executeCheckNode executes a single check node

setCurrentVersion updates version and persists to Redis (must be called with lock held)

simpleRuleFingerprintFromXML 解析单条 rule XML 并计算指纹。 忽略 ConditionAST，仅基于结构和字段内容。

CachedRegexMatch performs regex matching with caching for non-raw values Uses the same logic as REGEX function to ensure compatibility

CheckAbsenceTimeout checks if any absence stages have timed out (for deferred triggering). This is called when the sequence has not completed normally

CleanupKeyLock is kept for callers that explicitly clean up after deleting a state. Lock entries are now released automatically by UnlockKey once the

ClearRegexCache clears the global regex cache.

Eval performs ThreatBook threat intelligence lookup with caching Args: queryValue string, queryType string, apiKey string (optional) Returns: ThreatBo

Eval performs Shodan IP lookup with caching Args: ip string, apiKey string (optional) Returns: ShodanResult object with infrastructure information

FindAbsenceCompletionPath checks if the sequence can complete due to absence timeout and returns the match indices used. Returns nil if not triggerabl

Input accessors

PNS Output accessors

GetProjectAgents returns all agents used by this project, dynamically calculated from FlowNodes

GetProjectRulesets returns all rulesets used by this project, dynamically calculated from FlowNodes

NewPebbleCEPValueStore creates/opens a Pebble DB for a specific ruleset.

NewRedisErrorLogHandler creates a new Redis error log handler

RecordProjectOperation records a project operation

Stop the ruleset engine, waiting for all upstream and downstream data to be processed before shutdown.

UnlockKey releases the per-key mutex.

cleanup performs aggressive cleanup when normal stop fails

getCurrentVersionUnsafe returns version string without locking (must be called with lock held)

loadBuiltRulesetFromTestdata reads XML under testdata/, runs ParseRuleset + RulesetBuild + SetTestMode, registers cleanup, and returns a ready ruleset

ARM64-optimized SIMDContainsCaseInsensitive

processCheckNode handles the common logic for processing check nodes

============================================================================ Tokenizer ===============================================================

CalculateRefCountUnsafe performs the same calculation as CalculateRefCount but without acquiring locks This version should only be called when the cal

CheckConnectivity performs a real connectivity test for the input component This method tests actual connection to external systems (Kafka, SLS, etc.)

DeleteState removes a SequenceState by key.

GetActiveFollowers returns list of followers currently executing instructions

GetAllChanges returns all pending changes

GetProduceTotal returns the total produced count.

GetProjectOutputs returns all outputs used by this project, dynamically calculated from FlowNodes

Ruleset accessors

GetStageEventIDs returns the event IDs referenced in a specific stage.

HasAbsenceStages returns true if any stage in the condition is an absence stage.

NewRuleset creates a new resource from an XML file path: Path to the resource XML file

PutSnapshot serializes data and enqueues an asynchronous write to Pebble. The payload is kept in an inflight map so that an immediate GetSnapshot can

RecordLocalPush records a local push operation to Redis

Sample attempts to sample the data based on timer (performance optimized version)

Stop stops the output producer and waits for all routines to finish.

createComponentInstance creates actual component instances from configuration

decompressState decompresses a zstd-compressed string and deserializes to SequenceState. Transparently handles both compressed and uncompressed (legac

generateCacheKey creates a cache key from regex pattern and input value

getLineNumber finds the line number of a pattern in XML content

getLogDir returns the appropriate log directory based on the operating system

getSASLMechanism returns the appropriate SASL mechanism based on the configuration

Optimized prefix checking - avoid strings.HasPrefix overhead

parseNodeDirect splits "TYPE.name" into ("TYPE", "name")

parseWithGrok parses the input data using grok pattern if configured

pendingRuleDuplicate 使用 rules_engine 解析后的结构来做近似"逻辑等价"判断（忽略 ConditionAST）。

Helper function to return appropriate error format for ruleset APIs

serializeState serializes a SequenceState to zstd-compressed JSON.

validatePluginParameters validates the parameters of a plugin call

Clear removes all entries from the cache

Eval performs VirusTotal hash lookup with caching Args: hash string, apiKey string (optional) Returns: VirusTotalResult object with detection informat

============================================================================ Completion Path (Phase 3b: find which matches were used) ================

GetCurrentMetrics returns the latest system metrics

GetIncrementAndUpdate returns the increment since last call and updates the baseline. This method is thread-safe and designed for statistics collectio

GetOrCreateState atomically gets or creates a SequenceState for the given key. IMPORTANT: The caller MUST hold the per-key lock via LockKey before cal

Output accessors

Project accessors

GetRedisSampleManager returns the global Redis sample manager