@netkitty/codec 1.0.0

package/dist/headers/DNS.js

@@ -0,0 +1,309 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DNS = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * DNS — Domain Name System (RFC 1035), the message carried over UDP port 53. A 12-byte header (ID,
+ * flags, and the four section counts) followed by the Question, Answer, Authority and Additional
+ * sections. Names use label compression (RFC 1035 §4.1.4): a length octet with its top two bits set
+ * (0xC0) is a 14-bit pointer to an earlier offset in the message.
+ *
+ * Byte-perfect strategy: every name keeps its exact wire bytes (`raw`) and every record's RDATA is
+ * kept as raw hex, so compression pointers — inside names and inside RDATA (CNAME/NS/SOA/MX targets) —
+ * are reproduced verbatim; the resolved dotted name (`value`) is a decoded convenience. Per-RDATA
+ * semantic decoding (A → address, etc.) is a later enrichment on top of this faithful base. DNS over
+ * TCP (which prefixes a 2-byte length and can span segments) is out of scope for this single-packet
+ * codec and belongs to the reassembly layer.
+ */
+class DNS extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        //Running parse/emit cursor shared across the four section closures (they run in schema order:
+        //questions → answers → authorities → additionals). Header-relative; the header is 12 bytes.
+        this.#cursor = 12;
+        this.id = 'dns';
+        this.name = 'Domain Name System';
+        this.nickname = 'DNS';
+        //Port-defined (udp:53). DNS has no content signature, so no heuristicFallback. DNS over TCP uses a
+        //2-byte length prefix and can span segments — that is a reassembly-layer concern, not this codec.
+        this.matchKeys = ['udpport:53'];
+        //A leaf header — nothing demuxes above DNS.
+        this.demuxProducers = [];
+    }
+    //Running parse/emit cursor shared across the four section closures (they run in schema order:
+    //questions → answers → authorities → additionals). Header-relative; the header is 12 bytes.
+    #cursor;
+    static #schemaCache;
+    get SCHEMA() {
+        return (DNS.#schemaCache ??= DNS.#buildSchema());
+    }
+    static #flagBit(name, byteOffset, bitOffset, label) {
+        return {
+            type: 'boolean',
+            label: label,
+            decode: function () {
+                this.instance.flags[name].setValue(!!this.readBits(byteOffset, 1, bitOffset, 1));
+            },
+            encode: function () {
+                const value = !!this.instance.flags[name].getValue();
+                this.instance.flags[name].setValue(value);
+                this.writeBits(byteOffset, 1, bitOffset, 1, value ? 1 : 0);
+            }
+        };
+    }
+    static #flagInt(name, byteOffset, bitOffset, bitLength, label) {
+        return {
+            type: 'integer',
+            label: label,
+            minimum: 0,
+            maximum: (1 << bitLength) - 1,
+            decode: function () {
+                this.instance.flags[name].setValue(this.readBits(byteOffset, 1, bitOffset, bitLength));
+            },
+            encode: function () {
+                const value = this.instance.flags[name].getValue(0);
+                this.writeBits(byteOffset, 1, bitOffset, bitLength, value);
+            }
+        };
+    }
+    static #buildSchema() {
+        const nameSchema = {
+            type: 'object',
+            label: 'Name',
+            properties: {
+                value: { type: 'string', label: 'Name' },
+                raw: { type: 'string', label: 'Raw', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX, hidden: true }
+            }
+        };
+        return {
+            type: 'object',
+            summary: 'DNS ${id} queries=${qdcount} answers=${ancount}',
+            properties: {
+                id: this.fieldUInt('id', 0, 2, 'Transaction ID'),
+                //Byte 2 (bit 0 = MSB): QR, Opcode[4], AA, TC, RD. Byte 3: RA, Z, AD, CD, RCODE[4].
