@netkitty/codec 1.0.0

package/dist/headers/ISOSession.js

@@ -0,0 +1,343 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ISOSession = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+/**
+ * ISO Session — the OSI Session layer (ISO 8327 / X.225) that sits above COTP in the MMS stack
+ * (TPKT → COTP → Session → Presentation → MMS). Each SPDU is a 1-byte SI (SPDU Identifier) + 1-byte LI
+ * (Length Indicator) + LI bytes of parameters. The MMS data phase is the fixed pair GIVE-TOKENS +
+ * DATA-TRANSFER (`01 00 01 00`); the connection phase is a CONNECT (SI 13) or ACCEPT (SI 14) SPDU with
+ * variable parameters.
+ *
+ * Session is decoded as a small chain of SPDUs (each SI/LI/params kept verbatim), then the user data —
+ * the Presentation/MMS PDU that follows — is handed to the codec's dispatch (like COTP hands its payload
+ * to Session). The single-frame completeness gate is already enforced upstream by COTP (it only exposes
+ * a child for a DT+EOT PDU fully contained in the packet), so a T2-fragmented MMS body never reaches
+ * here. The SPDU chain round-trips byte-for-byte; the presentation/MMS remainder is a child layer.
+ */
+class ISOSession extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'iso-session';
+        this.name = 'ISO Session';
+        this.nickname = 'ISO-SES';
+        //A content-heuristic child of COTP (unkeyed), selected by a session SI at the start of the COTP payload.
+        this.matchKeys = [];
+        this.heuristicFallback = true;
+        //The Presentation/MMS PDU follows as a child — nothing demuxes off Session by a field value.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    //Session SPDU Identifiers we walk over: DT/GT (1), REFUSE (5), NOT-FINISHED (8), FINISH/DISCONNECT
+    //(9), CONNECT (13), ACCEPT (14), ABORT (25), ABORT-ACCEPT (26). The Presentation PDU that follows
+    //begins with a BER tag (0x61 / 0x31), which is not in this set, so the walk stops at the boundary.
+    static #VALID_SI = new Set([1, 5, 8, 9, 13, 14, 25, 26]);
+    //ACSE (ISO 8650) APDU tags, for naming the connection-phase PDU carried inside a CONNECT/ACCEPT SPDU.
+    static #ACSE_NAMES = {
+        0x60: 'AARQ', 0x61: 'AARE', 0x62: 'RLRQ', 0x63: 'RLRE', 0x64: 'ABRT'
+    };
+    get SCHEMA() {
+        return (ISOSession.#schemaCache ??= ISOSession.#buildSchema());
+    }
+    /** A clamping, never-throwing BER TLV read at `pos`: {tag, contentStart, contentLength} or null past end. */
+    static #readTLV(buf, pos) {
+        if (pos + 2 > buf.length)
+            return null;
+        const tag = buf[pos];
+        const lengthOctet = buf[pos + 1];
+        let contentStart = pos + 2;
+        let contentLength;
+        if (lengthOctet < 0x80) {
+            contentLength = lengthOctet;
+        }
+        else if (lengthOctet === 0x80) {
+            contentLength = buf.length - contentStart; //indefinite: run to end (kept verbatim)
+        }
+        else {
+            const n = lengthOctet & 0x7f;
+            if (contentStart + n > buf.length)
+                return null;
+            contentLength = 0;
+            for (let i = 0; i < n; i++)
+                contentLength = (contentLength << 8) | buf[contentStart + i];
+            contentStart += n;
+        }
+        if (contentStart + contentLength > buf.length)
+            contentLength = buf.length - contentStart;
+        if (contentLength < 0)
+            contentLength = 0;
+        return { tag: tag, contentStart: contentStart, contentLength: contentLength };
+    }
+    /** Find the first direct child TLV with the given tag within [start, end). */
+    static #findChild(buf, start, end, wantTag) {
+        let pos = start;
+        while (pos < end) {
+            const tlv = ISOSession.#readTLV(buf, pos);
+            if (!tlv)
+                break;
+            if (tlv.tag === wantTag)
+                return tlv;
+            const next = tlv.contentStart + tlv.contentLength;
+            if (next <= pos)
+                break;
+            pos = next;
+        }
+        return null;
+    }
+    /** Locate the SS-user-data (PGI 0xc1 / extended 0xc2) inside a CONNECT/ACCEPT SPDU's ISO 8327 params. */
+    static #sessionUserData(params) {
+        let pos = 0;
+        while (pos + 2 <= params.length) {
+            const pi = params[pos];
+            let li = params[pos + 1];
+            let contentStart = pos + 2;
+            if (li === 0xff) {
+                if (contentStart + 2 > params.length)
+                    break;
+                li = (params[contentStart] << 8) | params[contentStart + 1];
+                contentStart += 2;
+            }
+            if (pi === 0xc1 || pi === 0xc2) {
+                const end = Math.min(contentStart + li, params.length);
+                return params.subarray(contentStart, end);
+            }
+            const next = contentStart + li;
+            if (next <= pos)
+                break;
+            pos = next;
+        }
+        return null;
+    }
+    /**
+     * Detect the ACSE APDU inside a CONNECT/ACCEPT SPDU's user data (best-effort, never-throwing):
+     * the ISO 8823 Presentation CP-type/CPA-type (0x31) → normal-mode-parameters [2] (0xa2) →
+     * fully-encoded-data (0x61) → PDV-list (0x30) → presentation-data-values [0] (0xa0) → the ACSE APDU.
