@netkitty/codec 1.0.0

package/dist/headers/SOCKS4.js

@@ -0,0 +1,302 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SOCKS4 = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const BufferToIP_1 = require("../helper/BufferToIP");
+const IPToBuffer_1 = require("../helper/IPToBuffer");
+/**
+ * SOCKS4 — the SOCKS Protocol Version 4 (and the SOCKS4a extension), carried over TCP well-known
+ * port 1080. Only two message shapes travel on the wire, discriminated by their leading octet:
+ *
+ *   1. Client request : version(1,=4) · command(1: 1 CONNECT / 2 BIND) · dstPort(2, BE) ·
+ *                        dstIp(4, IPv4) · userId(null-terminated ASCII) [· domain(null-terminated)]
+ *   2. Server reply   : null(1,=0) · status(1: 0x5A granted, 0x5B/0x5C/0x5D rejected) ·
+ *                        dstPort(2, BE) · dstIp(4, IPv4)   — always exactly 8 octets
+ *
+ * The two shapes share their tail exactly — dstPort at offset 2 and dstIp at offset 4 — so those
+ * fields are common to both; only the leading octet (version 4 vs null 0), the second octet
+ * (command vs status), and the request's trailing user-id are shape-specific. A `messageType`
+ * display field ('request' | 'reply') is the discriminator, decoded from the leading octet
+ * (4 → request, 0 → reply) and driving every field below.
+ *
+ * SOCKS4a: when the request's dstIp is 0.0.0.x (first three octets zero, last non-zero) the client
+ * could not resolve the host and appends a second null-terminated string — the destination domain —
+ * after the user-id. The codec structures that trailing string as `domain` whenever bytes remain
+ * after the user-id's terminator, so both plain SOCKS4 and SOCKS4a requests round-trip byte-for-byte.
+ * (A request whose user-id lacks its RFC-mandated null terminator is malformed: it decodes
+ * best-effort but re-emits with the terminator, so the byte-perfect guarantee is for conformant
+ * SOCKS4 only.)
+ *
+ * Matching rationale (NO heuristicFallback): SOCKS4 is claimed ONLY on the tcp:1080 bucket. Its only
+ * content signature is a single leading octet of 0x04 (request) or 0x00 (reply) — a signature that
+ * matches enormous amounts of arbitrary binary TCP data; recognition therefore depends entirely on
+ * the well-known port. Joining the global content-heuristic chain would mislabel unrelated binary
+ * traffic on any port, so SOCKS4 is confined to tcp:1080 and alt-port SOCKS4 falls losslessly to raw.
+ */
+class SOCKS4 extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'socks4';
+        this.name = 'SOCKS4';
+        this.nickname = 'SOCKS4';
+        //SOCKS4 is recognized ONLY on the well-known port 1080 — deliberately NOT via heuristicFallback.
+        //Its only content signature is a single leading 0x04/0x00 octet, which matches vast amounts of
+        //arbitrary binary TCP data; recognition depends entirely on the port bucket. See the class doc.
+        this.matchKeys = ['tcpport:1080'];
+        //A leaf header — SOCKS4 tunnels an arbitrary application stream once the request is granted; its
+        //relayed payload is not demuxed off this header.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (SOCKS4.#schemaCache ??= SOCKS4.#buildSchema());
+    }
+    /** Bytes available to this header: SOCKS4 rides on TCP, which has no per-message length. */
+    #payloadLength() {
+        const available = this.packet.length - this.startPos;
+        return available < 0 ? 0 : available;
+    }
+    /** True when the leading octet marks a client request (version 4) rather than a server reply. */
+    #isRequest() {
+        return this.instance.messageType.getValue('request') === 'request';
+    }
+    /**
+     * Read a null-terminated latin1 string at `offset` (bounded by the captured length); returns its
+     * value plus the offset one past the terminator (or the end of buffer if never terminated).
