@netkitty/codec 1.0.0

package/dist/headers/MongoDB.js

@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MongoDB = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * MongoDB Wire Protocol (TCP port 27017). Every message begins with a fixed 16-byte standard message
+ * header — messageLength, requestID, responseTo, opCode — followed by an opCode-specific body. The
+ * messageLength counts the WHOLE message including the 16-byte header; requestID / responseTo tie a
+ * request to its reply; opCode selects the body layout (2013 OP_MSG — the modern, general-purpose
+ * message; 2004 OP_QUERY and 1 OP_REPLY — the legacy request/reply pair; plus OP_UPDATE/INSERT/… ).
+ *
+ * ⚠️ Every multi-byte field in the MongoDB wire protocol is LITTLE-ENDIAN. There is no little-endian
+ * helper in this codebase, so the four uint32 header fields are read and written byte-by-byte in their
+ * closures (`|` yields a signed int32, so the read applies `>>> 0` to the whole expression to keep a
+ * high-bit-set value unsigned).
+ *
+ * The body layout differs per opCode (OP_MSG's flagBits + sections of BSON, OP_QUERY's collection name /
+ * query document, OP_REPLY's cursor + returned documents) and BSON sub-parsing is cross-message,
+ * opCode-dependent state, so this single-message codec keeps the body verbatim as `body` hex
+ * (byte-perfect) and does not sub-decode it. The messageLength is auto-computed from the body on encode
+ * when not supplied, else honored verbatim (a crafted message may lie); the message is bounded by
+ * messageLength so a second pipelined message or trailing bytes are left to the codec's recursion /
+ * RawData. A well-formed message round-trips byte-for-byte.
+ */
+class MongoDB extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'mongodb';
+        this.name = 'MongoDB Wire Protocol';
+        this.nickname = 'MongoDB';
+        this.matchKeys = ['tcpport:27017'];
+        //A leaf header — the opCode-specific body (BSON sections/documents) requires cross-message,
+        //opCode-dependent parsing.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (MongoDB.#schemaCache ??= MongoDB.#buildSchema());
+    }
+    /** A little-endian unsigned 32-bit field of 4 octets at `offset` (MongoDB on-wire byte order). */
+    static #fieldUInt32LE(name, offset, label) {
+        return {
+            type: 'integer',
+            label: label,
+            minimum: 0,
+            maximum: 4294967295,
+            decode: function () {
+                const b = this.readBytes(offset, 4);
+                this.instance[name].setValue((b[0] | (b[1] << 8) | (b[2] << 16) | (b[3] << 24)) >>> 0);
+            },
+            encode: function () {
+                const node = this.instance[name];
+                let value = node.getValue(0, (nodePath) => this.recordError(nodePath, 'Not Found'));
+                if (value > 4294967295) {
+                    this.recordError(node.getPath(), 'Maximum value is 4294967295');
+                    value = 4294967295;
+                }
+                if (value < 0) {
+                    this.recordError(node.getPath(), 'Minimum value is 0');
+                    value = 0;
+                }
+                node.setValue(value);
+                this.writeBytes(offset, Buffer.from([value & 0xff, (value >> 8) & 0xff, (value >> 16) & 0xff, (value >>> 24) & 0xff]));
+            }
+        };
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'MongoDB opCode=${opCode} len=${messageLength}',
+            properties: {
+                //All multi-byte fields are LITTLE-ENDIAN.
+                //messageLength counts the WHOLE message including this 16-byte header. Honored when
+                //supplied (a crafted message may lie); else derived from the header + body byte length.
+                messageLength: {
+                    type: 'integer',
+                    label: 'Message Length',
+                    minimum: 0,
+                    maximum: 4294967295,
+                    decode: function () {
+                        const b = this.readBytes(0, 4);
+                        this.instance.messageLength.setValue((b[0] | (b[1] << 8) | (b[2] << 16) | (b[3] << 24)) >>> 0);
+                    },
+                    encode: function () {
+                        const provided = this.instance.messageLength.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : 16 + (0, HexToBuffer_1.HexToBuffer)(this.instance.body.getValue('')).length;
+                        if (value > 4294967295) {
+                            this.recordError(this.instance.messageLength.getPath(), 'Maximum value is 4294967295');
+                            value = 4294967295;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.messageLength.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.messageLength.setValue(value);
+                        this.writeBytes(0, Buffer.from([value & 0xff, (value >> 8) & 0xff, (value >> 16) & 0xff, (value >>> 24) & 0xff]));
+                    }
+                },
+                requestID: this.#fieldUInt32LE('requestID', 4, 'Request ID'),
+                responseTo: this.#fieldUInt32LE('responseTo', 8, 'Response To'),
+                //opCode selects the body layout (2013 OP_MSG, 2004 OP_QUERY, 1 OP_REPLY, …). Kept as a
+                //plain little-endian uint32 — byte-perfect and editable; an unknown/crafted opCode is a
+                //valid packet, so no enum constraint is imposed (it would reject a legal decoded value).
+                opCode: this.#fieldUInt32LE('opCode', 12, 'Op Code'),
+                //The opCode-specific body after the 16-byte header, kept verbatim. Bounded by the message
+                //messageLength (the message ends at offset messageLength) and the captured bytes, so
+                //trailing / pipelined data is left to the codec's recursion / RawData.
+                body: {
+                    type: 'string',
+                    label: 'Body',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        const length = this.instance.messageLength.getValue(0);
+                        let end = length;
+                        if (end > remaining)
+                            end = remaining;
+                        this.instance.body.setValue(end > 16 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(16, end - 16)) : '');
+                    },
+                    encode: function () {
+                        const body = this.instance.body.getValue('');
+                        if (body)
+                            this.writeBytes(16, (0, HexToBuffer_1.HexToBuffer)(body));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //MongoDB rides on TCP port 27017. The standard message header carries no strong content magic
+        //(the fields are counters / an opCode), so the well-known port is the signature: require the
+        //full 16-byte header to be present.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        return this.packet.length - this.startPos >= 16;
+    }
+}
+exports.MongoDB = MongoDB;

