@netkitty/codec 1.0.0

package/dist/headers/Memcached.js

@@ -0,0 +1,285 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Memcached = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * Memcached — the cache daemon's wire protocol, carried over TCP well-known port 11211. Memcached speaks
+ * TWO protocols on the same port, and this codec handles BOTH by branching on the first payload byte
+ * (the exact model of the SSH codec, which branches identification-vs-binary on a signature):
+ *
+ *  1. TEXT protocol (the classic, default). Line-based US-ASCII commands and replies terminated by CR LF:
+ *     `get <key>\r\n`, `set <key> <flags> <exptime> <bytes>\r\n<data>\r\n`, and replies such as
+ *     `VALUE <key> <flags> <bytes>\r\n<data>\r\nEND\r\n`, `STORED\r\n`, `END\r\n`, … Like the other
+ *     US-ASCII line protocols in this codec (POP3/FTP/SIP/HTTP), the exact bytes a peer sees are richer
+ *     than any structure a form needs (arbitrary keys, inline data blocks, pipelined commands), so the
+ *     ENTIRE payload is kept verbatim as the authoritative `message` field (hex) and re-emitted untouched;
+ *     only the leading token is parsed on decode into the display-only `command` field (get/set/VALUE/
+ *     STORED/…). Encode never reconstructs the payload from `command` — it writes `message` back
+ *     byte-for-byte, so any conformant (or malformed) text exchange round-trips exactly.
+ *
+ *  2. BINARY protocol (RFC-less, memcached's binary framing). A fixed 24-byte header —
+ *     magic(1: 0x80 request / 0x81 response) · opcode(1) · keyLength(2, BE) · extrasLength(1) ·
+ *     dataType(1) · vbucket-id/status(2, BE) · totalBodyLength(4, BE) · opaque(4) · cas(8) — followed by
+ *     `totalBodyLength` bytes of body (extras + key + value). This codec structures the 24-byte header as
+ *     editable fields and keeps the body verbatim as `body` hex, bounded by totalBodyLength (a trailing /
+ *     pipelined next message is left to the codec's recursion / RawData). The `cas` field is 8 bytes, so
+ *     it is kept as a HEX string (never a JS Number — 8 bytes exceeds 2^53 and would lose precision). A
+ *     well-formed binary message round-trips byte-for-byte.
+ *
+ * Matching rationale (NO heuristicFallback): Memcached is claimed ONLY on the tcp:11211 bucket. The binary
+ * header's magic (0x80/0x81) is a weak one-byte signature and the text protocol shares generic verbs
+ * (get/set/…) with countless other line protocols, so neither shape carries a signature strong enough to
+ * survive the global content-heuristic chain without mislabeling unrelated TCP traffic. Confining
+ * Memcached to its well-known port keeps recognition unambiguous; alt-port memcached is rare and falls
+ * losslessly to raw.
+ */
+class Memcached extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'memcached';
+        this.name = 'Memcached';
+        this.nickname = 'Memcached';
+        //Memcached is recognized ONLY on its well-known port bucket (tcp:11211) — deliberately NOT via
+        //heuristicFallback. The binary magic (0x80/0x81) is a weak one-byte signature and the text verbs are
+        //shared with many US-ASCII line protocols, so neither shape is distinctive enough for the global
+        //content-heuristic chain; the well-known port is the signature. See the class doc for the rationale.
+        this.matchKeys = ['tcpport:11211'];
+        //A leaf header — the memcached session (values, cross-message CAS state) is a higher-layer concern.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (_a.#schemaCache ??= _a.#buildSchema());
+    }
+    /** Known Memcached text tokens (client commands + server replies) — used to recognize a text line. */
+    static #TEXT_TOKENS = [
+        //Client commands (RFC-less protocol.txt): retrieval, storage, arithmetic, admin, meta.
+        'get', 'gets', 'set', 'add', 'replace', 'append', 'prepend', 'cas', 'delete', 'incr', 'decr',
+        'touch', 'gat', 'gats', 'stats', 'flush_all', 'version', 'verbosity', 'quit', 'watch', 'lru',
+        'lru_crawler', 'me', 'mg', 'ms', 'md', 'mn', 'ma', 'me',
+        //Server replies.
