rea-agents 6.4.0 → 6.5.0

package/dist/pcap/PcapCommand.js

@@ -0,0 +1,146 @@
+import { randomUUID } from "node:crypto";
+import { AnalysisError } from "../domain/analysisErrorBase.js";
+import { AnalysisCancelledError, AnalysisProtocolError, AnalysisResourceConstraintError, AnalysisTimeoutError, AnalysisUnsupportedTargetError, } from "../domain/analysisErrorCore.js";
+import { OwnedCommandFailure, ownedCommandResources, runOwnedCommand, } from "../process/OwnedCommand.js";
+import { prepareProcessOwnershipInspection } from "../process/ProcessOwnershipObservation.js";
+import { isWindowsBatchFile, windowsBatchCommand, WindowsBatchCommandError, } from "../process/WindowsBatchCommand.js";
+import { pcapToolUnavailable } from "./PcapConfiguration.js";
+/** Owned process execution shared by version probes and capture reads. */
+export const runPcapCommand = async (options) => {
+    const { operation, command, limits, signal } = options;
+    if (signal?.aborted)
+        throw new AnalysisCancelledError(operation, { cause: signal.reason });
+    const hostEnvironment = {
+        ...process.env,
+        ...options.environment,
+        LC_ALL: "C",
+        LANG: "C",
+    };
+    let cleanup;
+    try {
+        const batch = process.platform === "win32" && isWindowsBatchFile(command);
+        const invocation = batch
+            ? windowsBatchCommand({
+                environment: hostEnvironment,
+                batchPath: command,
+                arguments: options.arguments,
+            })
+            : { command, arguments: options.arguments };
+        const boundedInvocation = options.nativeBound?.limiter === undefined
+            ? invocation
+            : {
+                command: options.nativeBound.limiter.command,
+                arguments: [
+                    ...options.nativeBound.limiter.arguments,
+                    invocation.command,
+                    ...invocation.arguments,
+                ],
+            };
+        // Native ownership preparation has its own bounded compiler lifecycle;
+        // do not spend the tool's execution deadline rebuilding a cold SDK cache.
+        await prepareProcessOwnershipInspection(signal);
+        const output = await runOwnedCommand({
+            ...boundedInvocation,
+            runId: randomUUID(),
+            hostEnvironment,
+            windowsVerbatimArguments: batch,
+            expectedCommand: null,
+            ...(options.nativeBound?.memoryLimitBytes === undefined
+                ? {}
+                : { memoryLimitBytes: options.nativeBound.memoryLimitBytes }),
+        }, { timeoutMs: limits.timeoutMs, diagnosticBytes: limits.maxOutputBytes }, {
+            ...(signal === undefined ? {} : { signal }),
+            ...(options.launcher === undefined
+                ? {}
+                : { launcher: options.launcher }),
+            retainCleanup: (owner, stopped) => {
+                const resources = owner.launch.ownership === undefined
+                    ? ["owned-process"]
+                    : ownedCommandResources(owner.launch.ownership);
+                const snapshot = owner.snapshot();
+                const capturedOutput = {
+                    stdout: snapshot.stdout.text,
+                    stderr: snapshot.stderr.text,
+                    truncated: snapshot.diagnosticTruncated === true ||
+                        snapshot.outputIncomplete === true,
+                };
+                options.retain(owner, resources, stopped.reason, capturedOutput);
+                cleanup = { reason: stopped.reason, resources, capturedOutput };
+            },
+        });
+        return {
+            stdout: output.stdout.text,
+            stderr: output.stderr.text,
+            ...(cleanup === undefined ? {} : { cleanup }),
+        };
+    }
+    catch (cause) {
+        if (cause instanceof AnalysisError)
+            throw cause;
+        if (cause instanceof OwnedCommandFailure &&
+            cause.cleanupOwner !== undefined)
+            options.retain(cause.cleanupOwner, cause.resources, cause.cleanupFailure ?? cause.message, cause.snapshot === null
+                ? { stdout: "", stderr: "", truncated: true }
+                : {
+                    stdout: cause.snapshot.stdout.text,
+                    stderr: cause.snapshot.stderr.text,
+                    truncated: cause.snapshot.diagnosticTruncated === true ||