package/dist/headers/MySQL.d.ts

@@ -0,0 +1,30 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * MySQL client/server protocol (MySQL / MariaDB wire protocol), TCP port 3306. Every message is framed by
+ * a 4-byte packet header — a 3-byte payload length followed by a 1-byte sequence id — then exactly
+ * `payloadLength` bytes of payload. The payload's meaning is connection-phase- and command-dependent
+ * (handshake, auth, command, resultset) and is cross-message stateful, so this single-message codec
+ * structures only the 4-byte packet header and keeps the payload verbatim as `payload` hex (byte-perfect).
+ *
+ * ⚠️ Unlike most of the codec's protocols, the 3-byte payload length is LITTLE-ENDIAN (the MySQL wire
+ * protocol is little-endian throughout). There is no little-endian helper in this codebase, so the length
+ * is read and written byte-by-byte in its closure: `b[0] | (b[1] << 8) | (b[2] << 16)` (max 0xFFFFFF, so
+ * no sign issue — the value is always < 2^24). See ENIP.ts for the same hand-written little-endian pattern.
+ *
+ * The payload is bounded by the length field (it ends at offset 4 + payloadLength) and by the captured
+ * bytes, so a pipelined second MySQL packet or trailing bytes in the same segment are left to the codec's
+ * recursion / RawData. The length is auto-computed from the payload on encode when not supplied, else
+ * honored verbatim (a crafted message may carry any length). A well-formed message round-trips byte-for-byte.
+ */
+export declare class MySQL extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/MySQL.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MySQL = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * MySQL client/server protocol (MySQL / MariaDB wire protocol), TCP port 3306. Every message is framed by
+ * a 4-byte packet header — a 3-byte payload length followed by a 1-byte sequence id — then exactly
+ * `payloadLength` bytes of payload. The payload's meaning is connection-phase- and command-dependent
+ * (handshake, auth, command, resultset) and is cross-message stateful, so this single-message codec
+ * structures only the 4-byte packet header and keeps the payload verbatim as `payload` hex (byte-perfect).
+ *
+ * ⚠️ Unlike most of the codec's protocols, the 3-byte payload length is LITTLE-ENDIAN (the MySQL wire
+ * protocol is little-endian throughout). There is no little-endian helper in this codebase, so the length
+ * is read and written byte-by-byte in its closure: `b[0] | (b[1] << 8) | (b[2] << 16)` (max 0xFFFFFF, so
+ * no sign issue — the value is always < 2^24). See ENIP.ts for the same hand-written little-endian pattern.
+ *
+ * The payload is bounded by the length field (it ends at offset 4 + payloadLength) and by the captured
+ * bytes, so a pipelined second MySQL packet or trailing bytes in the same segment are left to the codec's
+ * recursion / RawData. The length is auto-computed from the payload on encode when not supplied, else
+ * honored verbatim (a crafted message may carry any length). A well-formed message round-trips byte-for-byte.
+ */
+class MySQL extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'mysql';
+        this.name = 'MySQL Protocol';
+        this.nickname = 'MySQL';
+        //MySQL is recognized ONLY on its well-known port bucket (tcp:3306) — deliberately NOT via
+        //heuristicFallback. The 4-byte packet header (a 3-byte length + a sequence id) carries no reliable
+        //mid-stream content signature: any TCP segment could begin with a plausible little-endian length, so a
+        //global heuristic would mislabel unrelated traffic as MySQL. Confining MySQL to its tcp:3306 bucket (as
+        //FTP/SMTP/POP3 are confined to theirs) keeps that collision impossible; alt-port MySQL is rare and
+        //falls losslessly to raw.
+        this.matchKeys = ['tcpport:3306'];
+        //A leaf header — the payload is phase/command-dependent, cross-message state; kept as hex, not demuxed.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (MySQL.#schemaCache ??= MySQL.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'MySQL seq=${sequenceId} len=${payloadLength}',
+            properties: {
+                //The 3-byte payload length is LITTLE-ENDIAN (MySQL wire byte order); read/written by hand.
+                payloadLength: {
+                    type: 'integer',
+                    label: 'Payload Length',
+                    minimum: 0,
+                    maximum: 0xffffff,
+                    decode: function () {
+                        const b = this.readBytes(0, 3);
+                        this.instance.payloadLength.setValue(b[0] | (b[1] << 8) | (b[2] << 16));
+                    },
+                    encode: function () {
+                        //The length counts only the payload that follows the 4-byte packet header.
+                        //Honored when supplied (a crafted message may lie); else derived from the payload.
+                        const provided = this.instance.payloadLength.getValue();
+                        let value = (provided !== undefined && provided !== null)
+                            ? provided
+                            : (0, HexToBuffer_1.HexToBuffer)(this.instance.payload.getValue('')).length;
+                        if (value > 0xffffff) {
+                            this.recordError(this.instance.payloadLength.getPath(), 'Maximum value is 16777215');
+                            value = 0xffffff;
+                        }
+                        if (value < 0) {
+                            this.recordError(this.instance.payloadLength.getPath(), 'Minimum value is 0');
+                            value = 0;
+                        }
+                        this.instance.payloadLength.setValue(value);
+                        //3-byte little-endian: low byte first. value < 2^24, so value >> 16 is a plain
+                        //non-negative byte — no sign issue.
+                        this.writeBytes(0, Buffer.from([value & 0xff, (value >> 8) & 0xff, (value >> 16) & 0xff]));
+                    }
+                },
+                sequenceId: this.fieldUInt('sequenceId', 3, 1, 'Sequence ID'),
+                //The message payload after the 4-byte packet header, kept verbatim. Bounded by the length
+                //field (the message ends at offset 4 + payloadLength) and the captured bytes, so a pipelined
+                //second packet or trailing bytes are left to the codec's recursion / RawData.
+                payload: {
+                    type: 'string',
+                    label: 'Payload',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const remaining = this.packet.length - this.startPos;
+                        const length = this.instance.payloadLength.getValue(0);
+                        let end = 4 + length;
+                        if (end > remaining)
+                            end = remaining;
+                        this.instance.payload.setValue(end > 4 ? (0, BufferToHex_1.BufferToHex)(this.readBytes(4, end - 4)) : '');
+                    },
+                    encode: function () {
+                        const payload = this.instance.payload.getValue('');
+                        if (payload)
+                            this.writeBytes(4, (0, HexToBuffer_1.HexToBuffer)(payload));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //MySQL rides on TCP port 3306. The packet header carries no strong content magic, so the
+        //well-known port is the signature: require at least the full 4-byte packet header to be present.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        return this.packet.length - this.startPos >= 4;
+    }
+}
+exports.MySQL = MySQL;

