@tellaro/tql 1.4.3 → 2.0.0

package/dist/src/completionProvider.js

@@ -1,7 +1,8 @@
-import { tokenizeTql as x, COMPARISON_OPERATORS as N, LOGICAL_OPERATORS as S, AGGREGATION_FUNCTIONS as I, VISUALIZATION_TYPES as A, TYPE_HINTS as L, MUTATORS as R } from "./tokenizer.js";
-import { fuzzyMatch as w } from "./fuzzyMatcher.js";
-import { getSchemaCache as $ } from "./schemaCache.js";
-const P = [
+import { BOOLEAN_PREDICATE_MUTATORS as L, tokenizeTql as T, COMPARISON_OPERATORS as E, LOGICAL_OPERATORS as R, AGGREGATION_FUNCTIONS as P, VISUALIZATION_TYPES as $, TYPE_HINTS as D, MUTATORS as M } from "./tokenizer.js";
+import { fuzzyMatch as _ } from "./fuzzyMatcher.js";
+import { getSchemaCache as S } from "./schemaCache.js";
+import { ALL_FIELD_TYPES as u, BETWEEN_FIELD_TYPES as w, ORDERED_FIELD_TYPES as f } from "./validator.js";
+const z = [
   {
     label: "Simple equality",
     insertText: 'field eq "value"',
@@ -104,13 +105,25 @@ const P = [
     description: "Top 10 results by count",
     category: "Stats"
   }
-], D = {
+], U = {
   eq: { detail: "Equals", documentation: "Exact match comparison" },
   ne: { detail: "Not equals", documentation: "Match any value except this one" },
-  gt: { detail: "Greater than", documentation: "Numeric/date comparison" },
-  gte: { detail: "Greater than or equal", documentation: "Numeric/date comparison" },
-  lt: { detail: "Less than", documentation: "Numeric/date comparison" },
-  lte: { detail: "Less than or equal", documentation: "Numeric/date comparison" },
+  gt: {
+    detail: "Greater than",
+    documentation: "Ordered comparison. Numbers and dates compare numerically; two STRINGS compare lexicographically. An array-valued field matches if ANY element does."
+  },
+  gte: {
+    detail: "Greater than or equal",
+    documentation: "Ordered comparison. Numbers and dates compare numerically; two STRINGS compare lexicographically. An array-valued field matches if ANY element does."
+  },
+  lt: {
+    detail: "Less than",
+    documentation: "Ordered comparison. Numbers and dates compare numerically; two STRINGS compare lexicographically. An array-valued field matches if ANY element does."
+  },
+  lte: {
+    detail: "Less than or equal",
+    documentation: "Ordered comparison. Numbers and dates compare numerically; two STRINGS compare lexicographically. An array-valued field matches if ANY element does."
+  },
   contains: { detail: "Contains substring", documentation: "Case-insensitive substring match" },
   not_contains: { detail: "Does not contain", documentation: "Negative substring match" },
   startswith: { detail: "Starts with", documentation: "Match prefix of field value" },
@@ -123,23 +136,47 @@ const P = [
   not_regex: { detail: "Not matching regex", documentation: "Alias for not_regexp" },
   matches: { detail: "Pattern match", documentation: "Match using pattern" },
   not_matches: { detail: "Not matching pattern", documentation: "Negative pattern match" },
-  between: { detail: "Between range", documentation: "Usage: field between A AND B" },
+  between: {
+    detail: "Between range",
+    documentation: "Inclusive range. Usage: field between A AND B, or field between [A, B]. Numeric bounds compare numerically; STRING bounds compare lexicographically, matching the range query this becomes on a keyword field."
+  },
   not_between: { detail: "Not between range", documentation: "Exclude values in range" },
   in: { detail: "In list", documentation: 'Usage: field in ["a", "b", "c"]' },
   not_in: { detail: "Not in list", documentation: "Exclude values in list" },
-  exists: { detail: "Field exists", documentation: "Check if field has any value" },
-  not_exists: { detail: "Field not exists", documentation: "Check if field is missing or null" },
-  is: { detail: "Is null check", documentation: "Usage: field is null" },
-  is_not: { detail: "Is not null check", documentation: "Usage: field is_not null" },
+  exists: {
+    detail: "Field exists",
+    documentation: "Field HAS A VALUE. An empty array [] counts as present."
+  },
+  not_exists: {
+    detail: "Field not exists",
+    documentation: "Field HAS NO VALUE — absent, or present and explicitly null. Identical to `field is null`. An empty array [] does NOT satisfy it."
