@netkitty/codec 1.0.0

package/dist/headers/Telnet.js

@@ -0,0 +1,193 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Telnet = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/** The Interpret As Command escape (RFC 854): every in-band command begins with this byte. */
+const IAC = 0xFF;
+/** SE — the byte that ends a subnegotiation (paired as `IAC SE`, i.e. FF F0). */
+const SE = 0xF0;
+/** Command byte → mnemonic (RFC 854 §Commands; 255 is the escaped-IAC data byte, shown as "IAC"). */
+const COMMAND_NAMES = {
+    240: 'SE', 241: 'NOP', 242: 'DM', 243: 'BRK', 244: 'IP', 245: 'AO', 246: 'AYT',
+    247: 'EC', 248: 'EL', 249: 'GA', 250: 'SB', 251: 'WILL', 252: 'WONT', 253: 'DO',
+    254: 'DONT', 255: 'IAC'
+};
+/** Common Telnet option codes → name (display only; unknown options resolve to ''). */
+const OPTION_NAMES = {
+    0: 'Binary Transmission', 1: 'Echo', 3: 'Suppress Go Ahead', 5: 'Status',
+    6: 'Timing Mark', 24: 'Terminal Type', 31: 'Window Size (NAWS)', 32: 'Terminal Speed',
+    33: 'Remote Flow Control', 34: 'Linemode', 35: 'X Display Location', 36: 'Environment Option',
+    39: 'New Environment Option'
+};
+/**
+ * Telnet — the Telnet Protocol (RFC 854), carried over TCP well-known port 23. Telnet is a raw byte
+ * stream that interleaves user data with in-band control commands. A command is introduced by the IAC
+ * (Interpret As Command) escape 0xFF and is followed by a command byte:
+ *
+ *   241 NOP · 242 DM · 243 BRK · 244 IP · 245 AO · 246 AYT · 247 EC · 248 EL · 249 GA   (2-byte commands)
+ *   251 WILL · 252 WONT · 253 DO · 254 DONT                                             (3-byte: FF <cmd> <option>)
+ *   250 SB … 240 SE                                                                     (subnegotiation, ends at FF F0)
+ *   255                                                                                 (escaped IAC — a literal 0xFF DATA byte)
+ *
+ * MINIMAL slice (mirrors the SSH/RFB verbatim-message pattern): the connection is a stream with no
+ * per-message framing, so the ENTIRE payload is the single source of truth — decoded verbatim to hex in
+ * the authoritative `message` field and re-emitted byte-for-byte on encode. On top of that, the leading
+ * run of IAC command sequences is parsed into DISPLAY-ONLY metadata: `commands` (an array of
+ * {command, option?}) and `isNegotiation` (true when the payload opens with an IAC byte). Those carry no
+ * codec of their own and never reconstruct the bytes — the message owns them. So any Telnet payload
+ * (option negotiation, subnegotiation, plain data, or a truncated fragment) round-trips exactly.
+ *
+ * Matching rationale (NO heuristicFallback): Telnet is claimed ONLY on the tcp:23 bucket. Telnet has NO
+ * distinctive off-port content signature — it is an arbitrary byte stream (a leading IAC is common but
+ * optional, and in binary mode the data can be anything), so recognizing it relies entirely on the
+ * well-known port. Joining the global content-heuristic chain would therefore let Telnet mislabel
+ * arbitrary TCP payloads on any port. Confining Telnet to tcp:23 keeps that impossible; alt-port Telnet
+ * is rare and falls losslessly to raw. For the same reason match() deliberately does NOT gate on a
+ * leading IAC or printable text: on the port-23 bucket every payload IS Telnet (including binary-mode
+ * data), so any non-empty payload is kept verbatim rather than dropped to raw.
