scp81: UI framing options, permissive TLS, drop the Apache-header mimicry (v2.2.14)

Listener Options block (applied at Start, persisted in localStorage, Reset to
defaults): HTTP framing - chunked body, chunk size (0 = one TLS record),
keep-alive, Connection header, compact headers, Next-URI (unchecked = omit);
script framing - indefinite/definite Command Scripting template, CR tag,
targeted app; link events (now parsed on the common start path, so every mode
honors them). scp81OptionsFromForm() is unit-tested.

TLS is automatic: 'auto' (min 1.0, max 1.2 + :@SECLEVEL=0) is the new
default, all six PSK suites are offered and OpenSSL negotiates the highest;
the negotiated version/cipher is logged (tls-handshake) and reported as
version_seen/cipher_seen in /api/scp81/status, and a handshake failing for a
TLS/cipher reason logs tls-handshake-failed (post-handshake record errors
stay tls-error). tls_version/cipher/keylog/answer_delay stay as API-only pins.

Dropped the Apache-style header mimicry completely: no Date/Server/
X-Powered-By, no Content-Length-before-Content-Type ordering, no Content-Type
on 204 - the minimal response set is X-Admin-Protocol (+ X-Admin-Next-URI /
Targeted-Application), Content-Type on 200s, and Transfer-Encoding or
Content-Length per the chunked flag. Docs, help (EN/RU), READMEs and the
AGENTS notes updated; SW cache otaman-v180.

frontend/help-ru.html

@@ -327,6 +327,7 @@
 		<li><strong>Проброс (адрес карты)</strong> — без слушателя и без цели: терминал подключает каждый BIP-канал к адресу, который карта запрашивает в OPEN CHANNEL (Other address + порт Transport level, только TCP-клиент, удалённое соединение; спецификации не задают порт по умолчанию, поэтому неполный запрос отклоняет канал). TLS завершается на той платформе, и используется сеть сервера (только для лаборатории).</li>
 		<li><strong>Захват (dump)</strong> — принимает TCP-канал карты и записывает всё, что она отправляет (например, TLS ClientHello), не отвечая.</li>
 	</ul>
+	<p class="mb-2">Блок <strong>Настройки</strong> (применяются при <strong>Start</strong>, сохраняются в браузере) открывает HTTP-фрейминг &mdash; <strong>chunked</strong>-тело / <strong>размер чанка</strong> (0 = весь ответ в одной TLS-записи), keep-alive, заголовок Connection, компактные заголовки и Next-URI (снято — заголовок не отправляется) &mdash; и фрейминг скрипта (неопределённая длина <code class="font-mono text-sm">AE 80 …</code> / определённая <code class="font-mono text-sm">AA</code> в Command Scripting template, теги с обязательным пониманием, целевое приложение). <strong>События канала</strong> (ENVELOPE Channel status, TS 102 223 &sect;7.5.11) действуют во всех режимах. У TLS нет настроек: слушатель предлагает TLS 1.0&ndash;1.2 и все PSK-наборы, а карта выбирает; строка состояния и TLS-журнал показывают фактически использованные версию и набор, а сбой рукопожатия по причине TLS/набора пишется как <code class="font-mono text-sm">tls-handshake-failed</code>.</p>
 	<p class="mb-2"><strong>Сценарий</strong> выбирает список команд, отдаваемый в сессии — <strong>Нет</strong> (оставить настроенный на сервере скрипт) или один из скриптов подвкладки <strong>&laquo;Скрипты&raquo;</strong>; выбранный список передаётся серверу при старте слушателя.</p>
 	<p class="text-sm mb-3">Строка состояния показывает слушатель, согласованный идентификатор и активные каналы (байты in/out). Панель <strong>Script results (R-APDUs)</strong> перечисляет каждый отданный C-APDU с его R-APDU/SW и прогрессом <em>done/total</em>; журнал <strong>HTTP OTA log</strong> фиксирует OPEN/CLOSE CHANNEL, SEND/RECEIVE DATA и каждый шаг TLS/HTTP/скрипта (<code class="font-mono text-sm">tls-handshake</code>, <code class="font-mono text-sm">tls-request</code>, <code class="font-mono text-sm">script-send</code>, <code class="font-mono text-sm">script-rapdu</code>, <code class="font-mono text-sm">script-page</code>, <code class="font-mono text-sm">script-done</code>, <code class="font-mono text-sm">data-available</code>, <code class="font-mono text-sm">peer-close</code>), кнопка <strong>Clear</strong> очищает его.</p>
 	<h3 id="scp81-scripts" class="text-lg font-medium mb-2">5.2 Скрипты</h3>

