Missing OrderExpression. In ES|QL documentation and grammar there is clearly defined OrderExpression. Used in SORT command:

FROM a | SORT <order-expression>

like

FROM a | SORT b [ ASC / DESC ] [ NULLS FIRST / NULLS LAST ]

for example

FROM a | SORT b ASC NULLS FIRST

However in Kibana ES|QL there is no such OrderExpression nodes at all. Instead the OrderExpression components are parsed as separate string literal expressions:

[
  { type: 'command', name: 'from' },
  { type: 'command', name: 'sort', args: [
    { type: 'column', name: 'b' },
    { type: 'literal', value: 'ASC' },
    { type: 'literal', value: 'NULLS' },
    { type: 'literal', value: 'FIRST' },
  ]},
]

Specifically ASC and NULLS FIRST modifiers are parsed as string literals. Also note, that the NULLS FIRST modifier is parsed as two separate NULLS and FIRST string literals.

The parser should parse it as a single OrderExpression node instead:

{
  type: 'order',
  order: 'asc' | 'desc',
  nulls: 'first' | 'last',
  column: {
    type: 'column',
    name: 'b',
  },
}