+ */
+class Telnet extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'telnet';
+        this.name = 'Telnet';
+        this.nickname = 'Telnet';
+        //Telnet is recognized ONLY on the well-known port 23 — deliberately NOT via heuristicFallback. Telnet
+        //is a raw byte stream with no distinctive off-port content signature (a leading IAC is common but
+        //optional, and binary-mode data is arbitrary), so its recognition depends entirely on the port bucket;
+        //joining the global heuristic chain would mislabel arbitrary TCP traffic. See the class doc.
+        this.matchKeys = ['tcpport:23'];
+        //A leaf header — the Telnet byte stream is the terminal session itself; nothing demuxes off it.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (Telnet.#schemaCache ??= Telnet.#buildSchema());
+    }
+    /** Bytes available to this header: Telnet rides on TCP, which has no per-message length. */
+    #payloadLength() {
+        const available = this.packet.length - this.startPos;
+        return available < 0 ? 0 : available;
+    }
+    /**
+     * Parse the leading run of IAC command sequences into the display-only `commands` array and set
+     * `isNegotiation`. Populated on decode only — these fields have no encode, so they never affect the
+     * re-emitted bytes and never mutate `message`. Never throws: a dangling/truncated IAC simply stops
+     * the walk, and a payload with no leading IAC yields an empty list.
+     */
+    #parseCommands(raw) {
+        const len = raw.length;
+        this.instance.isNegotiation.setValue(len >= 1 && raw[0] === IAC);
+        const commands = [];
+        let offset = 0;
+        while (offset < len && raw[offset] === IAC) {
+            //A dangling IAC at end-of-buffer is not a complete command — stop.
+            if (offset + 1 >= len)
+                break;
+            const cmd = raw[offset + 1];
+            //IAC IAC is an ESCAPED 0xFF data byte, not a command — the command run ends here.
+            if (cmd === IAC)
+                break;
+            const commandName = COMMAND_NAMES[cmd] ?? 'Unknown';
+            if (cmd >= 251 && cmd <= 254) {
+                //WILL/WONT/DO/DONT — a 3-byte command carrying an option byte.
+                if (offset + 2 >= len)
+                    break;
+                const option = raw[offset + 2];
+                commands.push({ command: cmd, commandName: commandName, option: option, optionName: OPTION_NAMES[option] ?? '' });
+                offset += 3;
+            }
+            else if (cmd === 250) {
+                //SB — subnegotiation: `FF FA <option> …params… FF F0`. Capture the option, then skip to
+                //just past the terminating IAC SE (or to end-of-buffer if it is unterminated/truncated).
+                const option = offset + 2 < len ? raw[offset + 2] : undefined;
+                const entry = { command: cmd, commandName: commandName };
+                if (option !== undefined) {
+                    entry.option = option;
+                    entry.optionName = OPTION_NAMES[option] ?? '';
+                }
+                commands.push(entry);
+                let se = -1;
+                for (let i = offset + 2; i + 1 < len; i++) {
+                    if (raw[i] === IAC && raw[i + 1] === SE) {
+                        se = i;
+                        break;
+                    }
+                }
+                if (se === -1)
+                    break;
+                offset = se + 2;
+            }
+            else {
+                //240 SE / 241..249 — a 2-byte command with no option.
+                commands.push({ command: cmd, commandName: commandName });
+                offset += 2;
+            }
+        }
+        this.instance.commands.setValue(commands);
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'Telnet',
+            properties: {
+                //Display-only metadata parsed from the leading IAC command run on decode (no encode —
+                //populated by the `message` field below, never read back). isNegotiation flags a payload
+                //that opens with an IAC byte; commands lists the leading command sequences for the UI.