+  },
+  is: {
+    detail: "Is null check",
+    documentation: "Usage: field is null. Means the field HAS NO VALUE — absent, OR present and explicitly null — so it is identical to `field not exists`. An empty array [] is a PRESENT value and does not satisfy it."
+  },
+  is_not: {
+    detail: "Is not null check",
+    documentation: "Usage: field is_not null (or `field is not null`). The exact complement of `is null`, and identical to `field exists`."
+  },
   cidr: { detail: "CIDR match", documentation: "Match IP addresses in CIDR range (IP fields only)" },
   not_cidr: { detail: "Not in CIDR", documentation: "Exclude IPs in CIDR range" },
-  any: { detail: "Any element matches", documentation: "True if any array element matches" },
-  all: { detail: "All elements match", documentation: "True if all array elements match" },
-  none: { detail: "No elements match", documentation: "True if no array elements match" },
+  any: {
+    detail: "Any element matches",
+    documentation: "True if any element matches. A SCALAR field is treated as a one-element collection, so `any` works on non-array fields too."
+  },
+  all: {
+    detail: "All elements match",
+    documentation: "True if every element matches. A scalar field is treated as a one-element collection."
+  },
+  none: {
+    detail: "No elements match",
+    documentation: "True if no element matches. A scalar field is treated as a one-element collection."
+  },
   not_any: { detail: "Not any matches", documentation: "Negation of any" },
   not_all: { detail: "Not all match", documentation: "Negation of all" },
   not_none: { detail: "Not none match", documentation: "Negation of none" }
-}, M = {
+}, F = {
   lowercase: { detail: "Convert to lowercase", documentation: "Transform string to lowercase" },
   uppercase: { detail: "Convert to uppercase", documentation: "Transform string to uppercase" },
   trim: { detail: "Trim whitespace", documentation: "Remove leading/trailing whitespace" },
@@ -155,8 +192,14 @@ const P = [
   sha256: { detail: "SHA256 hash", documentation: "Calculate SHA256 hash" },
   refang: { detail: "Refang IOC", documentation: "Convert defanged URL/IP to normal form" },
   defang: { detail: "Defang IOC", documentation: "Convert URL/IP to safe defanged form" },
-  is_private: { detail: "Is private IP", documentation: "Check if IP is RFC1918/private" },
-  is_global: { detail: "Is global IP", documentation: "Check if IP is globally routable" },
+  is_private: {
+    detail: "Is private IP",
+    documentation: "True if the IP is not globally reachable: RFC1918, loopback, link-local, IPv6 ULA, TEST-NET-1/2/3, benchmarking (198.18/15), class E (240/4) and 2001:db8::/32. NOT true for CGNAT 100.64/10, which is neither private nor global."
+  },
+  is_global: {
+    detail: "Is global IP",
+    documentation: "True only if the IP is genuinely routable. Not the inverse of is_private: CGNAT 100.64/10 and multicast are neither private nor global."
+  },
   nslookup: { detail: "DNS lookup", documentation: "Perform DNS lookup on hostname/IP" },
   geoip_lookup: { detail: "GeoIP lookup", documentation: "Get geolocation data for IP" },
   geoip: { detail: "GeoIP lookup", documentation: "Alias for geoip_lookup" },
@@ -168,7 +211,7 @@ const P = [
   sum: { detail: "Sum", documentation: "Sum of numeric array elements" },
   min: { detail: "Minimum", documentation: "Minimum value in array" },
   max: { detail: "Maximum", documentation: "Maximum value in array" }
-}, h = {
+}, g = {
   // String outputs
   lowercase: "keyword",
   uppercase: "keyword",
@@ -185,8 +228,20 @@ const P = [
   defang: "keyword",
   nslookup: "keyword",
   // Boolean outputs
-  is_private: "boolean",
-  is_global: "boolean",
+  //
+  // SPREAD, not listed. This table used to name `is_private` and `is_global` by hand and
+  // stop there, so `is_loopback`, `is_multicast` and `is_link_local` — the three predicates
+  // added later — fell through to no declared output type and were offered the operator set
+  // for an unknown field. That is the identical omission Python made in three copies of its
+  // predicate list, and the reason both engines now derive the set instead of writing it out.
+  // There is exactly one JS copy, in `tokenizer.ts`, pinned against both engines by
+  // `tests/booleanPredicateSugar.spec.ts`.
