@vltpkg/query 1.0.0-rc.31 → 1.0.0-rc.33

package/src/pseudo/semver.ts

@@ -0,0 +1,320 @@
+import {
+  satisfies,
+  gt,
+  gte,
+  lt,
+  lte,
+  eq,
+  neq,
+  intersects,
+  subset,
+  parse,
+  parseRange,
+} from '@vltpkg/semver'
+import type { Version } from '@vltpkg/semver'
+import { error } from '@vltpkg/error-cause'
+import { asError } from '@vltpkg/types'
+import { parseInternals as parseAttrInternals } from './attr.ts'
+import type { AttrInternals } from './attr.ts'
+import { getManifestPropertyValues } from '../attribute.ts'
+import {
+  asAttributeNode,
+  asPostcssNodeWithChildren,
+  asPseudoNode,
+  asStringNode,
+  asTagNode,
+  isAttributeNode,
+  isPseudoNode,
+  isStringNode,
+  isTagNode,
+} from '@vltpkg/dss-parser'
+import {
+  removeEdge,
+  removeNode,
+  removeQuotes,
+  removeUnlinkedNodes,
+} from './helpers.ts'
+import type { ParserState } from '../types.ts'
+import type { PostcssNode } from '@vltpkg/dss-parser'
+
+export type SemverInternals = {
+  semverValue: string
+  semverFunction: SemverComparatorFn
+  semverRangeFunction: SemverRangeComparatorFn | undefined
+  compareAttribute: SemverCompareAttribute
+}
+
+export type SemverFunctionNames =
+  | 'satisfies'
+  | 'gt'
+  | 'gte'
+  | 'lt'
+  | 'lte'
+  | 'eq'
+  | 'neq'
+  | 'intersects'
+  | 'subset'
+export type SemverComparatorFn = (
+  version: Version | string,
+  range: string,
+) => boolean
+export type SemverRangeComparatorFn = (
+  r1: string,
+  r2: string,
+) => boolean
+export type SemverCompareAttribute =
+  Pick<AttrInternals, 'attribute' | 'properties'> | undefined
+
+const semverFunctionNames = new Set([
+  'satisfies',
+  'gt',
+  'gte',
+  'lt',
+  'lte',
+  'eq',
+  'neq',
+  'intersects',
+  'subset',
+])
+export const isSemverFunctionName = (
+  name: string,
+): name is SemverFunctionNames => semverFunctionNames.has(name)
+
+export const asSemverFunctionName = (
+  name: string,
+): SemverFunctionNames => {
+  if (!isSemverFunctionName(name)) {
+    throw error('Invalid semver function name', {
+      found: name,
+      validOptions: Array.from(semverFunctionNames),
+    })
+  }
+  return name
+}
+
+const semverFunctions = new Map<
+  SemverFunctionNames,
+  SemverComparatorFn
+>([
+  ['satisfies', satisfies],
+  ['gt', gt],
+  ['gte', gte],
+  ['lt', lt],
+  ['lte', lte],
+  ['eq', eq],
+  ['neq', neq],
+])
+
+const semverRangeFunctions = new Map<
+  SemverFunctionNames,
+  SemverRangeComparatorFn
+>([
+  ['intersects', intersects],
+  ['subset', subset],
+])
+
+export const parseInternals = (
+  nodes: PostcssNode[],
+  loose: boolean,
+): SemverInternals => {
+  // tries to parse the first param as a string node, otherwise defaults
+  // to reading all postcss nodes as just strings, since it just means
+  // the value was defined as an unquoted string
+  let semverValue = ''
+  try {
+    semverValue = removeQuotes(
+      asStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+        .value,
+    )
+  } catch (err) {
+    if (
+      asError(err).message === 'Mismatching query node' &&
+      isTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+    ) {
+      // Handle tag node (unquoted values like >=2.0.0)
+      const tagNode = asTagNode(
+        asPostcssNodeWithChildren(nodes[0]).nodes[0],
+      )
+      semverValue = tagNode.value
+    } else {
+      throw err
+    }
+  }
+
+  // second param is the function name
+  let fnName: SemverFunctionNames = 'satisfies'
+  try {
+    // if there is a second node defined, try to parse it as a string node
+    // first and if that fails, then parse it as a tag node which just means
+    // it was defined as an unquoted string
+    if (nodes[1]) {
+      try {
+        fnName = asSemverFunctionName(
+          removeQuotes(
+            asStringNode(asPostcssNodeWithChildren(nodes[1]).nodes[0])
+              .value,
+          ),
+        )
+      } catch (err) {
+        if (asError(err).message === 'Mismatching query node') {
+          fnName = asSemverFunctionName(
+            asTagNode(asPostcssNodeWithChildren(nodes[1]).nodes[0])
+              .value,
+          )
+        } else {
+          throw err
+        }
+      }
+    }
+  } catch (e) {
+    // allow invalid semver function names in loose mode, defaults to satisfies
+    if (!loose) {
+      throw e
