huntkit 0.3.0__py3-none-any.whl

huntkit/enrich/engine.py

@@ -0,0 +1,167 @@
+"""Enrichment engine — favicon hashes and ASN origins over the recon surface.
+
+The recon pipeline gathers live URLs and resolved hosts; this layer adds the
+two *asset-correlation* signals that turn that surface into leads elsewhere:
+
+  - a **favicon hash** per origin (the Shodan pivot), and
+  - the **ASN / BGP prefix** behind each host (the network to sweep next).
+
+It mirrors the scanner's shape — targets are read from the workspace's own,
+already scope-filtered result files *and* re-checked against scope here, the
+work runs on a thread pool, and results are merged and persisted once on the
+main thread. Both the HTTP fetch and the ASN resolve/lookup are injected, so
+the engine stays testable without the network.
+"""
+
+from __future__ import annotations
+
+import json
+import time
+import urllib.request
+from collections.abc import Callable
+from concurrent.futures import ThreadPoolExecutor, as_completed
+from dataclasses import dataclass, field
+from typing import Optional
+from urllib.parse import urlparse
+
+from ..core.workspace import Workspace
+from .asn import AsnResult, LookupFn, ResolveFn, asn_for, default_lookup, default_resolve
+from .favicon import FaviconResult, FetchFn, hash_favicon
+
+# URL sources (already scope-filtered by recon; re-checked here anyway).
+URL_FILES = ["recon/live.txt", "urls/urls.txt"]
+HOST_FILES = ["recon/live.txt", "recon/resolved.txt", "urls/urls.txt"]
+
+ENRICH_JSON = "scans/enrich.json"
+ENRICH_STATE = "enrich"
+
+_UA = "HuntKit/enrich (+authorised recon)"
+_HTTP_TIMEOUT = 10
+
+EventFn = Callable[[dict], None]
+
+
+@dataclass
+class EnrichReport:
+    program: str
+    favicons: list[FaviconResult] = field(default_factory=list)
+    asns: list[AsnResult] = field(default_factory=list)
+
+    @property
+    def favicon_hits(self) -> int:
+        return sum(1 for f in self.favicons if f.ok)
+
+    @property
+    def asn_hits(self) -> int:
+        return sum(1 for a in self.asns if a.ok)
+
+    @property
+    def unique_asns(self) -> list[str]:
+        seen = {a.asn for a in self.asns if a.ok}
+        return sorted(seen, key=lambda s: int(s))
+
+
+def default_fetch(url: str) -> bytes:
+    """Fetch a URL's body over HTTP, raising on any non-200 or transport error."""
+    # scheme guard first: never let a file:// or other scheme reach urlopen
+    if urlparse(url).scheme not in ("http", "https"):
+        raise ValueError("only http(s) favicons are fetched")
+    req = urllib.request.Request(url, headers={"User-Agent": _UA})  # noqa: S310 — http(s) only
+    with urllib.request.urlopen(req, timeout=_HTTP_TIMEOUT) as resp:  # noqa: S310
+        if resp.status != 200:
+            raise OSError(f"HTTP {resp.status}")
+        return resp.read()
+
+
+def _host_of(url: str) -> Optional[str]:
+    parsed = urlparse(url if "://" in url else f"//{url}", scheme="http")
+    return parsed.hostname
+
+
+def enrich_origins(ws: Workspace) -> list[str]:
+    """One representative URL per in-scope origin (scheme + netloc), deduped."""
+    seen: dict[str, str] = {}
+    for rel in URL_FILES:
+        for url in ws.read_lines(rel):
+            parsed = urlparse(url if "://" in url else f"http://{url}")
+            host = parsed.hostname
+            if not host or not ws.in_scope(host):
+                continue
+            origin = f"{parsed.scheme}://{parsed.netloc}"
+            seen.setdefault(origin, origin)
+    return sorted(seen)
+
+
+def enrich_hosts(ws: Workspace) -> list[str]:
+    """Unique in-scope hostnames across the recon result files."""
+    seen: dict[str, None] = {}
+    for rel in HOST_FILES:
+        for line in ws.read_lines(rel):
+            host = _host_of(line)
+            if host and ws.in_scope(host):
+                seen[host] = None
+    return sorted(seen)
+
+
+def run_enrich(
+    ws: Workspace,
+    *,
+    do_favicon: bool = True,
+    do_asn: bool = True,
+    threads: int = 10,
+    fetch: FetchFn = default_fetch,
+    resolve: ResolveFn = default_resolve,
+    lookup: LookupFn = default_lookup,
+    on_event: Optional[EventFn] = None,
+) -> EnrichReport:
+    """Run the requested enrichers over the workspace and persist the report."""
+    emit: EventFn = on_event or (lambda _e: None)
+    report = EnrichReport(program=ws.program)
+    ws.state.start(ENRICH_STATE)
+
+    if do_favicon:
+        origins = enrich_origins(ws)
+        emit({"event": "favicon_start", "targets": len(origins)})
+        report.favicons = _run_pool(origins, lambda o: hash_favicon(o, fetch), threads)
+        emit({"event": "favicon_done", "hits": report.favicon_hits})
+
+    if do_asn:
+        hosts = enrich_hosts(ws)
+        emit({"event": "asn_start", "targets": len(hosts)})
+        report.asns = _run_pool(
+            hosts, lambda h: asn_for(h, resolve=resolve, lookup=lookup), threads
+        )
+        emit({"event": "asn_done", "hits": report.asn_hits})
+
+    _persist(ws, report)
+    ws.state.done(ENRICH_STATE, favicons=report.favicon_hits, asns=report.asn_hits)
+    return report
+
+
+def _run_pool(items: list[str], work: Callable[[str], object], threads: int) -> list:
+    """Map ``work`` over ``items`` on a thread pool, order-preserving.
+
+    A worker that raises is isolated: the batch keeps its other results.
+    """
+    if not items:
+        return []
+    out: dict[int, object] = {}
+    with ThreadPoolExecutor(max_workers=max(1, min(threads, len(items)))) as pool:
+        futures = {pool.submit(work, item): i for i, item in enumerate(items)}
+        for fut in as_completed(futures):
+            idx = futures[fut]
+            try:
+                out[idx] = fut.result()
+            except Exception:  # noqa: BLE001 — a crashing worker must not sink the pool
+                out[idx] = None
+    return [out[i] for i in range(len(items)) if out.get(i) is not None]
+
+
+def _persist(ws: Workspace, report: EnrichReport) -> None:
+    payload = {
+        "program": report.program,
+        "generated": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+        "favicons": [f.to_dict() for f in report.favicons],
+        "asns": [a.to_dict() for a in report.asns],
+    }
+    ws.path(ENRICH_JSON).write_text(json.dumps(payload, indent=2), encoding="utf-8")