frontend/help.html

@@ -327,6 +327,7 @@
 		<li><strong>Pass-through (card destination)</strong> — no listener and no target: the terminal connects each BIP channel to the destination the card requests in OPEN CHANNEL (Other address + Transport level port, TCP client remote only; the specs define no default port, so an incomplete request fails the channel). TLS is terminated by that platform, and the server's network is used (lab only).</li>
 		<li><strong>Capture (dump)</strong> — accepts the card's TCP channel and logs whatever it sends (e.g. the TLS ClientHello) without answering.</li>
 	</ul>
+	<p class="mb-2">The <strong>Options</strong> block (applied at <strong>Start</strong>, remembered in the browser) exposes the HTTP framing &mdash; <strong>chunked</strong> body / <strong>chunk size</strong> (0 = the whole response in one TLS record), keep-alive, the Connection header, compact headers and the Next-URI (unchecked = omit the header) &mdash; and the script framing (indefinite <code class="font-mono text-sm">AE 80 …</code> / definite <code class="font-mono text-sm">AA</code> Command Scripting template, comprehension-required tags, targeted application). <strong>Link events</strong> (Channel status ENVELOPEs, TS 102 223 &sect;7.5.11) apply to every mode. TLS itself has no settings: the listener offers TLS 1.0&ndash;1.2 and all PSK suites and lets the card negotiate; the state line and the TLS log show the version/cipher actually used, and a handshake that fails for a TLS/cipher reason is logged as <code class="font-mono text-sm">tls-handshake-failed</code>.</p>
 	<p class="mb-2"><strong>Script</strong> selects the command list served over the session — <strong>None</strong> (leave the server's configured script) or one of the scripts from the <strong>Scripts</strong> pill; the chosen list is sent to the server when the listener starts.</p>
 	<p class="text-sm mb-3">The state line shows the listener, the negotiated identity and live channels (bytes in/out). <strong>Script results (R-APDUs)</strong> lists each served C-APDU with its R-APDU/SW and a <em>done/total</em> progress; the <strong>HTTP OTA log</strong> records OPEN/CLOSE CHANNEL, SEND/RECEIVE DATA and every TLS/HTTP/script step (<code class="font-mono text-sm">tls-handshake</code>, <code class="font-mono text-sm">tls-request</code>, <code class="font-mono text-sm">script-send</code>, <code class="font-mono text-sm">script-rapdu</code>, <code class="font-mono text-sm">script-page</code>, <code class="font-mono text-sm">script-done</code>, <code class="font-mono text-sm">data-available</code>, <code class="font-mono text-sm">peer-close</code>), with <strong>Clear</strong>.</p>
 	<h3 id="scp81-scripts" class="text-lg font-medium mb-2">5.2 Scripts</h3>

