"""Read-only analyzers over stored forensic artifacts.

Every analyzer is a pure function of (artifact-on-disk + config).
Reanalysis is deterministic — re-running an analyzer on the same
captured data produces the same output. No mutation of captured
artifacts.
"""

from __future__ import annotations

from mgf.vm.forensics.analysis.filesystem import (
    DiffRenderRow,
    DiffSummary,
    load_diff,
    render_diff_table,
    summarize_diff,
)
from mgf.vm.forensics.analysis.ioc import (
    DEFAULT_MIN_STRING_LENGTH,
    FileHashes,
    StringHit,
    YaraMatch,
    default_yara_rule_dir,
    extract_strings,
    hash_file,
    scan_yara,
)
from mgf.vm.forensics.analysis.network import (
    DnsQuery,
    HttpRequest,
    NetworkAnalysis,
    ProtocolBreakdown,
    TalkerPair,
    TlsSni,
    analyze_pcap,
    iter_packets,
)
from mgf.vm.forensics.analysis.timeline import (
    TimelineEvent,
    build_timeline,
)

__all__ = [
    "DEFAULT_MIN_STRING_LENGTH",
    "DiffRenderRow",
    "DiffSummary",
    "DnsQuery",
    "FileHashes",
    "HttpRequest",
    "NetworkAnalysis",
    "ProtocolBreakdown",
    "StringHit",
    "TalkerPair",
    "TimelineEvent",
    "TlsSni",
    "YaraMatch",
    "analyze_pcap",
    "build_timeline",
    "default_yara_rule_dir",
    "extract_strings",
    "hash_file",
    "iter_packets",
    "load_diff",
    "render_diff_table",
    "scan_yara",
    "summarize_diff",
]
