@tellaro/tql 1.3.8 → 1.4.0

package/dist/src/index.d.ts

@@ -6,7 +6,7 @@
  *
  * @packageDocumentation
  */
-export type { TqlToken, TqlTokenType, TqlExpression, TqlBinaryExpression, TqlUnaryExpression, TqlComparisonExpression, TqlCollectionExpression, TqlMutatorExpression, TqlAggregationExpression, TqlStatsExpression, TqlGroupExpression, TqlLiteral, TqlFieldReference, TqlComparisonOperator, TqlLogicalOperator, TqlCollectionOperator, TqlMutator, TqlAggregationFunction, TqlTypeHint, TqlVisualizationType, TqlParseResult, TqlParseError, TqlParseWarning, TqlErrorCode, TqlWarningCode, TqlValidationResult, TqlValidationOptions, TqlFieldType, TqlCompletionItem, TqlCompletionKind, TqlCompletionContext, TqlCompletionOptions, TqlFieldSchema, TqlSnippet, TqlInputProps, TqlInputEmits, TqlInputExpose } from './types';
+export type { TqlToken, TqlTokenType, TqlExpression, TqlBinaryExpression, TqlUnaryExpression, TqlComparisonExpression, TqlCollectionExpression, TqlMutatorExpression, TqlAggregationExpression, TqlStatsExpression, TqlGroupExpression, TqlLiteral, TqlFieldReference, TqlComparisonOperator, TqlLogicalOperator, TqlCollectionOperator, TqlMutator, TqlAggregationFunction, TqlTypeHint, TqlVisualizationType, TqlVizParams, TqlVizHint, TqlParseResult, TqlParseError, TqlParseWarning, TqlErrorCode, TqlWarningCode, TqlValidationResult, TqlValidationOptions, TqlFieldType, TqlCompletionItem, TqlCompletionKind, TqlCompletionContext, TqlCompletionOptions, TqlFieldSchema, TqlSnippet, TqlInputProps, TqlInputEmits, TqlInputExpose } from './types';
 export { TqlTokenizer, tokenizeTql, tokenizeTqlNoWhitespace, findTokenAtPosition, findTokensInRange, findTokenBefore, findPreviousToken, COMPARISON_OPERATORS, SYMBOL_OPERATORS, NEGATION_SYMBOL_OPERATORS, LOGICAL_OPERATORS, COLLECTION_OPERATORS, MUTATORS, AGGREGATION_FUNCTIONS, TYPE_HINTS, VISUALIZATION_TYPES, KEYWORDS } from './tokenizer';
 export { TqlParser, parseTql, isValidTql, getTqlErrors, formatParseError } from './parser';
 export { TqlValidator, validateTql, isValidTqlSyntax, getTqlIssues, formatValidationResult } from './validator';
@@ -15,4 +15,5 @@ export { fuzzyMatch, levenshteinDistance, findClosestMatch, fuzzyFilter, highlig
 export { SchemaCache, getSchemaCache, createSchemaCache, getCachedFieldNames, getCachedFieldType, getCachedField, type CachedSchema } from './schemaCache';
 export { ComplexityAnalyzer, analyzeComplexity, isHighComplexity, getComplexityWarnings, getComplexityMetrics } from './complexityAnalyzer';
 export { SemanticPreview, generatePreview, getFieldUsage, getLogicTree, getUniqueFields, getOperatorSummary, formatLogicTreeNode, formatLogicTreeAscii, flattenLogicTree, getLogicTreeDepth } from './semanticPreview';
+export { buildStatsQuery, parseVizHintString, type StatsQueryConfig, type AggregationConfig, type GroupByConfig, type VizHintConfig } from './builder';
 export type { ComplexityScore, ComplexityWarning, ComplexityWarningType, ComplexityMetrics, ComplexityResult, ComplexityThresholds, MatchType, FieldUsage, LogicTreeNodeType, LogicTreeNode, PreviewResult, QueryHistoryEntry, UseQueryHistoryOptions } from './types';

package/dist/src/parser.d.ts

@@ -71,6 +71,16 @@ export declare class TqlParser {
      * This allows the parser to continue and find additional errors.
