@vltpkg/query 1.0.0-rc.23 → 1.0.0-rc.24

package/dist/pseudo/workspace.js

@@ -0,0 +1,19 @@
+import { removeNode } from "./helpers.js";
+/**
+ * :workspace Pseudo-Selector will only match workspace dependencies.
+ */
+export const workspace = async (state) => {
+    // Filter out the root node and any nodes that are not marked as workspaces
+    for (const node of state.partial.nodes) {
+        if (!node.importer || node.mainImporter) {
+            removeNode(state, node);
+        }
+    }
+    // Clears up any edges that are not pointing to workspace nodes
+    for (const edge of state.partial.edges) {
+        if (edge.to?.importer && !edge.to.mainImporter)
+            continue;
+        state.partial.edges.delete(edge);
+    }
+    return state;
+};

package/dist/pseudo.d.ts

@@ -0,0 +1,5 @@
+import type { ParserState } from './types.ts';
+/**
+ * Parsers the `pseudo` node types.
+ */
+export declare const pseudo: (state: ParserState) => Promise<ParserState>;

package/dist/pseudo.js

@@ -0,0 +1,366 @@
+import { error } from '@vltpkg/error-cause';
+import { removeDanglingEdges, removeNode } from "./pseudo/helpers.js";
+import { asPostcssNodeWithChildren, asPseudoNode, isSelectorNode, } from '@vltpkg/dss-parser';
+// imported pseudo selectors
+import { abandoned } from "./pseudo/abandoned.js";
+import { attr } from "./pseudo/attr.js";
+import { built } from "./pseudo/built.js";
+import { confused } from "./pseudo/confused.js";
+import { cve } from "./pseudo/cve.js";
+import { cwe } from "./pseudo/cwe.js";
+import { debug } from "./pseudo/debug.js";
+import { deprecated } from "./pseudo/deprecated.js";
+import { dev } from "./pseudo/dev.js";
+import { diff } from "./pseudo/diff.js";
+import { dynamic } from "./pseudo/dynamic.js";
+import { empty } from "./pseudo/empty.js";
+import { entropic } from "./pseudo/entropic.js";
+import { env } from "./pseudo/env.js";
+import { evalParser } from "./pseudo/eval.js";
+import { fs } from "./pseudo/fs.js";
+import { hostContext } from "./pseudo/host.js";
+import { hostname } from "./pseudo/hostname.js";
+import { license } from "./pseudo/license.js";
+import { link } from "./pseudo/link.js";
+import { malware } from "./pseudo/malware.js";
+import { minified } from "./pseudo/minified.js";
+import { missing } from "./pseudo/missing.js";
+import { nativeParser } from "./pseudo/native.js";
+import { network } from "./pseudo/network.js";
+import { obfuscated } from "./pseudo/obfuscated.js";
+import { optional } from "./pseudo/optional.js";
+import { outdated } from "./pseudo/outdated.js";
+import { overridden } from "./pseudo/overridden.js";
+import { path } from "./pseudo/path.js";
+import { peer } from "./pseudo/peer.js";
+import { prerelease } from "./pseudo/prerelease.js";
+import { published } from "./pseudo/published.js";
+import { privateParser } from "./pseudo/private.js";
+import { registry } from "./pseudo/registry.js";
+import { prod } from "./pseudo/prod.js";
+import { root } from "./pseudo/root.js";
+import { scanned } from "./pseudo/scanned.js";
+import { score } from "./pseudo/score.js";
+import { scripts } from "./pseudo/scripts.js";
+import { shell } from "./pseudo/shell.js";
+import { semverParser as semver } from "./pseudo/semver.js";
+import { severity } from "./pseudo/severity.js";
+import { spec } from "./pseudo/spec.js";
+import { shrinkwrap } from "./pseudo/shrinkwrap.js";
+import { squat } from "./pseudo/squat.js";
+import { suspicious } from "./pseudo/suspicious.js";
+import { tracker } from "./pseudo/tracker.js";
+import { trivial } from "./pseudo/trivial.js";
+import { type } from "./pseudo/type.js";
+import { undesirable } from "./pseudo/undesirable.js";
+import { unknown } from "./pseudo/unknown.js";
+import { unmaintained } from "./pseudo/unmaintained.js";
+import { unpopular } from "./pseudo/unpopular.js";
+import { unstable } from "./pseudo/unstable.js";
+import { workspace } from "./pseudo/workspace.js";
+/**
+ * :has Pseudo-Selector, matches only nodes that have valid results
+ * for its nested selector expressions.
+ */
+const has = async (state) => {
+    const top = asPostcssNodeWithChildren(state.current);
+    const collectNodes = new Set();
+    const collectEdges = new Set();
+    for (const node of top.nodes) {
+        if (isSelectorNode(node)) {
+            const nestedState = await state.walk({
+                cancellable: state.cancellable,
+                initial: {
