@tellaro/tql 0.1.17 → 0.2.0

package/dist/src/completionProvider.js

@@ -1,10 +1,7 @@
-var I = Object.defineProperty;
-var S = (e, t, a) => t in e ? I(e, t, { enumerable: !0, configurable: !0, writable: !0, value: a }) : e[t] = a;
-var p = (e, t, a) => S(e, typeof t != "symbol" ? t + "" : t, a);
-import { tokenizeTql as b, COMPARISON_OPERATORS as A, LOGICAL_OPERATORS as L, AGGREGATION_FUNCTIONS as R, VISUALIZATION_TYPES as $, TYPE_HINTS as P, MUTATORS as D, ENRICHMENT_MUTATORS as ENRICHMENT_MUTATORS, MUTATOR_PARAMETERS as MUTATOR_PARAMETERS } from "./tokenizer.js";
-import { fuzzyMatch as _ } from "./fuzzyMatcher.js";
-import { getSchemaCache as M } from "./schemaCache.js";
-const E = [
+import { tokenizeTql as x, COMPARISON_OPERATORS as N, LOGICAL_OPERATORS as I, AGGREGATION_FUNCTIONS as S, VISUALIZATION_TYPES as A, TYPE_HINTS as L, MUTATORS as R } from "./tokenizer.js";
+import { fuzzyMatch as w } from "./fuzzyMatcher.js";
+import { getSchemaCache as $ } from "./schemaCache.js";
+const P = [
   {
     label: "Simple equality",
     insertText: 'field eq "value"',
@@ -107,270 +104,70 @@ const E = [
     description: "Top 10 results by count",
     category: "Stats"
   }
-], U = {
-  // Equality operators
-  eq: { detail: "Equals", documentation: "Exact match comparison. Case-sensitive for strings.\n\nExamples:\n- status eq 'active'\n- severity eq 3\n- enabled eq true\n\nWorks with: strings, numbers, booleans, dates, IPs" },
-  ne: { detail: "Not equals", documentation: "Match any value except the specified one.\n\nExamples:\n- status ne 'error'\n- severity ne 0\n\nUseful for filtering out specific values." },
-  // Comparison operators
-  gt: { detail: "Greater than", documentation: "Compare if field value is greater than the specified value.\n\nExamples:\n- severity gt 3\n- bytes gt 1000000\n- @timestamp gt '2024-01-01'\n\nWorks with: numbers, dates" },
-  gte: { detail: "Greater than or equal", documentation: "Compare if field value is greater than or equal to the specified value.\n\nExamples:\n- risk_score gte 70\n- attempts gte 5\n\nWorks with: numbers, dates" },
-  lt: { detail: "Less than", documentation: "Compare if field value is less than the specified value.\n\nExamples:\n- response_time lt 100\n- @timestamp lt 'now-1d'\n\nWorks with: numbers, dates" },
-  lte: { detail: "Less than or equal", documentation: "Compare if field value is less than or equal to the specified value.\n\nExamples:\n- confidence lte 50\n- age lte 30\n\nWorks with: numbers, dates" },
-  // String operators
-  contains: { detail: "Contains substring", documentation: "Check if field contains the specified substring. Case-insensitive.\n\nExamples:\n- message contains 'error'\n- url contains 'admin'\n\nUseful for searching within text fields." },
-  not_contains: { detail: "Does not contain", documentation: "Check if field does NOT contain the specified substring.\n\nExamples:\n- message not_contains 'debug'\n- path not_contains 'test'\n\nUseful for excluding noise from results." },
-  startswith: { detail: "Starts with", documentation: "Check if field value starts with the specified prefix.\n\nExamples:\n- hostname startswith 'web-'\n- url startswith 'https://'\n\nFaster than contains for prefix matching." },
-  not_startswith: { detail: "Does not start with", documentation: "Check if field value does NOT start with the specified prefix.\n\nExamples:\n- hostname not_startswith 'test-'\n- email not_startswith 'noreply'" },
-  endswith: { detail: "Ends with", documentation: "Check if field value ends with the specified suffix.\n\nExamples:\n- file.name endswith '.exe'\n- email endswith '@company.com'\n\nUseful for file extension matching." },
-  not_endswith: { detail: "Does not end with", documentation: "Check if field value does NOT end with the specified suffix.\n\nExamples:\n- file.name not_endswith '.log'\n- url not_endswith '.jpg'" },
-  regexp: { detail: "Regular expression", documentation: "Match field value against a regular expression pattern.\n\nExamples:\n- ip regexp '^192\\\\.168\\\\..*'\n- email regexp '.*@(gmail|yahoo)\\\\.com$'\n\nUses standard regex syntax." },
-  regex: { detail: "Regular expression", documentation: "Alias for regexp. Match using regex pattern.\n\nExamples:\n- user.name regex '^admin.*'" },
-  not_regexp: { detail: "Not matching regex", documentation: "Match if field value does NOT match the regex.\n\nExamples:\n- file.path not_regexp '.*\\\\.tmp$'\n- message not_regexp 'DEBUG|TRACE'" },
-  matches: { detail: "Pattern match", documentation: "Alias for regexp. Match using regex pattern.\n\nExamples:\n- hostname matches 'server[0-9]+'" },
-  not_matches: { detail: "Not matching pattern", documentation: "Alias for not_regexp. Does NOT match the pattern." },
-  // Range operators
-  between: { detail: "Between range", documentation: "Check if field value is within a range (inclusive).\n\nExamples:\n- port between 1024 AND 65535\n- severity between 1 AND 5\n\nIncludes both boundary values." },
-  not_between: { detail: "Not between range", documentation: "Check if field value is outside a range.\n\nExamples:\n- port not_between 80 AND 443\n\nExcludes values in the range." },
-  // List operators
-  in: { detail: "In list", documentation: "Check if field value matches any value in the list.\n\nExamples:\n- status in ['active', 'pending']\n- severity in [3, 4, 5]\n\nMore efficient than multiple OR conditions." },
-  not_in: { detail: "Not in list", documentation: "Check if field value does NOT match any value in the list.\n\nExamples:\n- status not_in ['deleted', 'archived']\n\nUseful for exclusion lists." },
-  // Existence operators
-  exists: { detail: "Field exists", documentation: "Check if field exists and has a non-null value.\n\nExamples:\n- user.email exists\n- threat.indicator exists\n\nReturns false for null values or missing fields." },
-  not_exists: { detail: "Field not exists", documentation: "Check if field is missing or has a null value.\n\nExamples:\n- error.code not_exists\n\nTrue when field is missing or explicitly null." },
