@kernhq/module-tracker 0.1.0

package/dist/kql/lexer.js

@@ -0,0 +1,127 @@
+/** Two-character operators are matched before single-character ones. */
+const OPS2 = ['!=', '<=', '>=', '!~'];
+const OPS1 = ['=', '<', '>', '~'];
+const DATE_RE = /^\d{4}-\d{2}-\d{2}(?:[T ]\d{2}:\d{2}(?::\d{2})?(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?)?/;
+const RELDATE_RE = /^[+-]?\d+(?:\.\d+)?[hdwmy](?![\w.])/;
+const NUMBER_RE = /^[+-]?\d+(?:\.\d+)?/;
+/** Barewords may contain dots (`cf.severity`) and dashes (`KRN-12`), but must start with a letter. */
+const IDENT_RE = /^[A-Za-z_][A-Za-z0-9_.]*(?:-[A-Za-z0-9_.]+)*/;
+const isDigit = (c) => c >= '0' && c <= '9';
+const isIdentStart = (c) => /[A-Za-z_]/.test(c);
+/**
+ * Turn KQL source into a flat token list. The lexer never throws: anything it cannot read becomes an
+ * error with a span, and lexing continues at the next character so the parser can still report
+ * everything it understood.
+ */
+export function tokenize(input) {
+    const tokens = [];
+    const errors = [];
+    let i = 0;
+    const push = (t) => {
+        tokens.push(t);
+    };
+    while (i < input.length) {
+        const c = input[i];
+        if (/\s/.test(c)) {
+            i++;
+            continue;
+        }
+        const start = i;
+        if (c === '(') {
+            push({ kind: 'lparen', text: c, start, end: ++i });
+            continue;
+        }
+        if (c === ')') {
+            push({ kind: 'rparen', text: c, start, end: ++i });
+            continue;
+        }
+        if (c === ',') {
+            push({ kind: 'comma', text: c, start, end: ++i });
+            continue;
+        }
+        const two = input.slice(i, i + 2);
+        if (OPS2.includes(two)) {
+            i += 2;
+            push({ kind: 'op', text: two, start, end: i });
+            continue;
+        }
+        if (OPS1.includes(c)) {
+            i += 1;
+            push({ kind: 'op', text: c, start, end: i });
+            continue;
+        }
+        if (c === '!') {
+            // a lone `!` is only meaningful in `!=` / `!~`
+            errors.push({ message: 'Expected "!=" or "!~"', start, end: start + 1 });
+            i++;
+            continue;
+        }
+        if (c === '"' || c === "'") {
+            const quote = c;
+            let j = i + 1;
+            let out = '';
+            let closed = false;
+            while (j < input.length) {
+                const ch = input[j];
+                if (ch === '\\' && j + 1 < input.length) {
+                    const esc = input[j + 1];
+                    out += esc === 'n' ? '\n' : esc === 't' ? '\t' : esc;
+                    j += 2;
+                    continue;
+                }
+                if (ch === quote) {
+                    closed = true;
+                    j++;
+                    break;
+                }
+                out += ch;
+                j++;
+            }
+            if (!closed)
+                errors.push({ message: 'Unterminated string', start, end: j });
+            push({ kind: 'string', text: input.slice(start, j), value: out, start, end: j });
+            i = j;
+            continue;
+        }
+        if (isDigit(c) || ((c === '-' || c === '+') && isDigit(input[i + 1] ?? ''))) {
+            const rest = input.slice(i);
+            const dateM = DATE_RE.exec(rest);
+            if (dateM) {
+                i += dateM[0].length;
+                push({ kind: 'date', text: dateM[0], value: dateM[0], start, end: i });
+                continue;
+            }
+            const relM = RELDATE_RE.exec(rest);
+            if (relM) {
+                const raw = relM[0];
+                i += raw.length;
+                push({
+                    kind: 'reldate',
+                    text: raw,
+                    amount: Number(raw.slice(0, -1)),
+                    unit: raw.slice(-1),
+                    start,
+                    end: i,
+                });
+                continue;
+            }
+            const numM = NUMBER_RE.exec(rest);
+            if (numM) {
+                i += numM[0].length;
+                push({ kind: 'number', text: numM[0], value: Number(numM[0]), start, end: i });
+                continue;
+            }
+        }
+        if (isIdentStart(c)) {
+            const m = IDENT_RE.exec(input.slice(i));
+            i += m[0].length;
+            push({ kind: 'ident', text: m[0], value: m[0], start, end: i });
+            continue;
+        }
+        errors.push({ message: `Unexpected character "${c}"`, start, end: start + 1 });
+        i++;
+    }
+    push({ kind: 'eof', text: '', start: input.length, end: input.length });
+    return { tokens, errors };
+}
+//# sourceMappingURL=lexer.js.map