+     */
+    #readCString(offset, available) {
+        let p = offset;
+        while (p < available && this.readBytes(p, 1, true)[0] !== 0)
+            p++;
+        const value = p > offset ? this.readBytes(offset, p - offset).toString('latin1') : '';
+        let next = p;
+        if (p < available) {
+            this.readBytes(p, 1); //consume the null terminator (extends headerLength)
+            next = p + 1;
+        }
+        return { value: value, next: next };
+    }
+    /** Write a latin1 string plus its null terminator at `offset`; returns the offset past the terminator. */
+    #writeCString(offset, value) {
+        const bytes = Buffer.from(value ? value : '', 'latin1');
+        this.writeBytes(offset, bytes);
+        this.writeBytes(offset + bytes.length, Buffer.from([0]));
+        return offset + bytes.length + 1;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'SOCKS4 ${messageType}',
+            properties: {
+                //Discriminator + display field. Decoded from the leading octet (4 → request, 0 →
+                //reply); on encode it is supplied by the input (default 'request') and read by every
+                //field below to decide which bytes it owns.
+                messageType: {
+                    type: 'string',
+                    label: 'Message Type',
+                    enum: ['request', 'reply'],
+                    default: 'request',
+                    decode: function () {
+                        const lead = this.#payloadLength() >= 1 ? this.readBytes(0, 1, true).readUInt8(0) : 4;
+                        this.instance.messageType.setValue(lead === 0 ? 'reply' : 'request');
+                    }
+                },
+                //Leading octet, common to both shapes: 0x04 for a request, 0x00 (the "null" byte) for
+                //a reply. Structured for both so the common tail (port, ip) sits at fixed offsets.
+                version: {
+                    type: 'integer',
+                    label: 'Version',
+                    minimum: 0,
+                    maximum: 255,
+                    default: 4,
+                    decode: function () {
+                        this.instance.version.setValue(this.readBytes(0, 1).readUInt8(0));
+                    },
+                    encode: function () {
+                        const node = this.instance.version;
+                        let value = node.getValue(this.#isRequest() ? 4 : 0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 255) {
+                            this.recordError(node.getPath(), 'Maximum value is 255');
+                            value = 255;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBytes(0, Buffer.from([value]));
+                    }
+                },
+                //REQUEST shape: the SOCKS command at offset 1 (1 = CONNECT, 2 = BIND).
+                command: {
+                    type: 'integer',
+                    label: 'Command',
+                    enum: [1, 2],
+                    minimum: 0,
+                    maximum: 255,
+                    default: 1,
+                    decode: function () {
+                        if (!this.#isRequest()) {
+                            this.instance.command.setValue(1);
+                            return;
+                        }
+                        this.instance.command.setValue(this.readBytes(1, 1).readUInt8(0));
+                    },
+                    encode: function () {
+                        if (!this.#isRequest())
+                            return;
+                        const node = this.instance.command;
+                        let value = node.getValue(1, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 255) {
+                            this.recordError(node.getPath(), 'Maximum value is 255');
+                            value = 255;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBytes(1, Buffer.from([value]));
+                    }
+                },
+                //REPLY shape: the reply status code at offset 1 (0x5A granted, 0x5B request rejected
+                //or failed, 0x5C/0x5D identd failures).
+                status: {
+                    type: 'integer',
+                    label: 'Status',
+                    enum: [0x5a, 0x5b, 0x5c, 0x5d],
+                    minimum: 0,
+                    maximum: 255,
+                    default: 0x5a,
+                    decode: function () {
+                        if (this.#isRequest()) {
+                            this.instance.status.setValue(0x5a);
+                            return;
+                        }
+                        this.instance.status.setValue(this.readBytes(1, 1).readUInt8(0));
+                    },
+                    encode: function () {
+                        if (this.#isRequest())
+                            return;
+                        const node = this.instance.status;
+                        let value = node.getValue(0x5a, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 255) {
+                            this.recordError(node.getPath(), 'Maximum value is 255');
+                            value = 255;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBytes(1, Buffer.from([value]));
+                    }
+                },
+                //Common to both shapes: the destination (request) / bound (reply) port at offset 2,
+                //big-endian.