+  ...Object.fromEntries(
+    L.map((e) => [e, "boolean"])
+  ),
+  // `any` and `all` are collection OPERATORS rather than predicates — absent from both
+  // engines' predicate sets, and not eligible for the `field | <name>` filter sugar — so
+  // they are declared here and not folded into the set above.
   any: "boolean",
   all: "boolean",
   // Number outputs
@@ -202,23 +257,32 @@ const P = [
   geo: "object",
   // Array output (returns array of strings)
   split: "keyword"
-}, z = {
-  // Universal operators (work with all types)
-  eq: ["text", "keyword", "long", "integer", "double", "float", "date", "boolean", "ip"],
-  ne: ["text", "keyword", "long", "integer", "double", "float", "date", "boolean", "ip"],
-  exists: ["text", "keyword", "long", "integer", "double", "float", "date", "boolean", "ip", "nested", "object"],
-  not_exists: ["text", "keyword", "long", "integer", "double", "float", "date", "boolean", "ip", "nested", "object"],
-  is: ["text", "keyword", "long", "integer", "double", "float", "date", "boolean", "ip"],
-  is_not: ["text", "keyword", "long", "integer", "double", "float", "date", "boolean", "ip"],
-  in: ["text", "keyword", "long", "integer", "double", "float", "date", "boolean", "ip"],
-  not_in: ["text", "keyword", "long", "integer", "double", "float", "date", "boolean", "ip"],
-  // Comparison operators (numeric + date only)
-  gt: ["long", "integer", "double", "float", "date"],
-  gte: ["long", "integer", "double", "float", "date"],
-  lt: ["long", "integer", "double", "float", "date"],
-  lte: ["long", "integer", "double", "float", "date"],
-  between: ["long", "integer", "double", "float", "date"],
-  not_between: ["long", "integer", "double", "float", "date"],
+}, G = {
+  // Equality and membership — every field type, by NAME rather than by a transcribed list.
+  eq: u,
+  ne: u,
+  in: u,
+  not_in: u,
+  // Existence. `is null` is the SAME PREDICATE as `not exists`, so these four lists must be
+  // equal. They were not: `nested` and `object` were offered for `exists` and withheld from
+  // `is`, so the completion menu published one of two spellings of one operation depending
+  // on the field type. Pinned by `tests/collectionAndNullSemantics.spec.ts`.
+  exists: u,
+  not_exists: u,
+  is: u,
+  is_not: u,
+  // Ordered comparison — numeric, date and keyword. See ORDERED_FIELD_TYPES in
+  // `validator.ts`: both evaluators fall back to a lexicographic string comparison, and
+  // Python's own validator lists all four in `keyword_ops`. Withholding them from a keyword
+  // field's menu hid an operator every layer of the product supports.
+  gt: f,
+  gte: f,
+  lt: f,
+  lte: f,
+  // Numeric and date. `keyword` and `text` stay out because Python's `keyword_ops` excludes
+  // `between` while including `gte` — see BETWEEN_FIELD_TYPES in `validator.ts`.
+  between: w,
+  not_between: w,
   // String operators (text/keyword only)
   contains: ["text", "keyword"],
   not_contains: ["text", "keyword"],
@@ -235,12 +299,27 @@ const P = [
   // IP-specific operators
   cidr: ["ip"],
   not_cidr: ["ip"],
-  // Collection operators
-  any: ["nested", "object", "keyword"],
-  all: ["nested", "object", "keyword"],
-  none: ["nested", "object", "keyword"]
+  // Collection operators — every field type, and their negated forms stated explicitly.
+  //
+  // Two defects in four lines. `any`/`all`/`none` were restricted to `nested | object |
+  // keyword`, so the menu withheld them from an `ip` or `long` field — while both
+  // evaluators now treat a SCALAR as a one-element collection and iterate array-valued
+  // fields regardless of mapping type. `related.ip any [...]` is the ordinary case for an IP
+  // field: OpenSearch has no array type, so ECS's array guarantees live on ordinary `ip` and
+  // `keyword` mappings.
+  //
+  // And `not_any`/`not_all`/`not_none` were absent from this table entirely, which the
+  // filter reads as "no restriction" — so the negated halves were offered on every type
+  // while their positive twins were withheld. Permissive by omission is not the same as
+  // permissive by decision, and only one of them survives someone reading the table.
