@vltpkg/query 1.0.0-rc.31 → 1.0.0-rc.33

package/src/pseudo/published.ts

@@ -0,0 +1,248 @@
+import pRetry, { AbortError } from 'p-retry'
+import { hydrate, splitDepID } from '@vltpkg/dep-id/browser'
+import { error } from '@vltpkg/error-cause'
+import { asError } from '@vltpkg/types'
+import {
+  asPostcssNodeWithChildren,
+  asStringNode,
+  asTagNode,
+  isStringNode,
+  isTagNode,
+} from '@vltpkg/dss-parser'
+import {
+  removeDanglingEdges,
+  removeNode,
+  removeQuotes,
+} from './helpers.ts'
+import type { NodeLike, Packument } from '@vltpkg/types'
+import type { ParserState } from '../types.ts'
+import type { PostcssNode } from '@vltpkg/dss-parser'
+
+/**
+ * The possible comparator values accepted by the :published() pseudo selector.
+ */
+export type PublishedComparator = '>' | '<' | '>=' | '<=' | undefined
+
+/**
+ * Result of the internal parsing of the :published() pseudo selector.
+ */
+export type PublishedInternals = {
+  relativeDate: string
+  comparator: PublishedComparator
+}
+
+/**
+ * Fetches the published date of a package version from the npm registry.
+ */
+export const retrieveRemoteDate = async (
+  node: NodeLike,
+  signal?: AbortSignal,
+): Promise<string | undefined> => {
+  const spec = hydrate(node.id, String(node.name), node.options)
+  if (!spec.registry || !node.name || !node.version) {
+    return undefined
+  }
+
+  const url = new URL(spec.registry)
+  url.pathname = `/${node.name}`
+
+  const response = await fetch(String(url), {
+    signal,
+  })
+  // on missing valid auth or API, it should abort the retry logic
+  if (response.status === 404) {
+    throw new AbortError('Missing API')
+  }
+  if (!response.ok) {
+    throw error('Failed to fetch packument', {
+      name: node.name,
+      spec,
+      response,
+    })
+  }
+  const packument = (await response.json()) as Packument
+  const res = packument.time?.[node.version]
+  return res
+}
+
+/**
+ * Retrieves what kind of check the :published selector should perform.
+ */
+export const parseInternals = (
+  nodes: PostcssNode[],
+): PublishedInternals => {
+  let value = ''
+
+  if (isStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])) {
+    value = removeQuotes(
+      asStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+        .value,
+    )
+  } else if (
+    isTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+  ) {
+    const tagNode = asTagNode(
+      asPostcssNodeWithChildren(nodes[0]).nodes[0],
+    )
+    value = tagNode.value
+  }
+
+  // Check if the value starts with a comparator
+  let comparator: PublishedComparator
+  let relativeDate = value
+
+  if (value.startsWith('>=')) {
+    comparator = '>='
+    relativeDate = value.slice(2)
+  } else if (value.startsWith('<=')) {
+    comparator = '<='
+    relativeDate = value.slice(2)
+  } else if (value.startsWith('>')) {
+    comparator = '>'
+    relativeDate = value.slice(1)
+  } else if (value.startsWith('<')) {
+    comparator = '<'
+    relativeDate = value.slice(1)
+  }
+
+  return { relativeDate, comparator }
+}
+
+/**
+ * Filter nodes by queueing up for removal those that don't match the date criteria.
+ */
+export const queueNode = async (
+  state: ParserState,
+  node: NodeLike,
+  relativeDate: string,
+  comparator: PublishedComparator,
+): Promise<NodeLike | undefined> => {
+  if (!node.name || !node.version) {
+    return node
+  }
+
+  let publishedDate: string | undefined
+  try {
+    publishedDate = await pRetry(
+      () => retrieveRemoteDate(node, state.signal),
+      {
+        retries: state.retries,
+        signal: state.signal,
+      },
+    )
+  } catch (err) {
+    // eslint-disable-next-line no-console
+    console.warn(
+      error('Could not retrieve registry publish date', {
+        name: node.name,
+        cause: err,
+      }),
+    )
+    return node
+  }
+
+  if (!publishedDate) {
+    return node
+  }
+
+  // only matches the same amount of date information
+  // as provided in the relative date
+  const nodeDate = new Date(
+    publishedDate.slice(0, relativeDate.length),
+  )
+  const compareDate = new Date(relativeDate)
+
+  switch (comparator) {
+    case '>':
+      return nodeDate > compareDate ? undefined : node
+    case '<':
+      return nodeDate < compareDate ? undefined : node
+    case '>=':
+      return nodeDate >= compareDate ? undefined : node
+    case '<=':
+      return nodeDate <= compareDate ? undefined : node
+    default:
+      return nodeDate.getTime() === compareDate.getTime() ?
+          undefined
+        : node
+  }
+}
+
+/**
+ * Filters out nodes that don't match the published date criteria.
+ *
+ * The :published() pseudo selector supports a date parameter that can be prefixed
+ * with a comparator (>, <, >=, <=). If no comparator is provided, it will match
+ * exact dates.
+ *
+ * Examples:
+ * - :published("2024-01-01") - Matches packages published exactly on January 1st, 2024
+ * - :published(">2024-01-01") - Matches packages published after January 1st, 2024
+ * - :published("<=2023-12-31") - Matches packages published on or before December 31st, 2023
+ */
+export const published = async (state: ParserState) => {
+  let internals
+  try {
+    internals = parseInternals(
+      asPostcssNodeWithChildren(state.current).nodes,
+    )
+  } catch (err) {
+    if (asError(err).message === 'Expected a query node') {
+      // No parameters provided - pseudo state form: match ANY published metadata
+      for (const node of state.partial.nodes) {
+        // filter out nodes that are always ignored by the published selector
+        if (
+          node.mainImporter ||
+          node.manifest?.private ||
+          splitDepID(node.id)[0] !== 'registry'
+        ) {
+          removeNode(state, node)
+          continue
+        }
+
+        // For pseudo state form, we just check if the node has published metadata
+        // This is equivalent to checking if it's a registry package with version info
+        if (!node.name || !node.version) {
+          removeNode(state, node)
+        }
+      }
+      removeDanglingEdges(state)
+      return state
+    } else {
+      throw error('Failed to parse :published selector', {
+        cause: err,
+      })
+    }
+  }
+
+  const { relativeDate, comparator } = internals
+  const queue = []
+
+  for (const node of state.partial.nodes) {
+    // filter out nodes that are always ignored by the published selector
+    if (
+      node.mainImporter ||
+      node.manifest?.private ||
+      splitDepID(node.id)[0] !== 'registry'
+    ) {
+      removeNode(state, node)
+      continue
+    }
+
+    // fetch published date info and perform checks to define
+    // whether or not a node should be filtered out
+    queue.push(queueNode(state, node, relativeDate, comparator))
+  }
+
+  // nodes queued for removal are then finally removed
+  const removeNodeQueue = await Promise.all(queue)
+  for (const node of removeNodeQueue) {
+    if (node) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}

