@netkitty/codec 1.0.0

package/dist/headers/CMS.js

@@ -0,0 +1,238 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CMS = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const PerDecoder_1 = require("./cms/PerDecoder");
+const AcsiPdu_1 = require("./cms/AcsiPdu");
+/**
+ * CMS — China smart-substation communication (DL/T 2811-2024, "变电站二次系统通信报文规范"), the
+ * State-Grid replacement for IEC 61850 MMS that maps ACSI directly onto TCP (port 8102), dropping the
+ * OSI upper layers. Per DL/T 2811 §6.1, an Application Protocol Data Unit (APDU) is an Application
+ * Protocol Control Header (APCH) followed by an Application Service Data Unit (ASDU):
+ *
+ *   APCH (4 bytes): Control Code CC — Next(bit8) + Resp(bit7) + Err(bit6) + bak(bit5) + a 4-bit Protocol
+ *                   type PI (low nibble, = 0x01); Service Code SC (1 byte, §6.1.2 Table 1: 1 Associate,
+ *                   2 Abort, 3 Release, 48 GetDataValues, 83 GetAllDataValues, 154 AssociateNegotiate,
+ *                   155 GetAllDataDefinition, …); Frame Length FL (2 bytes, little-endian, the APDU
+ *                   length excluding the APCH).
+ *   ASDU (FL bytes): Service Request Id ReqID (2 bytes, little-endian, §6.2 — 1..65535, 0 for Report)
+ *                    + the service data area (encoded per the SC, kept verbatim here).
+ *
+ * An empty frame (§6.3) has FL=0 (APCH only) or FL=2 (APCH+ReqID). A large ASDU is framed (§6.5) with
+ * the Next bit set. A CMS PDU can also exceed one TCP segment; this single-packet stateless codec
+ * structures the APCH + the ASDU bytes present in the packet, leaving TCP-stream reassembly to a higher
+ * layer (mid-PDU continuation segments carry no APCH — their first byte's low nibble is not the PI 0x01
+ * — so they fall to raw). A single frame round-trips byte-for-byte.
+ */
+class CMS extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'cms';
+        this.name = 'CMS (China Substation Communication, DL/T 2811)';
+        this.nickname = 'CMS';
+        this.matchKeys = ['tcpport:8102', 'tcpport:9102'];
+        //A leaf for this slice — the service data area is kept verbatim (its per-service ACSI encoding, DL/T
+        //2811 §6.10 / §7, is a later slice).
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (CMS.#schemaCache ??= CMS.#buildSchema());
+    }
+    static #bit(name, bitOffset, label) {
+        return {
+            type: 'boolean', label: label,
+            decode: function () {
+                this.instance[name].setValue(!!this.readBits(0, 1, bitOffset, 1));
+            },
+            encode: function () {
+                this.writeBits(0, 1, bitOffset, 1, this.instance[name].getValue(false) ? 1 : 0);
+            }
+        };
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'CMS SC=${serviceCode} ReqID=${reqId}',
+            properties: {
+                //==== APCH — Control Code CC (byte 1) ====
+                //Next: more frames follow (application-level framing of a large ASDU, §6.5).
+                next: this.#bit('next', 0, 'Next'),
+                //Resp: this APDU is a response (vs a request).
+                resp: this.#bit('resp', 1, 'Resp'),
+                //Err: an error response.
+                err: this.#bit('err', 2, 'Err'),
+                //bak: reserved.
+                bak: this.#bit('bak', 3, 'bak'),
+                //Protocol type PI — the low nibble, 0x01 for DL/T 2811.
+                protocolType: {
+                    type: 'integer', label: 'Protocol Type', minimum: 0, maximum: 15,
+                    decode: function () {
+                        this.instance.protocolType.setValue(this.readBits(0, 1, 4, 4));
+                    },
+                    encode: function () {
+                        this.writeBits(0, 1, 4, 4, this.instance.protocolType.getValue(1) & 0x0f);
+                    }
+                },
+                //Service Code SC (byte 2) — the service in the data area (Table 1).
