@netkitty/codec 1.0.0

package/dist/headers/SMB2.js

@@ -0,0 +1,203 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SMB2 = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * SMB2 / SMB3 (MS-SMB2), TCP port 445. Over the Direct TCP transport (MS-SMB2 §2.1) every message is
+ * framed by a 4-byte transport header — a zero byte followed by a 24-bit big-endian StreamProtocolLength
+ * giving the number of SMB2 message bytes that follow — then the 64-byte SMB2 packet header, then the
+ * command-specific body.
+ *
+ * The 64-byte SMB2 header (MS-SMB2 §2.2.1.2, the SYNC form) is: ProtocolId (the 0xFE 'S' 'M' 'B' magic),
+ * StructureSize (always 64), CreditCharge, Status/ChannelSequence+Reserved, Command (0 NEGOTIATE, 1
+ * SESSION_SETUP, 3 TREE_CONNECT, 5 CREATE, 8 READ, 9 WRITE, …), CreditRequest/Response, Flags, NextCommand,
+ * MessageId, Reserved(ProcessId), TreeId, SessionId and a 16-byte Signature.
+ *
+ * ⚠️ Every multi-byte scalar in the SMB2 header is LITTLE-ENDIAN (SMB's on-wire byte order). There is no
+ * little-endian helper in this codebase, so the uint16 / uint32 fields are read and written byte-by-byte
+ * in their closures. The 8-byte MessageId / SessionId and the Signature are kept verbatim as hex (opaque,
+ * and 64-bit values exceed a JS number's exact integer range), so they round-trip byte-for-byte.
+ *
+ * The command-specific body (the NEGOTIATE dialects, SESSION_SETUP security blob, CREATE contexts, READ /
+ * WRITE data, …) is cross-message, command-dependent state, so this single-message codec keeps it verbatim
+ * as `body` hex (byte-perfect). The StreamProtocolLength is honored when supplied (a crafted frame may lie)
+ * else derived as 64 + body bytes; the message is bounded by it, so a second compounded/pipelined message
+ * or trailing bytes are left to the codec's recursion / RawData. A well-formed message round-trips
+ * byte-for-byte.
+ */
+class SMB2 extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'smb2';
+        this.name = 'SMB2';
+        this.nickname = 'SMB2';
+        this.matchKeys = ['tcpport:445'];
+        //A leaf header — the command-specific body requires per-command, cross-message parsing.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (SMB2.#schemaCache ??= SMB2.#buildSchema());
+    }
+    /** A little-endian unsigned 16-bit field of 2 octets at `offset`. */
+    static #fieldUInt16LE(name, offset, label) {
+        return {
+            type: 'integer',
+            label: label,
+            minimum: 0,
+            maximum: 65535,
+            decode: function () {
+                const b = this.readBytes(offset, 2);
+                this.instance[name].setValue(b[0] | (b[1] << 8));
+            },
+            encode: function () {
+                const node = this.instance[name];
+                let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                if (value > 65535) {
+                    this.recordError(node.getPath(), 'Maximum value is 65535');
+                    value = 65535;
+                }
+                if (value < 0) {
+                    this.recordError(node.getPath(), 'Minimum value is 0');
+                    value = 0;
+                }
+                node.setValue(value);
+                this.writeBytes(offset, Buffer.from([value & 0xff, (value >> 8) & 0xff]));
+            }
+        };
+    }
+    /** A little-endian unsigned 32-bit field of 4 octets at `offset`. */
+    static #fieldUInt32LE(name, offset, label) {
+        return {
+            type: 'integer',
+            label: label,
+            minimum: 0,
+            maximum: 4294967295,
+            decode: function () {
+                const b = this.readBytes(offset, 4);
+                this.instance[name].setValue((b[0] | (b[1] << 8) | (b[2] << 16) | (b[3] << 24)) >>> 0);
+            },
+            encode: function () {
+                const node = this.instance[name];
+                let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                if (value > 4294967295) {
+                    this.recordError(node.getPath(), 'Maximum value is 4294967295');
+                    value = 4294967295;
+                }
+                if (value < 0) {
+                    this.recordError(node.getPath(), 'Minimum value is 0');
+                    value = 0;
+                }
+                node.setValue(value);
+                this.writeBytes(offset, Buffer.from([value & 0xff, (value >> 8) & 0xff, (value >> 16) & 0xff, (value >>> 24) & 0xff]));
+            }
+        };
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'SMB2 command=${command} messageId=${messageId}',
+            properties: {
+                //Direct TCP transport header (MS-SMB2 §2.1): byte 0 is zero (the "session message" type),
+                //bytes 1-3 are the 24-bit big-endian StreamProtocolLength. Kept as a plain octet so a
+                //crafted non-zero type still round-trips.
