@netkitty/codec 1.0.0

package/dist/headers/MDNS.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MDNS = void 0;
+const DNS_1 = require("./DNS");
+/**
+ * mDNS — Multicast DNS (RFC 6762). The on-wire message format is byte-for-byte the standard DNS message
+ * (RFC 1035): the same 12-byte header, questions, and resource records with label compression. mDNS
+ * only reinterprets bits that DNS already carries verbatim — the top bit of a question's QCLASS is the
+ * unicast-response (QU) bit, and the top bit of a record's CLASS is the cache-flush bit — so storing
+ * QCLASS/CLASS as their full 16-bit values (as the DNS codec does) preserves them automatically and the
+ * whole message round-trips byte-perfect through the inherited DNS decode/encode. The only differences
+ * here are the protocol identity, the demux port (UDP 5353), the Info summary, and a tightened match().
+ */
+class MDNS extends DNS_1.DNS {
+    constructor() {
+        super(...arguments);
+        this.id = 'mdns';
+        this.name = 'Multicast DNS';
+        this.nickname = 'mDNS';
+        this.matchKeys = ['udpport:5353'];
+    }
+    static #schemaCache;
+    //Reuse the parent DNS schema (identical wire format + field closures) but relabel the Info summary
+    //so an mDNS packet does not render as "DNS". Shares the `properties` closures by reference; only the
+    //top-level object and its summary template differ.
+    get SCHEMA() {
+        return (MDNS.#schemaCache ??= { ...super.SCHEMA, summary: 'mDNS ${id} queries=${qdcount} answers=${ancount}' });
+    }
+    /**
+     * mDNS lives on UDP port 5353 and never uses the classic DNS port 53. Because UDP produces its demux
+     * keys destination-port-first, a DNS *response* (srcport 53) sent to a client that happens to use
+     * ephemeral port 5353 would otherwise hit the mDNS bucket first and be mislabeled. Reject any packet
+     * that carries port 53 (that is DNS, matched by the udpport:53 bucket), and require 5353 to be present.
+     */
+    match() {
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        const srcport = this.prevCodecModule.instance.srcport.getValue(0);
+        const dstport = this.prevCodecModule.instance.dstport.getValue(0);
+        if (srcport === 53 || dstport === 53)
+            return false;
+        return srcport === 5353 || dstport === 5353;
+    }
+}
+exports.MDNS = MDNS;

package/dist/headers/MGCP.d.ts

@@ -0,0 +1,30 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * MGCP — the Media Gateway Control Protocol (RFC 3435), the master/slave signalling protocol by which a
+ * Call Agent controls media gateways for VoIP. It is US-ASCII text carried over UDP (gateways listen on
+ * 2427, call agents on 2727). A message is a command or response line, then parameter lines, a blank
+ * line, and an optional SDP session description.
+ *
+ * The command line is `VERB SP transactionId SP endpoint SP "MGCP 1.0" CRLF` (VERB ∈ CRCX/MDCX/DLCX/…);
+ * a response line is `responseCode SP transactionId SP commentText CRLF`.
+ *
+ * Like SIP and HTTP, the message body is text whose full internal structure (arbitrary parameter lines,
+ * an embedded SDP session, significant whitespace/line ordering) is far richer than a form needs. So the
+ * ENTIRE raw message is kept verbatim as the authoritative `message` field (hex) and re-emitted
+ * untouched; only the first line is parsed on decode into display-only metadata
+ * (verb/transactionId/endpoint/version or responseCode/comment). Encode never reconstructs the message
+ * from the parsed fields — it writes `message` back byte-for-byte — so any conformant (or even
+ * malformed) MGCP message round-trips exactly.
+ */
+export declare class MGCP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/MGCP.js

@@ -0,0 +1,155 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MGCP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/** MGCP verbs (RFC 3435 §3.2 + common extensions) used only to recognize a command start-line. */
+const MGCP_VERBS = ['CRCX', 'MDCX', 'DLCX', 'RQNT', 'NTFY', 'AUEP', 'AUCX', 'RSIP', 'EPCF'];
+/**
+ * MGCP — the Media Gateway Control Protocol (RFC 3435), the master/slave signalling protocol by which a
+ * Call Agent controls media gateways for VoIP. It is US-ASCII text carried over UDP (gateways listen on
+ * 2427, call agents on 2727). A message is a command or response line, then parameter lines, a blank
+ * line, and an optional SDP session description.