-  is: { detail: "Is null check", documentation: "Check if field value is explicitly null.\n\nExamples:\n- user.phone is null\n\nDifferent from not_exists: returns false for missing fields." },
-  is_not: { detail: "Is not null check", documentation: "Check if field exists and is not null.\n\nExamples:\n- user.email is_not null\n\nField must exist and have a non-null value." },
-  // Network operators
-  cidr: { detail: "CIDR match", documentation: "Match IP addresses within a CIDR range.\n\nExamples:\n- source.ip cidr '192.168.0.0/16'\n- destination.ip cidr '10.0.0.0/8'\n\nWorks with IPv4 and IPv6." },
-  not_cidr: { detail: "Not in CIDR", documentation: "Match IP addresses NOT within a CIDR range.\n\nExamples:\n- source.ip not_cidr '192.168.0.0/16'\n\nUseful for identifying external IPs." },
-  // Collection operators
-  any: { detail: "Any element matches", documentation: "True if ANY element in an array matches the condition.\n\nExamples:\n- tags any eq 'critical'\n- ports any between 1 AND 1024\n\nUseful for searching within array fields." },
-  all: { detail: "All elements match", documentation: "True if ALL elements in an array match the condition.\n\nExamples:\n- scores all gte 70\n\nUseful for validation across arrays." },
-  none: { detail: "No elements match", documentation: "True if NO elements in an array match the condition.\n\nExamples:\n- tags none eq 'deprecated'\n\nUseful for ensuring no bad values exist." },
-  not_any: { detail: "Not any matches", documentation: "Negation of any - equivalent to none.\n\nTrue when no elements match." },
-  not_all: { detail: "Not all match", documentation: "Negation of all - at least one element doesn't match.\n\nTrue when at least one element fails." },
-  not_none: { detail: "Not none match", documentation: "Negation of none - equivalent to any.\n\nTrue when at least one element matches." }
-}, z = {
-  // String mutators
-  lowercase: {
-    detail: "Convert to lowercase",
-    documentation: "Transforms the field value to lowercase.\n\nExample: hostname | lowercase eq 'server01'\n\nUseful for case-insensitive comparisons."
-  },
-  uppercase: {
-    detail: "Convert to uppercase",
-    documentation: "Transforms the field value to uppercase.\n\nExample: status | uppercase eq 'ERROR'\n\nUseful for normalizing status codes."
-  },
-  trim: {
-    detail: "Trim whitespace",
-    documentation: "Removes leading and trailing whitespace from the field value.\n\nExample: message | trim contains 'error'\n\nUseful for cleaning user input or log messages."
-  },
-  split: {
-    detail: "Split string into array",
-    documentation: "Splits a string into an array using a delimiter.\n\nExample: tags | split(delimiter=',') any eq 'critical'\n\nParameters:\n- delimiter: Character(s) to split on (default: ',')\n- field: Field name to save results to"
-  },
-  length: {
-    detail: "Get string/array length",
-    documentation: "Returns the length of a string or array as a number.\n\nExample: password | length gte 8\n\nUseful for validation checks."
-  },
-  replace: {
-    detail: "Replace text in string",
-    documentation: "Replaces occurrences of a substring with another string.\n\nExample: url | replace(find='http://', replace='https://') startswith 'https'\n\nParameters:\n- find: Text to search for (required)\n- replace: Text to replace with (required)\n- field: Field name to save results to"
-  },
-  // Encoding mutators
-  b64encode: {
-    detail: "Base64 encode",
-    documentation: "Encodes the field value to Base64.\n\nExample: payload | b64encode eq 'SGVsbG8gV29ybGQ='\n\nParameters:\n- field: Field name to save encoded result"
-  },
-  b64decode: {
-    detail: "Base64 decode",
-    documentation: "Decodes a Base64-encoded field value.\n\nExample: encoded_data | b64decode contains 'password'\n\nParameters:\n- field: Field name to save decoded result"
-  },
-  urldecode: {
-    detail: "URL decode",
-    documentation: "Decodes URL-encoded (percent-encoded) strings.\n\nExample: query_string | urldecode contains 'SELECT'\n\nUseful for analyzing web requests."
-  },
-  hexencode: {
-    detail: "Hex encode",
-    documentation: "Encodes the field value to hexadecimal.\n\nExample: data | hexencode eq '48656c6c6f'\n\nParameters:\n- field: Field name to save encoded result"
-  },
-  hexdecode: {
-    detail: "Hex decode",
-    documentation: "Decodes a hexadecimal-encoded field value.\n\nExample: hex_payload | hexdecode contains 'malware'\n\nParameters:\n- field: Field name to save decoded result"
-  },
-  md5: {
-    detail: "MD5 hash",
-    documentation: "Calculates the MD5 hash of the field value.\n\nExample: file_content | md5 eq 'd41d8cd98f00b204e9800998ecf8427e'\n\nUseful for file integrity checks."
-  },
-  sha256: {
-    detail: "SHA256 hash",
-    documentation: "Calculates the SHA256 hash of the field value.\n\nExample: file_content | sha256 in ['hash1', 'hash2']\n\nUseful for malware signature matching."
-  },
-  // Security mutators
-  refang: {
-    detail: "Refang IOC",
-    documentation: "Converts defanged indicators back to their original form.\n\nExample: ioc | refang eq '192.168.1.1'\n\nConverts 'hxxp://evil[.]com' to 'http://evil.com'"
-  },
-  defang: {
-    detail: "Defang IOC",
-    documentation: "Converts URLs/IPs to a safe defanged form for sharing.\n\nExample: url | defang\n\nConverts 'http://evil.com' to 'hxxp://evil[.]com'"
-  },
-  // Network mutators
-  is_private: {
-    detail: "Check if IP is private",
-    documentation: "Returns true if the IP address is in a private range (RFC1918).\n\nExample: source.ip | is_private eq true\n\nPrivate ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16"
-  },
-  is_global: {
-    detail: "Check if IP is globally routable",
-    documentation: "Returns true if the IP address is globally routable (not private/reserved).\n\nExample: destination.ip | is_global eq true\n\nUseful for filtering external connections."
