file

type AdvancedConfig struct {
	UseMagicDetection bool `yaml:"use_magic_detection"`
	DecodeCompressed  bool `yaml:"decode_compressed"`
	DecodeBase64      bool `yaml:"decode_base64"`
	MaxFilenameLength int  `yaml:"max_filename_length"`
	DeduplicateFiles  bool `yaml:"deduplicate_files"` // Only save each unique file once based on content hash
	// Security analysis options
	ComputeEntropy        bool   `yaml:"compute_entropy"`         // Calculate Shannon entropy
	DetectExecutables     bool   `yaml:"detect_executables"`      // Detect PE/ELF/Mach-O executables
	DetectEmbeddedScripts bool   `yaml:"detect_embedded_scripts"` // Detect embedded VBA/JS/PowerShell
	EnableYaraScanning    bool   `yaml:"enable_yara_scanning"`    // Enable YARA rule matching (requires yara rules path)
	YaraRulesPath         string `yaml:"yara_rules_path"`         // Path to YARA rules directory
	EnableMagika          bool   `yaml:"enable_magika"`           // Enable AI-based file type classification (requires magika CLI in PATH)
	MagikaAssetsDir       string `yaml:"magika_assets_dir"`       // Unused (Rust CLI embeds model), kept for config compatibility
	MagikaModelName       string `yaml:"magika_model_name"`       // Unused (Rust CLI embeds model), kept for config compatibility
}

type Config struct {
	FileExtraction FileExtractionConfig `yaml:"file_extraction"`
}

type ContentInfo struct {
	Hash            string // SHA256 hash of the decoded content
	DecodedContent  []byte // Decompressed content
	WasCompressed   bool   // Whether the content was compressed
	CompressionType string // Compression algorithm (gzip, deflate, or empty)
	CompressedSize  int64  // Original compressed size
}

type FileAnalysis struct {
	Entropy             float64
	MagicBytes          []byte
	TrueFileType        string
	TypeMismatch        bool
	IsPEExecutable      bool
	IsELFExecutable     bool
	IsMachO             bool
	HasEmbeddedScript   bool
	IsPasswordProtected bool
	YaraMatches         []string
	IsKnownMalware      bool
	ThreatName          string
}

type FileExtractionConfig struct {
	Enabled         bool                  `yaml:"enabled"`
	Protocols       ProtocolsConfig       `yaml:"protocols"`
	SizeLimits      SizeLimitsConfig      `yaml:"size_limits"`
	HashAlgorithms  HashAlgorithmsConfig  `yaml:"hash_algorithms"`
	MimeTypes       MimeTypesConfig       `yaml:"mime_types"`
	Storage         StorageConfig         `yaml:"storage"`
	IncompleteFiles IncompleteFilesConfig `yaml:"incomplete_files"`
	Reassembly      ReassemblyConfig      `yaml:"reassembly"`
	Advanced        AdvancedConfig        `yaml:"advanced"`
}

type FileExtractor interface {
	// GetFileHandle generates a unique identifier for a file in the conversation
	GetFileHandle(conv *core.ConversationInfo, isOrigin bool, depth int) string

	// DescribeFile returns a human-readable description of the file
	DescribeFile(handle *FileHandle) string

	// ExtractFile performs the actual file extraction
	ExtractFile(conv *core.ConversationInfo, data []byte, metadata FileMetadata) error

	// ProtocolName returns the name of the protocol this extractor handles
	ProtocolName() string
}

type FileHandle struct {
	ID             string
	ConversationID string
	Protocol       string
	Timestamp      int64
	Depth          int
	IsComplete     bool
	TotalBytes     int64
	SeenBytes      int64
	MissingBytes   int64
	ParentFileID   string
}

type FileHashes struct {
	MD5    string
	SHA1   string
	SHA256 string
}

type FileMetadata struct {
	// Network context
	ConnectionUID string
	FlowDirection string // "client_to_server" or "server_to_client"

	// Protocol-specific context
	HTTPMethod     string // For HTTP files
	HTTPStatusCode int
	HTTPURL        string
	FTPCommand     string // RETR/STOR
	SMBShare       string
	SMBPath        string

	// Content information
	Filename    string
	ContentType string
	Host        string
	Encoding    []string
}

type FileReassembler struct {
	// contains filtered or unexported fields
}

type HashAlgorithmsConfig struct {
	MD5    bool `yaml:"md5"`
	SHA1   bool `yaml:"sha1"`
	SHA256 bool `yaml:"sha256"`
}

type IncompleteFilesConfig struct {
	WriteIncomplete  bool   `yaml:"write_incomplete"`
	IncompletePrefix string `yaml:"incomplete_prefix"`
}

type MIMESignature struct {
	Magic  []byte
	Offset int
	MIME   string
	Ext    string
}

type MimeTypesConfig struct {
	Whitelist []string `yaml:"whitelist"`
	Blacklist []string `yaml:"blacklist"`
}

type ProtocolsConfig struct {
	HTTP bool `yaml:"http"`
	FTP  bool `yaml:"ftp"`
	SMTP bool `yaml:"smtp"`
	POP3 bool `yaml:"pop3"`
	IMAP bool `yaml:"imap"`
	SMB  bool `yaml:"smb"`
	IRC  bool `yaml:"irc"`
}

type ReassemblyConfig struct {
	Enabled          bool  `yaml:"enabled"`
	AllowSparseFiles bool  `yaml:"allow_sparse_files"`
	MaxBufferSize    int64 `yaml:"max_buffer_size"`
}

type SizeLimitsConfig struct {
	MaxFileSize         int64 `yaml:"max_file_size"`
	IncludeMissingBytes bool  `yaml:"include_missing_bytes"`
	MaxFilesPerSession  int   `yaml:"max_files_per_session"`
}

type StorageConfig struct {
	OrganizeByMime      bool `yaml:"organize_by_mime"`
	OrganizeByProtocol  bool `yaml:"organize_by_protocol"`
	OrganizeByDate      bool `yaml:"organize_by_date"`
	CompressStoredFiles bool `yaml:"compress_stored_files"`
	IncludeConnectionID bool `yaml:"include_connection_id"`
}

type StreamingHashWriter struct {
	// contains filtered or unexported fields
}

type YaraScanner struct {
	// contains filtered or unexported fields
}