+    }
+  }
+
+  const semverFunction = semverFunctions.get(fnName)
+  const semverRangeFunction = semverRangeFunctions.get(fnName)
+  // the following should never happen as long as the semver function names
+  // type and Set are correctly mirroring each other values
+  /* c8 ignore start */
+  if (!semverFunction && !semverRangeFunction) {
+    throw error('Invalid semver function name', {
+      found: fnName,
+      validOptions: [
+        ...Array.from(semverFunctions.keys()),
+        ...Array.from(semverRangeFunctions.keys()),
+      ],
+    })
+  }
+  /* c8 ignore stop */
+
+  // optional third param is the compare value
+  let compareAttribute: SemverCompareAttribute
+  if (nodes[2]) {
+    const parentNode = asPostcssNodeWithChildren(nodes[2])
+    const currNode = parentNode.nodes[0]
+    if (isAttributeNode(currNode)) {
+      const { attribute } = asAttributeNode(currNode)
+      compareAttribute = {
+        attribute,
+        properties: [attribute],
+      }
+    } else if (isPseudoNode(currNode)) {
+      compareAttribute = parseAttrInternals(
+        asPseudoNode(currNode).nodes,
+      )
+    } else if (isStringNode(currNode)) {
+      const attribute = removeQuotes(asStringNode(currNode).value)
+      compareAttribute = {
+        attribute,
+        properties: [attribute],
+      }
+    }
+  }
+
+  return {
+    semverValue,
+    semverFunction: semverFunction ?? satisfies,
+    semverRangeFunction,
+    compareAttribute,
+  }
+}
+
+export const semverParser = async (state: ParserState) => {
+  let internals
+  try {
+    internals = parseInternals(
+      asPostcssNodeWithChildren(state.current).nodes,
+      !!state.loose,
+    )
+  } catch (err) {
+    throw error('Failed to parse :semver selector', {
+      cause: err,
+    })
+  }
+
+  const {
+    semverValue,
+    semverFunction,
+    semverRangeFunction,
+    compareAttribute,
+  } = internals
+
+  // Range-vs-range functions (subset, intersects) operate on edges by default
+  if (semverRangeFunction) {
+    if (compareAttribute) {
+      // Compare the semverValue against a manifest property value as ranges
+      for (const node of state.partial.nodes) {
+        const compareValues = getManifestPropertyValues(
+          node,
+          compareAttribute.properties,
+          compareAttribute.attribute,
+        )
+        const compareValue = compareValues?.[0]
+        if (
+          !compareValue ||
+          !semverRangeFunction(compareValue, semverValue)
+        ) {
+          removeNode(state, node)
+        }
+      }
+    } else {
+      // Default: operate on edges using bareSpec
+      for (const edge of state.partial.edges) {
+        const edgeRange = edge.spec.semver ?? edge.spec.bareSpec
+        if (
+          !edgeRange ||
+          !semverRangeFunction(edgeRange, semverValue)
+        ) {
+          removeEdge(state, edge)
+        }
+      }
+      removeUnlinkedNodes(state)
+    }
+    return state
+  }
+
+  for (const node of state.partial.nodes) {
+    if (compareAttribute) {
+      const compareValues = getManifestPropertyValues(
+        node,
+        compareAttribute.properties,
+        compareAttribute.attribute,
+      )
+
+      // if the provided semver value is a fixed semver version and the
+      // compare attribute is resolving to a range value, then we flip the
+      // order of comparison, in case it's a "satisfies" function check
+      const compareValue = compareValues?.[0]
+      const semverValueVersion = parse(semverValue)
+      const compareValueRange =
+        compareValue && parseRange(compareValue)
+      if (
+        semverFunction === satisfies &&
+        semverValueVersion &&
+        compareValueRange
+      ) {
+        if (!satisfies(semverValueVersion, compareValueRange)) {
+          removeNode(state, node)
+        }
+        // otherwise just compares the read attribute to the semver value
+      } else if (
+        !compareValue ||
+        !semverFunction(compareValue, semverValue)
+      ) {
+        removeNode(state, node)
+      }
+    } else {
+      const manifestVersion = node.manifest?.version
+      if (
+        !manifestVersion ||
+        !semverFunction(manifestVersion, semverValue)
+      ) {
+        removeNode(state, node)
+      }
+    }
+  }
+
+  return state
+}