frontend/index.html

@@ -18,7 +18,7 @@
 <div class="max-w-7xl mx-auto px-6 py-2">
 
 	<div class="flex items-center justify-between mb-3">
-		<h1 class="text-2xl font-bold text-heading">OTAMan <span id="slogan" class="text-sm font-normal text-gray-500 dark:text-slate-400 ml-2" data-l10n="SIM OTA with a Human Face">SIM OTA with a Human Face</span> <span class="text-xs text-gray-400 dark:text-slate-500 ml-1">v2.2.13</span></h1>
+		<h1 class="text-2xl font-bold text-heading">OTAMan <span id="slogan" class="text-sm font-normal text-gray-500 dark:text-slate-400 ml-2" data-l10n="SIM OTA with a Human Face">SIM OTA with a Human Face</span> <span class="text-xs text-gray-400 dark:text-slate-500 ml-1">v2.2.14</span></h1>
 		<div class="flex items-center gap-4">
 			<span id="state-indicator" class="flex items-center select-none" style="cursor:default" title="Connecting...">
 				<span id="state-indicator-dot" class="text-xs text-gray-400" title="Connecting...">●</span>
@@ -995,6 +995,44 @@
 				<div id="scp81-redirect-note" class="hidden mt-2 text-xs text-gray-500 dark:text-slate-400" data-l10n="Redirect: every BIP channel the card opens is connected to this Host:Port (the external HTTP OTA platform); TLS is terminated there, and the address the card requests is only logged.">Redirect: every BIP channel the card opens is connected to this Host:Port (the external HTTP OTA platform); TLS is terminated there, and the address the card requests is only logged.</div>
 				<div id="scp81-passthru-note" class="hidden mt-2 text-xs text-gray-500 dark:text-slate-400" data-l10n="Pass-through: the terminal connects each BIP channel to the destination the card requests in OPEN CHANNEL (Other address + transport port, TCP client only); Host and Port above are not used, TLS is terminated by that platform, and the server's network is used (lab only).">Pass-through: the terminal connects each BIP channel to the destination the card requests in OPEN CHANNEL (Other address + transport port, TCP client only); Host and Port above are not used, TLS is terminated by that platform, and the server's network is used (lab only).</div>
 			</div>
+			<div class="border border-gray-200 dark:border-slate-700 rounded p-3 mb-3">
+				<div class="flex flex-wrap items-center gap-2 mb-2">
+					<span class="text-sm text-gray-500 dark:text-slate-400" data-l10n="Options (applied at Start)">Options (applied at Start)</span>
+					<button onclick="scp81OptionsReset()" class="ml-auto px-2 py-0.5 text-xs rounded border border-gray-300 dark:border-slate-600 hover:bg-gray-200 dark:hover:bg-slate-700 text-gray-700 dark:text-slate-300" data-l10n="Reset to defaults">Reset to defaults</button>
+				</div>
+				<div id="scp81-opts-http" class="space-y-2">
+					<div class="text-xs font-medium text-gray-500 dark:text-slate-400" data-l10n="HTTP framing">HTTP framing</div>
+					<label class="flex items-center gap-2 text-xs text-gray-600 dark:text-slate-300 cursor-pointer"><input type="checkbox" id="opt-chunked" onchange="scp81OptionsPersist()" class="rounded"> <span data-l10n="Chunked body (Transfer-Encoding: chunked)">Chunked body (Transfer-Encoding: chunked)</span></label>
+					<div class="flex flex-wrap items-center gap-2">
+						<label class="text-xs text-gray-600 dark:text-slate-400" data-l10n="Chunk size (bytes, 0 = one TLS record)">Chunk size (bytes, 0 = one TLS record)</label>
+						<input id="opt-chunk-size" type="number" min="0" max="4096" onchange="scp81OptionsPersist()" class="w-24 font-mono border border-gray-300 dark:border-slate-600 text-sm rounded px-2 py-1 dark:bg-slate-800">
+					</div>