package/dist/kql/lexer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lexer.js","sourceRoot":"","sources":["../../src/kql/lexer.ts"],"names":[],"mappings":"AAoCA,wEAAwE;AACxE,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAU,CAAA;AAC9C,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAU,CAAA;AAE1C,MAAM,OAAO,GAAG,oFAAoF,CAAA;AACpG,MAAM,UAAU,GAAG,qCAAqC,CAAA;AACxD,MAAM,SAAS,GAAG,qBAAqB,CAAA;AACvC,sGAAsG;AACtG,MAAM,QAAQ,GAAG,8CAA8C,CAAA;AAE/D,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,CAAA;AACnD,MAAM,YAAY,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AAEvD;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,MAAM,GAAY,EAAE,CAAA;IAC1B,MAAM,MAAM,GAAe,EAAE,CAAA;IAC7B,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,MAAM,IAAI,GAAG,CAAC,CAAQ,EAAE,EAAE;QACxB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAChB,CAAC,CAAA;IAED,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACnB,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjB,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,CAAA;QAEf,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;YAClD,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;YAClD,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;YACjD,SAAQ;QACV,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QACjC,IAAK,IAA0B,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,CAAC,IAAI,CAAC,CAAA;YACN,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAC9C,SAAQ;QACV,CAAC;QACD,IAAK,IAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,CAAC,IAAI,CAAC,CAAA;YACN,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAC5C,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,+CAA+C;YAC/C,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;YACxE,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,CAAC,CAAA;YACf,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACb,IAAI,GAAG,GAAG,EAAE,CAAA;YACZ,IAAI,MAAM,GAAG,KAAK,CAAA;YAClB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;gBACpB,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBACxC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAA;oBACzB,GAAG,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA;oBACpD,CAAC,IAAI,CAAC,CAAA;oBACN,SAAQ;gBACV,CAAC;gBACD,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;oBACjB,MAAM,GAAG,IAAI,CAAA;oBACb,CAAC,EAAE,CAAA;oBACH,MAAK;gBACP,CAAC;gBACD,GAAG,IAAI,EAAE,CAAA;gBACT,CAAC,EAAE,CAAA;YACL,CAAC;YACD,IAAI,CAAC,MAAM;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAC3E,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAChF,CAAC,GAAG,CAAC,CAAA;YACL,SAAQ;QACV,CAAC;QAED,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAChC,IAAI,KAAK,EAAE,CAAC;gBACV,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;gBACpB,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;gBACtE,SAAQ;YACV,CAAC;YACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAClC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;gBACnB,CAAC,IAAI,GAAG,CAAC,MAAM,CAAA;gBACf,IAAI,CAAC;oBACH,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,GAAG;oBACT,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;oBAChC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAkB;oBACpC,KAAK;oBACL,GAAG,EAAE,CAAC;iBACP,CAAC,CAAA;gBACF,SAAQ;YACV,CAAC;YACD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACjC,IAAI,IAAI,EAAE,CAAC;gBACT,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnB,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;gBAC9E,SAAQ;YACV,CAAC;QACH,CAAC;QAED,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,CAAA;YACxC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;YAChB,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAC/D,SAAQ;QACV,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,yBAAyB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;QAC9E,CAAC,EAAE,CAAA;IACL,CAAC;IAED,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IACvE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AAC3B,CAAC"}

package/dist/kql/parser.d.ts

@@ -0,0 +1,14 @@
+import type { KqlQuery } from './ast.js';
+export interface ParseError {
+    message: string;
+    start: number;
+    end: number;
+}
+export interface ParseResult {
+    ok: boolean;
+    query: KqlQuery | null;
+    errors: ParseError[];
+}
+/** Parse a KQL string. Never throws: syntax problems come back as spans in `errors`. */
+export declare function parseKql(input: string): ParseResult;
+//# sourceMappingURL=parser.d.ts.map

