Skip to content

Conversation

@YoEight
Copy link
Owner

@YoEight YoEight commented Feb 9, 2026

This PR introduces the Session struct, establishing it as the primary entry point for all EventQL (EQL) parsing and static analysis operations. The Session type centralizes the necessary context and configuration, significantly streamlining the EQL processing pipeline.

Key features and benefits of this new Session type include:

  • Unified Context Management: The Session now encapsulates both the ExprArena (for efficient Abstract Syntax Tree allocation) and AnalysisOptions. This provides a single, coherent object to manage all mutable and immutable state required throughout the parsing and analysis lifecycle.
  • Configurable Analysis Environment: A dedicated SessionBuilder is introduced, allowing users to easily configure the AnalysisOptions. This includes:
    • Declaring custom functions (both regular and aggregate) with their type signatures.
    • Specifying the structure and type information for event records (event_type_info).
    • Registering custom type names for use in type conversions.
    • Conveniently including a standard library of common functions and a default event type with use_stdlib().
  • Streamlined EQL Processing Workflow: The Session provides high-level methods (tokenize, parse, run_static_analysis) that abstract away the individual steps of lexical analysis, syntactic parsing, and semantic analysis. This makes the library easier to consume and ensures consistent application of the configured analysis options across all stages.

@YoEight YoEight marked this pull request as ready for review February 9, 2026 05:49
@YoEight YoEight merged commit e208c9e into master Feb 9, 2026
4 checks passed
@YoEight YoEight deleted the session branch February 9, 2026 06:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant