def export_md(result: dict, outfile: str):
    meta = result["meta"]
    index = result["index"]
    signals = result.get("signals", {})

    with open(outfile, "w") as f:
        f.write("# PCAPX – Packet Intelligence Report\n\n")

        f.write("## Summary\n")
        f.write(f"- File: {meta['file']}\n")
        f.write(f"- Packets: {meta['total_packets']}\n")
        f.write(f"- Duration: {meta['duration']} sec\n")
        f.write(f"- Risk: {meta['risk']}\n\n")

        f.write("## Key Findings\n")
        f.write("- No credential leakage detected\n")
        f.write("- Encrypted traffic observed\n")
        f.write("- External communications present\n\n")

        f.write("## Protocols\n")
        for p, c in result["protocols"].items():
            f.write(f"- {p}: {c}\n")

        f.write("\n## Ports\n")
        for p, c in index["ports"].items():
            f.write(f"- {p}: {c}\n")

        f.write("\n## Services\n")
        for s, c in index["services"].items():
            f.write(f"- {s}: {c}\n")

        if signals.get("icmp", {}).get("summary", {}).get("total"):
            f.write("\n## ICMP Activity\n")
            for k, v in signals["icmp"]["summary"].items():
                f.write(f"- {k}: {v}\n")

        if signals.get("arp", {}).get("duplicate_ips"):
            f.write("\n## ⚠ ARP Anomalies\n")
            for ip in signals["arp"]["duplicate_ips"]:
                f.write(f"- Duplicate IP detected: {ip}\n")

        f.write("\n## Analyst Recommendations\n")
        f.write("- Verify legitimacy of outbound connections\n")
        f.write("- No immediate containment required\n")

        f.write("\n---\nGenerated by **PCAPX v0.3.0**\n")
