@cloudcare/codemirror-dql 0.0.56 → 0.0.58

package/dist/esm/parser/parser.js

@@ -14,6 +14,7 @@ const queryClauseLabels = new Map([
     ['TargetClause', 'projection'],
     ['FilterClause', 'WHERE'],
     ['TimeClause', 'time range'],
+    ['ShiftClause', 'SHIFT'],
     ['ByClause', 'BY'],
     ['HavingClause', 'HAVING'],
     ['OrderClause', 'ORDER BY'],
@@ -23,8 +24,142 @@ const queryClauseLabels = new Map([
     ['SLimitClause', 'SLIMIT'],
     ['SOffsetClause', 'SOFFSET'],
 ]);
-const expressionParents = new Set(['BinaryExpr', 'Expr', 'HavingExpr', 'ProjectionExpr']);
+const expressionParents = new Set(['BinaryExpr', 'Expr', 'HavingExpr', 'ProjectionExpr', 'CaseArithmeticExpr']);
 const commaContextBoundaries = new Set(['CaseExpr', 'Query']);
+const documentedFunctionArities = new Map([
+    ...[
+        'abs',
+        'any',
+        'avg',
+        'bool',
+        'ceil',
+        'count',
+        'count_distinct',
+        'count_series',
+        'deriv',
+        'derivative',
+        'difference',
+        'distinct',
+        'field_values',
+        'first',
+        'float',
+        'floor',
+        'histogram_auto',
+        'increase',
+        'int',
+        'irate',
+        'last',
+        'last_row',
+        'length',
+        'log',
+        'log2',
+        'log10',
+        'lower',
+        'ltrim',
+        'max',
+        'md5',
+        'median',
+        'min',
+        'mode',
+        'non_negative_derivative',
+        'non_negative_difference',
+        'rate',
+        'rate_over_count',
+        'rate_over_sum',
+        'rtrim',
+        'set',
+        'spread',
+        'stddev',
+        'string',
+        'sum',
+        'trim',
+        'uint',
+        'unwrap',
+        'upper',
+    ].map((name) => [name, { min: 1, max: 1 }]),
+    ['bottom', { min: 2, max: 2 }],
+    ['cidr', { min: 1, max: 2 }],
+    ['collect', { min: 1, max: 2 }],
+    ['collect_distinct', { min: 1, max: 2 }],
+    ['concat', { min: 1, max: Number.POSITIVE_INFINITY }],
+    ['count_filter', { min: 2, max: 2 }],
+    ['default', { min: 2, max: 2 }],
+    ['distinct_by_collapse', { min: 1, max: 2 }],
+    ['drain', { min: 2, max: 3 }],
+    ['exists', { min: 0, max: 0 }],
+    ['fill', { min: 2, max: 2 }],
+    ['histogram', { min: 4, max: 5 }],
+    ['histogram_quantile', { min: 2, max: 2 }],
+    ['match', { min: 1, max: 2 }],
+    ['now', { min: 0, max: 0 }],
+    ['query_string', { min: 1, max: 2 }],
+    ['querystring', { min: 1, max: 2 }],
+    ['re', { min: 1, max: 2 }],
+    ['regexp', { min: 1, max: 2 }],
+    ['regex', { min: 1, max: 2 }],
+    ['regexp_extract', { min: 2, max: 3 }],
+    ['regexp_extract_all', { min: 2, max: 3 }],
+    ['regexp_replace', { min: 3, max: 3 }],
+    ['round', { min: 1, max: 2 }],
+    ['search', { min: 1, max: 2 }],
+    ['substr', { min: 2, max: 3 }],
+    ['top', { min: 2, max: 2 }],
+    ['wildcard', { min: 1, max: 2 }],
+]);
+const stableShiftAggregateFunctions = new Set([
+    'any',
+    'avg',
+    'change_score',
+    'collect',
+    'collect_distinct',
+    'corr',
+    'count',
+    'count_distinct',
+    'count_filter',
+    'count_series',
+    'deriv',
+    'derivative',
+    'difference',
+    'ewma',
+    'first',
+    'histogram_quantile',
+    'increase',
+    'irate',
+    'last',
+    'last_row',
+    'mad_score',
+    'max',
+    'median',
+    'min',
+    'mode',
+    'moving_average',
+    'non_negative_derivative',
+    'non_negative_difference',
+    'p50',
+    'p75',
+    'p90',
+    'p95',
+    'p99',
+    'percentile',
+    'rate',
+    'rate_over_count',
+    'rate_over_sum',
+    'slope',
+    'spread',
+    'stddev',
+    'sum',
+    'zscore',
+]);
+const unstableShiftAggregateFunctions = new Set([
+    'distinct',
+    'distinct_by_collapse',
+    'drain',
+    'field_values',
+    'histogram',
+    'histogram_auto',
+    'schema',
+]);
+const caseScalarFunctions = new Set(['int', 'float', 'string', 'md5', 'lower', 'upper', 'trim', 'ltrim', 'rtrim', 'regexp_replace', 'length']);
 export const dqlSyntaxContexts = {
     DQL: 'DQL query',
     DQLConditions: 'DQL condition',
@@ -60,8 +195,15 @@ export const dqlSyntaxContexts = {
     OuterArgItem: 'outer function argument',
     Queted: 'quoted query delimiter',
     EvalCallBody: 'eval function arguments',
+    EvalArgItem: 'eval expression argument',
+    EvalExpression: 'eval expression',
+    EvalAtom: 'eval expression value',
+    EvalFunctionCall: 'eval function call',
+    EvalFunctionCallBody: 'eval function arguments',
+    EvalFunctionArg: 'eval function argument',
     FunctionCallBody: 'function arguments',
     ArgItem: 'function argument',
+    EvalFieldReference: 'eval field reference',
     InValue: 'argument value list',