package/dist/headers/NATS.d.ts

@@ -0,0 +1,29 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * NATS — the client/server text protocol of the NATS messaging system, carried over TCP (well-known
+ * port 4222). A NATS message is US-ASCII text: an operation verb, optional arguments on the control line
+ * terminated by CRLF, and — for the publish/deliver verbs — a payload body also terminated by CRLF. The
+ * control operations are `INFO {json}`, `CONNECT {json}`, `PUB subject [reply] #bytes`,
+ * `HPUB ...`, `SUB subject [queue] sid`, `UNSUB sid [max]`, `MSG subject sid [reply] #bytes`,
+ * `HMSG ...`, `PING`, `PONG`, `+OK`, and `-ERR message`.
+ *
+ * Like SIP/HTTP, the message body is text whose full internal structure (arbitrary JSON options, subject
+ * hierarchies, header blocks, binary-safe payloads, significant whitespace) is far richer than a form
+ * needs, and TCP may coalesce or split messages so no per-message length is authoritative. So the ENTIRE
+ * raw segment is kept verbatim as the authoritative `message` field (hex) and re-emitted untouched; only
+ * the leading operation and its control line are parsed on decode into display-only metadata. Encode
+ * never reconstructs the message from the parsed fields — it writes `message` back byte-for-byte — so
+ * any conformant (or even malformed) NATS message round-trips exactly.
+ */
+export declare class NATS extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/NATS.js

@@ -0,0 +1,135 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NATS = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * NATS control operations (the client/server protocol verbs). Operations that carry arguments on the
+ * control line are followed by a space; the standalone operations are followed by CRLF. The set is used
+ * only to recognize the leading operation of a message. NATS treats the verbs case-insensitively.
+ */
+const NATS_ARG_OPS = ['CONNECT', 'INFO', 'HPUB', 'PUB', 'HMSG', 'MSG', 'SUB', 'UNSUB', '-ERR'];
+const NATS_SOLO_OPS = ['PING', 'PONG', '+OK'];
+/**
+ * NATS — the client/server text protocol of the NATS messaging system, carried over TCP (well-known
+ * port 4222). A NATS message is US-ASCII text: an operation verb, optional arguments on the control line
+ * terminated by CRLF, and — for the publish/deliver verbs — a payload body also terminated by CRLF. The
+ * control operations are `INFO {json}`, `CONNECT {json}`, `PUB subject [reply] #bytes`,
+ * `HPUB ...`, `SUB subject [queue] sid`, `UNSUB sid [max]`, `MSG subject sid [reply] #bytes`,
+ * `HMSG ...`, `PING`, `PONG`, `+OK`, and `-ERR message`.
+ *
+ * Like SIP/HTTP, the message body is text whose full internal structure (arbitrary JSON options, subject
+ * hierarchies, header blocks, binary-safe payloads, significant whitespace) is far richer than a form
+ * needs, and TCP may coalesce or split messages so no per-message length is authoritative. So the ENTIRE
+ * raw segment is kept verbatim as the authoritative `message` field (hex) and re-emitted untouched; only
+ * the leading operation and its control line are parsed on decode into display-only metadata. Encode
+ * never reconstructs the message from the parsed fields — it writes `message` back byte-for-byte — so
+ * any conformant (or even malformed) NATS message round-trips exactly.
+ */
+class NATS extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'nats';
+        this.name = 'NATS Client Protocol';
+        this.nickname = 'NATS';
+        this.matchKeys = ['tcpport:4222'];
+        //A leaf header — the NATS payload body and the subscription/exchange it belongs to are higher-layer
+        //concerns; the raw message is kept verbatim.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (_a.#schemaCache ??= _a.#buildSchema());
+    }
+    /**
+     * Bytes of this header: NATS rides on TCP, which has no per-message length, so take the rest of the
+     * segment. Reassembly / message framing across segments is out of scope (see class doc).