-  },
-  // DNS mutator
-  nslookup: {
-    detail: "DNS lookup",
-    documentation: "Performs DNS lookup on a hostname or reverse lookup on an IP.\n\nExample: hostname | nslookup(types=['A', 'AAAA'])\n\nParameters:\n- servers: DNS servers to query (e.g., ['1.1.1.1'])\n- types: Record types to query (A, AAAA, MX, TXT, etc.)\n- force: Force lookup even if data exists\n- save: Save results to record\n- field: Field name to save results"
-  },
-  // GeoIP mutators
-  geoip_lookup: {
-    detail: "GeoIP enrichment",
-    documentation: "Enriches IP address with geolocation data (country, city, ASN, etc.).\n\nExample: source.ip | geoip_lookup(force=true)\n\nParameters:\n- db_path: Path to MaxMind database\n- force: Force lookup even if geo data exists\n- save: Save results to record\n- cache: Enable result caching\n- cache_ttl: Cache TTL in seconds"
-  },
-  geoip: {
-    detail: "GeoIP enrichment",
-    documentation: "Alias for geoip_lookup. Enriches IP with geolocation data.\n\nExample: destination.ip | geoip"
-  },
-  geo: {
-    detail: "GeoIP enrichment",
-    documentation: "Alias for geoip_lookup. Enriches IP with geolocation data.\n\nExample: source.ip | geo(save=true)\n\nAdds: country, city, region, coordinates, ASN info"
-  },
-  // List mutators
-  any: {
-    detail: "Any element matches",
-    documentation: "Returns true if any element in an array matches the condition.\n\nExample: tags | any eq 'critical'\n\nUseful for checking array fields."
-  },
-  all: {
-    detail: "All elements match",
-    documentation: "Returns true if all elements in an array match the condition.\n\nExample: scores | all gte 70\n\nUseful for validation across arrays."
-  },
-  avg: {
-    detail: "Average of array",
-    documentation: "Calculates the average of numeric array elements.\n\nExample: response_times | avg lt 100\n\nUseful for performance analysis."
-  },
-  average: {
-    detail: "Average of array",
-    documentation: "Alias for avg. Calculates the average of numeric array elements."
-  },
-  sum: {
-    detail: "Sum of array",
-    documentation: "Calculates the sum of numeric array elements.\n\nExample: byte_counts | sum gt 1000000\n\nUseful for aggregate analysis."
-  },
-  min: {
-    detail: "Minimum value in array",
-    documentation: "Returns the minimum value from a numeric array.\n\nExample: temperatures | min lt 0\n\nUseful for threshold detection."
-  },
-  max: {
-    detail: "Maximum value in array",
-    documentation: "Returns the maximum value from a numeric array.\n\nExample: cpu_usage | max gt 90\n\nUseful for peak detection."
-  }
-}, aggregationDocs = {
-  // Counting aggregations
-  count: {
-    detail: "Count records",
-    documentation: "Counts the number of records or non-null field values.\n\nExamples:\n- | stats count()\n- | stats count(user_id) by status\n\nReturns: Integer count"
-  },
-  unique_count: {
-    detail: "Count unique values",
-    documentation: "Counts distinct values in a field.\n\nExamples:\n- | stats unique_count(source.ip)\n- | stats unique_count(user.name) by department\n\nReturns: Integer count of unique values"
-  },
-  cardinality: {
-    detail: "Cardinality (unique count)",
-    documentation: "Alias for unique_count. Counts distinct values in a field.\n\nExamples:\n- | stats cardinality(user_id)\n\nReturns: Integer count of unique values"
-  },
-  // Numeric aggregations
-  sum: {
-    detail: "Sum of values",
-    documentation: "Calculates the sum of numeric field values.\n\nExamples:\n- | stats sum(bytes) by hostname\n- | stats sum(request.size)\n\nReturns: Numeric sum"
-  },
-  min: {
-    detail: "Minimum value",
-    documentation: "Returns the minimum value from a numeric or date field.\n\nExamples:\n- | stats min(response_time) by endpoint\n- | stats min(@timestamp)\n\nReturns: Minimum value"
-  },
-  max: {
-    detail: "Maximum value",
-    documentation: "Returns the maximum value from a numeric or date field.\n\nExamples:\n- | stats max(cpu_usage) by host\n- | stats max(@timestamp)\n\nReturns: Maximum value"
-  },
-  avg: {
-    detail: "Average value",
-    documentation: "Calculates the arithmetic mean of numeric field values.\n\nExamples:\n- | stats avg(response_time) by service\n- | stats avg(score)\n\nReturns: Numeric average"
-  },
-  average: {
-    detail: "Average value",
-    documentation: "Alias for avg. Calculates the arithmetic mean.\n\nExamples:\n- | stats average(latency) by region"
-  },
-  mean: {
-    detail: "Mean value",
-    documentation: "Alias for avg. Calculates the arithmetic mean.\n\nExamples:\n- | stats mean(temperature) by sensor_id"
-  },
-  median: {
-    detail: "Median value",
-    documentation: "Returns the median (50th percentile) of numeric values.\n\nExamples:\n- | stats median(response_time) by endpoint\n\nReturns: Median value (50th percentile)"
-  },
-  med: {
-    detail: "Median value",
-    documentation: "Alias for median. Returns the 50th percentile.\n\nExamples:\n- | stats med(latency)"
-  },
-  std: {
-    detail: "Standard deviation",
-    documentation: "Calculates the standard deviation of numeric values.\n\nExamples:\n- | stats std(response_time) by service\n\nReturns: Standard deviation"
-  },
-  standard_deviation: {
-    detail: "Standard deviation",
-    documentation: "Alias for std. Calculates the standard deviation.\n\nExamples:\n- | stats standard_deviation(score) by category"
-  },
-  // Percentile functions
-  percentile: {
