@netkitty/analysis 1.0.0

package/dist/lib/streaming/reducers/ConversationsReducer.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConversationsReducer = void 0;
+const ConversationKey_1 = require("../indexer/ConversationKey");
+/**
+ * Rolling conversation table: groups frames direction-independently by n-tuple, tallying packets,
+ * bytes, per-direction counts and time/index spans. result() is a snapshot at any point; reset()
+ * clears it.
+ */
+class ConversationsReducer {
+    constructor() {
+        this.needs = ['eth', 'ipv4', 'ipv6', 'tcp', 'udp', 'arp'];
+        //Only the five-tuple — replay can feed frames synthesized from the index columns (no re-decode).
+        this.indexOnly = true;
+        this.#conversations = new Map();
+    }
+    #conversations;
+    update(frame, context) {
+        void context;
+        const flow = (0, ConversationKey_1.flowOf)(frame.layers);
+        if (!flow)
+            return;
+        const forward = flow.source <= flow.destination;
+        const endpointA = forward ? flow.source : flow.destination;
+        const endpointB = forward ? flow.destination : flow.source;
+        const key = `${flow.protocol}|${endpointA}|${endpointB}`;
+        let conversation = this.#conversations.get(key);
+        if (!conversation) {
+            conversation = {
+                protocol: flow.protocol,
+                endpointA: endpointA,
+                endpointB: endpointB,
+                packets: 0,
+                bytes: 0,
+                packetsAToB: 0,
+                packetsBToA: 0,
+                firstTimestamp: frame.timestamp,
+                lastTimestamp: frame.timestamp,
+                firstIndex: frame.index,
+                lastIndex: frame.index
+            };
+            this.#conversations.set(key, conversation);
+        }
+        conversation.packets++;
+        conversation.bytes += frame.length;
+        if (flow.source === endpointA)
+            conversation.packetsAToB++;
+        else
+            conversation.packetsBToA++;
+        if (frame.timestamp < conversation.firstTimestamp)
+            conversation.firstTimestamp = frame.timestamp;
+        if (frame.timestamp > conversation.lastTimestamp)
+            conversation.lastTimestamp = frame.timestamp;
+        if (frame.index < conversation.firstIndex)
+            conversation.firstIndex = frame.index;
+        if (frame.index > conversation.lastIndex)
+            conversation.lastIndex = frame.index;
+    }
+    result() {
+        return [...this.#conversations.values()];
+    }
+    reset() {
+        this.#conversations.clear();
+    }
+}
+exports.ConversationsReducer = ConversationsReducer;

package/dist/lib/streaming/reducers/EndpointsReducer.d.ts

@@ -0,0 +1,25 @@
+import { Frame } from '../types/Frame';
+import { UpdateContext } from '../types/UpdateContext';
+import { IAnalysisReducer } from '../interfaces/IAnalysisReducer';
+/** Per-endpoint traffic totals, direction-aware (tx = seen as source, rx = seen as destination). */
+export type EndpointSummary = {
+    address: string;
+    packets: number;
+    bytes: number;
+    txPackets: number;
+    txBytes: number;
+    rxPackets: number;
+    rxBytes: number;
+};
+/**
+ * Rolling per-endpoint totals: every frame credits its source (tx) and destination (rx). result() is
+ * a snapshot; reset() clears it.
+ */
+export declare class EndpointsReducer implements IAnalysisReducer<EndpointSummary[]> {
+    #private;
+    readonly needs: string[];
+    readonly indexOnly: boolean;
+    update(frame: Frame, context: UpdateContext): void;
+    result(): EndpointSummary[];
+    reset(): void;
+}