+                    edges: new Set(state.initial.edges),
+                    nodes: new Set(state.initial.nodes),
+                },
+                current: node,
+                walk: state.walk,
+                collect: {
+                    edges: new Set(),
+                    nodes: new Set(),
+                },
+                partial: {
+                    edges: new Set(state.partial.edges),
+                    nodes: new Set(state.partial.nodes),
+                },
+                hostContexts: state.hostContexts,
+                importers: state.importers,
+                retries: state.retries,
+                securityArchive: state.securityArchive,
+                signal: state.signal,
+                scopeIDs: state.scopeIDs,
+                comment: state.comment,
+                specificity: { ...state.specificity },
+            });
+            for (const n of nestedState.collect.nodes) {
+                collectNodes.add(n);
+            }
+            for (const e of nestedState.partial.edges) {
+                collectEdges.add(e);
+            }
+        }
+    }
+    // if the nested selector did not match anything, that means
+    // no current node has any matches
+    if (collectNodes.size === 0) {
+        state.partial.edges.clear();
+        state.partial.nodes.clear();
+        return state;
+    }
+    // handles transitive dependencies
+    // compareNodes collects a list of all ancestor nodes
+    // from the resulting nodes of the nested selector
+    const compareNodes = new Set();
+    const traverse = new Set(collectNodes);
+    for (const node of traverse) {
+        for (const edge of node.edgesIn) {
+            compareNodes.add(edge.from);
+            if (edge.from.edgesIn.size) {
+                traverse.add(edge.from);
+            }
+        }
+    }
+    // for each node in the current list checks to see if
+    // it has a node in the resulting nested state that is
+    // a transitive dependency / children.
+    nodesLoop: for (const node of state.partial.nodes) {
+        if (node.edgesOut.size === 0 || !compareNodes.has(node)) {
+            removeNode(state, node);
+            continue;
+        }
+        for (const edge of node.edgesOut.values()) {
+            if (collectEdges.has(edge)) {
+                continue nodesLoop;
+            }
+        }
+        removeNode(state, node);
+    }
+    removeDanglingEdges(state);
+    return state;
+};
+/**
+ * :is Pseudo-selector, acts as a shortcut for writing more compact expressions
+ * by allowing multiple nested selectors to match on the previous results.
+ *
+ * It also enables the loose parsing mode, skipping instead of erroring usage
+ * of non-existing classes, identifiers, pseudo-classes, etc.
+ */
+const is = async (state) => {
+    const top = asPostcssNodeWithChildren(state.current);
+    const collect = new Set();
+    for (const node of top.nodes) {
+        if (isSelectorNode(node)) {
+            const nestedState = await state.walk({
+                cancellable: state.cancellable,
+                collect: {
+                    edges: new Set(),
+                    nodes: new Set(),
+                },
+                current: node,
+                initial: state.initial,
+                loose: true,
+                partial: {
+                    nodes: new Set(state.partial.nodes),
+                    edges: new Set(state.partial.edges),
+                },
+                importers: state.importers,
+                hostContexts: state.hostContexts,
+                walk: state.walk,
+                retries: state.retries,
+                securityArchive: state.securityArchive,
+                signal: state.signal,
+                scopeIDs: state.scopeIDs,
+                comment: state.comment,
+                specificity: { ...state.specificity },
+            });
+            for (const n of nestedState.collect.nodes) {
+                collect.add(n);
+            }
+        }
+    }
+    for (const node of state.partial.nodes) {
+        if (!collect.has(node)) {
+            removeNode(state, node);
+        }
+    }
+    return state;
+};
+/**
+ * :not Pseudo-class, serves to create negate expressions, anything that
+ * matches selectors declared inside the `:not()` expression is going to be
+ * filtered out in the final result.
+ */
+const not = async (state) => {
