@netkitty/codec 1.0.0

package/dist/headers/Redis.js

@@ -0,0 +1,202 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Redis = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * RESP type bytes → human names. The leading byte of every RESP message names its type: the RESP2 set
+ * `+ - : $ *` (simple-string / error / integer / bulk-string / array) plus the RESP3 additions
+ * `_ # , ( ! = % ~ >` (null / boolean / double / big-number / blob-error / verbatim-string / map / set /
+ * push). Used only to label the message for display — it never affects the re-emitted bytes.
+ */
+const RESP_TYPES = {
+    '*': 'array',
+    '$': 'bulk-string',
+    '+': 'simple-string',
+    '-': 'error',
+    ':': 'integer',
+    '_': 'null',
+    '#': 'boolean',
+    ',': 'double',
+    '(': 'big-number',
+    '%': 'map',
+    '~': 'set',
+    '>': 'push',
+    '!': 'blob-error',
+    '=': 'verbatim-string'
+};
+/** The RESP type bytes, as a lookup set for match(). A single leading byte is a WEAK signature — see matchKeys. */
+const RESP_TYPE_BYTES = '*$+-:_#,(%~>!=';
+/**
+ * Redis RESP — the REdis Serialization Protocol (RESP2/RESP3), carried over TCP well-known port 6379. RESP
+ * is a text-ish line protocol whose FIRST byte names the message type: `+` simple string (`+OK\r\n`), `-`
+ * error (`-ERR msg\r\n`), `:` integer (`:1000\r\n`), `$` bulk string (`$6\r\nfoobar\r\n`, or `$-1\r\n` null),
+ * `*` array (`*3\r\n$3\r\nSET\r\n$3\r\nfoo\r\n$3\r\nbar\r\n`). RESP3 adds `_` null, `#` boolean, `,` double,
+ * `(` big number, `!` blob error, `=` verbatim string, `%` map, `~` set, `>` push. Client commands are
+ * almost always arrays of bulk strings (`*` framing), so the first bulk-string element is the command verb.
+ *
+ * Like FTP, SMTP, POP3, IMAP, Syslog, SIP and HTTP, the message is text whose full internal structure
+ * (nested aggregates, binary-safe bulk strings, inline commands) is richer than a form needs. So the ENTIRE
+ * raw segment is kept verbatim as the authoritative `message` field (hex) and re-emitted untouched; only a
+ * little first-byte/first-line metadata is parsed on decode for display (respType/isRequest/command/preview).
+ * Encode never reconstructs the message from the parsed fields — it writes `message` back byte-for-byte — so
+ * any conformant (or even malformed) RESP frame round-trips exactly.
+ *
+ * Note: a single TCP segment may carry more than one RESP message (pipelined commands) or only part of a
+ * large bulk string; reassembly across segments is out of scope. This single-segment codec keeps whatever
+ * bytes are present verbatim, which is byte-perfect for the single-packet case.
+ */
+class Redis extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'redis';
+        this.name = 'Redis Serialization Protocol';
+        this.nickname = 'Redis';
+        //Redis is recognized ONLY on its well-known port bucket 6379 — deliberately NOT via heuristicFallback.
+        //A RESP message is identified by a SINGLE leading type byte (`* $ + - : _ # , ( % ~ > ! =`), which is an
+        //extremely WEAK signature: countless non-RESP byte streams begin with one of these bytes (`*` 0x2a, `+`
+        //0x2b, `-` 0x2d, `:` 0x3a, `#` 0x23, `=` 0x3d, `,` 0x2c all appear in ordinary ASCII text and binary
+        //data). Unlike HTTP/RTSP (multi-byte distinctive method sets), a 1-byte signature carries almost no
+        //discriminating power. Joining the global heuristic chain would let Redis mis-claim essentially every
+        //layer whose first byte happens to fall in that set, on ANY port — an unacceptable outcome. Confining
+        //Redis to its tcp:6379 bucket makes that impossible off-port; alt-port Redis is rare and falls losslessly
+        //to raw. (Even in-bucket, match() additionally sanity-checks the byte after `*`/`$`/`:` to further reduce
+        //false claims — see match().)
+        this.matchKeys = ['tcpport:6379'];
+        //A leaf header — the Redis session / pipelined command stream it belongs to is a higher-layer concern.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (_a.#schemaCache ??= _a.#buildSchema());
+    }
+    /**
+     * Bytes of this header: RESP rides on TCP, which has no per-message length, so take the rest of the
+     * segment. Reassembly across segments is out of scope (see class doc).