      */
     private createPlaceholderExpression;
+    /**
+     * Check if the token stream represents a stats query.
+     * Handles: "| stats ...", "stats ...", or starts with a filter before "| stats".
+     */
+    private isStatsQuery;
+    /**
+     * Check if the current position is a pipe followed by "stats" keyword.
+     * Used when the filter portion parsed successfully but there are remaining tokens.
+     */
+    private isStatsFollowingPipe;
 }
 /**
  * Parse a TQL query string

package/dist/src/parser.js

@@ -1,5 +1,5 @@
 import { tokenizeTql as u, COMPARISON_OPERATORS as c } from "./tokenizer.js";
-const d = 50, p = /* @__PURE__ */ new Set(["logicalOp", "paren"]);
+const p = 50, d = /* @__PURE__ */ new Set(["logicalOp", "paren"]);
 class v {
   tokens;
   allTokens;
@@ -23,11 +23,20 @@ class v {
         warnings: [],
         success: !0
       };
+    if (this.isStatsQuery())
+      return {
+        ast: null,
+        // Stats AST is produced by the Python/Rust parser
+        tokens: this.allTokens,
+        errors: [],
+        warnings: [],
+        success: !0
+      };
     try {
       const e = this.parseExpression();
       if (!this.isAtEnd()) {
         const t = this.peek();
-        this.addError(
+        t.type === "pipe" && this.isStatsFollowingPipe() || this.addError(
           `Unexpected token '${t.value}'`,
           t,
           "UNEXPECTED_TOKEN",
@@ -58,7 +67,7 @@ class v {
    * Parse a full expression (lowest precedence)
    */
   parseExpression() {
-    if (this.depth++, this.depth > d)
+    if (this.depth++, this.depth > p)
       throw new Error("Maximum query depth exceeded");
     try {
       return this.parseOr();
@@ -507,7 +516,7 @@ class v {
    */
   synchronize() {
     for (this.advance(); !this.isAtEnd(); ) {
-      if (p.has(this.peek().type) || this.peek().type === "paren" && this.peek().value === ")")
+      if (d.has(this.peek().type) || this.peek().type === "paren" && this.peek().value === ")")
         return;
       this.advance();
     }
@@ -538,24 +547,47 @@ class v {
       end: e.end
     };
   }
+  /**
+   * Check if the token stream represents a stats query.
+   * Handles: "| stats ...", "stats ...", or starts with a filter before "| stats".
+   */
+  isStatsQuery() {
+    if (this.tokens.length >= 2 && this.tokens[0].type === "pipe")
+      return this.tokens[1].type === "keyword" && this.tokens[1].value.toLowerCase() === "stats";
+    if (this.tokens.length >= 1 && this.tokens[0].type === "keyword" && this.tokens[0].value.toLowerCase() === "stats")
+      return !0;
+    for (let e = 0; e < this.tokens.length - 1; e++)
+      if (this.tokens[e].type === "pipe" && this.tokens[e + 1].type === "keyword" && this.tokens[e + 1].value.toLowerCase() === "stats")
+        return !0;
+    return !1;
+  }
+  /**
+   * Check if the current position is a pipe followed by "stats" keyword.
+   * Used when the filter portion parsed successfully but there are remaining tokens.