+  any: u,
+  all: u,
+  none: u,
+  not_any: u,
+  not_all: u,
+  not_none: u
 };
-class E {
+class B {
   cache = /* @__PURE__ */ new Map();
   maxSize = 50;
   maxAge = 5e3;
@@ -262,149 +341,151 @@ class E {
     this.cache.clear();
   }
 }
-const k = new E();
-function U(e, t, i) {
+const k = new B();
+function V(e, t, i) {
   if (!e) return { type: "start", partialText: "" };
-  const o = `${e.substring(0, t)}|${t}`, a = k.get(o);
+  const o = S().get(i)?.hash ?? "-", n = `${e.substring(0, t)}|${t}|${o}`, a = k.get(n);
   if (a)
-    return a.fieldName && !a.fieldType && i && (a.fieldType = p(a.fieldName, i)), a;
-  const n = F(e, t, i);
-  return k.set(o, n), n;
+    return a.fieldName && !a.fieldType && i && (a.fieldType = h(a.fieldName, i)), a;
+  const s = Y(e, t, i);
+  return k.set(n, s), s;
 }
-function F(e, t, i) {
-  const a = x(e.substring(0, t)).filter((l) => l.type !== "whitespace");
-  if (a.length === 0)
+function Y(e, t, i) {
+  const n = T(e.substring(0, t)).filter((l) => l.type !== "whitespace");
+  if (n.length === 0)
     return { type: "start" };
-  const n = a[a.length - 1], s = a.length > 1 ? a[a.length - 2] : null, u = n.end === t && !e[t - 1]?.match(/\s/), d = u ? n.value : void 0;
-  if (n.type === "logicalOp")
+  const a = n[n.length - 1], s = n.length > 1 ? n[n.length - 2] : null, c = a.end === t && !e[t - 1]?.match(/\s/), d = c ? a.value : void 0;
+  if (a.type === "logicalOp")
     return { type: "start" };
-  if (n.type === "paren" && n.value === "(") {
-    const l = a.length - 1, r = l > 0 ? a[l - 1] : null;
+  if (a.type === "paren" && a.value === "(") {
+    const l = n.length - 1, r = l > 0 ? n[l - 1] : null;
     if (r && r.type === "visualization")
       return { type: "in_viz_params" };
   }
-  if (n.type === "comma" || n.type === "field" && u) {
-    const l = a.indexOf(n);
+  if (a.type === "comma" || a.type === "field" && c) {
+    const l = n.indexOf(a);
     for (let r = l - 1; r >= 0; r--) {
-      if (a[r].type === "paren" && a[r].value === "(") {
-        if (r > 0 && a[r - 1].type === "visualization")
+      if (n[r].type === "paren" && n[r].value === "(") {
+        if (r > 0 && n[r - 1].type === "visualization")
           return { type: "in_viz_params", partialText: d };
         break;
       }
-      if (a[r].type === "paren" && a[r].value === ")") break;
+      if (n[r].type === "paren" && n[r].value === ")") break;
     }
   }
-  if (n.type === "paren" && n.value === "(")
+  if (a.type === "paren" && a.value === "(")
     return { type: "after_paren" };
-  if (n.type === "arrow")
+  if (a.type === "arrow")
     return { type: "after_arrow", partialText: d };
-  if (n.type === "doubleColon")
+  if (s?.type === "doubleColon" && c)
     return { type: "after_double_colon", partialText: d };
-  if (n.type === "visualization" && u)
+  if (a.type === "doubleColon")
+    return { type: "after_double_colon" };
+  if (a.type === "visualization" && c)
     return { type: "after_arrow", partialText: d };
-  if (n.type === "typeHint" && u)
+  if (a.type === "typeHint" && c)
     return { type: "after_double_colon", partialText: d };
-  if (n.type === "keyword" && n.value.toLowerCase() === "stats")
+  if (a.type === "keyword" && a.value.toLowerCase() === "stats")
     return { type: "after_stats", partialText: d };
-  if (n.type === "keyword" && n.value.toLowerCase() === "by")
+  if (a.type === "keyword" && a.value.toLowerCase() === "by")
     return { type: "after_by", partialText: d };
-  if (n.type === "paren" && n.value === ")") {
-    const l = a.indexOf(n);
+  if (a.type === "paren" && a.value === ")") {
+    const l = n.indexOf(a);
     for (let r = l - 1; r >= 0; r--) {
-      if (a[r].type === "keyword" && a[r].value.toLowerCase() === "stats")
+      if (n[r].type === "keyword" && n[r].value.toLowerCase() === "stats")
         return { type: "after_stats_agg" };