+     */
+    #payloadLength() {
+        const available = this.packet.length - this.startPos;
+        return available < 0 ? 0 : available;
+    }
+    /** The first line of the message (up to the first CRLF, or the whole payload if none). */
+    static #firstLine(text) {
+        const idx = text.indexOf('\r\n');
+        return idx >= 0 ? text.slice(0, idx) : text;
+    }
+    /**
+     * If the message is an array of bulk strings (RESP `*` framing, the usual client-command shape), parse
+     * the FIRST bulk-string element and uppercase it — that is the Redis command verb (SET/GET/PING/AUTH/…).
+     * Layout: `*<count>\r\n` then the first element `$<len>\r\n<bytes>\r\n`. Never throws: any malformed or
+     * non-array/non-bulk shape yields ''. Purely display-only — it never affects the re-emitted bytes.
+     */
+    static #parseCommand(text) {
+        if (text[0] !== '*')
+            return '';
+        //Step past the `*<count>\r\n` array header.
+        const arrEol = text.indexOf('\r\n');
+        if (arrEol < 0)
+            return '';
+        //The first element must be a bulk string: `$<len>\r\n<bytes>\r\n`.
+        const pos = arrEol + 2;
+        if (text[pos] !== '$')
+            return '';
+        const lenEol = text.indexOf('\r\n', pos);
+        if (lenEol < 0)
+            return '';
+        const len = Number(text.slice(pos + 1, lenEol));
+        if (!Number.isInteger(len) || len < 0)
+            return '';
+        const start = lenEol + 2;
+        const end = start + len;
+        if (end > text.length)
+            return '';
+        return text.slice(start, end).toUpperCase();
+    }
+    /**
+     * Parse the leading byte / first line into the display-only metadata fields. respType names the leading
+     * type byte; isRequest is the pragmatic `*`-means-client-command heuristic; command is the array's first
+     * bulk string (verb); preview is the first line for display. Populated on decode only — these fields have
+     * no encode, so they never affect the re-emitted bytes and never mutate `message`. Never throws:
+     * empty/garbage input yields sensible defaults.
+     */
+    #parseMetadata(text) {
+        const lead = text.length > 0 ? text[0] : '';
+        const respType = lead in RESP_TYPES ? RESP_TYPES[lead] : 'unknown';
+        this.instance.respType.setValue(respType);
+        this.instance.isRequest.setValue(lead === '*');
+        this.instance.command.setValue(_a.#parseCommand(text));
+        this.instance.preview.setValue(_a.#firstLine(text));
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'Redis ${respType} ${command}',
+            properties: {
+                //The whole raw segment is the single source of truth: decoded verbatim to hex and re-emitted
+                //untouched (byte-perfect for any RESP frame). The leading byte / first line is parsed into the
+                //display-only metadata below, which carry no codec of their own.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        if (available <= 0) {
+                            this.instance.message.setValue('');
+                            this.#parseMetadata('');
+                            return;
+                        }
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parseMetadata(raw.toString('latin1'));
+                    },
+                    encode: function () {
+                        //Re-emit the authoritative message verbatim — never reconstruct from metadata.
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                },
+                //Display-only metadata parsed on decode (no encode — populated by the message field above,
+                //never read back). respType names the leading type byte; isRequest flags the `*` array shape
+                //that client commands use; command is the array's first bulk string (the verb); preview is the
+                //first line as latin1 text.
+                respType: { type: 'string', label: 'RESP Type' },
+                isRequest: { type: 'boolean', label: 'Is Request' },
+                command: { type: 'string', label: 'Command' },
+                preview: { type: 'string', label: 'Preview' }
+            }
+        };
+    }
+    match() {
+        //RESP rides on TCP. Recognize it by the leading type byte only within the tcp:6379 bucket. To reduce
+        //even in-bucket false claims from binary traffic that happens to start with a type byte, the numeric
+        //framings `*` (array), `$` (bulk string) and `:` (integer) additionally require the next byte to be a
+        //plausible count/length — a digit or `-` (RESP encodes null/negative counts as `$-1`, `*-1`). The
+        //text framings (`+ - _ # , ( % ~ > ! =`) carry free-form content, so only the type byte is checked.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.#payloadLength() < 1)
+            return false;
+        const lead = this.readBytes(0, 2, true);
+        const type = String.fromCharCode(lead[0]);
+        if (!RESP_TYPE_BYTES.includes(type))
+            return false;
+        if (type === '*' || type === '$' || type === ':') {
+            //Need the following byte to decide plausibility; a 1-byte segment is too short to trust.