+                dstPort: {
+                    type: 'integer',
+                    label: 'Destination Port',
+                    minimum: 0,
+                    maximum: 65535,
+                    default: 0,
+                    decode: function () {
+                        this.instance.dstPort.setValue(this.#payloadLength() >= 4 ? (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(2, 2)) : 0);
+                    },
+                    encode: function () {
+                        const node = this.instance.dstPort;
+                        let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 65535) {
+                            this.recordError(node.getPath(), 'Maximum value is 65535');
+                            value = 65535;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBytes(2, (0, NumberToBuffer_1.UInt16ToBuffer)(value));
+                    }
+                },
+                //Common to both shapes: the destination (request) / bound (reply) IPv4 address at
+                //offset 4. A request whose first three octets are zero and last non-zero is SOCKS4a
+                //(the real host is carried by the trailing `domain`).
+                dstIp: {
+                    type: 'string',
+                    label: 'Destination IP',
+                    default: '0.0.0.0',
+                    decode: function () {
+                        this.instance.dstIp.setValue(this.#payloadLength() >= 8 ? (0, BufferToIP_1.BufferToIPv4)(this.readBytes(4, 4)) : '0.0.0.0');
+                    },
+                    encode: function () {
+                        const value = this.instance.dstIp.getValue('0.0.0.0');
+                        this.writeBytes(4, (0, IPToBuffer_1.IPv4ToBuffer)(value ? value : '0.0.0.0'));
+                    }
+                },
+                //REQUEST shape: the null-terminated user-id (SOCKS4 authentication identifier) at
+                //offset 8. Kept verbatim (latin1) and re-emitted with its null terminator.
+                userId: {
+                    type: 'string',
+                    label: 'User ID',
+                    default: '',
+                    decode: function () {
+                        if (!this.#isRequest()) {
+                            this.instance.userId.setValue('');
+                            return;
+                        }
+                        const available = this.#payloadLength();
+                        this.instance.userId.setValue(this.#readCString(8, available).value);
+                    },
+                    encode: function () {
+                        if (!this.#isRequest())
+                            return;
+                        this.#writeCString(8, this.instance.userId.getValue(''));
+                    }
+                },
+                //REQUEST shape (SOCKS4a): the null-terminated destination domain that follows the
+                //user-id when the client could not resolve the host (dstIp 0.0.0.x). Structured
+                //whenever bytes remain after the user-id terminator, so SOCKS4a round-trips exactly.
+                domain: {
+                    type: 'string',
+                    label: 'Domain',
+                    default: '',
+                    decode: function () {
+                        if (!this.#isRequest()) {
+                            this.instance.domain.setValue('');
+                            return;
+                        }
+                        const available = this.#payloadLength();
+                        const afterUser = this.#readCString(8, available).next;
+                        this.instance.domain.setValue(afterUser < available ? this.#readCString(afterUser, available).value : '');
+                    },
+                    encode: function () {
+                        if (!this.#isRequest())
+                            return;
+                        const domain = this.instance.domain.getValue('');
+                        if (!domain)
+                            return;
+                        const userBytes = Buffer.from(this.instance.userId.getValue(''), 'latin1');
+                        this.#writeCString(8 + userBytes.length + 1, domain);
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Port-bucket (tcp:1080) + leading-octet signature. Reached only on the tcp:1080 bucket.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'tcp')
+            return false;
+        const available = this.#payloadLength();
+        //A reply is exactly 8 octets; a request is at least 9 (its user-id contributes a terminator).
+        //Require the 8-octet common span and a leading 0x04 (request) or 0x00 (reply).
+        if (available < 8)
+            return false;
+        const lead = this.readBytes(0, 1, true).readUInt8(0);
+        return lead === 4 || lead === 0;
+    }
+}
+exports.SOCKS4 = SOCKS4;

package/dist/headers/SOCKS5.d.ts

@@ -0,0 +1,45 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * SOCKS5 — the SOCKS Protocol Version 5 (RFC 1928), carried over TCP well-known port 1080.