package/src/pseudo/registry.ts

@@ -0,0 +1,29 @@
+import { splitDepID } from '@vltpkg/dep-id/browser'
+import {
+  asPostcssNodeWithChildren,
+  asTagNode,
+} from '@vltpkg/dss-parser'
+import { removeDanglingEdges, removeNode } from './helpers.ts'
+import type { ParserState } from '../types.ts'
+
+/**
+ * :registry(name) Pseudo-Selector, matches only nodes that
+ * belong to the specified registry configuration alias.
+ *
+ * For example, `:registry(npm)` matches deps from the default
+ * npm registry, and `:registry(custom)` matches deps from a
+ * custom-named registry.
+ */
+export const registry = async (state: ParserState) => {
+  const top = asPostcssNodeWithChildren(state.current)
+  const selector = asPostcssNodeWithChildren(top.nodes[0])
+  const name = asTagNode(selector.nodes[0]).value
+  for (const node of state.partial.nodes) {
+    const tuple = splitDepID(node.id)
+    if (tuple[0] !== 'registry' || tuple[1] !== name) {
+      removeNode(state, node)
+    }
+  }
+  removeDanglingEdges(state)
+  return state
+}

package/src/pseudo/root.ts

@@ -0,0 +1,19 @@
+import type { ParserState } from '../types.ts'
+
+/**
+ * :root Pseudo-Element will return the project root node for the graph.
+ * It matches only nodes marked as `mainImporter`.
+ */
+export const root = async (state: ParserState) => {
+  for (const edge of state.partial.edges) {
+    if (!edge.to?.mainImporter) {
+      state.partial.edges.delete(edge)
+    }
+  }
+  for (const node of state.partial.nodes) {
+    if (!node.mainImporter) {
+      state.partial.nodes.delete(node)
+    }
+  }
+  return state
+}

package/src/pseudo/scanned.ts

@@ -0,0 +1,20 @@
+import { removeDanglingEdges, removeNode } from './helpers.ts'
+import type { ParserState } from '../types.ts'
+
+/**
+ * :scanned pseudo selector.
+ *
+ * Remove all nodes that do not have available metadata
+ * in the security archive.
+ */
+export const scanned = async (state: ParserState) => {
+  for (const node of state.partial.nodes) {
+    if (!state.securityArchive?.has(node.id)) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}

package/src/pseudo/score.ts

@@ -0,0 +1,186 @@
+import { error } from '@vltpkg/error-cause'
+import { asError } from '@vltpkg/types'
+import {
+  asPostcssNodeWithChildren,
+  asStringNode,
+  asTagNode,
+  isStringNode,
+  isTagNode,
+} from '@vltpkg/dss-parser'
+import {
+  assertSecurityArchive,
+  removeDanglingEdges,
+  removeNode,
+  removeQuotes,
+} from './helpers.ts'
+import type { PackageScore } from '@vltpkg/security-archive'
+import type { ParserState } from '../types.ts'
+import type { PostcssNode } from '@vltpkg/dss-parser'
+
+export type ScoreKinds = keyof PackageScore
+
+export type ScoreComparator =
+  '>' | '<' | '>=' | '<=' | '=' | undefined
+
+const kinds = new Set<ScoreKinds | undefined>([
+  'overall',
+  'license',
+  'maintenance',
+  'quality',
+  'supplyChain',
+  'vulnerability',
+  undefined,
+])
+
+export const isScoreKind = (value?: string): value is ScoreKinds =>
+  kinds.has(value as ScoreKinds)
+
+export const asScoreKind = (value?: string): ScoreKinds => {
+  if (!isScoreKind(value)) {
+    throw error('Expected a valid score kind', {
+      found: value,
+      validOptions: Array.from(kinds),
+    })
+  }
+  return value
+}
+
+export const parseInternals = (
+  nodes: PostcssNode[],
+): {
+  comparator: ScoreComparator
+  rate: number