+            if (lead.length < 2)
+                return false;
+            const next = lead[1];
+            const isDigit = next >= 0x30 && next <= 0x39;
+            const isMinus = next === 0x2d;
+            if (!isDigit && !isMinus)
+                return false;
+        }
+        return true;
+    }
+}
+exports.Redis = Redis;
+_a = Redis;

package/dist/headers/Rlogin.d.ts

@@ -0,0 +1,42 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * Rlogin — the Remote Login protocol (RFC 1282), carried over TCP well-known port 513. After the TCP
+ * connection opens, the client sends a single startup message: four null-separated strings
+ *
+ *   \0 {client-user-name} \0 {server-user-name} \0 {terminal-type}/{terminal-speed} \0
+ *
+ * e.g. `00 6a 64 6f 65 00 72 6f 6f 74 00 78 74 65 72 6d 2f 33 38 34 30 30 00`
+ * ("\0jdoe\0root\0xterm/38400\0"). The leading null makes the first split field empty. After that startup
+ * exchange the connection is an unframed byte stream (the server replies with a single 0x00 to accept,
+ * then terminal data flows; interrupts and window-size changes ride in-band as URG/control bytes).
+ *
+ * MINIMAL slice (mirrors the SSH/Telnet/Finger verbatim-message pattern): the connection has no
+ * per-message framing, so the ENTIRE payload is the single source of truth — decoded verbatim to hex in
+ * the authoritative `message` field and re-emitted byte-for-byte on encode. On top of that, when the
+ * payload opens with a 0x00 byte (the startup shape) the leading null-separated fields are parsed into
+ * DISPLAY-ONLY metadata: `isStartup`, `clientUser`, `serverUser`, `terminalType` (the raw
+ * "terminal/speed" field). Those carry no codec of their own and never reconstruct the bytes — the
+ * message owns them. So any Rlogin payload (a startup message, the server's 0x00 ack, terminal data, or
+ * a truncated fragment) round-trips exactly.
+ *
+ * Matching rationale (NO heuristicFallback): Rlogin is claimed ONLY on the tcp:513 bucket. The startup
+ * message opens with a 0x00 byte, but that is a weak, generic signature (a leading null byte matches
+ * countless binary payloads) and the ensuing byte stream has no content magic at all, so recognizing
+ * Rlogin relies entirely on the well-known port. Joining the global content-heuristic chain would let
+ * Rlogin mislabel arbitrary TCP payloads on any port. Confining Rlogin to tcp:513 keeps that impossible;
+ * alt-port Rlogin is rare and falls losslessly to raw. For the same reason match() does NOT gate on a
+ * leading null: on the port-513 bucket every payload IS Rlogin (including the byte-stream phase), so any
+ * non-empty payload is kept verbatim rather than dropped to raw.
+ */
+export declare class Rlogin extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/Rlogin.js

@@ -0,0 +1,139 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Rlogin = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * Rlogin — the Remote Login protocol (RFC 1282), carried over TCP well-known port 513. After the TCP
+ * connection opens, the client sends a single startup message: four null-separated strings
+ *
+ *   \0 {client-user-name} \0 {server-user-name} \0 {terminal-type}/{terminal-speed} \0
+ *
+ * e.g. `00 6a 64 6f 65 00 72 6f 6f 74 00 78 74 65 72 6d 2f 33 38 34 30 30 00`
+ * ("\0jdoe\0root\0xterm/38400\0"). The leading null makes the first split field empty. After that startup
+ * exchange the connection is an unframed byte stream (the server replies with a single 0x00 to accept,
+ * then terminal data flows; interrupts and window-size changes ride in-band as URG/control bytes).
+ *
+ * MINIMAL slice (mirrors the SSH/Telnet/Finger verbatim-message pattern): the connection has no
+ * per-message framing, so the ENTIRE payload is the single source of truth — decoded verbatim to hex in
+ * the authoritative `message` field and re-emitted byte-for-byte on encode. On top of that, when the
+ * payload opens with a 0x00 byte (the startup shape) the leading null-separated fields are parsed into
+ * DISPLAY-ONLY metadata: `isStartup`, `clientUser`, `serverUser`, `terminalType` (the raw
+ * "terminal/speed" field). Those carry no codec of their own and never reconstruct the bytes — the
+ * message owns them. So any Rlogin payload (a startup message, the server's 0x00 ack, terminal data, or
+ * a truncated fragment) round-trips exactly.
