s.offsetZ   = f.value.readFloatLE(0); break;
+      case 10: s.pattern   = Number(f.value); break;
+      default: break;
+    }
+  }
+
+  return s;
+}
+
+// ------------------------------------------------------------------
+// ItemPreviewData encode / decode
+// ------------------------------------------------------------------
+
+/** @param {ItemPreviewData} item @returns {Buffer} */
+function encodeItem(item) {
+  const w = new ProtoWriter();
+  w.writeUint32(1, item.accountId);
+  w.writeUint64(2, item.itemId);
+  w.writeUint32(3, item.defIndex);
+  w.writeUint32(4, item.paintIndex);
+  w.writeUint32(5, item.rarity);
+  w.writeUint32(6, item.quality);
+
+  // paintwear: float32 reinterpreted as uint32 varint
+  const pwUint32 = float32ToUint32(item.paintWear);
+  w.writeUint32(7, pwUint32);
+
+  w.writeUint32(8, item.paintSeed);
+  w.writeUint32(9, item.killEaterScoreType);
+  w.writeUint32(10, item.killEaterValue);
+  w.writeString(11, item.customName);
+
+  for (const sticker of item.stickers) {
+    w.writeRawBytes(12, encodeSticker(sticker));
+  }
+
+  w.writeUint32(13, item.inventory);
+  w.writeUint32(14, item.origin);
+  w.writeUint32(15, item.questId);
+  w.writeUint32(16, item.dropReason);
+  w.writeUint32(17, item.musicIndex);
+  w.writeInt32(18, item.entIndex);
+  w.writeUint32(19, item.petIndex);
+
+  for (const kc of item.keychains) {
+    w.writeRawBytes(20, encodeSticker(kc));
+  }
+
+  return w.toBytes();
+}
+
+/** @param {Buffer} data @returns {ItemPreviewData} */
+function decodeItem(data) {
+  const reader = new ProtoReader(data);
+  const item   = new ItemPreviewData();
+
+  for (const f of reader.readAllFields()) {
+    switch (f.field) {
+      case 1:  item.accountId          = Number(f.value); break;
+      case 2:  item.itemId             = Number(f.value); break;
+      case 3:  item.defIndex           = Number(f.value); break;
+      case 4:  item.paintIndex         = Number(f.value); break;
+      case 5:  item.rarity             = Number(f.value); break;
+      case 6:  item.quality            = Number(f.value); break;
+      case 7:  item.paintWear          = uint32ToFloat32(Number(f.value)); break;
+      case 8:  item.paintSeed          = Number(f.value); break;
+      case 9:  item.killEaterScoreType = Number(f.value); break;
+      case 10: item.killEaterValue     = Number(f.value); break;
+      case 11: item.customName         = f.value.toString('utf8'); break;
+      case 12: item.stickers.push(decodeSticker(f.value)); break;
+      case 13: item.inventory          = Number(f.value); break;
+      case 14: item.origin             = Number(f.value); break;
+      case 15: item.questId            = Number(f.value); break;
+      case 16: item.dropReason         = Number(f.value); break;
+      case 17: item.musicIndex         = Number(f.value); break;
+      case 18: item.entIndex           = Number(f.value); break;
+      case 19: item.petIndex           = Number(f.value); break;
+      case 20: item.keychains.push(decodeSticker(f.value)); break;
+      default: break;
+    }
+  }
+
+  return item;
+}
+
+// ------------------------------------------------------------------
+// Public API
+// ------------------------------------------------------------------
+
+class InspectLink {
+  /**
+   * Encode an ItemPreviewData to an uppercase hex inspect-link payload.
+   *
+   * The returned string can be appended to a steam:// inspect URL or used
+   * standalone. The key_byte is always 0x00 (no XOR applied).
+   *
+   * @param {ItemPreviewData} data
+   * @returns {string} uppercase hex string
+   */
+  static serialize(data) {
+    const protoBytes = encodeItem(data);
+    const buffer     = Buffer.concat([Buffer.from([0x00]), protoBytes]);
+    const checksum   = computeChecksum(buffer, protoBytes.length);
+    return Buffer.concat([buffer, checksum]).toString('hex').toUpperCase();
+  }
+
+  /**
+   * Returns true if the link contains a decodable protobuf payload (can be decoded offline).
+   * @param {string} link
+   * @returns {boolean}
+   */
+  static isMasked(link) {
+    const s = link.trim();
+    if (MASKED_URL_RE.test(s)) return true;
+    const m = s.match(HYBRID_URL_RE);
+    return !!(m && /[A-Fa-f]/.test(m[1]));
+  }
+
+  /**
+   * Returns true if the link is a classic S/A/D inspect URL with decimal did.
+   * @param {string} link
+   * @returns {boolean}
+   */
+  static isClassic(link) {
+    return CLASSIC_URL_RE.test(link.trim());
+  }
+
+  /**
+   * Decode an inspect-link hex payload (or full URL) into an ItemPreviewData.
+   *
+   * Accepts:
+   *   - A raw uppercase or lowercase hex string
+   *   - A full steam://rungame/... inspect URL
+   *   - A CS2-style csgo://rungame/... URL
+   *
+   * Handles the XOR obfuscation used in native CS2 links.
+   *
+   * @param {string} input
+   * @returns {ItemPreviewData}
+   */
+  static deserialize(input) {
+    const hex = extractHex(input);
+    const raw = Buffer.from(hex, 'hex');
+
+    if (raw.length < 6) {
+      throw new TypeError(
+        `Payload too short or invalid hex: "${input}"`,
+      );
+    }
+
+    const key = raw[0];
+    let decrypted;
+
+    if (key === 0) {
+      decrypted = raw;
+    } else {
+      decrypted = Buffer.alloc(raw.length);
+      for (let i = 0; i < raw.length; i++) {
+        decrypted[i] = raw[i] ^ key;
+      }
+    }
+
+    // Layout: [key_byte] [proto_bytes] [4-byte checksum]
+    const protoBytes = decrypted.slice(1, decrypted.length - 4);
+    return decodeItem(protoBytes);
+  }
+}
+
+module.exports = InspectLink;