+     * Returns the ACSE TLV (tag 0x60 AARQ … 0x64 ABRT) or null.
+     */
+    static #detectAcse(userData) {
+        const cp = ISOSession.#readTLV(userData, 0);
+        if (!cp || cp.tag !== 0x31)
+            return null;
+        const nmp = ISOSession.#findChild(userData, cp.contentStart, cp.contentStart + cp.contentLength, 0xa2);
+        if (!nmp)
+            return null;
+        const fed = ISOSession.#findChild(userData, nmp.contentStart, nmp.contentStart + nmp.contentLength, 0x61);
+        if (!fed)
+            return null;
+        const pdv = ISOSession.#readTLV(userData, fed.contentStart);
+        if (!pdv || pdv.tag !== 0x30)
+            return null;
+        const values = ISOSession.#findChild(userData, pdv.contentStart, pdv.contentStart + pdv.contentLength, 0xa0);
+        if (!values || values.contentStart >= userData.length)
+            return null;
+        //Only report a genuine ACSE APDU (AARQ 0x60 … ABRT 0x64); anything else leaves acseType unset.
+        const tag = userData[values.contentStart];
+        if (!(tag >= 0x60 && tag <= 0x64))
+            return null;
+        return ISOSession.#readTLV(userData, values.contentStart);
+    }
+    /**
+     * The OID inside a context-tagged ACSE field (e.g. application-context-name [1] = 0xa1, called-AP-title
+     * [2] = 0xa2, responding-AP-title [4] = 0xa4, calling-AP-title [6] = 0xa6, each wrapping an OBJECT
+     * IDENTIFIER form) as a dotted string, or ''.
+     */
+    static #acseOid(buf, acse, wantTag) {
+        const field = ISOSession.#findChild(buf, acse.contentStart, acse.contentStart + acse.contentLength, wantTag);
+        if (!field)
+            return '';
+        const oid = ISOSession.#readTLV(buf, field.contentStart);
+        if (!oid || oid.tag !== 0x06)
+            return '';
+        return ISOSession.#decodeOid(buf, oid.contentStart, oid.contentLength);
+    }
+    /** Read a small INTEGER (≤ 6 octets) from the first direct child with `wantTag` within [start, end), or -1. */
+    static #acseInt(buf, start, end, wantTag) {
+        const tlv = ISOSession.#findChild(buf, start, end, wantTag);
+        if (!tlv)
+            return -1;
+        let value = 0;
+        const limit = Math.min(tlv.contentLength, 6);
+        for (let i = 0; i < limit; i++)
+            value = (value * 256) + buf[tlv.contentStart + i];
+        return value;
+    }
+    /**
+     * Extract the MMS initiate parameters carried in the ACSE user-information (best-effort, never-throwing):
+     * ACSE user-information [30] (0xbe) → EXTERNAL (0x28) → encoding [0] (0xa0) → MMS initiate PDU (0xa8
+     * request / 0xa9 response) → proposedMaxServOutstandingCalling [1], -Called [2], nesting-level [3], and
+     * the (proposed/negotiated) version number inside init-detail [4] → [0]. -1 for any absent part.