+ *
+ * Matching rationale (NO heuristicFallback): Rlogin is claimed ONLY on the tcp:513 bucket. The startup
+ * message opens with a 0x00 byte, but that is a weak, generic signature (a leading null byte matches
+ * countless binary payloads) and the ensuing byte stream has no content magic at all, so recognizing
+ * Rlogin relies entirely on the well-known port. Joining the global content-heuristic chain would let
+ * Rlogin mislabel arbitrary TCP payloads on any port. Confining Rlogin to tcp:513 keeps that impossible;
+ * alt-port Rlogin is rare and falls losslessly to raw. For the same reason match() does NOT gate on a
+ * leading null: on the port-513 bucket every payload IS Rlogin (including the byte-stream phase), so any
+ * non-empty payload is kept verbatim rather than dropped to raw.
+ */
+class Rlogin extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'rlogin';
+        this.name = 'Rlogin';
+        this.nickname = 'Rlogin';
+        //Rlogin is recognized ONLY on the well-known port 513 — deliberately NOT via heuristicFallback. The
+        //startup message opens with a weak, generic 0x00 byte and the ensuing byte stream has no content magic,
+        //so its recognition depends entirely on the port bucket; joining the global heuristic chain would
+        //mislabel arbitrary TCP traffic. See the class doc for the full rationale.
+        this.matchKeys = ['tcpport:513'];
+        //A leaf header — the Rlogin byte stream is the terminal session itself; nothing demuxes off it.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (Rlogin.#schemaCache ??= Rlogin.#buildSchema());
+    }
+    /** Bytes available to this header: Rlogin rides on TCP, which has no per-message length. */
+    #payloadLength() {
+        const available = this.packet.length - this.startPos;
+        return available < 0 ? 0 : available;
+    }
+    /**
+     * Parse the startup message into the display-only metadata fields. The startup message is
+     * `\0 client-user \0 server-user \0 terminal-type/speed \0`, so splitting the payload on the null byte
+     * yields ['', clientUser, serverUser, terminalType, …]. Populated on decode only — these fields have no
+     * encode, so they never affect the re-emitted bytes and never mutate `message`. Never throws: a payload
+     * that does not open with 0x00 (the byte-stream phase) yields isStartup false and empty fields.
+     */
+    #parseStartup(raw) {
+        const isStartup = raw.length >= 1 && raw[0] === 0x00;
+        this.instance.isStartup.setValue(isStartup);
+        if (!isStartup) {
+            this.instance.clientUser.setValue('');
+            this.instance.serverUser.setValue('');
+            this.instance.terminalType.setValue('');
+            this.instance.summaryInfo.setValue('data');
+            return;
+        }
+        //The leading null makes segments[0] the empty first field; the three named fields follow.
+        const segments = raw.toString('latin1').split('\0');
+        const clientUser = segments[1] !== undefined ? segments[1] : '';
+        const serverUser = segments[2] !== undefined ? segments[2] : '';
+        const terminalType = segments[3] !== undefined ? segments[3] : '';
+        this.instance.clientUser.setValue(clientUser);
+        this.instance.serverUser.setValue(serverUser);
+        this.instance.terminalType.setValue(terminalType);
+        this.instance.summaryInfo.setValue(clientUser || serverUser ? `${clientUser}/${serverUser}` : 'startup');
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'Rlogin ${summaryInfo}',
+            properties: {
+                //Display-only metadata parsed from the startup message on decode (no encode — populated by
+                //the `message` field below, never read back). isStartup flags a payload that opens with a
+                //0x00 byte; clientUser/serverUser/terminalType are the leading null-separated fields.
+                isStartup: { type: 'boolean', label: 'Is Startup', default: false },
+                clientUser: { type: 'string', label: 'Client User', default: '' },
+                serverUser: { type: 'string', label: 'Server User', default: '' },
+                terminalType: { type: 'string', label: 'Terminal Type', default: '' },
+                //Drives the one-line summary: "clientUser/serverUser" for a startup, else 'data'.