+                isNegotiation: { type: 'boolean', label: 'Is Negotiation', default: false },
+                commands: {
+                    type: 'array',
+                    label: 'IAC Commands',
+                    items: {
+                        type: 'object',
+                        label: 'Command',
+                        properties: {
+                            command: { type: 'integer', label: 'Command', minimum: 0, maximum: 255 },
+                            commandName: { type: 'string', label: 'Command Name' },
+                            option: { type: 'integer', label: 'Option', minimum: 0, maximum: 255 },
+                            optionName: { type: 'string', label: 'Option Name' }
+                        }
+                    }
+                },
+                //The whole raw payload is the single source of truth: decoded verbatim to hex and
+                //re-emitted untouched (byte-perfect for any Telnet payload). The leading IAC command run is
+                //parsed into the display-only metadata above, which carry no codec of their own.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    default: '',
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        if (available <= 0) {
+                            this.instance.message.setValue('');
+                            this.#parseCommands(Buffer.alloc(0));
+                            return;
+                        }
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parseCommands(raw);
+                    },
+                    encode: function () {
+                        //Re-emit the authoritative payload verbatim — never reconstruct from metadata.
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Reached only on the tcp:23 bucket. Port 23 IS Telnet's, so any non-empty payload over TCP is
+        //claimed and kept verbatim (byte-perfect) — deliberately without an IAC/printable gate, so
+        //binary-mode Telnet data is never wrongly dropped to raw. An empty payload is not claimed.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'tcp')
+            return false;
+        return this.#payloadLength() >= 1;
+    }
+}
+exports.Telnet = Telnet;

package/dist/headers/Teredo.d.ts

@@ -0,0 +1,40 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * Teredo — tunneling IPv6 over UDP through NATs (RFC 4380), UDP port 3544. A Teredo message carried in
+ * the UDP payload is an inner IPv6 packet, OPTIONALLY prefixed by one or both Teredo indication headers
+ * (RFC 4380 §5.1.1), always in this order:
+ *
+ *   1. Authentication indication (Indicator Type 0x0001): a 2-byte type, a 1-byte Client-ID length, a
+ *      1-byte Authentication-value length, the client identifier, the authentication value, an 8-byte
+ *      nonce and a 1-byte confirmation. Total = 13 + ID-len + AU-len bytes.
+ *   2. Origin indication (Indicator Type 0x0000): a 2-byte type, the 2-byte mapped port and the 4-byte
+ *      mapped IPv4 address of the sender as seen by the Teredo relay/server. Total = 8 bytes. Both the
+ *      port and the address are OBFUSCATED on the wire by an exclusive-or (RFC 4380 §5.1.1): the port
+ *      with 0xFFFF and the address with 0xFFFFFFFF. This codec stores the de-obfuscated (mapped) values
+ *      for the editor and re-applies the exclusive-or on encode — XOR is exactly reversible, so the
+ *      frame round-trips byte-for-byte.
+ *
+ * An indication header is detected purely by content: an inner IPv6 packet always begins with the
+ * version nibble 6 (first octet 0x6X), so the first two octets can never be 0x0000 or 0x0001 — the two
+ * indicator types are therefore unambiguous signatures at the start of the (post-authentication) payload.
+ *
+ * Minimal slice: the indication headers are parsed into structured fields; the inner IPv6 packet (and
+ * anything after the indications) is kept verbatim as `payload` hex and is NOT recursed into — routing
+ * it back through the IPv6 header would require changing IPv6.match to accept a Teredo parent, left to a
+ * later serial step. The ID-len / AU-len bytes are derived from the client-identifier / authentication-
+ * value byte lengths (kept consistent with the bytes actually written); the payload is bounded by the
+ * parent UDP length so trailing Ethernet padding is left to the codec's recursion / RawData. A
+ * well-formed message round-trips byte-for-byte.
+ */
+export declare class Teredo extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/Teredo.js

@@ -0,0 +1,251 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Teredo = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const BufferToIP_1 = require("../helper/BufferToIP");
+const IPToBuffer_1 = require("../helper/IPToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * Teredo — tunneling IPv6 over UDP through NATs (RFC 4380), UDP port 3544. A Teredo message carried in
+ * the UDP payload is an inner IPv6 packet, OPTIONALLY prefixed by one or both Teredo indication headers
+ * (RFC 4380 §5.1.1), always in this order:
+ *
+ *   1. Authentication indication (Indicator Type 0x0001): a 2-byte type, a 1-byte Client-ID length, a
+ *      1-byte Authentication-value length, the client identifier, the authentication value, an 8-byte
+ *      nonce and a 1-byte confirmation. Total = 13 + ID-len + AU-len bytes.