+ *
+ * A SOCKS5 conversation is a short handshake of four message shapes, all beginning with a version octet
+ * (0x05):
+ *
+ *   1. Client greeting          : version(1,=5) · nMethods(1) · methods(nMethods)
+ *   2. Server method selection  : version(1,=5) · method(1)
+ *   3. Client request           : version(1,=5) · cmd(1) · rsv(1,=0) · atyp(1) · dstAddr(var) · dstPort(2)
+ *   4. Server reply             : version(1,=5) · rep(1) · rsv(1,=0) · atyp(1) · bndAddr(var) · bndPort(2)
+ *
+ * Design choice (documented): only the CLIENT GREETING is fully structured — it is the one message whose
+ * length is self-describing (nMethods exactly bounds the methods list), so it can be recognized and split
+ * with no ambiguity. The other three shapes carry a conditional, address-type-dependent address whose
+ * structuring is a later slice; here they are kept BYTE-VERBATIM after the common version octet as a
+ * single `data` hex field. So every SOCKS5 message is: version (structured) + either {nMethods, methods}
+ * (greeting) or {data} (everything else). A `messageType` display field ('greeting' | 'other') is the
+ * discriminator, and drives the one-line summary. Any well-formed message round-trips byte-for-byte.
+ *
+ * Greeting recognition is exact: version 5, at least one method offered (nMethods ≥ 1), and the payload
+ * length equal to 2 + nMethods (the octets nMethods claims are exactly the octets present). This keeps a
+ * two-byte server method-selection (`05 xx`, nMethods would read as 0) out of the greeting shape, and a
+ * lying nMethods that over-claims the remaining bytes is NOT mistaken for a greeting — it stays 'other'
+ * and is preserved verbatim, so the decoder never trusts nMethods to read past the captured bytes.
+ *
+ * Matching rationale (NO heuristicFallback): SOCKS5 is claimed ONLY on the tcp:1080 bucket. Its only
+ * content signature is a leading 0x05 version octet — a single byte with no further magic, which matches
+ * an enormous amount of arbitrary binary TCP data. Recognition therefore depends entirely on the
+ * well-known port; joining the global content-heuristic chain would mislabel unrelated binary traffic on
+ * any port. Confining SOCKS5 to tcp:1080 keeps that impossible; alt-port SOCKS5 is rare and falls
+ * losslessly to raw.
+ */
+export declare class SOCKS5 extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/SOCKS5.js

@@ -0,0 +1,223 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SOCKS5 = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * SOCKS5 — the SOCKS Protocol Version 5 (RFC 1928), carried over TCP well-known port 1080.
+ *
+ * A SOCKS5 conversation is a short handshake of four message shapes, all beginning with a version octet
+ * (0x05):
+ *
+ *   1. Client greeting          : version(1,=5) · nMethods(1) · methods(nMethods)
+ *   2. Server method selection  : version(1,=5) · method(1)
+ *   3. Client request           : version(1,=5) · cmd(1) · rsv(1,=0) · atyp(1) · dstAddr(var) · dstPort(2)
+ *   4. Server reply             : version(1,=5) · rep(1) · rsv(1,=0) · atyp(1) · bndAddr(var) · bndPort(2)
+ *
+ * Design choice (documented): only the CLIENT GREETING is fully structured — it is the one message whose
+ * length is self-describing (nMethods exactly bounds the methods list), so it can be recognized and split
+ * with no ambiguity. The other three shapes carry a conditional, address-type-dependent address whose
+ * structuring is a later slice; here they are kept BYTE-VERBATIM after the common version octet as a
+ * single `data` hex field. So every SOCKS5 message is: version (structured) + either {nMethods, methods}
+ * (greeting) or {data} (everything else). A `messageType` display field ('greeting' | 'other') is the
+ * discriminator, and drives the one-line summary. Any well-formed message round-trips byte-for-byte.
+ *
+ * Greeting recognition is exact: version 5, at least one method offered (nMethods ≥ 1), and the payload
+ * length equal to 2 + nMethods (the octets nMethods claims are exactly the octets present). This keeps a
+ * two-byte server method-selection (`05 xx`, nMethods would read as 0) out of the greeting shape, and a
+ * lying nMethods that over-claims the remaining bytes is NOT mistaken for a greeting — it stays 'other'
+ * and is preserved verbatim, so the decoder never trusts nMethods to read past the captured bytes.