+                summaryInfo: { type: 'string', label: 'Summary', hidden: true, default: '' },
+                //The whole raw payload is the single source of truth: decoded verbatim to hex and re-emitted
+                //untouched (byte-perfect for any Rlogin payload). The startup fields are parsed into the
+                //display-only metadata above, which carry no codec of their own.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    default: '',
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        if (available <= 0) {
+                            this.instance.message.setValue('');
+                            this.#parseStartup(Buffer.alloc(0));
+                            return;
+                        }
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parseStartup(raw);
+                    },
+                    encode: function () {
+                        //Re-emit the authoritative payload verbatim — never reconstruct from metadata.
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Reached only on the tcp:513 bucket. Port 513 IS Rlogin's, so any non-empty payload over TCP is
+        //claimed and kept verbatim (byte-perfect) — deliberately without a leading-null gate, so the
+        //byte-stream phase is never wrongly dropped to raw. An empty payload is not claimed.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'tcp')
+            return false;
+        return this.#payloadLength() >= 1;
+    }
+}
+exports.Rlogin = Rlogin;

package/dist/headers/Rsync.d.ts

@@ -0,0 +1,28 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * rsync — the rsync daemon protocol (TCP port 873). A session opens with a US-ASCII text handshake: the
+ * server sends a greeting line `@RSYNCD: <version>\n` (e.g. `@RSYNCD: 31.0\n`, LF-terminated, no CR), the
+ * client echoes its own `@RSYNCD: <version>\n`, then the client sends the module name and options as text
+ * lines, after which the connection switches to a binary multiplexed stream (4-byte tag/length framed
+ * messages) for the actual file-list / delta transfer.
+ *
+ * The post-handshake binary multiplexing is stateful and cross-message (tag demux, per-tag length,
+ * reassembly across segments), and even the text phase carries significant whitespace / ordering, far
+ * richer than a form needs. So, like SIP/HTTP/Finger, the ENTIRE raw payload is kept verbatim as the
+ * authoritative `message` field (hex) and re-emitted untouched — byte-perfect for any rsync segment,
+ * text handshake or binary frame alike. When the payload begins with the `@RSYNCD:` greeting signature,
+ * its first line is additionally parsed into display-only metadata (isGreeting + version); those fields
+ * carry no codec of their own and never affect the re-emitted bytes.
+ */
+export declare class Rsync extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/Rsync.js

@@ -0,0 +1,117 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Rsync = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * rsync — the rsync daemon protocol (TCP port 873). A session opens with a US-ASCII text handshake: the
+ * server sends a greeting line `@RSYNCD: <version>\n` (e.g. `@RSYNCD: 31.0\n`, LF-terminated, no CR), the
+ * client echoes its own `@RSYNCD: <version>\n`, then the client sends the module name and options as text
+ * lines, after which the connection switches to a binary multiplexed stream (4-byte tag/length framed
+ * messages) for the actual file-list / delta transfer.
+ *
+ * The post-handshake binary multiplexing is stateful and cross-message (tag demux, per-tag length,
+ * reassembly across segments), and even the text phase carries significant whitespace / ordering, far
+ * richer than a form needs. So, like SIP/HTTP/Finger, the ENTIRE raw payload is kept verbatim as the
+ * authoritative `message` field (hex) and re-emitted untouched — byte-perfect for any rsync segment,
+ * text handshake or binary frame alike. When the payload begins with the `@RSYNCD:` greeting signature,
+ * its first line is additionally parsed into display-only metadata (isGreeting + version); those fields
+ * carry no codec of their own and never affect the re-emitted bytes.
+ */
+class Rsync extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'rsync';
+        this.name = 'Rsync Daemon Protocol';
+        this.nickname = 'RSYNC';
+        this.matchKeys = ['tcpport:873'];
+        //A leaf header — the binary multiplexed stream that follows the handshake is a higher-layer concern.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (_a.#schemaCache ??= _a.#buildSchema());
+    }
+    /**
+     * Bytes of this header: rsync rides on TCP, which has no per-message length, so take the rest of the
+     * segment. The binary multiplexed framing (and reassembly across segments) is out of scope; whatever
+     * bytes are present in the current segment are kept verbatim.