-      if (a[r].type === "keyword" && a[r].value.toLowerCase() === "by" || a[r].type === "pipe") break;
+      if (n[r].type === "keyword" && n[r].value.toLowerCase() === "by" || n[r].type === "pipe") break;
     }
   }
-  if (n.type === "field" && !u) {
-    const l = a.indexOf(n);
+  if (a.type === "field" && !c) {
+    const l = n.indexOf(a);
     for (let r = l - 1; r >= 0; r--) {
-      if (a[r].type === "keyword" && a[r].value.toLowerCase() === "by") {
-        for (let c = r - 1; c >= 0; c--) {
-          if (a[c].type === "keyword" && a[c].value.toLowerCase() === "stats")
+      if (n[r].type === "keyword" && n[r].value.toLowerCase() === "by") {
+        for (let m = r - 1; m >= 0; m--) {
+          if (n[m].type === "keyword" && n[m].value.toLowerCase() === "stats")
             return { type: "after_group_by_field" };
-          if (a[c].type === "pipe") break;
+          if (n[m].type === "pipe") break;
         }
         break;
       }
-      if (a[r].type === "pipe") break;
+      if (n[r].type === "pipe") break;
     }
   }
-  if (n.type === "pipe")
+  if (a.type === "pipe")
     return { type: "after_pipe", partialText: d };
-  if (n.type === "mutator") {
-    if (u)
+  if (a.type === "mutator") {
+    if (c)
       return { type: "after_pipe", partialText: d };
-    const l = n.value.toLowerCase(), r = h[l];
+    const l = a.value.toLowerCase(), r = g[l];
     return {
       type: "after_mutator",
       mutatorName: l,
       mutatorOutputType: r
     };
   }
-  if (n.type === "aggregation")
-    return u ? { type: "after_stats", partialText: d } : { type: "after_value" };
-  if (n.type === "field") {
-    if (u)
+  if (a.type === "aggregation")
+    return c ? { type: "after_stats", partialText: d } : { type: "after_value" };
+  if (a.type === "field") {
+    if (c)
       return s?.type === "pipe" ? { type: "after_pipe", partialText: d } : { type: "start", partialText: d };
     if (s?.type === "pipe")
-      return { type: "after_pipe", partialText: n.value };
-    const l = p(n.value, i);
-    return { type: "after_field", fieldName: n.value, fieldType: l };
+      return { type: "after_pipe", partialText: a.value };
+    const l = h(a.value, i);
+    return { type: "after_field", fieldName: a.value, fieldType: l };
   }
-  if (n.type === "operator") {
-    if (u) {
+  if (a.type === "operator") {
+    if (c) {
       if (s?.type === "field") {
-        const l = p(s.value, i);
+        const l = h(s.value, i);
         return { type: "after_field", fieldName: s.value, fieldType: l, partialText: d };
       }
       if (s?.type === "mutator") {
-        const l = s.value.toLowerCase(), r = h[l];
+        const l = s.value.toLowerCase(), r = g[l];
         return { type: "after_mutator", mutatorName: l, mutatorOutputType: r, partialText: d };
       }
     }
-    return { type: "after_operator", operatorName: n.value };
+    return { type: "after_operator", operatorName: a.value };
   }
-  if (n.type === "string" || n.type === "number" || n.type === "boolean" || n.type === "null")
-    return u ? { type: "at_value_end" } : { type: "after_value" };
-  if (n.type === "paren" && n.value === ")")
+  if (a.type === "string" || a.type === "number" || a.type === "boolean" || a.type === "null")
+    return c ? { type: "at_value_end" } : { type: "after_value" };
+  if (a.type === "paren" && a.value === ")")
     return { type: "after_value" };
-  if (s?.type === "field" && u) {
-    const l = p(s.value, i);
+  if (s?.type === "field" && c) {
+    const l = h(s.value, i);
     return { type: "after_field", fieldName: s.value, fieldType: l, partialText: d };
   }
-  if (s?.type === "mutator" && u) {
-    const l = s.value.toLowerCase(), r = h[l];
+  if (s?.type === "mutator" && c) {
+    const l = s.value.toLowerCase(), r = g[l];
     return { type: "after_mutator", mutatorName: l, mutatorOutputType: r, partialText: d };
   }
   return { type: "unknown", partialText: d };
