@netkitty/codec 1.0.0

package/dist/headers/FTP.js

@@ -0,0 +1,158 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FTP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/** FTP command verbs (RFC 959 + common extensions) used only to recognize a command line. */
+const FTP_COMMANDS = ['USER', 'PASS', 'ACCT', 'CWD', 'CDUP', 'QUIT', 'PORT', 'PASV', 'TYPE', 'RETR', 'STOR', 'LIST', 'NLST', 'DELE', 'MKD', 'RMD', 'PWD', 'SYST', 'FEAT', 'EPSV', 'EPRT', 'SIZE', 'MDTM', 'RNFR', 'RNTO', 'NOOP', 'OPTS', 'AUTH', 'HELP', 'STAT', 'ABOR', 'REST', 'APPE'];
+/**
+ * FTP — the File Transfer Protocol control channel (RFC 959), carried as US-ASCII text over TCP
+ * well-known port 21. The control channel is line-based: a client sends commands
+ * (`USER anonymous\r\n`, `PASS x\r\n`, `RETR file\r\n`, …) and a server sends replies
+ * (`220 Service ready\r\n`, `331 …\r\n`); a multi-line reply repeats the code with a '-' after the
+ * first line (`220-…\r\n…\r\n220 …\r\n`). The bulk data transfer runs on a separate dynamic-port
+ * connection which is out of scope — only the control channel on port 21 is claimed here (like TFTP,
+ * whose data channel is likewise not claimed).
+ *
+ * Like Syslog, SIP and HTTP, the message is text whose full internal structure (arbitrary arguments,
+ * significant whitespace, multi-line reply continuations) is richer than a form needs. So the ENTIRE
+ * raw message is kept verbatim as the authoritative `message` field (hex) and re-emitted untouched;
+ * only the first line is parsed on decode into display-only metadata (command/argument for a command,
+ * replyCode/replyText for a reply). Encode never reconstructs the message from the parsed fields — it
+ * writes `message` back byte-for-byte — so any conformant (or even malformed) FTP line round-trips
+ * exactly.
+ *
+ * Note: a single TCP segment may carry more than one control line (pipelined commands) or only part of
+ * a multi-line reply; reassembly across segments is out of scope. This single-segment codec keeps
+ * whatever bytes are present verbatim, which is byte-perfect for the single-packet case.
+ */
+class FTP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'ftp';
+        this.name = 'File Transfer Protocol';
+        this.nickname = 'FTP';
+        //FTP is recognized ONLY on the well-known control port 21 — deliberately NOT via heuristicFallback.
+        //Unlike HTTP/RTSP (whose method sets are distinctive), FTP's line signature is a 3-digit reply code
+        //or a generic verb (USER/PASS/LIST/STAT/QUIT/RETR/…) that is SHARED with other US-ASCII line
+        //protocols this codec does not model — POP3 (USER/PASS/STAT/LIST/RETR/QUIT), SMTP (AUTH/QUIT/NOOP),
+        //IRC (USER/QUIT), and any NNN-code greeting (SMTP/NNTP). Joining the global heuristic chain would
+        //mislabel all of those as FTP on their own ports. Confining FTP to the tcp:21 bucket keeps that
+        //collision impossible (POP3/SMTP/IRC live on 110/25/6667, which never reach this bucket); alt-port
+        //FTP control is rare and falls losslessly to raw.
+        this.matchKeys = ['tcpport:21'];
+        //A leaf header — the FTP data channel and the session it belongs to are a higher-layer concern.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (_a.#schemaCache ??= _a.#buildSchema());
+    }
+    /**
+     * Bytes of this header: FTP rides on TCP, which has no per-message length, so take the rest of the
+     * segment. Reassembly across segments is out of scope (see class doc).