+     */
+    #payloadLength() {
+        const available = this.packet.length - this.startPos;
+        return available < 0 ? 0 : available;
+    }
+    /** The first line of the message (up to the first CRLF, or the whole payload if none). */
+    static #firstLine(text) {
+        const idx = text.indexOf('\r\n');
+        return idx >= 0 ? text.slice(0, idx) : text;
+    }
+    /**
+     * Parse the control line into the display-only metadata fields: the leading operation verb
+     * (upper-cased, as NATS is case-insensitive) and the remaining control-line arguments. Populated on
+     * decode only — these fields have no encode, so they never affect the re-emitted bytes and never
+     * mutate `message`. Never throws: a missing operation yields empty strings.
+     */
+    #parseControlLine(text) {
+        const line = _a.#firstLine(text);
+        //The operation is the first whitespace-delimited token (space or tab); the rest is the argument
+        //list (JSON for INFO/CONNECT, subject/sid/#bytes for PUB/MSG/SUB, message for -ERR, or empty).
+        const spaceIdx = line.search(/[ \t]/);
+        const operation = spaceIdx >= 0 ? line.slice(0, spaceIdx) : line;
+        const args = spaceIdx >= 0 ? line.slice(spaceIdx + 1) : '';
+        this.instance.operation.setValue(operation.toUpperCase());
+        this.instance.controlArguments.setValue(args);
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'NATS ${operation}',
+            properties: {
+                //The whole raw segment is the single source of truth: decoded verbatim to hex and
+                //re-emitted untouched (byte-perfect for any NATS message). The control line is parsed into
+                //the display-only metadata below, which carry no codec of their own.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        if (available <= 0) {
+                            this.instance.message.setValue('');
+                            this.#parseControlLine('');
+                            return;
+                        }
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parseControlLine(raw.toString('latin1'));
+                    },
+                    encode: function () {
+                        //Re-emit the authoritative message verbatim — never reconstruct from metadata.
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                },
+                //Display-only metadata parsed from the control line on decode (no encode — populated by the
+                //message field above, never read back). operation is the leading verb (upper-cased);
+                //controlArguments is the remainder of the control line (empty for PING/PONG/+OK).
+                operation: { type: 'string', label: 'Operation' },
+                controlArguments: { type: 'string', label: 'Arguments' }
+            }
+        };
+    }
+    match() {
+        //NATS rides on TCP port 4222 as US-ASCII text. Recognize it by the operation signature: a known
+        //argument-carrying verb followed by a space, or a standalone verb followed by CRLF — so non-NATS
+        //traffic on port 4222 falls through to raw rather than claiming an un-decodable text layer. The
+        //verbs are matched case-insensitively (NATS is case-insensitive). No heuristicFallback: selection
+        //stays strictly port-bucketed like the other text TCP payload codecs.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'tcp')
+            return false;
+        if (this.#payloadLength() <= 0)
+            return false;
+        const lead = this.readBytes(0, 12, true).toString('latin1').toUpperCase();
+        for (const op of NATS_ARG_OPS) {
+            if (lead.startsWith(op + ' '))
+                return true;
+        }
+        for (const op of NATS_SOLO_OPS) {
+            if (lead.startsWith(op + '\r'))
+                return true;
+        }
+        return false;
+    }
+}
+exports.NATS = NATS;
+_a = NATS;