+   */
+  isStatsFollowingPipe() {
+    if (this.current >= this.tokens.length || this.tokens[this.current].type !== "pipe") return !1;
+    const t = this.current + 1;
+    return t >= this.tokens.length ? !1 : this.tokens[t].type === "keyword" && this.tokens[t].value.toLowerCase() === "stats";
+  }
 }
 function l(i) {
-  return new v(i).parse();
+  return i ? new v(i).parse() : { ast: null, errors: [], warnings: [], tokens: [] };
 }
-function k(i) {
+function f(i) {
   return l(i).success;
 }
 function y(i) {
   return l(i).errors;
 }
-function E(i) {
+function g(i) {
   let e = `Error at line ${i.line}, column ${i.column}: ${i.message}`;
   return i.suggestion && (e += ` (${i.suggestion})`), e;
 }
 export {
   v as TqlParser,
-  E as formatParseError,
+  g as formatParseError,
   y as getTqlErrors,
-  k as isValidTql,
+  f as isValidTql,
   l as parseTql
 };

package/dist/src/tokenizer.js

@@ -2,18 +2,27 @@ const l = [
   // Equality
   "eq",
   "ne",
+  "eq_ci",
   // Comparison
   "gt",
   "gte",
   "lt",
   "lte",
-  // String operators
+  // String operators (case-insensitive by default)
   "contains",
   "not_contains",
   "startswith",
   "not_startswith",
   "endswith",
   "not_endswith",
+  // Case-sensitive string operators (explicit)
+  "contains_cs",
+  "not_contains_cs",
+  "startswith_cs",
+  "not_startswith_cs",
+  "endswith_cs",
+  "not_endswith_cs",
+  // Regex operators
   "regexp",
   "regex",
   "not_regexp",
@@ -24,6 +33,8 @@ const l = [
   "not_between",
   "in",
   "not_in",
+  "in_cs",
+  "not_in_cs",
   // Existence operators
   "exists",
   "not_exists",
@@ -39,7 +50,7 @@ const l = [
   "not_any",
   "not_all",
   "not_none"
-], c = {
+], h = {
   "==": "eq",
   "=": "eq",
   "!=": "ne",
@@ -48,6 +59,10 @@ const l = [
   "<": "lt",
   "<=": "lte"
 }, u = {
+  "!in_cs": "not_in_cs",
+  "!contains_cs": "not_contains_cs",
+  "!startswith_cs": "not_startswith_cs",
+  "!endswith_cs": "not_endswith_cs",
   "!in": "not_in",
   "!contains": "not_contains",
   "!startswith": "not_startswith",
@@ -61,7 +76,7 @@ const l = [
   "!any": "not_any",
   "!all": "not_all",
   "!none": "not_none"
-}, p = ["AND", "OR", "NOT"], d = ["ANY", "ALL", "NONE"], k = [
+}, d = ["AND", "OR", "NOT"], p = ["ANY", "ALL", "NONE"], k = [
   // String mutators
   "lowercase",
   "uppercase",
@@ -82,6 +97,9 @@ const l = [
   "defang",
   "is_private",
   "is_global",
+  "is_multicast",
+  "is_loopback",
+  "is_link_local",
   // DNS mutator
   "nslookup",
   // GeoIP mutators
@@ -125,7 +143,7 @@ const l = [
   "values",
   "unique",
   "distinct"
-], m = [
+], _ = [
   "string",
   "str",
   "number",
@@ -141,11 +159,13 @@ const l = [
   "list",
   "object",
   "geo"
-], _ = [
+], m = [
   "bar",
   "barchart",
+  "horizontal_bar",
   "line",
   "area",
+  "stacked_area",
   "pie",
   "donut",
   "scatter",
@@ -160,24 +180,25 @@ const l = [
   "stacked_bar",
   "nested_pie",
   "nested_donut",
-  "chord"
-], g = ["by", "as", "null", "true", "false", "stats", "top", "bottom"];
-class T {
+  "chord",
+  "auto"
+], w = ["by", "as", "null", "true", "false", "stats", "top", "bottom"];
+class g {
   input;
   position;
   line;
   column;
   tokens;
-  constructor(e) {
-    this.input = e, this.position = 0, this.line = 1, this.column = 1, this.tokens = [];
+  constructor(t) {
+    this.input = t ?? "", this.position = 0, this.line = 1, this.column = 1, this.tokens = [];
   }
   /**