package/dist/lib/streaming/reducers/EndpointsReducer.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EndpointsReducer = void 0;
+const ConversationKey_1 = require("../indexer/ConversationKey");
+/**
+ * Rolling per-endpoint totals: every frame credits its source (tx) and destination (rx). result() is
+ * a snapshot; reset() clears it.
+ */
+class EndpointsReducer {
+    constructor() {
+        this.needs = ['eth', 'ipv4', 'ipv6', 'tcp', 'udp', 'arp'];
+        //Only the five-tuple — replay can feed frames synthesized from the index columns (no re-decode).
+        this.indexOnly = true;
+        this.#endpoints = new Map();
+    }
+    #endpoints;
+    update(frame, context) {
+        void context;
+        const flow = (0, ConversationKey_1.flowOf)(frame.layers);
+        if (!flow)
+            return;
+        this.#account(flow.source, frame.length, true);
+        this.#account(flow.destination, frame.length, false);
+    }
+    result() {
+        return [...this.#endpoints.values()];
+    }
+    reset() {
+        this.#endpoints.clear();
+    }
+    #account(address, length, isSource) {
+        let endpoint = this.#endpoints.get(address);
+        if (!endpoint) {
+            endpoint = { address: address, packets: 0, bytes: 0, txPackets: 0, txBytes: 0, rxPackets: 0, rxBytes: 0 };
+            this.#endpoints.set(address, endpoint);
+        }
+        endpoint.packets++;
+        endpoint.bytes += length;
+        if (isSource) {
+            endpoint.txPackets++;
+            endpoint.txBytes += length;
+        }
+        else {
+            endpoint.rxPackets++;
+            endpoint.rxBytes += length;
+        }
+    }
+}
+exports.EndpointsReducer = EndpointsReducer;

package/dist/lib/streaming/reducers/ReducerFactories.d.ts

@@ -0,0 +1,13 @@
+import { Frame } from '../types/Frame';
+import { UpdateContext } from '../types/UpdateContext';
+import { IAnalysisReducer } from '../interfaces/IAnalysisReducer';
+/**
+ * Fold every frame into a single accumulator — the streaming analogue of Array.reduce. `fold` must
+ * return the next accumulator (treat it as immutable); reset() restores the seed.
+ */
+export declare function reduceReducer<TResult>(seed: TResult, fold: (accumulator: TResult, frame: Frame, context: UpdateContext) => TResult): IAnalysisReducer<TResult>;
+/**
+ * Group frames by a derived key, folding each group's frames into a per-group value (seeded per
+ * group). result() returns a snapshot copy of the group map; reset() clears it.
+ */
+export declare function groupByReducer<TKey, TValue>(keyOf: (frame: Frame) => TKey, seed: TValue, fold: (accumulator: TValue, frame: Frame) => TValue): IAnalysisReducer<Map<TKey, TValue>>;

package/dist/lib/streaming/reducers/ReducerFactories.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reduceReducer = reduceReducer;
+exports.groupByReducer = groupByReducer;
+/**
+ * Fold every frame into a single accumulator — the streaming analogue of Array.reduce. `fold` must
+ * return the next accumulator (treat it as immutable); reset() restores the seed.
+ */
+function reduceReducer(seed, fold) {
+    let accumulator = seed;
+    return {
+        update(frame, context) {
+            accumulator = fold(accumulator, frame, context);
+        },
+        result() {
+            return accumulator;
+        },
+        reset() {
+            accumulator = seed;
+        }
+    };
+}
+/**
+ * Group frames by a derived key, folding each group's frames into a per-group value (seeded per
+ * group). result() returns a snapshot copy of the group map; reset() clears it.
+ */
+function groupByReducer(keyOf, seed, fold) {
+    const groups = new Map();
+    return {
+        update(frame) {
+            const key = keyOf(frame);
+            const current = groups.has(key) ? groups.get(key) : seed;
+            groups.set(key, fold(current, frame));
+        },
+        result() {
+            return new Map(groups);
+        },
+        reset() {
+            groups.clear();
+        }
+    };
+}

package/dist/lib/streaming/reducers/TcpStreamReducer.d.ts

@@ -0,0 +1,35 @@
+import { Frame } from '../types/Frame';
+import { UpdateContext } from '../types/UpdateContext';
+import { IAnalysisReducer } from '../interfaces/IAnalysisReducer';
+/** One RTT sample: a data/SYN/FIN segment matched to the first ACK that covers it. */
+export type RttSample = {
+    segmentIndex: number;
+    ackIndex: number;
+    rtt: number;
+};
+/** Diagnostics for one bidirectional TCP conversation. */
+export type TcpStreamDiagnostic = {
+    key: string;
+    endpointA: string;
+    endpointB: string;
+    packets: number;
+    retransmissions: number[];
+    duplicateAcks: number[];
+    rttSamples: RttSample[];
+    rttMin: number | null;
+    rttMax: number | null;
+    rttMean: number | null;
+};
+/**
+ * Streaming TCP stream diagnostics, derived per-frame: retransmissions
+ * (sequence space already sent, RFC 1982-aware), duplicate ACKs, and RTT (a segment matched to the
+ * first ACK covering it). result() is a rolling snapshot; RTT min/max/mean are recomputed at result().
+ * State grows per unique TCP stream — watch governance (eviction) layers on in a later step.
+ */
+export declare class TcpStreamReducer implements IAnalysisReducer<TcpStreamDiagnostic[]> {
+    #private;
+    readonly needs: string[];
+    update(frame: Frame, context: UpdateContext): void;
+    result(): TcpStreamDiagnostic[];
+    reset(): void;
+}

