tellaro-query-language 0.2.6__py3-none-any.whl → 0.2.8__py3-none-any.whl

{tellaro_query_language-0.2.6.dist-info → tellaro_query_language-0.2.8.dist-info}/METADATA

@@ -1,9 +1,9 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: tellaro-query-language
-Version: 0.2.6
+Version: 0.2.8
 Summary: A flexible, human-friendly query language for searching and filtering structured data
-Home-page: https://github.com/tellaro/tellaro-query-language
 License: Proprietary
+License-File: LICENSE
 Keywords: query,language,opensearch,elasticsearch,search,filter,tql
 Author: Justin Henderson
 Author-email: justin@tellaro.io
@@ -18,14 +18,15 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Text Processing :: Linguistic
 Provides-Extra: opensearch
-Requires-Dist: dnspython (>=2.7.0,<3.0.0)
-Requires-Dist: maxminddb (>=2.7.0,<3.0.0)
+Requires-Dist: dnspython (>=2.8.0,<3.0.0)
+Requires-Dist: maxminddb (>=3.0.0,<4.0.0)
 Requires-Dist: opensearch-dsl (>=2.1.0,<3.0.0) ; extra == "opensearch"
-Requires-Dist: opensearch-py (>=2.4.2,<3.0.0) ; extra == "opensearch"
-Requires-Dist: pyparsing (>=3.2.1,<4.0.0)
-Requires-Dist: setuptools (>=80.0.0,<81.0.0)
-Requires-Dist: urllib3 (>=2.5.0,<3.0.0)
+Requires-Dist: opensearch-py (>=2.8.0,<3.0.0) ; extra == "opensearch"
+Requires-Dist: pyparsing (>=3.3.0,<4.0.0)
+Requires-Dist: setuptools (>=80.9.0,<81.0.0)
+Requires-Dist: urllib3 (>=2.6.0,<3.0.0)
 Project-URL: Documentation, https://github.com/tellaro/tellaro-query-language/tree/main/docs
+Project-URL: Homepage, https://github.com/tellaro/tellaro-query-language
 Project-URL: Repository, https://github.com/tellaro/tellaro-query-language
 Description-Content-Type: text/markdown
 

{tellaro_query_language-0.2.6.dist-info → tellaro_query_language-0.2.8.dist-info}/RECORD