package/dist/kql/parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/kql/parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA2C,QAAQ,EAAkB,MAAM,UAAU,CAAA;AAGjG,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,QAAQ,GAAG,IAAI,CAAA;IACtB,MAAM,EAAE,UAAU,EAAE,CAAA;CACrB;AA+QD,wFAAwF;AACxF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAcnD"}

package/dist/kql/parser.js

@@ -0,0 +1,290 @@
+import { tokenize } from './lexer.js';
+const KEYWORDS = new Set([
+    'and',
+    'or',
+    'not',
+    'in',
+    'is',
+    'empty',
+    'order',
+    'by',
+    'asc',
+    'desc',
+    'true',
+    'false',
+    'null',
+]);
+const COMPARE_OPS = {
+    '=': '=',
+    '!=': '!=',
+    '<': '<',
+    '<=': '<=',
+    '>': '>',
+    '>=': '>=',
+    '~': '~',
+    '!~': '!~',
+};
+class ParseFailure extends Error {
+    span;
+    constructor(message, span) {
+        super(message);
+        this.span = span;
+    }
+}
+/**
+ * Recursive-descent parser for KQL.
+ *
+ * ```ebnf
+ * query      = [ expr ] [ order-clause ] ;
+ * expr       = or-expr ;
+ * or-expr    = and-expr { "or" and-expr } ;
+ * and-expr   = unary { "and" unary } ;
+ * unary      = "not" unary | "(" expr ")" | comparison ;
+ * comparison = field ( op value
+ *                    | "in" "(" value { "," value } ")"
+ *                    | "not" "in" "(" value { "," value } ")"
+ *                    | "is" [ "not" ] "empty" ) ;
+ * op         = "=" | "!=" | "<" | "<=" | ">" | ">=" | "~" | "!~" ;
+ * value      = string | number | date | reldate | "true" | "false" | "null" | ident | function ;
+ * function   = ident "(" [ value { "," value } ] ")" ;
+ * order-clause = "order" "by" order-item { "," order-item } ;
+ * order-item = field [ "asc" | "desc" ] ;
+ * ```
+ */
+class Parser {
+    tokens;
+    pos = 0;
+    constructor(tokens) {
+        this.tokens = tokens;
+    }
+    peek(offset = 0) {
+        return this.tokens[Math.min(this.pos + offset, this.tokens.length - 1)];
+    }
+    next() {
+        const t = this.peek();
+        if (t.kind !== 'eof')
+            this.pos++;
+        return t;
+    }
+    atKeyword(word, offset = 0) {
+        const t = this.peek(offset);
+        return t.kind === 'ident' && t.text.toLowerCase() === word;
+    }
+    eatKeyword(word) {
+        if (!this.atKeyword(word))
+            return false;
+        this.pos++;
+        return true;
+    }
+    expectKeyword(word) {
+        const t = this.peek();
+        if (!this.eatKeyword(word))
+            throw new ParseFailure(`Expected "${word}"`, span(t));
+        return t;
+    }
+    expect(kind, label) {
+        const t = this.peek();
+        if (t.kind !== kind)
+            throw new ParseFailure(`Expected ${label}`, span(t));
+        return this.next();
+    }
+    parse() {
+        let where = null;
+        if (this.peek().kind !== 'eof' && !this.atKeyword('order'))
+            where = this.parseOr();
+        const orderBy = this.parseOrderClause();
+        const trailing = this.peek();
+        if (trailing.kind !== 'eof')
+            throw new ParseFailure(`Unexpected "${trailing.text}"`, span(trailing));
+        return { where, orderBy };
+    }
+    parseOrderClause() {
+        if (!this.atKeyword('order'))
+            return [];
+        this.next();
+        this.expectKeyword('by');
+        const out = [];
+        for (;;) {
+            const field = this.peek();
+            if (field.kind !== 'ident' || KEYWORDS.has(field.text.toLowerCase()))
+                throw new ParseFailure('Expected a field name', span(field));
+            this.next();
+            let dir = 'asc';
+            let end = field.end;
+            if (this.atKeyword('asc') || this.atKeyword('desc')) {
+                const d = this.next();
+                dir = d.text.toLowerCase();
+                end = d.end;
+            }
+            out.push({ field: field.text, dir, span: { start: field.start, end } });
+            if (this.peek().kind === 'comma') {
+                this.next();
+                continue;
+            }
+            break;
+        }
+        return out;
+    }
+    parseOr() {
+        const first = this.parseAnd();
+        if (!this.atKeyword('or'))
+            return first;
+        const children = [first];
+        while (this.eatKeyword('or'))
+            children.push(this.parseAnd());
+        return { kind: 'or', children, span: joinSpans(children) };
+    }
+    parseAnd() {
+        const first = this.parseUnary();
+        if (!this.atKeyword('and'))
+            return first;
+        const children = [first];
+        while (this.eatKeyword('and'))
+            children.push(this.parseUnary());
+        return { kind: 'and', children, span: joinSpans(children) };
+    }
+    parseUnary() {
+        // `not` starts a negation only when it is not the `not in` of a comparison
+        if (this.atKeyword('not') && !this.atKeyword('in', 1)) {
+            const start = this.next().start;
+            const child = this.parseUnary();
+            return { kind: 'not', child, span: { start, end: child.span.end } };
+        }
+        if (this.peek().kind === 'lparen') {
+            this.next();
+            const inner = this.parseOr();
+            this.expect('rparen', '")"');
+            return inner;
