@netkitty/codec 1.0.0

package/dist/headers/RADIUS.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RADIUS = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const BufferToNumber_1 = require("../helper/BufferToNumber");
+const NumberToBuffer_1 = require("../helper/NumberToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/**
+ * RADIUS — Remote Authentication Dial-In User Service (RFC 2865 auth / RFC 2866 accounting), UDP ports
+ * 1812 (auth) and 1813 (accounting). A 20-byte fixed header — Code, Identifier, Length (the whole
+ * packet), and a 16-byte Authenticator — followed by attributes (AVPs) in Type-Length-Value form:
+ * type(1) + length(1, counts the type+length+value) + value(length-2).
+ *
+ * Attributes are carried generically (type + verbatim hex value) so every attribute — including
+ * Vendor-Specific (26) whose value nests sub-AVPs — round-trips byte-for-byte; per-attribute semantic
+ * decoding is a later enrichment. The AVP walk is bounded by the RADIUS Length (and the UDP payload),
+ * so any trailing padding/FCS spills to the raw layer.
+ */
+class RADIUS extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'radius';
+        this.name = 'Remote Authentication Dial-In User Service';
+        this.nickname = 'RADIUS';
+        this.matchKeys = ['udpport:1812', 'udpport:1813'];
+        //A leaf header — nothing demuxes above RADIUS.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (RADIUS.#schemaCache ??= RADIUS.#buildSchema());
+    }
+    /** Bytes available for this RADIUS message: the frame end, clamped by the UDP payload and the RADIUS Length. */
+    #available() {
+        let available = this.packet.length - this.startPos;
+        if (this.prevCodecModule && this.prevCodecModule.id === 'udp') {
+            const udpLength = this.prevCodecModule.instance.length.getValue(0);
+            if (udpLength >= 8 && udpLength - 8 < available)
+                available = udpLength - 8;
+        }
+        const radiusLength = this.instance.length.getValue(0);
+        if (radiusLength >= 20 && radiusLength < available)
+            available = radiusLength;
+        return available < 0 ? 0 : available;
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'RADIUS code=${code} id=${identifier}',
+            properties: {
+                code: this.fieldUInt('code', 0, 1, 'Code'),
+                identifier: this.fieldUInt('identifier', 1, 1, 'Identifier'),
+                length: {
+                    type: 'integer',
+                    label: 'Length',
+                    minimum: 0,
+                    maximum: 65535,
+                    decode: function () {
+                        this.instance.length.setValue((0, BufferToNumber_1.BufferToUInt16)(this.readBytes(2, 2)));
+                    },
+                    encode: function () {
+                        //Honor an explicitly-set Length (even 0 — so a decoded malformed Length=0 still
+                        //round-trips byte-for-byte); auto-compute only when the field is absent (crafting).
+                        const length = this.instance.length.getValue();
+                        if (length !== undefined && length !== null) {
+                            this.instance.length.setValue(length);
+                            this.writeBytes(2, (0, NumberToBuffer_1.UInt16ToBuffer)(length));
+                        }
+                        else {
+                            this.writeBytes(2, (0, NumberToBuffer_1.UInt16ToBuffer)(0));
+                            //After the attributes have encoded, the header length is the whole message.
+                            this.addPostSelfEncodeHandler(() => {
+                                this.instance.length.setValue(this.length);
+                                this.writeBytes(2, (0, NumberToBuffer_1.UInt16ToBuffer)(this.length));
+                            }, 1);
+                        }
+                    }
+                },
+                authenticator: this.fieldHex('authenticator', 4, 16, 'Authenticator'),
+                attributes: {
+                    type: 'array',
+                    label: 'Attributes',
+                    items: {
+                        type: 'object',
+                        label: 'Attribute',
+                        properties: {
+                            type: { type: 'integer', label: 'Type', minimum: 0, maximum: 255 },
+                            value: { type: 'string', label: 'Value', contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX }
+                        }
+                    },
+                    decode: function () {
+                        const available = this.#available();
+                        const attributes = [];
+                        let offset = 20;
+                        //Each AVP is type(1) length(1) value(length-2). A length < 2 is invalid (and would
+                        //not advance), and a length that overruns the payload is truncated — in both cases
+                        //stop and leave the remaining bytes to the raw layer, keeping the round-trip exact.