     SingleExpr: 'expression value',
     Expr: 'expression',
@@ -78,6 +220,8 @@ export const dqlSyntaxContexts = {
     ProjectionFieldFragment: 'projection field fragment',
     ProjectionField: 'projection field',
     SingleFieldExpr: 'projection expression value',
+    ShiftExpr: 'SHIFT expression',
+    ShiftOperand: 'SHIFT operand',
     ProjectionExpr: 'projection expression',
     AsExpr: 'alias',
     FilterClause: 'filter clause',
@@ -91,10 +235,10 @@ export const dqlSyntaxContexts = {
     CaseCondition: 'CASE condition',
     CaseFilterExpr: 'CASE filter expression',
     CasePredicate: 'CASE predicate',
+    CaseComparableValue: 'CASE comparison value',
     CaseValue: 'CASE value',
-    CaseFunctionCall: 'CASE function call',
-    CaseFunctionIdentifier: 'CASE function name',
-    CaseFunctionCallBody: 'CASE function arguments',
+    CaseArithmeticAtom: 'CASE arithmetic value',
+    CaseArithmeticExpr: 'CASE arithmetic expression',
     FilterFragmentExpr: 'filter fragment',
     ComparisonExpr: 'comparison expression',
     LogicalFragmentExpr: 'logical filter expression',
@@ -105,6 +249,7 @@ export const dqlSyntaxContexts = {
     FilterExpr: 'filter expression',
     BinaryExpr: 'binary expression',
     TimeClause: 'time range clause',
+    ShiftClause: 'SHIFT clause',
     TimeRange: 'time range',
     TimeExpr: 'time range value',
     ByClause: 'BY clause',
@@ -124,6 +269,7 @@ export const dqlSyntaxContexts = {
 };
 const functionCallBodyParents = new Set([
     'FunctionCallBody',
+    'EvalFunctionCallBody',
     'EvalCallBody',
     'OuterFunctionCallBody',
     'RawOuterFunctionCallBody',
@@ -132,7 +278,6 @@ const functionCallBodyParents = new Set([
     'FillOuterFunctionCallBody',
     'VariadicOuterFunctionCallBody',
     'RollupFunctionCallBody',
-    'CaseFunctionCallBody',
 ]);
 export class Parser {
     constructor(state, deadline = Date.now() + analysisBudgetMs) {
@@ -149,6 +294,7 @@ export class Parser {
         this.quotedQueryDelimiterInfo = undefined;
         this.caseResultDiagnostics = undefined;
         this.caseResultRecoveryErrors = new Set();
+        this.caseShiftPresence = new Map();
     }
     getDiagnostics() {
         const seen = new Set();
@@ -401,7 +547,7 @@ export class Parser {
         this.appendDiagnostics(diagnostics);
     }
     describeError(node) {
-        var _a;
+        var _a, _b, _c;
         const delimiterIssue = this.getDelimiterIssue();
         if (delimiterIssue && delimiterIssue.kind !== 'unclosed' && this.isRelatedDelimiterError(node, delimiterIssue)) {
             return null;
@@ -483,6 +629,26 @@ export class Parser {
             }
             return this.makeDiagnostic(node, 'expected "AS" before projection alias', group);
         }
+        const projectionField = (_a = this.findAncestor(parent, 'ProjectionField')) !== null && _a !== void 0 ? _a : this.findAncestor(parent, 'ProjectionFieldFragment');
+        if (projectionField) {
+            const shiftError = this.errorDescendantsWithText(projectionField, 'shift').find((error) => error.from <= node.from);
+            if (shiftError && this.containsNode(projectionField, 'ShiftExpr')) {
+                return this.makeDiagnosticAt(shiftError.from, shiftError.to, 'SHIFT expressions cannot be nested', `shift-nested-syntax:${projectionField.from}`);
+            }
+            if (shiftError) {
+                const rawOperand = this.state.sliceDoc(projectionField.from, shiftError.from);
+                const leading = rawOperand.length - rawOperand.trimStart().length;
+                const trailing = rawOperand.length - rawOperand.trimEnd().length;
+                return this.makeDiagnosticAt(projectionField.from + leading, Math.max(projectionField.from + leading + 1, projectionField.from + rawOperand.length - trailing), 'SHIFT operand must be a stable aggregate or subquery measure', `shift-operand-syntax:${projectionField.from}`);
+            }
+        }
+        const invalidShiftContext = (_b = this.findAncestor(parent, 'FilterClause')) !== null && _b !== void 0 ? _b : this.findAncestor(parent, 'HavingClause');
+        if (invalidShiftContext) {
+            const shiftError = this.errorDescendantsWithText(invalidShiftContext, 'shift').find((error) => error.from <= node.from);
+            if (shiftError) {
+                return this.makeDiagnosticAt(shiftError.from, shiftError.to, 'expression-level SHIFT is only allowed in the projection', `shift-context-syntax:${invalidShiftContext.from}`);
+            }
+        }
         if (parentName === 'OuterFunctionCall') {
             return this.makeUnexpectedTokenDiagnostic(node, dqlSyntaxContexts.OuterFunctionCall, group);
         }
@@ -507,7 +673,7 @@ export class Parser {