+                transportType: this.fieldUInt('transportType', 0, 1, 'Transport Type'),
+                //24-bit big-endian length of the SMB2 message that follows (the 64-byte header + body,
+                //excluding this 4-byte transport prefix). Honored when supplied (a crafted frame may lie);
+                //else derived as 64 + body bytes.
+                streamProtocolLength: {
+                    type: 'integer',
+                    label: 'Stream Protocol Length',
+                    minimum: 0,
+                    maximum: 16777215,
+                    decode: function () {
+                        const b = this.readBytes(1, 3);
+                        this.instance.streamProtocolLength.setValue((b[0] << 16) | (b[1] << 8) | b[2]);
+                    },
+                    encode: function () {
+                        const provided = this.instance.streamProtocolLength.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : 64 + (0, HexToBuffer_1.HexToBuffer)(this.instance.body.getValue('')).length;
+                        if (value > 16777215) {
+                            this.recordError(this.instance.streamProtocolLength.getPath(), 'Maximum value is 16777215');
+                            value = 16777215;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.streamProtocolLength.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.streamProtocolLength.setValue(value);
+                        this.writeBytes(1, Buffer.from([(value >> 16) & 0xff, (value >> 8) & 0xff, value & 0xff]));
+                    }
+                },
+                //The 4-byte ProtocolId magic — 0xFE 'S' 'M' 'B' (fe534d42). Kept verbatim so a crafted
+                //magic round-trips; the match() gate enforces the real signature for selection.
+                protocolId: this.fieldHex('protocolId', 4, 4, 'Protocol Id'),
+                //StructureSize is always 64 on the wire (MS-SMB2 §2.2.1.1); kept as an honored LE uint so a
+                //crafted value round-trips (no hard constraint that would reject a lying value on re-encode).
+                structureSize: this.#fieldUInt16LE('structureSize', 8, 'Structure Size'),
+                creditCharge: this.#fieldUInt16LE('creditCharge', 10, 'Credit Charge'),
+                //Status (response) / ChannelSequence+Reserved (request) — a 4-byte LE field either way.
+                status: this.#fieldUInt32LE('status', 12, 'Status/ChannelSequence'),
+                //Command: 0 NEGOTIATE, 1 SESSION_SETUP, 2 LOGOFF, 3 TREE_CONNECT, 4 TREE_DISCONNECT, 5
+                //CREATE, 6 CLOSE, 8 READ, 9 WRITE, … (kept as a plain honored uint — no enum, so an
+                //unknown/crafted opcode still decodes and re-encodes).
+                command: this.#fieldUInt16LE('command', 16, 'Command'),
+                creditReqResp: this.#fieldUInt16LE('creditReqResp', 18, 'Credit Request/Response'),
+                flags: this.#fieldUInt32LE('flags', 20, 'Flags'),
+                //Offset of the next command in a compound request/response (0 = not compounded). This codec
+                //decodes the first message only; a non-zero NextCommand's trailing bytes fall through to raw.
+                nextCommand: this.#fieldUInt32LE('nextCommand', 24, 'Next Command'),
+                //8-byte MessageId — kept verbatim as hex (opaque LE, and a 64-bit value exceeds a JS
+                //number's exact integer range).
+                messageId: this.fieldHex('messageId', 28, 8, 'Message Id'),
+                //Reserved (ProcessId in the SYNC header; the low half of AsyncId in the ASYNC header),
+                //kept verbatim so either header form round-trips byte-for-byte.
+                reserved: this.fieldHex('reserved', 36, 4, 'Reserved'),
+                treeId: this.#fieldUInt32LE('treeId', 40, 'Tree Id'),
+                //8-byte SessionId — kept verbatim as hex (opaque LE, 64-bit).