+                serviceCode: this.fieldUInt('serviceCode', 1, 1, 'Service Code'),
+                //Frame Length FL (bytes 3-4, LITTLE-ENDIAN) — the APDU length excluding the 4-byte APCH,
+                //i.e. the ASDU length. Honored verbatim.
+                frameLength: {
+                    type: 'integer', label: 'Frame Length', minimum: 0, maximum: 65535,
+                    decode: function () {
+                        const b = this.readBytes(2, 2);
+                        this.instance.frameLength.setValue((b[0] | (b[1] << 8)) & 0xffff);
+                    },
+                    encode: function () {
+                        let value = this.instance.frameLength.getValue(0);
+                        if (value > 65535)
+                            value = 65535;
+                        if (value < 0)
+                            value = 0;
+                        this.writeBytes(2, Buffer.from([value & 0xff, (value >> 8) & 0xff]));
+                    }
+                },
+                //==== ASDU ====
+                //Service Request Id ReqID (bytes 5-6, LITTLE-ENDIAN). Present only when the ASDU carries it
+                //(FL >= 2); an FL=0 empty frame (§6.3) has no ASDU at all.
+                reqId: {
+                    type: 'integer', label: 'Request Id', minimum: 0, maximum: 65535,
+                    decode: function () {
+                        const available = this.packet.length - this.startPos;
+                        if (this.instance.frameLength.getValue(0) < 2 || available < 6)
+                            return;
+                        const b = this.readBytes(4, 2);
+                        this.instance.reqId.setValue((b[0] | (b[1] << 8)) & 0xffff);
+                    },
+                    encode: function () {
+                        const reqId = this.instance.reqId.getValue();
+                        if (reqId === undefined || reqId === null)
+                            return;
+                        this.writeBytes(4, Buffer.from([reqId & 0xff, (reqId >> 8) & 0xff]));
+                    }
+                },
+                //The service data area (encoded per the Service Code), kept verbatim. Bounded by FL (minus
+                //the 2-byte ReqID) and the captured bytes — for a PDU split across TCP segments only the
+                //bytes present in this packet are captured; the rest is left to a higher reassembly layer.
+                serviceData: {
+                    type: 'string', label: 'Service Data', contentEncoding: 'hex',
+                    decode: function () {
+                        const available = this.packet.length - this.startPos;
+                        const fl = this.instance.frameLength.getValue(0);
+                        if (fl < 2)
+                            return;
+                        let end = 4 + fl;
+                        if (end > available)
+                            end = available;
+                        //Service data begins after the 2-byte ReqID (offset 6).
+                        if (end <= 6)
+                            return;
+                        const buf = this.readBytes(6, end - 6);
+                        this.instance.serviceData.setValue((0, BufferToHex_1.BufferToHex)(buf));
+                        //Display-only: structure the service data area per the Service Code (§6.10, PER).
+                        const decoded = CMS.#decodeServiceData(this.instance.serviceCode.getValue(0), !!this.instance.resp.getValue(false), !!this.instance.err.getValue(false), buf);
+                        if (decoded !== undefined) {
+                            this.instance.serviceDataDecoded.setValue(decoded);
+                        }
+                        else {
+                            //No transcribed structure (e.g. a data/definition response, whose GB/T 33603
+                            //"M-coding" body framing is not fully specified in the available standards).
+                            //Best-effort: surface the readable IEC 61850 identifiers (object/attribute names,
+                            //CDC types, string values) as display metadata — not a structural decode.