 }
-function p(e, t) {
-  return t ? $().getFieldType(t, e) : void 0;
+function h(e, t) {
+  return t ? S().getFieldType(t, e) : void 0;
 }
-function Q(e, t = {}) {
-  const { query: i, cursorPosition: o } = e, a = U(i, o, t.fields), n = [];
-  switch (a.type) {
+function ie(e, t = {}) {
+  const { query: i, cursorPosition: o } = e, n = V(i, o, t.fields), a = [];
+  switch (n.type) {
     case "start":
     case "after_paren":
-      n.push(...g(t.fields, a.partialText)), n.push(O("NOT")), t.includeSnippets !== !1 && n.push(...B(t, a.partialText));
+      a.push(...x(t.fields, n.partialText)), a.push(I("NOT")), t.includeSnippets !== !1 && a.push(...K(t, n.partialText));
       break;
     case "after_field":
-      n.push(...y(a.partialText, a.fieldType));
+      a.push(...b(n.partialText, n.fieldType));
       break;
     case "after_mutator":
-      n.push(...y(a.partialText, a.mutatorOutputType));
+      a.push(...b(n.partialText, n.mutatorOutputType));
       break;
     case "after_operator":
-      n.push(...j(a.fieldName, t));
+      a.push(...j(n.fieldName, t));
       break;
     case "after_value":
-      n.push(..._());
+      a.push(...C());
       break;
     case "at_value_end":
       break;
     case "after_pipe":
-      n.push(...V(a.partialText)), (!a.partialText || "stats".includes(a.partialText.toLowerCase())) && n.push({
+      a.push(...W(n.partialText)), (!n.partialText || "stats".includes(n.partialText.toLowerCase())) && a.push({
         label: "stats",
         insertText: "stats ",
         kind: "keyword",
@@ -414,13 +495,13 @@ function Q(e, t = {}) {
       });
       break;
     case "after_stats_agg":
-      n.push({
+      a.push({
         label: "by",
         insertText: "by ",
         kind: "keyword",
         detail: "Group results by field",
         sortOrder: 1
-      }), n.push({
+      }), a.push({
         label: "=>",
         insertText: "=> ",
         kind: "visualization",
@@ -429,13 +510,13 @@ function Q(e, t = {}) {
       });
       break;
     case "after_group_by_field":
-      n.push({
+      a.push({
         label: "=>",
         insertText: "=> ",
         kind: "visualization",
         detail: "Set visualization type (bar, pie, line, ...)",
         sortOrder: 1
-      }), n.push({
+      }), a.push({
         label: ",",
         insertText: ", ",
         kind: "keyword",
@@ -444,61 +525,61 @@ function Q(e, t = {}) {
       });
       break;
     case "after_double_colon":
-      n.push(...H(a.partialText));
+      a.push(...Z(n.partialText));
       break;
     case "after_arrow":
-      n.push(...Y(a.partialText));
+      a.push(...X(n.partialText));
       break;
     case "in_viz_params":
-      n.push(...W(a.partialText));
+      a.push(...Q(n.partialText));
       break;
     case "after_stats":
-      n.push(...C(a.partialText));
+      a.push(...O(n.partialText));
       break;
     case "after_by":
-      n.push(...g(t.fields, a.partialText));
+      a.push(...x(t.fields, n.partialText));
       break;
     default:
-      n.push(...g(t.fields, a.partialText)), n.push(...y(a.partialText)), n.push(..._());
+      a.push(...x(t.fields, n.partialText)), a.push(...b(n.partialText)), a.push(...C());
   }
-  t.includeAggregations && a.type === "start" && n.push(...C(a.partialText));
-  let s = n;
-  const u = t.fuzzyMatching !== !1, d = t.minFuzzyScore ?? 0;
-  if (a.partialText) {
-    const l = a.partialText.toLowerCase();
-    if (u) {
+  t.includeAggregations && n.type === "start" && a.push(...O(n.partialText));
+  let s = a;
+  const c = t.fuzzyMatching !== !1, d = t.minFuzzyScore ?? 0;
+  if (n.partialText) {
+    const l = n.partialText.toLowerCase();
+    if (c) {
       const r = [];
-      for (const c of n) {
-        const m = w(l, c.label), b = c.filterText ? w(l, c.filterText) : { matched: !1, score: 0 }, f = m.score >= b.score ? m : b;