+     */
+    #payloadLength() {
+        const available = this.packet.length - this.startPos;
+        return available < 0 ? 0 : available;
+    }
+    /** The first line of the message (up to the first CRLF, or the whole payload if none). */
+    static #firstLine(text) {
+        const idx = text.indexOf('\r\n');
+        return idx >= 0 ? text.slice(0, idx) : text;
+    }
+    /**
+     * Parse the first line into the display-only metadata fields. A line matching `^\d{3}[ -]` is a
+     * server reply (the code, whether it is multi-line, and the trailing text); anything else is a
+     * client command (the uppercased verb and its argument). Populated on decode only — these fields
+     * have no encode, so they never affect the re-emitted bytes and never mutate `message`. Never
+     * throws: missing/garbage tokens yield empty strings or 0.
+     */
+    #parseFirstLine(text) {
+        const line = _a.#firstLine(text);
+        const reply = line.match(/^(\d{3})([ -])(.*)$/);
+        if (reply) {
+            //Reply: 3-digit code, then ' ' (final) or '-' (a multi-line continuation follows).
+            this.instance.isReply.setValue(true);
+            this.instance.replyCode.setValue(Number(reply[1]));
+            this.instance.isMultiline.setValue(reply[2] === '-');
+            this.instance.replyText.setValue(reply[3]);
+            this.instance.command.setValue('');
+            this.instance.argument.setValue('');
+            return;
+        }
+        //Command: VERB SP argument (the argument may itself contain spaces, e.g. a path).
+        const idx = line.indexOf(' ');
+        const verb = idx >= 0 ? line.slice(0, idx) : line;
+        this.instance.isReply.setValue(false);
+        this.instance.replyCode.setValue(0);
+        this.instance.isMultiline.setValue(false);
+        this.instance.replyText.setValue('');
+        this.instance.command.setValue(verb.toUpperCase());
+        this.instance.argument.setValue(idx >= 0 ? line.slice(idx + 1) : '');
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'FTP ${command}${replyCode}',
+            properties: {
+                //The whole raw message is the single source of truth: decoded verbatim to hex and
+                //re-emitted untouched (byte-perfect for any FTP control text). The first line is parsed
+                //into the display-only metadata below, which carry no codec of their own.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        if (available <= 0) {
+                            this.instance.message.setValue('');
+                            this.#parseFirstLine('');
+                            return;
+                        }
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parseFirstLine(raw.toString('latin1'));
+                    },
+                    encode: function () {
+                        //Re-emit the authoritative message verbatim — never reconstruct from metadata.
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                },
+                //Display-only metadata parsed from the first line on decode (no encode — populated by the
+                //message field above, never read back). isReply distinguishes a server reply from a
+                //client command; replyCode/isMultiline/replyText describe a reply, command/argument a
+                //command.
+                isReply: { type: 'boolean', label: 'Is Reply' },
+                replyCode: { type: 'integer', label: 'Reply Code', minimum: 0, maximum: 999 },
+                isMultiline: { type: 'boolean', label: 'Is Multiline' },
+                replyText: { type: 'string', label: 'Reply Text' },
+                command: { type: 'string', label: 'Command' },
+                argument: { type: 'string', label: 'Argument' }
+            }
+        };
+    }
+    match() {
+        //FTP rides on TCP as US-ASCII text. Recognize it by the line signature: a 3-digit reply code
+        //followed by space or '-', or a known command verb as the leading token (up to the first space
+        //or CR) — so non-FTP traffic on port 21 falls through to raw rather than claiming an
+        //un-decodable text layer.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.#payloadLength() < 3)
+            return false;
+        const lead = this.readBytes(0, 16, true).toString('latin1');
+        if (/^\d{3}[ -]/.test(lead))
+            return true;
+        const line = _a.#firstLine(lead);
+        const token = (line.split(/[ \r]/)[0] || '').toUpperCase();
+        return FTP_COMMANDS.includes(token);
+    }
+}
+exports.FTP = FTP;
+_a = FTP;

package/dist/headers/Finger.d.ts

@@ -0,0 +1,41 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * Finger — the Finger User Information Protocol (RFC 1288), carried over TCP well-known port 79. A Finger
+ * transaction opens with a single US-ASCII query line the client sends to the server, terminated by CR LF:
+ *
+ *   {C}                         — empty line: "list all users" ({U} query with no username)
+ *   {username}{C}               — a {U} query naming one user, e.g. "root\r\n"
+ *   /W{C} · /W {username}{C}     — the verbose ("whois") switch {W} = "/W", optionally followed by a
+ *                                 username, e.g. "/W root\r\n" (a forwarding {H} form "user@host" is just
+ *                                 carried inside the username text)
+ *
+ * MINIMAL slice (mirrors the SSH/Telnet verbatim-message pattern): the query is free-form US-ASCII text
+ * with only a line ending for framing, so the structure a form needs is far poorer than the exact bytes a
+ * peer sees. The ENTIRE payload is therefore the single source of truth — decoded verbatim to hex in the
+ * authoritative `message` field and re-emitted byte-for-byte on encode. On top of that the first line is
+ * parsed into DISPLAY-ONLY metadata: `query` (the username with any leading "/W" verbose switch and
+ * surrounding whitespace stripped) and `isVerbose` (true when the line opens with "/W"). Those carry no
+ * codec of their own and never reconstruct the bytes — the message owns them. So any Finger payload (an
+ * empty list-all query, a username, a verbose query, a server's textual response, or a truncated
+ * fragment) round-trips exactly.