+ *   2. Origin indication (Indicator Type 0x0000): a 2-byte type, the 2-byte mapped port and the 4-byte
+ *      mapped IPv4 address of the sender as seen by the Teredo relay/server. Total = 8 bytes. Both the
+ *      port and the address are OBFUSCATED on the wire by an exclusive-or (RFC 4380 §5.1.1): the port
+ *      with 0xFFFF and the address with 0xFFFFFFFF. This codec stores the de-obfuscated (mapped) values
+ *      for the editor and re-applies the exclusive-or on encode — XOR is exactly reversible, so the
+ *      frame round-trips byte-for-byte.
+ *
+ * An indication header is detected purely by content: an inner IPv6 packet always begins with the
+ * version nibble 6 (first octet 0x6X), so the first two octets can never be 0x0000 or 0x0001 — the two
+ * indicator types are therefore unambiguous signatures at the start of the (post-authentication) payload.
+ *
+ * Minimal slice: the indication headers are parsed into structured fields; the inner IPv6 packet (and
+ * anything after the indications) is kept verbatim as `payload` hex and is NOT recursed into — routing
+ * it back through the IPv6 header would require changing IPv6.match to accept a Teredo parent, left to a
+ * later serial step. The ID-len / AU-len bytes are derived from the client-identifier / authentication-
+ * value byte lengths (kept consistent with the bytes actually written); the payload is bounded by the
+ * parent UDP length so trailing Ethernet padding is left to the codec's recursion / RawData. A
+ * well-formed message round-trips byte-for-byte.
+ */
+class Teredo extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'teredo';
+        this.name = 'Teredo IPv6 over UDP tunneling';
+        this.nickname = 'Teredo';
+        this.matchKeys = ['udpport:3544'];
+        //A leaf header — the inner IPv6 packet is kept as payload hex (not recursed, see class comment).
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (Teredo.#schemaCache ??= Teredo.#buildSchema());
+    }
+    /** Clamp a number into [lo, hi] without throwing (mirrors the fieldUInt clamp contract). */
+    static #clamp(value, lo, hi) {
+        if (!Number.isFinite(value))
+            return lo;
+        if (value < lo)
+            return lo;
+        if (value > hi)
+            return hi;
+        return Math.trunc(value);
+    }
+    /**
+     * Byte length of the Authentication indication header as it exists on the wire / will be written,
+     * or 0 when absent. Derived from the client-identifier / authentication-value byte lengths (each
+     * capped at 255, a single ID-len/AU-len octet), so decode (where those equal the decoded lengths)
+     * and encode compute the SAME offsets for the origin header and the inner payload.
+     */
+    #authLength() {
+        if (this.instance.authentication.isUndefined())
+            return 0;
+        const authentication = this.instance.authentication;
+        const idLength = Math.min(255, (0, HexToBuffer_1.HexToBuffer)(authentication.clientId.getValue('')).length);
+        const auLength = Math.min(255, (0, HexToBuffer_1.HexToBuffer)(authentication.authData.getValue('')).length);
+        //2 (type) + 1 (ID-len) + 1 (AU-len) + idLength + auLength + 8 (nonce) + 1 (confirmation).
+        return 13 + idLength + auLength;
+    }
+    /** Byte length of the Origin indication header (fixed 8 bytes) or 0 when absent. */
+    #originLength() {
+        return this.instance.origin.isUndefined() ? 0 : 8;
+    }
+    /** Offset where the inner IPv6 payload begins: after whichever indication headers are present. */
+    #payloadStart() {
+        return this.#authLength() + this.#originLength();
+    }
+    /** End of this Teredo message within the captured bytes, bounded by the parent UDP payload (udp.length − 8). */
+    #payloadEnd() {
+        let end = this.packet.length - this.startPos;
+        const prev = this.prevCodecModule;
+        if (prev && prev.id === 'udp') {
+            const udpLength = prev.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < end)
+                end = udpLength - 8;
+        }
+        return end < 0 ? 0 : end;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'Teredo IPv6-over-UDP',
+            properties: {
+                //Authentication indication (RFC 4380 §5.1.1), present only when the payload starts with
+                //Indicator Type 0x0001. The decode/encode logic lives on this parent object; the child
+                //properties are declarative (UI form metadata) so they are not decoded a second time.