package/dist/lib/streaming/reducers/TcpStreamReducer.js

@@ -0,0 +1,153 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TcpStreamReducer = void 0;
+function find(layers, id) {
+    return layers.find((l) => l.id === id);
+}
+//RFC 1982 serial comparison over the 32-bit sequence space (wraps at 2^32): a at/before b.
+function seqLte(a, b) {
+    return ((b - a) >>> 0) < 0x80000000;
+}
+/** Project a frame to the TCP fields the reducer needs, or null if it is not TCP-over-IP. */
+function tcpViewOf(frame) {
+    const tcp = find(frame.layers, 'tcp');
+    if (!tcp)
+        return null;
+    const ip = find(frame.layers, 'ipv4') || find(frame.layers, 'ipv6');
+    if (!ip)
+        return null;
+    const tcpData = tcp.data;
+    const ipData = ip.data;
+    const tcpHeaderBytes = Number(tcpData.hdrLen) || 20;
+    let payload;
+    if (ip.id === 'ipv4')
+        payload = Number(ipData.length) - (Number(ipData.hdrLen) || 20) - tcpHeaderBytes;
+    //IPv6 uses plen (bytes after the 40-byte header), not length; over-counts with extension headers.
+    else
+        payload = Number(ipData.plen) - tcpHeaderBytes;
+    if (!(payload >= 0))
+        payload = 0;
+    const flags = tcpData.flags || {};
+    return {
+        source: `${ipData.sip}:${tcpData.srcport}`,
+        destination: `${ipData.dip}:${tcpData.dstport}`,
+        seq: Number(tcpData.seq) || 0,
+        ack: Number(tcpData.ack) || 0,
+        syn: Boolean(flags.syn),
+        fin: Boolean(flags.fin),
+        ackFlag: Boolean(flags.ack),
+        segmentLength: payload,
+        timestamp: frame.timestamp,
+        index: frame.index
+    };
+}
+function summarizeRtt(stream) {
+    if (stream.rttSamples.length === 0) {
+        stream.rttMin = null;
+        stream.rttMax = null;
+        stream.rttMean = null;
+        return;
+    }
+    let min = Infinity;
+    let max = -Infinity;
+    let sum = 0;
+    for (const sample of stream.rttSamples) {
+        if (sample.rtt < min)
+            min = sample.rtt;
+        if (sample.rtt > max)
+            max = sample.rtt;
+        sum += sample.rtt;
+    }
+    stream.rttMin = min;
+    stream.rttMax = max;
+    stream.rttMean = sum / stream.rttSamples.length;
+}
+/**
+ * Streaming TCP stream diagnostics, derived per-frame: retransmissions
+ * (sequence space already sent, RFC 1982-aware), duplicate ACKs, and RTT (a segment matched to the
+ * first ACK covering it). result() is a rolling snapshot; RTT min/max/mean are recomputed at result().
+ * State grows per unique TCP stream — watch governance (eviction) layers on in a later step.
+ */
+class TcpStreamReducer {
+    constructor() {
+        this.needs = ['ipv4', 'ipv6', 'tcp'];
+        this.#streams = new Map();
+        this.#halves = new Map();
+    }
+    #streams;
+    #halves;
+    update(frame, context) {
+        void context;
+        const view = tcpViewOf(frame);
+        if (!view)
+            return;
+        const forward = view.source <= view.destination;
+        const endpointA = forward ? view.source : view.destination;
+        const endpointB = forward ? view.destination : view.source;
+        const key = `tcp|${endpointA}|${endpointB}`;
+        let stream = this.#streams.get(key);
+        if (!stream) {
+            stream = { key: key, endpointA: endpointA, endpointB: endpointB, packets: 0, retransmissions: [], duplicateAcks: [], rttSamples: [], rttMin: null, rttMax: null, rttMean: null };
+            this.#streams.set(key, stream);
+        }
+        stream.packets++;
+        const forwardHalf = this.#half(`${key}|${view.source}`);
+        const reverseHalf = this.#half(`${key}|${view.destination}`);
+        const consumed = view.segmentLength + (view.syn ? 1 : 0) + (view.fin ? 1 : 0);
+        const endSeq = view.seq + consumed;
+        if (consumed > 0) {
+            const alreadySent = forwardHalf.hasMaxEndSeq && seqLte(endSeq, forwardHalf.maxEndSeq);
+            if (alreadySent || (view.syn && forwardHalf.seenSyn)) {
+                stream.retransmissions.push(view.index);
+            }
+            else {
+                forwardHalf.pending.push({ endSeq: endSeq, timestamp: view.timestamp, index: view.index });
+            }
+            if (!forwardHalf.hasMaxEndSeq || seqLte(forwardHalf.maxEndSeq, endSeq)) {
+                forwardHalf.maxEndSeq = endSeq;
+                forwardHalf.hasMaxEndSeq = true;
+            }
+            if (view.syn)
+                forwardHalf.seenSyn = true;
+        }
+        if (view.ackFlag && consumed === 0) {
+            if (forwardHalf.lastPureAck !== null && forwardHalf.lastPureAck === view.ack) {
+                stream.duplicateAcks.push(view.index);
+            }
+            forwardHalf.lastPureAck = view.ack;
+        }
+        if (view.ackFlag && reverseHalf.pending.length > 0) {
+            const remaining = [];
+            for (const segment of reverseHalf.pending) {
+                if (seqLte(segment.endSeq, view.ack)) {
+                    if (view.timestamp >= segment.timestamp) {
+                        const sample = { segmentIndex: segment.index, ackIndex: view.index, rtt: view.timestamp - segment.timestamp };
+                        stream.rttSamples.push(sample);
+                    }
+                }
+                else {
+                    remaining.push(segment);
+                }
+            }
+            reverseHalf.pending = remaining;
+        }
+    }
+    result() {
+        for (const stream of this.#streams.values())
+            summarizeRtt(stream);
+        return [...this.#streams.values()];
+    }
+    reset() {
+        this.#streams.clear();
+        this.#halves.clear();
+    }
+    #half(key) {
+        let half = this.#halves.get(key);
+        if (!half) {
+            half = { maxEndSeq: 0, hasMaxEndSeq: false, seenSyn: false, lastPureAck: null, pending: [] };
+            this.#halves.set(key, half);
+        }
+        return half;
+    }
+}
+exports.TcpStreamReducer = TcpStreamReducer;