+ *
+ * Matching rationale (NO heuristicFallback): Finger is claimed ONLY on the tcp:79 bucket. A Finger query
+ * is arbitrary US-ASCII text with no distinctive off-port content signature (a bare "root\r\n" or an empty
+ * "\r\n" is indistinguishable from countless other line protocols), so recognizing it relies entirely on
+ * the well-known port. Joining the global content-heuristic chain would let Finger mislabel arbitrary text
+ * TCP payloads on any port. Confining Finger to tcp:79 keeps that impossible; alt-port Finger is rare and
+ * falls losslessly to raw. For the same reason match() does NOT gate on printable text: on the port-79
+ * bucket every payload IS Finger, so any non-empty payload is kept verbatim rather than dropped to raw.
+ */
+export declare class Finger extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/Finger.js

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Finger = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * Finger — the Finger User Information Protocol (RFC 1288), carried over TCP well-known port 79. A Finger
+ * transaction opens with a single US-ASCII query line the client sends to the server, terminated by CR LF:
+ *
+ *   {C}                         — empty line: "list all users" ({U} query with no username)
+ *   {username}{C}               — a {U} query naming one user, e.g. "root\r\n"
+ *   /W{C} · /W {username}{C}     — the verbose ("whois") switch {W} = "/W", optionally followed by a
+ *                                 username, e.g. "/W root\r\n" (a forwarding {H} form "user@host" is just
+ *                                 carried inside the username text)
+ *
+ * MINIMAL slice (mirrors the SSH/Telnet verbatim-message pattern): the query is free-form US-ASCII text
+ * with only a line ending for framing, so the structure a form needs is far poorer than the exact bytes a
+ * peer sees. The ENTIRE payload is therefore the single source of truth — decoded verbatim to hex in the
+ * authoritative `message` field and re-emitted byte-for-byte on encode. On top of that the first line is
+ * parsed into DISPLAY-ONLY metadata: `query` (the username with any leading "/W" verbose switch and
+ * surrounding whitespace stripped) and `isVerbose` (true when the line opens with "/W"). Those carry no
+ * codec of their own and never reconstruct the bytes — the message owns them. So any Finger payload (an
+ * empty list-all query, a username, a verbose query, a server's textual response, or a truncated
+ * fragment) round-trips exactly.
+ *
+ * Matching rationale (NO heuristicFallback): Finger is claimed ONLY on the tcp:79 bucket. A Finger query
+ * is arbitrary US-ASCII text with no distinctive off-port content signature (a bare "root\r\n" or an empty
+ * "\r\n" is indistinguishable from countless other line protocols), so recognizing it relies entirely on
+ * the well-known port. Joining the global content-heuristic chain would let Finger mislabel arbitrary text
+ * TCP payloads on any port. Confining Finger to tcp:79 keeps that impossible; alt-port Finger is rare and
+ * falls losslessly to raw. For the same reason match() does NOT gate on printable text: on the port-79
+ * bucket every payload IS Finger, so any non-empty payload is kept verbatim rather than dropped to raw.