+                        while (offset + 2 <= available) {
+                            const type = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(offset, 1, true));
+                            const length = (0, BufferToNumber_1.BufferToUInt8)(this.readBytes(offset + 1, 1, true));
+                            if (length < 2 || offset + length > available)
+                                break;
+                            const attributeBuffer = this.readBytes(offset, length);
+                            attributes.push({ type: type, value: length > 2 ? (0, BufferToHex_1.BufferToHex)(attributeBuffer.subarray(2)) : '' });
+                            offset += length;
+                        }
+                        this.instance.attributes.setValue(attributes);
+                    },
+                    encode: function () {
+                        const attributes = this.instance.attributes.getValue([]);
+                        if (!attributes)
+                            return;
+                        let offset = 20;
+                        for (const attribute of attributes) {
+                            const value = (0, HexToBuffer_1.HexToBuffer)(attribute.value ? attribute.value : '');
+                            this.writeBytes(offset, (0, NumberToBuffer_1.UInt8ToBuffer)(attribute.type ? attribute.type : 0));
+                            this.writeBytes(offset + 1, (0, NumberToBuffer_1.UInt8ToBuffer)(value.length + 2));
+                            offset += 2;
+                            if (value.length) {
+                                this.writeBytes(offset, value);
+                                offset += value.length;
+                            }
+                        }
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Require the full 20-byte fixed header within the UDP PAYLOAD (not just the captured frame — a
+        //padded sub-20-byte datagram on a RADIUS port would otherwise over-read the trailer into the
+        //header). During MATCH the Length field is unset, so #available() reduces to the UDP-payload bound.
+        return !!this.prevCodecModule && this.prevCodecModule.id === 'udp' && this.#available() >= 20;
+    }
+}
+exports.RADIUS = RADIUS;

package/dist/headers/RDP.d.ts

@@ -0,0 +1,27 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * RDP — Remote Desktop Protocol (MS-RDPBCGR), specifically the X.224 Negotiation that opens every RDP
+ * connection, carried in the user data of a COTP Connection Request / Connection Confirm (over
+ * TPKT/tcp:3389). The 8-byte structure is: a 1-byte Type (0x01 Negotiation Request, 0x02 Negotiation
+ * Response, 0x03 Negotiation Failure), a 1-byte Flags, a 2-byte little-endian Length (always 8), and a
+ * 4-byte little-endian bitmask — the requested/selected security protocols (0x00 standard RDP, 0x01 TLS,
+ * 0x02 CredSSP/HYBRID, 0x08 RDSTLS, …).
+ *
+ * This is the single-packet-identifiable part of RDP; the subsequent MCS/T.125 data phase (over COTP DT)
+ * is a multi-layer sub-stack left for later. A cookie/routing-token prefix (ASCII "Cookie: …\r\n") that
+ * may precede the Negotiation in some Connection Requests is not handled here (such a CR falls to raw).
+ * The Negotiation round-trips byte-for-byte.
+ */
+export declare class RDP extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    readonly heuristicFallback: boolean;
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/RDP.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RDP = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+/**
+ * RDP — Remote Desktop Protocol (MS-RDPBCGR), specifically the X.224 Negotiation that opens every RDP
+ * connection, carried in the user data of a COTP Connection Request / Connection Confirm (over
+ * TPKT/tcp:3389). The 8-byte structure is: a 1-byte Type (0x01 Negotiation Request, 0x02 Negotiation
+ * Response, 0x03 Negotiation Failure), a 1-byte Flags, a 2-byte little-endian Length (always 8), and a
+ * 4-byte little-endian bitmask — the requested/selected security protocols (0x00 standard RDP, 0x01 TLS,
+ * 0x02 CredSSP/HYBRID, 0x08 RDSTLS, …).
