@tellaro/tql 0.1.0

package/dist/_virtual/_plugin-vue_export-helper.js

@@ -0,0 +1,9 @@
+const s = (t, e) => {
+  const o = t.__vccOpts || t;
+  for (const [r, c] of e)
+    o[r] = c;
+  return o;
+};
+export {
+  s as default
+};

package/dist/index.d.ts

@@ -0,0 +1 @@
+export * from './src/index'

package/dist/index.js

@@ -0,0 +1,37 @@
+import { AGGREGATION_FUNCTIONS as T, COLLECTION_OPERATORS as r, COMPARISON_OPERATORS as t, KEYWORDS as i, LOGICAL_OPERATORS as O, MUTATORS as l, NEGATION_SYMBOL_OPERATORS as n, SYMBOL_OPERATORS as a, TYPE_HINTS as s, TqlTokenizer as R, VISUALIZATION_TYPES as A, findPreviousToken as S, findTokenAtPosition as E, findTokenBefore as P, findTokensInRange as I, tokenizeTql as d, tokenizeTqlNoWhitespace as f } from "./src/tokenizer.js";
+import { TqlParser as g, formatParseError as N, getTqlErrors as m, isValidTql as p, parseTql as C } from "./src/parser.js";
+import { TqlValidator as k, formatValidationResult as L, getTqlIssues as x, isValidTqlSyntax as G, validateTql as V } from "./src/validator.js";
+import { getCompletionTriggerCharacters as u, getCompletions as M, getWordAtPosition as h, shouldTriggerCompletion as z } from "./src/completionProvider.js";
+export {
+  T as AGGREGATION_FUNCTIONS,
+  r as COLLECTION_OPERATORS,
+  t as COMPARISON_OPERATORS,
+  i as KEYWORDS,
+  O as LOGICAL_OPERATORS,
+  l as MUTATORS,
+  n as NEGATION_SYMBOL_OPERATORS,
+  a as SYMBOL_OPERATORS,
+  s as TYPE_HINTS,
+  g as TqlParser,
+  R as TqlTokenizer,
+  k as TqlValidator,
+  A as VISUALIZATION_TYPES,
+  S as findPreviousToken,
+  E as findTokenAtPosition,
+  P as findTokenBefore,
+  I as findTokensInRange,
+  N as formatParseError,
+  L as formatValidationResult,
+  u as getCompletionTriggerCharacters,
+  M as getCompletions,
+  m as getTqlErrors,
+  x as getTqlIssues,
+  h as getWordAtPosition,
+  p as isValidTql,
+  G as isValidTqlSyntax,
+  C as parseTql,
+  z as shouldTriggerCompletion,
+  d as tokenizeTql,
+  f as tokenizeTqlNoWhitespace,
+  V as validateTql
+};

package/dist/src/completionProvider.d.ts

@@ -0,0 +1,22 @@
+import { TqlCompletionContext, TqlCompletionItem, TqlCompletionOptions } from './types';
+
+/**
+ * Get completions for a TQL query at the cursor position
+ */
+export declare function getCompletions(context: TqlCompletionContext, options?: TqlCompletionOptions): TqlCompletionItem[];
+/**
+ * Get the word at the cursor position
+ */
+export declare function getWordAtPosition(query: string, position: number): {
+    word: string;
+    start: number;
+    end: number;
+} | null;
+/**
+ * Get completion trigger characters
+ */
+export declare function getCompletionTriggerCharacters(): string[];
+/**
+ * Check if completion should be triggered automatically
+ */
+export declare function shouldTriggerCompletion(query: string, position: number, triggerChar?: string): boolean;

package/dist/src/completionProvider.js

@@ -0,0 +1,619 @@
+import { tokenizeTql as y, COMPARISON_OPERATORS as k, LOGICAL_OPERATORS as v, AGGREGATION_FUNCTIONS as T, VISUALIZATION_TYPES as C, TYPE_HINTS as O, MUTATORS as N } from "./tokenizer.js";
+const I = [
+  {
+    label: "Simple equality",
+    insertText: 'field eq "value"',
+    description: "Basic field equals value comparison",
+    category: "Basic"
+  },
+  {
+    label: "Contains search",
+    insertText: 'field contains "text"',
+    description: "Search for text within a field",
+    category: "Basic"
+  },
+  {
+    label: "Multiple conditions (AND)",
+    insertText: 'field1 eq "value1" AND field2 eq "value2"',
+    description: "Combine conditions with AND",
+    category: "Logical"
+  },
+  {
