@netkitty/codec 1.0.0

package/dist/headers/NFS.js

@@ -0,0 +1,273 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NFS = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * Network File System (NFS, RFC 1813 v3 / RFC 7530 v4), TCP + UDP port 2049. NFS is carried inside an
+ * ONC RPC (RFC 5531) message, so on the wire an NFS packet is a plain RPC message: a 4-byte XID followed
+ * by a 4-byte Message Type (0 CALL, 1 REPLY). A CALL body continues with the RPC version (== 2), the
+ * program number (NFS = 100003), the program version, the procedure, then the credential + verifier auth
+ * structures and the NFS procedure arguments. NFS parses this RPC envelope itself at its 2049 port bucket
+ * (it does not depend on the SunRPC header, which is scoped to the portmapper's port 111).
+ *
+ * Transport framing differs by L4 (RFC 5531 §11): over UDP the RPC message is the whole datagram; over
+ * TCP a 4-byte Record Marking prefix precedes it — the high bit is the last-fragment flag and the low 31
+ * bits are the fragment length. This header detects the transport via prevCodecModule.id and structures
+ * accordingly: TCP → recordMark (lastFragment + fragmentLength) then the message at offset 4; UDP → the
+ * message directly at offset 0.
+ *
+ * Byte-perfect strategy (minimal slice): structure the XID and Message Type, and for a CALL the four
+ * fixed program-identity words (rpcVersion / program / programVersion / procedure); the remainder — the
+ * credential, verifier and NFS procedure arguments for a CALL, or the whole REPLY body — is kept verbatim
+ * as `body` hex, bounded by the transport payload (UDP length − 8, or the TCP Record Marking fragment
+ * length). The TCP fragmentLength is honored when supplied (a crafted frame may lie) else derived as the
+ * encoded message length; a well-formed message round-trips byte-for-byte. Trailing / pipelined bytes are
+ * left to the codec's recursion / RawData. Sub-decoding the per-procedure NFS argument/reply structures
+ * (GETATTR fh, LOOKUP dir+name, READ/WRITE, …) is a later enrichment.
+ */
+class NFS extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'nfs';
+        this.name = 'Network File System';
+        this.nickname = 'NFS';
+        //NFS ports 2049 on both TCP and UDP.
+        this.matchKeys = ['tcpport:2049', 'udpport:2049'];
+        //A leaf header — the credential / verifier / NFS arguments / REPLY body are kept verbatim for now.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (NFS.#schemaCache ??= NFS.#buildSchema());
+    }
+    /** True when this RPC message rides on TCP (a 4-byte Record Marking prefix precedes the message). */
+    #isTcp() {
+        return !!this.prevCodecModule && this.prevCodecModule.id === 'tcp';
+    }
+    /** Offset of the RPC message within this header: 4 bytes past startPos for TCP, 0 for UDP. */
+    #messageOffset() {
+        return this.#isTcp() ? 4 : 0;
+    }
+    /**
+     * Header-relative end offset of the bytes this NFS layer consumes, so a lying length never reads past
+     * the real transport payload and trailing / pipelined data is left to the codec. Over UDP the bound
+     * is (udp.length − 8); over TCP it is 4 (Record Marking) + the fragment length carried in that
+     * prefix; both clamped to the captured bytes.