             }
             return this.makeUnexpectedTokenDiagnostic(node, 'function call', group);
         }
-        if (parentName === 'ArgItem' && node.from === node.to) {
+        if ((parentName === 'ArgItem' || parentName === 'EvalFunctionArg') && node.from === node.to) {
             if ((previous === null || previous === void 0 ? void 0 : previous.name) === 'EqlSingle') {
                 return this.makeDiagnostic(node, 'function argument value expected after "="', group);
             }
@@ -553,19 +719,51 @@ export class Parser {
         if (parentName === 'ByExpr' && errorText === ',') {
             return this.makeDiagnostic(node, 'grouping field expected before ","', group);
         }
-        if (expressionParents.has(parentName)) {
-            if (previous && this.isOperator(previous)) {
-                return this.makeDiagnostic(node, `right-hand expression expected after "${previousText}"`, group);
-            }
-            return this.makeUnexpectedTokenDiagnostic(node, 'expression', group);
-        }
         const caseWhenClause = this.findAncestor(parent, 'CaseWhenClause');
         if (caseWhenClause) {
+            const firstCaseError = this.firstErrorFrom(caseWhenClause);
             const missingCondition = /^\s*when\s+(then)\b/i.exec(this.maskLineComments(this.nodeText(caseWhenClause)));
             if (missingCondition) {
-                const thenOffset = missingCondition.index + missingCondition[0].toLowerCase().lastIndexOf('then');
-                return this.makeDiagnosticAt(caseWhenClause.from + thenOffset, caseWhenClause.from + thenOffset + 4, 'CASE condition expected after "WHEN"', this.caseGroup(caseWhenClause));
+                if (node.from === firstCaseError) {
+                    const thenOffset = missingCondition.index + missingCondition[0].toLowerCase().lastIndexOf('then');
+                    return this.makeDiagnosticAt(caseWhenClause.from + thenOffset, caseWhenClause.from + thenOffset + 4, 'CASE condition expected after "WHEN"', this.caseGroup(caseWhenClause));
+                }
+                return null;
+            }
+            if (!caseWhenClause.getChild('Then')) {
+                if (node.from === firstCaseError) {
+                    return this.makeDiagnostic(node, 'expected "THEN" after CASE condition', this.caseGroup(caseWhenClause));
+                }
+                return null;
+            }
+            const missingResult = /\bthen\s+(else)\b/i.exec(this.maskLineComments(this.nodeText(caseWhenClause)));
+            if (missingResult) {
+                if (node.from === firstCaseError) {
+                    const keyword = missingResult[1];
+                    const keywordOffset = missingResult.index + missingResult[0].toLowerCase().lastIndexOf(keyword.toLowerCase());
+                    return this.makeDiagnosticAt(caseWhenClause.from + keywordOffset, caseWhenClause.from + keywordOffset + keyword.length, 'CASE result expected after "THEN"', this.caseGroup(caseWhenClause));
+                }
+                return errorText ? this.makeUnexpectedTokenDiagnostic(node, dqlSyntaxContexts.CaseExpr, group) : null;
+            }
+        }
+        if (parentName === 'EvalAtom' && errorText === '=' && (previous === null || previous === void 0 ? void 0 : previous.name) === 'Identifier') {
+            return this.makeDiagnostic(node, 'function argument value expected after "="', group);
+        }
+        if (parentName === 'EvalExpression' && node.from === node.to && (previous === null || previous === void 0 ? void 0 : previous.name) === 'EvalAtom' && (next === null || next === void 0 ? void 0 : next.name) === 'EvalAtom') {
+            return this.makeDiagnostic(node, 'expected "," between function arguments', group);
+        }
+        if (parentName === 'CaseArithmeticExpr' && errorText && !(previous === null || previous === void 0 ? void 0 : previous.type.isError)) {
+            return this.makeUnexpectedTokenDiagnostic(node, dqlSyntaxContexts.CaseExpr, group);
+        }
+        if (parentName === 'ShiftExpr' || parentName === 'ShiftClause') {
+            const message = errorText ? 'SHIFT duration must be a positive fixed duration' : 'duration expected after "SHIFT"';
+            return this.makeDiagnostic(node, message, `shift-duration:${parent.from}`);
+        }
+        if (expressionParents.has(parentName)) {
+            if (previous && this.isOperator(previous)) {
+                return this.makeDiagnostic(node, `right-hand expression expected after "${previousText}"`, group);
             }
+            return this.makeUnexpectedTokenDiagnostic(node, 'expression', group);
         }
         if (parentName === 'CaseCondition') {