+        'VALUE', 'END', 'STORED', 'NOT_STORED', 'EXISTS', 'NOT_FOUND', 'DELETED', 'TOUCHED', 'OK',
+        'STAT', 'VERSION', 'ERROR', 'CLIENT_ERROR', 'SERVER_ERROR', 'RESET', 'BUSY', 'BADCLASS'
+    ];
+    /** Bytes available to this header: Memcached rides on TCP, which has no per-message length. */
+    #payloadLength() {
+        const available = this.packet.length - this.startPos;
+        return available < 0 ? 0 : available;
+    }
+    /** True when the payload begins with the binary magic byte (0x80 request / 0x81 response). */
+    #isBinaryMagic() {
+        if (this.#payloadLength() < 1)
+            return false;
+        const first = this.readBytes(0, 1, true).readUInt8(0);
+        return first === 0x80 || first === 0x81;
+    }
+    /** The leading token of the text payload (up to the first space, CR or LF), or '' if empty. */
+    static #leadingToken(text) {
+        const line = text.split(/[\r\n]/)[0];
+        return line.split(' ')[0] || '';
+    }
+    /**
+     * Parse the text payload's leading token into the display-only `command` field and drive the summary.
+     * Populated on decode only — `command` has no encode, so it never affects the re-emitted bytes and
+     * never mutates `message`. Never throws: an empty payload yields an empty command.
+     */
+    #parseText(text) {
+        const token = _a.#leadingToken(text);
+        this.instance.command.setValue(token);
+        this.instance.summaryInfo.setValue(token);
+    }
+    /**
+     * A guarded big-endian unsigned integer field of the BINARY header. It decodes only when the payload
+     * is binary (else it resets to 0 so the text view is clean) and encodes only for the binary shape
+     * (the text shape's `message` owns those bytes). Wraps BaseHeader.fieldUInt so the offset/width live
+     * in one place.
+     */
+    static #binUInt(name, offset, byteLength, label) {
+        const field = this.fieldUInt(name, offset, byteLength, label);
+        field.default = 0;
+        const rawDecode = field.decode;
+        const rawEncode = field.encode;
+        field.decode = function () {
+            if (!this.instance.isBinary.getValue(false)) {
+                this.instance[name].setValue(0);
+                return;
+            }
+            rawDecode.call(this);
+        };
+        field.encode = function () {
+            if (this.instance.isBinary.getValue(false))
+                rawEncode.call(this);
+        };
+        return field;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'Memcached ${summaryInfo}',
+            properties: {
+                //Discriminator between the two on-wire shapes (see class doc). Decoded from the payload's
+                //first byte; on encode it is supplied by the input (default false = the TEXT protocol) and
+                //read by every field below to decide which bytes it owns. Mirrors SSH.isIdentification.
+                isBinary: {
+                    type: 'boolean',
+                    label: 'Is Binary',
+                    default: false,
+                    decode: function () {
+                        this.instance.isBinary.setValue(this.#isBinaryMagic());
+                    }
+                },
+                //BINARY 24-byte header. magic(0x80 req / 0x81 resp), opcode, keyLength(BE), extrasLength,
+                //dataType, vbucket-id/status(BE), totalBodyLength(BE), opaque, cas(8 bytes → HEX).
+                magic: _a.#binUInt('magic', 0, 1, 'Magic'),
+                opcode: _a.#binUInt('opcode', 1, 1, 'Opcode'),
+                keyLength: _a.#binUInt('keyLength', 2, 2, 'Key Length'),
+                extrasLength: _a.#binUInt('extrasLength', 4, 1, 'Extras Length'),
+                dataType: _a.#binUInt('dataType', 5, 1, 'Data Type'),
+                status: _a.#binUInt('status', 6, 2, 'VBucket/Status'),
+                //totalBodyLength counts the whole body (extras + key + value). Honored on encode when
+                //supplied (a crafted message may lie); else derived from the body bytes. No `default` so
+                //Ajv leaves it undefined and the derive path can trigger (mirrors ENIP.length).