package/src/pseudo/severity.ts

@@ -0,0 +1,231 @@
+import { error } from '@vltpkg/error-cause'
+import {
+  asPostcssNodeWithChildren,
+  asStringNode,
+  asTagNode,
+  isStringNode,
+  isTagNode,
+} from '@vltpkg/dss-parser'
+import {
+  assertSecurityArchive,
+  removeDanglingEdges,
+  removeNode,
+  removeQuotes,
+} from './helpers.ts'
+import type { ParserState } from '../types.ts'
+import type { PostcssNode } from '@vltpkg/dss-parser'
+
+export type SeverityKinds =
+  | '0'
+  | '1'
+  | '2'
+  | '3'
+  | 'critical'
+  | 'high'
+  | 'medium'
+  | 'low'
+  | undefined
+
+export type SeverityAlertTypes =
+  | 'criticalCVE'
+  | 'cve'
+  | 'potentialVulnerability'
+  | 'mildCVE'
+  | undefined
+
+export type SeverityComparator = '>' | '<' | '>=' | '<=' | undefined
+
+const kindsMap = new Map<SeverityKinds, SeverityAlertTypes>([
+  ['critical', 'criticalCVE'],
+  ['high', 'cve'],
+  ['medium', 'potentialVulnerability'],
+  ['low', 'mildCVE'],
+  ['0', 'criticalCVE'],
+  ['1', 'cve'],
+  ['2', 'potentialVulnerability'],
+  ['3', 'mildCVE'],
+])
+
+// Map numerical values to their respective kinds for comparison operations
+const kindLevelMap = new Map<SeverityKinds, number>([
+  ['critical', 0],
+  ['high', 1],
+  ['medium', 2],
+  ['low', 3],
+  ['0', 0],
+  ['1', 1],
+  ['2', 2],
+  ['3', 3],
+])
+
+const kinds = new Set(kindsMap.keys())
+
+export const isSeverityKind = (
+  value?: string,
+): value is SeverityKinds => kinds.has(value as SeverityKinds)
+
+export const asSeverityKind = (value?: string): SeverityKinds => {
+  if (!isSeverityKind(value)) {
+    throw error('Expected a valid severity kind', {
+      found: value,
+      validOptions: Array.from(kinds),
+    })
+  }
+  return value
+}
+
+export const parseInternals = (
+  nodes: PostcssNode[],
+): {
+  kind: SeverityKinds
+  comparator: SeverityComparator
+} => {
+  let kind: SeverityKinds
+  let comparator: SeverityComparator
+
+  if (nodes.length === 0) {
+    throw error('Missing severity kind parameter')
+  }
+
+  let kindValue = ''
+  if (isStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])) {
+    kindValue = removeQuotes(
+      asStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+        .value,
+    )
+  } else if (
+    isTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+  ) {
+    kindValue = asTagNode(
+      asPostcssNodeWithChildren(nodes[0]).nodes[0],
+    ).value
+  }
+
+  // Extract comparator if present
+  if (kindValue.startsWith('>=')) {
+    comparator = '>='
+    kindValue = kindValue.substring(2)
+  } else if (kindValue.startsWith('<=')) {
+    comparator = '<='
+    kindValue = kindValue.substring(2)
+  } else if (kindValue.startsWith('>')) {
+    comparator = '>'
+    kindValue = kindValue.substring(1)
+  } else if (kindValue.startsWith('<')) {
+    comparator = '<'
+    kindValue = kindValue.substring(1)
+  }
+
+  // Parse kind value
+  if (kindValue) {
+    if (isSeverityKind(kindValue)) {
+      kind = kindValue
+    } else {
+      throw error(
+        'Expected a valid severity kind or number between 0-3',
+        {
+          found: kindValue,
+        },
+      )
+    }
+  }
+
+  return { kind, comparator }
+}
+
+export const severity = async (state: ParserState) => {
+  assertSecurityArchive(state, 'severity')
+
+  let internals
+  try {
+    internals = parseInternals(