             return this.makeDiagnostic(node, 'expected "THEN" after CASE condition', this.caseGroup(parent));
@@ -614,7 +812,7 @@ export class Parser {
         }
         if (parentName === 'RollupIdentifier') {
             const timeClause = this.findAncestor(parent, 'TimeClause');
-            let child = (_a = timeClause === null || timeClause === void 0 ? void 0 : timeClause.firstChild) !== null && _a !== void 0 ? _a : null;
+            let child = (_c = timeClause === null || timeClause === void 0 ? void 0 : timeClause.firstChild) !== null && _c !== void 0 ? _c : null;
             while (child) {
                 if (child.type.isError)
                     return null;
@@ -1154,6 +1352,7 @@ export class Parser {
         const contexts = {
             Projection: 'projection item',
             FunctionCallBody: 'function argument',
+            EvalFunctionCallBody: 'function argument',
             EvalCallBody: 'function argument',
             OuterFunctionCallBody: 'function argument',
             RawOuterFunctionCallBody: 'function argument',
@@ -1162,7 +1361,6 @@ export class Parser {
             FillOuterFunctionCallBody: 'function argument',
             VariadicOuterFunctionCallBody: 'function argument',
             RollupFunctionCallBody: 'function argument',
-            CaseFunctionCallBody: 'function argument',
             InValue: 'argument value',
             InFieldValue: 'filter value',
             IndexExpr: 'namespace index',
@@ -1347,6 +1545,20 @@ export class Parser {
         }
         return false;
     }
+    firstErrorFrom(node) {
+        let first = null;
+        const visit = (current) => {
+            let child = current.firstChild;
+            while (child) {
+                if (child.type.isError && (first === null || child.from < first))
+                    first = child.from;
+                visit(child);
+                child = child.nextSibling;
+            }
+        };
+        visit(node);
+        return first;
+    }
     looksLikeProjectionAfterMissingColon(node) {
         const querySource = node.getChild('QuerySource');
         return Boolean(querySource && this.containsError(querySource) && !this.containsNode(querySource, 'DColon'));
@@ -2294,7 +2506,10 @@ export class Parser {
         if (!node.type.isError && !this.containsError(node)) {
             switch (node.name) {
                 case 'Query':
+                case 'QueryFragment':
                     this.checkDuplicateQueryClauses(node);
+                    this.checkQueryShiftPlacement(node);
+                    this.checkExpressionShiftOffsets(node);
                     break;
                 case 'ShowExpr':
                     this.checkDuplicateShowClauses(node);
@@ -2303,6 +2518,19 @@ export class Parser {
                 case 'TimeRange':
                     this.checkTimeRangeShape(node);
                     break;
+                case 'ShiftClause':
+                    this.checkShiftDuration(node);
+                    break;
+                case 'ShiftExpr':
+                    this.checkShiftDuration(node);
+                    this.checkShiftExpression(node);
+                    break;
+                case 'EvalExpr':
+                    this.checkEvalReferences(node);
+                    break;
+                case 'EvalFieldReference':
+                    this.checkEvalFieldReferenceContext(node);
+                    break;
                 case 'RollupIdentifier':
                     this.checkBareRollup(node);
                     break;
@@ -2310,7 +2538,10 @@ export class Parser {
                     this.checkRollupFunctionCall(node);
                     break;
                 case 'FunctionCall':
+                case 'EvalFunctionCall':
                     this.checkFunctionCall(node);
+                    if (node.name === 'FunctionCall')
+                        this.checkCaseFunction(node);
                     break;
                 case 'OuterFunctionCall':
                     this.checkOuterFunctionCall(node);
@@ -2330,9 +2561,6 @@ export class Parser {
                 case 'FieldName':
                     this.checkFieldName(node);
                     break;
-                case 'CaseFunctionIdentifier':
-                    this.checkCaseFunction(node);
-                    break;
                 case 'CaseExpr':
                     this.checkCaseResults(node);
                     break;
@@ -2348,7 +2576,7 @@ export class Parser {
         const seen = new Set();
         let child = query.firstChild;
         while (child) {
-            if (child.name === 'QueryClause') {
+            if (child.name === 'QueryClause' || child.name === 'QueryFragmentClause') {
                 const clause = child.firstChild;