+					<label class="flex items-center gap-2 text-xs text-gray-600 dark:text-slate-300 cursor-pointer"><input type="checkbox" id="opt-keep-alive" onchange="scp81OptionsPersist()" class="rounded"> <span data-l10n="Keep-alive (one connection until the session ends)">Keep-alive (one connection until the session ends)</span></label>
+					<div class="flex flex-wrap items-center gap-2">
+						<label class="text-xs text-gray-600 dark:text-slate-400" data-l10n="Connection header">Connection header</label>
+						<select id="opt-conn-header" onchange="scp81OptionsPersist()" class="border border-gray-300 dark:border-slate-600 text-sm rounded px-2 py-1 dark:bg-slate-800">
+							<option value="none" data-l10n="omit (implicit keep-alive)">omit (implicit keep-alive)</option>
+							<option value="close">close</option>
+							<option value="keep-alive">keep-alive</option>
+						</select>
+					</div>
+					<label class="flex items-center gap-2 text-xs text-gray-600 dark:text-slate-300 cursor-pointer"><input type="checkbox" id="opt-compact" onchange="scp81OptionsPersist()" class="rounded"> <span data-l10n="Compact headers (no space after ':')">Compact headers (no space after ':')</span></label>
+					<label class="flex items-center gap-2 text-xs text-gray-600 dark:text-slate-300 cursor-pointer"><input type="checkbox" id="opt-next-uri" onchange="scp81OptionsPersist()" class="rounded"> <span data-l10n="Next-URI (unchecked = omit the header)">Next-URI (unchecked = omit the header)</span></label>
+					<input id="opt-next-uri-value" onchange="scp81OptionsPersist()" class="w-full font-mono border border-gray-300 dark:border-slate-600 text-sm rounded px-2 py-1 dark:bg-slate-800" placeholder="/api/scp81?req=%d">
+				</div>
+				<div id="scp81-opts-script" class="space-y-2 mt-3">
+					<div class="text-xs font-medium text-gray-500 dark:text-slate-400" data-l10n="Script framing">Script framing</div>
+					<div class="flex flex-wrap items-center gap-2">
+						<select id="opt-script-template" onchange="scp81OptionsPersist()" class="border border-gray-300 dark:border-slate-600 text-sm rounded px-2 py-1 dark:bg-slate-800">
+							<option value="indefinite" data-l10n="Indefinite (AE 80 … 00 00)">Indefinite (AE 80 … 00 00)</option>
+							<option value="definite" data-l10n="Definite (AA)">Definite (AA)</option>
+						</select>
+						<label class="flex items-center gap-2 text-xs text-gray-600 dark:text-slate-300 cursor-pointer"><input type="checkbox" id="opt-cr-tag" onchange="scp81OptionsPersist()" class="rounded"> <span data-l10n="Comprehension-required tags">Comprehension-required tags</span></label>
+					</div>
+					<input id="opt-targeted-app" onchange="scp81OptionsPersist()" class="w-full font-mono border border-gray-300 dark:border-slate-600 text-sm rounded px-2 py-1 dark:bg-slate-800" placeholder="X-Admin-Targeted-Application, e.g. //aid/A000000151000000">
+				</div>
+				<label class="flex items-center gap-2 text-xs text-gray-600 dark:text-slate-300 cursor-pointer mt-3"><input type="checkbox" id="opt-link-events" onchange="scp81OptionsPersist()" class="rounded"> <span data-l10n="Link events (Channel status ENVELOPEs, TS 102 223 7.5.11)">Link events (Channel status ENVELOPEs, TS 102 223 7.5.11)</span></label>
+			</div>
 			<div class="border border-gray-200 dark:border-slate-700 rounded p-3 mb-3">
 				<div class="flex justify-between items-center mb-2">
 					<span class="text-sm text-gray-500 dark:text-slate-400" data-l10n="Script results (R-APDUs)">Script results (R-APDUs)</span>
@@ -7770,6 +7808,67 @@ async function pysimProactiveLogRender() {
 let _scp81Timer = null;
 let _scp81LastStatus = null;
 