huntkit/enrich/favicon.py

@@ -0,0 +1,91 @@
+"""Favicon hashing — the Shodan pivot from one icon to every host serving it.
+
+A favicon is a strong asset-correlation signal: load balancers, dev/staging
+mirrors, and forgotten origins behind a CDN very often ship the *same* icon as
+the flagship site. Hashing it (``mmh3`` over the base64 of the raw bytes, the
+Shodan convention) gives a single integer you can paste into
+``http.favicon.hash:<h>`` on Shodan/Censys to surface the rest of the estate.
+
+The fetch is a plain HTTP GET to an in-scope target — the same kind of request
+recon already makes — and is injectable so the engine (and the tests) can swap
+in a stubbed fetcher instead of hitting the network.
+"""
+
+from __future__ import annotations
+
+import base64
+from collections.abc import Callable
+from dataclasses import dataclass
+from typing import Optional
+from urllib.parse import urljoin, urlparse
+
+from . import mmh3
+
+# Fetcher contract: given an absolute URL, return the response body bytes, or
+# raise on any failure (timeout, non-200, connection error). The engine wraps
+# the default urllib fetcher so callers can inject a stub in tests.
+FetchFn = Callable[[str], bytes]
+
+_MAX_BYTES = 1024 * 1024  # a favicon over 1 MiB is not a favicon
+
+
+@dataclass
+class FaviconResult:
+    """One host's favicon hash and the search pivot it unlocks."""
+
+    url: str
+    hash: Optional[int] = None
+    size: int = 0
+    error: str = ""
+
+    @property
+    def ok(self) -> bool:
+        return self.hash is not None
+
+    @property
+    def shodan(self) -> str:
+        return f"http.favicon.hash:{self.hash}" if self.ok else ""
+
+    def to_dict(self) -> dict:
+        return {
+            "url": self.url,
+            "hash": self.hash,
+            "size": self.size,
+            "shodan": self.shodan,
+            "error": self.error,
+        }
+
+
+def favicon_url(base: str) -> str:
+    """The ``/favicon.ico`` URL for a site, given any URL on that origin."""
+    parsed = urlparse(base if "://" in base else f"http://{base}")
+    origin = f"{parsed.scheme}://{parsed.netloc}"
+    return urljoin(origin + "/", "favicon.ico")
+
+
+def favicon_hash(data: bytes) -> int:
+    """The Shodan-convention favicon hash: mmh3 over the base64 of the bytes.
+
+    ``base64.encodebytes`` is used (not ``b64encode``) because it inserts a
+    newline every 76 chars and a trailing newline — the exact byte stream
+    Shodan hashes, so the result matches ``http.favicon.hash:`` queries.
+    """
+    return mmh3.hash_bytes(base64.encodebytes(data))
+
+
+def hash_favicon(base_url: str, fetch: FetchFn) -> FaviconResult:
+    """Fetch the favicon for ``base_url`` and hash it, never raising.
+
+    A fetch failure (missing icon, timeout, oversize) is recorded on the
+    result rather than propagated, so one dead host cannot sink a batch.
+    """
+    url = favicon_url(base_url)
+    try:
+        data = fetch(url)
+    except Exception as exc:  # noqa: BLE001 — a bad fetch is data, not a crash
+        return FaviconResult(url=url, error=str(exc) or type(exc).__name__)
+    if not data:
+        return FaviconResult(url=url, error="empty response")
+    if len(data) > _MAX_BYTES:
+        return FaviconResult(url=url, size=len(data), error="too large")
+    return FaviconResult(url=url, hash=favicon_hash(data), size=len(data))

huntkit/enrich/mmh3.py

@@ -0,0 +1,69 @@
+"""MurmurHash3 (x86, 32-bit) — a self-contained, pure-Python port.
+
+Shodan indexes a site's favicon by ``mmh3.hash(base64(favicon_bytes))``, so a
+favicon hash is the pivot that turns one asset into *every* host serving the
+same icon. The reference hasher ships as a C extension (``mmh3``); HuntKit
+keeps its runtime dependencies to three pure-Python packages, so rather than
+pull a compiled wheel onto a hunter's box we port the ~40-line algorithm here.
+
+This is a faithful port of Austin Appleby's ``MurmurHash3_x86_32`` (public
+domain). It returns a *signed* 32-bit int by default, matching the ``mmh3``
+package — which is the exact value Shodan's ``http.favicon.hash:`` expects.
+"""
+
+from __future__ import annotations
+
+_C1 = 0xCC9E2D51
+_C2 = 0x1B873593
+_MASK = 0xFFFFFFFF
+
+
+def _rotl32(x: int, r: int) -> int:
+    return ((x << r) | (x >> (32 - r))) & _MASK
+
+
+def hash_bytes(data: bytes, seed: int = 0, *, signed: bool = True) -> int:
+    """MurmurHash3_x86_32 of ``data``.
+
+    ``signed`` (the default) folds the result into the signed 32-bit range,
+    so it equals ``mmh3.hash(data, seed)`` from the C package.
+    """
+    length = len(data)
+    nblocks = length // 4
+    h1 = seed & _MASK
+
+    # body — four bytes at a time, little-endian
+    for i in range(nblocks):
+        k1 = int.from_bytes(data[i * 4 : i * 4 + 4], "little")
+        k1 = (k1 * _C1) & _MASK
+        k1 = _rotl32(k1, 15)
+        k1 = (k1 * _C2) & _MASK
+        h1 ^= k1
+        h1 = _rotl32(h1, 13)
+        h1 = (h1 * 5 + 0xE6546B64) & _MASK
+
+    # tail — the trailing 0..3 bytes
+    tail = data[nblocks * 4 :]
+    k1 = 0
+    if len(tail) >= 3:
+        k1 ^= tail[2] << 16
+    if len(tail) >= 2:
+        k1 ^= tail[1] << 8
+    if len(tail) >= 1:
+        k1 ^= tail[0]
+        k1 = (k1 * _C1) & _MASK
+        k1 = _rotl32(k1, 15)
+        k1 = (k1 * _C2) & _MASK
+        h1 ^= k1
+
+    # finalisation mix (fmix32)
+    h1 ^= length
+    h1 ^= h1 >> 16
+    h1 = (h1 * 0x85EBCA6B) & _MASK
+    h1 ^= h1 >> 13
+    h1 = (h1 * 0xC2B2AE35) & _MASK
+    h1 ^= h1 >> 16
+
+    if signed and h1 & 0x80000000:
+        return h1 - 0x100000000
+    return h1