                 if (clause) {
                     const label = queryClauseLabels.get(clause.name);
@@ -2365,6 +2593,168 @@ export class Parser {
             child = child.nextSibling;
         }
     }
+    checkQueryShiftPlacement(query) {
+        var _a;
+        const clauses = [];
+        let child = query.firstChild;
+        while (child) {
+            if (child.name === 'QueryClause' || child.name === 'QueryFragmentClause') {
+                const clause = child.firstChild;
+                if (clause)
+                    clauses.push(clause);
+            }
+            child = child.nextSibling;
+        }
+        const shifts = clauses.filter((clause) => clause.name === 'ShiftClause');
+        const timeRanges = clauses.filter((clause) => clause.name === 'TimeClause');
+        if (shifts.length !== 1 || timeRanges.length > 1)
+            return;
+        const shift = shifts[0];
+        const shiftIndex = clauses.indexOf(shift);
+        const laterTarget = clauses.slice(shiftIndex + 1).find((clause) => clause.name === 'TargetClause');
+        if (laterTarget) {
+            this.pushSemanticDiagnostic(shift, '"SHIFT" must appear after the projection', `shift-placement:${shift.from}`);
+            return;
+        }
+        const laterFilter = clauses.slice(shiftIndex + 1).find((clause) => clause.name === 'FilterClause');
+        if (laterFilter) {
+            this.pushSemanticDiagnostic(shift, '"SHIFT" must appear after "WHERE"', `shift-placement:${shift.from}`);
+            return;
+        }
+        if (timeRanges.length === 1) {
+            const timeIndex = clauses.indexOf(timeRanges[0]);
+            if (shiftIndex !== timeIndex + 1) {
+                this.pushSemanticDiagnostic(shift, '"SHIFT" must immediately follow the time range', `shift-placement:${shift.from}`);
+            }
+            return;
+        }
+        const outputClause = clauses
+            .slice(0, shiftIndex)
+            .reverse()
+            .find((clause) => ['ByClause', 'HavingClause', 'OrderClause', 'SOrderClause', 'LimitClause', 'OffsetClause', 'SLimitClause', 'SOffsetClause'].includes(clause.name));
+        if (outputClause) {
+            const label = (_a = queryClauseLabels.get(outputClause.name)) !== null && _a !== void 0 ? _a : outputClause.name;
+            this.pushSemanticDiagnostic(shift, `"SHIFT" must appear before "${label}"`, `shift-placement:${shift.from}`);
+        }
+    }
+    checkExpressionShiftOffsets(query) {
+        const offsets = new Set();
+        let overflowReported = false;
+        const visit = (node) => {
+            if (overflowReported || Date.now() >= this.deadline)
+                return;
+            if (node !== query && node.name === 'Query')
+                return;
+            if (node.name === 'ShiftExpr') {
+                const duration = node.getChild('Duration');
+                if (duration) {
+                    const rawOffset = this.nodeText(duration).toLowerCase();
+                    const milliseconds = this.fixedDurationMilliseconds(rawOffset);
+                    const offset = milliseconds !== null && Number.isSafeInteger(milliseconds) ? `${milliseconds}ms` : rawOffset;
+                    if (!offsets.has(offset)) {
+                        offsets.add(offset);
+                        if (offsets.size > 16) {
+                            this.pushSemanticDiagnostic(duration, 'a SELECT can use at most 16 distinct SHIFT offsets', `shift-offsets:${query.from}`);
+                            overflowReported = true;
+                            return;
+                        }
+                    }
+                }
+            }
+            let child = node.firstChild;
+            while (child) {
+                visit(child);
+                child = child.nextSibling;
+            }
+        };
+        visit(query);
+    }
+    checkShiftDuration(shift) {
+        const duration = shift.getChild('Duration');
+        if (!duration || this.isPositiveFixedDuration(this.nodeText(duration)))
+            return;
+        this.pushSemanticDiagnostic(duration, 'SHIFT duration must be a positive fixed duration', `shift-duration:${shift.from}`);
+    }
+    checkShiftExpression(shift) {
+        var _a, _b;
+        const nested = this.findAncestor(shift.parent, 'ShiftExpr');
+        if (nested) {
+            this.pushSemanticDiagnostic(shift, 'SHIFT expressions cannot be nested', `shift-nested:${shift.from}`);
+            return;
+        }
+        if (!this.findAncestor(shift.parent, 'TargetClause') && !this.findAncestor(shift.parent, 'ProjectionFragment')) {
+            this.pushSemanticDiagnostic(shift, 'expression-level SHIFT is only allowed in the projection', `shift-context:${shift.from}`);