+ *
+ * This is the single-packet-identifiable part of RDP; the subsequent MCS/T.125 data phase (over COTP DT)
+ * is a multi-layer sub-stack left for later. A cookie/routing-token prefix (ASCII "Cookie: …\r\n") that
+ * may precede the Negotiation in some Connection Requests is not handled here (such a CR falls to raw).
+ * The Negotiation round-trips byte-for-byte.
+ */
+class RDP extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'rdp';
+        this.name = 'Remote Desktop Protocol';
+        this.nickname = 'RDP';
+        //A content-heuristic child of COTP (unkeyed), selected by the X.224 Negotiation signature.
+        this.matchKeys = [];
+        this.heuristicFallback = true;
+        //A leaf for this slice — the MCS/T.125 data phase is a separate sub-stack.
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (RDP.#schemaCache ??= RDP.#buildSchema());
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'RDP-Neg type=${negotiationType} protocols=${requestedProtocols}',
+            properties: {
+                //0x01 Negotiation Request, 0x02 Response, 0x03 Failure.
+                negotiationType: this.fieldUInt('negotiationType', 0, 1, 'Negotiation Type'),
+                flags: this.fieldUInt('flags', 1, 1, 'Flags'),
+                //2-byte LITTLE-ENDIAN length — always 8 for the Negotiation. Honored verbatim.
+                length: {
+                    type: 'integer', label: 'Length', minimum: 0, maximum: 65535,
+                    decode: function () {
+                        const bytes = this.readBytes(2, 2);
+                        this.instance.length.setValue((bytes[0] | (bytes[1] << 8)) & 0xffff);
+                    },
+                    encode: function () {
+                        let value = this.instance.length.getValue(8);
+                        if (value > 65535)
+                            value = 65535;
+                        if (value < 0)
+                            value = 0;
+                        this.writeBytes(2, Buffer.from([value & 0xff, (value >> 8) & 0xff]));
+                    }
+                },
+                //4-byte LITTLE-ENDIAN protocol bitmask (RDP/TLS/CredSSP/RDSTLS). >>> 0 keeps it unsigned.
+                requestedProtocols: {
+                    type: 'integer', label: 'Requested Protocols', minimum: 0, maximum: 4294967295,
+                    decode: function () {
+                        const b = this.readBytes(4, 4);
+                        this.instance.requestedProtocols.setValue((b[0] | (b[1] << 8) | (b[2] << 16) | (b[3] << 24)) >>> 0);
+                    },
+                    encode: function () {
+                        let value = this.instance.requestedProtocols.getValue(0);
+                        if (value > 4294967295)
+                            value = 4294967295;
+                        if (value < 0)
+                            value = 0;
+                        this.writeBytes(4, Buffer.from([value & 0xff, (value >> 8) & 0xff, (value >> 16) & 0xff, (value >>> 24) & 0xff]));
+                    }
+                }
+            }
+        };
+    }
+    match() {
+        //Rides in COTP CR/CC user data. The Negotiation is a strong signature: an 8-byte structure whose
+        //Type is 0x01/0x02/0x03 and whose little-endian Length field is exactly 8 (byte 2 = 0x08, byte
+        //3 = 0x00) — distinctive enough to separate it from ISO-Session/other COTP payloads without a
+        //port gate.
+        if (!this.prevCodecModule || this.prevCodecModule.id !== 'cotp')
+            return false;
+        if (this.packet.length - this.startPos < 8)
+            return false;
+        const header = this.readBytes(0, 4, true);
+        const type = header[0];
+        if (type !== 0x01 && type !== 0x02 && type !== 0x03)
+            return false;
+        return header[2] === 0x08 && header[3] === 0x00;
+    }
+}
+exports.RDP = RDP;

package/dist/headers/RFB.d.ts

@@ -0,0 +1,39 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * RFB / VNC — the Remote Framebuffer Protocol (RFC 6143), the wire protocol behind VNC, carried over TCP
+ * well-known port 5900. A connection OPENS with a 12-byte ProtocolVersion handshake: the US-ASCII line
+ * `"RFB 003.008\n"` (or 003.003 / 003.007) — exactly `RFB ` then a 3-digit major, a dot, a 3-digit minor,
+ * and a trailing `\n`. After that come binary security/init messages and then the (complex, stateful)
+ * framebuffer-update protocol.