+                flags: {
+                    type: 'object',
+                    label: 'Flags',
+                    properties: {
+                        qr: this.#flagBit('qr', 2, 0, 'Response'),
+                        opcode: this.#flagInt('opcode', 2, 1, 4, 'Opcode'),
+                        aa: this.#flagBit('aa', 2, 5, 'Authoritative'),
+                        tc: this.#flagBit('tc', 2, 6, 'Truncated'),
+                        rd: this.#flagBit('rd', 2, 7, 'Recursion Desired'),
+                        ra: this.#flagBit('ra', 3, 0, 'Recursion Available'),
+                        z: this.#flagBit('z', 3, 1, 'Reserved'),
+                        ad: this.#flagBit('ad', 3, 2, 'Authentic Data'),
+                        cd: this.#flagBit('cd', 3, 3, 'Checking Disabled'),
+                        rcode: this.#flagInt('rcode', 3, 4, 4, 'Reply Code')
+                    }
+                },
+                qdcount: this.fieldUInt('qdcount', 4, 2, 'Questions'),
+                ancount: this.fieldUInt('ancount', 6, 2, 'Answer RRs'),
+                nscount: this.fieldUInt('nscount', 8, 2, 'Authority RRs'),
+                arcount: this.fieldUInt('arcount', 10, 2, 'Additional RRs'),
+                questions: {
+                    type: 'array',
+                    label: 'Queries',
+                    items: {
+                        type: 'object',
+                        label: 'Query',
+                        properties: {
+                            name: nameSchema,
+                            qtype: { type: 'integer', label: 'Type', minimum: 0, maximum: 65535 },
+                            qclass: { type: 'integer', label: 'Class', minimum: 0, maximum: 65535 }
+                        }
+                    },
+                    decode: function () {
+                        const count = this.instance.qdcount.getValue(0);
+                        const available = this.packet.length - this.startPos;
+                        const questions = [];
+                        let offset = 12;
+                        for (let i = 0; i < count && offset < available; i++) {
+                            const nameEnd = this.readName(offset);
+                            let o = nameEnd.next;
+                            const qtype = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(o, 2));
+                            o += 2;
+                            const qclass = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(o, 2));
+                            o += 2;
+                            questions.push({ name: nameEnd.name, qtype: qtype, qclass: qclass });
+                            offset = o;
+                        }
+                        this.#cursor = offset;
+                        this.instance.questions.setValue(questions);
+                    },
+                    encode: function () {
+                        const questions = this.instance.questions.getValue();
+                        let offset = 12;
+                        if (questions) {
+                            for (const question of questions) {
+                                offset = this.writeName(offset, question.name);
+                                this.writeBytes(offset, (0, NumberToBuffer_1.UInt16ToBuffer)(question.qtype ? question.qtype : 0));
+                                offset += 2;
+                                this.writeBytes(offset, (0, NumberToBuffer_1.UInt16ToBuffer)(question.qclass ? question.qclass : 0));
+                                offset += 2;
+                            }
+                        }
+                        this.#cursor = offset;
+                    }
+                },
+                answers: this.#recordSection('answers', 'Answers', 'ancount'),
+                authorities: this.#recordSection('authorities', 'Authoritative nameservers', 'nscount'),
+                additionals: this.#recordSection('additionals', 'Additional records', 'arcount')
+            }
+        };
+    }
+    //A resource-record section (Answer/Authority/Additional): NAME TYPE CLASS TTL RDLENGTH RDATA, each
+    //continuing from the shared cursor. RDLENGTH is derived from the RDATA byte length on encode.