+                            const strings = CMS.#extractStrings(buf);
+                            if (strings.length)
+                                this.instance.serviceDataStrings.setValue(strings);
+                        }
+                    },
+                    encode: function () {
+                        const data = this.instance.serviceData.getValue('');
+                        if (data)
+                            this.writeBytes(6, (0, HexToBuffer_1.HexToBuffer)(data));
+                    }
+                },
+                //Display-only structured view of the service data area, decoded with ALIGNED BASIC-PER
+                //(DL/T 2811 §6.10) per the Service Code. Populated on decode by the serviceData closure
+                //above; it has no encode closure, so `serviceData` (hex) stays the authoritative encode
+                //form and the structured view can never perturb the re-emitted bytes.
+                serviceDataDecoded: { type: 'object', label: 'Service Data (decoded)' },
+                //Display-only best-effort readable identifiers extracted from a service data area that has
+                //no transcribed structure (the GB/T 33603 M-coded responses). No encode closure.
+                serviceDataStrings: { type: 'array', label: 'Readable Identifiers', items: { type: 'string' } }
+            }
+        };
+    }
+    /**
+     * Best-effort ALIGNED BASIC-PER decode of the service data area for display. Returns a plain tree
+     * {service, direction, …fields} when the Service Code + direction has a transcribed ASN.1 descriptor,
+     * `incomplete: true` if the decoder bailed partway, or undefined when nothing is structured (leaving
+     * the verbatim hex as the only view). Never throws.
+     */
+    /**
+     * Best-effort readable-identifier extraction from an M-coded (GB/T 33603) service data area whose exact
+     * framing is not fully specified in the available standards. IEC 61850 names/values are length-prefixed
+     * in the low 7 bits of a leading octet; this collects each run of `len` identifier characters
+     * ([A-Za-z0-9_/]) that starts with a letter — the object/attribute names, CDC types and string values
+     * (Mod, stVal, INC, vendor, …). Bounded and never-throwing. This is display metadata, not a structural
+     * decode: it makes no claim about the record structure and never affects the re-emitted bytes.
+     */
+    static #extractStrings(buf) {
+        const isId = (b) => (b >= 0x30 && b <= 0x39) || (b >= 0x41 && b <= 0x5a) || (b >= 0x61 && b <= 0x7a) || b === 0x5f || b === 0x2f;
+        const isAlpha = (b) => (b >= 0x41 && b <= 0x5a) || (b >= 0x61 && b <= 0x7a);
+        const out = [];
+        for (let i = 0; i + 1 < buf.length && out.length < 256; i++) {
+            const len = buf[i] & 0x7f;
+            if (len < 2 || i + 1 + len > buf.length)
+                continue;
+            if (!isAlpha(buf[i + 1]))
+                continue;
+            let ok = true;
+            for (let j = 1; j < len; j++)
+                if (!isId(buf[i + 1 + j])) {
+                    ok = false;
+                    break;
+                }
+            if (ok) {
+                out.push(buf.subarray(i + 1, i + 1 + len).toString('latin1'));
+                i += len;
+            }
+        }
+        return out;
+    }
+    static #decodeServiceData(serviceCode, isResponse, isError, buf) {
+        const entry = AcsiPdu_1.SERVICE_PDU[serviceCode];
+        if (!entry)
+            return undefined;
+        //Error responses carry a ServiceError, not the normal response PDU — not structured in this slice.