package/dist/lib/streaming/stores/ColumnarIndexStore.d.ts

@@ -0,0 +1,21 @@
+import { FrameIndexRecord } from '../types/FrameIndexRecord';
+import { IIndexStore } from '../interfaces/IIndexStore';
+/**
+ * Columnar, heap-external frame index: each fixed-width field is its own growable TypedArray, so a
+ * few million frames cost tens of MB rather than a JS object per frame. Frame numbers are global and
+ * monotonic (never reused); physical slot = globalIndex - firstIndex. evictOldest shifts the columns
+ * down (FIFO) for watch governance. This is the v1 IIndexStore; a SQLite backend is a v2 seam.
+ */
+export declare class ColumnarIndexStore implements IIndexStore {
+    #private;
+    constructor(initialCapacity?: number);
+    append(record: FrameIndexRecord): number;
+    get(index: number): FrameIndexRecord | null;
+    /** Records whose global frame number is in the half-open range [from, to), clamped to what exists. */
+    range(from: number, to: number): FrameIndexRecord[];
+    scan(predicate: (record: FrameIndexRecord) => boolean): number[];
+    count(): number;
+    firstIndex(): number;
+    evictOldest(count: number): void;
+    clear(): void;
+}

package/dist/lib/streaming/stores/ColumnarIndexStore.js

@@ -0,0 +1,134 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ColumnarIndexStore = void 0;
+/**
+ * Columnar, heap-external frame index: each fixed-width field is its own growable TypedArray, so a
+ * few million frames cost tens of MB rather than a JS object per frame. Frame numbers are global and
+ * monotonic (never reused); physical slot = globalIndex - firstIndex. evictOldest shifts the columns
+ * down (FIFO) for watch governance. This is the v1 IIndexStore; a SQLite backend is a v2 seam.
+ */
+class ColumnarIndexStore {
+    #capacity;
+    //Number of frames physically retained.
+    #length = 0;
+    //Global frame number of physical slot 0 (advances on eviction).
+    #base = 0;
+    #fileOffset;
+    #capturedLength;
+    #originalLength;
+    #timestamp;
+    #protocolId;
+    #conversationHash;
+    #directionForward;
+    constructor(initialCapacity = 1024) {
+        this.#capacity = Math.max(1, initialCapacity);
+        this.#fileOffset = new Float64Array(this.#capacity);
+        this.#capturedLength = new Uint32Array(this.#capacity);
+        this.#originalLength = new Uint32Array(this.#capacity);
+        this.#timestamp = new Float64Array(this.#capacity);
+        this.#protocolId = new Uint16Array(this.#capacity);
+        this.#conversationHash = new Uint32Array(this.#capacity);
+        this.#directionForward = new Uint8Array(this.#capacity);
+    }
+    append(record) {
+        if (this.#length >= this.#capacity)
+            this.#grow();
+        const slot = this.#length;
+        this.#fileOffset[slot] = record.fileOffset;
+        this.#capturedLength[slot] = record.capturedLength;
+        this.#originalLength[slot] = record.originalLength;
+        this.#timestamp[slot] = record.timestamp;
+        this.#protocolId[slot] = record.protocolId;
+        this.#conversationHash[slot] = record.conversationHash;
+        this.#directionForward[slot] = record.directionForward;
+        this.#length++;
+        return this.#base + slot;
+    }
+    get(index) {
+        const slot = index - this.#base;