+    label: "Multiple conditions (OR)",
+    insertText: 'field1 eq "value1" OR field2 eq "value2"',
+    description: "Match either condition with OR",
+    category: "Logical"
+  },
+  {
+    label: "Negation",
+    insertText: 'NOT field eq "value"',
+    description: "Negate a condition",
+    category: "Logical"
+  },
+  {
+    label: "Field exists",
+    insertText: "field exists",
+    description: "Check if field has a value",
+    category: "Existence"
+  },
+  {
+    label: "Value in list",
+    insertText: 'field in ["value1", "value2", "value3"]',
+    description: "Match any value in a list",
+    category: "List"
+  },
+  {
+    label: "Value not in list",
+    insertText: 'field not_in ["value1", "value2"]',
+    description: "Exclude values in a list",
+    category: "List"
+  },
+  {
+    label: "Range (between)",
+    insertText: "field between 10 AND 100",
+    description: "Match values in a range",
+    category: "Range"
+  },
+  {
+    label: "Starts with",
+    insertText: 'field startswith "prefix"',
+    description: "Match fields starting with text",
+    category: "String"
+  },
+  {
+    label: "Regular expression",
+    insertText: 'field regexp "pattern.*"',
+    description: "Match using regex pattern",
+    category: "String"
+  },
+  {
+    label: "CIDR IP match",
+    insertText: 'source.ip cidr "192.168.0.0/24"',
+    description: "Match IP addresses in a CIDR range",
+    category: "Network"
+  },
+  {
+    label: "With mutator",
+    insertText: 'email | lowercase eq "test@example.com"',
+    description: "Apply mutator before comparison",
+    category: "Mutator"
+  },
+  {
+    label: "GeoIP lookup",
+    insertText: "source.ip | geoip_lookup",
+    description: "Enrich IP with geolocation data",
+    category: "Enrichment"
+  },
+  {
+    label: "Stats count by field",
+    insertText: "| stats count() by hostname",
+    description: "Count events grouped by field",
+    category: "Stats"
+  },
+  {
+    label: "Stats with visualization",
+    insertText: "| stats count() by status => bar",
+    description: "Stats with chart visualization",
+    category: "Stats"
+  },
+  {
+    label: "Stats top N",
+    insertText: "| stats count() by source.ip top 10",
+    description: "Top 10 results by count",
+    category: "Stats"
+  }
+], A = {
+  eq: { detail: "Equals", documentation: "Exact match comparison" },
+  ne: { detail: "Not equals", documentation: "Match any value except this one" },
+  gt: { detail: "Greater than", documentation: "Numeric/date comparison" },
+  gte: { detail: "Greater than or equal", documentation: "Numeric/date comparison" },
+  lt: { detail: "Less than", documentation: "Numeric/date comparison" },
+  lte: { detail: "Less than or equal", documentation: "Numeric/date comparison" },
+  contains: { detail: "Contains substring", documentation: "Case-insensitive substring match" },
+  not_contains: { detail: "Does not contain", documentation: "Negative substring match" },
+  startswith: { detail: "Starts with", documentation: "Match prefix of field value" },
+  not_startswith: { detail: "Does not start with", documentation: "Negative prefix match" },
+  endswith: { detail: "Ends with", documentation: "Match suffix of field value" },
+  not_endswith: { detail: "Does not end with", documentation: "Negative suffix match" },
+  regexp: { detail: "Regular expression", documentation: "Match using regex pattern" },
+  regex: { detail: "Regular expression", documentation: "Alias for regexp" },
+  not_regexp: { detail: "Not matching regex", documentation: "Negative regex match" },
+  matches: { detail: "Pattern match", documentation: "Match using pattern" },