+// ===== SCP81 listener options (HTTP framing / script framing / link events) =====
+// The API takes these at listener start; they are kept in localStorage so a
+// test setup survives reloads. TLS itself has no settings: the listener
+// accepts everything it can and reports the negotiated version/cipher.
+const SCP81_OPT_DEFAULTS = {
+	chunked: true, chunkSize: 0, keepAlive: true, connHeader: 'none',
+	compact: false, nextUri: '/api/scp81?req=%d', linkEvents: true,
+	scriptTemplate: 'indefinite', crTag: false, targetedApp: ''
+};
+
+function scp81OptionsLoad() {
+	let saved = {};
+	try { saved = JSON.parse(localStorage.getItem('otaman_scp81_opts') || '{}') || {}; } catch (e) { saved = {}; }
+	const opt = Object.assign({}, SCP81_OPT_DEFAULTS, saved);
+	const set = (id, v) => { const el = document.getElementById(id); if (el) el.value = v; };
+	const chk = (id, v) => { const el = document.getElementById(id); if (el) el.checked = !!v; };
+	chk('opt-chunked', opt.chunked);
+	set('opt-chunk-size', opt.chunkSize);
+	chk('opt-keep-alive', opt.keepAlive);
+	set('opt-conn-header', opt.connHeader);
+	chk('opt-compact', opt.compact);
+	chk('opt-next-uri', opt.nextUri !== '');
+	set('opt-next-uri-value', opt.nextUri || SCP81_OPT_DEFAULTS.nextUri);
+	chk('opt-link-events', opt.linkEvents);
+	set('opt-script-template', opt.scriptTemplate === 'definite' ? 'definite' : 'indefinite');
+	chk('opt-cr-tag', opt.crTag);
+	set('opt-targeted-app', opt.targetedApp);
+}
+
+function scp81OptionsFromForm() {
+	const val = id => { const el = document.getElementById(id); return el ? el.value : ''; };
+	const on = id => { const el = document.getElementById(id); return !!(el && el.checked); };
+	return {
+		chunked: on('opt-chunked'),
+		chunk_size: Math.max(0, parseInt(val('opt-chunk-size'), 10) || 0),
+		keep_alive: on('opt-keep-alive'),
+		conn_header: val('opt-conn-header') || 'none',
+		compact_headers: on('opt-compact'),
+		next_uri: on('opt-next-uri') ? (val('opt-next-uri-value').trim() || SCP81_OPT_DEFAULTS.nextUri) : '',
+		link_events: on('opt-link-events'),
+		script_template: val('opt-script-template') === 'definite' ? 'definite' : 'indefinite',
+		cr_tag: on('opt-cr-tag'),
+		targeted_app: val('opt-targeted-app').trim()
+	};
+}
+
+function scp81OptionsPersist() {
+	const o = scp81OptionsFromForm();
+	localStorage.setItem('otaman_scp81_opts', JSON.stringify({
+		chunked: o.chunked, chunkSize: o.chunk_size, keepAlive: o.keep_alive,
+		connHeader: o.conn_header, compact: o.compact_headers, nextUri: o.next_uri,
+		linkEvents: o.link_events, scriptTemplate: o.script_template,
+		crTag: o.cr_tag, targetedApp: o.targeted_app
+	}));
+}
+
+function scp81OptionsReset() {
+	localStorage.removeItem('otaman_scp81_opts');
+	scp81OptionsLoad();
+}
+
 function scp81ModeChanged() {
 	const mode = document.getElementById('scp81-mode').value;
 	const row = document.getElementById('scp81-script-row');
@@ -7780,6 +7879,11 @@ function scp81ModeChanged() {
 	if (redirectNote) redirectNote.classList.toggle('hidden', mode !== 'redirect');
 	const passthruNote = document.getElementById('scp81-passthru-note');
 	if (passthruNote) passthruNote.classList.toggle('hidden', mode !== 'passthru');
+	// HTTP and script framing are properties of our TLS listener
+	const httpOpts = document.getElementById('scp81-opts-http');
+	if (httpOpts) httpOpts.classList.toggle('hidden', mode !== 'tls');
+	const scriptOpts = document.getElementById('scp81-opts-script');
+	if (scriptOpts) scriptOpts.classList.toggle('hidden', mode !== 'tls');
 	// passthru dials the destination from the card's OPEN CHANNEL: the
 	// configured target fields do not apply.
 	for (const id of ['scp81-host', 'scp81-port']) {
@@ -8132,6 +8236,13 @@ async function scp81StatusRefresh() {
 						? t('matched') + (name ? ': ' + name : '')
 						: t('unknown identity')) + ']';
 			}
+			if (l.version_seen) {
+				s += ' | TLS ' + l.version_seen + (l.cipher_seen ? ' ' + l.cipher_seen : '');
+			}
+			s += ' | ' + (l.chunked
+				? ('chunked' + (l.chunk_size ? ' ' + l.chunk_size : ''))
+				: 'content-length');
+			if (l.keep_alive) s += ' | keep-alive';
 		}
 		const ch = (bip.channels || []).map(c => 'ch' + c.id + (c.target ? ' → ' + c.target : '') + ' in:' + c.bytes_in + ' out:' + c.bytes_out).join(', ');
 		if (ch) s += ' | ' + ch;
@@ -8173,6 +8284,20 @@ async function scp81Start() {
 		body.host = hostVal || '127.0.0.1';
 		body.port = parseInt(portVal || '8443', 10);
 	}
+	const opts = scp81OptionsFromForm();
+	body.link_events = opts.link_events;
+	if (mode === 'tls') {
+		body.chunked = opts.chunked;
+		body.chunk_size = opts.chunk_size;
+		body.keep_alive = opts.keep_alive;
+		body.conn_header = opts.conn_header;
+		body.compact_headers = opts.compact_headers;
+		body.next_uri = opts.next_uri;
+		body.script_template = opts.script_template;
+		body.cr_tag = opts.cr_tag;
+		body.targeted_app = opts.targeted_app || null;
+	}
+	scp81OptionsPersist();
 	if (mode === 'tls') {
 		const map = cardsPskMap();
 		if (!map.length) {
@@ -10997,6 +11122,7 @@ function profilerRenderReport(results, labels) {
 