+     */
+    #payloadEnd() {
+        let end = this.packet.length - this.startPos;
+        const prev = this.prevCodecModule;
+        if (prev && prev.id === 'udp') {
+            const udpLength = prev.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < end)
+                end = udpLength - 8;
+        }
+        else if (prev && prev.id === 'tcp') {
+            const word = (0, BufferToNumber_1.BufferToUInt32)(this.readBytes(0, 4, true));
+            const fragmentLength = (word & 0x7fffffff) >>> 0;
+            const total = 4 + fragmentLength;
+            if (total < end)
+                end = total;
+        }
+        return end < 0 ? 0 : end;
+    }
+    /** A 4-byte big-endian unsigned integer at the RPC-message offset + `wordOffset`, only for a CALL. */
+    static #callWord(name, wordOffset, label) {
+        return {
+            type: 'integer',
+            label: label,
+            minimum: 0,
+            maximum: 4294967295,
+            decode: function () {
+                if (this.instance.msgType.getValue(0) !== 0)
+                    return;
+                const offset = this.#messageOffset() + wordOffset;
+                if (this.#payloadEnd() < offset + 4)
+                    return;
+                this.instance[name].setValue((0, BufferToNumber_1.BufferToUInt32)(this.readBytes(offset, 4)));
+            },
+            encode: function () {
+                if (this.instance.msgType.getValue(0) !== 0)
+                    return;
+                const node = this.instance[name];
+                let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                if (value > 4294967295) {
+                    this.recordError(node.getPath(), 'Maximum value is 4294967295');
+                    value = 4294967295;
+                }
+                if (value < 0) {
+                    this.recordError(node.getPath(), 'Minimum value is 0');
+                    value = 0;
+                }
+                node.setValue(value);
+                this.writeBytes(this.#messageOffset() + wordOffset, (0, NumberToBuffer_1.UInt32ToBuffer)(value));
+            }
+        };
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'NFS xid=${xid} type=${msgType}',
+            properties: {
+                //==== TCP-only Record Marking prefix (RFC 5531 §11) ====
+                //The 4-byte word's high bit is the last-fragment flag; the low 31 bits are the fragment
+                //length (message bytes that follow). Absent over UDP. The 4-byte word is written together
+                //by fragmentLength (colocated) so the flag and length stay a single field on the wire.
+                lastFragment: {
+                    type: 'boolean',
+                    label: 'Last Fragment',
+                    decode: function () {
+                        if (!this.#isTcp())
+                            return;
+                        this.instance.lastFragment.setValue(!!this.readBits(0, 1, 0, 1));
+                    },
+                    encode: function () {
+                        //Display only; the combined 4-byte word is emitted by fragmentLength below.
+                        if (!this.#isTcp())
+                            return;
+                        this.instance.lastFragment.setValue(!!this.instance.lastFragment.getValue(true));
+                    }
+                },
+                fragmentLength: {
+                    type: 'integer',
+                    label: 'Fragment Length',
+                    minimum: 0,
+                    maximum: 2147483647,
+                    decode: function () {
+                        if (!this.#isTcp())
+                            return;
+                        const word = (0, BufferToNumber_1.BufferToUInt32)(this.readBytes(0, 4));
+                        this.instance.fragmentLength.setValue((word & 0x7fffffff) >>> 0);
+                    },
+                    encode: function () {
+                        if (!this.#isTcp())
+                            return;
+                        const last = !!this.instance.lastFragment.getValue(true);
+                        const provided = this.instance.fragmentLength.getValue();
+                        if (provided !== undefined && provided !== null) {
+                            //Honored verbatim (a crafted frame may lie about the fragment length).
+                            let value = provided;
+                            if (value > 2147483647) {
+                                this.recordError(this.instance.fragmentLength.getPath(), 'Maximum value is 2147483647');
+                                value = 2147483647;
+                            }
+                            if (value < 0) {
+                                this.recordError(this.instance.fragmentLength.getPath(), 'Minimum value is 0');
+                                value = 0;
+                            }
+                            this.instance.fragmentLength.setValue(value);
+                            this.writeBytes(0, (0, NumberToBuffer_1.UInt32ToBuffer)(((last ? 0x80000000 : 0) + value) >>> 0));
+                        }
+                        else {
+                            //Derive after the message bytes are written: the fragment length counts exactly
+                            //the RPC message (everything after this 4-byte prefix).