    * Tokenize the entire input string
    */
   tokenize() {
     for (this.tokens = [], this.position = 0, this.line = 1, this.column = 1; !this.isAtEnd(); ) {
-      const e = this.scanToken();
-      e && this.tokens.push(e);
+      const t = this.scanToken();
+      t && this.tokens.push(t);
     }
     return this.tokens;
   }
@@ -187,40 +208,40 @@ class T {
   scanToken() {
     if (this.isWhitespace(this.peek()))
       return this.scanWhitespace();
-    const e = this.position, n = this.line, i = this.column, t = this.advance();
-    switch (t) {
+    const t = this.position, n = this.line, i = this.column, e = this.advance();
+    switch (e) {
       case "(":
       case ")":
-        return this.makeToken("paren", t, e, n, i);
+        return this.makeToken("paren", e, t, n, i);
       case "[":
       case "]":
-        return this.makeToken("bracket", t, e, n, i);
+        return this.makeToken("bracket", e, t, n, i);
       case ",":
-        return this.makeToken("comma", t, e, n, i);
+        return this.makeToken("comma", e, t, n, i);
       case "|":
-        return this.makeToken("pipe", t, e, n, i);
+        return this.makeToken("pipe", e, t, n, i);
     }
-    return t === "=" && this.peek() === ">" ? (this.advance(), this.makeToken("arrow", "=>", e, n, i)) : t === ":" && this.peek() === ":" ? (this.advance(), this.makeToken("doubleColon", "::", e, n, i)) : t === '"' || t === "'" ? this.scanString(t, e, n, i) : this.isDigit(t) || t === "-" && this.isDigit(this.peek()) ? this.scanNumber(e, n, i) : this.isOperatorChar(t) ? this.scanSymbolOperator(e, n, i) : this.isIdentifierStart(t) ? this.scanIdentifier(e, n, i) : this.makeToken("unknown", t, e, n, i);
+    return e === "=" && this.peek() === ">" ? (this.advance(), this.makeToken("arrow", "=>", t, n, i)) : e === ":" && this.peek() === ":" ? (this.advance(), this.makeToken("doubleColon", "::", t, n, i)) : e === '"' || e === "'" ? this.scanString(e, t, n, i) : this.isDigit(e) || e === "-" && this.isDigit(this.peek()) ? this.scanNumber(t, n, i) : this.isOperatorChar(e) ? this.scanSymbolOperator(t, n, i) : this.isIdentifierStart(e) ? this.scanIdentifier(t, n, i) : this.makeToken("unknown", e, t, n, i);
   }
   /**
    * Scan whitespace characters
    */
   scanWhitespace() {
-    const e = this.position, n = this.line, i = this.column;
-    let t = "";
+    const t = this.position, n = this.line, i = this.column;
+    let e = "";
     for (; !this.isAtEnd() && this.isWhitespace(this.peek()); ) {
       const s = this.advance();
-      t += s;
+      e += s;
     }
-    return this.makeToken("whitespace", t, e, n, i);
+    return this.makeToken("whitespace", e, t, n, i);
   }
   /**
    * Scan a string literal (single or double quoted)
    */
-  scanString(e, n, i, t) {
+  scanString(t, n, i, e) {
     let s = "";
-    const r = e;
-    for (; !this.isAtEnd() && this.peek() !== e; )
+    const r = t;
+    for (; !this.isAtEnd() && this.peek() !== t; )
       if (this.peek() === "\\") {
         if (this.advance(), !this.isAtEnd()) {
           const a = this.advance();
@@ -256,7 +277,7 @@ class T {
       start: n,
       end: this.position,
       line: i,
-      column: t,
+      column: e,
       raw: r + s
     } : (this.advance(), {
       type: "string",
@@ -264,88 +285,88 @@ class T {
       start: n,
       end: this.position,
       line: i,
-      column: t,
-      raw: e + s + e
+      column: e,
+      raw: t + s + t
     });