+  not_matches: { detail: "Not matching pattern", documentation: "Negative pattern match" },
+  between: { detail: "Between range", documentation: "Usage: field between A AND B" },
+  not_between: { detail: "Not between range", documentation: "Exclude values in range" },
+  in: { detail: "In list", documentation: 'Usage: field in ["a", "b", "c"]' },
+  not_in: { detail: "Not in list", documentation: "Exclude values in list" },
+  exists: { detail: "Field exists", documentation: "Check if field has any value" },
+  not_exists: { detail: "Field not exists", documentation: "Check if field is missing or null" },
+  is: { detail: "Is null check", documentation: "Usage: field is null" },
+  is_not: { detail: "Is not null check", documentation: "Usage: field is_not null" },
+  cidr: { detail: "CIDR match", documentation: "Match IP addresses in CIDR range (IP fields only)" },
+  not_cidr: { detail: "Not in CIDR", documentation: "Exclude IPs in CIDR range" },
+  any: { detail: "Any element matches", documentation: "True if any array element matches" },
+  all: { detail: "All elements match", documentation: "True if all array elements match" },
+  none: { detail: "No elements match", documentation: "True if no array elements match" },
+  not_any: { detail: "Not any matches", documentation: "Negation of any" },
+  not_all: { detail: "Not all match", documentation: "Negation of all" },
+  not_none: { detail: "Not none match", documentation: "Negation of none" }
+}, L = {
+  lowercase: { detail: "Convert to lowercase", documentation: "Transform string to lowercase" },
+  uppercase: { detail: "Convert to uppercase", documentation: "Transform string to uppercase" },
+  trim: { detail: "Trim whitespace", documentation: "Remove leading/trailing whitespace" },
+  split: { detail: "Split string", documentation: "Split string into array. Usage: split(delimiter)" },
+  length: { detail: "Get length", documentation: "Returns string/array length as number" },
+  replace: { detail: "Replace text", documentation: "Replace substring. Usage: replace(find, replace)" },
+  b64encode: { detail: "Base64 encode", documentation: "Encode value to Base64" },
+  b64decode: { detail: "Base64 decode", documentation: "Decode Base64 to string" },
+  urldecode: { detail: "URL decode", documentation: "Decode URL-encoded string" },
+  hexencode: { detail: "Hex encode", documentation: "Encode to hexadecimal" },
+  hexdecode: { detail: "Hex decode", documentation: "Decode from hexadecimal" },
+  md5: { detail: "MD5 hash", documentation: "Calculate MD5 hash" },
+  sha256: { detail: "SHA256 hash", documentation: "Calculate SHA256 hash" },
+  refang: { detail: "Refang IOC", documentation: "Convert defanged URL/IP to normal form" },
+  defang: { detail: "Defang IOC", documentation: "Convert URL/IP to safe defanged form" },
+  is_private: { detail: "Is private IP", documentation: "Check if IP is RFC1918/private" },
+  is_global: { detail: "Is global IP", documentation: "Check if IP is globally routable" },
+  nslookup: { detail: "DNS lookup", documentation: "Perform DNS lookup on hostname/IP" },
+  geoip_lookup: { detail: "GeoIP lookup", documentation: "Get geolocation data for IP" },
+  geoip: { detail: "GeoIP lookup", documentation: "Alias for geoip_lookup" },
+  geo: { detail: "GeoIP lookup", documentation: "Alias for geoip_lookup with conditions" },
+  any: { detail: "Any truthy", documentation: "True if any array element is truthy" },
+  all: { detail: "All truthy", documentation: "True if all array elements are truthy" },
+  avg: { detail: "Average", documentation: "Calculate average of numeric array" },