+     */
+    static #mmsInitiate(buf, acse) {
+        const out = { maxCalling: -1, maxCalled: -1, nesting: -1, version: -1 };
+        const ui = ISOSession.#findChild(buf, acse.contentStart, acse.contentStart + acse.contentLength, 0xbe);
+        if (!ui)
+            return out;
+        const ext = ISOSession.#findChild(buf, ui.contentStart, ui.contentStart + ui.contentLength, 0x28);
+        if (!ext)
+            return out;
+        const enc = ISOSession.#findChild(buf, ext.contentStart, ext.contentStart + ext.contentLength, 0xa0);
+        if (!enc)
+            return out;
+        const init = ISOSession.#readTLV(buf, enc.contentStart);
+        if (!init || (init.tag !== 0xa8 && init.tag !== 0xa9))
+            return out;
+        const end = init.contentStart + init.contentLength;
+        out.maxCalling = ISOSession.#acseInt(buf, init.contentStart, end, 0x81);
+        out.maxCalled = ISOSession.#acseInt(buf, init.contentStart, end, 0x82);
+        out.nesting = ISOSession.#acseInt(buf, init.contentStart, end, 0x83);
+        const detail = ISOSession.#findChild(buf, init.contentStart, end, 0xa4);
+        if (detail)
+            out.version = ISOSession.#acseInt(buf, detail.contentStart, detail.contentStart + detail.contentLength, 0x80);
+        return out;
+    }
+    /** Decode a BER OBJECT IDENTIFIER body to a dotted string (never-throwing, clamped). */
+    static #decodeOid(buf, start, length) {
+        if (length <= 0 || start + length > buf.length)
+            return '';
+        //Accumulate base-128 subidentifiers (high-bit continuation). Multiplication (not <<7) so arcs above
+        //2^28 don't overflow the 32-bit shift.
+        const subs = [];
+        let value = 0;
+        for (let i = start; i < start + length; i++) {
+            value = value * 128 + (buf[i] & 0x7f);
+            if ((buf[i] & 0x80) === 0) {
+                subs.push(value);
+                value = 0;
+            }
+        }
+        if (subs.length === 0)
+            return '';
+        //The first subidentifier encodes the first two arcs: X*40 + Y, X in {0,1,2} (Y unbounded when X=2).
+        const first = subs[0];
+        const x = first < 40 ? 0 : first < 80 ? 1 : 2;
+        const parts = [x, first - x * 40, ...subs.slice(1)];
+        return parts.join('.');
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'ISO-Session ${spdus.length} spdu',
+            properties: {
+                spdus: {
+                    type: 'array',
+                    label: 'SPDUs',
+                    items: {
+                        type: 'object',
+                        properties: {
+                            si: { type: 'integer', label: 'SPDU Identifier', minimum: 0, maximum: 255 },
+                            li: { type: 'integer', label: 'Length Indicator', minimum: 0, maximum: 255 },
+                            params: { type: 'string', label: 'Parameters', contentEncoding: 'hex' }
+                        }
+                    },
+                    decode: function () {
+                        const available = this.packet.length - this.startPos;
+                        const spdus = [];
+                        let offset = 0;
+                        //Walk SPDUs while the SI is a session identifier; stop at the Presentation PDU (a
+                        //BER tag, not a session SI). The SI/LI are peeked dryRun so a malformed length
+                        //leaves the bytes to the child rather than being mis-consumed.
+                        while (offset + 2 <= available) {
+                            const si = this.readBytes(offset, 1, true)[0];
+                            if (!ISOSession.#VALID_SI.has(si))
+                                break;
+                            const li = this.readBytes(offset + 1, 1, true)[0];
+                            if (offset + 2 + li > available)
+                                break;
+                            const params = li > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset + 2, li, true)) : '';
+                            spdus.push({ si: si, li: li, params: params });
+                            offset += 2 + li;
+                        }
+                        //Mark the consumed SPDU region so headerLength stops here and the codec dispatches
+                        //the Presentation/MMS remainder as a child (empty-param SPDUs do no non-dry read).
+                        if (offset > 0)
+                            this.readBytes(0, offset);
+                        this.instance.spdus.setValue(spdus);
+                        //Connection phase: a CONNECT (13) / ACCEPT (14) SPDU embeds the ACSE APDU in its
+                        //user data (the presentation is not a following child here). Surface its type for
+                        //display; the params stay verbatim so the byte round-trip is unaffected.