+ */
+class Finger extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'finger';
+        this.name = 'Finger';
+        this.nickname = 'Finger';
+        //Finger is recognized ONLY on the well-known port 79 — deliberately NOT via heuristicFallback. A Finger
+        //query is arbitrary US-ASCII text with no distinctive off-port content signature, so its recognition
+        //depends entirely on the port bucket; joining the global heuristic chain would mislabel arbitrary text
+        //TCP payloads on any port. See the class doc for the full rationale.
+        this.matchKeys = ['tcpport:79'];
+        //A leaf header — a Finger query/response is free-form user-information text; nothing demuxes off it.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (Finger.#schemaCache ??= Finger.#buildSchema());
+    }
+    /** Bytes available to this header: Finger rides on TCP, which has no per-message length. */
+    #payloadLength() {
+        const available = this.packet.length - this.startPos;
+        return available < 0 ? 0 : available;
+    }
+    /**
+     * Parse the first line into the display-only metadata fields. The Finger query is `[/W[ ]]username{C}`
+     * where {C} is CR LF (a lone LF is tolerated); "/W" is the verbose switch. Populated on decode only —
+     * these fields have no encode, so they never affect the re-emitted bytes and never mutate `message`.
+     * Never throws: an empty payload yields empty query / isVerbose false.
+     */
+    #parseQuery(text) {
+        //Keep only up to the first line ending for the display parse; `message` still holds all bytes.
+        let line = text;
+        const lf = line.indexOf('\n');
+        if (lf >= 0)
+            line = line.slice(0, lf);
+        if (line.endsWith('\r'))
+            line = line.slice(0, -1);
+        //The verbose switch is the literal "/W" at the very start of the line (RFC 1288 §2.3).
+        let verbose = false;
+        if (line.startsWith('/W')) {
+            verbose = true;
+            line = line.slice(2);
+        }
+        //Strip the whitespace that separates the switch from the username (or leads a plain query).
+        const query = line.trim();
+        this.instance.isVerbose.setValue(verbose);
+        this.instance.query.setValue(query);
+        this.instance.summaryInfo.setValue(query ? query : 'list all');
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'Finger ${summaryInfo}',
+            properties: {
+                //Display-only metadata parsed from the first line on decode (no encode — populated by the
+                //`message` field below, never read back). isVerbose flags a query opening with "/W"; query
+                //is the username text with the verbose switch and surrounding whitespace removed.
+                isVerbose: { type: 'boolean', label: 'Is Verbose', default: false },
+                query: { type: 'string', label: 'Query', default: '' },
+                //Drives the one-line summary: the query text, or 'list all' for the empty query.
+                summaryInfo: { type: 'string', label: 'Summary', hidden: true, default: '' },
+                //The whole raw payload is the single source of truth: decoded verbatim to hex and re-emitted
+                //untouched (byte-perfect for any Finger payload). The first line is parsed into the
+                //display-only metadata above, which carry no codec of their own.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    default: '',
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        if (available <= 0) {
+                            this.instance.message.setValue('');
+                            this.#parseQuery('');
+                            return;
+                        }
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parseQuery(raw.toString('latin1'));
+                    },
+                    encode: function () {
+                        //Re-emit the authoritative payload verbatim — never reconstruct from metadata.