+        }
+        return this.parseComparison();
+    }
+    parseComparison() {
+        const field = this.peek();
+        if (field.kind !== 'ident' || KEYWORDS.has(field.text.toLowerCase()))
+            throw new ParseFailure('Expected a field name', span(field));
+        this.next();
+        const t = this.peek();
+        if (t.kind === 'op') {
+            const op = COMPARE_OPS[t.text];
+            if (!op)
+                throw new ParseFailure(`Unknown operator "${t.text}"`, span(t));
+            this.next();
+            const value = this.parseValue();
+            return {
+                kind: 'cmp',
+                field: field.text,
+                op,
+                value,
+                values: null,
+                span: { start: field.start, end: value.span.end },
+            };
+        }
+        if (this.atKeyword('in') || (this.atKeyword('not') && this.atKeyword('in', 1))) {
+            const negated = this.eatKeyword('not');
+            this.expectKeyword('in');
+            this.expect('lparen', '"("');
+            const values = [];
+            if (this.peek().kind !== 'rparen') {
+                values.push(this.parseValue());
+                while (this.peek().kind === 'comma') {
+                    this.next();
+                    values.push(this.parseValue());
+                }
+            }
+            const close = this.expect('rparen', '")"');
+            return {
+                kind: 'cmp',
+                field: field.text,
+                op: negated ? 'not-in' : 'in',
+                value: null,
+                values,
+                span: { start: field.start, end: close.end },
+            };
+        }
+        if (this.atKeyword('is')) {
+            this.next();
+            const negated = this.eatKeyword('not');
+            const empty = this.expectKeyword('empty');
+            return {
+                kind: 'cmp',
+                field: field.text,
+                op: negated ? 'is-not-empty' : 'is-empty',
+                value: null,
+                values: null,
+                span: { start: field.start, end: empty.end },
+            };
+        }
+        throw new ParseFailure(`Expected an operator after "${field.text}"`, span(t));
+    }
+    parseValue() {
+        const t = this.peek();
+        switch (t.kind) {
+            case 'string':
+                this.next();
+                return { kind: 'string', value: String(t.value ?? ''), span: span(t) };
+            case 'number':
+                this.next();
+                return { kind: 'number', value: Number(t.value), span: span(t) };
+            case 'date':
+                this.next();
+                return { kind: 'date', value: String(t.value), span: span(t) };
+            case 'reldate':
+                this.next();
+                return { kind: 'reldate', amount: t.amount, unit: t.unit, span: span(t) };
+            case 'ident': {
+                const lower = t.text.toLowerCase();
+                if (lower === 'true' || lower === 'false') {
+                    this.next();
+                    return { kind: 'bool', value: lower === 'true', span: span(t) };
+                }
+                if (lower === 'null') {
+                    this.next();
+                    return { kind: 'null', span: span(t) };
+                }
+                if (KEYWORDS.has(lower))
+                    throw new ParseFailure(`Expected a value, got "${t.text}"`, span(t));
+                this.next();
+                if (this.peek().kind === 'lparen') {
+                    this.next();
+                    const args = [];
+                    if (this.peek().kind !== 'rparen') {
+                        args.push(this.parseValue());
+                        while (this.peek().kind === 'comma') {
+                            this.next();
+                            args.push(this.parseValue());
+                        }
+                    }
+                    const close = this.expect('rparen', '")"');
+                    return { kind: 'func', name: t.text, args, span: { start: t.start, end: close.end } };
+                }
+                return { kind: 'ident', value: t.text, span: span(t) };
+            }
+            default:
+                throw new ParseFailure('Expected a value', span(t));
+        }
+    }
+}
+const span = (t) => ({ start: t.start, end: t.end });
+const joinSpans = (nodes) => ({
+    start: nodes[0]?.span.start ?? 0,
+    end: nodes.at(-1)?.span.end ?? 0,
+});
+/** Parse a KQL string. Never throws: syntax problems come back as spans in `errors`. */
+export function parseKql(input) {
+    const { tokens, errors: lexErrors } = tokenize(input);
+    const errors = [...lexErrors];
+    if (!input.trim())
+        return { ok: errors.length === 0, query: { where: null, orderBy: [] }, errors };
+    try {
+        const query = new Parser(tokens).parse();
+        return { ok: errors.length === 0, query, errors };
+    }
+    catch (err) {
+        if (err instanceof ParseFailure) {
+            errors.push({ message: err.message, start: err.span.start, end: err.span.end });
+            return { ok: false, query: null, errors };
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=parser.js.map