+ *
+ * MINIMAL slice: this codec structures ONLY the clean, self-identifying text part — the 12-byte
+ * ProtocolVersion handshake — into display-only metadata {isVersionHandshake, versionString, major,
+ * minor}. Everything else (the post-handshake binary messages) is kept verbatim; structuring those is a
+ * later slice. Like the text protocols (HTTP/SIP/FTP), the ENTIRE raw payload is the single source of
+ * truth: it is decoded verbatim to hex in the `message` field and re-emitted byte-for-byte on encode —
+ * the parsed metadata carry no codec of their own and never reconstruct the bytes. So any RFB payload
+ * (version handshake, binary message, or truncated fragment) round-trips exactly.
+ *
+ * Matching is deliberately PORT-CONFINED to tcp:5900 with NO heuristicFallback. The 12-byte "RFB xxx.yyy\n"
+ * greeting is a strong, distinctive signature, but the post-handshake RFB messages are opaque binary with
+ * no reliable content signature — they cannot be recognized off-port without over-claiming arbitrary TCP
+ * traffic. So the tcp:5900 bucket is the whole scope: on that bucket a leading "RFB " (with >=12 bytes) is
+ * a version handshake and any other payload is kept as verbatim RFB `data`. Off port 5900, even an
+ * "RFB "-looking payload falls losslessly to raw (see the port-confinement test). This mirrors FTP's
+ * bucket-only confinement, for the same "the tail is ambiguous, so trust the port" reason.
+ *
+ * Note: reassembly across TCP segments is out of scope. This single-segment codec keeps whatever bytes
+ * are present verbatim, which is byte-perfect for the single-packet case.
+ */
+export declare class RFB extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}

package/dist/headers/RFB.js

@@ -0,0 +1,151 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RFB = void 0;
+const BaseHeader_1 = require("../abstracts/BaseHeader");
+const BufferToHex_1 = require("../helper/BufferToHex");
+const HexToBuffer_1 = require("../helper/HexToBuffer");
+const StringContentEncodingEnum_1 = require("../lib/StringContentEncodingEnum");
+/** The 4-byte signature that opens every RFB stream ("RFB " — the ProtocolVersion handshake prefix). */
+const RFB_SIGNATURE = 'RFB ';
+/** The ProtocolVersion handshake is a fixed 12-byte line: `RFB ` + 3-digit major `.` 3-digit minor + `\n`. */
+const RFB_VERSION_LENGTH = 12;
+/**
+ * RFB / VNC — the Remote Framebuffer Protocol (RFC 6143), the wire protocol behind VNC, carried over TCP
+ * well-known port 5900. A connection OPENS with a 12-byte ProtocolVersion handshake: the US-ASCII line
+ * `"RFB 003.008\n"` (or 003.003 / 003.007) — exactly `RFB ` then a 3-digit major, a dot, a 3-digit minor,
+ * and a trailing `\n`. After that come binary security/init messages and then the (complex, stateful)
+ * framebuffer-update protocol.
+ *
+ * MINIMAL slice: this codec structures ONLY the clean, self-identifying text part — the 12-byte
+ * ProtocolVersion handshake — into display-only metadata {isVersionHandshake, versionString, major,
+ * minor}. Everything else (the post-handshake binary messages) is kept verbatim; structuring those is a
+ * later slice. Like the text protocols (HTTP/SIP/FTP), the ENTIRE raw payload is the single source of
+ * truth: it is decoded verbatim to hex in the `message` field and re-emitted byte-for-byte on encode —
+ * the parsed metadata carry no codec of their own and never reconstruct the bytes. So any RFB payload
+ * (version handshake, binary message, or truncated fragment) round-trips exactly.