+                totalBodyLength: {
+                    type: 'integer',
+                    label: 'Total Body Length',
+                    minimum: 0,
+                    maximum: 4294967295,
+                    decode: function () {
+                        if (!this.instance.isBinary.getValue(false)) {
+                            this.instance.totalBodyLength.setValue(0);
+                            return;
+                        }
+                        this.instance.totalBodyLength.setValue(this.readBytes(8, 4).readUInt32BE(0));
+                    },
+                    encode: function () {
+                        if (!this.instance.isBinary.getValue(false))
+                            return;
+                        const provided = this.instance.totalBodyLength.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : (0, HexToBuffer_1.HexToBuffer)(this.instance.body.getValue('')).length;
+                        if (value > 4294967295) {
+                            this.recordError(this.instance.totalBodyLength.getPath(), 'Maximum value is 4294967295');
+                            value = 4294967295;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.totalBodyLength.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.totalBodyLength.setValue(value);
+                        const buffer = Buffer.alloc(4);
+                        buffer.writeUInt32BE(value, 0);
+                        this.writeBytes(8, buffer);
+                    }
+                },
+                opaque: _a.#binUInt('opaque', 12, 4, 'Opaque'),
+                //cas is 8 bytes — an opaque compare-and-swap token. Kept as HEX (never a JS Number: 8
+                //bytes exceeds 2^53 and would lose precision). Guarded like the numeric header fields.
+                cas: {
+                    type: 'string',
+                    label: 'CAS',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    default: '0000000000000000',
+                    decode: function () {
+                        if (!this.instance.isBinary.getValue(false)) {
+                            this.instance.cas.setValue('0000000000000000');
+                            return;
+                        }
+                        this.instance.cas.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(16, 8)));
+                    },
+                    encode: function () {
+                        if (!this.instance.isBinary.getValue(false))
+                            return;
+                        this.writeBytes(16, (0, HexToBuffer_1.HexToBuffer)(this.instance.cas.getValue('0000000000000000')));
+                    }
+                },
+                //BINARY body (extras + key + value), kept verbatim. Bounded by totalBodyLength (the body
+                //ends at offset 24 + totalBodyLength) and the captured bytes, so a trailing / pipelined
+                //next message is left to the codec's recursion / RawData. Also sets the binary summary.
+                body: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    default: '',
+                    decode: function () {
+                        if (!this.instance.isBinary.getValue(false)) {
+                            this.instance.body.setValue('');
+                            return;
+                        }
+                        const remaining = this.#payloadLength();
+                        const totalBodyLength = this.instance.totalBodyLength.getValue(0);
+                        let end = 24 + totalBodyLength;
+                        if (end > remaining)
+                            end = remaining;
+                        this.instance.body.setValue(end > 24 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(24, end - 24)) : '');
+                        this.instance.summaryInfo.setValue(`binary op=${this.instance.opcode.getValue(0)}`);
+                    },
+                    encode: function () {
+                        if (!this.instance.isBinary.getValue(false))
+                            return;
+                        const body = this.instance.body.getValue('');
+                        if (body)
+                            this.writeBytes(24, (0, HexToBuffer_1.HexToBuffer)(body));
+                    }
+                },
+                //Display-only text metadata: the leading token of the text payload (populated by the
+                //`message` decode below; no encode of its own). Empty for a binary message.
+                command: { type: 'string', label: 'Command', default: '' },
+                //Drives the one-line summary: the text command, or `binary op=<opcode>` for a binary msg.
+                summaryInfo: { type: 'string', label: 'Summary', hidden: true, default: '' },
+                //TEXT payload: the whole message kept verbatim (byte-perfect) and re-emitted untouched. The
+                //leading token is parsed into `command` on decode; encode never reconstructs from it.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    default: '',
+                    decode: function () {
+                        if (this.instance.isBinary.getValue(false)) {
+                            //Binary shape: no verbatim text; clear the text metadata (summary set by body).