-    detail: "Percentile value",
-    documentation: "Returns a specific percentile of numeric values.\n\nExamples:\n- | stats percentile(response_time, 95) by endpoint\n- | stats percentile(latency, 99)\n\nParameters: field, percentile (0-100)"
-  },
-  percentiles: {
-    detail: "Multiple percentiles",
-    documentation: "Returns multiple percentiles at once.\n\nExamples:\n- | stats percentiles(response_time, [50, 90, 95, 99])\n\nParameters: field, array of percentiles"
-  },
-  p: {
-    detail: "Percentile (shorthand)",
-    documentation: "Shorthand for percentile function.\n\nExamples:\n- | stats p(latency, 95) by service"
-  },
-  pct: {
-    detail: "Percentile (shorthand)",
-    documentation: "Shorthand for percentile function.\n\nExamples:\n- | stats pct(response_time, 99)"
-  },
-  percentile_rank: {
-    detail: "Percentile rank",
-    documentation: "Returns the percentile rank of a specific value.\n\nExamples:\n- | stats percentile_rank(response_time, 100) by endpoint\n\nReturns: What percentile the given value falls into"
-  },
-  percentile_ranks: {
-    detail: "Multiple percentile ranks",
-    documentation: "Returns percentile ranks for multiple values.\n\nExamples:\n- | stats percentile_ranks(latency, [50, 100, 200])"
-  },
-  pct_rank: {
-    detail: "Percentile rank (shorthand)",
-    documentation: "Shorthand for percentile_rank.\n\nExamples:\n- | stats pct_rank(response_time, 100)"
-  },
-  pct_ranks: {
-    detail: "Percentile ranks (shorthand)",
-    documentation: "Shorthand for percentile_ranks.\n\nExamples:\n- | stats pct_ranks(latency, [50, 100])"
-  },
-  // Unique values
-  values: {
-    detail: "Unique values list",
-    documentation: "Returns a list of unique values for a field.\n\nExamples:\n- | stats values(status) by hostname\n\nReturns: Array of unique values"
-  },
-  unique: {
-    detail: "Unique values list",
-    documentation: "Alias for values. Returns a list of unique values.\n\nExamples:\n- | stats unique(user.name) by department"
-  },
-  distinct: {
-    detail: "Distinct values list",
-    documentation: "Alias for values. Returns a list of distinct values.\n\nExamples:\n- | stats distinct(source.ip)"
-  }
-}, h = {
+], D = {
+  eq: { detail: "Equals", documentation: "Exact match comparison" },
+  ne: { detail: "Not equals", documentation: "Match any value except this one" },
+  gt: { detail: "Greater than", documentation: "Numeric/date comparison" },
+  gte: { detail: "Greater than or equal", documentation: "Numeric/date comparison" },
+  lt: { detail: "Less than", documentation: "Numeric/date comparison" },
+  lte: { detail: "Less than or equal", documentation: "Numeric/date comparison" },
+  contains: { detail: "Contains substring", documentation: "Case-insensitive substring match" },
+  not_contains: { detail: "Does not contain", documentation: "Negative substring match" },
+  startswith: { detail: "Starts with", documentation: "Match prefix of field value" },
+  not_startswith: { detail: "Does not start with", documentation: "Negative prefix match" },
+  endswith: { detail: "Ends with", documentation: "Match suffix of field value" },
+  not_endswith: { detail: "Does not end with", documentation: "Negative suffix match" },
+  regexp: { detail: "Regular expression", documentation: "Match using regex pattern" },
+  regex: { detail: "Regular expression", documentation: "Alias for regexp" },
+  not_regexp: { detail: "Not matching regex", documentation: "Negative regex match" },
+  matches: { detail: "Pattern match", documentation: "Match using pattern" },
+  not_matches: { detail: "Not matching pattern", documentation: "Negative pattern match" },
+  between: { detail: "Between range", documentation: "Usage: field between A AND B" },
+  not_between: { detail: "Not between range", documentation: "Exclude values in range" },
+  in: { detail: "In list", documentation: 'Usage: field in ["a", "b", "c"]' },
+  not_in: { detail: "Not in list", documentation: "Exclude values in list" },
+  exists: { detail: "Field exists", documentation: "Check if field has any value" },
+  not_exists: { detail: "Field not exists", documentation: "Check if field is missing or null" },
+  is: { detail: "Is null check", documentation: "Usage: field is null" },
+  is_not: { detail: "Is not null check", documentation: "Usage: field is_not null" },
+  cidr: { detail: "CIDR match", documentation: "Match IP addresses in CIDR range (IP fields only)" },
+  not_cidr: { detail: "Not in CIDR", documentation: "Exclude IPs in CIDR range" },
+  any: { detail: "Any element matches", documentation: "True if any array element matches" },
+  all: { detail: "All elements match", documentation: "True if all array elements match" },
+  none: { detail: "No elements match", documentation: "True if no array elements match" },
+  not_any: { detail: "Not any matches", documentation: "Negation of any" },
+  not_all: { detail: "Not all match", documentation: "Negation of all" },
+  not_none: { detail: "Not none match", documentation: "Negation of none" }
+}, M = {
+  lowercase: { detail: "Convert to lowercase", documentation: "Transform string to lowercase" },
+  uppercase: { detail: "Convert to uppercase", documentation: "Transform string to uppercase" },
+  trim: { detail: "Trim whitespace", documentation: "Remove leading/trailing whitespace" },
+  split: { detail: "Split string", documentation: "Split string into array. Usage: split(delimiter)" },