+        if (slot < 0 || slot >= this.#length)
+            return null;
+        return this.#recordAt(slot);
+    }
+    /** Records whose global frame number is in the half-open range [from, to), clamped to what exists. */
+    range(from, to) {
+        const start = Math.max(from, this.#base);
+        const end = Math.min(to, this.#base + this.#length);
+        const out = [];
+        for (let index = start; index < end; index++)
+            out.push(this.#recordAt(index - this.#base));
+        return out;
+    }
+    scan(predicate) {
+        const out = [];
+        for (let slot = 0; slot < this.#length; slot++) {
+            const record = this.#recordAt(slot);
+            if (predicate(record))
+                out.push(record.index);
+        }
+        return out;
+    }
+    count() {
+        return this.#length;
+    }
+    firstIndex() {
+        return this.#base;
+    }
+    evictOldest(count) {
+        const drop = Math.min(count, this.#length);
+        if (drop <= 0)
+            return;
+        const remaining = this.#length - drop;
+        this.#fileOffset.copyWithin(0, drop, this.#length);
+        this.#capturedLength.copyWithin(0, drop, this.#length);
+        this.#originalLength.copyWithin(0, drop, this.#length);
+        this.#timestamp.copyWithin(0, drop, this.#length);
+        this.#protocolId.copyWithin(0, drop, this.#length);
+        this.#conversationHash.copyWithin(0, drop, this.#length);
+        this.#directionForward.copyWithin(0, drop, this.#length);
+        this.#length = remaining;
+        this.#base += drop;
+    }
+    clear() {
+        this.#length = 0;
+        this.#base = 0;
+    }
+    #recordAt(slot) {
+        return {
+            index: this.#base + slot,
+            fileOffset: this.#fileOffset[slot],
+            capturedLength: this.#capturedLength[slot],
+            originalLength: this.#originalLength[slot],
+            timestamp: this.#timestamp[slot],
+            protocolId: this.#protocolId[slot],
+            conversationHash: this.#conversationHash[slot],
+            directionForward: this.#directionForward[slot]
+        };
+    }
+    #grow() {
+        const next = this.#capacity * 2;
+        const fileOffset = new Float64Array(next);
+        const capturedLength = new Uint32Array(next);
+        const originalLength = new Uint32Array(next);
+        const timestamp = new Float64Array(next);
+        const protocolId = new Uint16Array(next);
+        const conversationHash = new Uint32Array(next);
+        const directionForward = new Uint8Array(next);
+        fileOffset.set(this.#fileOffset);
+        capturedLength.set(this.#capturedLength);
+        originalLength.set(this.#originalLength);
+        timestamp.set(this.#timestamp);
+        protocolId.set(this.#protocolId);
+        conversationHash.set(this.#conversationHash);
+        directionForward.set(this.#directionForward);
+        this.#fileOffset = fileOffset;
+        this.#capturedLength = capturedLength;
+        this.#originalLength = originalLength;
+        this.#timestamp = timestamp;
+        this.#protocolId = protocolId;
+        this.#conversationHash = conversationHash;
+        this.#directionForward = directionForward;
+        this.#capacity = next;
+    }
+}
+exports.ColumnarIndexStore = ColumnarIndexStore;

