"""Forensics & Analysis Tooling for Quarantined VMs (Phase 17).

See [`docs/FORENSICS.md`](../../docs/FORENSICS.md) for the full design
+ implementation tracker. The subpackage layout:

- :mod:`.case` — :class:`Case`, :class:`Artifact`, :class:`CaseStatus`,
  :class:`ArtifactKind` frozen dataclasses + ``CASE_SCHEMA_VERSION``.
- :mod:`.store` — :class:`CaseStore` atomic CRUD over ``case.yaml``;
  status state-machine validation; lazy CF-04 path resolution.
- :mod:`.manifest` — :class:`Manifest` with SHA-256 integrity-hash
  build / save / load / verify helpers (accidental-corruption check;
  not a defence against an attacker with case-dir write access).
- :mod:`.capture` (FN-A2/A3/A4) — capture-side wrappers for network /
  filesystem / memory / screenshot.
- :mod:`.analysis` (FN-A2.2/A3.2/A6/A7) — read-only analyzers over
  stored artifacts.
- :mod:`.reports` (FN-A5) — Markdown / HTML report renderers.
- :mod:`.live` (FN-A2.3) — streaming live views.
"""

from __future__ import annotations

__version__ = "0.1.9"

from mgf.vm.forensics.capture import (
    BASELINE_SCHEMA_VERSION as FS_BASELINE_SCHEMA_VERSION,
)
from mgf.vm.forensics.capture import (
    DIFF_SCHEMA_VERSION as FS_DIFF_SCHEMA_VERSION,
)
from mgf.vm.forensics.capture import (
    FileEntry,
    FilesystemBaseline,
    FilesystemDiff,
    NetworkCaptureHandle,
    NetworkCaptureStatus,
    capture_filesystem_baseline,
    capture_filesystem_diff,
    capture_memory,
    capture_screenshot,
    list_network_captures,
    network_capture_status,
    start_network_capture,
    stop_network_capture,
    walk_tree,
)
from mgf.vm.forensics.case import (
    CASE_SCHEMA_VERSION,
    Artifact,
    ArtifactKind,
    Case,
    CaseStatus,
)
from mgf.vm.forensics.manifest import (
    MANIFEST_FILENAME,
    MANIFEST_SCHEMA_VERSION,
    Manifest,
    ManifestEntry,
    VerifyResult,
    build_manifest,
    load_manifest,
    save_manifest,
    verify_manifest,
)
from mgf.vm.forensics.store import (
    CASE_FILENAME,
    CaseStore,
    default_forensics_dir,
)

__all__ = [
    "CASE_FILENAME",
    "CASE_SCHEMA_VERSION",
    "FS_BASELINE_SCHEMA_VERSION",
    "FS_DIFF_SCHEMA_VERSION",
    "MANIFEST_FILENAME",
    "MANIFEST_SCHEMA_VERSION",
    "Artifact",
    "ArtifactKind",
    "Case",
    "CaseStatus",
    "CaseStore",
    "FileEntry",
    "FilesystemBaseline",
    "FilesystemDiff",
    "Manifest",
    "ManifestEntry",
    "NetworkCaptureHandle",
    "NetworkCaptureStatus",
    "VerifyResult",
    "__version__",
    "build_manifest",
    "capture_filesystem_baseline",
    "capture_filesystem_diff",
    "capture_memory",
    "capture_screenshot",
    "default_forensics_dir",
    "list_network_captures",
    "load_manifest",
    "network_capture_status",
    "save_manifest",
    "start_network_capture",
    "stop_network_capture",
    "verify_manifest",
    "walk_tree",
]