huntkit/fingerprint/__init__.py

@@ -0,0 +1,26 @@
+"""Fingerprint layer — recognise CDN/WAF/cloud/tech from HTTP headers.
+
+A pure feature layer (depends only on ``utils``): it classifies response
+headers the operator already captured against a declarative catalog. Offline;
+never touches a target.
+"""
+
+from __future__ import annotations
+
+from .engine import (
+    FingerprintMatch,
+    fingerprint_headers,
+    has_waf,
+    parse_headers,
+)
+from .rules import FINGERPRINT_RULES, KINDS, FingerprintRule
+
+__all__ = [
+    "FINGERPRINT_RULES",
+    "FingerprintMatch",
+    "FingerprintRule",
+    "KINDS",
+    "fingerprint_headers",
+    "has_waf",
+    "parse_headers",
+]

huntkit/fingerprint/engine.py

@@ -0,0 +1,83 @@
+"""Fingerprint engine — classify HTTP response headers against the catalog.
+
+Accepts either a parsed header mapping or a raw header block (as printed by
+``curl -sI`` or saved from a response), and returns the vendors it recognises,
+WAF first. Pure: it only reads headers the operator already captured.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from ..utils.severity import Severity
+from .rules import FINGERPRINT_RULES, KINDS
+
+_KIND_ORDER = {k: i for i, k in enumerate(KINDS)}
+
+
+@dataclass(frozen=True)
+class FingerprintMatch:
+    id: str
+    name: str
+    kind: str
+    severity: Severity
+    evidence: str  # the header that matched, e.g. "cf-ray: 7a1b…"
+
+    def to_dict(self) -> dict:
+        return {
+            "id": self.id,
+            "name": self.name,
+            "kind": self.kind,
+            "severity": self.severity.label,
+            "evidence": self.evidence,
+        }
+
+
+def parse_headers(text: str) -> dict[str, str]:
+    """Parse a raw header block into a lowercased name->value map.
+
+    The HTTP status line is skipped and repeated headers (notably Set-Cookie)
+    are joined with '; ' so a single substring check still sees them all.
+    """
+    headers: dict[str, str] = {}
+    for line in text.splitlines():
+        if ":" not in line:
+            continue
+        name, _, value = line.partition(":")
+        name = name.strip().lower()
+        value = value.strip()
+        if not name or name.startswith("http/"):
+            continue
+        headers[name] = f"{headers[name]}; {value}" if name in headers else value
+    return headers
+
+
+def _evidence(rule, headers: dict[str, str]) -> str:
+    for hname, vsub in rule.headers:
+        val = headers.get(hname)
+        if val is None:
+            continue
+        if vsub == "" or vsub in val.lower():
+            shown = val if len(val) <= 60 else val[:57] + "…"
+            return f"{hname}: {shown}"
+    return ""
+
+
+def fingerprint_headers(headers: str | dict) -> list[FingerprintMatch]:
+    """Return matched vendors for the given headers, WAF first then by kind."""
+    hmap = (
+        parse_headers(headers)
+        if isinstance(headers, str)
+        else {str(k).lower(): str(v) for k, v in headers.items()}
+    )
+    out: list[FingerprintMatch] = []
+    for rule in FINGERPRINT_RULES:
+        ev = _evidence(rule, hmap)
+        if ev:
+            out.append(FingerprintMatch(rule.id, rule.name, rule.kind, rule.severity, ev))
+    out.sort(key=lambda m: (-int(m.severity), _KIND_ORDER.get(m.kind, 9), m.name))
+    return out
+
+
+def has_waf(matches: list[FingerprintMatch]) -> bool:
+    return any(m.kind == "waf" for m in matches)