package/dist/lib/streaming/types/AnalysisEvents.d.ts

@@ -0,0 +1,8 @@
+import { FrameRow } from './FrameRow';
+/** Event map for the Analysis facade: newly indexed frame, indexing progress, completion, error. */
+export type AnalysisEvents = {
+    frame: (row: FrameRow) => void;
+    progress: (done: number, total: number) => void;
+    complete: () => void;
+    error: (error: Error) => void;
+};

package/dist/lib/streaming/types/AnalysisEvents.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/lib/streaming/types/AnalysisOptions.d.ts

@@ -0,0 +1,5 @@
+/** Construction-time knobs for an Analysis instance. */
+export type AnalysisOptions = {
+    parseCacheBytes?: number;
+    maxFrames?: number;
+};

package/dist/lib/streaming/types/AnalysisOptions.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/lib/streaming/types/AnalysisPhase.d.ts

@@ -0,0 +1,2 @@
+/** Which pass a reducer update belongs to: replaying the already-indexed backlog, or the live tail. */
+export type AnalysisPhase = 'replay' | 'live';

package/dist/lib/streaming/types/AnalysisPhase.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/lib/streaming/types/AnalysisSource.d.ts

@@ -0,0 +1,2 @@
+/** Where a capture comes from: a filesystem path (node), a browser File, or an in-memory buffer. */
+export type AnalysisSource = string | File | ArrayBuffer | Uint8Array;

package/dist/lib/streaming/types/AnalysisSource.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/lib/streaming/types/Frame.d.ts

@@ -0,0 +1,7 @@
+import { CodecDecodeResult } from '@netkitty/codec';
+import { FrameRow } from './FrameRow';
+/** A fully materialized frame: the lightweight row plus its decoded layers (fetched on demand via LRU). */
+export type Frame = FrameRow & {
+    capturedLength: number;
+    layers: CodecDecodeResult[];
+};

package/dist/lib/streaming/types/Frame.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/lib/streaming/types/FrameIndexRecord.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Logical view of one frame's fixed-width index record. Physically stored columnar across TypedArrays
+ * by the index store; this shape is what append/get/range/scan hand back.
+ */
+export type FrameIndexRecord = {
+    index: number;
+    fileOffset: number;
+    capturedLength: number;
+    originalLength: number;
+    timestamp: number;
+    protocolId: number;
+    conversationHash: number;
+    directionForward: number;
+};

package/dist/lib/streaming/types/FrameIndexRecord.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/lib/streaming/types/FrameRow.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Lightweight per-frame row for list display and batch projection — no decoded layers. Derived from
+ * the columnar index, cheap to stream across the worker boundary in bulk.
+ */
+export type FrameRow = {
+    index: number;
+    timestamp: number;
+    length: number;
+    topProtocol: string;
+    conversationKey: string | null;
+    info: string;
+};

package/dist/lib/streaming/types/FrameRow.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/lib/streaming/types/UpdateContext.d.ts

@@ -0,0 +1,7 @@
+import { AnalysisPhase } from './AnalysisPhase';
+/** Context handed to a reducer alongside each frame: position in the stream and which pass it is. */
+export type UpdateContext = {
+    index: number;
+    total: number;
+    phase: AnalysisPhase;
+};

package/dist/lib/streaming/types/UpdateContext.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/lib/streaming/worker/AnalysisWorkerCore.d.ts

@@ -0,0 +1,10 @@
+import { IReadBackend } from '../interfaces/IReadBackend';
+import { IWorkerEndpoint } from './IWorkerEndpoint';
+/**
+ * Environment-agnostic analysis-worker logic: owns the read backend, columnar index, indexer
+ * dictionaries and codec, and wires all request handlers plus watch tailing onto the given endpoint.
+ * `makeBackend` adapts the source (node: a path string → NodeFileReadBackend; browser: a Blob →
+ * BrowserFileReadBackend). node and browser worker entrypoints each call this with their endpoint and
+ * backend factory, so the handler logic lives in one place.
+ */
+export declare function installAnalysisHandlers(endpoint: IWorkerEndpoint, makeBackend: (source: unknown) => IReadBackend): void;