+    static #recordSection(field, label, countField) {
+        const nameSchema = {
+            type: 'object',
+            label: 'Name',
+            properties: {
+                value: { type: 'string', label: 'Name' },
+                raw: { type: 'string', label: 'Raw', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX, hidden: true }
+            }
+        };
+        return {
+            type: 'array',
+            label: label,
+            items: {
+                type: 'object',
+                label: 'Resource Record',
+                properties: {
+                    name: nameSchema,
+                    type: { type: 'integer', label: 'Type', minimum: 0, maximum: 65535 },
+                    class: { type: 'integer', label: 'Class', minimum: 0, maximum: 65535 },
+                    ttl: { type: 'integer', label: 'Time to Live', minimum: 0, maximum: 4294967295 },
+                    rdlength: { type: 'integer', label: 'Data Length', minimum: 0, maximum: 65535 },
+                    rdata: { type: 'string', label: 'Data', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX }
+                }
+            },
+            decode: function () {
+                const count = this.instance[countField].getValue(0);
+                const available = this.packet.length - this.startPos;
+                const records = [];
+                let offset = this.#cursor;
+                for (let i = 0; i < count && offset < available; i++) {
+                    const nameEnd = this.readName(offset);
+                    let o = nameEnd.next;
+                    const type = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(o, 2));
+                    o += 2;
+                    const cls = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(o, 2));
+                    o += 2;
+                    const ttl = (0, BufferToNumber_1.BufferToUInt32)(this.readBytes(o, 4));
+                    o += 4;
+                    const rdlength = (0, BufferToNumber_1.BufferToUInt16)(this.readBytes(o, 2));
+                    o += 2;
+                    let rdata = '';
+                    if (rdlength) {
+                        rdata = (0, BufferToHex_1.BufferToHex)(this.readBytes(o, rdlength));
+                        o += rdlength;
+                    }
+                    records.push({ name: nameEnd.name, type: type, class: cls, ttl: ttl, rdlength: rdlength, rdata: rdata });
+                    offset = o;
+                }
+                this.#cursor = offset;
+                this.instance[field].setValue(records);
+            },
+            encode: function () {
+                const records = this.instance[field].getValue();
+                let offset = this.#cursor;
+                if (records) {
+                    for (const record of records) {
+                        offset = this.writeName(offset, record.name);
+                        this.writeBytes(offset, (0, NumberToBuffer_1.UInt16ToBuffer)(record.type ? record.type : 0));
+                        offset += 2;
+                        this.writeBytes(offset, (0, NumberToBuffer_1.UInt16ToBuffer)(record.class ? record.class : 0));
+                        offset += 2;
+                        this.writeBytes(offset, (0, NumberToBuffer_1.UInt32ToBuffer)(record.ttl ? record.ttl : 0));
+                        offset += 4;
+                        const rdata = Buffer.from(record.rdata ? record.rdata : '', 'hex');
+                        //RDLENGTH is authoritatively the RDATA byte length — derive it (byte-perfect,
+                        //since the decoded RDLENGTH equals the RDATA length).
+                        this.writeBytes(offset, (0, NumberToBuffer_1.UInt16ToBuffer)(rdata.length));
+                        offset += 2;
+                        if (rdata.length) {
+                            this.writeBytes(offset, rdata);
+                            offset += rdata.length;
+                        }
+                    }
+                }
+                this.#cursor = offset;
+            }
+        };
+    }
+    /**
+     * Parse the name at header-relative `offset`. Returns the resolved value + exact physical raw bytes
+     * and the offset just past the physical name. Compression pointers are followed only to build the
+     * resolved value (dry-run reads that never grow headerLength); the physical bytes are the local
+     * labels plus the terminating null OR the 2-byte pointer, so endPos stays exact.
+     */
+    readName(offset) {
+        const labels = [];
+        const visited = new Set();
+        let o = offset;
+        let physicalEnd = -1;
+        let guard = 0;
+        while (guard++ < 256) {
+            if (visited.has(o))
+                break;
+            visited.add(o);
+            const len = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(o, 1, true));
+            if (len === 0) {
+                if (physicalEnd < 0)
+                    physicalEnd = o + 1;
+                break;
+            }
+            if ((len & 0xc0) === 0xc0) {
+                const pointer = ((len & 0x3f) << 8) | (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(o + 1, 1, true));
+                if (physicalEnd < 0)
+                    physicalEnd = o + 2;
+                o = pointer;
+                continue;
+            }
+            labels.push(this.readBytes(o + 1, len, true).toString('latin1'));
+            o = o + 1 + len;
+        }
+        if (physicalEnd < 0)
+            physicalEnd = o;
+        const rawLength = physicalEnd - offset;
+        //Physically read the local name bytes (non-dry-run) so headerLength/endPos cover them.