+                            this.instance.message.setValue('');
+                            this.instance.command.setValue('');
+                            return;
+                        }
+                        const available = this.#payloadLength();
+                        if (available <= 0) {
+                            this.instance.message.setValue('');
+                            this.#parseText('');
+                            return;
+                        }
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parseText(raw.toString('latin1'));
+                    },
+                    encode: function () {
+                        //Re-emit the authoritative text payload verbatim — never reconstruct from metadata.
+                        if (this.instance.isBinary.getValue(false))
+                            return;
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Reached only on the tcp:11211 bucket. Confirm the parent is TCP and the payload is either a
+        //binary message (magic 0x80/0x81) or a text line whose leading token is a known Memcached verb —
+        //so unrelated binary traffic on 11211 still falls through to raw rather than a bogus layer.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.#payloadLength() < 1)
+            return false;
+        if (this.#isBinaryMagic())
+            return true;
+        const lead = this.readBytes(0, 24, true).toString('latin1');
+        return _a.#TEXT_TOKENS.includes(_a.#leadingToken(lead));
+    }
+}
+exports.Memcached = Memcached;
+_a = Memcached;

package/dist/headers/ModbusTCP.d.ts

@@ -0,0 +1,25 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * Modbus/TCP (MODBUS Application Protocol V1.1b3 + Modbus Messaging on TCP/IP V1.0b), TCP port 502. Each
+ * message is a 7-byte MBAP header — Transaction Identifier, Protocol Identifier (0 for Modbus), Length,
+ * and Unit Identifier — followed by the PDU: a Function Code and its data. The Length field counts the
+ * Unit Identifier plus the PDU, so it bounds the message (a second pipelined PDU or trailing bytes are
+ * left to the codec's recursion / RawData).
+ *
+ * Whether the PDU data is a request or a response is only knowable from the paired transaction, which is
+ * cross-packet state — so this single-packet codec keeps the PDU data as raw hex (byte-perfect) and does
+ * not sub-decode it. The Length is auto-computed from the data on encode when not supplied, else honored
+ * verbatim (a crafted message may carry any Length). A well-formed message round-trips byte-for-byte.
+ */
+export declare class ModbusTCP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/ModbusTCP.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ModbusTCP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * Modbus/TCP (MODBUS Application Protocol V1.1b3 + Modbus Messaging on TCP/IP V1.0b), TCP port 502. Each
+ * message is a 7-byte MBAP header — Transaction Identifier, Protocol Identifier (0 for Modbus), Length,
+ * and Unit Identifier — followed by the PDU: a Function Code and its data. The Length field counts the
+ * Unit Identifier plus the PDU, so it bounds the message (a second pipelined PDU or trailing bytes are
+ * left to the codec's recursion / RawData).
+ *
+ * Whether the PDU data is a request or a response is only knowable from the paired transaction, which is
+ * cross-packet state — so this single-packet codec keeps the PDU data as raw hex (byte-perfect) and does
+ * not sub-decode it. The Length is auto-computed from the data on encode when not supplied, else honored
+ * verbatim (a crafted message may carry any Length). A well-formed message round-trips byte-for-byte.
+ */
+class ModbusTCP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'modbus';
+        this.name = 'Modbus/TCP';
+        this.nickname = 'Modbus';
+        this.matchKeys = ['tcpport:502'];
+        //A leaf header — the PDU data is kept as hex, not demuxed further.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (ModbusTCP.#schemaCache ??= ModbusTCP.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'Modbus func=${functionCode} unit=${unitId}',
+            properties: {
+                transactionId: this.fieldUInt('transactionId', 0, 2, 'Transaction Identifier'),
+                protocolId: this.fieldUInt('protocolId', 2, 2, 'Protocol Identifier'),
+                length: {
+                    type: 'integer',
+                    label: 'Length',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        this.instance.length.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(4, 2)));
+                    },
+                    encode: function () {
+                        //Length counts the Unit Identifier + PDU = 1 (unit) + 1 (function code) + data.
+                        //Honored when supplied (a crafted message may lie); else derived from the data.