+ *
+ * Matching is deliberately PORT-CONFINED to tcp:5900 with NO heuristicFallback. The 12-byte "RFB xxx.yyy\n"
+ * greeting is a strong, distinctive signature, but the post-handshake RFB messages are opaque binary with
+ * no reliable content signature — they cannot be recognized off-port without over-claiming arbitrary TCP
+ * traffic. So the tcp:5900 bucket is the whole scope: on that bucket a leading "RFB " (with >=12 bytes) is
+ * a version handshake and any other payload is kept as verbatim RFB `data`. Off port 5900, even an
+ * "RFB "-looking payload falls losslessly to raw (see the port-confinement test). This mirrors FTP's
+ * bucket-only confinement, for the same "the tail is ambiguous, so trust the port" reason.
+ *
+ * Note: reassembly across TCP segments is out of scope. This single-segment codec keeps whatever bytes
+ * are present verbatim, which is byte-perfect for the single-packet case.
+ */
+class RFB extends BaseHeader_1.BaseHeader {
+    constructor() {
+        super(...arguments);
+        this.id = 'rfb';
+        this.name = 'RFB (VNC)';
+        this.nickname = 'VNC';
+        //RFB/VNC is recognized ONLY on the well-known port 5900 — deliberately NOT via heuristicFallback.
+        //The 12-byte "RFB xxx.yyy\n" greeting is distinctive, but the post-handshake RFB messages are opaque
+        //binary with no content signature, so they can only be claimed by trusting the port. Confining to the
+        //tcp:5900 bucket keeps that safe: off-port traffic (even an "RFB "-looking payload) never reaches this
+        //bucket and falls losslessly to raw.
+        this.matchKeys = ['tcpport:5900'];
+        //A leaf header — the post-handshake RFB message stream is a higher-layer concern (a later slice).
+        this.demuxProducers = [];
+    }
+    static #schemaCache;
+    get SCHEMA() {
+        return (RFB.#schemaCache ??= RFB.#buildSchema());
+    }
+    /**
+     * Bytes of this header: RFB rides on TCP, which has no per-message length, so take the rest of the
+     * segment. Reassembly across segments is out of scope (see class doc).
+     */
+    #payloadLength() {
+        const available = this.packet.length - this.startPos;
+        return available < 0 ? 0 : available;
+    }
+    /**
+     * Parse the display-only metadata from the raw payload. When the payload opens with the "RFB "
+     * signature and is at least a full 12-byte ProtocolVersion line, it is a version handshake: the
+     * version string ("RFB 003.008") and its numeric major/minor are extracted (best-effort — a
+     * malformed greeting yields 0). Otherwise it is a post-handshake binary message kept as verbatim
+     * `data`; versionString is set to the literal 'data' so the summary reads "VNC data". Populated on
+     * decode only — these fields have no encode, so they never affect the re-emitted bytes.
+     */
+    #parseVersion(raw) {
+        //A ProtocolVersion handshake is exactly the 12-byte "RFB xxx.yyy\n" form (RFC 6143 §7.1.1, LF only).
+        //Require the full pattern to match — a 12-byte payload that merely starts with "RFB " but is not a
+        //well-formed version line (garbage digits, or a CRLF terminator) is NOT flagged as a handshake, so
+        //the display metadata never claims a version it could not parse.
+        const line = raw.length >= RFB_VERSION_LENGTH ? raw.subarray(0, RFB_VERSION_LENGTH).toString('latin1') : '';
+        const match = line.match(/^RFB (\d{3})\.(\d{3})\n$/);
+        if (match) {
+            this.instance.isVersionHandshake.setValue(true);
+            //The version string is the greeting without its trailing newline, e.g. "RFB 003.008".
+            this.instance.versionString.setValue(line.replace(/[\r\n]+$/, ''));
+            this.instance.major.setValue(Number(match[1]));
+            this.instance.minor.setValue(Number(match[2]));
+            return;
+        }
+        this.instance.isVersionHandshake.setValue(false);
+        //Non-handshake payload: the summary tail is the literal 'data' (produces "VNC data").
+        this.instance.versionString.setValue('data');
+        this.instance.major.setValue(0);
+        this.instance.minor.setValue(0);
+    }
+    static #buildSchema() {
+        return {
+            type: 'object',
+            summary: 'VNC ${versionString}',
+            properties: {
+                //The whole raw payload is the single source of truth: decoded verbatim to hex and
+                //re-emitted untouched (byte-perfect for any RFB payload). When it is a ProtocolVersion
+                //handshake the leading line is parsed into the display-only metadata below, which carry
+                //no codec of their own.