+                        cause.snapshot.outputIncomplete === true,
+                });
+        const details = {
+            cause,
+            ...(cause instanceof OwnedCommandFailure && cause.snapshot !== null
+                ? {
+                    capturedOutput: {
+                        stdout: cause.snapshot.stdout.text,
+                        stderr: cause.snapshot.stderr.text,
+                        truncated: cause.snapshot.diagnosticTruncated === true ||
+                            cause.snapshot.outputIncomplete === true,
+                        exit_code: cause.snapshot.exitCode ?? null,
+                        signal: cause.snapshot.signal ?? null,
+                    },
+                }
+                : {}),
+            ...(cause instanceof OwnedCommandFailure && cause.cleanupFailure !== null
+                ? {
+                    cleanup: {
+                        reason: cause.cleanupFailure,
+                        resources: cause.resources,
+                    },
+                }
+                : {}),
+        };
+        if (signal?.aborted ||
+            (cause instanceof OwnedCommandFailure && cause.reason === "cancelled"))
+            throw new AnalysisCancelledError(operation, details);
+        if (cause instanceof OwnedCommandFailure &&
+            cause.snapshot?.memoryLimitReached === true)
+            throw new AnalysisResourceConstraintError(operation, "memory", "The owned Windows tool tree reached its enforced committed-memory limit.", {
+                process_memory_limit_bytes: options.nativeBound?.memoryLimitBytes ?? null,
+            }, details);
+        if (cause instanceof OwnedCommandFailure &&
+            (cause.snapshot?.signal === "SIGXCPU" ||
+                cause.snapshot?.signal === "SIGXFSZ"))
+            throw new AnalysisResourceConstraintError(operation, cause.snapshot.signal === "SIGXCPU" ? "cpu" : "file-size", `Producer terminated with ${cause.snapshot.signal}; its exact cause is not independently established.`, null, details);
+        if (cause instanceof OwnedCommandFailure && cause.reason === "timeout")
+            throw new AnalysisTimeoutError(operation, limits.timeoutMs, details);
+        if (cause instanceof OwnedCommandFailure && cause.reason === "output-limit")
+            throw new AnalysisResourceConstraintError(operation, "memory", "Tool output exceeded its complete-output budget", { max_output_bytes: limits.maxOutputBytes }, details);
+        if (cause instanceof WindowsBatchCommandError ||
+            (cause instanceof Error &&
+                "code" in cause &&
+                (cause.code === "ENOENT" || cause.code === "EACCES")))
+            throw pcapToolUnavailable(operation, `Cannot run selected tool ${command}: ${cause.message}`, details);
+        const diagnostic = cause instanceof OwnedCommandFailure
+            ? cause.snapshot?.stderr.text.trim() || cause.message
+            : cause instanceof Error
+                ? cause.message
+                : String(cause);
+        if (options.inputPath === undefined)
+            throw pcapToolUnavailable(operation, `The selected tool ${command} cannot report its version: ${diagnostic}`, details);
+        if (options.inputPath !== undefined &&
+            /not a capture file|file.*isn't a capture file|file format.*not supported/iu.test(diagnostic))
+            throw new AnalysisUnsupportedTargetError(operation, options.inputPath, diagnostic, details);
+        throw new AnalysisProtocolError(`Packet capture tool ${command} failed: ${diagnostic}`, details);
+    }
+};

package/dist/pcap/PcapConfiguration.js

@@ -0,0 +1,93 @@
+import { isAbsolute } from "node:path";
+import { AnalysisCapabilityUnavailableError } from "../domain/analysisErrorCore.js";
+/** Environment keys selecting the caller's tshark and capinfos binaries. */
+export const TSHARK_COMMAND_ENV = "REA_TSHARK_COMMAND";
+export const CAPINFOS_COMMAND_ENV = "REA_CAPINFOS_COMMAND";
+const TOOL_REMEDIATION = `Supply Wireshark 4.x tshark and capinfos on PATH or through absolute ${TSHARK_COMMAND_ENV} and ${CAPINFOS_COMMAND_ENV}; REA does not install them.`;
+/**
+ * Host-tool refusals concern the caller's Wireshark installation, not the
+ * target, so they carry their own guidance instead of the generic advice to
+ * choose another target.