+                sessionId: this.fieldHex('sessionId', 44, 8, 'Session Id'),
+                //16-byte message Signature (zero when unsigned) — kept verbatim.
+                signature: this.fieldHex('signature', 52, 16, 'Signature'),
+                //The command-specific body after the 64-byte header, kept verbatim. Bounded by the
+                //StreamProtocolLength (the message ends at 4 + StreamProtocolLength) and the captured bytes,
+                //so trailing / compounded / pipelined data is left to the codec's recursion / RawData.
+                body: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        const streamLength = this.instance.streamProtocolLength.getValue(0);
+                        let end = 4 + streamLength;
+                        if (end > remaining)
+                            end = remaining;
+                        this.instance.body.setValue(end > 68 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(68, end - 68)) : '');
+                    },
+                    encode: function () {
+                        const body = this.instance.body.getValue('');
+                        if (body)
+                            this.writeBytes(68, (0, HexToBuffer_1.HexToBuffer)(body));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //SMB2 rides on TCP port 445 (selected via the tcpport:445 bucket). Require the 4-byte transport
+        //prefix + the 0xFE 'S' 'M' 'B' (fe534d42) ProtocolId magic at offset 4 — a strong 4-byte content
+        //signature — so non-SMB2 445 traffic (and legacy SMB1's 0xFF 'S' 'M' 'B') falls through to raw.
+        //Selection stays port-bucketed (matchKeys, no heuristicFallback) like the other length-bounded
+        //TCP payload codecs.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.packet.length - this.startPos < 8)
+            return false;
+        return (0, BufferToHex_1.BufferToHex)(this.readBytes(4, 4)) === 'fe534d42';
+    }
+}
+exports.SMB2 = SMB2;

package/dist/headers/SMPP.d.ts

@@ -0,0 +1,33 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * Short Message Peer-to-Peer (SMPP 3.4), TCP port 2775 — the SMS-gateway ESME↔SMSC protocol. Every SMPP
+ * PDU begins with a fixed 16-byte header (all big-endian): command_length (the total octet count of the
+ * whole PDU, this header included), command_id (the operation, e.g. 0x00000001 bind_receiver,
+ * 0x00000002 bind_transmitter, 0x00000004 submit_sm, 0x00000009 bind_transceiver, 0x80000009
+ * bind_transceiver_resp — the 0x8000_0000 bit marks a response), command_status (0 = ESME_ROK on
+ * requests, the error code on responses) and sequence_number (correlates a request with its response) —
+ * followed by the command-specific body.
+ *
+ * The body layout is per-command (bind_*'s C-Octet-String system_id/password/system_type +
+ * interface_version + address fields, submit_sm's addresses and short_message, plus optional TLVs) and
+ * needs command-dependent parsing, so this single-PDU codec keeps the body verbatim as `body` hex
+ * (byte-perfect) and does not sub-decode it. command_length is auto-computed from the body on encode when
+ * not supplied, else honored verbatim (a crafted PDU may lie); the PDU is bounded by command_length so a
+ * second pipelined PDU or trailing bytes are left to the codec's recursion / RawData. A well-formed PDU
+ * round-trips byte-for-byte.
+ *
+ * command_id / command_status are decoded with unclamped uint32 fields (no hard enum) so any on-wire
+ * operation or error value survives decode→encode without being rejected.
+ */
+export declare class SMPP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/SMPP.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SMPP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * Short Message Peer-to-Peer (SMPP 3.4), TCP port 2775 — the SMS-gateway ESME↔SMSC protocol. Every SMPP
+ * PDU begins with a fixed 16-byte header (all big-endian): command_length (the total octet count of the
+ * whole PDU, this header included), command_id (the operation, e.g. 0x00000001 bind_receiver,
+ * 0x00000002 bind_transmitter, 0x00000004 submit_sm, 0x00000009 bind_transceiver, 0x80000009
+ * bind_transceiver_resp — the 0x8000_0000 bit marks a response), command_status (0 = ESME_ROK on
+ * requests, the error code on responses) and sequence_number (correlates a request with its response) —
+ * followed by the command-specific body.