+  length: { detail: "Get length", documentation: "Returns string/array length as number" },
+  replace: { detail: "Replace text", documentation: "Replace substring. Usage: replace(find, replace)" },
+  b64encode: { detail: "Base64 encode", documentation: "Encode value to Base64" },
+  b64decode: { detail: "Base64 decode", documentation: "Decode Base64 to string" },
+  urldecode: { detail: "URL decode", documentation: "Decode URL-encoded string" },
+  hexencode: { detail: "Hex encode", documentation: "Encode to hexadecimal" },
+  hexdecode: { detail: "Hex decode", documentation: "Decode from hexadecimal" },
+  md5: { detail: "MD5 hash", documentation: "Calculate MD5 hash" },
+  sha256: { detail: "SHA256 hash", documentation: "Calculate SHA256 hash" },
+  refang: { detail: "Refang IOC", documentation: "Convert defanged URL/IP to normal form" },
+  defang: { detail: "Defang IOC", documentation: "Convert URL/IP to safe defanged form" },
+  is_private: { detail: "Is private IP", documentation: "Check if IP is RFC1918/private" },
+  is_global: { detail: "Is global IP", documentation: "Check if IP is globally routable" },
+  nslookup: { detail: "DNS lookup", documentation: "Perform DNS lookup on hostname/IP" },
+  geoip_lookup: { detail: "GeoIP lookup", documentation: "Get geolocation data for IP" },
+  geoip: { detail: "GeoIP lookup", documentation: "Alias for geoip_lookup" },
+  geo: { detail: "GeoIP lookup", documentation: "Alias for geoip_lookup with conditions" },
+  any: { detail: "Any truthy", documentation: "True if any array element is truthy" },
+  all: { detail: "All truthy", documentation: "True if all array elements are truthy" },
+  avg: { detail: "Average", documentation: "Calculate average of numeric array" },
+  average: { detail: "Average", documentation: "Alias for avg" },
+  sum: { detail: "Sum", documentation: "Sum of numeric array elements" },
+  min: { detail: "Minimum", documentation: "Minimum value in array" },
+  max: { detail: "Maximum", documentation: "Maximum value in array" }
+}, g = {
   // String outputs
   lowercase: "keyword",
   uppercase: "keyword",
@@ -404,7 +201,7 @@ const E = [
   geo: "object",
   // Array output (returns array of strings)
   split: "keyword"
-}, F = {
+}, E = {
   // Universal operators (work with all types)
   eq: ["text", "keyword", "long", "integer", "double", "float", "date", "boolean", "ip"],
   ne: ["text", "keyword", "long", "integer", "double", "float", "date", "boolean", "ip"],
@@ -441,12 +238,10 @@ const E = [
   all: ["nested", "object", "keyword"],
   none: ["nested", "object", "keyword"]
 };
-class q {
-  constructor() {
-    p(this, "cache", /* @__PURE__ */ new Map());
-    p(this, "maxSize", 50);
-    p(this, "maxAge", 5e3);
-  }
+class U {
+  cache = /* @__PURE__ */ new Map();
+  maxSize = 50;
+  maxAge = 5e3;
   // 5 seconds
   get(t) {
     const a = this.cache.get(t);
@@ -465,106 +260,66 @@ class q {
     this.cache.clear();
   }
 }
-const v = new q();
-function B(e, t, a) {
+const v = new U();
+function z(e, t, a) {
   const i = `${e.substring(0, t)}|${t}`, o = v.get(i);
   if (o)
-    return o.fieldName && !o.fieldType && a && (o.fieldType = f(o.fieldName, a)), o;
-  const n = G(e, t, a);
+    return o.fieldName && !o.fieldType && a && (o.fieldType = p(o.fieldName, a)), o;
+  const n = F(e, t, a);
   return v.set(i, n), n;
 }
-function G(e, t, a) {
-  var u;
-  const o = b(e.substring(0, t)).filter((l) => l.type !== "whitespace");
+function F(e, t, a) {
+  const o = x(e.substring(0, t)).filter((r) => r.type !== "whitespace");
   if (o.length === 0)
     return { type: "start" };
-  const n = o[o.length - 1], r = o.length > 1 ? o[o.length - 2] : null, d = n.end === t && !((u = e[t - 1]) != null && u.match(/\s/)), s = d ? n.value : void 0;
+  const n = o[o.length - 1], s = o.length > 1 ? o[o.length - 2] : null, d = n.end === t && !e[t - 1]?.match(/\s/), l = d ? n.value : void 0;
   if (n.type === "logicalOp")
     return { type: "start" };
-  if (n.type === "paren" && n.value === "(") {
-    // Check if previous token is a mutator - we're inside mutator params
-    if (r && r.type === "mutator") {
-      const mutatorName = r.value.toLowerCase();
-      // Don't use "(" as partialText - we want to show all params when cursor is right after (
-      return { type: "mutator_params", mutatorName: mutatorName, usedParams: [], partialText: undefined };
-    }
+  if (n.type === "paren" && n.value === "(")
     return { type: "after_paren" };
-  }
-  // Check if we're typing inside mutator params (e.g., "geo(for" while typing "force")
-  // Pattern: field token, preceded by "(", preceded by mutator
-  if (n.type === "field" && r && r.type === "paren" && r.value === "(") {
-    const mutatorToken = o.length > 2 ? o[o.length - 3] : null;
-    if (mutatorToken && mutatorToken.type === "mutator") {
-      const mutatorName = mutatorToken.value.toLowerCase();
-      return { type: "mutator_params", mutatorName: mutatorName, usedParams: [], partialText: n.value };
-    }
-  }
-  // Check if we're after a comma inside mutator params (e.g., "geo(force=true, ")
-  if (n.type === "comma") {
-    // Look back for the pattern: mutator, "(", ...params..., ","
-    let foundMutator = null;
-    let usedParams = [];
-    for (let i = o.length - 2; i >= 0; i--) {
-      const tok = o[i];
-      if (tok.type === "paren" && tok.value === "(") {
-        // Check if token before ( is a mutator
-        if (i > 0 && o[i - 1].type === "mutator") {