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Reached only on the tcp:79 bucket. Port 79 IS Finger's, so any non-empty payload over TCP is
+        //claimed and kept verbatim (byte-perfect) — deliberately without a printable-text gate, so a
+        //response body is never wrongly dropped to raw. An empty payload is not claimed.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'tcp')
+            return false;
+        return this.#payloadLength() >= 1;
+    }
+}
+exports.Finger = Finger;

package/dist/headers/FoundationFieldbusHSE.d.ts

@@ -0,0 +1,43 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * FOUNDATION Fieldbus HSE — High Speed Ethernet (IEC 61158), the process-control fieldbus mapping onto
+ * TCP + UDP ports 1089/1090/1091. Every HSE frame carries an FDA (Field Device Access) message, which
+ * begins with a 12-octet FDA Message Header (FF-588 §6.3 / Wireshark `ff` dissector layout):
+ *
+ *   0    Version                          (1 octet)  FDA message version
+ *   1    Options                          (1 octet)  trailer-presence bitmap + pad length; bit fields are
+ *                                                    0x80 msg-num, 0x40 invoke-id, 0x20 timestamp,
+ *                                                    0x10 reserved, 0x08 ext-ctrl, 0x07 pad length —
+ *                                                    kept as the whole octet so every bit round-trips
+ *   2    Protocol Id And Confirmed Type   (1 octet)  0xFC protocol id (FDA/SM/FMS/LAN), 0x03 confirmed msg type
+ *   3    Service                          (1 octet)  0x80 confirmed flag, 0x7F service id
+ *   4..7 FDA Address                       (4 octets) session/address handle, kept as hex (BASE_HEX)
+ *   8..11 Message Length                   (4 octets) total octet count of the whole FDA message (this
+ *                                                    12-octet header + service body + trailer)
+ *
+ * The service-specific body (and any optional trailer selected by the Options bits) follows the header.
+ * Its layout is per protocol id + service id and needs cross-message session context, so this
+ * single-message codec keeps everything after the header verbatim as `body` hex (byte-perfect) and does
+ * not sub-decode it (a later enrichment). Message Length delimits this layer: the FDA message ends at
+ * `Message Length` octets, so a second pipelined FDA message or trailing/padding bytes are left to the
+ * codec's recursion / RawData rather than swallowed. Message Length is honored when supplied (a crafted
+ * frame may lie) else derived from the header + body on encode. A well-formed message round-trips
+ * byte-for-byte.
+ *
+ * Transport framing is identical over TCP and UDP — the FDA message has no record/length prefix of its
+ * own (unlike Kerberos/SunRPC over TCP); Message Length is the sole delimiter. The only transport-aware
+ * detail is the payload bound: over UDP the message is capped by (udp.length − 8) so Ethernet padding is
+ * never read into `body`; over TCP it is capped by the captured stream bytes.
+ */
+export declare class FoundationFieldbusHSE extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/FoundationFieldbusHSE.js

@@ -0,0 +1,163 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FoundationFieldbusHSE = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * FOUNDATION Fieldbus HSE — High Speed Ethernet (IEC 61158), the process-control fieldbus mapping onto
+ * TCP + UDP ports 1089/1090/1091. Every HSE frame carries an FDA (Field Device Access) message, which
+ * begins with a 12-octet FDA Message Header (FF-588 §6.3 / Wireshark `ff` dissector layout):
+ *
+ *   0    Version                          (1 octet)  FDA message version
+ *   1    Options                          (1 octet)  trailer-presence bitmap + pad length; bit fields are
+ *                                                    0x80 msg-num, 0x40 invoke-id, 0x20 timestamp,
+ *                                                    0x10 reserved, 0x08 ext-ctrl, 0x07 pad length —
+ *                                                    kept as the whole octet so every bit round-trips
+ *   2    Protocol Id And Confirmed Type   (1 octet)  0xFC protocol id (FDA/SM/FMS/LAN), 0x03 confirmed msg type
+ *   3    Service                          (1 octet)  0x80 confirmed flag, 0x7F service id
+ *   4..7 FDA Address                       (4 octets) session/address handle, kept as hex (BASE_HEX)
+ *   8..11 Message Length                   (4 octets) total octet count of the whole FDA message (this
+ *                                                    12-octet header + service body + trailer)
+ *
+ * The service-specific body (and any optional trailer selected by the Options bits) follows the header.
+ * Its layout is per protocol id + service id and needs cross-message session context, so this
+ * single-message codec keeps everything after the header verbatim as `body` hex (byte-perfect) and does
+ * not sub-decode it (a later enrichment). Message Length delimits this layer: the FDA message ends at
+ * `Message Length` octets, so a second pipelined FDA message or trailing/padding bytes are left to the
+ * codec's recursion / RawData rather than swallowed. Message Length is honored when supplied (a crafted
+ * frame may lie) else derived from the header + body on encode. A well-formed message round-trips
+ * byte-for-byte.