+                        for (const spdu of spdus) {
+                            if (spdu.si !== 13 && spdu.si !== 14)
+                                continue;
+                            const userData = ISOSession.#sessionUserData((0, HexToBuffer_1.HexToBuffer)(spdu.params));
+                            if (!userData)
+                                continue;
+                            const acse = ISOSession.#detectAcse(userData);
+                            if (acse) {
+                                this.instance.acseType.setValue(ISOSession.#ACSE_NAMES[acse.tag] ?? `0x${acse.tag.toString(16)}`);
+                                const appContext = ISOSession.#acseOid(userData, acse, 0xa1);
+                                if (appContext)
+                                    this.instance.acseAppContext.setValue(appContext);
+                                if (acse.tag === 0x60) {
+                                    //AARQ: called-AP-title [2], calling-AP-title [6].
+                                    const called = ISOSession.#acseOid(userData, acse, 0xa2);
+                                    if (called)
+                                        this.instance.acseCalledApTitle.setValue(called);
+                                    const calling = ISOSession.#acseOid(userData, acse, 0xa6);
+                                    if (calling)
+                                        this.instance.acseCallingApTitle.setValue(calling);
+                                }
+                                else if (acse.tag === 0x61) {
+                                    //AARE: responding-AP-title [4].
+                                    const responding = ISOSession.#acseOid(userData, acse, 0xa4);
+                                    if (responding)
+                                        this.instance.acseRespondingApTitle.setValue(responding);
+                                }
+                                //MMS initiate parameters carried in the ACSE user-information.
+                                const init = ISOSession.#mmsInitiate(userData, acse);
+                                if (init.maxCalling >= 0)
+                                    this.instance.mmsInitMaxServOutstandingCalling.setValue(init.maxCalling);
+                                if (init.maxCalled >= 0)
+                                    this.instance.mmsInitMaxServOutstandingCalled.setValue(init.maxCalled);
+                                if (init.nesting >= 0)
+                                    this.instance.mmsInitNestingLevel.setValue(init.nesting);
+                                if (init.version >= 0)
+                                    this.instance.mmsInitVersion.setValue(init.version);
+                            }
+                            break;
+                        }
+                    },
+                    encode: function () {
+                        const spdus = this.instance.spdus.getValue();
+                        if (!Array.isArray(spdus))
+                            return;
+                        let offset = 0;
+                        for (const spdu of spdus) {
+                            const si = Number(spdu && spdu.si) & 0xff;
+                            const params = (0, HexToBuffer_1.HexToBuffer)(spdu && spdu.params ? String(spdu.params) : '');
+                            //LI honored when supplied (a crafted SPDU may lie), else derived from params.
+                            const provided = Number(spdu && spdu.li);
+                            const li = (spdu && spdu.li !== undefined && spdu.li !== null && Number.isFinite(provided)) ? provided & 0xff : params.length & 0xff;
+                            this.writeBytes(offset, Buffer.from([si, li]));
+                            if (params.length)
+                                this.writeBytes(offset + 2, params);
+                            offset += 2 + params.length;
+                        }
+                    }
+                },
+                //Display-only: the ACSE APDU type (AARQ/AARE/…) and application-context-name OID parsed from
+                //a CONNECT/ACCEPT SPDU's user data on decode. No encode closure — the SPDU params above stay
+                //the encode authority.
+                acseType: { type: 'string', label: 'ACSE APDU' },
+                acseAppContext: { type: 'string', label: 'ACSE Application Context' },
+                acseCalledApTitle: { type: 'string', label: 'ACSE Called AP-Title' },
+                acseCallingApTitle: { type: 'string', label: 'ACSE Calling AP-Title' },
+                acseRespondingApTitle: { type: 'string', label: 'ACSE Responding AP-Title' },
+                mmsInitMaxServOutstandingCalling: { type: 'integer', label: 'MMS Init Max Serv Outstanding Calling' },
+                mmsInitMaxServOutstandingCalled: { type: 'integer', label: 'MMS Init Max Serv Outstanding Called' },
+                mmsInitNestingLevel: { type: 'integer', label: 'MMS Init Data Structure Nesting Level' },
+                mmsInitVersion: { type: 'integer', label: 'MMS Init Version' }
+            }
+        };
+    }
+    match() {
+        const prev = this.prevCodecModule;
+        if (!prev || prev.id !== 'cotp')
+            return false;
+        if (this.packet.length - this.startPos < 2)
+            return false;
+        return ISOSession.#VALID_SI.has(this.readBytes(0, 1, true)[0]);
+    }
+}
+exports.ISOSession = ISOSession;

package/dist/headers/Ident.d.ts

@@ -0,0 +1,42 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * Ident — the Identification Protocol (RFC 1413), carried over TCP well-known port 113. A single
+ * US-ASCII line, terminated by CR LF, is exchanged in each direction:
+ *
+ *   QUERY  (client → server):  "<server-port> , <client-port>{C}"
+ *                              e.g. "6193, 23\r\n" — asks the ident server who owns the connection
+ *                              whose remote/local TCP ports are server-port and client-port.