+    const top = asPostcssNodeWithChildren(state.current);
+    const collect = new Set();
+    for (const node of top.nodes) {
+        if (isSelectorNode(node)) {
+            const nestedState = await state.walk({
+                cancellable: state.cancellable,
+                collect: {
+                    edges: new Set(),
+                    nodes: new Set(),
+                },
+                current: node,
+                initial: state.initial,
+                partial: {
+                    nodes: new Set(state.partial.nodes),
+                    edges: new Set(state.partial.edges),
+                },
+                importers: state.importers,
+                hostContexts: state.hostContexts,
+                walk: state.walk,
+                retries: state.retries,
+                securityArchive: state.securityArchive,
+                signal: state.signal,
+                scopeIDs: state.scopeIDs,
+                comment: state.comment,
+                specificity: { ...state.specificity },
+            });
+            for (const n of nestedState.collect.nodes) {
+                collect.add(n);
+            }
+            /* c8 ignore start - should be impossible */
+        }
+        else {
+            throw error('Error parsing :not() selectors', {
+                wanted: { type: 'selector' },
+                found: node,
+            });
+        }
+        /* c8 ignore stop */
+    }
+    for (const node of state.partial.nodes) {
+        if (collect.has(node)) {
+            removeNode(state, node);
+        }
+    }
+    removeDanglingEdges(state);
+    return state;
+};
+/**
+ * :project Pseudo-Class, matches only graph importers (e.g: the
+ * root node along with any configured workspace)
+ */
+const project = async (state) => {
+    for (const node of state.partial.nodes) {
+        if (!node.importer) {
+            removeNode(state, node);
+        }
+    }
+    for (const edge of state.partial.edges) {
+        if (!edge.to?.importer) {
+            state.partial.edges.delete(edge);
+        }
+    }
+    return state;
+};
+/**
+ * :scope Pseudo-Element, returns only the nodes that match the provided scopeIDs
+ * from the Query.search method.
+ */
+const scope = async (state) => {
+    const scopeIDSet = new Set(state.scopeIDs);
+    for (const node of state.partial.nodes) {
+        if (!scopeIDSet.has(node.id)) {
+            removeNode(state, node);
+        }
+    }
+    removeDanglingEdges(state);
+    return state;
+};
+const pseudoSelectors = new Map(Object.entries({
+    abandoned,
+    attr,
+    built,
+    confused,
+    cve,
+    cwe,
+    debug,
+    deprecated,
+    dev,
+    diff,
+    dynamic,
+    eval: evalParser,
+    empty,
+    entropic,
+    env,
+    fs,
+    has,
+    host: hostContext,
+    hostname,
+    is,
+    license,
+    link,
+    malware,
+    minified,
+    missing,
+    native: nativeParser,
+    network,
+    not,
+    obfuscated,
+    optional,
+    outdated,
+    overridden,
+    path,
+    peer,
+    prerelease,
+    published,
+    private: privateParser,
+    prod,
+    registry,
+    project,
+    root,
+    scanned,
+    scope,
+    score,
+    scripts,
+    semver,
+    sev: severity,
+    spec,
+    severity,
+    shell,
+    shrinkwrap,
+    squat,
+    suspicious,
+    tracker,
+    trivial,
+    type,
+    undesirable,
+    unknown,
+    unmaintained,
+    unpopular,
+    unstable,
+    v: semver,
+    workspace,
+}));
+/**
+ * Parsers the `pseudo` node types.
+ */
+export const pseudo = async (state) => {
+    await state.cancellable();
+    const curr = asPseudoNode(state.current);
+    const parserFn = curr.value && pseudoSelectors.get(curr.value.slice(1));
+    if (!parserFn) {
+        if (state.loose) {
+            state.partial.edges.clear();
+            state.partial.nodes.clear();
+            return state;
+        }
+        throw error(`Unsupported pseudo-class: ${state.current.value}`, {
+            found: state.current,
+        });
+    }
+    const result = await parserFn(state);
+    // Increment the commonCounter for specificity, except for
+    // nesting selectors which don't contribute to specificity
+    const pseudoValue = curr.value.slice(1);
+    if (pseudoValue &&
+        pseudoValue !== 'not' &&
+        pseudoValue !== 'is' &&
+        pseudoValue !== 'has') {
+        result.specificity.commonCounter += 1;
+    }
+    return result;
+};