@@ -17,7 +17,7 @@ tql/evaluator_components/README.md,sha256=c59yf2au34yPhrru7JWgGop_ORteB6w5vfMhsa
 tql/evaluator_components/__init__.py,sha256=DourRUSYXWPnCghBFj7W0YfMeymT3X8YTDCwnLIyP1c,535
 tql/evaluator_components/field_access.py,sha256=BuXvL9jlv4H77neT70Vh7_qokmzs-d4EbSDA2FB1IT0,6435
 tql/evaluator_components/special_expressions.py,sha256=prhXnVRnFfmecgmuTz0fsefTA1clb2eyyYf-zPtzXGs,15703
-tql/evaluator_components/value_comparison.py,sha256=a0Vo3BWyPxMtEgAKtUuaN0HN9Arc0A7BUVrxgZyH6_o,21200
+tql/evaluator_components/value_comparison.py,sha256=k4-4AnNSvVXkCF-ZdmhBpwLaMC_vajAv5m8BjIinni8,21276
 tql/exceptions.py,sha256=GVssdBp9134Wyk1bWbcLQFU9U8yQKl5zzquTTrM22A0,5620
 tql/field_type_inference.py,sha256=KOazjp8CK6s9vwOcFkQrdOwcazOwHqSIhYgX8hWCiDo,9700
 tql/geoip_normalizer.py,sha256=tvie-5xevJEeLp2KmjoXDjYdND8AvyVE7lCO8qgUzGY,10486
@@ -39,21 +39,21 @@ tql/opensearch_components/lucene_converter.py,sha256=OvYTZHNBktPGow1fsVm4TMlvxHS
 tql/opensearch_components/query_converter.py,sha256=INjX6hd-1dlCdCn_dGSBnub2mpNyUBpHXhHA5WoBQX4,41985
 tql/opensearch_mappings.py,sha256=sVLlQlE3eGD7iNNZ_m4F4j5GVzQAJhZyCqDKYRhLRh8,11531
 tql/opensearch_stats.py,sha256=sxJ4KziV-Yv1kvjo22souxjBQH3chmlm4lAgEhRBtyA,24530
-tql/parser.py,sha256=y4LKYuNqE74Xx5UpHZBZE6PlVaRBiwr5i49NeMJW-jU,80383
+tql/parser.py,sha256=wQHoy9OPCNw80hlqOkFZOaNW8_RbuAUen41J0c6t6ms,83696
 tql/parser_components/README.md,sha256=lvQX72ckq2zyotGs8QIHHCIFqaA7bOHwkP44wU8Zoiw,2322
 tql/parser_components/__init__.py,sha256=zBwHBMPJyHSBbaOojf6qTrJYjJg5A6tPUE8nHFdRiQs,521
 tql/parser_components/ast_builder.py,sha256=erHoeKAMzobswoRIXB9xcsZbzQ5-2ZwaYfQgRWoUAa8,9653
 tql/parser_components/error_analyzer.py,sha256=qlCD9vKyW73aeKQYI33P1OjIWSJ3LPd08wuN9cis2fU,4012
 tql/parser_components/field_extractor.py,sha256=eUEkmiYWX2OexanFqhHeX8hcIkRlfIcgMB667e0HRYs,4629
-tql/parser_components/grammar.py,sha256=h58RBshZHXgbP1EmNwmf7dny-fgVloNg-qN4Rivross,20599
+tql/parser_components/grammar.py,sha256=vEPiYOMMk-a6Xzz0y6kjRzyq4slwBG5T9YDeBg1txAk,21460
 tql/post_processor.py,sha256=5w_rP0V-t3AC7iAFLnlDxUtawcDFovbhbRsoZxt9yP4,51787
 tql/scripts.py,sha256=DUY0H5IoGs_CNdG_oxITvLiCNVsogb2RJqUs2xXOs24,4319
 tql/stats_evaluator.py,sha256=2qnjeH5Qx14qpHDS_YJn9jRPeoPUfkeiYJabBagdfRs,36126
 tql/stats_transformer.py,sha256=MT-4rDWZSySgn4Fuq9H0c-mvwFYLM6FqWpPv2rHX-rE,7588
 tql/streaming_file_processor.py,sha256=cftWhYcvUo984P3ALf2CO3FoCQPJPe_2s2HLcXTp5UQ,12437
 tql/validators.py,sha256=e9MlX-zQ_O3M8YP8vXyMjKU8iiJMTh6mMK0iv0_4gTY,3771
-tellaro_query_language-0.2.6.dist-info/LICENSE,sha256=eWf8lkuXlVX_8WiDpUgQvzxc1cxCeVne_e6P-pVJpwM,3038
-tellaro_query_language-0.2.6.dist-info/METADATA,sha256=FJV1TPy9q1SQt0eReXeVJw8XcMr2-OkGMEMF9Y99J5Q,21857
-tellaro_query_language-0.2.6.dist-info/WHEEL,sha256=sP946D7jFCHeNz5Iq4fL4Lu-PrWrFsgfLXbbkciIZwg,88
-tellaro_query_language-0.2.6.dist-info/entry_points.txt,sha256=D0lbIGUYuDyfcYeqju1rWcMBFzft4sZtfIlw5uPNx5g,181
-tellaro_query_language-0.2.6.dist-info/RECORD,,
+tellaro_query_language-0.2.8.dist-info/METADATA,sha256=NwgXSoSzBB6oDL-aBxAnjwB46BWYiwbi_D16TMoBjE8,21891
+tellaro_query_language-0.2.8.dist-info/WHEEL,sha256=3ny-bZhpXrU6vSQ1UPG34FoxZBp3lVcvK0LkgUz6VLk,88
+tellaro_query_language-0.2.8.dist-info/entry_points.txt,sha256=D0lbIGUYuDyfcYeqju1rWcMBFzft4sZtfIlw5uPNx5g,181
+tellaro_query_language-0.2.8.dist-info/licenses/LICENSE,sha256=eWf8lkuXlVX_8WiDpUgQvzxc1cxCeVne_e6P-pVJpwM,3038
+tellaro_query_language-0.2.8.dist-info/RECORD,,