+ *
+ * The command line is `VERB SP transactionId SP endpoint SP "MGCP 1.0" CRLF` (VERB ∈ CRCX/MDCX/DLCX/…);
+ * a response line is `responseCode SP transactionId SP commentText CRLF`.
+ *
+ * Like SIP and HTTP, the message body is text whose full internal structure (arbitrary parameter lines,
+ * an embedded SDP session, significant whitespace/line ordering) is far richer than a form needs. So the
+ * ENTIRE raw message is kept verbatim as the authoritative `message` field (hex) and re-emitted
+ * untouched; only the first line is parsed on decode into display-only metadata
+ * (verb/transactionId/endpoint/version or responseCode/comment). Encode never reconstructs the message
+ * from the parsed fields — it writes `message` back byte-for-byte — so any conformant (or even
+ * malformed) MGCP message round-trips exactly.
+ */
+class MGCP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'mgcp';
+        this.name = 'Media Gateway Control Protocol';
+        this.nickname = 'MGCP';
+        this.matchKeys = ['udpport:2427', 'udpport:2727'];
+        //A leaf header — the embedded SDP body and the transaction it belongs to are a higher-layer concern.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (_a.#schemaCache ??= _a.#buildSchema());
+    }
+    /**
+     * Bytes of this header: for UDP, bounded by the datagram length (so a retained FCS/padding is not
+     * absorbed); otherwise take the rest of the packet. Never negative.
+     */
+    #payloadLength() {
+        let available = this.packet.length - this.startPos;
+        if (this.prevCodecModule && this.prevCodecModule.id === 'udp') {
+            const udpLength = this.prevCodecModule.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < available)
+                available = udpLength - 8;
+        }
+        return available < 0 ? 0 : available;
+    }
+    /** The first line of the message (up to the first CRLF, or the whole payload if none). */
+    static #firstLine(text) {
+        const idx = text.indexOf('\r\n');
+        return idx >= 0 ? text.slice(0, idx) : text;
+    }
+    /**
+     * Parse the first line into the display-only metadata fields. A response line begins with a 3-digit
+     * numeric code; anything else is treated as a command line. Populated on decode only — these fields
+     * have no encode, so they never affect the re-emitted bytes. Never throws: missing tokens yield
+     * empty strings, a non-numeric code yields 0.
+     */
+    #parseFirstLine(text) {
+        const line = _a.#firstLine(text);
+        const parts = line.split(' ');
+        if (/^\d{3}$/.test(parts[0] || '')) {
+            //Response line: responseCode SP transactionId SP commentText
+            this.instance.isResponse.setValue(true);
+            this.instance.verb.setValue('');
+            this.instance.transactionId.setValue(parts.length > 1 ? parts[1] : '');
+            this.instance.endpoint.setValue('');
+            this.instance.version.setValue('');
+            this.instance.responseCode.setValue(Number(parts[0]));
+            this.instance.comment.setValue(parts.length > 2 ? parts.slice(2).join(' ') : '');
+            return;
+        }
+        //Command line: VERB SP transactionId SP endpoint SP "MGCP 1.0"
+        this.instance.isResponse.setValue(false);
+        this.instance.verb.setValue(parts[0] ? parts[0] : '');
+        this.instance.transactionId.setValue(parts.length > 1 ? parts[1] : '');
+        this.instance.endpoint.setValue(parts.length > 2 ? parts[2] : '');
+        //The MGCP-Version is the trailing "MGCP 1.0" (last two tokens); keep whatever tokens follow the
+        //endpoint so a non-standard version string is still displayed.
+        this.instance.version.setValue(parts.length > 3 ? parts.slice(3).join(' ') : '');
+        this.instance.responseCode.setValue(0);
+        this.instance.comment.setValue('');
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'MGCP ${verb}${responseCode}',
+            properties: {
+                //The whole raw message is the single source of truth: decoded verbatim to hex and
+                //re-emitted untouched (byte-perfect for any MGCP message). The first line is parsed into
+                //the display-only metadata below, which carry no codec of their own.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        if (available <= 0) {
+                            this.instance.message.setValue('');
+                            this.#parseFirstLine('');
+                            return;
+                        }
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parseFirstLine(raw.toString('latin1'));
+                    },
+                    encode: function () {
+                        //Re-emit the authoritative message verbatim — never reconstruct from metadata.
