Enum RuleCondition 

#[non_exhaustive]
pub enum RuleCondition {
    PatternExists {
        pattern_id: u32,
    },
    PatternCountGt {
        pattern_id: u32,
        threshold: u32,
    },
    PatternCountGte {
        pattern_id: u32,
        threshold: u32,
    },
    FileSizeLt(u64),
    FileSizeLte(u64),
    FileSizeGt(u64),
    FileSizeGte(u64),
    FileSizeEq(u64),
    FileSizeNe(u64),
    LiteralTrue,
    LiteralFalse,
    RegexMatch {
        field: Arc<str>,
        pattern: Arc<str>,
    },
    SubstringMatch {
        haystack: Arc<str>,
        needle: Arc<str>,
    },
    PrefixMatch {
        value: Arc<str>,
        prefix: Arc<str>,
    },
    SuffixMatch {
        value: Arc<str>,
        suffix: Arc<str>,
    },
    RangeMatch {
        value: u64,
        min: u64,
        max: u64,
    },
    SetMembership {
        value: Arc<str>,
        set: SmallVec<[Arc<str>; 4]>,
    },
    FieldInSet {
        field: Arc<str>,
        set: SmallVec<[Arc<str>; 4]>,
    },
    Opaque(Arc<dyn RuleConditionExt>),
}

A typed rule leaf condition.

pattern_id indexes the rule_bitmaps and rule_counts buffers used by RuleFormula::to_program. File-size thresholds are accepted as u64; thresholds above the current scalar IR file-size range are folded to their mathematically forced result.

Examples

use vyre_libs::rule::RuleCondition;

let condition = RuleCondition::PatternCountGte {
    pattern_id: 7,
    threshold: 2,
};
assert!(matches!(condition, RuleCondition::PatternCountGte { .. }));

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

PatternExists

True when the pattern has any match state.

Fields

pattern_id: u32

Pattern table index.

PatternCountGt

True when the pattern count is strictly greater than threshold.

Fields

pattern_id: u32

Pattern table index.

threshold: u32

Exclusive lower bound.

PatternCountGte

True when the pattern count is greater than or equal to threshold.

Fields

pattern_id: u32

Pattern table index.

threshold: u32

Inclusive lower bound.

FileSizeLt(u64)

True when the file size is less than the threshold.

FileSizeLte(u64)

True when the file size is less than or equal to the threshold.

FileSizeGt(u64)

True when the file size is greater than the threshold.

FileSizeGte(u64)

True when the file size is greater than or equal to the threshold.

FileSizeEq(u64)

True when the file size equals the threshold.

FileSizeNe(u64)

True when the file size does not equal the threshold.

LiteralTrue

Constant true leaf.

LiteralFalse

Constant false leaf.

RegexMatch

True when text matched by field satisfies pattern.

Fields

field: Arc<str>

Source field name.

pattern: Arc<str>

Regular expression pattern.

SubstringMatch

True when haystack contains needle.

Fields

haystack: Arc<str>

Source text or field name.

needle: Arc<str>

Required substring.

PrefixMatch

True when value starts with prefix.

Fields

value: Arc<str>

Source text or field name.

prefix: Arc<str>

Required prefix.

SuffixMatch

True when value ends with suffix.

Fields

value: Arc<str>

Source text or field name.

suffix: Arc<str>

Required suffix.

RangeMatch

True when value falls inside the inclusive numeric range.

Fields

value: u64

Observed value.

min: u64

Inclusive lower bound.

max: u64

Inclusive upper bound.

SetMembership

True when value is present in set.

Fields

value: Arc<str>

Candidate value.

set: SmallVec<[Arc<str>; 4]>

Accepted set members.

FieldInSet

True when the value of context field field is present in set. Differs from Self::SetMembership: this variant dereferences field against the evaluation context, while SetMembership compares a static value payload. Lets a rule express “detector_id is one of …” without emulating it via a regex alternation.

Fields

field: Arc<str>

Context field name to look up (e.g. "detector_id").

set: SmallVec<[Arc<str>; 4]>

Accepted set members.

Opaque(Arc<dyn RuleConditionExt>)

Extension-declared rule condition.

Downstream crates supply an Arc<dyn RuleConditionExt> with its own evaluator + required-buffer contract. The core rule builder rejects opaque conditions because it cannot lower them truthfully; extension-aware builders can call RuleConditionExt::required_buffers when wiring the extension to concrete IR.

Implementations

impl RuleCondition

pub fn required_extension_buffers(&self) -> Vec<BufferDecl>

Return the buffer declarations this condition requires.

Frozen conditions need only the six canonical rule buffers (rule_ids, pattern_ids, rule_bitmaps, rule_counts, file_size, verdicts). Extension conditions contribute extra buffers via RuleConditionExt::required_buffers - callers merge the results.

Trait Implementations

impl Clone for RuleCondition

fn clone(&self) -> RuleCondition

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RuleCondition

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for RuleCondition

impl PartialEq for RuleCondition

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.