+                authentication: {
+                    type: 'object',
+                    label: 'Authentication Indication',
+                    properties: {
+                        clientIdLength: { type: 'integer', label: 'Client ID Length', minimum: 0, maximum: 255 },
+                        authDataLength: { type: 'integer', label: 'Authentication Value Length', minimum: 0, maximum: 255 },
+                        clientId: { type: 'string', label: 'Client Identifier', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX },
+                        authData: { type: 'string', label: 'Authentication Value', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX },
+                        nonce: { type: 'string', label: 'Nonce', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX },
+                        confirmation: { type: 'integer', label: 'Confirmation', minimum: 0, maximum: 255 }
+                    },
+                    decode: function () {
+                        //Peek (dryRun) the indicator type — an inner IPv6 packet starts 0x6X, so only a
+                        //genuine Authentication indication reads 0x0001 here.
+                        if ((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(0, 2, true)) !== 0x0001)
+                            return;
+                        const idLength = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(2, 1, true));
+                        const auLength = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(3, 1, true));
+                        //The WHOLE authentication header must fit inside the payload; otherwise this is a
+                        //truncated/spoofed prefix — leave the bytes to `payload` so they round-trip verbatim.
+                        if (13 + idLength + auLength > this.#payloadEnd())
+                            return;
+                        const clientId = this.readBytes(4, idLength);
+                        const authData = this.readBytes(4 + idLength, auLength);
+                        const nonce = this.readBytes(4 + idLength + auLength, 8);
+                        const confirmation = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(12 + idLength + auLength, 1));
+                        this.instance.authentication.setValue({
+                            clientIdLength: idLength,
+                            authDataLength: auLength,
+                            clientId: (0, BufferToHex_1.BufferToHex)(clientId),
+                            authData: (0, BufferToHex_1.BufferToHex)(authData),
+                            nonce: (0, BufferToHex_1.BufferToHex)(nonce),
+                            confirmation: confirmation
+                        });
+                    },
+                    encode: function () {
+                        if (this.instance.authentication.isUndefined())
+                            return;
+                        const authentication = this.instance.authentication;
+                        //ID-len / AU-len are derived from (and capped to) the actual bytes written, so
+                        //the length octets and the following data can never disagree.
+                        const clientId = (0, HexToBuffer_1.HexToBuffer)(authentication.clientId.getValue('')).subarray(0, 255);
+                        const authData = (0, HexToBuffer_1.HexToBuffer)(authentication.authData.getValue('')).subarray(0, 255);
+                        //Nonce is a fixed 8-byte field; pad/truncate so #authLength's constant 13 holds.
+                        let nonce = (0, HexToBuffer_1.HexToBuffer)(authentication.nonce.getValue(''));
+                        if (nonce.length < 8)
+                            nonce = Buffer.concat([nonce, Buffer.alloc(8 - nonce.length, 0)]);
+                        else if (nonce.length > 8)
+                            nonce = nonce.subarray(0, 8);
+                        const confirmation = Teredo.#clamp(authentication.confirmation.getValue(0), 0, 255);
+                        const idLength = clientId.length;
+                        const auLength = authData.length;
+                        this.writeBytes(0, (0, NumberToBuffer_1.UInt16ToBuffer)(0x0001));
+                        this.writeBytes(2, (0, NumberToBuffer_1.UInt8ToBuffer)(idLength));
+                        this.writeBytes(3, (0, NumberToBuffer_1.UInt8ToBuffer)(auLength));
+                        this.writeBytes(4, clientId);
+                        this.writeBytes(4 + idLength, authData);
+                        this.writeBytes(4 + idLength + auLength, nonce);
+                        this.writeBytes(12 + idLength + auLength, (0, NumberToBuffer_1.UInt8ToBuffer)(confirmation));
+                    }
+                },
+                //Origin indication (RFC 4380 §5.1.1), present only when the payload (after any
+                //Authentication indication) starts with Indicator Type 0x0000. Port and address are
+                //stored de-obfuscated (mapped) and re-obfuscated (XOR) on encode.