+                            this.writeBytes(0, (0, NumberToBuffer_1.UInt32ToBuffer)(last ? 0x80000000 : 0));
+                            this.addPostSelfEncodeHandler(() => {
+                                const messageLength = this.headerLength - 4;
+                                const value = messageLength > 0 ? messageLength : 0;
+                                this.instance.fragmentLength.setValue(value);
+                                this.writeBytes(0, (0, NumberToBuffer_1.UInt32ToBuffer)(((last ? 0x80000000 : 0) + value) >>> 0));
+                            }, 0);
+                        }
+                    }
+                },
+                //==== RPC message (RFC 5531 §9) ====
+                //The transaction id — an opaque 4-byte value a caller matches its REPLY to, kept as hex.
+                xid: {
+                    type: 'string',
+                    label: 'XID',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const offset = this.#messageOffset();
+                        if (this.#payloadEnd() < offset + 4)
+                            return;
+                        this.instance.xid.setValue((0, BufferToHex_1.BufferToHex)(this.readBytes(offset, 4)));
+                    },
+                    encode: function () {
+                        this.writeBytes(this.#messageOffset(), (0, HexToBuffer_1.HexToBuffer)(this.instance.xid.getValue('00000000')));
+                    }
+                },
+                //0 = CALL, 1 = REPLY. Drives whether the fixed CALL identity words are structured below.
+                msgType: {
+                    type: 'integer',
+                    label: 'Message Type',
+                    minimum: 0,
+                    maximum: 4294967295,
+                    decode: function () {
+                        const offset = this.#messageOffset() + 4;
+                        if (this.#payloadEnd() < offset + 4)
+                            return;
+                        this.instance.msgType.setValue((0, BufferToNumber_1.BufferToUInt32)(this.readBytes(offset, 4)));
+                    },
+                    encode: function () {
+                        const node = this.instance.msgType;
+                        let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 4294967295) {
+                            this.recordError(node.getPath(), 'Maximum value is 4294967295');
+                            value = 4294967295;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBytes(this.#messageOffset() + 4, (0, NumberToBuffer_1.UInt32ToBuffer)(value));
+                    }
+                },
+                //==== CALL identity (RFC 5531 §9, decoded only for msgType == 0) ====
+                //For NFS the program word is 100003; kept as a plain unbounded-in-practice uint (honored
+                //verbatim) rather than a hard enum so any value round-trips (never-throws contract).
+                rpcVersion: this.#callWord('rpcVersion', 8, 'RPC Version'),
+                program: this.#callWord('program', 12, 'Program'),
+                programVersion: this.#callWord('programVersion', 16, 'Program Version'),
+                procedure: this.#callWord('procedure', 20, 'Procedure'),
+                //The remainder kept verbatim: for a CALL the credential + verifier + NFS procedure
+                //arguments (from message offset 24); for a REPLY / other the whole body (from message
+                //offset 8). Bounded by #payloadEnd so a lying length can't read past the transport payload.
+                body: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const isCall = this.instance.msgType.getValue(0) === 0;
+                        const start = this.#messageOffset() + (isCall ? 24 : 8);
+                        const end = this.#payloadEnd();
+                        this.instance.body.setValue(end > start ? (0, BufferToHex_1.BufferToHex)(this.readBytes(start, end - start)) : '');
+                    },
+                    encode: function () {
+                        const isCall = this.instance.msgType.getValue(0) === 0;
+                        const start = this.#messageOffset() + (isCall ? 24 : 8);
+                        const body = this.instance.body.getValue('');
+                        if (body)
+                            this.writeBytes(start, (0, HexToBuffer_1.HexToBuffer)(body));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //NFS rides UDP/TCP port 2049 (selected via the udpport:2049 / tcpport:2049 buckets). This stays a
+        //port-bucket protocol: matchKeys only, NO heuristicFallback — the signature (XID + a Message Type
+        //of 0 or 1) is too weak to claim NFS/RPC off port 2049, and non-RPC traffic on 2049 must fall
+        //through to raw. Over TCP the message sits after the 4-byte Record Marking prefix; over UDP it is
+        //the first byte. Require the fixed XID + Message Type within the transport payload and a valid
+        //Message Type.