+ */
+export const pcapToolUnavailable = (operation, reason, options) => new AnalysisCapabilityUnavailableError("pcap", operation, reason, {
+    ...options,
+    userMessage: `${/[.!?]$/u.test(reason) ? reason : `${reason}.`} ${TOOL_REMEDIATION}`,
+});
+/**
+ * Resolve the caller-supplied tshark and capinfos binaries. Each accepts an
+ * absolute environment path or falls back to PATH resolution, mirroring the
+ * mitmdump pattern. REA never installs the Wireshark suite.
+ */
+export const resolvePcapTools = (environment) => {
+    const tsharkEnv = environment[TSHARK_COMMAND_ENV];
+    const capinfosEnv = environment[CAPINFOS_COMMAND_ENV];
+    if (tsharkEnv !== undefined &&
+        tsharkEnv.trim() !== "" &&
+        !isAbsolute(tsharkEnv))
+        throw new PcapConfigurationFailure("tshark_not_absolute", `${TSHARK_COMMAND_ENV} must be an absolute path to the tshark binary`, { configured: tsharkEnv });
+    if (capinfosEnv !== undefined &&
+        capinfosEnv.trim() !== "" &&
+        !isAbsolute(capinfosEnv))
+        throw new PcapConfigurationFailure("capinfos_not_absolute", `${CAPINFOS_COMMAND_ENV} must be an absolute path to the capinfos binary`, { configured: capinfosEnv });
+    return {
+        tshark: {
+            command: tsharkEnv === undefined || tsharkEnv.trim() === ""
+                ? "tshark"
+                : tsharkEnv,
+            source: tsharkEnv === undefined || tsharkEnv.trim() === ""
+                ? "path"
+                : "environment",
+        },
+        capinfos: {
+            command: capinfosEnv === undefined || capinfosEnv.trim() === ""
+                ? "capinfos"
+                : capinfosEnv,
+            source: capinfosEnv === undefined || capinfosEnv.trim() === ""
+                ? "path"
+                : "environment",
+        },
+    };
+};
+export class PcapConfigurationFailure extends Error {
+    code;
+    diagnostics;
+    constructor(code, message, diagnostics = {}, options) {
+        super(message, options);
+        this.code = code;
+        this.diagnostics = diagnostics;
+    }
+}
+/** Recognize the selected Wireshark tool's version banner. */
+const parseVersion = (stdout, tool) => {
+    const line = stdout
+        .split(/\r?\n/u)
+        .map((entry) => entry.trim())
+        .find((entry) => entry !== "");
+    const parsed = line === undefined
+        ? null
+        : new RegExp(`^${tool} \\(Wireshark\\) (\\d+)\\.\\d+\\.\\d+`, "iu").exec(line);
+    if (parsed === null || line === undefined)
+        return null;
+    if (parsed[1] !== "4")
+        throw new PcapConfigurationFailure(`${tool}_version_unsupported`, "Packet summary inspection currently requires Wireshark 4.x tools; select an installation with the admitted output profile.", { version: line });
+    return line;
+};
+/** Probe both tools without reading any capture file. */
+export const inspectPcapClient = async (selection, probe) => ({
+    tsharkVersion: parseVersion(await probe(selection.tshark.command), "tshark"),
+    capinfosVersion: parseVersion(await probe(selection.capinfos.command), "capinfos"),
+});
+/** Availability in the shape shared by every provider. */
+const rejectionCodeOf = (code) => code.includes("missing")
+    ? "executable_missing"
+    : code.includes("unsupported")
+        ? "unsupported_version"
+        : code.includes("not_absolute")
+            ? "not_configured"
+            : "version_unresolved";
+export const pcapConfigurationAvailability = (cause) => ({
+    status: "unavailable",
+    code: rejectionCodeOf(cause.code),
+    reason: cause.message,
+    diagnostics: { ...cause.diagnostics },
+});

package/dist/pcap/PcapNativeBound.js

@@ -0,0 +1,58 @@
+import { access, realpath } from "node:fs/promises";
+import { constants } from "node:fs";
+import { isAbsolute } from "node:path";
+import { AnalysisError } from "../domain/analysisErrorBase.js";
+import { AnalysisCapabilityUnavailableError } from "../domain/analysisErrorCore.js";
+const PRLIMIT_COMMAND_ENV = "REA_TSHARK_PRLIMIT_COMMAND";
+/** Own native capture admission and the exact enforced resource profile. */
+export const preparePcapNativeBound = async (environment, resources) => {
+    if (process.platform === "win32") {
+        return {
+            nativeBound: { memoryLimitBytes: 1024 ** 3 },
+            limitations: [
+                "Each owned Windows tool tree has a 1 GiB Job Object committed-memory limit; this is not a machine-wide quota.",
+            ],
+        };
+    }
+    if (process.platform !== "linux") {