huntkit/fingerprint/rules.py

@@ -0,0 +1,170 @@
+"""CDN / WAF / cloud / tech fingerprint catalog.
+
+Each rule maps one vendor to the HTTP response headers (and Set-Cookie values)
+that give it away. A rule matches when ANY of its header signals hit — a header
+is present and, if a value substring is given, contains it. Plain data, so
+adding a vendor is one row (same ethos as the signal and secret catalogs).
+
+Pure and offline: it classifies response headers the operator already captured
+(``curl -sI``, a saved response). WAF matches are flagged MEDIUM because a WAF
+changes how the rest of the engagement should be run; everything else is INFO.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from ..utils.severity import Severity
+
+# kind values, in the order they should surface.
+KINDS = ("waf", "cdn", "cloud", "server", "tech")
+
+
+@dataclass(frozen=True)
+class FingerprintRule:
+    id: str
+    name: str
+    kind: str  # one of KINDS
+    headers: tuple[tuple[str, str], ...]  # (header-name-lower, value-substr-lower); "" = presence
+    severity: Severity = Severity.INFO
+
+
+_WAF = Severity.MEDIUM
+_INFO = Severity.INFO
+
+
+FINGERPRINT_RULES: tuple[FingerprintRule, ...] = (
+    # ---- WAF / security proxies (flagged) --------------------------------
+    FingerprintRule(
+        "imperva",
+        "Imperva / Incapsula WAF",
+        "waf",
+        (
+            ("x-iinfo", ""),
+            ("x-cdn", "incapsula"),
+            ("set-cookie", "incap_ses"),
+            ("set-cookie", "visid_incap"),
+        ),
+        _WAF,
+    ),
+    FingerprintRule(
+        "sucuri",
+        "Sucuri CloudProxy WAF",
+        "waf",
+        (("x-sucuri-id", ""), ("x-sucuri-cache", ""), ("server", "sucuri/cloudproxy")),
+        _WAF,
+    ),
+    FingerprintRule(
+        "f5-bigip",
+        "F5 BIG-IP / ASM",
+        "waf",
+        (("set-cookie", "bigipserver"), ("server", "big-ip"), ("x-waf-event-info", "")),
+        _WAF,
+    ),
+    FingerprintRule(
+        "citrix-netscaler",
+        "Citrix NetScaler",
+        "waf",
+        (("set-cookie", "ns_af"), ("set-cookie", "citrix_ns_id"), ("via", "ns-cache")),
+        _WAF,
+    ),
+    FingerprintRule(
+        "barracuda",
+        "Barracuda WAF",
+        "waf",
+        (("set-cookie", "barra_counter_session"), ("server", "barracuda")),
+        _WAF,
+    ),
+    FingerprintRule("fortiweb", "Fortinet FortiWeb", "waf", (("set-cookie", "fortiwafsid"),), _WAF),
+    FingerprintRule(
+        "modsecurity",
+        "ModSecurity",
+        "waf",
+        (("server", "mod_security"), ("server", "modsecurity")),
+        _WAF,
+    ),
+    FingerprintRule("aws-waf", "AWS WAF", "waf", (("x-amzn-waf-action", ""),), _WAF),
+    # ---- CDN -------------------------------------------------------------
+    FingerprintRule(
+        "cloudflare",
+        "Cloudflare",
+        "cdn",
+        (("server", "cloudflare"), ("cf-ray", ""), ("cf-cache-status", "")),
+        _INFO,
+    ),
+    FingerprintRule(
+        "fastly",
+        "Fastly",
+        "cdn",
+        (("x-served-by", "cache"), ("x-fastly-request-id", ""), ("via", "fastly")),
+        _INFO,
+    ),
+    FingerprintRule(
+        "cloudfront",
+        "Amazon CloudFront",
+        "cdn",
+        (("via", "cloudfront"), ("x-amz-cf-id", ""), ("x-amz-cf-pop", "")),
+        _INFO,
+    ),
+    FingerprintRule(
+        "akamai",
+        "Akamai",
+        "cdn",
+        (("server", "akamaighost"), ("x-akamai-transformed", ""), ("x-akamai-request-id", "")),
+        _INFO,
+    ),
+    FingerprintRule("keycdn", "KeyCDN", "cdn", (("server", "keycdn-engine"),), _INFO),