+        if (!this.prevCodecModule)
+            return false;
+        const isTcp = this.prevCodecModule.id === 'tcp';
+        const isUdp = this.prevCodecModule.id === 'udp';
+        if (!isTcp && !isUdp)
+            return false;
+        const offset = isTcp ? 4 : 0;
+        if (this.#payloadEnd() < offset + 8)
+            return false;
+        const msgType = (0, BufferToNumber_1.BufferToUInt32)(this.readBytes(offset + 4, 4, true));
+        return msgType === 0 || msgType === 1;
+    }
+}
+exports.NFS = NFS;

package/dist/headers/NHRP.d.ts

@@ -0,0 +1,32 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * NHRP — NBMA Next Hop Resolution Protocol (RFC 2332), carried directly over IP as protocol 54. Every
+ * NHRP packet opens with a 20-byte Fixed Header — ar$afn (Address Family Number of the NBMA network),
+ * ar$pro.type + ar$pro.snap (the protocol whose next hop is being resolved, an EtherType plus an
+ * optional SNAP), ar$hopcnt, ar$pktsz (the total NHRP packet length), ar$chksum (an IP-style
+ * ones-complement checksum over the whole NHRP packet), ar$extoff (offset to the first extension), the
+ * op.version / op.type opcode (1 Resolution Request, 2 Resolution Reply, 3 Registration Request,
+ * 4 Registration Reply, 5 Purge Request, 6 Purge Reply, 7 Error Indication), and ar$shtl / ar$sstl
+ * (the source NBMA address / subaddress type+length) — followed by the type-specific Mandatory Part and
+ * any Extensions.
+ *
+ * The Mandatory Part and Extensions are opcode-dependent, variable-length (their sub-address lengths are
+ * driven by ar$shtl and the per-entry CIE type/length octets) and carry cross-field context, so this
+ * codec keeps them verbatim as `body` hex (byte-perfect) and does not sub-decode them. Packet Length is
+ * auto-computed from the body on encode when not supplied, else honored verbatim (a crafted packet may
+ * lie); the checksum is honored verbatim, never recomputed (encode is a faithful executor). The body is
+ * bounded by both Packet Length and the enclosing IP payload, so trailing bytes are left to the codec's
+ * recursion / RawData. A well-formed packet round-trips byte-for-byte.
+ */
+export declare class NHRP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/NHRP.js

@@ -0,0 +1,154 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NHRP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * NHRP — NBMA Next Hop Resolution Protocol (RFC 2332), carried directly over IP as protocol 54. Every
+ * NHRP packet opens with a 20-byte Fixed Header — ar$afn (Address Family Number of the NBMA network),
+ * ar$pro.type + ar$pro.snap (the protocol whose next hop is being resolved, an EtherType plus an
+ * optional SNAP), ar$hopcnt, ar$pktsz (the total NHRP packet length), ar$chksum (an IP-style
+ * ones-complement checksum over the whole NHRP packet), ar$extoff (offset to the first extension), the
+ * op.version / op.type opcode (1 Resolution Request, 2 Resolution Reply, 3 Registration Request,
+ * 4 Registration Reply, 5 Purge Request, 6 Purge Reply, 7 Error Indication), and ar$shtl / ar$sstl
+ * (the source NBMA address / subaddress type+length) — followed by the type-specific Mandatory Part and
+ * any Extensions.
+ *
+ * The Mandatory Part and Extensions are opcode-dependent, variable-length (their sub-address lengths are
+ * driven by ar$shtl and the per-entry CIE type/length octets) and carry cross-field context, so this
+ * codec keeps them verbatim as `body` hex (byte-perfect) and does not sub-decode them. Packet Length is
+ * auto-computed from the body on encode when not supplied, else honored verbatim (a crafted packet may
+ * lie); the checksum is honored verbatim, never recomputed (encode is a faithful executor). The body is
+ * bounded by both Packet Length and the enclosing IP payload, so trailing bytes are left to the codec's
+ * recursion / RawData. A well-formed packet round-trips byte-for-byte.