+        const reason = "Packet summaries require an enforceable native memory bound: Linux with util-linux prlimit, or Windows with owned Job Objects. This host's capture boundary remains unsupported.";
+        throw new AnalysisCapabilityUnavailableError("pcap", "inspect_pcap_capture", reason, { userMessage: reason });
+    }
+    const configured = environment[PRLIMIT_COMMAND_ENV] ?? "/usr/bin/prlimit";
+    try {
+        if (!isAbsolute(configured))
+            throw new Error(`${PRLIMIT_COMMAND_ENV} must be absolute.`);
+        const limiter = await realpath(configured);
+        await access(limiter, constants.X_OK);
+        const limits = await resources.readLimits({
+            address_space_bytes: 1024 ** 3,
+            file_bytes: 64 * 1024 ** 2,
+            cpu_seconds: 300,
+        });
+        const nativeBound = {
+            limiter: {
+                command: limiter,
+                arguments: [
+                    `--as=${limits.address_space_bytes}:${limits.address_space_bytes}`,
+                    `--fsize=${limits.file_bytes}:${limits.file_bytes}`,
+                    `--cpu=${limits.cpu_seconds}:${limits.cpu_seconds}`,
+                    "--core=0:0",
+                    "--",
+                ],
+            },
+        };
+        const limitations = [
+            `Linux prlimit preserves stricter inherited ceilings: ${limits.address_space_bytes} bytes of per-process address space, ${limits.file_bytes} bytes per file and ${limits.cpu_seconds} CPU seconds; core dumps are disabled. These are not aggregate machine quotas.`,
+        ];
+        return { nativeBound, limitations };
+    }
+    catch (cause) {
+        if (cause instanceof AnalysisError)
+            throw cause;
+        const reason = "Cannot establish the selected Linux resource limiter before processing capture bytes.";
+        throw new AnalysisCapabilityUnavailableError("pcap", "inspect_pcap_capture", reason, {
+            cause,
+            userMessage: `${reason} (${cause instanceof Error ? cause.message : String(cause)}) Check that ${PRLIMIT_COMMAND_ENV} (default /usr/bin/prlimit) names an absolute, executable util-linux prlimit.`,
+        });
+    }
+};

package/dist/pcap/PcapOutput.js

@@ -0,0 +1,240 @@
+import { setImmediate as yieldToEventLoop } from "node:timers/promises";
+import { AnalysisProtocolError, AnalysisResourceConstraintError, } from "../domain/analysisErrorCore.js";
+import { parseRecordedTransportUrl } from "../domain/recordedTransportUrl.js";
+import { compareUnicodeCodePoints } from "../domain/unicodeCodePointOrder.js";
+const OPERATION = "inspect_pcap_capture";
+/** Bounds JSON decoding plus its expanded object graph before JSON.parse. */
+export const TSHARK_JSON_MAX_BYTES = 8 * 1024 * 1024;
+const MAX_RETAINED_BYTES = 16 * 1024 * 1024;
+const MAX_DECODED_BYTES = 128 * 1024 * 1024;
+const protocolFailure = (reason) => {
+    throw new AnalysisProtocolError(`Invalid packet-capture output: ${reason}`);
+};
+/** capinfos -M with a C locale provides exact numbers instead of "20 k". */
+export const parseCapinfosOutput = (stdout) => {
+    const lines = new Map();
+    for (const line of stdout.split(/\r?\n/u)) {
+        const at = line.indexOf(":");
+        if (at >= 0 && !/^\s/u.test(line))
+            lines.set(line.slice(0, at), line.slice(at + 1).trim());
+    }
+    const fileType = lines.get("File type");
+    const encapsulation = lines.get("File encapsulation");
+    const countText = lines.get("Number of packets");
+    if (!fileType ||
+        !encapsulation ||
+        countText === undefined ||
+        !/^\d+$/u.test(countText))
+        return protocolFailure("capinfos did not provide machine-readable type, encapsulation and packet count");
+    const packetCount = Number(countText);
+    if (!Number.isSafeInteger(packetCount))
+        return protocolFailure("packet count is not representable");
+    const durationText = lines.get("Capture duration");
+    const duration = durationText === undefined
+        ? null
+        : /^(\d+(?:\.\d+)?)(?:\s+seconds?)?$/u.exec(durationText);
+    const snapshot = /^file hdr:\s*(\d+) bytes$/u.exec(lines.get("Packet size limit") ?? "");
+    const snapshotLength = snapshot === null ? null : Number(snapshot[1]);
+    const sha256 = lines.get("SHA256") ?? null;
+    if (sha256 !== null && !/^[0-9a-f]{64}$/u.test(sha256))
+        return protocolFailure("capinfos SHA256 is malformed");
+    return {
+        fileType,
+        encapsulation,
+        packetCount,
+        captureStart: lines.get("Earliest packet time") ?? null,
+        captureEnd: lines.get("Latest packet time") ?? null,