 profilerLoad();
 snapshotsLoad();
+scp81OptionsLoad();
 
 // Init sub-tab pills
 document.querySelectorAll('.pysim-subtab').forEach(btn => {
@@ -11450,6 +11576,21 @@ const LANG_RU = {
 	'Redirect: every BIP channel the card opens is connected to this Host:Port (the external HTTP OTA platform); TLS is terminated there, and the address the card requests is only logged.': 'Перенаправление: каждый открываемый картой BIP-канал подключается к этому Host:Port (внешняя платформа HTTP OTA); TLS завершается там, а запрошенный картой адрес только журналируется.',
 	'Pass-through: the terminal connects each BIP channel to the destination the card requests in OPEN CHANNEL (Other address + transport port, TCP client only); Host and Port above are not used, TLS is terminated by that platform, and the server\'s network is used (lab only).': 'Проброс: терминал подключает каждый BIP-канал к адресу, который карта запрашивает в OPEN CHANNEL (Other address + порт Transport level, только TCP-клиент); поля Host и Port выше не используются, TLS завершается на той платформе, и используется сеть сервера (только для лаборатории).',
 	'Redirect requires the target host and port': 'Для перенаправления нужны host и port внешнего сервера',
+	'Options (applied at Start)': 'Настройки (применяются при запуске)',
+	'Reset to defaults': 'Сбросить к умолчаниям',
+	'HTTP framing': 'HTTP-фрейминг',
+	'Chunked body (Transfer-Encoding: chunked)': 'Chunked-тело (Transfer-Encoding: chunked)',
+	'Chunk size (bytes, 0 = one TLS record)': 'Размер чанка (байт, 0 = одна TLS-запись)',
+	'Keep-alive (one connection until the session ends)': 'Keep-alive (одно соединение до конца сессии)',
+	'Connection header': 'Заголовок Connection',
+	'omit (implicit keep-alive)': 'не отправлять (неявный keep-alive)',
+	"Compact headers (no space after ':')": 'Компактные заголовки (без пробела после «:»)',
+	'Next-URI (unchecked = omit the header)': 'Next-URI (снято — заголовок не отправляется)',
+	'Script framing': 'Фрейминг скрипта',
+	'Indefinite (AE 80 … 00 00)': 'Неопределённая длина (AE 80 … 00 00)',
+	'Definite (AA)': 'Определённая длина (AA)',
+	'Comprehension-required tags': 'Теги с обязательным пониманием (CR)',
+	'Link events (Channel status ENVELOPEs, TS 102 223 7.5.11)': 'События канала (ENVELOPE Channel status, TS 102 223 7.5.11)',
 	'ADM verified': 'ADM подтверждён',
 	'ADM not verified': 'ADM не подтверждён',
 	'TERMINAL PROFILE': 'TERMINAL PROFILE',