+        const type = isError ? undefined : (isResponse ? entry.response : entry.request);
+        if (!type)
+            return undefined;
+        try {
+            const decoder = new PerDecoder_1.PerDecoder(buf);
+            const tree = decoder.decode(type);
+            const head = {
+                service: AcsiPdu_1.SERVICE_NAMES[serviceCode] ?? String(serviceCode),
+                direction: isResponse ? 'response' : 'request'
+            };
+            const body = (tree !== null && typeof tree === 'object') ? tree : {};
+            return decoder.bailed ? { ...head, ...body, incomplete: true } : { ...head, ...body };
+        }
+        catch {
+            return undefined;
+        }
+    }
+    match() {
+        //CMS rides on TCP port 8102 (DL/T 2811 §6.6); some deployments also expose it on 9102 (the 国密
+        //TLCP port), where it can appear in the clear. Require the 4-byte APCH and the Protocol type
+        //PI = 0x01 in the low nibble of the Control Code, so non-CMS traffic and mid-PDU TCP-continuation
+        //segments (which begin with ASDU data bytes, not an APCH) fall through to raw.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.packet.length - this.startPos < 4)
+            return false;
+        return (this.readBytes(0, 1, true)[0] & 0x0f) === 0x01;
+    }
+}
+exports.CMS = CMS;

package/dist/headers/COTP.d.ts

@@ -0,0 +1,30 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * COTP — the ISO 8073 / ITU-T X.224 Connection-Oriented Transport Protocol TPDU, carried inside a TPKT
+ * PDU (RFC 1006) and the transport layer of the IEC 61850 MMS / substation ISO stack. Each TPDU begins
+ * with a Length Indicator (LI) — the number of header octets that FOLLOW the LI byte (it counts neither
+ * the LI itself nor the user data) — then the PDU Type octet (its high nibble is the type code: 0xF0 = DT
+ * Data, 0xE0 = CR Connect Request, 0xD0 = CC Connect Confirm, 0x80 = DR Disconnect Request, 0x50 = ER
+ * Error, …), then type-specific header fields, then the user data (the ISO Session / Presentation / ACSE /
+ * MMS bytes above).
+ *
+ * The single most common TPDU — DT (Data, 0xF0) — is structured: the octet after the PDU Type carries EOT
+ * (bit 7, "end of TSDU") and the 7-bit TPDU-NR. Every OTHER TPDU type keeps its type-specific header
+ * verbatim as `headerRest` hex (bounded by LI), so any TPDU round-trips byte-for-byte without fully
+ * modelling each variant. `pduType` is stored as the FULL octet (e.g. DT = 0xF0 = 240), preserving the low
+ * nibble (CDT credit on CR/CC, etc.) so nothing is lost. The user data is kept verbatim as `data` hex,
+ * bounded by the parent TPKT's Length when present; sub-decoding the session/MMS layers above is deferred.
+ * COTP is therefore effectively a leaf for now.
+ */
+export declare class COTP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/COTP.js

@@ -0,0 +1,193 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COTP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * COTP — the ISO 8073 / ITU-T X.224 Connection-Oriented Transport Protocol TPDU, carried inside a TPKT
+ * PDU (RFC 1006) and the transport layer of the IEC 61850 MMS / substation ISO stack. Each TPDU begins
+ * with a Length Indicator (LI) — the number of header octets that FOLLOW the LI byte (it counts neither
+ * the LI itself nor the user data) — then the PDU Type octet (its high nibble is the type code: 0xF0 = DT
+ * Data, 0xE0 = CR Connect Request, 0xD0 = CC Connect Confirm, 0x80 = DR Disconnect Request, 0x50 = ER
+ * Error, …), then type-specific header fields, then the user data (the ISO Session / Presentation / ACSE /
+ * MMS bytes above).
+ *
+ * The single most common TPDU — DT (Data, 0xF0) — is structured: the octet after the PDU Type carries EOT
+ * (bit 7, "end of TSDU") and the 7-bit TPDU-NR. Every OTHER TPDU type keeps its type-specific header
+ * verbatim as `headerRest` hex (bounded by LI), so any TPDU round-trips byte-for-byte without fully
+ * modelling each variant. `pduType` is stored as the FULL octet (e.g. DT = 0xF0 = 240), preserving the low
+ * nibble (CDT credit on CR/CC, etc.) so nothing is lost. The user data is kept verbatim as `data` hex,
+ * bounded by the parent TPKT's Length when present; sub-decoding the session/MMS layers above is deferred.
+ * COTP is therefore effectively a leaf for now.
+ */
+class COTP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'cotp';
+        this.name = 'COTP';
+        this.nickname = 'COTP';
+        //No demux keys: COTP is an unkeyed content-heuristic child that only rides on top of TPKT.