package/dist/headers/NBDS.d.ts

@@ -0,0 +1,34 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * NBDS — NetBIOS Datagram Service (RFC 1002 §4.4), the NetBIOS-over-TCP/IP datagram service on UDP 138.
+ * Every NBDS packet opens with a fixed 10-byte common prefix — a 1-byte Message Type, a 1-byte Flags
+ * octet (MORE/FIRST fragment bits + 2-bit Source End-Node Type + reserved bits), a 2-byte Datagram ID,
+ * the 4-byte Source IP and the 2-byte Source Port of the originating node.
+ *
+ * What follows the prefix depends on the Message Type. The DIRECT_UNIQUE (0x10), DIRECT_GROUP (0x11)
+ * and BROADCAST (0x12) datagrams add a 2-byte Datagram Length and a 2-byte Packet Offset (fragmentation
+ * offset), then the second-level-encoded Source and Destination NetBIOS names followed by the user data
+ * (an SMB mailslot payload, e.g. a browser announcement). DATAGRAM ERROR (0x13) carries a 1-byte error
+ * code; the QUERY messages (0x14/0x15/0x16) carry only a destination name. So only the Direct/Broadcast
+ * types have the Datagram-Length / Packet-Offset words — they are structured for those types and left out
+ * of the byte stream otherwise (mirroring COTP's DT-only fields).
+ *
+ * The names + user data (for Direct/Broadcast) or the type-specific remainder (for the other types) are
+ * kept verbatim as `body` hex, bounded by the UDP payload length so trailing bytes are not absorbed:
+ * decoding the second-level NetBIOS names and handing the user data to SMB is a later enrichment. Message
+ * Type is stored as the raw octet (fieldUInt — no enum, so a crafted/unknown type still round-trips) and
+ * the Datagram Length is honored on encode when supplied, else derived from the body. A well-formed
+ * datagram of any type round-trips byte-for-byte.
+ */
+export declare class NBDS extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}