+                origin: {
+                    type: 'object',
+                    label: 'Origin Indication',
+                    properties: {
+                        port: { type: 'integer', label: 'Mapped Port', minimum: 0, maximum: 65535 },
+                        address: {
+                            type: 'string',
+                            label: 'Mapped Address',
+                            minLength: 7,
+                            maxLength: 15,
+                            contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.IPv4
+                        }
+                    },
+                    decode: function () {
+                        const start = this.#authLength();
+                        if ((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(start, 2, true)) !== 0x0000)
+                            return;
+                        //A full 8-byte origin header must fit; otherwise leave the bytes to the payload.
+                        if (start + 8 > this.#payloadEnd())
+                            return;
+                        const wirePort = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(start + 2, 2));
+                        const wireAddress = this.readBytes(start + 4, 4);
+                        const mappedAddress = Buffer.from([
+                            wireAddress[0] ^ 0xff,
+                            wireAddress[1] ^ 0xff,
+                            wireAddress[2] ^ 0xff,
+                            wireAddress[3] ^ 0xff
+                        ]);
+                        this.instance.origin.setValue({
+                            port: (wirePort ^ 0xffff) & 0xffff,
+                            address: (0, BufferToIP_1.BufferToIPv4)(mappedAddress)
+                        });
+                    },
+                    encode: function () {
+                        if (this.instance.origin.isUndefined())
+                            return;
+                        const start = this.#authLength();
+                        const origin = this.instance.origin;
+                        const port = Teredo.#clamp(origin.port.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found')), 0, 65535);
+                        const address = origin.address.getValue('0.0.0.0', (nodePath) => this.recordError(nodePath, 'Not Found'));
+                        const addressBuffer = (0, IPToBuffer_1.IPv4ToBuffer)(address);
+                        const wireAddress = Buffer.from([
+                            addressBuffer[0] ^ 0xff,
+                            addressBuffer[1] ^ 0xff,
+                            addressBuffer[2] ^ 0xff,
+                            addressBuffer[3] ^ 0xff
+                        ]);
+                        this.writeBytes(start, (0, NumberToBuffer_1.UInt16ToBuffer)(0x0000));
+                        this.writeBytes(start + 2, (0, NumberToBuffer_1.UInt16ToBuffer)((port ^ 0xffff) & 0xffff));
+                        this.writeBytes(start + 4, wireAddress);
+                    }
+                },
+                //The inner IPv6 packet (and anything after the indications), kept verbatim. Bounded by
+                //the parent UDP payload, so trailing padding is left to the codec's recursion / RawData.
+                //Not recursed into (would need an IPv6.match change) — a later serial step.
+                payload: {
+                    type: 'string',
+                    label: 'Payload',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const start = this.#payloadStart();
+                        const end = this.#payloadEnd();
+                        this.instance.payload.setValue(end > start ? (0, BufferToHex_1.BufferToHex)(this.readBytes(start, end - start)) : '');
+                    },
+                    encode: function () {
+                        const payload = this.instance.payload.getValue('');
+                        if (payload)
+                            this.writeBytes(this.#payloadStart(), (0, HexToBuffer_1.HexToBuffer)(payload));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Teredo rides on UDP port 3544 (the port bucket selects this candidate). Confirm a UDP parent
+        //and at least one payload byte; the message is either an inner IPv6 packet or an indication
+        //header, both recognised by content inside decode.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        return this.packet.length - this.startPos >= 1;
+    }
+}
+exports.Teredo = Teredo;

package/dist/headers/TimeProtocol.d.ts

@@ -0,0 +1,25 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * Time Protocol (RFC 868), TCP & UDP well-known port 37. A trivial time service: the server returns the
+ * time as the number of seconds since 00:00 (midnight) 1 January 1900 GMT, in a single 32-bit big-endian
+ * unsigned integer. Over TCP the client opens a connection and the server sends the 4 octets then closes;
+ * over UDP the client sends an empty datagram and the server replies with a 4-octet datagram. The request
+ * carries no payload, so only the 4-octet response is a Time Protocol message this codec claims.