+  kind: ScoreKinds
+} => {
+  let rateStr = ''
+  let comparator: ScoreComparator = '='
+  let kind: ScoreKinds = 'overall'
+
+  // Parse the first parameter (rate with optional comparator)
+  if (isStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])) {
+    rateStr = removeQuotes(
+      asStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+        .value,
+    )
+  } else if (
+    isTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+  ) {
+    const tagNode = asTagNode(
+      asPostcssNodeWithChildren(nodes[0]).nodes[0],
+    )
+    rateStr = tagNode.value
+  }
+
+  // Extract comparator if present
+  if (rateStr.startsWith('>=')) {
+    comparator = '>='
+    rateStr = rateStr.substring(2)
+  } else if (rateStr.startsWith('<=')) {
+    comparator = '<='
+    rateStr = rateStr.substring(2)
+  } else if (rateStr.startsWith('>')) {
+    comparator = '>'
+    rateStr = rateStr.substring(1)
+  } else if (rateStr.startsWith('<')) {
+    comparator = '<'
+    rateStr = rateStr.substring(1)
+  }
+
+  // Parse rate as number
+  let rate = parseFloat(rateStr)
+
+  // Normalize to 0-1 range if needed
+  if (rate > 1) {
+    rate = rate / 100
+  }
+
+  // Validate rate is in acceptable range
+  if (rate < 0 || rate > 1) {
+    throw error('Expected rate to be between 0 and 100', {
+      found: rateStr,
+    })
+  }
+
+  // Parse the second parameter (kind) if present
+  if (nodes.length > 1) {
+    if (isStringNode(asPostcssNodeWithChildren(nodes[1]).nodes[0])) {
+      kind = asScoreKind(
+        removeQuotes(
+          asStringNode(asPostcssNodeWithChildren(nodes[1]).nodes[0])
+            .value,
+        ),
+      )
+    } else if (
+      isTagNode(asPostcssNodeWithChildren(nodes[1]).nodes[0])
+    ) {
+      kind = asScoreKind(
+        asTagNode(asPostcssNodeWithChildren(nodes[1]).nodes[0]).value,
+      )
+    }
+  }
+
+  return { comparator, rate, kind }
+}
+
+export const score = async (state: ParserState) => {
+  assertSecurityArchive(state, 'score')
+
+  let internals
+  try {
+    internals = parseInternals(
+      asPostcssNodeWithChildren(state.current).nodes,
+    )
+  } catch (err) {
+    if (asError(err).message === 'Expected a query node') {
+      // No parameters provided - pseudo state form: match ANY score (scanned packages)
+      for (const node of state.partial.nodes) {
+        const report = state.securityArchive.get(node.id)
+        if (!report) {
+          removeNode(state, node)
+        }
+      }
+      removeDanglingEdges(state)
+      return state
+    } else {
+      throw error('Failed to parse :score selector', { cause: err })
+    }
+  }
+
+  const { comparator, rate, kind } = internals
+  for (const node of state.partial.nodes) {
+    const report = state.securityArchive.get(node.id)
+    if (!report) {
+      removeNode(state, node)
+      continue
+    }
+
+    const scoreValue = report.score[kind]
+
+    let exclude = false
+    switch (comparator) {
+      case '>':
+        exclude = scoreValue <= rate
+        break
+      case '<':
+        exclude = scoreValue >= rate
+        break
+      case '>=':
+        exclude = scoreValue < rate
+        break
+      case '<=':
+        exclude = scoreValue > rate
+        break
+      default: // '='
+        exclude = scoreValue !== rate
+        break
+    }
+
+    if (exclude) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}