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                },
+                //Display-only metadata parsed from the first line on decode (no encode — populated by the
+                //message field above, never read back). isResponse distinguishes a response line from a
+                //command line; verb/endpoint/version are for commands, responseCode/comment for responses.
+                isResponse: { type: 'boolean', label: 'Is Response' },
+                verb: { type: 'string', label: 'Verb' },
+                transactionId: { type: 'string', label: 'Transaction ID' },
+                endpoint: { type: 'string', label: 'Endpoint' },
+                version: { type: 'string', label: 'Version' },
+                responseCode: { type: 'integer', label: 'Response Code', minimum: 0, maximum: 999 },
+                comment: { type: 'string', label: 'Comment' }
+            }
+        };
+    }
+    match() {
+        //MGCP rides on UDP ports 2427 (gateway) / 2727 (call agent) as US-ASCII text. Recognize it by the
+        //first-line signature: a known verb followed by a space, or a 3-digit response code followed by a
+        //space — so non-MGCP traffic on these ports falls through to raw rather than claiming an
+        //un-decodable text layer.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'udp')
+            return false;
+        if (this.#payloadLength() < 5)
+            return false;
+        const lead = this.readBytes(0, 16, true).toString('latin1');
+        //A 3-digit response code (e.g. "200 ") begins a response.
+        if (/^\d{3} /.test(lead))
+            return true;
+        for (const verb of MGCP_VERBS) {
+            if (lead.startsWith(verb + ' '))
+                return true;
+        }
+        return false;
+    }
+}
+exports.MGCP = MGCP;
+_a = MGCP;

package/dist/headers/MMS.d.ts

@@ -0,0 +1,29 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * MMS — Manufacturing Message Specification (ISO 9506) for IEC 61850, the innermost application layer of
+ * the substation stack: TPKT → COTP → ISO Session → (this) ISO Presentation + MMS. In the data-transfer
+ * phase the Session user data is a Presentation "fully-encoded-data" PDU (BER `[APPLICATION 1]`, tag
+ * 0x61) that wraps a PDV-list (SEQUENCE 0x30) carrying a presentation-context-identifier and the MMS PDU
+ * itself as `[0]` single-ASN1-type (0xa0). The MMS PDU is a CHOICE — 0xa0 confirmed-request, 0xa1
+ * confirmed-response, 0xa2 confirmed-error, 0xa3 unconfirmed, 0xa8 initiate-request, 0xa9
+ * initiate-response, 0x05 NULL (keep-alive) …
+ *
+ * Following the SNMP pattern, this header owns the whole nested BER blob and re-emits it verbatim (so it
+ * round-trips byte-for-byte regardless of definite/indefinite length quirks), while exposing the parsed
+ * presentation context and the MMS PDU type as display metadata. The single-frame completeness gate is
+ * enforced upstream by COTP, so a T2-fragmented MMS body never reaches here. Deeper structuring of the
+ * MMS service body (read/write/report) and the connection-phase ACSE are later slices.
+ */
+export declare class MMS extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    readonly heuristicFallback: boolean;
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/MMS.js

@@ -0,0 +1,243 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MMS = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+/**
+ * MMS — Manufacturing Message Specification (ISO 9506) for IEC 61850, the innermost application layer of
+ * the substation stack: TPKT → COTP → ISO Session → (this) ISO Presentation + MMS. In the data-transfer
+ * phase the Session user data is a Presentation "fully-encoded-data" PDU (BER `[APPLICATION 1]`, tag
+ * 0x61) that wraps a PDV-list (SEQUENCE 0x30) carrying a presentation-context-identifier and the MMS PDU
+ * itself as `[0]` single-ASN1-type (0xa0). The MMS PDU is a CHOICE — 0xa0 confirmed-request, 0xa1
+ * confirmed-response, 0xa2 confirmed-error, 0xa3 unconfirmed, 0xa8 initiate-request, 0xa9
+ * initiate-response, 0x05 NULL (keep-alive) …
+ *
+ * Following the SNMP pattern, this header owns the whole nested BER blob and re-emits it verbatim (so it
+ * round-trips byte-for-byte regardless of definite/indefinite length quirks), while exposing the parsed
+ * presentation context and the MMS PDU type as display metadata. The single-frame completeness gate is
+ * enforced upstream by COTP, so a T2-fragmented MMS body never reaches here. Deeper structuring of the
+ * MMS service body (read/write/report) and the connection-phase ACSE are later slices.