package/dist/kql/parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../../src/kql/parser.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,QAAQ,EAAE,MAAM,YAAY,CAAA;AAcjD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,KAAK;IACL,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,OAAO;IACP,IAAI;IACJ,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;CACP,CAAC,CAAA;AAEF,MAAM,WAAW,GAA0B;IACzC,GAAG,EAAE,GAAG;IACR,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,GAAG;IACR,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,GAAG;IACR,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,GAAG;IACR,IAAI,EAAE,IAAI;CACX,CAAA;AAED,MAAM,YAAa,SAAQ,KAAK;IAGnB;IAFX,YACE,OAAe,EACN,IAAU;QAEnB,KAAK,CAAC,OAAO,CAAC,CAAA;QAFL,SAAI,GAAJ,IAAI,CAAM;IAGrB,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM;IAEmB;IADrB,GAAG,GAAG,CAAC,CAAA;IACf,YAA6B,MAAe;QAAf,WAAM,GAAN,MAAM,CAAS;IAAG,CAAC;IAExC,IAAI,CAAC,MAAM,GAAG,CAAC;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAE,CAAA;IAC1E,CAAC;IACO,IAAI;QACV,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACrB,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;YAAE,IAAI,CAAC,GAAG,EAAE,CAAA;QAChC,OAAO,CAAC,CAAA;IACV,CAAC;IACO,SAAS,CAAC,IAAY,EAAE,MAAM,GAAG,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC3B,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAA;IAC5D,CAAC;IACO,UAAU,CAAC,IAAY;QAC7B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACvC,IAAI,CAAC,GAAG,EAAE,CAAA;QACV,OAAO,IAAI,CAAA;IACb,CAAC;IACO,aAAa,CAAC,IAAY;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,aAAa,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACjF,OAAO,CAAC,CAAA;IACV,CAAC;IACO,MAAM,CAAC,IAAmB,EAAE,KAAa;QAC/C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACrB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,YAAY,CAAC,YAAY,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACzE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAA;IACpB,CAAC;IAED,KAAK;QACH,IAAI,KAAK,GAAmB,IAAI,CAAA;QAChC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QAClF,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAA;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC5B,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK;YAAE,MAAM,IAAI,YAAY,CAAC,eAAe,QAAQ,CAAC,IAAI,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;QACpG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IAC3B,CAAC;IAEO,gBAAgB;QACtB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAA;QACvC,IAAI,CAAC,IAAI,EAAE,CAAA;QACX,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QACxB,MAAM,GAAG,GAAe,EAAE,CAAA;QAC1B,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;YACzB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClE,MAAM,IAAI,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YAC9D,IAAI,CAAC,IAAI,EAAE,CAAA;YACX,IAAI,GAAG,GAAmB,KAAK,CAAA;YAC/B,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;YACnB,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;gBACrB,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAoB,CAAA;gBAC5C,GAAG,GAAG,CAAC,CAAC,GAAG,CAAA;YACb,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;YACvE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACjC,IAAI,CAAC,IAAI,EAAE,CAAA;gBACX,SAAQ;YACV,CAAC;YACD,MAAK;QACP,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAEO,OAAO;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QAC7B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACvC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAA;QACxB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC5D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAA;IAC5D,CAAC;IAEO,QAAQ;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;QAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QACxC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAA;QACxB,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;QAC/D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAA;IAC7D,CAAC;IAEO,UAAU;QAChB,2EAA2E;QAC3E,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;YAC/B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;QACrE,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,EAAE,CAAA;YACX,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;YAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;YAC5B,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,EAAE,