+                message: {
+                    type: 'string',
+                    label: 'Message',
+                    contentEncoding: StringContentEncodingEnum_1.StringContentEncodingEnum.HEX,
+                    decode: function () {
+                        const available = this.#payloadLength();
+                        if (available <= 0) {
+                            this.instance.message.setValue('');
+                            this.#parseVersion(Buffer.alloc(0));
+                            return;
+                        }
+                        const raw = this.readBytes(0, available);
+                        this.instance.message.setValue((0, BufferToHex_1.BufferToHex)(raw));
+                        this.#parseVersion(raw);
+                    },
+                    encode: function () {
+                        //Re-emit the authoritative payload verbatim — never reconstruct from metadata.
+                        this.writeBytes(0, (0, HexToBuffer_1.HexToBuffer)(this.instance.message.getValue('')));
+                    }
+                },
+                //Display-only metadata parsed from the ProtocolVersion handshake on decode (no encode —
+                //populated by the message field above, never read back). isVersionHandshake distinguishes
+                //the opening 12-byte version line from any other (binary) RFB payload; versionString/major/
+                //minor describe the version when it is a handshake.
+                isVersionHandshake: { type: 'boolean', label: 'Is Version Handshake' },
+                versionString: { type: 'string', label: 'Version String' },
+                major: { type: 'integer', label: 'Major Version', minimum: 0, maximum: 999 },
+                minor: { type: 'integer', label: 'Minor Version', minimum: 0, maximum: 999 }
+            }
+        };
+    }
+    match() {
+        //Reached only on the tcp:5900 bucket. A leading "RFB " with a full 12-byte line is a version
+        //handshake; any other payload on this port-confined bucket is kept as verbatim RFB data. Either
+        //way a non-empty payload over TCP is claimed (byte-perfect), and an empty payload is not.
+        if (!this.prevCodecModule)
+            return false;
+        if (this.prevCodecModule.id !== 'tcp')
+            return false;
+        const available = this.#payloadLength();
+        if (available < 1)
+            return false;
+        const lead = this.readBytes(0, 4, true).toString('latin1');
+        if (lead === RFB_SIGNATURE && available >= RFB_VERSION_LENGTH)
+            return true;
+        return available >= 1;
+    }
+}
+exports.RFB = RFB;

package/dist/headers/RGoose.d.ts

@@ -0,0 +1,72 @@
+import { BaseHeader } from '../abstracts/BaseHeader';
+import { ProtocolJSONSchema } from '../schema/ProtocolJSONSchema';
+import { DemuxProducer } from '../types/DemuxProducer';
+/**
+ * IEC 61850-90-5 Session protocol — Routable GOOSE / Routable SV (R-GOOSE / R-SV).
+ *
+ * Carries a GOOSE (goosePdu) or SV (savPdu) APDU over UDP inside an OSI-style Session PDU (SPDU). One
+ * header handles both, branching on the Session Identifier (SI) byte: 0xA1 = non-tunnelled GOOSE,
+ * 0xA2 = non-tunnelled SV, 0xA0 = tunnelled. This is a leaf (Slice 1): each payload item's APDU is kept
+ * as bounded raw hex — structuring it via the shared BER/GOOSE/SV decoders is deferred to Slice 2, so we
+ * deliberately do NOT recurse into Goose.ts / IEC61850SampledValues.ts (that would swallow the trailing
+ * signature and any 2nd payload item). All multi-byte session fields are big-endian.