-          foundMutator = o[i - 1].value.toLowerCase();
-        }
-        break;
-      }
-      // Collect used parameter names (tokens that look like param=value)
-      if (tok.type === "field") {
-        usedParams.push(tok.value.toLowerCase());
-      }
-    }
-    if (foundMutator) {
-      return { type: "mutator_params", mutatorName: foundMutator, usedParams: usedParams, partialText: s };
-    }
-  }
   if (n.type === "arrow")
-    return { type: "after_arrow", partialText: s };
+    return { type: "after_arrow", partialText: l };
   if (n.type === "doubleColon")
-    return { type: "after_double_colon", partialText: s };
+    return { type: "after_double_colon", partialText: l };
   if (n.type === "visualization" && d)
-    return { type: "after_arrow", partialText: s };
+    return { type: "after_arrow", partialText: l };
   if (n.type === "typeHint" && d)
-    return { type: "after_double_colon", partialText: s };
+    return { type: "after_double_colon", partialText: l };
   if (n.type === "keyword" && n.value.toLowerCase() === "stats")
-    return { type: "after_stats", partialText: s };
+    return { type: "after_stats", partialText: l };
   if (n.type === "keyword" && n.value.toLowerCase() === "by")
-    return { type: "after_by", partialText: s };
+    return { type: "after_by", partialText: l };
   if (n.type === "pipe")
-    return { type: "after_pipe", partialText: s };
+    return { type: "after_pipe", partialText: l };
   if (n.type === "mutator") {
     if (d)
-      return { type: "after_pipe", partialText: s };
-    const l = n.value.toLowerCase(), c = h[l];
+      return { type: "after_pipe", partialText: l };
+    const r = n.value.toLowerCase(), c = g[r];
     return {
       type: "after_mutator",
-      mutatorName: l,
+      mutatorName: r,
       mutatorOutputType: c
     };
   }
   if (n.type === "aggregation")
-    return d ? { type: "after_stats", partialText: s } : { type: "after_value" };
+    return d ? { type: "after_stats", partialText: l } : { type: "after_value" };
   if (n.type === "field") {
     if (d)
-      return (r == null ? void 0 : r.type) === "pipe" ? { type: "after_pipe", partialText: s } : { type: "start", partialText: s };
-    if ((r == null ? void 0 : r.type) === "pipe")
+      return s?.type === "pipe" ? { type: "after_pipe", partialText: l } : { type: "start", partialText: l };
+    if (s?.type === "pipe")
       return { type: "after_pipe", partialText: n.value };
-    const l = f(n.value, a);
-    return { type: "after_field", fieldName: n.value, fieldType: l };
+    const r = p(n.value, a);
+    return { type: "after_field", fieldName: n.value, fieldType: r };
   }
   if (n.type === "operator") {
     if (d) {
-      if ((r == null ? void 0 : r.type) === "field") {
-        const l = f(r.value, a);
-        return { type: "after_field", fieldName: r.value, fieldType: l, partialText: s };
+      if (s?.type === "field") {
+        const r = p(s.value, a);
+        return { type: "after_field", fieldName: s.value, fieldType: r, partialText: l };
       }
-      if ((r == null ? void 0 : r.type) === "mutator") {
-        const l = r.value.toLowerCase(), c = h[l];
-        return { type: "after_mutator", mutatorName: l, mutatorOutputType: c, partialText: s };
+      if (s?.type === "mutator") {
+        const r = s.value.toLowerCase(), c = g[r];
+        return { type: "after_mutator", mutatorName: r, mutatorOutputType: c, partialText: l };
       }
     }
     return { type: "after_operator", operatorName: n.value };
@@ -573,110 +328,96 @@ function G(e, t, a) {
     return d ? { type: "at_value_end" } : { type: "after_value" };
   if (n.type === "paren" && n.value === ")")
     return { type: "after_value" };
-  if ((r == null ? void 0 : r.type) === "field" && d) {
-    const l = f(r.value, a);
-    return { type: "after_field", fieldName: r.value, fieldType: l, partialText: s };
+  if (s?.type === "field" && d) {
+    const r = p(s.value, a);
+    return { type: "after_field", fieldName: s.value, fieldType: r, partialText: l };
   }
-  if ((r == null ? void 0 : r.type) === "mutator" && d) {
-    const l = r.value.toLowerCase(), c = h[l];
-    return { type: "after_mutator", mutatorName: l, mutatorOutputType: c, partialText: s };
+  if (s?.type === "mutator" && d) {
+    const r = s.value.toLowerCase(), c = g[r];
+    return { type: "after_mutator", mutatorName: r, mutatorOutputType: c, partialText: l };
   }
-  return { type: "unknown", partialText: s };
+  return { type: "unknown", partialText: l };
 }
-function f(e, t) {
-  return t ? M().getFieldType(t, e) : void 0;
+function p(e, t) {
+  return t ? $().getFieldType(t, e) : void 0;
 }
-function ae(e, t = {}) {
-  const { query: a, cursorPosition: i } = e, o = B(a, i, t.fields), n = [];
+function J(e, t = {}) {
+  const { query: a, cursorPosition: i } = e, o = z(a, i, t.fields), n = [];
   switch (o.type) {
     case "start":
     case "after_paren":
-      n.push(...y(t.fields, o.partialText)), n.push(N("NOT")), t.includeSnippets !== !1 && n.push(...K(t, o.partialText));
+      n.push(...h(t.fields, o.partialText)), n.push(O("NOT")), t.includeSnippets !== !1 && n.push(...V(t, o.partialText));
       break;
     case "after_field":
-      n.push(...x(o.partialText, o.fieldType)), n.push(H());
+      n.push(...y(o.partialText, o.fieldType));
       break;
     case "after_mutator":
-      // Check if this is an enrichment mutator (geo, nslookup, etc.)