+        const raw = rawLength > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(offset, rawLength)) : '';
+        return { name: { value: labels.join('.'), raw: raw }, next: physicalEnd };
+    }
+    /**
+     * Write a name at `offset`. Re-emits the exact `raw` wire bytes when present (byte-perfect for a
+     * decoded name, including its compression pointer); otherwise builds an uncompressed encoding from
+     * the dotted `value` (for names crafted from scratch). Returns the offset past the written name.
+     */
+    writeName(offset, name) {
+        const raw = name && name.raw ? name.raw : '';
+        if (raw) {
+            const rawBuffer = Buffer.from(raw, 'hex');
+            this.writeBytes(offset, rawBuffer);
+            return offset + rawBuffer.length;
+        }
+        let o = offset;
+        const value = name && name.value ? name.value : '';
+        if (value.length) {
+            for (const label of value.split('.')) {
+                const labelBuffer = Buffer.from(label, 'latin1');
+                this.writeBytes(o, (0, NumberToBuffer_1.UInt8ToBuffer)(labelBuffer.length));
+                o += 1;
+                this.writeBytes(o, labelBuffer);
+                o += labelBuffer.length;
+            }
+        }
+        this.writeBytes(o, (0, NumberToBuffer_1.UInt8ToBuffer)(0));
+        o += 1;
+        return o;
+    }
+    match() {
+        return !!this.prevCodecModule && this.prevCodecModule.id === 'udp';
+    }
+}
+exports.DNS = DNS;

package/dist/headers/DTLS.d.ts

@@ -0,0 +1,33 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * DTLS — Datagram Transport Layer Security (RFC 6347), the datagram-oriented sibling of TLS carried over
+ * UDP. Its record layer mirrors TLS's but adds explicit anti-replay sequencing: every record begins with a
+ * fixed 13-byte header — ContentType(1) + Version(2) + Epoch(2) + SequenceNumber(6) + Length(2) — followed
+ * by the `Length`-byte Fragment. ContentType names the sub-protocol (20 change_cipher_spec, 21 alert,
+ * 22 handshake, 23 application_data, 24 heartbeat); Version is 0xfeff for DTLS 1.0 or 0xfefd for DTLS 1.2
+ * (deliberately ~ the ones-complement of the TLS version so the two never collide). Epoch counts cipher
+ * changes and SequenceNumber is a 48-bit per-epoch counter.
+ *
+ * DTLS has no single well-known UDP port (it underlies WebRTC, CoAP-over-DTLS, OpenVPN-style tunnels,
+ * etc.), so this header is bucketed on udp:443 yet opts into the content-heuristic fallback: its record
+ * header is a strong signature (ContentType in 20..25 AND Version feff/fefd) that lets it be recognized on
+ * any UDP port. This is a minimal record-layer slice: it structures one record header and keeps the
+ * Fragment verbatim as hex (bounded by `Length` and the UDP payload); the Fragment's sub-protocol
+ * (handshake / alert / …) and any second pipelined record in the same datagram are left to later
+ * enrichment / the codec's recursion (a leaf advances only over its own record). The Length is honored
+ * when supplied (a crafted record may lie) else derived from the Fragment; a well-formed record
+ * round-trips byte-for-byte.