+            return;
+        }
+        const operand = shift.getChild('ShiftOperand');
+        if (!operand)
+            return;
+        const calls = this.shiftOperandFunctionCalls(operand);
+        const unstable = calls.find((call) => {
+            const name = this.functionCallName(call);
+            return name !== null && unstableShiftAggregateFunctions.has(name);
+        });
+        if (unstable) {
+            const name = (_a = this.functionCallName(unstable)) !== null && _a !== void 0 ? _a : 'function';
+            const identifier = (_b = unstable.getChild('FunctionIdentifier')) !== null && _b !== void 0 ? _b : unstable;
+            this.pushSemanticDiagnostic(identifier, `function "${name}" cannot be used as a SHIFT operand`, `shift-operand:${shift.from}`);
+            return;
+        }
+        const hasStableAggregate = calls.some((call) => {
+            const name = this.functionCallName(call);
+            return name !== null && stableShiftAggregateFunctions.has(name);
+        });
+        if (!hasStableAggregate) {
+            this.pushSemanticDiagnostic(operand, 'SHIFT operand must be a stable aggregate or subquery measure', `shift-operand:${shift.from}`);
+        }
+    }
+    checkEvalFieldReferenceContext(reference) {
+        if (this.findAncestor(reference.parent, 'EvalExpr'))
+            return;
+        this.pushSemanticDiagnostic(reference, 'qualified field references are only supported inside eval', `eval-field-context:${reference.from}`);
+    }
+    checkEvalReferences(evalExpr) {
+        const body = evalExpr.getChild('EvalCallBody');
+        if (!body)
+            return;
+        const aliases = new Set();
+        for (const argument of this.directChildren(body, 'OuterArgItem')) {
+            const identifier = argument.getChild('Identifier');
+            if (!identifier || !argument.getChild('EqlSingle'))
+                continue;
+            if (!argument.getChild('Query') && !argument.getChild('OuterFunctionCall'))
+                continue;
+            const name = this.nodeText(identifier).toLowerCase();
+            if (aliases.has(name)) {
+                this.pushSemanticDiagnostic(identifier, `duplicate eval subquery "${name}"`, `eval-alias-duplicate:${identifier.from}`);
+                continue;
+            }
+            aliases.add(name);
+        }
+        const expression = body.getChild('EvalArgItem');
+        if (!expression)
+            return;
+        for (const reference of this.descendantsNamed(expression, 'EvalFieldReference')) {
+            const alias = reference.getChild('Identifier');
+            if (!alias)
+                continue;
+            const name = this.nodeText(alias).toLowerCase();
+            if (!aliases.has(name)) {
+                this.pushSemanticDiagnostic(alias, `unknown eval subquery "${name}" in field reference`, `eval-field:${reference.from}`);
+            }
+        }
+        if (aliases.size > 1) {
+            for (const atom of this.descendantsNamed(expression, 'EvalAtom')) {
+                const identifier = atom.getChild('Identifier');
+                if (!identifier)
+                    continue;
+                const name = this.nodeText(identifier).toLowerCase();
+                if (!aliases.has(name)) {
+                    this.pushSemanticDiagnostic(identifier, `unknown eval subquery "${name}" in expression`, `eval-alias:${identifier.from}`);
+                }
+            }
+        }
+    }
     checkDuplicateShowClauses(show) {
         const seen = new Set();
         let child = show.firstChild;
@@ -2480,12 +2870,44 @@ export class Parser {
         }
     }
     checkFunctionCall(call) {
+        var _a;
         const identifier = call.getChild('FunctionIdentifier');
-        const body = call.getChild('FunctionCallBody');
+        const body = (_a = call.getChild('FunctionCallBody')) !== null && _a !== void 0 ? _a : call.getChild('EvalFunctionCallBody');
         if (!identifier || !body)
             return;
         const name = this.nodeText(identifier).toLowerCase();
-        const args = this.directChildren(body, 'ArgItem');
+        const argumentName = body.name === 'EvalFunctionCallBody' ? 'EvalFunctionArg' : 'ArgItem';
+        const args = this.directChildren(body, argumentName);
+        const arity = documentedFunctionArities.get(name);
+        if (arity && (args.length < arity.min || args.length > arity.max)) {
+            this.pushSemanticDiagnostic(body, this.functionArityMessage(name, arity), `function-arity:${call.from}`);
+            return;
+        }
+        if ((name === 'count_filter' || name === 'distinct_by_collapse') && args.length === 2 && !args[1].getChild('InValue')) {