+        this.matchKeys = [];
+        //Effectively a leaf for now — the session/MMS layers above are kept verbatim and decoded later.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (COTP.#schemaCache ??= COTP.#buildSchema());
+    }
+    /** DT (Data) is identified by the high nibble of the PDU Type octet being 0xF. */
+    static #isDT(pduType) {
+        return (pduType & 0xf0) === 0xf0;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'COTP type=${pduType} li=${li}',
+            properties: {
+                //Length Indicator: the count of header octets following this byte (excludes LI + data).
+                //Honoured when supplied; else derived from the PDU Type + any verbatim header bytes.
+                li: {
+                    type: 'integer',
+                    label: 'Length Indicator',
+                    minimum: 0,
+                    maximum: 255,
+                    decode: function () {
+                        this.instance.li.setValue((0, BufferToNumber_1.BufferToUInt8)(this.readBytes(0, 1)));
+                    },
+                    encode: function () {
+                        const provided = this.instance.li.getValue(0);
+                        let value = provided;
+                        if (!value) {
+                            const dt = COTP.#isDT(this.instance.pduType.getValue(0));
+                            const headerRest = (0, HexToBuffer_1.HexToBuffer)(this.instance.headerRest.getValue(''));
+                            //pduType(1) + (DT ? the EOT/TPDU-NR octet(1) : 0) + verbatim header bytes.
+                            value = 1 + (dt ? 1 : 0) + headerRest.length;
+                        }
+                        if (value > 255) {
+                            this.recordError(this.instance.li.getPath(), 'Maximum value is 255');
+                            value = 255;
+                        }
+                        this.instance.li.setValue(value);
+                        this.writeBytes(0, (0, NumberToBuffer_1.UInt8ToBuffer)(value));
+                    }
+                },
+                //Full PDU Type octet (high nibble = type code, low nibble kept verbatim), e.g. DT = 0xF0 = 240.
+                pduType: this.fieldUInt('pduType', 1, 1, 'PDU Type'),
+                //DT only: bit 7 of the octet at offset 2 — "end of TSDU". Meaningless for other types (left false).
+                eot: {
+                    type: 'boolean',
+                    label: 'EOT',
+                    decode: function () {
+                        const dt = COTP.#isDT(this.instance.pduType.getValue(0));
+                        this.instance.eot.setValue(dt ? !!this.readBits(2, 1, 0, 1) : false);
+                    },
+                    encode: function () {
+                        const dt = COTP.#isDT(this.instance.pduType.getValue(0));
+                        if (dt)
+                            this.writeBits(2, 1, 0, 1, this.instance.eot.getValue(false) ? 1 : 0);
+                    }
+                },
+                //DT only: the low 7 bits of the octet at offset 2 — the TPDU sequence number.
+                tpduNr: {
+                    type: 'integer',
+                    label: 'TPDU Number',
+                    minimum: 0,
+                    maximum: 127,
+                    decode: function () {
+                        const dt = COTP.#isDT(this.instance.pduType.getValue(0));
+                        this.instance.tpduNr.setValue(dt ? this.readBits(2, 1, 1, 7) : 0);
+                    },
+                    encode: function () {
+                        const dt = COTP.#isDT(this.instance.pduType.getValue(0));
+                        if (dt)
+                            this.writeBits(2, 1, 1, 7, this.instance.tpduNr.getValue(0));
+                    }
+                },
+                //The type-specific header bytes of a non-DT TPDU (CR/CC/DR/ER/…), bounded by LI and kept
+                //verbatim so every TPDU variant round-trips byte-for-byte. Empty for a DT TPDU (its single
+                //type-specific octet is structured into eot/tpduNr above).
+                headerRest: {
+                    type: 'string',
+                    label: 'Header Rest',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const dt = COTP.#isDT(this.instance.pduType.getValue(0));
+                        const li = this.instance.li.getValue(0);
+                        const available = this.packet.length - this.startPos;
+                        //The COTP header occupies octets [0, 1 + li); clamp to the captured bytes.
