package classify

// TrafficClass represents a classified network traffic category.
type TrafficClass string

const (
	ClassICMP     TrafficClass = "ICMP"
	ClassDNS      TrafficClass = "DNS"
	ClassHTTPS    TrafficClass = "HTTPS"
	ClassHTTP     TrafficClass = "HTTP"
	ClassSSH      TrafficClass = "SSH"
	ClassSMTP     TrafficClass = "SMTP"
	ClassNTP      TrafficClass = "NTP"
	ClassDHCP     TrafficClass = "DHCP"
	ClassOtherTCP TrafficClass = "other-TCP"
	ClassOtherUDP TrafficClass = "other-UDP"
	ClassUnknown  TrafficClass = "unknown"
)

// AllClasses returns all known traffic classes in display order.
func AllClasses() []TrafficClass {
	return []TrafficClass{
		ClassICMP, ClassDNS, ClassHTTPS, ClassHTTP, ClassSSH,
		ClassSMTP, ClassNTP, ClassDHCP, ClassOtherTCP, ClassOtherUDP, ClassUnknown,
	}
}

// ClassifiedPacket pairs a raw packet's classification result with metadata.
type ClassifiedPacket struct {
	Class    TrafficClass
	SrcPort  uint16
	DstPort  uint16
	Protocol string // "tcp", "udp", "icmp"
	Length   int
}

// WindowSnapshot holds aggregated packet counts for a time window.
// This is the contract between the aggregation stage and future audio synthesis (Phase 2).
type WindowSnapshot struct {
	Counts       map[TrafficClass]int64
	TotalPackets int64
	WindowIndex  int
}