+ *
+ * Transport framing is identical over TCP and UDP — the FDA message has no record/length prefix of its
+ * own (unlike Kerberos/SunRPC over TCP); Message Length is the sole delimiter. The only transport-aware
+ * detail is the payload bound: over UDP the message is capped by (udp.length − 8) so Ethernet padding is
+ * never read into `body`; over TCP it is capped by the captured stream bytes.
+ */
+class FoundationFieldbusHSE extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'ffhse';
+        this.name = 'FOUNDATION Fieldbus HSE';
+        this.nickname = 'FF-HSE';
+        //HSE FDA agent ports 1089/1090/1091 on both TCP and UDP.
+        this.matchKeys = [
+            'tcpport:1089', 'udpport:1089',
+            'tcpport:1090', 'udpport:1090',
+            'tcpport:1091', 'udpport:1091'
+        ];
+        //A leaf header — the service body / trailer needs per-protocol, session-dependent parsing.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (FoundationFieldbusHSE.#schemaCache ??= FoundationFieldbusHSE.#buildSchema());
+    }
+    /** Length of the fixed FDA Message Header in octets. */
+    static #HEADER_LENGTH = 12;
+    /**
+     * Header-relative end offset of the bytes this layer may read: the captured remainder, further capped
+     * by (udp.length − 8) over UDP so a lying Message Length can never read past the real transport
+     * payload (and Ethernet padding is never swallowed into `body`). Over TCP the stream bytes are the cap.
+     */
+    #payloadEnd() {
+        let end = this.packet.length - this.startPos;
+        const prev = this.prevCodecModule;
+        if (prev && prev.id === 'udp') {
+            const udpLength = prev.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < end)
+                end = udpLength - 8;
+        }
+        return end < 0 ? 0 : end;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'FF-HSE ver=${version} svc=${service} len=${messageLength}',
+            properties: {
+                //FDA Message Version (FF-588 §6.3).
+                version: this.fieldUInt('version', 0, 1, 'Version'),
+                //Options: a trailer-presence bitmap (0x80 message number, 0x40 invoke id, 0x20 timestamp,
+                //0x08 extended control) plus 0x10 reserved and a 0x07 pad-length. Kept as the whole octet
+                //so every reserved/flag bit round-trips untouched.
+                options: this.fieldUInt('options', 1, 1, 'Options'),
+                //Protocol Id And Confirmed Msg Type: 0xFC = protocol id (FDA/SM/FMS/LAN dispatch),
+                //0x03 = confirmed message type. Whole octet kept so both sub-fields round-trip.
+                protocolAndType: this.fieldUInt('protocolAndType', 2, 1, 'Protocol Id And Confirmed Msg Type'),
+                //Service: 0x80 = confirmed flag, 0x7F = service id. Whole octet kept.
+                service: this.fieldUInt('service', 3, 1, 'Service'),
+                //FDA Address — a session/address handle, kept verbatim as hex (BASE_HEX in the dissector).
+                fdaAddress: this.fieldHex('fdaAddress', 4, 4, 'FDA Address'),
+                messageLength: {
+                    type: 'integer',
+                    label: 'Message Length',
+                    minimum: 0,
+                    maximum: 4294967295,
+                    decode: function () {
+                        this.instance.messageLength.setValue((0, BufferToNumber_1.BufferToUInt32)(this.readBytes(8, 4)));
+                    },
+                    encode: function () {
+                        //Total octet count of the whole FDA message = 12-byte header + body. Honored when
+                        //supplied (a crafted frame may lie); else derived from the body.