+                        let headerEnd = 1 + li;
+                        if (headerEnd > available)
+                            headerEnd = available;
+                        const restStart = dt ? 3 : 2;
+                        this.instance.headerRest.setValue(headerEnd > restStart ? (0, BufferToHex_1.BufferToHex)(this.readBytes(restStart, headerEnd - restStart)) : '');
+                    },
+                    encode: function () {
+                        const dt = COTP.#isDT(this.instance.pduType.getValue(0));
+                        const headerRest = this.instance.headerRest.getValue('');
+                        if (headerRest)
+                            this.writeBytes(dt ? 3 : 2, (0, HexToBuffer_1.HexToBuffer)(headerRest));
+                    }
+                },
+                //The user data (ISO Session / Presentation / ACSE / MMS bytes), kept verbatim. Bounded by
+                //the parent TPKT's Length when available (so trailing bytes are not absorbed), else runs to
+                //the end of the captured bytes.
+                data: {
+                    type: 'string',
+                    label: 'Data',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const li = this.instance.li.getValue(0);
+                        const available = this.packet.length - this.startPos;
+                        const dataStart = 1 + li;
+                        //Expose the user data as a dispatchable CHILD layer (RDP / S7comm / ISO-Session /
+                        //MMS) instead of consuming it here, but ONLY when the upper PDU is fully self-
+                        //contained in this packet: a DT TPDU with EOT set, riding on TPKT, whose TPKT-
+                        //declared length exactly equals the captured remaining bytes. That rules out
+                        //fragmentation (EOT=0, which a single-packet stateless codec cannot reassemble),
+                        //truncation, and a pipelined trailing TPKT PDU (which an unbounded RawData child
+                        //would otherwise swallow). In that case set data='' and return WITHOUT reading, so
+                        //headerLength stops at the header end and the codec dispatches the remaining bytes.
+                        const pduType = this.instance.pduType.getValue(0);
+                        const dt = COTP.#isDT(pduType);
+                        const eot = this.instance.eot.getValue(false);
+                        //A DT with EOT set, or a Connection Request (0xE0) / Connection Confirm (0xD0)
+                        //whose user data (an RDP Negotiation Request/Response) is single-PDU by nature.
+                        const exposeChild = (dt && eot) || pduType === 0xe0 || pduType === 0xd0;
+                        if (exposeChild && this.prevCodecModule && this.prevCodecModule.id === 'tpkt') {
+                            const cotpPdu = this.prevCodecModule.instance.length.getValue(0) - 4;
+                            if (cotpPdu === available && available > dataStart) {
+                                this.instance.data.setValue('');
+                                return;
+                            }
+                        }
+                        //Otherwise COTP remains a leaf and keeps the user data verbatim, bounded by the TPKT
+                        //Length so a pipelined trailing PDU is left for a fresh TPKT dispatch.
+                        let end = available;
+                        if (this.prevCodecModule && this.prevCodecModule.id === 'tpkt') {
+                            const cotpPdu = this.prevCodecModule.instance.length.getValue(0) - 4;
+                            if (cotpPdu >= 0 && cotpPdu < end)
+                                end = cotpPdu;
+                        }
+                        this.instance.data.setValue(end > dataStart ? (0, BufferToHex_1.BufferToHex)(this.readBytes(dataStart, end - dataStart)) : '');
+                    },
+                    encode: function () {
+                        const li = this.instance.li.getValue(0);
+                        const data = this.instance.data.getValue('');
+                        if (data)
+                            this.writeBytes(1 + li, (0, HexToBuffer_1.HexToBuffer)(data));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //COTP is carried exclusively inside a TPKT PDU — gate purely on the parent being TPKT so a stray
+        //TCP payload is never mis-claimed (the heuristic chain offers COTP on every layer).