+ */
+class NHRP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'nhrp';
+        this.name = 'NBMA Next Hop Resolution Protocol';
+        this.nickname = 'NHRP';
+        this.matchKeys = ['ipproto:54'];
+        //A leaf header — the Mandatory Part / Extensions require opcode-dependent, length-driven parsing.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (NHRP.#schemaCache ??= NHRP.#buildSchema());
+    }
+    /**
+     * Bytes of NHRP the IP layer below says are available. IPv4 carries a total-length field, so the
+     * NHRP payload is (total length - IP header length); IPv6 carries the payload length directly (plen).
+     * Mirrors the OSPF/GRE pattern so the body decode and the match gate are bounded by the real on-wire
+     * length rather than trusting the NHRP Packet Length field alone (which a malformed packet may
+     * overstate). Returns 0 when neither is present.
+     * @private
+     */
+    #available() {
+        const prev = this.prevCodecModule;
+        if (!prev)
+            return 0;
+        const ipv4TotalLength = prev.instance.length.getValue(0);
+        if (ipv4TotalLength)
+            return ipv4TotalLength - prev.length;
+        const ipv6PayloadLength = prev.instance.plen.getValue(0);
+        if (ipv6PayloadLength)
+            return ipv6PayloadLength;
+        return 0;
+    }
+    /**
+     * Header-relative end offset of the NHRP body: the Packet Length field, clamped down to the bytes the
+     * IP layer actually made available (#available). Never less than the 20-byte Fixed Header. Bounds the
+     * verbatim body so a corrupt Packet Length can't read past the IP payload.
+     * @private
+     */
+    #bodyEnd() {
+        let end = this.instance.packetSize.getValue(0);
+        const available = this.#available();
+        if (available && available < end)
+            end = available;
+        if (end < 20)
+            end = 20;
+        return end;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'NHRP op=${opType} pktsz=${packetSize}',
+            properties: {
+                //==== Fixed Header (20 bytes, RFC 2332 §5.2.0.1) ====
+                afn: this.fieldUInt('afn', 0, 2, 'Address Family Number'),
+                //The protocol being resolved, an EtherType (e.g. 0x0800 IPv4) — kept as a hex string like
+                //eth.etherType, byte-perfect and editable.
+                protocolType: this.fieldHex('protocolType', 2, 2, 'Protocol Type'),
+                protocolSnap: this.fieldHex('protocolSnap', 4, 5, 'Protocol SNAP'),
+                hopCount: this.fieldUInt('hopCount', 9, 1, 'Hop Count'),
+                packetSize: {
+                    type: 'integer',
+                    label: 'Packet Length',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        this.instance.packetSize.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(10, 2)));
+                    },
+                    encode: function () {
+                        //Packet Length counts the whole NHRP packet = 20-byte Fixed Header + body.
+                        //Honored when supplied (a crafted packet may lie); else derived from the body.
+                        const provided = this.instance.packetSize.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : 20 + (0, HexToBuffer_1.HexToBuffer)(this.instance.body.getValue('')).length;
+                        if (value > 65535) {
+                            this.recordError(this.instance.packetSize.getPath(), 'Maximum value is 65535');
+                            value = 65535;
+                        }
+                        this.instance.packetSize.setValue(value);
+                        this.writeBytes(10, (0, NumberToBuffer_1.UInt16ToBuffer)(value));
+                    }
+                },
+                //Honored verbatim: the NHRP checksum (ones-complement over the whole packet) is never
+                //recomputed, so a captured packet round-trips byte-for-byte.