+ */
+class MMS extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'mms';
+        this.name = 'Manufacturing Message Specification';
+        this.nickname = 'MMS';
+        //A content-heuristic child of ISO Session (unkeyed), selected by the Presentation fully-encoded-data
+        //BER tag 0x61 (the MMS data-transfer phase).
+        this.matchKeys = [];
+        this.heuristicFallback = true;
+        //A leaf for this slice — the MMS service body is kept verbatim inside `message`.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (MMS.#schemaCache ??= MMS.#buildSchema());
+    }
+    /**
+     * A clamping, never-throwing BER TLV read at `pos`: returns the tag, the header length (tag+length
+     * octets), the content start and the content length (clamped to the buffer). Indefinite length (0x80)
+     * yields a content that runs to the buffer end (kept verbatim, not parsed). Returns null past the end.
+     */
+    static #readTLV(buf, pos) {
+        if (pos + 2 > buf.length)
+            return null;
+        const tag = buf[pos];
+        const lengthOctet = buf[pos + 1];
+        let contentStart = pos + 2;
+        let contentLength;
+        if (lengthOctet < 0x80) {
+            contentLength = lengthOctet;
+        }
+        else if (lengthOctet === 0x80) {
+            contentLength = buf.length - contentStart;
+        }
+        else {
+            const n = lengthOctet & 0x7f;
+            if (contentStart + n > buf.length)
+                return null;
+            contentLength = 0;
+            for (let i = 0; i < n; i++)
+                contentLength = (contentLength << 8) | buf[contentStart + i];
+            contentStart += n;
+        }
+        if (contentStart + contentLength > buf.length)
+            contentLength = buf.length - contentStart;
+        if (contentLength < 0)
+            contentLength = 0;
+        return { tag: tag, contentStart: contentStart, contentLength: contentLength };
+    }
+    //MMS ConfirmedServiceRequest/Response CHOICE context tags (ISO 9506-2) → service name, for display.
+    static #SERVICE_NAMES = {
+        0: 'status', 1: 'getNameList', 2: 'identify', 3: 'rename', 4: 'read', 5: 'write',
+        6: 'getVariableAccessAttributes', 7: 'defineNamedVariable', 8: 'defineScatteredAccess',
+        9: 'getScatteredAccessAttributes', 10: 'deleteVariableAccess', 11: 'defineNamedVariableList',
+        12: 'getNamedVariableListAttributes', 13: 'deleteNamedVariableList', 14: 'defineNamedType',
+        15: 'getNamedTypeAttributes', 16: 'deleteNamedType', 17: 'input', 18: 'output', 19: 'takeControl',
+        20: 'relinquishControl', 21: 'defineSemaphore', 22: 'deleteSemaphore', 23: 'reportSemaphoreStatus',
+        24: 'reportPoolSemaphoreStatus', 25: 'reportSemaphoreEntryStatus', 26: 'initiateDownloadSequence',
+        27: 'downloadSegment', 28: 'terminateDownloadSequence', 29: 'initiateUploadSequence', 30: 'uploadSegment'
+    };
+    /**
+     * Parse the Presentation/MMS nesting for display, best-effort: the presentation context, the MMS PDU
+     * type (0xa0 confirmed-request / 0xa1 confirmed-response / 0xa2 confirmed-error / 0xa3 unconfirmed /
+     * 0x05 NULL …), and — for a confirmed request/response/error — the invokeID and the service (from the
+     * ConfirmedService CHOICE context tag). -1 / '' when a part is absent.
+     */
+    static #parse(buf) {
+        const result = { presentationContext: -1, mmsPduType: -1, invokeID: -1, service: '', objectNames: [] };
+        //61 (fully-encoded-data) → 30 (PDV-list) → 02 01 ctx, a0 (presentation-data-values) → MMS PDU.
+        const app = MMS.#readTLV(buf, 0);
+        if (!app || app.tag !== 0x61)
+            return result;
+        const pdvList = MMS.#readTLV(buf, app.contentStart);
+        if (!pdvList || pdvList.tag !== 0x30)
+            return result;
+        let pos = pdvList.contentStart;
+        const end = pdvList.contentStart + pdvList.contentLength;
+        while (pos < end) {
+            const tlv = MMS.#readTLV(buf, pos);
+            if (!tlv)
+                break;
+            if (tlv.tag === 0x02 && tlv.contentLength >= 1) {
+                //presentation-context-identifier (INTEGER)
+                let value = 0;
+                for (let i = 0; i < tlv.contentLength; i++)
+                    value = (value << 8) | buf[tlv.contentStart + i];
+                result.presentationContext = value;
+            }
+            else if (tlv.tag === 0xa0) {
+                //presentation-data-values [0] → the MMS PDU TLV is inside.