+ *   REPLY  (server → client):  "<server-port> , <client-port> : USERID : <opsys> : <username>{C}"
+ *                          or  "<server-port> , <client-port> : ERROR  : <error-type>{C}"
+ *                              e.g. "6193, 23 : USERID : UNIX : stjohns\r\n"
+ *                              or   "6193, 23 : ERROR : NO-USER\r\n"
+ *
+ * MINIMAL slice (mirrors the Finger/SIP/HTTP verbatim-message pattern): the line is free-form US-ASCII
+ * with only CR LF for framing and a username field that MAY carry almost any octet, so the exact bytes a
+ * peer sees are richer than a form needs. The ENTIRE payload is therefore the single source of truth —
+ * decoded verbatim to hex in the authoritative `message` field and re-emitted byte-for-byte on encode.
+ * On top of that the first line is parsed into DISPLAY-ONLY metadata: the two port numbers, whether the
+ * line is a query or a reply, the reply type (USERID / ERROR) and its USERID opsys+username or ERROR
+ * error-type. Those carry no codec of their own and never reconstruct the bytes — the message owns them.
+ * So any Ident payload (a query, a USERID reply, an ERROR reply, or a truncated fragment) round-trips
+ * exactly.
+ *
+ * Matching rationale (NO heuristicFallback): Ident is claimed ONLY on the tcp:113 bucket. A query/reply
+ * line is arbitrary US-ASCII text with no distinctive off-port content signature, so recognizing it
+ * relies entirely on the well-known port; joining the global content-heuristic chain would mislabel
+ * arbitrary text TCP payloads on any port. Confining Ident to tcp:113 keeps that impossible; alt-port
+ * Ident is rare and falls losslessly to raw. As the terminal verbatim layer it consumes to the end of the
+ * segment (like Finger/HTTP) so a well-formed frame round-trips byte-for-byte.
+ */
+export declare class Ident extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/Ident.js

@@ -0,0 +1,184 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Ident = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * Ident — the Identification Protocol (RFC 1413), carried over TCP well-known port 113. A single
+ * US-ASCII line, terminated by CR LF, is exchanged in each direction:
+ *
+ *   QUERY  (client → server):  "<server-port> , <client-port>{C}"
+ *                              e.g. "6193, 23\r\n" — asks the ident server who owns the connection
+ *                              whose remote/local TCP ports are server-port and client-port.
+ *   REPLY  (server → client):  "<server-port> , <client-port> : USERID : <opsys> : <username>{C}"
+ *                          or  "<server-port> , <client-port> : ERROR  : <error-type>{C}"
+ *                              e.g. "6193, 23 : USERID : UNIX : stjohns\r\n"
+ *                              or   "6193, 23 : ERROR : NO-USER\r\n"
+ *
+ * MINIMAL slice (mirrors the Finger/SIP/HTTP verbatim-message pattern): the line is free-form US-ASCII
+ * with only CR LF for framing and a username field that MAY carry almost any octet, so the exact bytes a
+ * peer sees are richer than a form needs. The ENTIRE payload is therefore the single source of truth —
+ * decoded verbatim to hex in the authoritative `message` field and re-emitted byte-for-byte on encode.
+ * On top of that the first line is parsed into DISPLAY-ONLY metadata: the two port numbers, whether the
+ * line is a query or a reply, the reply type (USERID / ERROR) and its USERID opsys+username or ERROR
+ * error-type. Those carry no codec of their own and never reconstruct the bytes — the message owns them.