-        f.matched && f.score >= d && r.push({
-          ...c,
-          matchScore: f.score,
-          matchedIndices: m.matched ? m.matchedIndices : void 0
+      for (const m of a) {
+        const p = _(l, m.label), v = m.filterText ? _(l, m.filterText) : { matched: !1, score: 0 }, y = p.score >= v.score ? p : v;
+        y.matched && y.score >= d && r.push({
+          ...m,
+          matchScore: y.score,
+          matchedIndices: p.matched ? p.matchedIndices : void 0
         });
       }
       s = r;
     } else
-      s = n.filter(
+      s = a.filter(
         (r) => r.label.toLowerCase().includes(l) || r.filterText?.toLowerCase().includes(l)
       );
   }
   return s.sort((l, r) => l.matchScore !== void 0 && r.matchScore !== void 0 && r.matchScore !== l.matchScore ? r.matchScore - l.matchScore : l.sortOrder - r.sortOrder), t.maxItems && t.maxItems > 0 && (s = s.slice(0, t.maxItems)), s;
 }
-function g(e, t) {
+function x(e, t) {
   if (!e || e.length === 0)
-    return G(t);
+    return q(t);
   const i = [];
   for (const o of e) {
-    const a = v(o);
-    if (i.push(a), o.nested)
-      for (const n of o.nested) {
-        const s = v(n, o.name);
+    const n = N(o);
+    if (i.push(n), o.nested)
+      for (const a of o.nested) {
+        const s = N(a, o.name);
         i.push(s);
       }
   }
   return i;
 }
-function G(e) {
+function q(e) {
   return [
     { name: "hostname", description: "Host/machine name" },
     { name: "status", description: "Status value" },
@@ -524,7 +605,7 @@ function G(e) {
     sortOrder: 10
   }));
 }
-function v(e, t) {
+function N(e, t) {
   const i = t ? `${t}.${e.name}` : e.name;
   return {
     label: i,
@@ -536,24 +617,24 @@ function v(e, t) {
     sortOrder: 10
   };
 }
-function y(e, t) {
-  let i = [...N];
+function b(e, t) {
+  let i = [...E];
   return t && (i = i.filter((o) => {
-    const a = z[o];
-    return !a || a.includes(t);
-  })), e && (i = i.filter((o) => o.toLowerCase().includes(e.toLowerCase()))), i.map((o, a) => {
-    const n = D[o] || { detail: o, documentation: "" }, s = q(o, t);
+    const n = G[o];
+    return !n || n.includes(t);
+  })), e && (i = i.filter((o) => o.toLowerCase().includes(e.toLowerCase()))), i.map((o, n) => {
+    const a = U[o] || { detail: o, documentation: "" }, s = H(o, t);
     return {
       label: o,
       insertText: s,
       kind: "operator",
-      detail: n.detail,
-      documentation: n.documentation,
-      sortOrder: 20 + a
+      detail: a.detail,
+      documentation: a.documentation,
+      sortOrder: 20 + n
     };
   });
 }
-function q(e, t) {
+function H(e, t) {
   const i = [
     "contains",
     "not_contains",
@@ -567,12 +648,12 @@ function q(e, t) {
     "not_regex",
     "matches",
     "not_matches"
-  ], o = ["exists", "not_exists"], a = ["is", "is_not"];
+  ], o = ["exists", "not_exists"], n = ["is", "is_not"];
   if (e === "in" || e === "not_in")
-    return T(t) ? `${e} [$1]` : `${e} ["$1"]`;
+    return A(t) ? `${e} [$1]` : `${e} ["$1"]`;
   if (e === "between" || e === "not_between")
-    return T(t) ? `${e} $1 AND $2` : `${e} "$1" AND "$2"`;
-  if (a.includes(e))
+    return A(t) ? `${e} $1 AND $2` : `${e} "$1" AND "$2"`;
+  if (n.includes(e))
     return `${e} null`;
   if (o.includes(e))
     return e;
@@ -605,15 +686,15 @@ function q(e, t) {
       return `${e} `;
   }
 }
-function T(e) {
+function A(e) {
   return e === "long" || e === "integer" || e === "double" || e === "float" || e === "short" || e === "byte" || e === "half_float" || e === "scaled_float" || e === "unsigned_long";
 }
-function _() {
-  return S.filter((e) => e !== "NOT").map(
-    (e, t) => O(e, t)
+function C() {
+  return R.filter((e) => e !== "NOT").map(
+    (e, t) => I(e, t)
   );
 }
-function O(e, t = 0) {
+function I(e, t = 0) {
   return {
     label: e,
     insertText: e + " ",
@@ -624,13 +705,13 @@ function O(e, t = 0) {
 }