+                        const provided = this.instance.messageLength.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : FoundationFieldbusHSE.#HEADER_LENGTH + (0, HexToBuffer_1.HexToBuffer)(this.instance.body.getValue('')).length;
+                        if (value > 4294967295) {
+                            this.recordError(this.instance.messageLength.getPath(), 'Maximum value is 4294967295');
+                            value = 4294967295;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.messageLength.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.messageLength.setValue(value);
+                        this.writeBytes(8, (0, NumberToBuffer_1.UInt32ToBuffer)(value));
+                    }
+                },
+                //The service body + optional trailer after the 12-byte header, kept verbatim. Bounded by
+                //Message Length (the FDA message ends at that octet count) and by the transport payload, so
+                //trailing / pipelined FDA messages and Ethernet padding are left to the codec's recursion.
+                body: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const payloadEnd = this.#payloadEnd();
+                        const messageLength = this.instance.messageLength.getValue(0);
+                        let end = messageLength;
+                        if (end > payloadEnd)
+                            end = payloadEnd;
+                        this.instance.body.setValue(end > FoundationFieldbusHSE.#HEADER_LENGTH
+                            ? (0, BufferToHex_1.BufferToHex)(this.readBytes(FoundationFieldbusHSE.#HEADER_LENGTH, end - FoundationFieldbusHSE.#HEADER_LENGTH))
+                            : '');
+                    },
+                    encode: function () {
+                        const body = this.instance.body.getValue('');
+                        if (body)
+                            this.writeBytes(FoundationFieldbusHSE.#HEADER_LENGTH, (0, HexToBuffer_1.HexToBuffer)(body));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //FF-HSE rides TCP/UDP ports 1089-1091 (selected via the port buckets). This stays a port-bucket
+        //protocol: matchKeys only, NO heuristicFallback — the FDA header has no distinctive magic to
+        //claim FF off its well-known ports, and Wireshark itself dissects these ports by port alone. The
+        //only guard is that the full 12-byte FDA Message Header fits within the transport payload (payload
+        //length, not whole-frame remainder, so Ethernet padding on a short UDP datagram does not match).
+        if (!this.prevCodecModule)
+            return false;
+        const prev = this.prevCodecModule;
+        if (prev.id !== 'tcp' && prev.id !== 'udp')
+            return false;
+        if (this.#payloadEnd() < FoundationFieldbusHSE.#HEADER_LENGTH)
+            return false;
+        return true;
+    }
+}
+exports.FoundationFieldbusHSE = FoundationFieldbusHSE;

package/dist/headers/GELF.d.ts

@@ -0,0 +1,35 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * GELF — Graylog Extended Log Format, the log-shipping payload Graylog and its inputs exchange over
+ * UDP port 12201. A GELF UDP datagram carries a single log message in one of three on-wire forms, told
+ * apart by the first bytes of the payload:
+ *
+ *  - Chunked (magic 0x1E0F): a large message split across datagrams. The 12-byte chunk header is the
+ *    2-byte magic, an 8-byte Message ID (shared by all chunks of one message), a 1-byte Sequence Number
+ *    (this chunk's index) and a 1-byte Sequence Count (total chunks), followed by this chunk's slice of
+ *    the (possibly compressed) message. The receiver reassembles the slices by Message ID / Sequence.
+ *  - GZIP (magic 0x1F8B): the whole datagram is a single gzip-compressed GELF JSON document.
+ *  - Uncompressed: anything else — the datagram is the GELF JSON document as UTF-8 text (a `{ ... }`
+ *    object). (A zlib-deflated document, magic 0x78, also falls here and is kept verbatim.)
+ *
+ * This is the minimal faithful slice: the form is detected from the leading magic and the chunk header
+ * is structured (magic / messageId / sequenceNumber / sequenceCount + chunk `data` hex); the gzip body
+ * and the uncompressed/zlib body are opaque here and kept verbatim (`payload` / `message` hex) — the
+ * chunk-reassembly, gunzip and JSON decoding are a later enrichment layered on top of this byte-perfect
+ * base. Everything is bounded by the enclosing UDP payload length so a trailing FCS/padding is not
+ * absorbed. Nothing is recomputed on encode (the Sequence Count is honored, not derived), so a
+ * well-formed datagram of any form round-trips byte-for-byte. `form` is a decode-time discriminant that
+ * writes no bytes; on encode it is honored when supplied, else inferred from which fields are present.
+ */
+export declare class GELF extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}