+        return !!this.prevCodecModule && this.prevCodecModule.id === 'tpkt';
+    }
+}
+exports.COTP = COTP;

package/dist/headers/CassandraCQL.d.ts

@@ -0,0 +1,28 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * Cassandra CQL native protocol (DataStax/Apache Cassandra, native protocol v4), TCP port 9042. Every
+ * CQL frame begins with a fixed 9-byte big-endian header — Version (the direction bit 0x80 OR-ed with
+ * the protocol version, so 0x04 = a v4 request, 0x84 = a v4 response), Flags, a 2-byte Stream id, an
+ * Opcode (0x01 STARTUP, 0x02 READY, 0x05 OPTIONS, 0x07 QUERY, 0x08 RESULT, 0x09 PREPARE, …), and a
+ * 4-byte Length (the octet count of the body that follows) — followed by `Length` bytes of
+ * opcode-specific body.
+ *
+ * The body layout differs per opcode (STARTUP's [string map], QUERY's query + consistency, RESULT's
+ * kind + rows metadata, …) and several bodies need query-prepare / paging context, so this
+ * single-frame codec keeps the body verbatim as `body` hex (byte-perfect) and does not sub-decode it.
+ * The Length is auto-computed from the body on encode when not supplied, else honored verbatim (a
+ * crafted frame may lie); the body is bounded by the Length so a second pipelined CQL frame or trailing
+ * bytes are left to the codec's recursion / RawData. A well-formed frame round-trips byte-for-byte.
+ */
+export declare class CassandraCQL extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/CassandraCQL.js

@@ -0,0 +1,117 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CassandraCQL = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * Cassandra CQL native protocol (DataStax/Apache Cassandra, native protocol v4), TCP port 9042. Every
+ * CQL frame begins with a fixed 9-byte big-endian header — Version (the direction bit 0x80 OR-ed with
+ * the protocol version, so 0x04 = a v4 request, 0x84 = a v4 response), Flags, a 2-byte Stream id, an
+ * Opcode (0x01 STARTUP, 0x02 READY, 0x05 OPTIONS, 0x07 QUERY, 0x08 RESULT, 0x09 PREPARE, …), and a
+ * 4-byte Length (the octet count of the body that follows) — followed by `Length` bytes of
+ * opcode-specific body.
+ *
+ * The body layout differs per opcode (STARTUP's [string map], QUERY's query + consistency, RESULT's
+ * kind + rows metadata, …) and several bodies need query-prepare / paging context, so this
+ * single-frame codec keeps the body verbatim as `body` hex (byte-perfect) and does not sub-decode it.
+ * The Length is auto-computed from the body on encode when not supplied, else honored verbatim (a
+ * crafted frame may lie); the body is bounded by the Length so a second pipelined CQL frame or trailing
+ * bytes are left to the codec's recursion / RawData. A well-formed frame round-trips byte-for-byte.
+ */
+class CassandraCQL extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'cql';
+        this.name = 'Cassandra CQL';
+        this.nickname = 'CQL';
+        this.matchKeys = ['tcpport:9042'];
+        //A leaf header — the opcode-specific body requires per-opcode, cross-frame parsing.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (CassandraCQL.#schemaCache ??= CassandraCQL.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'CQL v=${version} opcode=${opcode} len=${length}',
+            properties: {
+                //Version octet: direction bit 0x80 (request 0, response 1) OR-ed with the protocol
+                //version in the low 7 bits (e.g. 0x04 v4 request, 0x84 v4 response). Kept as the full
+                //octet so both the direction bit and the version round-trip; the split is UI enrichment.
+                version: this.fieldUInt('version', 0, 1, 'Version'),
+                //Frame flags (bit 0 compression, bit 1 tracing, bit 2 custom payload, bit 3 warning).
+                flags: this.fieldUInt('flags', 1, 1, 'Flags'),
+                //Stream id correlating requests with responses (may be negative on the wire for
+                //server-initiated events; kept as a plain 2-byte value — byte-perfect and editable).