+  average: { detail: "Average", documentation: "Alias for avg" },
+  sum: { detail: "Sum", documentation: "Sum of numeric array elements" },
+  min: { detail: "Minimum", documentation: "Minimum value in array" },
+  max: { detail: "Maximum", documentation: "Maximum value in array" }
+}, m = {
+  // String outputs
+  lowercase: "keyword",
+  uppercase: "keyword",
+  trim: "keyword",
+  replace: "keyword",
+  b64encode: "keyword",
+  b64decode: "keyword",
+  urldecode: "keyword",
+  hexencode: "keyword",
+  hexdecode: "keyword",
+  md5: "keyword",
+  sha256: "keyword",
+  refang: "keyword",
+  defang: "keyword",
+  nslookup: "keyword",
+  // Boolean outputs
+  is_private: "boolean",
+  is_global: "boolean",
+  any: "boolean",
+  all: "boolean",
+  // Number outputs
+  length: "long",
+  avg: "double",
+  average: "double",
+  sum: "double",
+  min: "double",
+  max: "double",
+  // Object outputs
+  geoip_lookup: "object",
+  geoip: "object",
+  geo: "object",
+  // Array output (returns array of strings)
+  split: "keyword"
+}, S = {
+  // Universal operators (work with all types)
+  eq: ["text", "keyword", "long", "integer", "double", "float", "date", "boolean", "ip"],
+  ne: ["text", "keyword", "long", "integer", "double", "float", "date", "boolean", "ip"],
+  exists: ["text", "keyword", "long", "integer", "double", "float", "date", "boolean", "ip", "nested", "object"],
+  not_exists: ["text", "keyword", "long", "integer", "double", "float", "date", "boolean", "ip", "nested", "object"],
+  is: ["text", "keyword", "long", "integer", "double", "float", "date", "boolean", "ip"],
+  is_not: ["text", "keyword", "long", "integer", "double", "float", "date", "boolean", "ip"],
+  in: ["text", "keyword", "long", "integer", "double", "float", "date", "boolean", "ip"],
+  not_in: ["text", "keyword", "long", "integer", "double", "float", "date", "boolean", "ip"],
+  // Comparison operators (numeric + date only)
+  gt: ["long", "integer", "double", "float", "date"],
+  gte: ["long", "integer", "double", "float", "date"],
+  lt: ["long", "integer", "double", "float", "date"],
+  lte: ["long", "integer", "double", "float", "date"],
+  between: ["long", "integer", "double", "float", "date"],
+  not_between: ["long", "integer", "double", "float", "date"],
+  // String operators (text/keyword only)
+  contains: ["text", "keyword"],
+  not_contains: ["text", "keyword"],
+  startswith: ["text", "keyword"],
+  not_startswith: ["text", "keyword"],
+  endswith: ["text", "keyword"],
+  not_endswith: ["text", "keyword"],
+  regexp: ["text", "keyword"],
+  regex: ["text", "keyword"],
+  not_regexp: ["text", "keyword"],
+  matches: ["text", "keyword"],
+  not_matches: ["text", "keyword"],
+  // IP-specific operators
+  cidr: ["ip"],
+  not_cidr: ["ip"],
+  // Collection operators
+  any: ["nested", "object", "keyword"],
+  all: ["nested", "object", "keyword"],
+  none: ["nested", "object", "keyword"]
+};
+function R(e, t, n) {
+  var u;
+  const o = y(e.substring(0, t)).filter((s) => s.type !== "whitespace");
+  if (o.length === 0)
+    return { type: "start" };
+  const a = o[o.length - 1], r = o.length > 1 ? o[o.length - 2] : null, d = a.end === t && !((u = e[t - 1]) != null && u.match(/\s/)), l = d ? a.value : void 0;
+  if (a.type === "logicalOp")
+    return { type: "start" };
+  if (a.type === "paren" && a.value === "(")
+    return { type: "after_paren" };
+  if (a.type === "arrow")
+    return { type: "after_arrow", partialText: l };
+  if (a.type === "doubleColon")
+    return { type: "after_double_colon", partialText: l };
+  if (a.type === "visualization" && d)