package/src/pseudo/scripts.ts

@@ -0,0 +1,54 @@
+import type { NodeLike } from '@vltpkg/types'
+import type { ParserState } from '../types.ts'
+import { removeNode, removeDanglingEdges } from './helpers.ts'
+
+/**
+ * Checks if a node needs to be built based on the conditions from the reify build process:
+ * 1. Has install lifecycle scripts (install, preinstall, postinstall)
+ * 2. Is an importer or git dependency with prepare scripts (prepare, preprepare, postprepare)
+ */
+const nodeNeedsBuild = (node: NodeLike): boolean => {
+  const { manifest } = node
+  /* c8 ignore next */
+  if (!manifest) return false
+
+  const { scripts = {} } = manifest
+
+  // Check for install lifecycle scripts
+  const runInstall = !!(
+    scripts.install ||
+    scripts.preinstall ||
+    scripts.postinstall
+  )
+  if (runInstall) return true
+
+  // Check for prepare scripts on importers or git dependencies
+  const prepable = node.id.startsWith('git') || node.importer
+  const runPrepare =
+    !!(
+      scripts.prepare || scripts.preprepare || scripts.postprepare
+      /* c8 ignore next 2 */
+    ) && prepable
+  if (runPrepare) return true
+
+  return false
+}
+
+/**
+ * :scripts Pseudo-Selector filters nodes based on whether they need to be built.
+ *
+ * A node needs to be built if it has:
+ * - Install lifecycle scripts (install, preinstall, postinstall)
+ * - Prepare scripts on importers or git dependencies (prepare, preprepare, postprepare)
+ */
+export const scripts = async (state: ParserState) => {
+  for (const node of state.partial.nodes) {
+    if (!nodeNeedsBuild(node)) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}