+     */
+    #payloadLength() {
+        const available = this.packet.length - this.startPos;
+        return available < 0 ? 0 : available;
+    }
+    /** The first line of the payload (up to the first LF, or the whole payload if none); a trailing CR is stripped. */
+    static #firstLine(text) {
+        const idx = text.indexOf('\n');
+        let line = idx >= 0 ? text.slice(0, idx) : text;
+        if (line.endsWith('\r'))
+            line = line.slice(0, -1);
+        return line;
+    }
+    /**
+     * Parse the first line into the display-only metadata. Only a line beginning with the `@RSYNCD:`
+     * signature is a greeting; its remainder (trimmed) is the protocol version token (e.g. "31.0", or a
+     * status word like "OK"/"AUTHREQD ..."). Populated on decode only — these fields have no encode, so
+     * they never affect the re-emitted bytes. Never throws: a non-greeting payload yields empty metadata.
+     */
+    #parseFirstLine(text) {
+        const line = _a.#firstLine(text);
+        if (line.startsWith('@RSYNCD:')) {
+            this.instance.isGreeting.setValue(true);
+            this.instance.version.setValue(line.slice('@RSYNCD:'.length).trim());
+            return;
+        }
+        this.instance.isGreeting.setValue(false);
+        this.instance.version.setValue('');
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'rsync ${version}',
+            properties: {
+                //The whole raw payload is the single source of truth: decoded verbatim to hex and
+                //re-emitted untouched (byte-perfect for any rsync segment). The greeting line, when
+                //present, is parsed into the display-only metadata below, which carry no codec.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        if (available <= 0) {
+                            this.instance.message.setValue('');
+                            this.#parseFirstLine('');
+                            return;
+                        }
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parseFirstLine(raw.toString('latin1'));
+                    },
+                    encode: function () {
+                        //Re-emit the authoritative payload verbatim — never reconstruct from metadata.
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                },
+                //Display-only metadata parsed from the first line on decode (no encode — populated by the
+                //message field above, never read back). isGreeting is true only for a `@RSYNCD:` line;
+                //version is the token after `@RSYNCD:` (empty for a binary/non-greeting segment).
+                isGreeting: { type: 'boolean', label: 'Is Greeting' },
+                version: { type: 'string', label: 'Version' }
+            }
+        };
+    }
+    match() {
+        //rsync rides on TCP port 873. The payload has no fixed content magic once the connection turns
+        //binary, so the well-known port is the signature (no heuristicFallback: it is not claimed on any
+        //other port). Require the previous layer to be TCP and at least one payload byte to be present.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        return this.#payloadLength() > 0;
+    }
+}
+exports.Rsync = Rsync;
+_a = Rsync;

package/dist/headers/S7comm.d.ts

@@ -0,0 +1,36 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * S7comm — the Siemens S7 Communication protocol (S7-300/400/1200/1500 PLC), the application layer of
+ * the S7 ISO-on-TCP stack: it rides inside a COTP DT (Data) TPDU, itself carried by a TPKT PDU on TCP
+ * port 102 (RFC 1006). Every S7comm PDU begins with a fixed 10-byte header — a Protocol Id (always
+ * 0x32), a ROSCTR (message class: 1 Job request, 2 Ack, 3 Ack_Data, 7 Userdata), a 2-byte Redundancy
+ * Identification (reserved, normally 0), a 2-byte PDU Reference, and the 2-byte Parameter Length and
+ * Data Length that delimit the two variable sections — plus, ONLY for the Ack / Ack_Data classes
+ * (ROSCTR 2 or 3), a 2-byte error field (Error Class + Error Code). The Parameter section (the S7
+ * function + its arguments) and the Data section (item values, results) then follow, sized by the two
+ * length fields.
+ *
+ * The Parameter and Data sections are function-dependent, cross-PDU state (Setup Communication,
+ * Read/Write Var, block up/download, PLC control, …), so this codec keeps them verbatim as bounded hex
+ * (byte-perfect): `parameter` sized by Parameter Length and `data` sized by Data Length. The two length
+ * fields are honor-else-derive (honored verbatim when supplied — a crafted PDU may lie — else derived
+ * from the hex byte length of their section). Every field is BIG-ENDIAN (S7comm is not CIP/ENIP). A
+ * well-formed PDU round-trips byte-for-byte.
+ *
+ * S7comm is gated purely on its parent being a COTP DT TPDU (prev.id === 'cotp') plus the Protocol Id
+ * 0x32 signature at offset 0 (heuristicFallback), mirroring how COTP itself is an unkeyed
+ * content-heuristic child of TPKT — nothing on TCP/102 other than a COTP-carried 0x32 PDU is S7comm.
+ */
+export declare class S7comm extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    readonly heuristicFallback: boolean;
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}