+    return { type: "after_arrow", partialText: l };
+  if (a.type === "typeHint" && d)
+    return { type: "after_double_colon", partialText: l };
+  if (a.type === "keyword" && a.value.toLowerCase() === "stats")
+    return { type: "after_stats", partialText: l };
+  if (a.type === "keyword" && a.value.toLowerCase() === "by")
+    return { type: "after_by", partialText: l };
+  if (a.type === "pipe")
+    return { type: "after_pipe", partialText: l };
+  if (a.type === "mutator") {
+    if (d)
+      return { type: "after_pipe", partialText: l };
+    const s = a.value.toLowerCase(), c = m[s];
+    return {
+      type: "after_mutator",
+      mutatorName: s,
+      mutatorOutputType: c
+    };
+  }
+  if (a.type === "aggregation")
+    return d ? { type: "after_stats", partialText: l } : { type: "after_value" };
+  if (a.type === "field") {
+    if (d)
+      return (r == null ? void 0 : r.type) === "pipe" ? { type: "after_pipe", partialText: l } : { type: "start", partialText: l };
+    if ((r == null ? void 0 : r.type) === "pipe")
+      return { type: "after_pipe", partialText: a.value };
+    const s = p(a.value, n);
+    return { type: "after_field", fieldName: a.value, fieldType: s };
+  }
+  if (a.type === "operator") {
+    if (d) {
+      if ((r == null ? void 0 : r.type) === "field") {
+        const s = p(r.value, n);
+        return { type: "after_field", fieldName: r.value, fieldType: s, partialText: l };
+      }
+      if ((r == null ? void 0 : r.type) === "mutator") {
+        const s = r.value.toLowerCase(), c = m[s];
+        return { type: "after_mutator", mutatorName: s, mutatorOutputType: c, partialText: l };
+      }
+    }
+    return { type: "after_operator", operatorName: a.value };
+  }
+  if (a.type === "string" || a.type === "number" || a.type === "boolean" || a.type === "null")
+    return { type: "after_value" };
+  if (a.type === "paren" && a.value === ")")
+    return { type: "after_value" };
+  if ((r == null ? void 0 : r.type) === "field" && d) {
+    const s = p(r.value, n);
+    return { type: "after_field", fieldName: r.value, fieldType: s, partialText: l };
+  }
+  if ((r == null ? void 0 : r.type) === "mutator" && d) {
+    const s = r.value.toLowerCase(), c = m[s];
+    return { type: "after_mutator", mutatorName: s, mutatorOutputType: c, partialText: l };
+  }
+  return { type: "unknown", partialText: l };
+}
+function p(e, t) {
+  if (!t) return;
+  const n = t.find((i) => i.name === e);
+  return n == null ? void 0 : n.type;
+}
+function B(e, t = {}) {
+  const { query: n, cursorPosition: i } = e, o = R(n, i, t.fields), a = [];
+  switch (o.type) {
+    case "start":
+    case "after_paren":
+      a.push(...f(t.fields, o.partialText)), a.push(_("NOT")), t.includeSnippets !== !1 && a.push(...E(t, o.partialText));
+      break;
+    case "after_field":
+      a.push(...g(o.partialText, o.fieldType));
+      break;
+    case "after_mutator":
+      a.push(...g(o.partialText, o.mutatorOutputType));
+      break;
+    case "after_operator":
+      a.push(...D(o.fieldName, t));
+      break;
+    case "after_value":
+      a.push(...x());
+      break;
+    case "after_pipe":
+      a.push(...M(o.partialText));
+      break;
+    case "after_double_colon":
+      a.push(...U(o.partialText));
+      break;
+    case "after_arrow":
+      a.push(...q(o.partialText));
+      break;
+    case "after_stats":
+      a.push(...w(o.partialText));
+      break;
+    case "after_by":
+      a.push(...f(t.fields, o.partialText));
+      break;
+    default:
+      a.push(...f(t.fields, o.partialText)), a.push(...g(o.partialText)), a.push(...x());
+  }