+                const mmsPdu = MMS.#readTLV(buf, tlv.contentStart);
+                if (mmsPdu) {
+                    result.mmsPduType = mmsPdu.tag;
+                    MMS.#parseConfirmed(buf, mmsPdu, result);
+                }
+            }
+            pos = tlv.contentStart + tlv.contentLength;
+        }
+        return result;
+    }
+    /** True if every byte is printable ASCII (a heuristic Identifier guard for context-tagged names). */
+    static #isPrintable(buf) {
+        if (buf.length === 0)
+            return false;
+        for (const b of buf)
+            if (b < 0x20 || b > 0x7e)
+                return false;
+        return true;
+    }
+    /**
+     * Recursively collect the object/variable names referenced in an MMS service body into `out` (depth- and
+     * count-bounded, never-throwing). A name is an ObjectName Identifier (VisibleString): the domain-specific
+     * form's domainID/itemID appear as universal VisibleString (BER 0x1a), while the vmd-specific [0],
+     * domain-scope [1] and aa-specific [2] forms are IMPLICIT context-tagged primitives (0x80/0x81/0x82). To
+     * avoid collecting non-name context values (objectClass, error codes, booleans, or Data VALUEs, whose
+     * string alternatives are tags ≥ [3]), the context-primitive forms are taken only when their content is a
+     * printable Identifier.
+     */
+    static #collectVisibleStrings(buf, start, end, out, depth) {
+        if (depth > 32 || out.length >= 64)
+            return;
+        let pos = start;
+        while (pos < end && out.length < 64) {
+            const tlv = MMS.#readTLV(buf, pos);
+            if (!tlv)
+                break;
+            const constructed = (tlv.tag & 0x20) !== 0;
+            const content = buf.subarray(tlv.contentStart, tlv.contentStart + tlv.contentLength);
+            if (tlv.tag === 0x1a) {
+                out.push(content.toString('latin1'));
+            }
+            else if (!constructed && (tlv.tag & 0xc0) === 0x80 && (tlv.tag & 0x1f) <= 2 && MMS.#isPrintable(content)) {
+                //vmd-specific [0] / domain-scope [1] / aa-specific [2] Identifier.
+                out.push(content.toString('latin1'));
+            }
+            else if (constructed) {
+                MMS.#collectVisibleStrings(buf, tlv.contentStart, tlv.contentStart + tlv.contentLength, out, depth + 1);
+            }
+            const next = tlv.contentStart + tlv.contentLength;
+            if (next <= pos)
+                break;
+            pos = next;
+        }
+    }
+    /** For a confirmed-request/response/error MMS PDU, extract the invokeID, the service name, and the
+     *  object/variable names referenced. */
+    static #parseConfirmed(buf, mmsPdu, result) {
+        if (mmsPdu.tag !== 0xa0 && mmsPdu.tag !== 0xa1 && mmsPdu.tag !== 0xa2)
+            return;
+        //All three begin with the invokeID INTEGER (Confirmed-{Request,Response,Error}PDU).
+        const invokeID = MMS.#readTLV(buf, mmsPdu.contentStart);
+        if (!invokeID || invokeID.tag !== 0x02)
+            return;
+        let id = 0;
+        for (let i = 0; i < invokeID.contentLength; i++)
+            id = (id << 8) | buf[invokeID.contentStart + i];
+        result.invokeID = id;
+        //The ConfirmedService CHOICE is the element after the invokeID ONLY for request/response. A
+        //Confirmed-ErrorPDU's second element is modifierPosition/serviceError, not a service, so skip it.
+        if (mmsPdu.tag !== 0xa0 && mmsPdu.tag !== 0xa1)
+            return;
+        const service = MMS.#readTLV(buf, invokeID.contentStart + invokeID.contentLength);
+        if (!service)
+            return;
+        //Single-byte context tags (0..30) identify the service; a higher (multi-byte) tag's first byte has
+        //low bits 0x1f=31, absent from the map, so it shows as "31" — lossy but never aliases a real name.