{tellaro_query_language-0.2.6.dist-info → tellaro_query_language-0.2.8.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: poetry-core 1.9.0
+Generator: poetry-core 2.3.0
 Root-Is-Purelib: true
 Tag: py3-none-any

tql/evaluator_components/value_comparison.py

@@ -170,15 +170,17 @@ class ValueComparator:
                 return str(field_value).lower().endswith(str(expected_value).lower())
             elif operator == "in":
                 if isinstance(expected_value, list):
-                    if len(expected_value) == 1 and isinstance(field_value, list):
-                        # This is likely a reversed 'in' case: 'value' in field_list
-                        # Check if the single expected value is in the field list
-                        converted_expected = self._convert_numeric(expected_value[0])
-                        return converted_expected in field_value
+                    # Convert list elements to appropriate types for comparison
+                    converted_list = [self._convert_numeric(val) for val in expected_value]
+
+                    if isinstance(field_value, (list, tuple)):
+                        # Field is an array - check if ANY element of field equals ANY value in list
+                        # This handles both:
+                        # - "value" in field (single expected value, array field)
+                        # - field in ["val1", "val2"] (multiple expected values, array field)
+                        return any(elem in converted_list for elem in field_value)
                     else:
-                        # Standard case: field_value in list
-                        # Convert list elements to appropriate types for comparison
-                        converted_list = [self._convert_numeric(val) for val in expected_value]
+                        # Scalar field - check if field_value is in the list
                         return field_value in converted_list
                 else:
                     return field_value == expected_value

tql/parser.py

@@ -332,6 +332,29 @@ class TQLParser:
                         return result
 
             if len(parsed) == 4:
+                # Check for field_in_values marker: field in [values] __field_in_values__
+                if isinstance(parsed[3], str) and parsed[3] == "__field_in_values__":
+                    # This is field in [values] syntax
+                    field_part, op, values_list, marker = parsed
+                    field_name, type_hint, field_mutators = self.ast_builder.extract_field_info(field_part)
+                    # Extract values from the list
+                    values = []
+                    for item in values_list:
+                        if isinstance(item, list) and len(item) >= 1:
+                            values.append(item[0] if len(item) == 1 else item)
+                        else:
+                            values.append(item)
+                    result = {
+                        "type": "comparison",
+                        "field": field_name,
+                        "type_hint": type_hint,
+                        "operator": "in",
+                        "value": values,
+                    }
+                    if field_mutators:
+                        result["field_mutators"] = field_mutators
+                    return result
+
                 # Check for ANY/ALL operators: ANY field op value
                 first, field, operator, value = parsed
 
@@ -368,12 +391,25 @@ class TQLParser:
                             normalized_operator = "any"
                         else:
                             normalized_operator = f"not_{third.lower()}"
+
+                        # Extract value properly - unwrap if it's a double-wrapped list
+                        # This happens for "field not in [values]" where the list is wrapped twice
+                        value = fourth
+                        if (
+                            third.lower() == "in"
+                            and isinstance(fourth, list)
+                            and len(fourth) == 1
+                            and isinstance(fourth[0], list)
+                        ):
+                            # Unwrap the double-wrapped list for "not in" with values
+                            value = fourth[0]
+
                         result = {
                             "type": "comparison",
                             "field": field_name,
                             "type_hint": type_hint,
                             "operator": normalized_operator,
-                            "value": fourth,
+                            "value": value,
                         }
                         if field_mutators:
                             result["field_mutators"] = field_mutators
@@ -577,6 +613,29 @@ class TQLParser:
                             result["value_mutators"] = value_mutators
                         return result
             elif len(parsed) == 5:
+                # Check for field_not_in_values marker: field not in [values] __field_not_in_values__
+                if isinstance(parsed[4], str) and parsed[4] == "__field_not_in_values__":
+                    # This is field not in [values] syntax
+                    field_part, not_kw, in_kw, values_list, marker = parsed
+                    field_name, type_hint, field_mutators = self.ast_builder.extract_field_info(field_part)
+                    # Extract values from the list
+                    values = []
+                    for item in values_list:
+                        if isinstance(item, list) and len(item) >= 1:
+                            values.append(item[0] if len(item) == 1 else item)
+                        else:
+                            values.append(item)
+                    result = {
+                        "type": "comparison",
+                        "field": field_name,
+                        "type_hint": type_hint,
+                        "operator": "not_in",
+                        "value": values,
+                    }
+                    if field_mutators:
+                        result["field_mutators"] = field_mutators
+                    return result
+
                 # Check for natural between syntax: field between value1 and value2
                 # Only process as between if the second element is "between"
                 if (
@@ -996,7 +1055,7 @@ class TQLParser:
                     return {"type": "unknown", "value": parsed}
                 else:
                     # Comparison operation
-                    # Handle 'in' operator - always value in field(s)
+                    # Handle 'in' operator - can be "value in field(s)" or "field in [values]"
                     if isinstance(operator, str) and operator.lower() == "in":
                         # Check for old syntax: [field1, field2] in value
                         # The parser wraps list literals, so check for wrapped lists too
@@ -1031,26 +1090,21 @@ class TQLParser:
                                     position=0,
                                 )
 