+  t.includeAggregations && o.type === "start" && a.push(...w(o.partialText));
+  let r = a;
+  if (o.partialText) {
+    const d = o.partialText.toLowerCase();
+    r = a.filter(
+      (l) => {
+        var u;
+        return l.label.toLowerCase().includes(d) || ((u = l.filterText) == null ? void 0 : u.toLowerCase().includes(d));
+      }
+    );
+  }
+  return r.sort((d, l) => d.sortOrder - l.sortOrder), t.maxItems && t.maxItems > 0 && (r = r.slice(0, t.maxItems)), r;
+}
+function f(e, t) {
+  if (!e || e.length === 0)
+    return $(t);
+  const n = [];
+  for (const i of e) {
+    const o = h(i);
+    if (n.push(o), i.nested)
+      for (const a of i.nested) {
+        const r = h(a, i.name);
+        n.push(r);
+      }
+  }
+  return n;
+}
+function $(e) {
+  return [
+    { name: "hostname", description: "Host/machine name" },
+    { name: "status", description: "Status value" },
+    { name: "severity", description: "Severity level" },
+    { name: "source", description: "Event source" },
+    { name: "source.ip", description: "Source IP address" },
+    { name: "destination.ip", description: "Destination IP address" },
+    { name: "tags", description: "Associated tags" },
+    { name: "@timestamp", description: "Event timestamp" },
+    { name: "message", description: "Message content" },
+    { name: "user.name", description: "User name" },
+    { name: "os.family", description: "Operating system family" },
+    { name: "os.type", description: "Operating system type" },
+    { name: "os.version", description: "Operating system version" },
+    { name: "customer", description: "Customer identifier" },
+    { name: "stack", description: "Stack identifier" }
+  ].filter((n) => !e || n.name.toLowerCase().includes(e.toLowerCase())).map((n) => ({
+    label: n.name,
+    insertText: n.name,
+    kind: "field",
+    detail: n.description,
+    sortOrder: 10
+  }));
+}
+function h(e, t) {
+  const n = t ? `${t}.${e.name}` : e.name;
+  return {
+    label: n,
+    insertText: n,
+    kind: "field",
+    detail: e.description || `Type: ${e.type}`,
+    documentation: e.examples ? `Examples: ${e.examples.join(", ")}` : void 0,
+    sortOrder: 10
+  };
+}
+function g(e, t) {
+  let n = [...k];
+  return t && (n = n.filter((i) => {
+    const o = S[i];
+    return !o || o.includes(t);
+  })), e && (n = n.filter((i) => i.toLowerCase().includes(e.toLowerCase()))), n.map((i, o) => {
+    const a = A[i] || { detail: i, documentation: "" }, r = P(i, t);
+    return {
+      label: i,
+      insertText: r,
+      kind: "operator",
+      detail: a.detail,
+      documentation: a.documentation,
+      sortOrder: 20 + o
+    };
+  });
+}
+function P(e, t) {
+  const n = [
+    "contains",
+    "not_contains",
+    "startswith",
+    "not_startswith",
+    "endswith",
+    "not_endswith",
+    "regexp",
+    "regex",
+    "not_regexp",
+    "matches",
+    "not_matches"
+  ], i = ["exists", "not_exists"], o = ["is", "is_not"];
+  if (e === "in" || e === "not_in")
+    return b(t) ? `${e} [$1]` : `${e} ["$1"]`;
+  if (e === "between" || e === "not_between")
+    return b(t) ? `${e} $1 AND $2` : `${e} "$1" AND "$2"`;
+  if (o.includes(e))
+    return `${e} null`;
+  if (i.includes(e))
+    return e;
+  if (e === "cidr" || e === "not_cidr")
+    return `${e} "$1"`;
+  if (n.includes(e))
+    return `${e} "$1"`;
+  if (!t)
+    return `${e} `;
+  switch (t) {
+    case "text":
+    case "keyword":
+      return `${e} "$1"`;
+    case "boolean":
+      return `${e} $1`;
+    case "long":
+    case "integer":
+    case "double":
+    case "float":
+      return `${e} $1`;
+    case "date":
+      return `${e} "$1"`;