+                checksum: this.fieldUInt('checksum', 12, 2, 'Checksum'),
+                extensionOffset: this.fieldUInt('extensionOffset', 14, 2, 'Extension Offset'),
+                opVersion: this.fieldUInt('opVersion', 16, 1, 'Version'),
+                opType: this.fieldUInt('opType', 17, 1, 'Operation Type'),
+                shtl: this.fieldUInt('shtl', 18, 1, 'Source NBMA Address Type/Length'),
+                sstl: this.fieldUInt('sstl', 19, 1, 'Source NBMA Subaddress Type/Length'),
+                //The type-specific Mandatory Part + Extensions after the 20-byte Fixed Header, kept
+                //verbatim. Bounded by both the Packet Length and the enclosing IP payload (#bodyEnd), so
+                //trailing / pipelined data is left to the codec's recursion / RawData.
+                body: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const end = this.#bodyEnd();
+                        this.instance.body.setValue(end > 20 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(20, end - 20)) : '');
+                    },
+                    encode: function () {
+                        const body = this.instance.body.getValue('');
+                        if (body)
+                            this.writeBytes(20, (0, HexToBuffer_1.HexToBuffer)(body));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        if (!this.prevCodecModule)
+            return false;
+        //NHRP sits directly on IP (protocol 54). Accept the demux value from either the IPv4 protocol
+        //field or the IPv6 next-header field, and require at least a full 20-byte Fixed Header of IP
+        //payload to be present.
+        const protocol = this.prevCodecModule.instance.protocol.getValue(0);
+        const nextHeader = this.prevCodecModule.instance.nxt.getValue(0);
+        if (protocol !== 54 && nextHeader !== 54)
+            return false;
+        return this.#available() >= 20;
+    }
+}
+exports.NHRP = NHRP;

package/dist/headers/NNTP.d.ts

@@ -0,0 +1,35 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * NNTP — the Network News Transfer Protocol (RFC 3977), carried as US-ASCII text over TCP well-known
+ * port 119 (and 563 for NNTPS, the TLS-wrapped variant). The control channel is line-based and
+ * structurally identical to SMTP: a client sends commands (`ARTICLE 123\r\n`, `GROUP misc.test\r\n`,
+ * `POST\r\n`, `CAPABILITIES\r\n`, `QUIT\r\n`) and a server sends 3-digit-coded replies
+ * (`200 news.example.com ready\r\n`, `211 1234 3000234 3002322 misc.test\r\n`, `340 send article\r\n`);
+ * a multi-line reply repeats/marks the code with a '-' after the first line. The article/list data
+ * blocks that follow certain replies use the same line channel but their arbitrary content is out of
+ * scope — only the control channel is claimed here.
+ *
+ * Like SMTP, FTP, Syslog, SIP and HTTP, the message is text whose full internal structure (arbitrary
+ * arguments, significant whitespace, multi-line reply continuations) is richer than a form needs. So the
+ * ENTIRE raw message is kept verbatim as the authoritative `message` field (hex) and re-emitted
+ * untouched; only the first line is parsed on decode into display-only metadata (command/argument for a
+ * command, replyCode/replyText for a reply). Encode never reconstructs the message from the parsed
+ * fields — it writes `message` back byte-for-byte — so any conformant (or even malformed) NNTP line
+ * round-trips exactly.
+ *
+ * Note: a single TCP segment may carry more than one control line (pipelined commands) or only part of
+ * a multi-line reply/article block; reassembly across segments is out of scope. This single-segment
+ * codec keeps whatever bytes are present verbatim, which is byte-perfect for the single-packet case.