+ *
+ * The body layout is per-command (bind_*'s C-Octet-String system_id/password/system_type +
+ * interface_version + address fields, submit_sm's addresses and short_message, plus optional TLVs) and
+ * needs command-dependent parsing, so this single-PDU codec keeps the body verbatim as `body` hex
+ * (byte-perfect) and does not sub-decode it. command_length is auto-computed from the body on encode when
+ * not supplied, else honored verbatim (a crafted PDU may lie); the PDU is bounded by command_length so a
+ * second pipelined PDU or trailing bytes are left to the codec's recursion / RawData. A well-formed PDU
+ * round-trips byte-for-byte.
+ *
+ * command_id / command_status are decoded with unclamped uint32 fields (no hard enum) so any on-wire
+ * operation or error value survives decode→encode without being rejected.
+ */
+class SMPP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'smpp';
+        this.name = 'Short Message Peer-to-Peer';
+        this.nickname = 'SMPP';
+        this.matchKeys = ['tcpport:2775'];
+        //A leaf header — the command-specific body requires per-command, TLV-aware parsing.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (SMPP.#schemaCache ??= SMPP.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'SMPP cmd=${commandId} seq=${sequenceNumber}',
+            properties: {
+                commandLength: {
+                    type: 'integer',
+                    label: 'Command Length',
+                    //minimum 0 (not 16): a crafted/corrupt PDU may carry a command_length below the 16-byte
+                    //header, and that value must round-trip (honored verbatim) rather than being rejected by
+                    //Ajv at the encode entry — decode never fails, encode is a faithful executor.
+                    minimum: 0,
+                    maximum: 4294967295,
+                    decode: function () {
+                        this.instance.commandLength.setValue((0, BufferToNumber_1.BufferToUInt32)(this.readBytes(0, 4)));
+                    },
+                    encode: function () {
+                        //command_length counts the whole PDU = 16-byte header + body. Honored when
+                        //supplied (a crafted PDU may lie); else derived from the body.
+                        const provided = this.instance.commandLength.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : 16 + (0, HexToBuffer_1.HexToBuffer)(this.instance.body.getValue('')).length;
+                        if (value > 4294967295) {
+                            this.recordError(this.instance.commandLength.getPath(), 'Maximum value is 4294967295');
+                            value = 4294967295;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.commandLength.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.commandLength.setValue(value);
+                        this.writeBytes(0, (0, NumberToBuffer_1.UInt32ToBuffer)(value));
+                    }
+                },
+                //The operation code; the 0x80000000 bit marks a response. Kept as an unclamped uint32
+                //(no hard enum) so any on-wire command_id round-trips.
+                commandId: this.fieldUInt('commandId', 4, 4, 'Command ID'),
+                //0 = ESME_ROK on requests; the operation's error code on responses. Unclamped uint32.
+                commandStatus: this.fieldUInt('commandStatus', 8, 4, 'Command Status'),
+                //Correlates a request PDU with its response PDU.
+                sequenceNumber: this.fieldUInt('sequenceNumber', 12, 4, 'Sequence Number'),
+                //The command-specific body after the 16-byte header, kept verbatim. Bounded by
+                //command_length (the PDU ends at offset command_length) and the captured bytes, so
+                //trailing / pipelined data is left to the codec's recursion / RawData.
+                body: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        const length = this.instance.commandLength.getValue(0);
+                        let end = length;
+                        if (end > remaining)
+                            end = remaining;
+                        this.instance.body.setValue(end > 16 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(16, end - 16)) : '');
+                    },
+                    encode: function () {
+                        const body = this.instance.body.getValue('');
+                        if (body)
+                            this.writeBytes(16, (0, HexToBuffer_1.HexToBuffer)(body));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //SMPP rides on TCP port 2775. The 16-byte header carries no strong content magic, so the
+        //well-known port is the signature: require the full header to be present. Selection stays
+        //port-bucketed (matchKeys) like the other length-bounded TCP payload codecs.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        return this.packet.length - this.startPos >= 16;
+    }
+}
+exports.SMPP = SMPP;

package/dist/headers/SMTP.d.ts

@@ -0,0 +1,33 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * SMTP — the Simple Mail Transfer Protocol (RFC 5321), carried as US-ASCII text over TCP well-known
+ * port 25 (and 587 for message submission). The control channel is line-based: a client sends commands
+ * (`EHLO host\r\n`, `MAIL FROM:<a@b>\r\n`, `RCPT TO:<c@d>\r\n`, `DATA\r\n`, `QUIT\r\n`) and a server
+ * sends replies (`220 mail.example.com ESMTP\r\n`, `250 OK\r\n`); a multi-line reply repeats the code
+ * with a '-' after the first line (`250-STARTTLS\r\n250 OK\r\n`). The DATA message body follows the same
+ * line channel but its arbitrary content is out of scope — only the control channel is claimed here.