   }
   /**
    * Scan a numeric literal
    */
-  scanNumber(e, n, i) {
-    this.position = e, this.column = i;
-    let t = "";
-    for (this.peek() === "-" && (t += this.advance()); !this.isAtEnd() && this.isDigit(this.peek()); )
-      t += this.advance();
+  scanNumber(t, n, i) {
+    this.position = t, this.column = i;
+    let e = "";
+    for (this.peek() === "-" && (e += this.advance()); !this.isAtEnd() && this.isDigit(this.peek()); )
+      e += this.advance();
     if (this.peek() === "." && this.isDigit(this.peekNext()))
-      for (t += this.advance(); !this.isAtEnd() && this.isDigit(this.peek()); )
-        t += this.advance();
+      for (e += this.advance(); !this.isAtEnd() && this.isDigit(this.peek()); )
+        e += this.advance();
     if (this.peek() === "e" || this.peek() === "E")
-      for (t += this.advance(), (this.peek() === "+" || this.peek() === "-") && (t += this.advance()); !this.isAtEnd() && this.isDigit(this.peek()); )
-        t += this.advance();
-    return this.makeToken("number", t, e, n, i);
+      for (e += this.advance(), (this.peek() === "+" || this.peek() === "-") && (e += this.advance()); !this.isAtEnd() && this.isDigit(this.peek()); )
+        e += this.advance();
+    return this.makeToken("number", e, t, n, i);
   }
   /**
    * Scan symbol-based operators (==, !=, >, >=, <, <=, !)
    */
-  scanSymbolOperator(e, n, i) {
-    this.position = e, this.column = i;
-    let t = this.advance();
+  scanSymbolOperator(t, n, i) {
+    this.position = t, this.column = i;
+    let e = this.advance();
     if (!this.isAtEnd()) {
-      const s = t + this.peek();
+      const s = e + this.peek();
       if (s === "=>")
-        return this.advance(), this.makeToken("arrow", "=>", e, n, i);
-      (s in c || s === "==" || s === "!=") && (t = s, this.advance());
+        return this.advance(), this.makeToken("arrow", "=>", t, n, i);
+      (s in h || s === "==" || s === "!=") && (e = s, this.advance());
     }
-    if (t === "!") {
+    if (e === "!") {
       const s = this.position;
       let r = "";
       for (; !this.isAtEnd() && this.isIdentifierChar(this.peek()); )
         r += this.advance();
       if (r) {
         if ("!" + r in u)
-          return this.makeToken("operator", "!" + r, e, n, i);
+          return this.makeToken("operator", "!" + r, t, n, i);
         this.position = s, this.column = i + 1;
       }
     }
-    return t in c || t === "==" || t === "=" || t === "!=" || t === ">" || t === ">=" || t === "<" || t === "<=" ? this.makeToken("operator", t, e, n, i) : this.makeToken("unknown", t, e, n, i);
+    return e in h || e === "==" || e === "=" || e === "!=" || e === ">" || e === ">=" || e === "<" || e === "<=" ? this.makeToken("operator", e, t, n, i) : this.makeToken("unknown", e, t, n, i);
   }
   /**
    * Scan an identifier (field name, operator keyword, etc.)
    */
-  scanIdentifier(e, n, i) {
-    this.position = e, this.column = i;
-    let t = "";
+  scanIdentifier(t, n, i) {
+    this.position = t, this.column = i;
+    let e = "";
     const s = this.advance();
-    if (t += s, s === "@" && this.peek() === "@")
-      return this.makeToken("unknown", t, e, n, i);
+    if (e += s, s === "@" && this.peek() === "@")
+      return this.makeToken("unknown", e, t, n, i);
     let r = s;
     for (; !this.isAtEnd() && this.isIdentifierChar(this.peek()); ) {
-      const h = this.advance();
-      if (h === "." && r === ".")