frontend/sw.js

@@ -1,4 +1,4 @@
-const CACHE = 'otaman-v179';
+const CACHE = 'otaman-v180';
 const URLS = [
   'index.html',
   'help.html',

frontend/tests/scp81_options.test.js

@@ -0,0 +1,161 @@
+const { test } = require('node:test');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const html = fs.readFileSync(path.join(__dirname, '..', 'index.html'), 'utf8');
+
+function extractFunc(src, name) {
+	const re = new RegExp('function\\s+' + name + '\\s*\\([^)]*\\)\\s*\\{');
+	const m = re.exec(src);
+	if (!m) throw new Error('function ' + name + ' not found');
+	let i = m.index + m[0].length - 1;
+	let depth = 0;
+	for (; i < src.length; i++) {
+		if (src[i] === '{') depth++;
+		else if (src[i] === '}') {
+			depth--;
+			if (depth === 0) break;
+		}
+	}
+	return src.slice(m.index, i + 1);
+}
+
+let code = html.match(/const SCP81_OPT_DEFAULTS = \{[\s\S]*?\n\};/)[0].replace('const ', 'var ') + '\n';
+for (const fn of ['scp81OptionsLoad', 'scp81OptionsFromForm', 'scp81OptionsPersist', 'scp81OptionsReset']) {
+	code += extractFunc(html, fn) + '\n';
+}
+eval(code);
+
+function setup(opts) {
+	const spec = Object.assign({
+		'opt-chunked': true,
+		'opt-chunk-size': 0,
+		'opt-keep-alive': true,
+		'opt-conn-header': 'none',
+		'opt-compact': false,
+		'opt-next-uri': true,
+		'opt-next-uri-value': '/api/scp81?req=%d',
+		'opt-link-events': true,
+		'opt-script-template': 'indefinite',
+		'opt-cr-tag': false,
+		'opt-targeted-app': ''
+	}, opts || {});
+	const els = {};
+	for (const [id, v] of Object.entries(spec)) {
+		els[id] = typeof v === 'boolean' ? { checked: v, value: '' } : { checked: true, value: String(v) };
+	}
+	globalThis.document = { getElementById: id => els[id] || null };
+	return els;
+}
+
+function fakeStorage(initial) {
+	const store = Object.assign({}, initial || {});
+	globalThis.localStorage = {
+		getItem: k => (k in store ? store[k] : null),
+		setItem: (k, v) => { store[k] = String(v); },
+		removeItem: k => { delete store[k]; },
+		_store: store,
+	};
+	return store;
+}
+
+test('scp81OptionsFromForm maps the reference defaults', () => {
+	setup();
+	assert.deepStrictEqual(scp81OptionsFromForm(), {
+		chunked: true,
+		chunk_size: 0,
+		keep_alive: true,
+		conn_header: 'none',
+		compact_headers: false,
+		next_uri: '/api/scp81?req=%d',
+		link_events: true,
+		script_template: 'indefinite',
+		cr_tag: false,
+		targeted_app: ''
+	});
+});
+
+test('scp81OptionsFromForm reflects a changed setup', () => {
+	setup({
+		'opt-chunked': false,
+		'opt-chunk-size': '100',
+		'opt-keep-alive': false,
+		'opt-conn-header': 'close',
+		'opt-compact': true,
+		'opt-next-uri-value': '/adminserver?apdu_id=%d',
+		'opt-link-events': false,
+		'opt-script-template': 'definite',
+		'opt-cr-tag': true,
+		'opt-targeted-app': ' //aid/A000000151000000 '
+	});
+	assert.deepStrictEqual(scp81OptionsFromForm(), {
+		chunked: false,
+		chunk_size: 100,
+		keep_alive: false,
+		conn_header: 'close',
+		compact_headers: true,