+ *
+ * Like FTP, Syslog, SIP and HTTP, the message is text whose full internal structure (arbitrary
+ * arguments, significant whitespace, multi-line reply continuations) is richer than a form needs. So the
+ * ENTIRE raw message is kept verbatim as the authoritative `message` field (hex) and re-emitted
+ * untouched; only the first line is parsed on decode into display-only metadata (command/argument for a
+ * command, replyCode/replyText for a reply). Encode never reconstructs the message from the parsed
+ * fields — it writes `message` back byte-for-byte — so any conformant (or even malformed) SMTP line
+ * round-trips exactly.
+ *
+ * Note: a single TCP segment may carry more than one control line (pipelined commands) or only part of
+ * a multi-line reply; reassembly across segments is out of scope. This single-segment codec keeps
+ * whatever bytes are present verbatim, which is byte-perfect for the single-packet case.
+ */
+export declare class SMTP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/SMTP.js

@@ -0,0 +1,157 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SMTP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/** SMTP command verbs (RFC 5321 + common extensions) used only to recognize a command line. */
+const SMTP_COMMANDS = ['EHLO', 'HELO', 'MAIL', 'RCPT', 'DATA', 'RSET', 'VRFY', 'EXPN', 'HELP', 'NOOP', 'QUIT', 'AUTH', 'STARTTLS', 'BDAT'];
+/**
+ * SMTP — the Simple Mail Transfer Protocol (RFC 5321), carried as US-ASCII text over TCP well-known
+ * port 25 (and 587 for message submission). The control channel is line-based: a client sends commands
+ * (`EHLO host\r\n`, `MAIL FROM:<a@b>\r\n`, `RCPT TO:<c@d>\r\n`, `DATA\r\n`, `QUIT\r\n`) and a server
+ * sends replies (`220 mail.example.com ESMTP\r\n`, `250 OK\r\n`); a multi-line reply repeats the code
+ * with a '-' after the first line (`250-STARTTLS\r\n250 OK\r\n`). The DATA message body follows the same
+ * line channel but its arbitrary content is out of scope — only the control channel is claimed here.
+ *
+ * Like FTP, Syslog, SIP and HTTP, the message is text whose full internal structure (arbitrary
+ * arguments, significant whitespace, multi-line reply continuations) is richer than a form needs. So the
+ * ENTIRE raw message is kept verbatim as the authoritative `message` field (hex) and re-emitted
+ * untouched; only the first line is parsed on decode into display-only metadata (command/argument for a
+ * command, replyCode/replyText for a reply). Encode never reconstructs the message from the parsed
+ * fields — it writes `message` back byte-for-byte — so any conformant (or even malformed) SMTP line
+ * round-trips exactly.
+ *
+ * Note: a single TCP segment may carry more than one control line (pipelined commands) or only part of
+ * a multi-line reply; reassembly across segments is out of scope. This single-segment codec keeps
+ * whatever bytes are present verbatim, which is byte-perfect for the single-packet case.
+ */
+class SMTP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'smtp';
+        this.name = 'Simple Mail Transfer Protocol';
+        this.nickname = 'SMTP';
+        //SMTP is recognized ONLY on its well-known port buckets 25 (relay) and 587 (submission) —
+        //deliberately NOT via heuristicFallback. Unlike HTTP/RTSP (whose method sets are distinctive),
+        //SMTP's line signature is a 3-digit reply code or a generic verb (HELO/QUIT/NOOP/HELP/AUTH/DATA/…)
+        //that is SHARED with other US-ASCII line protocols this codec does not model — FTP (QUIT/NOOP/AUTH/
+        //HELP), POP3 (QUIT/NOOP), IRC (QUIT), and any NNN-code greeting (FTP/NNTP). Joining the global
+        //heuristic chain would mislabel all of those as SMTP on their own ports. Confining SMTP to the
+        //tcp:25/tcp:587 buckets keeps that collision impossible (FTP/POP3/IRC live on 21/110/6667, which
+        //never reach these buckets); alt-port SMTP is rare and falls losslessly to raw.