+ *
+ * The whole message is exactly one field — `time`, the 32-bit seconds count — kept as a plain uint so any
+ * on-wire value (including the post-2036 wrap once the counter passes 0x80000000) round-trips byte-for-byte
+ * and can be re-encoded without an Ajv rejection. The response is exactly 4 octets; anything beyond is left
+ * to the codec's recursion / RawData. A well-formed message round-trips byte-for-byte.
+ */
+export declare class TimeProtocol extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/TimeProtocol.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TimeProtocol = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+/**
+ * Time Protocol (RFC 868), TCP & UDP well-known port 37. A trivial time service: the server returns the
+ * time as the number of seconds since 00:00 (midnight) 1 January 1900 GMT, in a single 32-bit big-endian
+ * unsigned integer. Over TCP the client opens a connection and the server sends the 4 octets then closes;
+ * over UDP the client sends an empty datagram and the server replies with a 4-octet datagram. The request
+ * carries no payload, so only the 4-octet response is a Time Protocol message this codec claims.
+ *
+ * The whole message is exactly one field — `time`, the 32-bit seconds count — kept as a plain uint so any
+ * on-wire value (including the post-2036 wrap once the counter passes 0x80000000) round-trips byte-for-byte
+ * and can be re-encoded without an Ajv rejection. The response is exactly 4 octets; anything beyond is left
+ * to the codec's recursion / RawData. A well-formed message round-trips byte-for-byte.
+ */
+class TimeProtocol extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'timeproto';
+        this.name = 'Time Protocol';
+        this.nickname = 'TIME';
+        this.matchKeys = ['tcpport:37', 'udpport:37'];
+        //A leaf header — the 4-octet time value is the entire message; nothing rides above it.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (TimeProtocol.#schemaCache ??= TimeProtocol.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'TIME seconds=${time}',
+            properties: {
+                //Seconds since 1900-01-01 00:00:00 GMT, 32-bit big-endian unsigned (RFC 868). A plain uint
+                //so every on-wire value round-trips; the epoch/date rendering is UI enrichment for later.
+                time: this.fieldUInt('time', 0, 4, 'Seconds since 1900-01-01 00:00:00 GMT')
+            }
+        };
+    }
+    match() {
+        //Time Protocol rides on TCP/UDP port 37; the well-known port is the only signature (the payload
+        //is 4 opaque bytes with no magic). The request carries no payload, so require the full 4-octet
+        //response to be present — an empty request (0 bytes) is not claimed and falls through.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'tcp' && this.prevCodecModule.id !== 'udp')
+            return false;
+        return this.packet.length - this.startPos >= 4;
+    }
+}
+exports.TimeProtocol = TimeProtocol;

package/dist/headers/UDP.d.ts

@@ -0,0 +1,19 @@
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { DemuxProducer } from '../types/DemuxProducer';
+export declare class UDP extends BaseHeader {
+    #private;
+    /**
+     * Calculate UDP Checksum
+     * @protected
+     * @param udpHeaderBuffer
+     */
+    protected calculateUDPChecksum(udpHeaderBuffer: Buffer): number;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly matchKeys: string[];
+    readonly demuxProducers: DemuxProducer[];
+    readonly name: string;
+    readonly nickname: string;
+    match(): boolean;
+}