1use thiserror::Error;
2
3#[derive(Debug, Error)]
4#[non_exhaustive]
5pub enum ConvertError {
6 #[error("backend does not support modifier: {0}")]
7 UnsupportedModifier(String),
8
9 #[error("backend does not support keyword/unbound detection")]
10 UnsupportedKeyword,
11
12 #[error("backend does not support array object-scope matching (field[any]/field[all])")]
13 UnsupportedArrayMatching,
14
15 #[error("backend does not support correlation type: {0}")]
16 UnsupportedCorrelation(String),
17
18 #[error("backend requires a processing pipeline")]
19 PipelineRequired,
20
21 #[error("field name is required but missing")]
22 MissingFieldName,
23
24 #[error("unsupported value type: {0}")]
25 UnsupportedValue(String),
26
27 #[error("CIDR parse error: {0}")]
28 CidrParse(String),
29
30 #[error("regex error: {0}")]
31 Regex(String),
32
33 #[error("rule conversion failed: {0}")]
34 RuleConversion(String),
35
36 #[error("invalid SQL identifier: {0}")]
37 InvalidIdentifier(String),
38
39 #[error("pipeline error: {0}")]
40 Pipeline(#[from] rsigma_eval::error::EvalError),
41}
42
43pub type Result<T> = std::result::Result<T, ConvertError>;