+ * So any Ident payload (a query, a USERID reply, an ERROR reply, or a truncated fragment) round-trips
+ * exactly.
+ *
+ * Matching rationale (NO heuristicFallback): Ident is claimed ONLY on the tcp:113 bucket. A query/reply
+ * line is arbitrary US-ASCII text with no distinctive off-port content signature, so recognizing it
+ * relies entirely on the well-known port; joining the global content-heuristic chain would mislabel
+ * arbitrary text TCP payloads on any port. Confining Ident to tcp:113 keeps that impossible; alt-port
+ * Ident is rare and falls losslessly to raw. As the terminal verbatim layer it consumes to the end of the
+ * segment (like Finger/HTTP) so a well-formed frame round-trips byte-for-byte.
+ */
+class Ident extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'ident';
+        this.name = 'Identification Protocol';
+        this.nickname = 'Ident';
+        //Ident is recognized ONLY on the well-known port 113 — deliberately NOT via heuristicFallback. A
+        //query/reply line is arbitrary US-ASCII text with no distinctive off-port content signature, so its
+        //recognition depends entirely on the port bucket; joining the global heuristic chain would mislabel
+        //arbitrary text TCP payloads on any port. See the class doc for the full rationale.
+        this.matchKeys = ['tcpport:113'];
+        //A leaf header — an Ident query/reply is a single free-form line; nothing demuxes off it.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (_a.#schemaCache ??= _a.#buildSchema());
+    }
+    /** Bytes available to this header: Ident rides on TCP, which has no per-message length. */
+    #payloadLength() {
+        const available = this.packet.length - this.startPos;
+        return available < 0 ? 0 : available;
+    }
+    /** Parse a decimal TCP port for display, clamped to [0, 65535] (never throws; non-numeric → 0). */
+    static #clampPort(text) {
+        const value = parseInt((text ? text : '').trim(), 10);
+        if (!Number.isFinite(value))
+            return 0;
+        return value < 0 ? 0 : value > 65535 ? 65535 : value;
+    }
+    /**
+     * Parse the first line into the display-only metadata fields. The line is
+     * `<server-port> , <client-port>[ : <resp-type> : ...]{C}` where {C} is CR LF (a lone LF is
+     * tolerated). Populated on decode only — these fields have no encode, so they never affect the
+     * re-emitted bytes and never mutate `message`. Never throws: missing tokens yield 0 / empty strings.
+     */
+    #parse(text) {
+        //Keep only up to the first line ending for the display parse; `message` still holds all bytes.
+        let line = text;
+        const lf = line.indexOf('\n');
+        if (lf >= 0)
+            line = line.slice(0, lf);
+        if (line.endsWith('\r'))
+            line = line.slice(0, -1);
+        //Fields are colon-separated; the first field is "<server-port> , <client-port>".
+        const parts = line.split(':');
+        const ports = (parts[0] ? parts[0] : '').split(',');
+        const serverPort = _a.#clampPort(ports[0]);
+        const clientPort = _a.#clampPort(ports[1]);
+        this.instance.serverPort.setValue(serverPort);
+        this.instance.clientPort.setValue(clientPort);
+        if (parts.length <= 1) {
+            //A query carries only the two ports (no ":" reply structure).
+            this.instance.isQuery.setValue(true);
+            this.instance.responseType.setValue('');
+            this.instance.opsys.setValue('');
+            this.instance.userId.setValue('');
+            this.instance.errorType.setValue('');
+            this.instance.summaryInfo.setValue(`query ${serverPort},${clientPort}`);
+            return;
+        }
+        this.instance.isQuery.setValue(false);
+        const responseType = (parts[1] ? parts[1] : '').trim();
+        this.instance.responseType.setValue(responseType);
+        if (responseType === 'USERID') {
+            //USERID : <opsys>[, <charset>] : <username> — the username is the remainder (it MAY itself
+            //contain ':'), so rejoin the trailing fields rather than taking a single token.
