1use thiserror::Error;
2
3#[derive(Debug, Error)]
4#[non_exhaustive]
5pub enum ConvertError {
6 #[error("backend does not support modifier: {0}")]
7 UnsupportedModifier(String),
8
9 #[error("backend does not support keyword/unbound detection")]
10 UnsupportedKeyword,
11
12 #[error("backend does not support correlation type: {0}")]
13 UnsupportedCorrelation(String),
14
15 #[error("backend requires a processing pipeline")]
16 PipelineRequired,
17
18 #[error("field name is required but missing")]
19 MissingFieldName,
20
21 #[error("unsupported value type: {0}")]
22 UnsupportedValue(String),
23
24 #[error("CIDR parse error: {0}")]
25 CidrParse(String),
26
27 #[error("regex error: {0}")]
28 Regex(String),
29
30 #[error("rule conversion failed: {0}")]
31 RuleConversion(String),
32
33 #[error("invalid SQL identifier: {0}")]
34 InvalidIdentifier(String),
35
36 #[error("pipeline error: {0}")]
37 Pipeline(#[from] rsigma_eval::error::EvalError),
38}
39
40pub type Result<T> = std::result::Result<T, ConvertError>;