Cortex.Query

Shared request-body building blocks used by Cortex list/search endpoints.

Most Advanced API endpoints accept a common set of fields inside request_data — filters, sort, search_from/search_to, and a timeframe. This module defines the opaque value types for those fields and the constructors / encoders that build them. Endpoint modules combine these into a Cortex.RequestData.Standard envelope and hand it to Cortex.Request.post.

Values are opaque so the wire format (operator keywords, keyword: asc|desc, epoch-ms time windows) stays an implementation detail that can shift without breaking callers.

A small number of endpoints — most notably the asset-inventory POST /public_api/v1/assets and the cloud-API list endpoints — use a different wire shape ({SEARCH_FIELD, SEARCH_TYPE, SEARCH_VALUE} with uppercase operators, sort wrapped in an array, etc.). Dialect selects which shape the encoders emit; endpoint modules pick the right value at the call site.

type Filter

A single {field, operator, value} filter entry. Multiple filters sent on one request are AND-ed together by the server.

eq : String -> String -> Filter

Equality filter — field == value.

neq : String -> String -> Filter

Inequality filter — field /= value.

in_ : String -> List String -> Filter

Membership filter — field is one of the given values. Named with a trailing underscore because in is a reserved word in Elm.

nin : String -> List String -> Filter

Non-membership filter — field is none of the given values.

contains : String -> String -> Filter

Substring filter — field contains value.

gt : String -> Int -> Filter

Greater-than filter.

gte : String -> Int -> Filter

Greater-than-or-equal filter.

lt : String -> Int -> Filter

Less-than filter.

lte : String -> Int -> Filter

Less-than-or-equal filter.

custom : String -> String -> Value -> Filter

Escape hatch for operators the SDK has not catalogued yet. The operator string is passed through to the wire as-is, and value can be any JSON.

type Sort

Sort directive — a field name and direction keyword.

asc : String -> Sort

Ascending sort on the given field.

desc : String -> Sort

Descending sort on the given field.

type Range

Pagination window over the result set. The server reads this as search_from / search_to row indices (0-based, exclusive on the upper bound).

range : Int -> Int -> Range

Rows in [from, to). Use limit for the common case of "first N rows".

limit : Int -> Range

First n rows — sugar for range 0 n.

offset : Int -> Int -> Range

n rows starting at start.

type Timeframe

Time window for list/search queries. relative is a duration in epoch-milliseconds measured backward from "now"; between is an absolute from/to epoch-millisecond window.

relative : Int -> Timeframe

Last n milliseconds — e.g. relative 86400000 is the last 24 hours.

between : Int -> Int -> Timeframe

Absolute window — inclusive epoch-millisecond bounds.

type Dialect

Selects which request_data wire shape the encoders emit. Pick one with standard (the default for almost every Cortex endpoint) or assetInventory (the POST /public_api/v1/assets inventory endpoint and the cloud-API list endpoints, which use uppercase SEARCH_FIELD/SEARCH_TYPE/SEARCH_VALUE filters and a sort array).

standard : Dialect

The default dialect used by most Cortex Advanced API list/search endpoints — {field, operator, value} filters and {field, keyword} sort.

assetInventory : Dialect

The asset-inventory dialect — {SEARCH_FIELD, SEARCH_TYPE, SEARCH_VALUE} filters wrapped in {AND: [...]} and sort wrapped in a one-element array. Timeframes are not supported by this dialect and are dropped silently.

encodeFilter : Dialect -> Filter -> Value

Encode a Filter in the given Dialect's wire representation. The Standard dialect emits {field, operator, value} with lowercase operators; the AssetInventory dialect emits {SEARCH_FIELD, SEARCH_TYPE, SEARCH_VALUE} with uppercase operators.

encodeSort : Dialect -> Sort -> Value

Encode a Sort in the given Dialect's wire representation. The Standard dialect emits {field, keyword: "asc"|"desc"}; the AssetInventory dialect emits {FIELD, ORDER: "ASC"|"DESC"} (the enclosing array wrapping is applied by Cortex.RequestData.encode).

encodeRange : Range -> List ( String, Value )

Encode a Range as the two-field {search_from, search_to} pair expected inside request_data. Returned as a list so callers can splice it into the enclosing object.

encodeTimeframe : Timeframe -> Value

Encode a Timeframe to its wire representation.

vanhecke/celmex/2.0.0

Cortex.Query

Modules