+        this.matchKeys = ['tcpport:25', 'tcpport:587'];
+        //A leaf header — the DATA message body and the mail session it belongs to are a higher-layer concern.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (_a.#schemaCache ??= _a.#buildSchema());
+    }
+    /**
+     * Bytes of this header: SMTP rides on TCP, which has no per-message length, so take the rest of the
+     * segment. Reassembly across segments is out of scope (see class doc).
+     */
+    #payloadLength() {
+        const available = this.packet.length - this.startPos;
+        return available < 0 ? 0 : available;
+    }
+    /** The first line of the message (up to the first CRLF, or the whole payload if none). */
+    static #firstLine(text) {
+        const idx = text.indexOf('\r\n');
+        return idx >= 0 ? text.slice(0, idx) : text;
+    }
+    /**
+     * Parse the first line into the display-only metadata fields. A line matching `^\d{3}[ -]` is a
+     * server reply (the code, whether it is multi-line, and the trailing text); anything else is a
+     * client command (the uppercased verb and its argument). Populated on decode only — these fields
+     * have no encode, so they never affect the re-emitted bytes and never mutate `message`. Never
+     * throws: missing/garbage tokens yield empty strings or 0.
+     */
+    #parseFirstLine(text) {
+        const line = _a.#firstLine(text);
+        const reply = line.match(/^(\d{3})([ -])(.*)$/);
+        if (reply) {
+            //Reply: 3-digit code, then ' ' (final) or '-' (a multi-line continuation follows).
+            this.instance.isReply.setValue(true);
+            this.instance.replyCode.setValue(Number(reply[1]));
+            this.instance.isMultiline.setValue(reply[2] === '-');
+            this.instance.replyText.setValue(reply[3]);
+            this.instance.command.setValue('');
+            this.instance.argument.setValue('');
+            return;
+        }
+        //Command: VERB SP argument (the argument may itself contain spaces, e.g. an address path).
+        const idx = line.indexOf(' ');
+        const verb = idx >= 0 ? line.slice(0, idx) : line;
+        this.instance.isReply.setValue(false);
+        this.instance.replyCode.setValue(0);
+        this.instance.isMultiline.setValue(false);
+        this.instance.replyText.setValue('');
+        this.instance.command.setValue(verb.toUpperCase());
+        this.instance.argument.setValue(idx >= 0 ? line.slice(idx + 1) : '');
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'SMTP ${command}${replyCode}',
+            properties: {
+                //The whole raw message is the single source of truth: decoded verbatim to hex and
+                //re-emitted untouched (byte-perfect for any SMTP control text). The first line is parsed
+                //into the display-only metadata below, which carry no codec of their own.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        if (available <= 0) {
+                            this.instance.message.setValue('');
+                            this.#parseFirstLine('');
+                            return;
+                        }
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parseFirstLine(raw.toString('latin1'));
+                    },
+                    encode: function () {
+                        //Re-emit the authoritative message verbatim — never reconstruct from metadata.
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                },
+                //Display-only metadata parsed from the first line on decode (no encode — populated by the
+                //message field above, never read back). isReply distinguishes a server reply from a
+                //client command; replyCode/isMultiline/replyText describe a reply, command/argument a
+                //command.