 function j(e, t) {
   const i = [];
-  return e && t?.fieldValues?.[e] && t.fieldValues[e].forEach((a, n) => {
+  return e && t?.fieldValues?.[e] && t.fieldValues[e].forEach((n, a) => {
     i.push({
-      label: a,
-      insertText: `"${a}"`,
+      label: n,
+      insertText: `"${n}"`,
       kind: "value",
       detail: `Known value for ${e}`,
-      sortOrder: 40 + n
+      sortOrder: 40 + a
     });
   }), i.push(
     {
@@ -663,20 +744,20 @@ function j(e, t) {
     }
   ), i;
 }
-function B(e, t) {
-  return P.filter((o) => !t || o.label.toLowerCase().includes(t.toLowerCase())).map((o, a) => ({
+function K(e, t) {
+  return z.filter((o) => !t || o.label.toLowerCase().includes(t.toLowerCase())).map((o, n) => ({
     label: o.label,
     insertText: o.insertText,
     kind: "snippet",
     detail: o.description,
     documentation: `Insert: ${o.insertText}`,
-    sortOrder: 100 + a
+    sortOrder: 100 + n
   }));
 }
-function V(e) {
-  return R.filter((t) => !e || t.toLowerCase().includes(e.toLowerCase())).map(
+function W(e) {
+  return M.filter((t) => !e || t.toLowerCase().includes(e.toLowerCase())).map(
     (t, i) => {
-      const o = M[t] || { detail: "Field mutator", documentation: "" };
+      const o = F[t] || { detail: "Field mutator", documentation: "" };
       return {
         label: t,
         insertText: t,
@@ -688,8 +769,8 @@ function V(e) {
     }
   );
 }
-function C(e) {
-  return I.filter(
+function O(e) {
+  return P.filter(
     (t) => !e || t.toLowerCase().includes(e.toLowerCase())
   ).map((t, i) => ({
     label: t,
@@ -699,8 +780,8 @@ function C(e) {
     sortOrder: 70 + i
   }));
 }
-function H(e) {
-  return L.filter(
+function Z(e) {
+  return D.filter(
     (t) => !e || t.toLowerCase().includes(e.toLowerCase())
   ).map((t, i) => ({
     label: t,
@@ -710,8 +791,8 @@ function H(e) {
     sortOrder: 80 + i
   }));
 }
-function Y(e) {
-  return A.filter(
+function X(e) {
+  return $.filter(
     (t) => !e || t.toLowerCase().includes(e.toLowerCase())
   ).map((t, i) => ({
     label: t,
@@ -721,7 +802,7 @@ function Y(e) {
     sortOrder: 90 + i
   }));
 }
-const K = [
+const J = [
   // Titles & labels
   { name: "title", detail: "Chart title", insertText: 'title="' },
   { name: "x_label", detail: "X-axis label", insertText: 'x_label="' },
@@ -757,8 +838,8 @@ const K = [
   { name: "link", detail: 'Template URL for value links: "https://...{{value}}"', insertText: 'link="' },
   { name: "link_target", detail: "Link target: _self (default) or _blank", insertText: "link_target=" }
 ];
-function W(e) {
-  return K.filter(
+function Q(e) {
+  return J.filter(
     (t) => !e || t.name.toLowerCase().includes(e.toLowerCase())
   ).map((t, i) => ({
     label: t.name,
@@ -768,9 +849,9 @@ function W(e) {
     sortOrder: 95 + i
   }));
 }
-function ee(e, t) {
-  const o = x(e).find(
-    (a) => a.start <= t && a.end >= t && a.type !== "whitespace"
+function re(e, t) {
+  const o = T(e).find(
+    (n) => n.start <= t && n.end >= t && n.type !== "whitespace"
   );
   return o ? {
     word: o.value,
@@ -778,18 +859,18 @@ function ee(e, t) {
     end: o.end
   } : null;
 }
-function te() {
+function oe() {
   return [" ", "(", ".", '"', "'", "|", ":", "="];
 }
-function ae(e, t, i) {
+function le(e, t, i) {
   if (!e) return !1;
   if (i === " " || i === "(" || i === "." || i === "|" || i === ":" || i === "=") return !0;
-  const o = x(e.substring(0, t)), a = o[o.length - 1];
-  return !!(a && a.type === "field" && a.value.length >= 2);
+  const o = T(e.substring(0, t)), n = o[o.length - 1];
+  return !!(n && n.type === "field" && n.value.length >= 2);
 }
 export {
-  te as getCompletionTriggerCharacters,
-  Q as getCompletions,
-  ee as getWordAtPosition,
-  ae as shouldTriggerCompletion
+  oe as getCompletionTriggerCharacters,
+  ie as getCompletions,
+  re as getWordAtPosition,
+  le as shouldTriggerCompletion
 };