+ */
+export declare class DTLS extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    readonly heuristicFallback: boolean;
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/DTLS.js

@@ -0,0 +1,142 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DTLS = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * DTLS — Datagram Transport Layer Security (RFC 6347), the datagram-oriented sibling of TLS carried over
+ * UDP. Its record layer mirrors TLS's but adds explicit anti-replay sequencing: every record begins with a
+ * fixed 13-byte header — ContentType(1) + Version(2) + Epoch(2) + SequenceNumber(6) + Length(2) — followed
+ * by the `Length`-byte Fragment. ContentType names the sub-protocol (20 change_cipher_spec, 21 alert,
+ * 22 handshake, 23 application_data, 24 heartbeat); Version is 0xfeff for DTLS 1.0 or 0xfefd for DTLS 1.2
+ * (deliberately ~ the ones-complement of the TLS version so the two never collide). Epoch counts cipher
+ * changes and SequenceNumber is a 48-bit per-epoch counter.
+ *
+ * DTLS has no single well-known UDP port (it underlies WebRTC, CoAP-over-DTLS, OpenVPN-style tunnels,
+ * etc.), so this header is bucketed on udp:443 yet opts into the content-heuristic fallback: its record
+ * header is a strong signature (ContentType in 20..25 AND Version feff/fefd) that lets it be recognized on
+ * any UDP port. This is a minimal record-layer slice: it structures one record header and keeps the
+ * Fragment verbatim as hex (bounded by `Length` and the UDP payload); the Fragment's sub-protocol
+ * (handshake / alert / …) and any second pipelined record in the same datagram are left to later
+ * enrichment / the codec's recursion (a leaf advances only over its own record). The Length is honored
+ * when supplied (a crafted record may lie) else derived from the Fragment; a well-formed record
+ * round-trips byte-for-byte.
+ */
+class DTLS extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'dtls';
+        this.name = 'Datagram Transport Layer Security';
+        this.nickname = 'DTLS';
+        //Bucketed on the common DTLS-over-HTTPS port; heuristicFallback keeps it recognized on any other UDP
+        //port via its record-header signature (DTLS has no single well-known port).
+        this.matchKeys = ['udpport:443'];
+        this.heuristicFallback = true;
+        //A leaf header — the record Fragment's sub-protocol is kept verbatim for now.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (DTLS.#schemaCache ??= DTLS.#buildSchema());
+    }
+    /**
+     * Bytes available to this record, bounded by the enclosing UDP payload (udp.length - 8) so a lying
+     * Length near the end of the datagram cannot read into a trailing record / padding, and so the
+     * Fragment stops at the datagram boundary rather than swallowing the whole captured buffer.
+     */
+    #available() {
+        let available = this.packet.length - this.startPos;
+        const prev = this.prevCodecModule;
+        if (prev && prev.id === 'udp') {
+            const udpPayload = prev.instance.length.getValue(0) - 8;
+            if (udpPayload >= 0 && udpPayload < available)
+                available = udpPayload;
+        }
+        return available < 0 ? 0 : available;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'DTLS type=${contentType} len=${length}',
+            properties: {
+                //ContentType (20 change_cipher_spec, 21 alert, 22 handshake, 23 application_data,
+                //24 heartbeat). Kept as an integer — the record header is otherwise opaque here.
+                contentType: this.fieldUInt('contentType', 0, 1, 'Content Type'),
+                //Version — 0xfeff DTLS 1.0 / 0xfefd DTLS 1.2. Stored as a lower-case hex string so any
+                //value round-trips verbatim (the match gate restricts real selection to feff/fefd).
+                version: this.fieldHex('version', 1, 2, 'Version'),
+                epoch: this.fieldUInt('epoch', 3, 2, 'Epoch'),
+                //48-bit per-epoch sequence number, kept verbatim as hex (exceeds the 32-bit fieldUInt path).
+                sequenceNumber: this.fieldHex('sequenceNumber', 5, 6, 'Sequence Number'),
+                length: {
+                    type: 'integer',
+                    label: 'Length',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        this.instance.length.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(11, 2)));
+                    },
+                    encode: function () {
+                        //Honored when supplied (a crafted record may lie); else derived from the Fragment.