CAAA;IAC/B,CAAC;IAEO,eAAe;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACzB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAClE,MAAM,IAAI,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;QAC9D,IAAI,CAAC,IAAI,EAAE,CAAA;QAEX,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACrB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YAC9B,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,YAAY,CAAC,qBAAqB,CAAC,CAAC,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YACxE,IAAI,CAAC,IAAI,EAAE,CAAA;YACX,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;YAC/B,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,EAAE;gBACF,KAAK;gBACL,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;aAClD,CAAA;QACH,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;YACtC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;YACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;YAC5B,MAAM,MAAM,GAAe,EAAE,CAAA;YAC7B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;gBAC9B,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACpC,IAAI,CAAC,IAAI,EAAE,CAAA;oBACX,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;gBAChC,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;YAC1C,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;gBAC7B,KAAK,EAAE,IAAI;gBACX,MAAM;gBACN,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE;aAC7C,CAAA;QACH,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,EAAE,CAAA;YACX,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;YACzC,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU;gBACzC,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE;aAC7C,CAAA;QACH,CAAC;QACD,MAAM,IAAI,YAAY,CAAC,+BAA+B,KAAK,CAAC,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/E,CAAC;IAEO,UAAU;QAChB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACrB,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,QAAQ;gBACX,IAAI,CAAC,IAAI,EAAE,CAAA;gBACX,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;YACxE,KAAK,QAAQ;gBACX,IAAI,CAAC,IAAI,EAAE,CAAA;gBACX,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;YAClE,KAAK,MAAM;gBACT,IAAI,CAAC,IAAI,EAAE,CAAA;gBACX,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;YAChE,KAAK,SAAS;gBACZ,IAAI,CAAC,IAAI,EAAE,CAAA;gBACX,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,MAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;YAC7E,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;gBAClC,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;oBAC1C,IAAI,CAAC,IAAI,EAAE,CAAA;oBACX,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;gBACjE,CAAC;gBACD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;oBACrB,IAAI,CAAC,IAAI,EAAE,CAAA;oBACX,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;gBACxC,CAAC;gBACD,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,YAAY,CAAC,0BAA0B,CAAC,CAAC,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC7F,IAAI,CAAC,IAAI,EAAE,CAAA;gBACX,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAClC,IAAI,CAAC,IAAI,EAAE,CAAA;oBACX,MAAM,IAAI,GAAe,EAAE,CAAA;oBAC3B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAClC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;wBAC5B,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;4BACpC,IAAI,CAAC,IAAI,EAAE,CAAA;4BACX,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;wBAC9B,CAAC;oBACH,CAAC;oBACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;oBAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,CAAA;gBACvF,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;YACxD,CAAC;YACD;gBACE,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACvD,CAAC;IACH,CAAC;CACF;AAED,MAAM,IAAI,GAAG,CAAC,CAAQ,EAAQ,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;AACjE,MAAM,SAAS,GAAG,CAAC,KAA4B,EAAQ,EAAE,CAAC,CAAC;IACzD,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC;IAChC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC;CACjC,CAAC,CAAA;AAEF,wFAAwF;AACxF,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACrD,MAAM,MAAM,GAAiB,CAAC,GAAG,SAAS,CAAC,CAAA;IAC3C,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAA;IAClG,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAA;QACxC,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;YAC/E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QAC3C,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC"}