+ */
+export declare class NNTP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/NNTP.js

@@ -0,0 +1,162 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NNTP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/** NNTP command verbs (RFC 3977 + common extensions) used only to recognize a command line. */
+const NNTP_COMMANDS = ['ARTICLE', 'BODY', 'HEAD', 'STAT', 'GROUP', 'LISTGROUP', 'LAST', 'NEXT', 'POST', 'IHAVE', 'QUIT', 'CAPABILITIES', 'MODE', 'LIST', 'NEWGROUPS', 'NEWNEWS', 'OVER', 'XOVER', 'HDR', 'XHDR', 'HELP', 'DATE', 'AUTHINFO', 'STARTTLS'];
+/**
+ * NNTP — the Network News Transfer Protocol (RFC 3977), carried as US-ASCII text over TCP well-known
+ * port 119 (and 563 for NNTPS, the TLS-wrapped variant). The control channel is line-based and
+ * structurally identical to SMTP: a client sends commands (`ARTICLE 123\r\n`, `GROUP misc.test\r\n`,
+ * `POST\r\n`, `CAPABILITIES\r\n`, `QUIT\r\n`) and a server sends 3-digit-coded replies
+ * (`200 news.example.com ready\r\n`, `211 1234 3000234 3002322 misc.test\r\n`, `340 send article\r\n`);
+ * a multi-line reply repeats/marks the code with a '-' after the first line. The article/list data
+ * blocks that follow certain replies use the same line channel but their arbitrary content is out of
+ * scope — only the control channel is claimed here.
+ *
+ * Like SMTP, FTP, Syslog, SIP and HTTP, the message is text whose full internal structure (arbitrary
+ * arguments, significant whitespace, multi-line reply continuations) is richer than a form needs. So the
+ * ENTIRE raw message is kept verbatim as the authoritative `message` field (hex) and re-emitted
+ * untouched; only the first line is parsed on decode into display-only metadata (command/argument for a
+ * command, replyCode/replyText for a reply). Encode never reconstructs the message from the parsed
+ * fields — it writes `message` back byte-for-byte — so any conformant (or even malformed) NNTP line
+ * round-trips exactly.
+ *
+ * Note: a single TCP segment may carry more than one control line (pipelined commands) or only part of
+ * a multi-line reply/article block; reassembly across segments is out of scope. This single-segment
+ * codec keeps whatever bytes are present verbatim, which is byte-perfect for the single-packet case.
+ */
+class NNTP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'nntp';
+        this.name = 'Network News Transfer Protocol';
+        this.nickname = 'NNTP';
+        //NNTP is recognized ONLY on its well-known port buckets 119 (news) and 563 (NNTPS/TLS) —
+        //deliberately NOT via heuristicFallback. Unlike HTTP/RTSP (whose method sets are distinctive),
+        //NNTP's line signature is a 3-digit reply code or a generic verb (QUIT/HELP/LIST/HEAD/BODY/STAT/…)
+        //that is SHARED with other US-ASCII line protocols this codec models — SMTP (HELP/QUIT), FTP (QUIT/
+        //HELP/LIST/STAT), POP3 (QUIT/STAT/LIST), IRC (QUIT), and any NNN-code greeting (FTP/SMTP). Joining
+        //the global heuristic chain would mislabel all of those as NNTP on their own ports. Confining NNTP to
+        //the tcp:119/tcp:563 buckets keeps that collision impossible (SMTP/FTP/POP3/IRC live on 25/21/110/
+        //6667, which never reach these buckets); alt-port NNTP is rare and falls losslessly to raw. (NNTPS on
+        //563 is normally TLS-wrapped, so the bucket rarely carries plain NNTP text, but is listed for
+        //completeness/STARTTLS-downgrade traffic.)
+        this.matchKeys = ['tcpport:119', 'tcpport:563'];
+        //A leaf header — the article/list data blocks and the news session they belong to are a higher-layer
+        //concern.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (_a.#schemaCache ??= _a.#buildSchema());
+    }
+    /**
+     * Bytes of this header: NNTP rides on TCP, which has no per-message length, so take the rest of the
+     * segment. Reassembly across segments is out of scope (see class doc).