+                        const provided = this.instance.length.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : (0, HexToBuffer_1.HexToBuffer)(this.instance.fragment.getValue('')).length;
+                        if (value > 65535) {
+                            this.recordError(this.instance.length.getPath(), 'Maximum value is 65535');
+                            value = 65535;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.length.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.length.setValue(value);
+                        this.writeBytes(11, (0, NumberToBuffer_1.UInt16ToBuffer)(value));
+                    }
+                },
+                //The record Fragment (the sub-protocol payload), kept verbatim. Bounded by the decoded
+                //Length and the UDP payload, so trailing / pipelined records are left to the codec's
+                //recursion (a leaf record does not re-match itself — its parent is no longer UDP).
+                fragment: {
+                    type: 'string',
+                    label: 'Fragment',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#available();
+                        const maxFragment = available - 13;
+                        let fragmentLength = this.instance.length.getValue(0);
+                        if (maxFragment <= 0)
+                            fragmentLength = 0;
+                        else if (fragmentLength > maxFragment)
+                            fragmentLength = maxFragment;
+                        this.instance.fragment.setValue(fragmentLength > 0 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(13, fragmentLength)) : '');
+                    },
+                    encode: function () {
+                        const fragment = this.instance.fragment.getValue('');
+                        if (fragment)
+                            this.writeBytes(13, (0, HexToBuffer_1.HexToBuffer)(fragment));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //DTLS rides UDP. Require the full 13-byte record header within the UDP payload, a ContentType in
+        //the DTLS sub-protocol range (20..25), and a DTLS 1.0/1.2 Version (feff/fefd) — a distinctive
+        //two-field signature so non-DTLS UDP traffic (on 443 or elsewhere) falls through to raw.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'udp')
+            return false;
+        if (this.#available() < 13)
+            return false;
+        const contentType = this.readBytes(0, 1, true)[0];
+        if (contentType < 20 || contentType > 25)
+            return false;
+        const version = (0, BufferToHex_1.BufferToHex)(this.readBytes(1, 2, true));
+        return version === 'feff' || version === 'fefd';
+    }
+}
+exports.DTLS = DTLS;

package/dist/headers/Diameter.d.ts

@@ -0,0 +1,34 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * Diameter (RFC 6733), the RADIUS successor — TCP/SCTP port 3868. A 20-byte fixed header, all
+ * big-endian: Version (1, always 1) + Message Length (3, the whole message including the header and the
+ * padded AVPs) + Command Flags (1: R/P/E/T in the high nibble) + Command Code (3) + Application-Id (4) +
+ * Hop-by-Hop Id (4) + End-to-End Id (4). It is followed by AVPs until the Message Length is consumed.
+ *
+ * Each AVP is AVP Code(4) + Flags(1: V/M/P) + Length(3, counts the AVP header + data but NOT the trailing
+ * padding) + [Vendor-Id(4) only when the V flag 0x80 is set] + data + padding (zero bytes to the next
+ * 4-byte boundary). Because the AVP Length excludes the padding, the alignment pad is the tricky part of a
+ * byte-perfect round-trip: it is captured verbatim (per AVP, as hex) and re-emitted, so even a malformed
+ * non-zero pad reproduces exactly. AVPs are carried generically (code + flags + verbatim hex value) so
+ * every AVP — including Grouped AVPs whose value nests sub-AVPs — round-trips; per-AVP semantic decoding
+ * is a later enrichment. The walk is bounded by the Message Length (and the captured bytes), so any
+ * trailing/pipelined bytes spill to the raw layer.
+ *
+ * MATCH is a two-signal gate — the well-known port bucket (tcpport:3868) plus a content signature
+ * (Version == 1 and a plausible Message Length >= 20) — so there is deliberately NO heuristicFallback:
+ * unlike a content-signed protocol (TLS/IEC104), Diameter's first byte (a constant 1) and 3-byte length
+ * are far too weak a signature to claim arbitrary off-port TCP traffic, so recognition stays anchored to
+ * the port bucket. Non-Diameter traffic on 3868 (or a Version != 1) falls through to raw.
+ */
+export declare class Diameter extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}