-      // Enrichment mutators don't need operators - they transform the field into enriched data
-      if (o.mutatorName && ENRICHMENT_MUTATORS.includes(o.mutatorName)) {
-        // Suggest logical operators (AND, OR) or pipe for chaining
-        n.push(...C());
-        n.push(H());
-      } else {
-        n.push(...x(o.partialText, o.mutatorOutputType));
-      }
+      n.push(...y(o.partialText, o.mutatorOutputType));
       break;
     case "after_operator":
-      n.push(...Y(o.fieldName, t));
+      n.push(...G(o.fieldName, t));
       break;
     case "after_value":
-      n.push(...C());
+      n.push(...T());
       break;
     case "at_value_end":
       break;
     case "after_pipe":
-      n.push(...W(o.partialText));
+      n.push(...j(o.partialText));
       break;
     case "after_double_colon":
-      n.push(...Z(o.partialText));
+      n.push(...H(o.partialText));
       break;
     case "after_arrow":
-      n.push(...J(o.partialText));
+      n.push(...Y(o.partialText));
       break;
     case "after_stats":
-      n.push(...O(o.partialText));
+      n.push(...C(o.partialText));
       break;
     case "after_by":
-      n.push(...y(t.fields, o.partialText));
-      break;
-    case "mutator_params":
-      n.push(...getMutatorParameterCompletions(o.mutatorName, o.usedParams, o.partialText));
+      n.push(...h(t.fields, o.partialText));
       break;
     default:
-      n.push(...y(t.fields, o.partialText)), n.push(...x(o.partialText)), n.push(...C());
+      n.push(...h(t.fields, o.partialText)), n.push(...y(o.partialText)), n.push(...T());
   }
-  t.includeAggregations && o.type === "start" && n.push(...O(o.partialText));
-  let r = n;
-  const d = t.fuzzyMatching !== !1, s = t.minFuzzyScore ?? 0;
+  t.includeAggregations && o.type === "start" && n.push(...C(o.partialText));
+  let s = n;
+  const d = t.fuzzyMatching !== !1, l = t.minFuzzyScore ?? 0;
   if (o.partialText) {
-    const u = o.partialText.toLowerCase();
+    const r = o.partialText.toLowerCase();
     if (d) {
-      const l = [];
-      for (const c of n) {
-        const m = _(u, c.label), w = c.filterText ? _(u, c.filterText) : { matched: !1, score: 0 }, g = m.score >= w.score ? m : w;
-        g.matched && g.score >= s && l.push({
-          ...c,
-          matchScore: g.score,
+      const c = [];
+      for (const u of n) {
+        const m = w(r, u.label), b = u.filterText ? w(r, u.filterText) : { matched: !1, score: 0 }, f = m.score >= b.score ? m : b;
+        f.matched && f.score >= l && c.push({
+          ...u,
+          matchScore: f.score,
           matchedIndices: m.matched ? m.matchedIndices : void 0
         });
       }
-      r = l;
+      s = c;
     } else
-      r = n.filter(
-        (l) => {
-          var c;
-          return l.label.toLowerCase().includes(u) || ((c = l.filterText) == null ? void 0 : c.toLowerCase().includes(u));
-        }
+      s = n.filter(
+        (c) => c.label.toLowerCase().includes(r) || c.filterText?.toLowerCase().includes(r)
       );
   }
-  return r.sort((u, l) => u.matchScore !== void 0 && l.matchScore !== void 0 && l.matchScore !== u.matchScore ? l.matchScore - u.matchScore : u.sortOrder - l.sortOrder), t.maxItems && t.maxItems > 0 && (r = r.slice(0, t.maxItems)), r;
+  return s.sort((r, c) => r.matchScore !== void 0 && c.matchScore !== void 0 && c.matchScore !== r.matchScore ? c.matchScore - r.matchScore : r.sortOrder - c.sortOrder), t.maxItems && t.maxItems > 0 && (s = s.slice(0, t.maxItems)), s;
 }
-function y(e, t) {
+function h(e, t) {
   if (!e || e.length === 0)
-    return V(t);
+    return q(t);
   const a = [];
   for (const i of e) {
     const o = k(i);
     if (a.push(o), i.nested)
       for (const n of i.nested) {
-        const r = k(n, i.name);
-        a.push(r);
+        const s = k(n, i.name);
+        a.push(s);
       }
   }
   return a;
 }
-function V(e) {
+function q(e) {
   return [
     { name: "hostname", description: "Host/machine name" },
     { name: "status", description: "Status value" },
@@ -714,16 +455,16 @@ function k(e, t) {
     sortOrder: 10
   };
 }
-function x(e, t) {
-  let a = [...A];
+function y(e, t) {
+  let a = [...N];
   return t && (a = a.filter((i) => {
-    const o = F[i];
+    const o = E[i];
     return !o || o.includes(t);
   })), e && (a = a.filter((i) => i.toLowerCase().includes(e.toLowerCase()))), a.map((i, o) => {
-    const n = U[i] || { detail: i, documentation: "" }, r = j(i, t);
+    const n = D[i] || { detail: i, documentation: "" }, s = B(i, t);
     return {
       label: i,
-      insertText: r,
+      insertText: s,
       kind: "operator",
       detail: n.detail,
       documentation: n.documentation,
@@ -731,7 +472,7 @@ function x(e, t) {
     };
   });
 }
-function j(e, t) {
+function B(e, t) {
   const a = [
     "contains",
     "not_contains",
@@ -746,9 +487,9 @@ function j(e, t) {
     "not_matches"
   ], i = ["exists", "not_exists"], o = ["is", "is_not"];
   if (e === "in" || e === "not_in")
-    return T(t) ? `${e} [$1]` : `${e} ["$1"]`;
+    return _(t) ? `${e} [$1]` : `${e} ["$1"]`;
   if (e === "between" || e === "not_between")
-    return T(t) ? `${e} $1 AND $2` : `${e} "$1" AND "$2"`;
+    return _(t) ? `${e} $1 AND $2` : `${e} "$1" AND "$2"`;
   if (o.includes(e))
     return `${e} null`;
   if (i.includes(e))
@@ -765,28 +506,32 @@ function j(e, t) {
       return `${e} "$1"`;
     case "boolean":
       return `${e} $1`;
+    // true or false, no quotes
     case "long":
     case "integer":
     case "double":
     case "float":
       return `${e} $1`;
+    // Numbers, no quotes
     case "date":
       return `${e} "$1"`;
+    // Dates typically quoted
     case "ip":
       return `${e} "$1"`;
+    // IPs quoted
     default:
       return `${e} `;
   }
 }
-function T(e) {
+function _(e) {
   return e === "long" || e === "integer" || e === "double" || e === "float" || e === "short" || e === "byte" || e === "half_float" || e === "scaled_float" || e === "unsigned_long";
 }
-function C() {
-  return L.filter((e) => e !== "NOT").map(
-    (e, t) => N(e, t)
+function T() {
+  return I.filter((e) => e !== "NOT").map(
+    (e, t) => O(e, t)
   );
 }
-function N(e, t = 0) {
+function O(e, t = 0) {
   return {
     label: e,
     insertText: e + " ",