+      asPostcssNodeWithChildren(state.current).nodes,
+    )
+  } catch (err) {
+    throw error('Failed to parse :severity selector', { cause: err })
+  }
+
+  const { kind, comparator } = internals
+
+  for (const node of state.partial.nodes) {
+    const report = state.securityArchive.get(node.id)
+    // Always exclude nodes that don't have security data or alerts
+    if (!report?.alerts || report.alerts.length === 0) {
+      removeNode(state, node)
+    }
+  }
+
+  for (const node of state.partial.nodes) {
+    const report = state.securityArchive.get(node.id)
+    let exclude = true
+
+    if (report) {
+      if (comparator) {
+        // retrieve the value to compare against
+        const kindLevel = kindLevelMap.get(kind)
+        // the kindLevel value has already been validated at this point
+        // and thus can never return an undefined/falsy value but ts doesn't
+        // know about that, so we have the extra check here
+        /* c8 ignore next - impossible */
+        if (!kindLevel) break
+
+        // Check each alert to find any that match our comparison criteria
+        for (const alert of report.alerts) {
+          // Get the numerical value of the alert type
+          const alertType = alert.type
+
+          // retrieve a key to the current alert level to be compared against
+          const currentAlertLevelKey = [...kindsMap.entries()].find(
+            ([_, alertValue]) => alertValue === alertType,
+          )?.[0]
+
+          // perform the comparison based on the user-provided kindLevel
+          if (currentAlertLevelKey) {
+            const currentAlertLevel = kindLevelMap.get(
+              currentAlertLevelKey,
+            )
+            /* c8 ignore next - impossible but ts doesn't know */
+            if (currentAlertLevel == null) continue
+
+            switch (comparator) {
+              case '>':
+                if (currentAlertLevel > kindLevel) {
+                  exclude = false
+                }
+                break
+              case '<':
+                if (currentAlertLevel < kindLevel) {
+                  exclude = false
+                }
+                break
+              case '>=':
+                if (currentAlertLevel >= kindLevel) {
+                  exclude = false
+                }
+                break
+              case '<=':
+                if (currentAlertLevel <= kindLevel) {
+                  exclude = false
+                }
+                break
+            }
+          }
+        }
+      } else {
+        // Original exact match behavior
+        const alertName = kindsMap.get(kind)
+        exclude = !report.alerts.some(
+          alert => alert.type === alertName,
+        )
+      }
+    }
+
+    if (exclude) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}

package/src/pseudo/shell.ts

@@ -0,0 +1,9 @@
+import { createSecuritySelectorFilter } from './helpers.ts'
+
+/**
+ * Filters out any node that does not have a **shellAccess** report alert.
+ */
+export const shell = createSecuritySelectorFilter(
+  'shell',
+  'shellAccess',
+)

package/src/pseudo/shrinkwrap.ts

@@ -0,0 +1,9 @@
+import { createSecuritySelectorFilter } from './helpers.ts'
+
+/**
+ * Filters out any node that does not have a **shrinkwrap** report alert.
+ */
+export const shrinkwrap = createSecuritySelectorFilter(
+  'shrinkwrap',
+  'shrinkwrap',
+)