package/dist/kql/suggest.d.ts

@@ -0,0 +1,8 @@
+import type { KqlSuggestion } from '../contract/models.js';
+import { type KqlField } from './fields.js';
+/**
+ * Autocomplete for a KQL editor. Looks only at the tokens before `cursor`, so it works on
+ * half-written queries the parser would reject.
+ */
+export declare function suggest(input: string, fields: readonly KqlField[], cursor?: number): KqlSuggestion[];
+//# sourceMappingURL=suggest.d.ts.map

package/dist/kql/suggest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suggest.d.ts","sourceRoot":"","sources":["../../src/kql/suggest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAA4B,KAAK,QAAQ,EAAgB,MAAM,aAAa,CAAA;AA+BnF;;;GAGG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,QAAQ,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,aAAa,EAAE,CAsDpG"}

package/dist/kql/suggest.js

@@ -0,0 +1,96 @@
+import { findField, KQL_FUNCTIONS, operatorsFor } from './fields.js';
+import { tokenize } from './lexer.js';
+const KEYWORD_TOKENS = new Set(['and', 'or', 'not', 'in', 'is', 'empty', 'order', 'by', 'asc', 'desc']);
+const fieldSuggestion = (f) => ({
+    kind: 'field',
+    label: f.name,
+    insertText: f.name,
+    detail: f.label,
+});
+const opSuggestion = (op) => ({ kind: 'operator', label: op, insertText: op });
+const valueSuggestions = (field) => {
+    const out = [];
+    for (const v of field.enumValues ?? [])
+        out.push({ kind: 'value', label: v, insertText: v });
+    if (field.kind === 'user')
+        out.push({ kind: 'function', label: 'currentUser()', insertText: 'currentUser()', detail: 'You' });
+    if (field.kind === 'date' || field.kind === 'datetime')
+        for (const f of KQL_FUNCTIONS)
+            if (['now', 'startOfDay', 'startOfWeek', 'startOfMonth'].includes(f.name))
+                out.push({ kind: 'function', label: `${f.name}()`, insertText: `${f.name}()`, detail: f.detail });
+    if (field.refType === 'cycle')
+        for (const name of ['activeCycle', 'openCycles'])
+            out.push({ kind: 'function', label: `${name}()`, insertText: `${name}()` });
+    if (field.kind === 'boolean')
+        for (const v of ['true', 'false'])
+            out.push({ kind: 'value', label: v, insertText: v });
+    return out;
+};
+/**
+ * Autocomplete for a KQL editor. Looks only at the tokens before `cursor`, so it works on
+ * half-written queries the parser would reject.
+ */
+export function suggest(input, fields, cursor) {
+    const at = cursor ?? input.length;
+    const head = input.slice(0, at);
+    const { tokens } = tokenize(head);
+    const real = tokens.filter((t) => t.kind !== 'eof');
+    const last = real.at(-1);
+    const prev = real.at(-2);
+    const matchFields = (prefix) => fields
+        .filter((f) => f.name.toLowerCase().startsWith(prefix.toLowerCase()))
+        .slice(0, 40)
+        .map(fieldSuggestion);
+    // nothing typed yet, or the query continues after a connective / open paren
+    const startsNewTerm = !last ||
+        last.kind === 'lparen' ||
+        (last.kind === 'ident' && ['and', 'or', 'not'].includes(last.text.toLowerCase()));
+    if (startsNewTerm)
+        return matchFields('');
+    // the caret sits inside a bareword
+    if (last.kind === 'ident' && last.end === at) {
+        const word = last.text.toLowerCase();
+        // after `field <op>` a bareword is a value, not a field
+        if (prev?.kind === 'op' || (prev?.kind === 'ident' && ['in', 'is'].includes(prev.text.toLowerCase()))) {
+            const fieldTok = fieldTokenBefore(real, real.length - 2);
+            const field = fieldTok ? findField(fields, fieldTok) : undefined;
+            return field ? valueSuggestions(field).filter((s) => s.label.toLowerCase().startsWith(word)) : [];
+        }
+        if (KEYWORD_TOKENS.has(word))
+            return matchFields('');
+        const exact = findField(fields, last.text);
+        if (exact)
+            return operatorsFor(exact).map(opSuggestion);
+        return matchFields(last.text);
+    }
+    // right after an operator → values of the field on its left
+    if (last.kind === 'op' || (last.kind === 'ident' && ['in', 'is'].includes(last.text.toLowerCase()))) {
+        const fieldTok = fieldTokenBefore(real, real.length - 2);
+        const field = fieldTok ? findField(fields, fieldTok) : undefined;
+        return field ? valueSuggestions(field) : [];
+    }
+    if (last.kind === 'lparen' || last.kind === 'comma') {
+        const fieldTok = fieldTokenBefore(real, real.length - 1);
+        const field = fieldTok ? findField(fields, fieldTok) : undefined;
+        return field ? valueSuggestions(field) : matchFields('');
+    }
+    // a complete term: offer connectives
+    return [
+        { kind: 'keyword', label: 'and', insertText: ' and ' },
+        { kind: 'keyword', label: 'or', insertText: ' or ' },
+        { kind: 'keyword', label: 'order by', insertText: ' order by ' },
+    ];
+}
+/** Walk left from `from` to the nearest bareword that is not a keyword — the field of this comparison. */
+function fieldTokenBefore(tokens, from) {
+    for (let i = from; i >= 0; i--) {
+        const t = tokens[i];
+        if (t?.kind !== 'ident')
+            continue;
+        if (KEYWORD_TOKENS.has(t.text.toLowerCase()))
+            continue;
+        return t.text;
+    }
+    return null;
+}
+//# sourceMappingURL=suggest.js.map