-        return this.position--, this.column--, t = t.slice(0, -1), this.makeToken("unknown", t, e, n, i);
-      t += h, r = h;
+      const c = this.advance();
+      if (c === "." && r === ".")
+        return this.position--, this.column--, e = e.slice(0, -1), this.makeToken("unknown", e, t, n, i);
+      e += c, r = c;
     }
-    t.endsWith(".") && (this.position--, this.column--, t = t.slice(0, -1));
-    const a = this.classifyIdentifier(t);
-    return this.makeToken(a, t, e, n, i);
+    e.endsWith(".") && (this.position--, this.column--, e = e.slice(0, -1));
+    const a = this.classifyIdentifier(e);
+    return this.makeToken(a, e, t, n, i);
   }
   /**
    * Classify an identifier into the appropriate token type
    */
-  classifyIdentifier(e) {
-    const n = e.toUpperCase(), i = e.toLowerCase();
-    return p.includes(n) ? "logicalOp" : d.includes(n) ? "collectionOp" : i === "true" || i === "false" ? "boolean" : i === "null" ? "null" : i === "stats" ? "keyword" : l.includes(i) ? "operator" : f.includes(i) ? "aggregation" : k.includes(i) ? "mutator" : m.includes(i) ? "typeHint" : _.includes(i) ? "visualization" : g.includes(i) ? "keyword" : "field";
+  classifyIdentifier(t) {
+    const n = t.toUpperCase(), i = t.toLowerCase();
+    return d.includes(n) ? "logicalOp" : p.includes(n) ? "collectionOp" : i === "true" || i === "false" ? "boolean" : i === "null" ? "null" : i === "stats" ? "keyword" : l.includes(i) ? "operator" : f.includes(i) ? "aggregation" : k.includes(i) ? "mutator" : _.includes(i) ? "typeHint" : m.includes(i) ? "visualization" : w.includes(i) ? "keyword" : "field";
   }
   // ============================================================================
   // Helper Methods
   // ============================================================================
-  makeToken(e, n, i, t, s) {
+  makeToken(t, n, i, e, s) {
     return {
-      type: e,
+      type: t,
       value: n,
       start: i,
       end: this.position,
-      line: t,
+      line: e,
       column: s
     };
   }
@@ -359,81 +380,81 @@ class T {
     return this.position + 1 >= this.input.length ? "\0" : this.input[this.position + 1];
   }
   advance() {
-    const e = this.input[this.position];
-    return this.position++, e === `
-` ? (this.line++, this.column = 1) : this.column++, e;
+    const t = this.input[this.position];
+    return this.position++, t === `
+` ? (this.line++, this.column = 1) : this.column++, t;
   }
-  isWhitespace(e) {
-    return e === " " || e === "	" || e === `
-` || e === "\r";
+  isWhitespace(t) {
+    return t === " " || t === "	" || t === `
+` || t === "\r";
   }
-  isDigit(e) {
-    return e >= "0" && e <= "9";
+  isDigit(t) {
+    return t >= "0" && t <= "9";
   }
-  isIdentifierStart(e) {
-    return e >= "a" && e <= "z" || e >= "A" && e <= "Z" || e === "_" || e === "@";
+  isIdentifierStart(t) {
+    return t >= "a" && t <= "z" || t >= "A" && t <= "Z" || t === "_" || t === "@";
   }
   /**
    * Check if char can continue an identifier (NOT including @ which is only valid at start)
    */
-  isIdentifierChar(e) {
-    return e >= "a" && e <= "z" || e >= "A" && e <= "Z" || e === "_" || this.isDigit(e) || e === "." || // For nested field access
