Update rsigma-wasm for EvaluationResult breaking change (rsigma-eval >= 0.13)

[mostafa]

Awesome work on integrating RSigma using WASM. 👏 I have plans to introduce WASM inside the project, but has lower priority for now.

Context

RSigma PR timescale/rsigma#132 unified MatchResult and CorrelationResult into a single EvaluationResult type. This is a breaking change in the rsigma-eval Rust API that will land in the next rsigma release after 0.12.0.

detection.studio currently pins rsigma-eval = "0.10.0" and is unaffected today, but bumping the dependency to the release containing this change will require a small migration in the WASM bridge.

What changed in rsigma-eval

• MatchResult removed. Replaced by EvaluationResult, which is composed of a shared RuleHeader and a body enum (DetectionBody / CorrelationBody).
• Shared fields (rule_title, rule_id, level, tags, custom_attributes) moved from flat struct fields to m.header.rule_title, m.header.rule_id, etc.
• Detection-specific fields (matched_selections, matched_fields, event) moved to m.as_detection().unwrap().matched_selections, etc.
• ProcessResult { detections, correlations } collapsed to Vec<EvaluationResult>. The ProcessResultExt trait provides .detections() / .correlations() iterator helpers.
• NDJSON wire shape is preserved (no change to serialized JSON output).

Migration required in detection.studio

Only rsigma-wasm/src/lib.rs (lines ~261-277) needs updating. The mapping closure that builds the local RuleMatch struct changes from:

.map(|m| RuleMatch {
    rule_title: m.rule_title.clone(),
    rule_id: m.rule_id.clone(),
    level: m.level.as_ref().map(|l| format!("{l:?}").to_lowercase()),
    tags: m.tags.clone(),
    matched_selections: m.matched_selections.clone(),
    matched_fields: m.matched_fields.iter().map(/* ... */).collect(),
})

to:

.map(|m| {
    let det = m.as_detection().unwrap();
    RuleMatch {
        rule_title: m.header.rule_title.clone(),
        rule_id: m.header.rule_id.clone(),
        level: m.header.level.as_ref().map(|l| format!("{l:?}").to_lowercase()),
        tags: m.header.tags.clone(),
        matched_selections: det.matched_selections.clone(),
        matched_fields: det.matched_fields.iter().map(/* ... */).collect(),
    }
})

Plus a version bump in rsigma-wasm/Cargo.toml and a WASM rebuild.

The TypeScript/Vue layer (rsigmaEvaluator.ts, DataView.vue) does not need changes because it consumes detection.studio's own RuleMatch/MatchedEvent JSON shape, which is insulated by the Rust bridge.

Priority

Low. This can wait until the next rsigma crate release is published and detection.studio decides to bump.