+ *
+ * ── VERIFIED BYTE LAYOUT (cross-checked against Wireshark 4.6.7 packet-goose.c `dissect_rgoose`, and
+ *    tshark's own R-GOOSE dissection of a crafted frame; offsets are header-relative) ──────────────────
+ *   off  w   field                         source
+ *    0   1   SI (Session Identifier)        packet-goose.c OSI_SPDU_* (0xA0 tunneled, 0xA1 GOOSE, 0xA2 SV, 0xA3 mgmt)
+ *    1   1   LI (session header length)     hf_goose_session_hdr_length (display only; proto_item_set_len=LI+2)
+ *    2   1   Common session header id       hf_goose_content_id (0x80)
+ *    3   1   Header length                  hf_goose_hdr_length
+ *    4   4   SPDU length                    hf_goose_spdu_lenth  (BE)
+ *    8   4   SPDU number                    hf_goose_spdu_num    (BE)
+ *   12   2   Version                        hf_goose_version     (BE, =1)
+ *   ── Security information subtree ──
+ *   14   4   Time of current key            hf_goose_current_key_t (BE)
+ *   18   2   Time to next key               hf_goose_next_key_t    (BE)
+ *   20   4   Key ID                         hf_goose_key_id        (BE)
+ *   24   1   Initialization vector length   hf_goose_init_vec_length  → ivLen
+ *   25  iv   Initialization vector          hf_goose_init_vec (present only if ivLen>0)
+ *   ── Session user information ──
+ *   25+iv  4 Payload length                 hf_goose_payload_length (BE); bounds the payload-item walk
+ *   ── per payload item (APDU_HEADER_SIZE=6, then the APDU) ──
+ *   +0   1   Payload type tag               hf_goose_apdu_tag (0x81 GOOSE, 0x82 SV, 0x83 tunnel, 0x84 mgmt)
+ *   +1   1   Simulation flag                hf_goose_apdu_simulation
+ *   +2   2   APPID                          hf_goose_apdu_appid  (BE)
+ *   +4   2   APDU length                    hf_goose_apdu_length (BE)
+ *   +6   N   APDU (goosePdu 0x61.. / savPdu 0x60.. BER)
+ *   ── trailer (after payload length consumed) ──
+ *        v   Signature / HMAC               optional 0xAF-tagged padding then HMAC; Wireshark lumps the
+ *                                           trailing bytes as hf_goose_hmac (it does not parse a 0x85 tag)
+ *
+ * NOTE (layout uncertainty, resolved in favour of tshark): some 90-5 texts describe the security area as
+ * TimeOfCurrentKey(4)+TimeToNextKey(2)+SecurityAlgorithm(enc 1 + MAC 1)+KeyID(4). Wireshark 4.6.7 instead
+ * models those bytes as KeyID(4)+InitVectorLength(1)+InitVector — the SAME octets, different field names.
+ * tshark is the byte-layout gate here, so we follow Wireshark's interpretation exactly.
+ *
+ * There is NO explicit payload-item count: items are walked accumulating (6 + APDU length) until the
+ * Payload length is consumed (matches Wireshark's `while (apdu_offset < payload_length)` loop).
+ *
+ * TRANSPORT: real R-GOOSE reaches Wireshark's dissector via a CLTP (ISO 8602) UD TPDU heuristic over UDP,
+ * but the common/libiec61850 wire form puts the SPDU directly in the UDP payload (SI as the first byte);
+ * that is the form modelled here (matchKeys udpport:102, SI-signature match), and the form the fixture
+ * ships. The session byte layout itself was validated by wrapping this SPDU in a minimal CLTP UD TPDU and
+ * confirming tshark dissects it as R-GOOSE with the expected SPDU number / APPID / goosePdu / HMAC.
+ *
+ * Length fields (LI / Header length / SPDU length / Payload length / per-item APDU length) are honored
+ * when present and derived only when absent — a well-formed frame's derived values equal the decoded
+ * ones, so it round-trips byte-for-byte. A crafted frame that lies is re-emitted faithfully as long as
+ * its payload is honestly tiled by items (the signature boundary is taken from the actual item bytes on
+ * both decode and encode); a self-contradictory payloadLength that overshoots the item span by a partial
+ * item is best-effort, like a truncated frame.
+ */
+export declare class RGoose extends BaseHeader {
+    #private;
+    get SCHEMA(): ProtocolJSONSchema;
+    readonly id: string;
+    readonly name: string;
+    readonly nickname: string;
+    readonly matchKeys: string[];
+    match(): boolean;
+    readonly demuxProducers: DemuxProducer[];
+}