+                        const provided = this.instance.length.getValue();
+                        const value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : 2 + (0, HexToBuffer_1.HexToBuffer)(this.instance.data.getValue('')).length;
+                        this.instance.length.setValue(value);
+                        this.writeBytes(4, (0, NumberToBuffer_1.UInt16ToBuffer)(value));
+                    }
+                },
+                unitId: this.fieldUInt('unitId', 6, 1, 'Unit Identifier'),
+                functionCode: this.fieldUInt('functionCode', 7, 1, 'Function Code'),
+                //The PDU data after the function code, kept verbatim. Bounded by the MBAP Length (the
+                //message ends at offset 6 + Length) and the captured bytes, so trailing/pipelined data
+                //is not absorbed.
+                data: {
+                    type: 'string',
+                    label: 'Data',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        const length = this.instance.length.getValue(0);
+                        let end = 6 + length;
+                        if (end > remaining)
+                            end = remaining;
+                        this.instance.data.setValue(end > 8 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(8, end - 8)) : '');
+                    },
+                    encode: function () {
+                        const data = this.instance.data.getValue('');
+                        if (data)
+                            this.writeBytes(8, (0, HexToBuffer_1.HexToBuffer)(data));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Modbus/TCP rides on TCP port 502. Require the 7-byte MBAP header + a function code (8 bytes),
+        //and a zero Protocol Identifier (the Modbus content signature) so non-Modbus 502 traffic falls
+        //through to raw.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.packet.length - this.startPos < 8)
+            return false;
+        return (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(2, 2, true)) === 0;
+    }
+}
+exports.ModbusTCP = ModbusTCP;

package/dist/headers/ModbusUDP.d.ts

@@ -0,0 +1,26 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * Modbus/UDP (MODBUS Application Protocol V1.1b3 + Modbus Messaging on TCP/IP V1.0b), UDP port 502. The
+ * frame carries the same MBAP + PDU layout as Modbus/TCP but over UDP instead of a TCP stream: a 7-byte
+ * MBAP header — Transaction Identifier, Protocol Identifier (0 for Modbus), Length, and Unit Identifier —
+ * followed by the PDU (a Function Code and its data). The Length field counts the Unit Identifier plus the
+ * PDU, so it bounds the message; a second pipelined PDU or trailing bytes are left to the codec's
+ * recursion / RawData.
+ *
+ * Whether the PDU data is a request or a response is only knowable from the paired transaction, which is
+ * cross-packet state — so this single-packet codec keeps the PDU data as raw hex (byte-perfect) and does
+ * not sub-decode it. The Length is auto-computed from the data on encode when not supplied, else honored
+ * verbatim (a crafted message may carry any Length). A well-formed message round-trips byte-for-byte.
+ */
+export declare class ModbusUDP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/ModbusUDP.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ModbusUDP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * Modbus/UDP (MODBUS Application Protocol V1.1b3 + Modbus Messaging on TCP/IP V1.0b), UDP port 502. The
+ * frame carries the same MBAP + PDU layout as Modbus/TCP but over UDP instead of a TCP stream: a 7-byte
+ * MBAP header — Transaction Identifier, Protocol Identifier (0 for Modbus), Length, and Unit Identifier —
+ * followed by the PDU (a Function Code and its data). The Length field counts the Unit Identifier plus the
+ * PDU, so it bounds the message; a second pipelined PDU or trailing bytes are left to the codec's
+ * recursion / RawData.
+ *
+ * Whether the PDU data is a request or a response is only knowable from the paired transaction, which is
+ * cross-packet state — so this single-packet codec keeps the PDU data as raw hex (byte-perfect) and does
+ * not sub-decode it. The Length is auto-computed from the data on encode when not supplied, else honored
+ * verbatim (a crafted message may carry any Length). A well-formed message round-trips byte-for-byte.