+        captureDurationSeconds: duration === null ? null : Number(duration[1]),
+        snapshotLength: snapshotLength !== null &&
+            Number.isSafeInteger(snapshotLength) &&
+            snapshotLength > 0
+            ? snapshotLength
+            : null,
+        sha256,
+    };
+};
+const object = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** Validate the fixed JSON field representation before retaining aggregate facts. */
+export const parseTsharkJsonOutput = async (stdout, signal) => {
+    signal?.throwIfAborted();
+    if (Buffer.byteLength(stdout) > TSHARK_JSON_MAX_BYTES)
+        throw new AnalysisResourceConstraintError(OPERATION, "memory", "tshark JSON exceeds the bounded decoding budget", { max_json_bytes: TSHARK_JSON_MAX_BYTES });
+    // The selected-field protocol has five container levels. Reject deeper
+    // graphs before materializing them; quoted brackets are string data.
+    let depth = 0, quoted = false, escaped = false;
+    let decodedBytes = stdout.length * 2;
+    for (let index = 0; index < stdout.length; index += 1) {
+        if (index % 65536 === 0) {
+            await yieldToEventLoop();
+            signal?.throwIfAborted();
+        }
+        const char = stdout[index];
+        if (quoted) {
+            if (escaped)
+                escaped = false;
+            else if (char === "\\")
+                escaped = true;
+            else if (char === '"')
+                quoted = false;
+        }
+        else if (char === '"') {
+            quoted = true;
+            decodedBytes += 64;
+        }
+        else if (char === "{" || char === "[") {
+            decodedBytes += 128;
+            if (++depth > 5)
+                protocolFailure("unexpected JSON nesting");
+        }
+        else if (char === "}" || char === "]")
+            depth -= 1;
+        else if (char === ":" || char === ",")
+            decodedBytes += 128;
+        if (decodedBytes > MAX_DECODED_BYTES)
+            throw new AnalysisResourceConstraintError(OPERATION, "memory", "tshark JSON expansion exceeds the decoding budget", { max_decoded_bytes: MAX_DECODED_BYTES });
+    }
+    let packets;
+    try {
+        packets = JSON.parse(stdout);
+    }
+    catch (cause) {
+        throw new AnalysisProtocolError("tshark emitted malformed JSON", { cause });
+    }
+    if (!Array.isArray(packets))
+        return protocolFailure("tshark packet root must be an array");
+    const endpoints = new Map();
+    const dns = new Map();
+    const sni = new Set();
+    const protocols = new Map();
+    const uris = new Set();
+    const observedUris = new Set();
+    let uriRedactions = 0;
+    const unattributed = new Set();
+    let unattributedPackets = 0;
+    let retainedBytes = 0;
+    const charge = (value) => {
+        retainedBytes += 192 + 2 * Buffer.byteLength(value);
+        if (retainedBytes > MAX_RETAINED_BYTES)
+            throw new AnalysisResourceConstraintError(OPERATION, "memory", "Packet inventory exceeds the retained-fact budget", { max_retained_bytes: MAX_RETAINED_BYTES });
+    };
+    const add = (set, value) => {
+        if (!set.has(value)) {
+            charge(value);
+            set.add(value);
+        }
+    };
+    for (let index = 0; index < packets.length; index += 1) {
+        if (index % 256 === 0) {
+            await yieldToEventLoop();
+            signal?.throwIfAborted();
+        }
+        const packet = packets[index];
+        if (!object(packet) ||
+            !object(packet._source) ||
+            !object(packet._source.layers))
+            return protocolFailure(`packet ${String(index + 1)} lacks _source.layers`);
+        const layers = packet._source.layers;
+        for (const [key, value] of Object.entries(layers))
+            if (!Array.isArray(value) ||
+                !value.every((item) => typeof item === "string"))
+                return protocolFailure(`packet ${String(index + 1)} field ${key} must be an array of strings`);
+        const field = (name) => layers[name] ?? [];
+        const frame = field("frame.number");
+        if (frame.length !== 1 ||
+            !/^\d+$/u.test(frame[0]) ||
+            Number(frame[0]) !== index + 1)
+            return protocolFailure("frame inventory is missing, duplicated or out of order");
+        if (field("frame.protocols").length !== 1 ||
+            field("frame.protocols")[0] === "")
+            return protocolFailure("packet protocol inventory is missing or ambiguous");
+        // Count one occurrence per packet even for loopback or nested IP layers.