+    case "ip":
+      return `${e} "$1"`;
+    default:
+      return `${e} `;
+  }
+}
+function b(e) {
+  return e === "long" || e === "integer" || e === "double" || e === "float" || e === "short" || e === "byte" || e === "half_float" || e === "scaled_float" || e === "unsigned_long";
+}
+function x() {
+  return v.filter((e) => e !== "NOT").map(
+    (e, t) => _(e, t)
+  );
+}
+function _(e, t = 0) {
+  return {
+    label: e,
+    insertText: e + " ",
+    kind: "logicalOp",
+    detail: e === "AND" ? "Both conditions must match" : e === "OR" ? "Either condition can match" : "Negate the condition",
+    sortOrder: 30 + t
+  };
+}
+function D(e, t) {
+  var i;
+  const n = [];
+  return e && ((i = t == null ? void 0 : t.fieldValues) != null && i[e]) && t.fieldValues[e].forEach((a, r) => {
+    n.push({
+      label: a,
+      insertText: `"${a}"`,
+      kind: "value",
+      detail: `Known value for ${e}`,
+      sortOrder: 40 + r
+    });
+  }), n.push(
+    {
+      label: '"text"',
+      insertText: '"$1"',
+      kind: "value",
+      detail: "String value",
+      sortOrder: 50
+    },
+    {
+      label: "123",
+      insertText: "0",
+      kind: "value",
+      detail: "Numeric value",
+      sortOrder: 51
+    },
+    {
+      label: "true/false",
+      insertText: "true",
+      kind: "value",
+      detail: "Boolean value",
+      sortOrder: 52
+    },
+    {
+      label: "null",
+      insertText: "null",
+      kind: "value",
+      detail: "Null value",
+      sortOrder: 53
+    }
+  ), n;
+}
+function E(e, t) {
+  return I.filter((i) => !t || i.label.toLowerCase().includes(t.toLowerCase())).map((i, o) => ({
+    label: i.label,
+    insertText: i.insertText,
+    kind: "snippet",
+    detail: i.description,
+    documentation: `Insert: ${i.insertText}`,
+    sortOrder: 100 + o
+  }));
+}
+function M(e) {
+  return N.filter((t) => !e || t.toLowerCase().includes(e.toLowerCase())).map(
+    (t, n) => {
+      const i = L[t] || { detail: "Field mutator", documentation: "" };
+      return {
+        label: t,
+        insertText: t,
+        kind: "mutator",
+        detail: i.detail,
+        documentation: i.documentation,
+        sortOrder: 60 + n
+      };
+    }
+  );
+}
+function w(e) {
+  return T.filter(
+    (t) => !e || t.toLowerCase().includes(e.toLowerCase())
+  ).map((t, n) => ({
+    label: t,
+    insertText: `${t}($1)`,
+    kind: "aggregation",
+    detail: "Aggregation function",
+    sortOrder: 70 + n
+  }));
+}
+function U(e) {
+  return O.filter(
+    (t) => !e || t.toLowerCase().includes(e.toLowerCase())
+  ).map((t, n) => ({
+    label: t,
+    insertText: t,
+    kind: "typeHint",
+    detail: "Type hint",
+    sortOrder: 80 + n
+  }));
+}
+function q(e) {
+  return C.filter(
+    (t) => !e || t.toLowerCase().includes(e.toLowerCase())
+  ).map((t, n) => ({
+    label: t,
+    insertText: t,
+    kind: "visualization",
+    detail: "Visualization type",
+    sortOrder: 90 + n
+  }));
+}
+function G(e, t) {
+  const i = y(e).find(
+    (o) => o.start <= t && o.end >= t && o.type !== "whitespace"
+  );
+  return i ? {
+    word: i.value,
+    start: i.start,
+    end: i.end
+  } : null;
+}
+function V() {
+  return [" ", "(", ".", '"', "'", "|", ":", "="];
+}
+function j(e, t, n) {
+  if (n === " " || n === "(" || n === "." || n === "|" || n === ":" || n === "=") return !0;
+  const i = y(e.substring(0, t)), o = i[i.length - 1];
+  return !!(o && o.type === "field" && o.value.length >= 2);
+}
+export {
+  V as getCompletionTriggerCharacters,
+  B as getCompletions,
+  G as getWordAtPosition,
+  j as shouldTriggerCompletion
+};