+ */
+class ModbusUDP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'modbusudp';
+        this.name = 'Modbus/UDP';
+        this.nickname = 'Modbus';
+        this.matchKeys = ['udpport:502'];
+        //A leaf header — the PDU data is kept as hex, not demuxed further.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (ModbusUDP.#schemaCache ??= ModbusUDP.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'Modbus/UDP func=${functionCode} unit=${unitId}',
+            properties: {
+                transactionId: this.fieldUInt('transactionId', 0, 2, 'Transaction Identifier'),
+                protocolId: this.fieldUInt('protocolId', 2, 2, 'Protocol Identifier'),
+                length: {
+                    type: 'integer',
+                    label: 'Length',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        this.instance.length.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(4, 2)));
+                    },
+                    encode: function () {
+                        //Length counts the Unit Identifier + PDU = 1 (unit) + 1 (function code) + data.
+                        //Honored when supplied (a crafted message may lie); else derived from the data.
+                        const provided = this.instance.length.getValue();
+                        const value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : 2 + (0, HexToBuffer_1.HexToBuffer)(this.instance.data.getValue('')).length;
+                        this.instance.length.setValue(value);
+                        this.writeBytes(4, (0, NumberToBuffer_1.UInt16ToBuffer)(value));
+                    }
+                },
+                unitId: this.fieldUInt('unitId', 6, 1, 'Unit Identifier'),
+                functionCode: this.fieldUInt('functionCode', 7, 1, 'Function Code'),
+                //The PDU data after the function code, kept verbatim. Bounded by the MBAP Length (the
+                //message ends at offset 6 + Length) and the captured bytes, so trailing/pipelined data
+                //is not absorbed.
+                data: {
+                    type: 'string',
+                    label: 'Data',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        const length = this.instance.length.getValue(0);
+                        let end = 6 + length;
+                        if (end > remaining)
+                            end = remaining;
+                        this.instance.data.setValue(end > 8 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(8, end - 8)) : '');
+                    },
+                    encode: function () {
+                        const data = this.instance.data.getValue('');
+                        if (data)
+                            this.writeBytes(8, (0, HexToBuffer_1.HexToBuffer)(data));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Modbus/UDP rides on UDP port 502. Require the 7-byte MBAP header + a function code (8 bytes),
+        //and a zero Protocol Identifier (the Modbus content signature) so non-Modbus 502 traffic falls
+        //through to raw.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        if (this.packet.length - this.startPos < 8)
+            return false;
+        return (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(2, 2, true)) === 0;
+    }
+}
+exports.ModbusUDP = ModbusUDP;

package/dist/headers/MongoDB.d.ts

@@ -0,0 +1,33 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * MongoDB Wire Protocol (TCP port 27017). Every message begins with a fixed 16-byte standard message
+ * header — messageLength, requestID, responseTo, opCode — followed by an opCode-specific body. The
+ * messageLength counts the WHOLE message including the 16-byte header; requestID / responseTo tie a
+ * request to its reply; opCode selects the body layout (2013 OP_MSG — the modern, general-purpose
+ * message; 2004 OP_QUERY and 1 OP_REPLY — the legacy request/reply pair; plus OP_UPDATE/INSERT/… ).
+ *
+ * ⚠️ Every multi-byte field in the MongoDB wire protocol is LITTLE-ENDIAN. There is no little-endian
+ * helper in this codebase, so the four uint32 header fields are read and written byte-by-byte in their
+ * closures (`|` yields a signed int32, so the read applies `>>> 0` to the whole expression to keep a
+ * high-bit-set value unsigned).
+ *
+ * The body layout differs per opCode (OP_MSG's flagBits + sections of BSON, OP_QUERY's collection name /
+ * query document, OP_REPLY's cursor + returned documents) and BSON sub-parsing is cross-message,
+ * opCode-dependent state, so this single-message codec keeps the body verbatim as `body` hex
+ * (byte-perfect) and does not sub-decode it. The messageLength is auto-computed from the body on encode
+ * when not supplied, else honored verbatim (a crafted message may lie); the message is bounded by
+ * messageLength so a second pipelined message or trailing bytes are left to the codec's recursion /
+ * RawData. A well-formed message round-trips byte-for-byte.
+ */
+export declare class MongoDB extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}