+            const opsys = (parts[2] ? parts[2] : '').trim();
+            const userId = parts.length > 3 ? parts.slice(3).join(':').trim() : '';
+            this.instance.opsys.setValue(opsys);
+            this.instance.userId.setValue(userId);
+            this.instance.errorType.setValue('');
+            this.instance.summaryInfo.setValue(`USERID ${userId}`);
+            return;
+        }
+        if (responseType === 'ERROR') {
+            const errorType = parts.length > 2 ? parts.slice(2).join(':').trim() : '';
+            this.instance.opsys.setValue('');
+            this.instance.userId.setValue('');
+            this.instance.errorType.setValue(errorType);
+            this.instance.summaryInfo.setValue(`ERROR ${errorType}`);
+            return;
+        }
+        //An unknown reply type is still a reply — keep its ports and label, drop the type-specific fields.
+        this.instance.opsys.setValue('');
+        this.instance.userId.setValue('');
+        this.instance.errorType.setValue('');
+        this.instance.summaryInfo.setValue(responseType ? responseType : `${serverPort},${clientPort}`);
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'Ident ${summaryInfo}',
+            properties: {
+                //Display-only metadata parsed from the first line on decode (no encode — populated by the
+                //`message` field below, never read back). isQuery distinguishes the client query from the
+                //server reply; responseType/opsys/userId apply to a USERID reply, errorType to an ERROR
+                //reply. The two ports are present in both directions.
+                serverPort: { type: 'integer', label: 'Server Port', minimum: 0, maximum: 65535, default: 0 },
+                clientPort: { type: 'integer', label: 'Client Port', minimum: 0, maximum: 65535, default: 0 },
+                isQuery: { type: 'boolean', label: 'Is Query', default: false },
+                responseType: { type: 'string', label: 'Response Type', default: '' },
+                opsys: { type: 'string', label: 'Operating System', default: '' },
+                userId: { type: 'string', label: 'User ID', default: '' },
+                errorType: { type: 'string', label: 'Error Type', default: '' },
+                //Drives the one-line summary (query ports / USERID username / ERROR error-type).
+                summaryInfo: { type: 'string', label: 'Summary', hidden: true, default: '' },
+                //The whole raw payload is the single source of truth: decoded verbatim to hex and
+                //re-emitted untouched (byte-perfect for any Ident payload). The first line is parsed into
+                //the display-only metadata above, which carry no codec of their own.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    default: '',
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        if (available <= 0) {
+                            this.instance.message.setValue('');
+                            this.#parse('');
+                            return;
+                        }
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parse(raw.toString('latin1'));
+                    },
+                    encode: function () {
+                        //Re-emit the authoritative payload verbatim — never reconstruct from metadata.
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Reached only on the tcp:113 bucket. Port 113 IS Ident's, so any non-empty payload over TCP is
+        //claimed and kept verbatim (byte-perfect) — deliberately without a printable-text gate, so a
+        //server reply body is never wrongly dropped to raw. An empty payload (a bare ACK) is not claimed.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'tcp')
+            return false;
+        return this.#payloadLength() >= 1;
+    }
+}
+exports.Ident = Ident;
+_a = Ident;

package/dist/headers/KNXnetIP.d.ts

@@ -0,0 +1,30 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * KNXnet/IP (KNX over IP, ISO/IEC 14543-3, KNX Association 03/03/02), UDP port 3671 — the IP transport
+ * of the KNX building-automation bus (tunnelling KNX telegrams over IP and routing them between KNXnet/IP
+ * routers). Every KNXnet/IP frame begins with a fixed 6-byte header — Header Length (always 0x06 for the
+ * current spec), Protocol Version (0x10 = 1.0), a 2-byte Service Type Identifier and a 2-byte Total Length
+ * (the whole frame octet count INCLUDING this 6-byte header) — followed by the service-specific body.
+ *
+ * Common Service Type Identifiers: 0x0201 SEARCH_REQUEST, 0x0202 SEARCH_RESPONSE, 0x0205 CONNECT_REQUEST,
+ * 0x0420 TUNNELLING_REQUEST, 0x0530 ROUTING_INDICATION.
+ *
+ * The body layout differs per service type (HPAI discovery endpoints, connection headers, cEMI frames)
+ * and several sub-structures need connection/service context, so this single-frame codec keeps the body
+ * verbatim as `body` hex (byte-perfect) and does not sub-decode it. The Total Length is auto-computed from
+ * the body on encode when not supplied, else honored verbatim (a crafted frame may lie); the frame is
+ * bounded by Total Length (and the enclosing UDP payload) so trailing bytes are left to the codec's
+ * recursion / RawData. A well-formed frame round-trips byte-for-byte.
+ */
+export declare class KNXnetIP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}