package/src/pseudo/spec.ts

@@ -0,0 +1,131 @@
+import { error } from '@vltpkg/error-cause'
+import { asError } from '@vltpkg/types'
+import {
+  asPostcssNodeWithChildren,
+  asStringNode,
+  asTagNode,
+  isTagNode,
+} from '@vltpkg/dss-parser'
+import {
+  removeEdge,
+  removeUnlinkedNodes,
+  removeQuotes,
+} from './helpers.ts'
+import type { ParserState } from '../types.ts'
+import type { PostcssNode } from '@vltpkg/dss-parser'
+
+export type SpecInternals = {
+  specValue: string
+}
+
+export const parseInternals = (
+  nodes: PostcssNode[],
+): SpecInternals => {
+  // tries to parse the first param as a string node, otherwise defaults
+  // to reading all postcss nodes as just strings, since it just means
+  // the value was defined as an unquoted string
+  let specValue = ''
+
+  if (nodes.length === 0) {
+    throw new Error('No nodes provided to parseInternals')
+  }
+
+  const firstNode = asPostcssNodeWithChildren(nodes[0])
+
+  if (firstNode.nodes.length === 0) {
+    throw new Error('First node has no child nodes')
+  }
+
+  // Try to parse as a quoted string first (single string node)
+  if (firstNode.nodes.length === 1) {
+    const targetNode = firstNode.nodes[0]
+    try {
+      specValue = removeQuotes(asStringNode(targetNode).value)
+      return { specValue }
+    } catch (err) {
+      if (
+        asError(err).message === 'Mismatching query node' &&
+        isTagNode(targetNode)
+        /* c8 ignore start */
+      ) {
+        // Handle simple unquoted single-token values like "1"
+        const tagNode = asTagNode(targetNode)
+        specValue = tagNode.value
+        return { specValue }
+        /* c8 ignore stop */
+      } else {
+        throw err
+      }
+    }
+  }
+
+  // Handle unquoted complex values that get parsed into multiple nodes
+  // This happens when unquoted values contain dots, like ^1.0.0 which becomes:
+  // - Tag: "^1"
+  // - ClassName: "0" (from .0)
+  // - ClassName: "0" (from .0)
+  // We need to reconstruct the original value by concatenating all nodes
+  const parts: string[] = []
+
+  for (const node of firstNode.nodes) {
+    switch (node.type) {
+      case 'tag':
+        parts.push(asTagNode(node).value)
+        break
+      case 'class':
+        // Class nodes represent .className in CSS, so we need to add the dot back
+        parts.push('.' + node.value)
+        break
+      case 'id':
+        // ID nodes represent #idName in CSS, so we need to add the hash back
+        parts.push('#' + node.value)
+        break
+      case 'string':
+        parts.push(removeQuotes(asStringNode(node).value))
+        break
+      default:
+        // For other node types, try to get the value property or convert to string
+        /* c8 ignore next */
+        parts.push(node.value ?? String(node))
+        break
+    }
+  }
+
+  specValue = parts.join('')
+  return { specValue }
+}
+
+/**
+ * :spec Pseudo-Selector, matches edges where edge.spec.bareSpec equals the provided value.
+ *
+ * Examples:
+ * - :spec("*") matches edges with a package specifier equal to "*"
+ * - :spec(^1.0.0) matches edges with a package specifier equal to "^1.0.0"
+ * - :spec("catalog:") matches edges with a package specifier equal to "catalog:"
+ * - :spec("workspace:dev") matches edges with a package specifier equal to "workspace:dev"
+ */
+export const spec = async (state: ParserState) => {
+  let internals
+  try {
+    internals = parseInternals(
+      asPostcssNodeWithChildren(state.current).nodes,
+    )
+  } catch (err) {
+    throw error('Failed to parse :spec selector', {
+      cause: err,
+    })
+  }
+
+  const { specValue } = internals
+
+  for (const edge of state.partial.edges) {
+    if (edge.spec.bareSpec !== specValue) {
+      removeEdge(state, edge)
+    }
+  }
+
+  // Clean up unlinked nodes after removing edges
+  removeUnlinkedNodes(state)
+
+  return state
+}