+        for (const address of new Set([
+            ...field("ip.src"),
+            ...field("ip.dst"),
+            ...field("ipv6.src"),
+            ...field("ipv6.dst"),
+        ])) {
+            if (address === "")
+                continue;
+            if (!endpoints.has(address))
+                charge(address);
+            endpoints.set(address, (endpoints.get(address) ?? 0) + 1);
+        }
+        const questions = new Set(field("dns.qry.name").filter((value) => value !== ""));
+        for (const question of questions)
+            if (!dns.has(question)) {
+                charge(question);
+                dns.set(question, new Set());
+            }
+        const addresses = [...field("dns.a"), ...field("dns.aaaa")].filter((value) => value !== "");
+        const response = field("dns.flags.response");
+        if (addresses.length > 0) {
+            if (questions.size === 1 &&
+                response.length > 0 &&
+                response.every((value) => value === "True" || value === "1")) {
+                const values = dns.get(questions.values().next().value);
+                for (const address of addresses)
+                    add(values, address);
+            }
+            else {
+                unattributedPackets += 1;
+                for (const address of addresses)
+                    add(unattributed, address);
+            }
+        }
+        for (const value of field("tls.handshake.extensions_server_name"))
+            if (value !== "")
+                add(sni, value);
+        for (const value of new Set(field("frame.protocols"))) {
+            if (value === "")
+                continue;
+            if (!protocols.has(value))
+                charge(value);
+            protocols.set(value, (protocols.get(value) ?? 0) + 1);
+        }
+        for (const value of field("http.request.full_uri")) {
+            if (value === "" || observedUris.has(value))
+                continue;
+            add(observedUris, value);
+            const { credentials } = parseRecordedTransportUrl(value);
+            if (credentials !== null)
+                uriRedactions += 1;
+            if (credentials === "ambiguous")
+                continue;
+            add(uris, credentials === null
+                ? value
+                : value.slice(0, credentials.start) + value.slice(credentials.end));
+        }
+    }
+    signal?.throwIfAborted();
+    return {
+        endpoints: [...endpoints]
+            .sort((a, b) => b[1] - a[1] || compareUnicodeCodePoints(a[0], b[0]))
+            .map(([address, packet_count]) => ({
+            address,
+            port: null,
+            packet_count,
+        })),
+        endpointCount: endpoints.size,
+        dnsQueries: [...dns].map(([query, addresses]) => ({
+            query,
+            response_addresses: [...addresses],
+            response_address_count: addresses.size,
+        })),
+        dnsQueryCount: dns.size,
+        tlsSniValues: [...sni],
+        tlsSniCount: sni.size,
+        protocolDistribution: [...protocols]
+            .sort((a, b) => b[1] - a[1] || compareUnicodeCodePoints(a[0], b[0]))
+            .map(([protocol, packet_count]) => ({ protocol, packet_count })),
+        protocolCount: protocols.size,
+        httpRequestUris: [...uris],
+        httpRequestUriCount: observedUris.size,
+        httpUriRedactionCount: uriRedactions,
+        unattributedDnsAddresses: [...unattributed],
+        unattributedDnsAddressCount: unattributed.size,
+        unattributedDnsPackets: unattributedPackets,
+        packetCount: packets.length,
+        partial: observedUris.size > uris.size || unattributedPackets > 0,
+    };
+};