@@ -795,27 +540,15 @@ function N(e, t = 0) {
     sortOrder: 30 + t
   };
 }
-function H() {
-  return {
-    label: "|",
-    insertText: "| ",
-    kind: "operator",
-    detail: "Pipe to mutator",
-    documentation: "Chain field to a mutator function (e.g., hostname | lower)",
-    sortOrder: 19
-    // Just before operators (20+)
-  };
-}
-function Y(e, t) {
-  var i;
+function G(e, t) {
   const a = [];
-  return e && ((i = t == null ? void 0 : t.fieldValues) != null && i[e]) && t.fieldValues[e].forEach((n, r) => {
+  return e && t?.fieldValues?.[e] && t.fieldValues[e].forEach((o, n) => {
     a.push({
-      label: n,
-      insertText: `"${n}"`,
+      label: o,
+      insertText: `"${o}"`,
       kind: "value",
       detail: `Known value for ${e}`,
-      sortOrder: 40 + r
+      sortOrder: 40 + n
     });
   }), a.push(
     {
@@ -848,8 +581,8 @@ function Y(e, t) {
     }
   ), a;
 }
-function K(e, t) {
-  return E.filter((i) => !t || i.label.toLowerCase().includes(t.toLowerCase())).map((i, o) => ({
+function V(e, t) {
+  return P.filter((i) => !t || i.label.toLowerCase().includes(t.toLowerCase())).map((i, o) => ({
     label: i.label,
     insertText: i.insertText,
     kind: "snippet",
@@ -858,60 +591,34 @@ function K(e, t) {
     sortOrder: 100 + o
   }));
 }
-function W(e) {
-  return D.filter((t) => !e || t.toLowerCase().includes(e.toLowerCase())).map(
+function j(e) {
+  return R.filter((t) => !e || t.toLowerCase().includes(e.toLowerCase())).map(
     (t, a) => {
-      const i = z[t] || { detail: "Field mutator", documentation: "" };
-      // Check if this mutator has parameters defined
-      const hasParams = MUTATOR_PARAMETERS[t] && MUTATOR_PARAMETERS[t].length > 0;
-      const isEnrichment = ENRICHMENT_MUTATORS.includes(t);
-
-      // Build label and insertText
-      let label = t;
-      let insertText = t;
-      let detail = i.detail;
-
-      if (hasParams) {
-        // Mutators with parameters show () in label and insert with cursor inside
-        label = `${t}()`;
-        insertText = `${t}($1)`;
-        // Add param hint to detail
-        const paramNames = MUTATOR_PARAMETERS[t].map(p => p.name).join(", ");
-        detail = `${i.detail} - params: ${paramNames}`;
-      } else if (isEnrichment) {
-        // Enrichment mutators without params still get () for consistency
-        label = `${t}()`;
-        insertText = `${t}()`;
-      }
-
+      const i = M[t] || { detail: "Field mutator", documentation: "" };
       return {
-        label: label,
-        insertText: insertText,
+        label: t,
+        insertText: t,
         kind: "mutator",
-        detail: detail,
+        detail: i.detail,
         documentation: i.documentation,
         sortOrder: 60 + a
       };
     }
   );
 }
-function O(e) {
-  return R.filter(
+function C(e) {
+  return S.filter(
     (t) => !e || t.toLowerCase().includes(e.toLowerCase())
-  ).map((t, a) => {
-    const docs = aggregationDocs[t] || { detail: "Aggregation function", documentation: "" };
-    return {
-      label: t,
-      insertText: `${t}($1)`,
-      kind: "aggregation",
-      detail: docs.detail,
-      documentation: docs.documentation,
-      sortOrder: 70 + a
-    };
-  });
+  ).map((t, a) => ({
+    label: t,
+    insertText: `${t}($1)`,
+    kind: "aggregation",
+    detail: "Aggregation function",
+    sortOrder: 70 + a
+  }));
 }
-function Z(e) {
-  return P.filter(
+function H(e) {
+  return L.filter(
     (t) => !e || t.toLowerCase().includes(e.toLowerCase())
   ).map((t, a) => ({
     label: t,
@@ -921,8 +628,8 @@ function Z(e) {
     sortOrder: 80 + a
   }));
 }
-function J(e) {
-  return $.filter(
+function Y(e) {
+  return A.filter(
     (t) => !e || t.toLowerCase().includes(e.toLowerCase())
   ).map((t, a) => ({
     label: t,
@@ -932,8 +639,8 @@ function J(e) {
     sortOrder: 90 + a
   }));
 }
-function ne(e, t) {
-  const i = b(e).find(
+function Q(e, t) {
+  const i = x(e).find(
     (o) => o.start <= t && o.end >= t && o.type !== "whitespace"
   );
   return i ? {
@@ -942,63 +649,17 @@ function ne(e, t) {
     end: i.end
   } : null;
 }
-function oe() {
+function X() {
   return [" ", "(", ".", '"', "'", "|", ":", "="];
 }
-function ie(e, t, a) {
+function ee(e, t, a) {
   if (a === " " || a === "(" || a === "." || a === "|" || a === ":" || a === "=") return !0;
-  const i = b(e.substring(0, t)), o = i[i.length - 1];
+  const i = x(e.substring(0, t)), o = i[i.length - 1];
   return !!(o && o.type === "field" && o.value.length >= 2);
 }
-/**
- * Get mutator parameter completions
- * @param mutatorName - The mutator name (e.g., "geo", "nslookup")
- * @param usedParams - Parameters already used in the current call
- * @param partialText - Partial text for filtering
- */
-function getMutatorParameterCompletions(mutatorName, usedParams = [], partialText) {
-  const params = MUTATOR_PARAMETERS[mutatorName];
-  if (!params || params.length === 0) {
-    return [];
-  }
-
-  // Filter out already used parameters
-  const usedSet = new Set(usedParams.map(p => p.toLowerCase()));
-  const availableParams = params.filter(p => !usedSet.has(p.name.toLowerCase()));
-
-  // Filter by partial text if provided
-  let filteredParams = availableParams;
-  if (partialText) {
-    const searchText = partialText.toLowerCase();
-    filteredParams = availableParams.filter(p =>
-      p.name.toLowerCase().includes(searchText)
-    );
-  }
-
-  return filteredParams.map((param, idx) => {
-    // Generate insert text based on parameter type
-    let insertText = `${param.name}=`;
-    if (param.type === "boolean") {
-      insertText = `${param.name}=true`;
-    } else if (param.type === "string") {
-      insertText = `${param.name}="$1"`;
-    } else if (param.type === "number") {
-      insertText = `${param.name}=$1`;
-    }
-
-    return {
-      label: param.name,
-      insertText: insertText,
-      kind: "property",
-      detail: `${param.type} - ${param.description}`,
-      documentation: param.description,
-      sortOrder: 100 + idx
-    };
-  });
-}
 export {
-  oe as getCompletionTriggerCharacters,
-  ae as getCompletions,
-  ne as getWordAtPosition,
-  ie as shouldTriggerCompletion
+  X as getCompletionTriggerCharacters,
+  J as getCompletions,
+  Q as getWordAtPosition,
+  ee as shouldTriggerCompletion
 };