+     */
+    #payloadLength() {
+        const available = this.packet.length - this.startPos;
+        return available < 0 ? 0 : available;
+    }
+    /** The first line of the message (up to the first CRLF, or the whole payload if none). */
+    static #firstLine(text) {
+        const idx = text.indexOf('\r\n');
+        return idx >= 0 ? text.slice(0, idx) : text;
+    }
+    /**
+     * Parse the first line into the display-only metadata fields. A line matching `^\d{3}[ -]` is a
+     * server reply (the code, whether it is multi-line, and the trailing text); anything else is a
+     * client command (the uppercased verb and its argument). Populated on decode only — these fields
+     * have no encode, so they never affect the re-emitted bytes and never mutate `message`. Never
+     * throws: missing/garbage tokens yield empty strings or 0.
+     */
+    #parseFirstLine(text) {
+        const line = _a.#firstLine(text);
+        const reply = line.match(/^(\d{3})([ -])(.*)$/);
+        if (reply) {
+            //Reply: 3-digit code, then ' ' (final) or '-' (a multi-line continuation follows).
+            this.instance.isReply.setValue(true);
+            this.instance.replyCode.setValue(Number(reply[1]));
+            this.instance.isMultiline.setValue(reply[2] === '-');
+            this.instance.replyText.setValue(reply[3]);
+            this.instance.command.setValue('');
+            this.instance.argument.setValue('');
+            return;
+        }
+        //Command: VERB SP argument (the argument may itself contain spaces, e.g. a message-id or range).
+        const idx = line.indexOf(' ');
+        const verb = idx >= 0 ? line.slice(0, idx) : line;
+        this.instance.isReply.setValue(false);
+        this.instance.replyCode.setValue(0);
+        this.instance.isMultiline.setValue(false);
+        this.instance.replyText.setValue('');
+        this.instance.command.setValue(verb.toUpperCase());
+        this.instance.argument.setValue(idx >= 0 ? line.slice(idx + 1) : '');
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'NNTP ${command}${replyCode}',
+            properties: {
+                //The whole raw message is the single source of truth: decoded verbatim to hex and
+                //re-emitted untouched (byte-perfect for any NNTP control text). The first line is parsed
+                //into the display-only metadata below, which carry no codec of their own.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        if (available <= 0) {
+                            this.instance.message.setValue('');
+                            this.#parseFirstLine('');
+                            return;
+                        }
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parseFirstLine(raw.toString('latin1'));
+                    },
+                    encode: function () {
+                        //Re-emit the authoritative message verbatim — never reconstruct from metadata.
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                },
+                //Display-only metadata parsed from the first line on decode (no encode — populated by the
+                //message field above, never read back). isReply distinguishes a server reply from a
+                //client command; replyCode/isMultiline/replyText describe a reply, command/argument a
+                //command.
+                isReply: { type: 'boolean', label: 'Is Reply' },
+                replyCode: { type: 'integer', label: 'Reply Code', minimum: 0, maximum: 999 },
+                isMultiline: { type: 'boolean', label: 'Is Multiline' },
+                replyText: { type: 'string', label: 'Reply Text' },
+                command: { type: 'string', label: 'Command' },
+                argument: { type: 'string', label: 'Argument' }
+            }
+        };
+    }
+    match() {
+        //NNTP rides on TCP as US-ASCII text. Recognize it by the line signature: a 3-digit reply code
+        //followed by space or '-', or a known command verb as the leading token (up to the first space
+        //or CR) — so non-NNTP traffic on port 119/563 falls through to raw rather than claiming an
+        //un-decodable text layer.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.#payloadLength() < 3)
+            return false;
+        const lead = this.readBytes(0, 16, true).toString('latin1');
+        if (/^\d{3}[ -]/.test(lead))
+            return true;
+        const line = _a.#firstLine(lead);
+        const token = (line.split(/[ \r]/)[0] || '').toUpperCase();
+        return NNTP_COMMANDS.includes(token);
+    }
+}
+exports.NNTP = NNTP;
+_a = NNTP;