+            this.pushSemanticDiagnostic(args[1], `function "${name}" expects a value list as its second argument`, `function:${call.from}`);
+            return;
+        }
+        if (name === 'histogram_quantile' && args.length === 2) {
+            const quantile = this.numericValue(args[1]);
+            if (quantile === null || quantile < 0 || quantile > 1) {
+                this.pushSemanticDiagnostic(args[1], 'function "histogram_quantile" expects a quantile in range [0, 1]', `function:${call.from}`);
+                return;
+            }
+        }
+        if (name === 'drain' && args.length >= 2) {
+            const threshold = this.numericValue(args[1]);
+            if (threshold === null || threshold <= 0 || threshold > 1) {
+                this.pushSemanticDiagnostic(args[1], 'function "drain" expects a similarity threshold in range (0, 1]', `function:${call.from}`);
+                return;
+            }
+            if (args.length === 3) {
+                const maxClusters = this.numericValue(args[2]);
+                if (maxClusters === null || !Number.isInteger(maxClusters) || maxClusters < 1 || maxClusters > 10000) {
+                    this.pushSemanticDiagnostic(args[2], 'function "drain" expects max_clusters to be an integer in range [1, 10000]', `function:${call.from}`);
+                    return;
+                }
+            }
+        }
         if (name === 'ewma') {
             const alpha = args.length === 2 ? this.numericValue(args[1]) : null;
             if (alpha === null || alpha <= 0 || alpha > 1) {
@@ -2514,6 +2936,17 @@ export class Parser {
             this.pushSemanticDiagnostic(body, `function "${name}" expects exactly one input field`, `function:${call.from}`);
         }
     }
+    functionArityMessage(name, arity) {
+        if (arity.min === arity.max) {
+            if (arity.min === 0)
+                return `function "${name}" does not accept arguments`;
+            return `function "${name}" expects exactly ${arity.min} ${arity.min === 1 ? 'argument' : 'arguments'}`;
+        }
+        if (!Number.isFinite(arity.max)) {
+            return `function "${name}" expects at least ${arity.min} ${arity.min === 1 ? 'argument' : 'arguments'}`;
+        }
+        return `function "${name}" expects between ${arity.min} and ${arity.max} arguments`;
+    }
     checkOuterFunctionCall(call) {
         const identifier = call.firstChild;
         if (!identifier || identifier.name === 'FunctionIdentifier')
@@ -2612,10 +3045,36 @@ export class Parser {
             this.pushSemanticDiagnostic(field, 'field names containing "-" must be enclosed in backticks', `field-name:${field.from}`);
         }
     }
-    checkCaseFunction(identifier) {
-        if (this.nodeText(identifier).toLowerCase() === 'substr') {
-            this.pushSemanticDiagnostic(identifier, 'function "substr" is not supported inside CASE', `case-function:${identifier.from}`);
-        }
+    checkCaseFunction(call) {
+        const caseExpr = this.findAncestor(call.parent, 'CaseExpr');
+        if (!caseExpr)
+            return;
+        const shiftExpr = this.findAncestor(call.parent, 'ShiftExpr');
+        if (shiftExpr && shiftExpr.from >= caseExpr.from && shiftExpr.to <= caseExpr.to)
+            return;
+        const identifier = call.getChild('FunctionIdentifier');
+        const body = call.getChild('FunctionCallBody');
+        if (!identifier || !body)
+            return;
+        const name = this.nodeText(identifier).toLowerCase();
+        const args = this.directChildren(body, 'ArgItem');
+        const arity = documentedFunctionArities.get(name);
+        if (arity && (args.length < arity.min || args.length > arity.max))
+            return;
+        if (caseScalarFunctions.has(name))
+            return;
+        if (stableShiftAggregateFunctions.has(name) && this.caseContainsShift(caseExpr))
+            return;
+        this.pushSemanticDiagnostic(identifier, `function "${name}" is not supported inside CASE`, `case-function:${identifier.from}`);
+    }
+    caseContainsShift(caseExpr) {
+        const key = this.nodeRangeKey(caseExpr);
+        const cached = this.caseShiftPresence.get(key);
+        if (cached !== undefined)
+            return cached;
+        const containsShift = this.containsNode(caseExpr, 'ShiftExpr');
+        this.caseShiftPresence.set(key, containsShift);
+        return containsShift;
     }
     checkCaseResults(caseExpr) {
         let clause = caseExpr.firstChild;
@@ -2642,6 +3101,10 @@ export class Parser {
         const hasFrom = /\bfrom\s*=/.test(bodyText.toLowerCase());
         const filter = show.getChild('FilterClause');
         const hasSourceFilter = Boolean(filter && /@__source__/.test(this.maskStringsAndLineComments(this.nodeText(filter))));