+		next_uri: '/adminserver?apdu_id=%d',
+		link_events: false,
+		script_template: 'definite',
+		cr_tag: true,
+		targeted_app: '//aid/A000000151000000'
+	});
+});
+
+test('unchecked Next-URI omits the header; empty text falls back to the template', () => {
+	setup({ 'opt-next-uri': false });
+	assert.strictEqual(scp81OptionsFromForm().next_uri, '');
+	setup({ 'opt-next-uri': true, 'opt-next-uri-value': '   ' });
+	assert.strictEqual(scp81OptionsFromForm().next_uri, '/api/scp81?req=%d');
+});
+
+test('load/persist/reset round-trip through localStorage', () => {
+	const store = fakeStorage();
+	setup({
+		'opt-chunked': false,
+		'opt-chunk-size': 100,
+		'opt-keep-alive': false,
+		'opt-conn-header': 'close',
+		'opt-compact': true,
+		'opt-next-uri': false,
+		'opt-link-events': false,
+		'opt-script-template': 'definite',
+		'opt-cr-tag': true,
+		'opt-targeted-app': '//aid/A000000151000000'
+	});
+	scp81OptionsPersist();
+	assert.ok(store['otaman_scp81_opts'].includes('"chunkSize":100'));
+	// a reload restores the saved setup
+	setup({});
+	scp81OptionsLoad();
+	assert.strictEqual(globalThis.document.getElementById('opt-chunked').checked, false);
+	assert.strictEqual(globalThis.document.getElementById('opt-chunk-size').value, 100);
+	assert.strictEqual(globalThis.document.getElementById('opt-conn-header').value, 'close');
+	assert.strictEqual(globalThis.document.getElementById('opt-next-uri').checked, false);
+	assert.strictEqual(globalThis.document.getElementById('opt-script-template').value, 'definite');
+	assert.strictEqual(globalThis.document.getElementById('opt-cr-tag').checked, true);
+	assert.strictEqual(globalThis.document.getElementById('opt-targeted-app').value, '//aid/A000000151000000');
+	// reset clears the saved entry and restores the defaults
+	scp81OptionsReset();
+	assert.ok(!('otaman_scp81_opts' in store));
+	scp81OptionsLoad();
+	assert.strictEqual(globalThis.document.getElementById('opt-chunked').checked, true);
+	assert.strictEqual(globalThis.document.getElementById('opt-next-uri').checked, true);
+	assert.strictEqual(globalThis.document.getElementById('opt-conn-header').value, 'none');
+});
+
+test('the Listener UI wires the framing options into Start', () => {
+	for (const id of ['scp81-opts-http', 'scp81-opts-script', 'opt-chunked',
+		'opt-chunk-size', 'opt-keep-alive', 'opt-conn-header', 'opt-compact',
+		'opt-next-uri', 'opt-next-uri-value', 'opt-script-template', 'opt-cr-tag',
+		'opt-targeted-app', 'opt-link-events']) {
+		assert.ok(html.includes('id="' + id + '"'), id);
+	}
+	assert.ok(html.includes('body.link_events = opts.link_events;'));
+	assert.ok(html.includes('body.chunk_size = opts.chunk_size;'));
+	assert.ok(html.includes('body.next_uri = opts.next_uri;'));
+	assert.ok(html.includes('body.script_template = opts.script_template;'));
+	assert.ok(html.includes("httpOpts.classList.toggle('hidden', mode !== 'tls')"));
+	assert.ok(html.includes("scriptOpts.classList.toggle('hidden', mode !== 'tls')"));
+});