-    e === "-";
+  isIdentifierChar(t) {
+    return t >= "a" && t <= "z" || t >= "A" && t <= "Z" || t === "_" || this.isDigit(t) || t === "." || // For nested field access
+    t === "-";
   }
-  isOperatorChar(e) {
-    return e === "=" || e === "!" || e === ">" || e === "<";
+  isOperatorChar(t) {
+    return t === "=" || t === "!" || t === ">" || t === "<";
   }
 }
-function w(o) {
-  return new T(o).tokenize();
+function T(o) {
+  return new g(o).tokenize();
 }
 function b(o) {
-  return w(o).filter((e) => e.type !== "whitespace");
+  return T(o).filter((t) => t.type !== "whitespace");
 }
-function v(o, e) {
+function v(o, t) {
   for (const n of o)
-    if (e >= n.start && e < n.end)
+    if (t >= n.start && t < n.end)
       return n;
   return null;
 }
-function O(o, e, n) {
-  return o.filter((i) => i.start < n && i.end > e);
+function O(o, t, n) {
+  return o.filter((i) => i.start < n && i.end > t);
 }
-function A(o, e) {
+function A(o, t) {
   let n = null;
   for (const i of o)
-    if (i.end <= e)
+    if (i.end <= t)
       n = i;
     else
       break;
   return n;
 }
-function E(o, e, n = !0) {
+function E(o, t, n = !0) {
   const i = n ? o.filter((s) => s.type !== "whitespace") : o;
-  let t = null;
+  let e = null;
   for (const s of i)
-    if (s.end <= e)
-      t = s;
+    if (s.end <= t)
+      e = s;
     else
       break;
-  return t;
+  return e;
 }
 export {
   f as AGGREGATION_FUNCTIONS,
-  d as COLLECTION_OPERATORS,
+  p as COLLECTION_OPERATORS,
   l as COMPARISON_OPERATORS,
-  g as KEYWORDS,
-  p as LOGICAL_OPERATORS,
+  w as KEYWORDS,
+  d as LOGICAL_OPERATORS,
   k as MUTATORS,
   u as NEGATION_SYMBOL_OPERATORS,
-  c as SYMBOL_OPERATORS,
-  m as TYPE_HINTS,
-  T as TqlTokenizer,
-  _ as VISUALIZATION_TYPES,
+  h as SYMBOL_OPERATORS,
+  _ as TYPE_HINTS,
+  g as TqlTokenizer,
+  m as VISUALIZATION_TYPES,
   E as findPreviousToken,
   v as findTokenAtPosition,
   A as findTokenBefore,
   O as findTokensInRange,
-  w as tokenizeTql,
+  T as tokenizeTql,
   b as tokenizeTqlNoWhitespace
 };

package/dist/src/types.d.ts

@@ -70,6 +70,8 @@ export interface TqlStatsExpression {
     topN?: number;
     bottomN?: number;
     visualization?: TqlVisualizationType;
+    /** Full visualization hint with type and optional parameters */
+    vizHint?: TqlVizHint;
     start: number;
     end: number;
 }
@@ -95,13 +97,35 @@ export interface TqlFieldReference {
     start: number;
     end: number;
 }
-export type TqlComparisonOperator = "eq" | "ne" | "=" | "!=" | "==" | "gt" | "gte" | "lt" | "lte" | ">" | ">=" | "<" | "<=" | "contains" | "not_contains" | "!contains" | "startswith" | "not_startswith" | "!startswith" | "endswith" | "not_endswith" | "!endswith" | "regexp" | "regex" | "not_regexp" | "!regexp" | "matches" | "not_matches" | "!matches" | "between" | "not_between" | "!between" | "in" | "not_in" | "!in" | "exists" | "not_exists" | "!exists" | "is" | "is_not" | "!is" | "cidr" | "not_cidr" | "!cidr" | "any" | "all" | "none" | "not_any" | "not_all" | "not_none" | "!any" | "!all" | "!none";