+ *
+ * Matching rationale (NO heuristicFallback): SOCKS5 is claimed ONLY on the tcp:1080 bucket. Its only
+ * content signature is a leading 0x05 version octet — a single byte with no further magic, which matches
+ * an enormous amount of arbitrary binary TCP data. Recognition therefore depends entirely on the
+ * well-known port; joining the global content-heuristic chain would mislabel unrelated binary traffic on
+ * any port. Confining SOCKS5 to tcp:1080 keeps that impossible; alt-port SOCKS5 is rare and falls
+ * losslessly to raw.
+ */
+class SOCKS5 extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'socks5';
+        this.name = 'SOCKS5';
+        this.nickname = 'SOCKS5';
+        //SOCKS5 is recognized ONLY on the well-known port 1080 — deliberately NOT via heuristicFallback. Its
+        //only content signature is a single 0x05 version octet, which matches vast amounts of arbitrary
+        //binary TCP data; recognition depends entirely on the port bucket. See the class doc for the full
+        //rationale.
+        this.matchKeys = ['tcpport:1080'];
+        //A leaf header — SOCKS5 tunnels an arbitrary application stream once the handshake completes; its
+        //relayed payload is not demuxed off this header.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (SOCKS5.#schemaCache ??= SOCKS5.#buildSchema());
+    }
+    /** Bytes available to this header: SOCKS5 rides on TCP, which has no per-message length. */
+    #payloadLength() {
+        const available = this.packet.length - this.startPos;
+        return available < 0 ? 0 : available;
+    }
+    /**
+     * True when the payload is a well-formed client greeting: version 5, at least one method offered,
+     * and the captured length is exactly 2 + nMethods (nMethods bounds the methods list precisely).
+     * Never over-reads: only inspects the first two octets.
+     */
+    #isGreeting() {
+        const available = this.#payloadLength();
+        if (available < 3)
+            return false;
+        const head = this.readBytes(0, 2, true);
+        if (head.readUInt8(0) !== 5)
+            return false;
+        const nMethods = head.readUInt8(1);
+        if (nMethods < 1)
+            return false;
+        return available === 2 + nMethods;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'SOCKS5 ${messageType}',
+            properties: {
+                //Discriminator + display field. Decoded from the payload shape; on encode it is supplied
+                //by the input (default 'other') and read by every field below to decide which bytes it
+                //owns. 'greeting' → {version, nMethods, methods}; 'other' → {version, data}.
+                messageType: {
+                    type: 'string',
+                    label: 'Message Type',
+                    enum: ['greeting', 'other'],
+                    default: 'other',
+                    decode: function () {
+                        this.instance.messageType.setValue(this.#isGreeting() ? 'greeting' : 'other');
+                    }
+                },
+                //Common to every SOCKS5 message: the version octet (always 0x05). Structured for both
+                //shapes, so the verbatim `data` of a non-greeting holds only the bytes AFTER the version.
+                version: {
+                    type: 'integer',
+                    label: 'Version',
+                    minimum: 0,
+                    maximum: 255,
+                    default: 5,
+                    decode: function () {
+                        this.instance.version.setValue(this.readBytes(0, 1).readUInt8(0));
+                    },
+                    encode: function () {
+                        const node = this.instance.version;
+                        let value = node.getValue(5, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 255) {
+                            this.recordError(node.getPath(), 'Maximum value is 255');
+                            value = 255;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBytes(0, Buffer.from([value]));
+                    }
+                },
+                //GREETING shape: the count of authentication methods the client offers.
+                nMethods: {
+                    type: 'integer',
+                    label: 'Number of Methods',
+                    minimum: 0,
+                    maximum: 255,
+                    default: 0,
+                    decode: function () {
+                        if (this.instance.messageType.getValue('other') !== 'greeting') {
+                            this.instance.nMethods.setValue(0);
+                            return;
+                        }
+                        this.instance.nMethods.setValue(this.readBytes(1, 1).readUInt8(0));
+                    },
+                    encode: function () {
+                        if (this.instance.messageType.getValue('other') !== 'greeting')
+                            return;
+                        const node = this.instance.nMethods;
+                        let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        if (value > 255) {
+                            this.recordError(node.getPath(), 'Maximum value is 255');
+                            value = 255;
+                        }
+                        if (value < 0) {
+                            this.recordError(node.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        node.setValue(value);
+                        this.writeBytes(1, Buffer.from([value]));
+                    }
+                },
+                //GREETING shape: the offered method identifiers, kept verbatim as hex. Bounded by nMethods
+                //AND by the captured bytes — a lying nMethods can never make this read past the buffer.