+                isReply: { type: 'boolean', label: 'Is Reply' },
+                replyCode: { type: 'integer', label: 'Reply Code', minimum: 0, maximum: 999 },
+                isMultiline: { type: 'boolean', label: 'Is Multiline' },
+                replyText: { type: 'string', label: 'Reply Text' },
+                command: { type: 'string', label: 'Command' },
+                argument: { type: 'string', label: 'Argument' }
+            }
+        };
+    }
+    match() {
+        //SMTP rides on TCP as US-ASCII text. Recognize it by the line signature: a 3-digit reply code
+        //followed by space or '-', or a known command verb as the leading token (up to the first space
+        //or CR) — so non-SMTP traffic on port 25/587 falls through to raw rather than claiming an
+        //un-decodable text layer.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.#payloadLength() < 3)
+            return false;
+        const lead = this.readBytes(0, 16, true).toString('latin1');
+        if (/^\d{3}[ -]/.test(lead))
+            return true;
+        const line = _a.#firstLine(lead);
+        const token = (line.split(/[ \r]/)[0] || '').toUpperCase();
+        return SMTP_COMMANDS.includes(token);
+    }
+}
+exports.SMTP = SMTP;
+_a = SMTP;

package/dist/headers/SNAP.d.ts

@@ -0,0 +1,22 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * SNAP — Sub-Network Access Protocol (IEEE 802.2), the 5-byte header that follows an LLC header whose
+ * DSAP/SSAP are 0xAA. It carries a 3-byte OUI (Organizationally Unique Identifier) and a 2-byte Protocol
+ * Identifier. When the OUI is 0x000000 the PID is an EtherType, so SNAP re-exposes it (in a field named
+ * `etherType`, identically to Ethernet/VLAN) and routes IPv4/ARP/IPv6/… through the existing `ethertype`
+ * demux for free. A non-zero OUI (e.g. Cisco 0x00000C for CDP/VTP) is a vendor protocol whose PID is not
+ * an EtherType; for those SNAP also emits an `snapoui` key of OUI+PID concatenated. A well-formed SNAP
+ * header round-trips byte-for-byte.
+ */
+export declare class SNAP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/SNAP.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SNAP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+/**
+ * SNAP — Sub-Network Access Protocol (IEEE 802.2), the 5-byte header that follows an LLC header whose
+ * DSAP/SSAP are 0xAA. It carries a 3-byte OUI (Organizationally Unique Identifier) and a 2-byte Protocol
+ * Identifier. When the OUI is 0x000000 the PID is an EtherType, so SNAP re-exposes it (in a field named
+ * `etherType`, identically to Ethernet/VLAN) and routes IPv4/ARP/IPv6/… through the existing `ethertype`
+ * demux for free. A non-zero OUI (e.g. Cisco 0x00000C for CDP/VTP) is a vendor protocol whose PID is not
+ * an EtherType; for those SNAP also emits an `snapoui` key of OUI+PID concatenated. A well-formed SNAP
+ * header round-trips byte-for-byte.
+ */
+class SNAP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'snap';
+        this.name = 'Sub-Network Access Protocol';
+        this.nickname = 'SNAP';
+        this.matchKeys = ['llcsap:170'];
+        //Two producers: the EtherType (for OUI 0x000000 → the shared ethertype machinery) and the OUI+PID
+        //(for vendor protocols → the snapoui namespace). Both are emitted; the miss simply never matches.
+        this.demuxProducers = [
+            { field: 'etherType', namespace: 'ethertype', kind: 'string' },
+            { field: 'ouiProtocol', namespace: 'snapoui', kind: 'string' }
+        ];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (SNAP.#schemaCache ??= SNAP.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'SNAP oui=${oui} type=${etherType}',
+            properties: {
+                oui: this.fieldHex('oui', 0, 3, 'OUI'),
+                //Named `etherType` (not `pid`) so the existing ethertype demux + IPv4/ARP/IPv6 match() —
+                //which read the parent's `etherType` field literally — route through SNAP unchanged, exactly
+                //as they do through Ethernet II and 802.1Q.
+                etherType: this.fieldHex('etherType', 3, 2, 'Protocol Type'),
+                //Display/demux-only: OUI+PID concatenated, the `snapoui` key for vendor protocols (CDP/VTP
+                //under Cisco 0x00000C). No encode closure — the bytes are written by oui + etherType, this
+                //is derived — so it never affects the re-emitted frame.
+                ouiProtocol: {
+                    type: 'string',
+                    label: 'OUI Protocol',
+                    decode: function () {
+                        const oui = this.instance.oui.getValue('');
+                        const etherType = this.instance.etherType.getValue('');
+                        this.instance.ouiProtocol.setValue((oui + etherType).toLowerCase());
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //An LLC child selected by DSAP 0xAA (170). Confirm the parent is LLC with DSAP 0xAA and the full
+        //5-byte SNAP header is present.
+        const prev = this.prevCodecModule;
+        if (!prev || prev.id !== 'llc')
+            return false;
+        if (prev.instance.dsap.getValue(0) !== 0xaa)
+            return false;
+        return this.packet.length - this.startPos >= 5;
+    }
+}
+exports.SNAP = SNAP;