package/dist/types.d.ts

@@ -0,0 +1,124 @@
+import type { EdgeLike, NodeLike } from '@vltpkg/types';
+import type { SecurityArchiveLike, PackageScore } from '@vltpkg/security-archive';
+import type { DepID } from '@vltpkg/dep-id';
+import type { PostcssNode } from '@vltpkg/dss-parser';
+export type HostContextsMapResult = {
+    initialEdges: EdgeLike[];
+    initialNodes: NodeLike[];
+    edges: EdgeLike[];
+    nodes: NodeLike[];
+    securityArchive: SecurityArchiveLike | undefined;
+};
+export type HostContextsMap = Map<string, () => Promise<HostContextsMapResult>>;
+export type Specificity = {
+    idCounter: number;
+    commonCounter: number;
+};
+export type GraphSelectionState = {
+    nodes: Set<NodeLike>;
+    edges: Set<EdgeLike>;
+};
+/**
+ * Callback that returns changed file paths for a given
+ * commitish reference. Used by the :diff() pseudo selector.
+ * The returned paths should be relative to the project root.
+ */
+export type DiffFilesProvider = (commitish: string) => Set<string>;
+export type ParserState = {
+    cancellable: () => Promise<void>;
+    collect: GraphSelectionState;
+    comment: string;
+    current: PostcssNode;
+    diffFiles?: DiffFilesProvider;
+    hostContexts?: HostContextsMap;
+    importers: Set<NodeLike>;
+    initial: GraphSelectionState;
+    loose?: boolean;
+    next?: PostcssNode;
+    prev?: PostcssNode;
+    result?: NodeLike[];
+    signal: AbortSignal;
+    walk: ParserFn;
+    partial: GraphSelectionState;
+    retries: number;
+    securityArchive: SecurityArchiveLike | undefined;
+    scopeIDs?: DepID[];
+    specificity: Specificity;
+};
+export type QueryResponse = {
+    edges: QueryResponseEdge[];
+    nodes: QueryResponseNode[];
+    importers: QueryResponseNode[];
+    comment: string;
+    specificity: Specificity;
+};
+export type QueryResponseEdge = Omit<EdgeLike, 'from' | 'to'> & {
+    from: QueryResponseNode;
+    to?: QueryResponseNode;
+};
+export type QueryResponseNode = Omit<NodeLike, 'edgesIn' | 'edgesOut'> & {
+    edgesIn: Set<QueryResponseEdge>;
+    edgesOut: Map<string, QueryResponseEdge>;
+    insights: Insights;
+    toJSON: () => Pick<QueryResponseNode, 'id' | 'name' | 'version' | 'location' | 'importer' | 'manifest' | 'projectRoot' | 'integrity' | 'resolved' | 'dev' | 'optional' | 'insights' | 'confused'>;
+};
+export type Insights = {
+    abandoned?: boolean;
+    confused?: boolean;
+    cve?: `CVE-${string}`[];
+    cwe?: `CWE-${string}`[];
+    debug?: boolean;
+    deprecated?: boolean;
+    dynamic?: boolean;
+    entropic?: boolean;
+    env?: boolean;
+    eval?: boolean;
+    fs?: boolean;
+    license?: LicenseInsights;
+    malware?: MalwareInsights;
+    minified?: boolean;
+    native?: boolean;
+    network?: boolean;
+    obfuscated?: boolean;
+    scanned: boolean;
+    score?: PackageScore;
+    scripts?: boolean;
+    severity?: SeverityInsights;
+    shell?: boolean;
+    shrinkwrap?: boolean;
+    squat?: SquatInsights;
+    suspicious?: boolean;
+    tracker?: boolean;
+    trivial?: boolean;
+    undesirable?: boolean;
+    unknown?: boolean;
+    unmaintained?: boolean;
+    unpopular?: boolean;
+    unstable?: boolean;
+};
+export type LicenseInsights = {
+    unlicensed: boolean;
+    misc: boolean;
+    restricted: boolean;
+    ambiguous: boolean;
+    copyleft: boolean;
+    unknown: boolean;
+    none: boolean;
+    exception: boolean;
+};
+export type LeveledInsights = {
+    low: boolean;
+    medium: boolean;
+    high: boolean;
+    critical: boolean;
+};
+export type MalwareInsights = LeveledInsights;
+export type SeverityInsights = LeveledInsights;
+export type SquatInsights = {
+    medium: boolean;
+    critical: boolean;
+};
+export type ParserFn = (opt: ParserState) => Promise<ParserState>;
+export type ParsedSelectorToken = PostcssNode & {
+    token: string;
+};

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/query",
   "description": "Query syntax parser that retrieves items from a graph",
-  "version": "1.0.0-rc.23",
+  "version": "1.0.0-rc.24",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -12,12 +12,12 @@
     "email": "support@vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/dep-id": "1.0.0-rc.23",
-    "@vltpkg/dss-parser": "1.0.0-rc.23",
-    "@vltpkg/error-cause": "1.0.0-rc.23",
-    "@vltpkg/security-archive": "1.0.0-rc.23",
-    "@vltpkg/semver": "1.0.0-rc.23",
-    "@vltpkg/types": "1.0.0-rc.23",
+    "@vltpkg/dep-id": "1.0.0-rc.24",
+    "@vltpkg/dss-parser": "1.0.0-rc.24",
+    "@vltpkg/error-cause": "1.0.0-rc.24",
+    "@vltpkg/security-archive": "1.0.0-rc.24",
+    "@vltpkg/semver": "1.0.0-rc.24",
+    "@vltpkg/types": "1.0.0-rc.24",
     "minimatch": "^10.1.1",
     "p-retry": "^7.1.1",
     "postcss-selector-parser": "^7.1.1"
@@ -25,7 +25,7 @@
   "devDependencies": {
     "@eslint/js": "^9.39.1",
     "@types/node": "^22.19.2",
-    "@vltpkg/spec": "1.0.0-rc.23",
+    "@vltpkg/spec": "1.0.0-rc.24",
     "eslint": "^9.39.1",
     "prettier": "^3.7.4",
     "tap": "^21.5.0",