+                stream: this.fieldUInt('stream', 2, 2, 'Stream'),
+                //Opcode naming the message (0x01 STARTUP, 0x02 READY, 0x05 OPTIONS, 0x07 QUERY,
+                //0x08 RESULT, 0x09 PREPARE, …). Plain uint8 so any opcode round-trips.
+                opcode: this.fieldUInt('opcode', 4, 1, 'Opcode'),
+                length: {
+                    type: 'integer',
+                    label: 'Length',
+                    minimum: 0,
+                    maximum: 4294967295,
+                    decode: function () {
+                        this.instance.length.setValue((0, BufferToNumber_1.BufferToUInt32)(this.readBytes(5, 4)));
+                    },
+                    encode: function () {
+                        //Length counts only the body that follows the 9-byte header. Honored when supplied
+                        //(a crafted frame may lie); else derived from the body.
+                        const provided = this.instance.length.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : (0, HexToBuffer_1.HexToBuffer)(this.instance.body.getValue('')).length;
+                        if (value > 4294967295) {
+                            this.recordError(this.instance.length.getPath(), 'Maximum value is 4294967295');
+                            value = 4294967295;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.length.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.length.setValue(value);
+                        this.writeBytes(5, (0, NumberToBuffer_1.UInt32ToBuffer)(value));
+                    }
+                },
+                //The opcode-specific body after the 9-byte header, kept verbatim. Bounded by the Length
+                //field (the body ends at offset 9 + Length) and the captured bytes, so trailing /
+                //pipelined data is left to the codec's recursion / RawData.
+                body: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        const length = this.instance.length.getValue(0);
+                        let end = 9 + length;
+                        if (end > remaining)
+                            end = remaining;
+                        this.instance.body.setValue(end > 9 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(9, end - 9)) : '');
+                    },
+                    encode: function () {
+                        const body = this.instance.body.getValue('');
+                        if (body)
+                            this.writeBytes(9, (0, HexToBuffer_1.HexToBuffer)(body));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Cassandra CQL rides on TCP port 9042. The 9-byte header carries no strong content magic (the
+        //version octet's low nibble is just a small protocol version), so the well-known port is the
+        //signature: require the previous layer to be TCP and the full 9-byte header to be present. Stays
+        //port-bucketed (matchKeys only, no heuristicFallback) so non-CQL 9042 traffic falls through to raw.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        return this.packet.length - this.startPos >= 9;
+    }
+}
+exports.CassandraCQL = CassandraCQL;

package/dist/headers/CoAP.d.ts

@@ -0,0 +1,29 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * CoAP — Constrained Application Protocol (RFC 7252), a RESTful transfer protocol for constrained nodes
+ * and networks (IoT), riding on UDP port 5683. Every message opens with a 4-byte fixed header: byte 0
+ * holds the 2-bit Version (always 1), a 2-bit Type (0 CON, 1 NON, 2 ACK, 3 RST) and a 4-bit Token
+ * Length (TKL, 0-8); byte 1 is the 8-bit Code (a 3-bit class '.' 5-bit detail, e.g. 0.01 GET = 0x01,
+ * 2.05 Content = 0x45); bytes 2-3 are the big-endian Message ID. The fixed header is followed by a
+ * Token of TKL octets, then a sequence of Options, then optionally a 0xFF payload marker and the
+ * payload.
+ *
+ * This codec decodes the fixed header and the Token structurally and keeps everything after the Token
+ * (the Options plus the optional payload-marker-and-payload) verbatim as `payload` hex — de-structuring
+ * CoAP's option deltas / TLV encoding is a later slice, so those bytes are preserved untouched and the
+ * message round-trips byte-for-byte. The region is bounded by the UDP datagram length so any trailing
+ * padding is not absorbed. version === 1 is the content signature that separates a real CoAP datagram
+ * on port 5683 from arbitrary traffic.
+ */
+export declare class CoAP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}