+                methods: {
+                    type: 'string',
+                    label: 'Methods',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    default: '',
+                    decode: function () {
+                        if (this.instance.messageType.getValue('other') !== 'greeting') {
+                            this.instance.methods.setValue('');
+                            return;
+                        }
+                        const nMethods = this.instance.nMethods.getValue(0);
+                        const remaining = this.#payloadLength() - 2;
+                        const count = nMethods < remaining ? nMethods : (remaining < 0 ? 0 : remaining);
+                        this.instance.methods.setValue(count > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(2, count)) : '');
+                    },
+                    encode: function () {
+                        if (this.instance.messageType.getValue('other') !== 'greeting')
+                            return;
+                        const methods = this.instance.methods.getValue('');
+                        if (methods)
+                            this.writeBytes(2, (0, HexToBuffer_1.HexToBuffer)(methods));
+                    }
+                },
+                //NON-GREETING shape ('other'): every SOCKS5 message that is not a client greeting
+                //(method selection, request, reply) is kept BYTE-VERBATIM after the version octet — from
+                //offset 1 to the end of the captured bytes. Structuring the request/reply address is a
+                //later slice; this preserves the exact bytes and round-trips them untouched.
+                data: {
+                    type: 'string',
+                    label: 'Data',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    default: '',
+                    decode: function () {
+                        if (this.instance.messageType.getValue('other') === 'greeting') {
+                            this.instance.data.setValue('');
+                            return;
+                        }
+                        const remaining = this.#payloadLength() - 1;
+                        this.instance.data.setValue(remaining > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(1, remaining)) : '');
+                    },
+                    encode: function () {
+                        if (this.instance.messageType.getValue('other') === 'greeting')
+                            return;
+                        const data = this.instance.data.getValue('');
+                        if (data)
+                            this.writeBytes(1, (0, HexToBuffer_1.HexToBuffer)(data));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Port-bucket (tcp:1080) + version-5 signature. Reached only on the tcp:1080 bucket.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'tcp')
+            return false;
+        const available = this.#payloadLength();
+        //Every SOCKS5 message is at least 2 octets (version + one more) and starts with version 0x05.
+        if (available < 2)
+            return false;
+        if (this.readBytes(0, 1, true).readUInt8(0) !== 5)
+            return false;
+        return true;
+    }
+}
+exports.SOCKS5 = SOCKS5;

package/dist/headers/SSDP.d.ts

@@ -0,0 +1,27 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * SSDP — the Simple Service Discovery Protocol (UPnP Device Architecture), the discovery layer of UPnP
+ * carried over UDP port 1900 (advertisements/searches to the multicast group 239.255.255.250, unicast
+ * search responses). An SSDP message is HTTP/1.1-shaped US-ASCII text but is NOT HTTP: a start-line,
+ * then header lines, and a terminating CRLF. Requests use `NOTIFY * HTTP/1.1` (advertise) or
+ * `M-SEARCH * HTTP/1.1` (search); responses use a `HTTP/1.1 200 OK` Status-Line.
+ *
+ * Like SIP and HTTP, the message body is text whose full internal structure (HOST/NT/NTS/USN/ST/MAN/…
+ * header fields, significant whitespace/header ordering/casing) is far richer than a form needs. So the
+ * ENTIRE raw message is kept verbatim as the authoritative `message` field (hex) and re-emitted
+ * untouched; only the start-line is parsed on decode into display-only metadata (method/uri/version or
+ * status-code/reason). Encode never reconstructs the message from the parsed fields — it writes
+ * `message` back byte-for-byte — so any conformant (or even malformed) SSDP message round-trips exactly.
+ */
+export declare class SSDP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}