+    FingerprintRule("bunnycdn", "BunnyCDN", "cdn", (("server", "bunnycdn"),), _INFO),
+    # ---- cloud / hosting -------------------------------------------------
+    FingerprintRule(
+        "aws-s3", "Amazon S3", "cloud", (("server", "amazons3"), ("x-amz-bucket-region", "")), _INFO
+    ),
+    FingerprintRule(
+        "aws", "Amazon Web Services", "cloud", (("x-amz-request-id", ""), ("x-amz-id-2", "")), _INFO
+    ),
+    FingerprintRule(
+        "gcp",
+        "Google Cloud",
+        "cloud",
+        (("server", "gws"), ("server", "gse"), ("x-goog-generation", "")),
+        _INFO,
+    ),
+    FingerprintRule(
+        "azure",
+        "Microsoft Azure",
+        "cloud",
+        (("x-azure-ref", ""), ("x-ms-request-id", ""), ("server", "microsoft-azure")),
+        _INFO,
+    ),
+    FingerprintRule("heroku", "Heroku", "cloud", (("via", "vegur"), ("server", "cowboy")), _INFO),
+    FingerprintRule(
+        "vercel", "Vercel", "cloud", (("x-vercel-id", ""), ("server", "vercel")), _INFO
+    ),
+    FingerprintRule(
+        "netlify", "Netlify", "cloud", (("x-nf-request-id", ""), ("server", "netlify")), _INFO
+    ),
+    FingerprintRule("github-pages", "GitHub Pages", "cloud", (("server", "github.com"),), _INFO),
+    FingerprintRule(
+        "fly-io", "Fly.io", "cloud", (("fly-request-id", ""), ("server", "fly")), _INFO
+    ),
+    FingerprintRule("render", "Render", "cloud", (("x-render-origin-server", ""),), _INFO),
+    # ---- server / framework ---------------------------------------------
+    FingerprintRule("nginx", "nginx", "server", (("server", "nginx"),), _INFO),
+    FingerprintRule("apache", "Apache httpd", "server", (("server", "apache"),), _INFO),
+    FingerprintRule("iis", "Microsoft IIS", "server", (("server", "microsoft-iis"),), _INFO),
+    FingerprintRule("litespeed", "LiteSpeed", "server", (("server", "litespeed"),), _INFO),
+    FingerprintRule("openresty", "OpenResty", "server", (("server", "openresty"),), _INFO),
+    FingerprintRule("express", "Node.js / Express", "tech", (("x-powered-by", "express"),), _INFO),
+    FingerprintRule("php", "PHP", "tech", (("x-powered-by", "php"),), _INFO),
+    FingerprintRule(
+        "aspnet", "ASP.NET", "tech", (("x-powered-by", "asp.net"), ("x-aspnet-version", "")), _INFO
+    ),
+    FingerprintRule(
+        "nextjs", "Next.js", "tech", (("x-powered-by", "next.js"), ("x-nextjs-cache", "")), _INFO
+    ),
+    FingerprintRule(
+        "wordpress", "WordPress", "tech", (("x-pingback", ""), ("link", "wp-json")), _INFO
+    ),
+    FingerprintRule("laravel", "Laravel", "tech", (("set-cookie", "laravel_session"),), _INFO),
+    FingerprintRule("django", "Django", "tech", (("set-cookie", "csrftoken"),), _INFO),
+)

huntkit/history/__init__.py

@@ -0,0 +1,38 @@
+"""History layer — snapshot a program's results and diff across runs.
+
+Bug bounty is the same scope re-swept over time; this layer freezes the
+workspace's result sets into timestamped snapshots (``history/``) and reports
+the delta between two points — new subdomains, freshly-live URLs, and above
+all new findings. Depends only on ``core``; pure and offline.
+"""
+
+from __future__ import annotations
+
+from .diff import CategoryDiff, DiffReport, current_vs, diff_snapshots
+from .store import (
+    CATEGORIES,
+    HISTORY_DIR,
+    Snapshot,
+    capture,
+    find,
+    latest,
+    list_snapshots,
+    load,
+    save,
+)
+
+__all__ = [
+    "CATEGORIES",
+    "HISTORY_DIR",
+    "CategoryDiff",
+    "DiffReport",
+    "Snapshot",
+    "capture",
+    "current_vs",
+    "diff_snapshots",
+    "find",
+    "latest",
+    "list_snapshots",
+    "load",
+    "save",
+]