+        const tagNumber = service.tag & 0x1f;
+        result.service = MMS.#SERVICE_NAMES[tagNumber] ?? String(tagNumber);
+        //Collect the object/variable names referenced within the service body.
+        MMS.#collectVisibleStrings(buf, service.contentStart, service.contentStart + service.contentLength, result.objectNames, 0);
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'MMS pdu=${mmsPduType} ctx=${presentationContext}',
+            properties: {
+                //The whole Presentation + MMS BER blob is the authoritative source: decoded verbatim to hex
+                //and re-emitted untouched, so any (even malformed) frame round-trips byte-for-byte.
+                message: {
+                    type: 'string', label: 'Message', contentEncoding: 'hex',
+                    decode: function () {
+                        const available = this.packet.length - this.startPos;
+                        const buf = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(buf));
+                        const parsed = MMS.#parse(buf);
+                        this.instance.presentationContext.setValue(parsed.presentationContext);
+                        this.instance.mmsPduType.setValue(parsed.mmsPduType);
+                        if (parsed.invokeID >= 0)
+                            this.instance.mmsInvokeID.setValue(parsed.invokeID);
+                        if (parsed.service)
+                            this.instance.mmsService.setValue(parsed.service);
+                        if (parsed.objectNames.length)
+                            this.instance.mmsObjectNames.setValue(parsed.objectNames);
+                    },
+                    encode: function () {
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                },
+                //Display-only metadata parsed from the BER blob on decode (no encode — populated by the
+                //message field above), so they never affect the re-emitted bytes. invokeID / service are
+                //present only for a confirmed request/response/error PDU.
+                presentationContext: { type: 'integer', label: 'Presentation Context' },
+                mmsPduType: { type: 'integer', label: 'MMS PDU Type' },
+                mmsInvokeID: { type: 'integer', label: 'Invoke ID' },
+                mmsService: { type: 'string', label: 'MMS Service' },
+                mmsObjectNames: { type: 'array', label: 'Object Names', items: { type: 'string' } }
+            }
+        };
+    }
+    match() {
+        const prev = this.prevCodecModule;
+        if (!prev || prev.id !== 'iso-session')
+            return false;
+        if (this.packet.length - this.startPos < 2)
+            return false;
+        //Presentation fully-encoded-data (BER [APPLICATION 1] = 0x61). The connection-phase CP-type (0x31)
+        //+ ACSE is a later slice.
+        return this.readBytes(0, 1, true)[0] === 0x61;
+    }
+}
+exports.MMS = MMS;

package/dist/headers/MPLS.d.ts

@@ -0,0 +1,31 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * MPLS — Multiprotocol Label Switching (RFC 3032), carried directly in an Ethernet II frame with
+ * EtherType 0x8847 (unicast) or 0x8848 (multicast) — an Ethernet child, no IP/UDP below it. The MPLS
+ * shim is a label stack: a sequence of 4-byte entries, each packing a 20-bit Label, a 3-bit Traffic
+ * Class / Experimental field (TC/EXP), a 1-bit Bottom-of-Stack flag (S), and an 8-bit Time To Live
+ * (TTL). The stack repeats until an entry with S=1 (the bottom of stack); the encapsulated packet
+ * (typically IPv4/IPv6, dispatched by the first payload nibble) follows immediately after it.
+ *
+ * This codec is the label-stack leaf: it decodes the stack (each entry's structured label/tc/s/ttl)
+ * up to and including the S=1 entry, then keeps the encapsulated packet after it as an opaque `payload`
+ * hex field so MPLS is a self-contained byte-perfect leaf. (It deliberately consumes the payload rather
+ * than leaving it to the codec's recursion: with IPv4/IPv6.match unchanged the inner IP would not fall
+ * to RawData but be claimed by the greedy EthernetII content heuristic, which emits an un-re-encodable
+ * layer for a short trailer. Owning the bytes keeps decode→encode from ever throwing.) Each entry and
+ * the payload are re-emitted verbatim, so a well-formed shim round-trips byte-for-byte. Structured inner
+ * IPv4/IPv6 recursion is a serial follow-up (IPv4/IPv6.match must learn an 'mpls' parent branch
+ * dispatching on the first payload nibble, at which point `payload` becomes real child layers).
+ */
+export declare class MPLS extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}