+export type TqlComparisonOperator = "eq" | "ne" | "=" | "!=" | "==" | "eq_ci" | "gt" | "gte" | "lt" | "lte" | ">" | ">=" | "<" | "<=" | "contains" | "not_contains" | "!contains" | "startswith" | "not_startswith" | "!startswith" | "endswith" | "not_endswith" | "!endswith" | "contains_cs" | "not_contains_cs" | "!contains_cs" | "startswith_cs" | "not_startswith_cs" | "!startswith_cs" | "endswith_cs" | "not_endswith_cs" | "!endswith_cs" | "regexp" | "regex" | "not_regexp" | "!regexp" | "matches" | "not_matches" | "!matches" | "between" | "not_between" | "!between" | "in" | "not_in" | "!in" | "in_cs" | "not_in_cs" | "!in_cs" | "exists" | "not_exists" | "!exists" | "is" | "is_not" | "!is" | "cidr" | "not_cidr" | "!cidr" | "any" | "all" | "none" | "not_any" | "not_all" | "not_none" | "!any" | "!all" | "!none";
 export type TqlLogicalOperator = "AND" | "OR" | "NOT";
 export type TqlCollectionOperator = "ANY" | "ALL" | "NONE";
-export type TqlMutator = "lowercase" | "uppercase" | "trim" | "split" | "length" | "replace" | "b64encode" | "b64decode" | "urldecode" | "hexencode" | "hexdecode" | "md5" | "sha256" | "refang" | "defang" | "is_private" | "is_global" | "nslookup" | "geoip_lookup" | "geoip" | "geo" | "any" | "all" | "avg" | "average" | "sum" | "min" | "max";
+export type TqlMutator = "lowercase" | "uppercase" | "trim" | "split" | "length" | "replace" | "b64encode" | "b64decode" | "urldecode" | "hexencode" | "hexdecode" | "md5" | "sha256" | "refang" | "defang" | "is_private" | "is_global" | "is_multicast" | "is_loopback" | "is_link_local" | "nslookup" | "geoip_lookup" | "geoip" | "geo" | "any" | "all" | "avg" | "average" | "sum" | "min" | "max";
 export type TqlAggregationFunction = "count" | "sum" | "avg" | "average" | "mean" | "median" | "med" | "min" | "max" | "percentile" | "percentiles" | "p" | "pct" | "percentile_rank" | "percentile_ranks" | "pct_rank" | "pct_ranks" | "std" | "standard_deviation" | "unique_count" | "cardinality" | "values" | "unique" | "distinct";
 export type TqlTypeHint = "string" | "str" | "number" | "int" | "integer" | "float" | "double" | "decimal" | "date" | "bool" | "boolean" | "array" | "list" | "object" | "geo";
-export type TqlVisualizationType = "bar" | "barchart" | "line" | "area" | "pie" | "donut" | "scatter" | "heatmap" | "treemap" | "sunburst" | "table" | "number" | "gauge" | "map" | "grouped_bar" | "stacked_bar" | "nested_pie" | "nested_donut" | "chord";
+export type TqlVisualizationType = "bar" | "barchart" | "horizontal_bar" | "line" | "area" | "stacked_area" | "pie" | "donut" | "scatter" | "heatmap" | "treemap" | "sunburst" | "table" | "number" | "gauge" | "map" | "grouped_bar" | "stacked_bar" | "nested_pie" | "nested_donut" | "chord" | "auto";
+/**
+ * Visualization parameters (e.g., title="Events", stacked=true).
+ */
+export interface TqlVizParams {
+    title?: string;
+    x_label?: string;
+    y_label?: string;
+    legend?: string;
+    stacked?: boolean;
+    donut?: boolean;
+    fill?: boolean;
+    smooth?: boolean;
+    limit?: number;
+    [key: string]: string | number | boolean | undefined;
+}
+/**
+ * Full visualization hint with type and optional parameters.
+ */
+export interface TqlVizHint {
+    type: TqlVisualizationType;
+    params?: TqlVizParams;
+}
 export interface TqlParseResult {
     ast: TqlExpression | null;
     tokens: TqlToken[];