package/dist/kql/suggest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suggest.js","sourceRoot":"","sources":["../../src/kql/suggest.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAiB,YAAY,EAAE,MAAM,aAAa,CAAA;AACnF,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAErC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;AAEvG,MAAM,eAAe,GAAG,CAAC,CAAW,EAAiB,EAAE,CAAC,CAAC;IACvD,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,CAAC,CAAC,IAAI;IACb,UAAU,EAAE,CAAC,CAAC,IAAI;IAClB,MAAM,EAAE,CAAC,CAAC,KAAK;CAChB,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;AAErG,MAAM,gBAAgB,GAAG,CAAC,KAAe,EAAmB,EAAE;IAC5D,MAAM,GAAG,GAAoB,EAAE,CAAA;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,EAAE;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAA;IAC5F,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QACvB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IACpG,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;QACpD,KAAK,MAAM,CAAC,IAAI,aAAa;YAC3B,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;gBACvE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;IACvG,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;QAC3B,KAAK,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,CAAA;IAC/E,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAA;IACzF,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,KAAa,EAAE,MAA2B,EAAE,MAAe;IACjF,MAAM,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,MAAM,CAAA;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACxB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAExB,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,EAAE,CACrC,MAAM;SACH,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;SACpE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,GAAG,CAAC,eAAe,CAAC,CAAA;IAEzB,4EAA4E;IAC5E,MAAM,aAAa,GACjB,CAAC,IAAI;QACL,IAAI,CAAC,IAAI,KAAK,QAAQ;QACtB,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IACnF,IAAI,aAAa;QAAE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAA;IAEzC,mCAAmC;IACnC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;QACpC,wDAAwD;QACxD,IAAI,IAAI,EAAE,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;YACtG,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAChE,OAAO,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACnG,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAA;QACpD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1C,IAAI,KAAK;YAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QACvD,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC;IAED,4DAA4D;IAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;QACpG,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAChE,OAAO,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC7C,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAChE,OAAO,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,qCAAqC;IACrC,OAAO;QACL,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE;QACtD,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE;QACpD,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE;KACjE,CAAA;AACH,CAAC;AAED,0GAA0G;AAC1G,SAAS,gBAAgB,CAAC,MAA6C,EAAE,IAAY;IACnF,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO;YAAE,SAAQ;QACjC,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,SAAQ;QACtD,OAAO,CAAC,CAAC,IAAI,CAAA;IACf,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/kql/validate.d.ts

@@ -0,0 +1,10 @@
+import type { KqlQuery } from './ast.js';
+import { type KqlField } from './fields.js';
+export interface KqlIssue {
+    message: string;
+    start: number;
+    end: number;
+}
+/** Semantic checks: known fields, operators the field supports, plausible values, known functions. */
+export declare function validateQuery(query: KqlQuery, fields: readonly KqlField[]): KqlIssue[];
+//# sourceMappingURL=validate.d.ts.map

package/dist/kql/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/kql/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,QAAQ,EAAY,MAAM,UAAU,CAAA;AAEjE,OAAO,EAA4B,KAAK,QAAQ,EAAgB,MAAM,aAAa,CAAA;AAEnF,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACZ;AAOD,sGAAsG;AACtG,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAatF"}