-                        # For 'in' operator, left is always the value, right is field(s)
-                        # Extract the value from left
-                        value_extracted, value_mutators = self.ast_builder.extract_value_info(left)
-
-                        # Check if right is a list of fields
+                        # Check if right is a list of fields (value in [fields] syntax)
+                        # Note: field in [values] is now handled by field_in_values grammar rule
+                        # with __field_in_values__ marker, so this is only for value in [fields]
                         if isinstance(right, list) and len(right) > 0:
-                            # Check if all elements are fields
-                            all_fields = True
-                            for item in right:
-                                if isinstance(item, list):
-                                    # This is a typed_field group
-                                    if not (len(item) >= 1 and isinstance(item[0], str)):
-                                        all_fields = False
-                                        break
-                                elif not isinstance(item, str):
-                                    all_fields = False
-                                    break
+                            # Check if all elements are fields (typed_fields wrapped in lists)
+                            # value in [field1, field2] produces right = [['field1'], ['field2']]
+                            # field in ["val1", "val2"] produces right = ['val1', 'val2']
+                            # (but field in [values] is now handled by __field_in_values__ marker)
+                            is_field_list = all(
+                                isinstance(item, list) and len(item) >= 1 and isinstance(item[0], str) for item in right
+                            )
 
-                            if all_fields:
+                            if is_field_list:
                                 # This is "value in [field1, field2, ...]" format
+                                value_extracted, value_mutators = self.ast_builder.extract_value_info(left)
                                 # Create an OR expression for all fields
                                 field_comparisons = []
                                 for field in right:
@@ -1083,7 +1137,11 @@ class TQLParser:
                                     }
                                 return result
 
-                        # Otherwise, treat as standard "value in field" (single field)
+                        # For 'in' operator with single field, left is the value, right is field
+                        # Extract the value from left
+                        value_extracted, value_mutators = self.ast_builder.extract_value_info(left)
+
+                        # Treat as standard "value in field" (single field)
                         field_name, type_hint, field_mutators = self.ast_builder.extract_field_info(right)
                         result = {
                             "type": "comparison",

tql/parser_components/grammar.py

@@ -225,10 +225,26 @@ class TQLGrammar:
         self.field_list_item = self.typed_field
         self.field_list = Group(Suppress("[") + delimitedList(self.field_list_item) + Suppress("]"))
 
-        # Special case for 'in' operator - always value in field(s)
+        # Special case for 'in' operator - value in field(s)
         self.value_in_field = Group(self.value + CaselessKeyword("in") + self.typed_field)
         self.value_in_field_list = Group(self.value + CaselessKeyword("in") + self.field_list)
 
+        # Field-first 'in' operator: field in [value1, value2, ...] (checks if field equals any value)
+        # Add a marker "__field_in_values__" to distinguish from value_in_field
+        self.field_in_values = Group(
+            self.typed_field
+            + CaselessKeyword("in")
+            + self.list_literal
+            + Literal("").setParseAction(lambda: "__field_in_values__")
+        )
+        self.field_not_in_values = Group(
+            self.typed_field
+            + (CaselessKeyword("not") | Literal("!"))
+            + CaselessKeyword("in")
+            + self.list_literal
+            + Literal("").setParseAction(lambda: "__field_not_in_values__")
+        )
+
     def _setup_special_expressions(self):
         """Set up special expressions like geo() and nslookup()."""
         # Forward declare for recursive use
@@ -455,6 +471,8 @@ class TQLGrammar:
             | self.is_not_comparison
             | self.not_between_comparison_natural
             | self.not_between_comparison_list
+            | self.field_not_in_values  # field not in [values] - must come before std_comparison
+            | self.field_in_values  # field in [values] - must come before std_comparison
             | self.std_comparison
             | self.between_comparison_natural
             | self.between_comparison_list