+        if (/^show_[a-z0-9]+_index$/.test(name)) {
+            this.pushSemanticDiagnostic(identifier, `"${name}" is not supported by the DQL parser`, `show:${show.from}:unsupported`);
+            return;
+        }
         if ((name === 'show_tag_value' || name === 'show_tag_value_cardinality' || name === 'show_series_count_by_tag_value') && !hasKeyin) {
             this.pushSemanticDiagnostic(identifier, `"${name}" requires the named argument "keyin"`, `show:${show.from}:keyin`);
         }
@@ -2667,13 +3130,105 @@ export class Parser {
         }
         return children;
     }
+    descendantsNamed(node, name) {
+        const descendants = [];
+        const visit = (current) => {
+            let child = current.firstChild;
+            while (child) {
+                if (child.name === name)
+                    descendants.push(child);
+                visit(child);
+                child = child.nextSibling;
+            }
+        };
+        visit(node);
+        return descendants;
+    }
+    shiftOperandFunctionCalls(operand) {
+        const querySource = operand.getChild('QuerySource');
+        if (!querySource)
+            return this.descendantsNamed(operand, 'FunctionCall');
+        const query = querySource.getChild('Query');
+        if (!query)
+            return [];
+        const calls = [];
+        let clause = query.firstChild;
+        while (clause) {
+            if (clause.name === 'QueryClause') {
+                const target = clause.getChild('TargetClause');
+                if (target)
+                    calls.push(...this.descendantsNamed(target, 'FunctionCall'));
+            }
+            clause = clause.nextSibling;
+        }
+        return calls;
+    }
+    errorDescendantsWithText(node, text) {
+        const errors = [];
+        const expected = text.toLowerCase();
+        const visit = (current) => {
+            let child = current.firstChild;
+            while (child) {
+                if (child.type.isError && this.nodeText(child).toLowerCase() === expected)
+                    errors.push(child);
+                visit(child);
+                child = child.nextSibling;
+            }
+        };
+        visit(node);
+        return errors;
+    }
+    functionCallName(call) {
+        const identifier = call.getChild('FunctionIdentifier');
+        return identifier ? this.nodeText(identifier).toLowerCase() : null;
+    }
+    isPositiveFixedDuration(text) {
+        const milliseconds = this.fixedDurationMilliseconds(text);
+        return milliseconds !== null && milliseconds > 0;
+    }
+    fixedDurationMilliseconds(text) {
+        const multipliers = {
+            y: 365 * 24 * 60 * 60 * 1000,
+            w: 7 * 24 * 60 * 60 * 1000,
+            d: 24 * 60 * 60 * 1000,
+            h: 60 * 60 * 1000,
+            m: 60 * 1000,
+            s: 1000,
+            ms: 1,
+        };
+        const normalized = text.toLowerCase();
+        const pattern = /(\d+)(ms|[ywdhms])/g;
+        let total = 0;
+        let consumed = 0;
+        let part = pattern.exec(normalized);
+        while (part) {
+            if (part.index !== consumed)
+                return null;
+            const amount = Number(part[1]);
+            const component = amount * multipliers[part[2]];
+            if (!Number.isSafeInteger(amount) || !Number.isSafeInteger(component) || !Number.isSafeInteger(total + component))
+                return null;
+            total += component;
+            consumed = pattern.lastIndex;
+            part = pattern.exec(normalized);
+        }
+        return consumed === normalized.length ? total : null;
+    }
     numericValue(node) {
         if (!node)
             return null;
-        const number = node.name === 'Number' ? node : node.getChild('Number');
+        let valueNode = node;
+        if (node.name === 'EvalFunctionArg') {
+            const expression = node.getChild('EvalExpression');
+            const atom = expression === null || expression === void 0 ? void 0 : expression.firstChild;
+            if (!expression || (atom === null || atom === void 0 ? void 0 : atom.name) !== 'EvalAtom' || atom.nextSibling)
+                return null;
+            valueNode = atom;
+        }
+        const number = valueNode.name === 'Number' ? valueNode : valueNode.getChild('Number');
         if (!number)
             return null;
-        const sign = node.name !== 'Number' && node.getChild('Sub') ? -1 : 1;
+        const sign = valueNode.name !== 'Number' && valueNode.getChild('Sub') ? -1 : 1;
         const value = sign * Number(this.nodeText(number).replace(/_/g, ''));
         return Number.isFinite(value) ? value : null;
     }