@vltpkg/query 1.0.0-rc.32 → 1.0.0-rc.34

package/src/pseudo/score.ts

@@ -0,0 +1,186 @@
+import { error } from '@vltpkg/error-cause'
+import { asError } from '@vltpkg/types'
+import {
+  asPostcssNodeWithChildren,
+  asStringNode,
+  asTagNode,
+  isStringNode,
+  isTagNode,
+} from '@vltpkg/dss-parser'
+import {
+  assertSecurityArchive,
+  removeDanglingEdges,
+  removeNode,
+  removeQuotes,
+} from './helpers.ts'
+import type { PackageScore } from '@vltpkg/security-archive'
+import type { ParserState } from '../types.ts'
+import type { PostcssNode } from '@vltpkg/dss-parser'
+
+export type ScoreKinds = keyof PackageScore
+
+export type ScoreComparator =
+  '>' | '<' | '>=' | '<=' | '=' | undefined
+
+const kinds = new Set<ScoreKinds | undefined>([
+  'overall',
+  'license',
+  'maintenance',
+  'quality',
+  'supplyChain',
+  'vulnerability',
+  undefined,
+])
+
+export const isScoreKind = (value?: string): value is ScoreKinds =>
+  kinds.has(value as ScoreKinds)
+
+export const asScoreKind = (value?: string): ScoreKinds => {
+  if (!isScoreKind(value)) {
+    throw error('Expected a valid score kind', {
+      found: value,
+      validOptions: Array.from(kinds),
+    })
+  }
+  return value
+}
+
+export const parseInternals = (
+  nodes: PostcssNode[],
+): {
+  comparator: ScoreComparator
+  rate: number
+  kind: ScoreKinds
+} => {
+  let rateStr = ''
+  let comparator: ScoreComparator = '='
+  let kind: ScoreKinds = 'overall'
+
+  // Parse the first parameter (rate with optional comparator)
+  if (isStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])) {
+    rateStr = removeQuotes(
+      asStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+        .value,
+    )
+  } else if (
+    isTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+  ) {
+    const tagNode = asTagNode(
+      asPostcssNodeWithChildren(nodes[0]).nodes[0],
+    )
+    rateStr = tagNode.value
+  }
+
+  // Extract comparator if present
+  if (rateStr.startsWith('>=')) {
+    comparator = '>='
+    rateStr = rateStr.substring(2)
+  } else if (rateStr.startsWith('<=')) {
+    comparator = '<='
+    rateStr = rateStr.substring(2)
+  } else if (rateStr.startsWith('>')) {
+    comparator = '>'
+    rateStr = rateStr.substring(1)
+  } else if (rateStr.startsWith('<')) {
+    comparator = '<'
+    rateStr = rateStr.substring(1)
+  }
+
+  // Parse rate as number
+  let rate = parseFloat(rateStr)
+
+  // Normalize to 0-1 range if needed
+  if (rate > 1) {
+    rate = rate / 100
+  }
+
+  // Validate rate is in acceptable range
+  if (rate < 0 || rate > 1) {
+    throw error('Expected rate to be between 0 and 100', {
+      found: rateStr,
+    })
+  }
+
+  // Parse the second parameter (kind) if present
+  if (nodes.length > 1) {
+    if (isStringNode(asPostcssNodeWithChildren(nodes[1]).nodes[0])) {
+      kind = asScoreKind(
+        removeQuotes(
+          asStringNode(asPostcssNodeWithChildren(nodes[1]).nodes[0])
+            .value,
+        ),
+      )
+    } else if (
+      isTagNode(asPostcssNodeWithChildren(nodes[1]).nodes[0])
+    ) {
+      kind = asScoreKind(
+        asTagNode(asPostcssNodeWithChildren(nodes[1]).nodes[0]).value,
+      )
+    }
+  }
+
+  return { comparator, rate, kind }
+}
+
+export const score = async (state: ParserState) => {
+  assertSecurityArchive(state, 'score')
+
+  let internals
+  try {
+    internals = parseInternals(
+      asPostcssNodeWithChildren(state.current).nodes,
+    )
+  } catch (err) {
+    if (asError(err).message === 'Expected a query node') {
+      // No parameters provided - pseudo state form: match ANY score (scanned packages)
+      for (const node of state.partial.nodes) {
+        const report = state.securityArchive.get(node.id)
+        if (!report) {
+          removeNode(state, node)
+        }
+      }
+      removeDanglingEdges(state)
+      return state
+    } else {
+      throw error('Failed to parse :score selector', { cause: err })
+    }
+  }
+
+  const { comparator, rate, kind } = internals
+  for (const node of state.partial.nodes) {
+    const report = state.securityArchive.get(node.id)
+    if (!report) {
+      removeNode(state, node)
+      continue
+    }
+
+    const scoreValue = report.score[kind]
+
+    let exclude = false
+    switch (comparator) {
+      case '>':
+        exclude = scoreValue <= rate
+        break
+      case '<':
+        exclude = scoreValue >= rate
+        break
+      case '>=':
+        exclude = scoreValue < rate
+        break
+      case '<=':
+        exclude = scoreValue > rate
+        break
+      default: // '='
+        exclude = scoreValue !== rate
+        break
+    }
+
+    if (exclude) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}

package/src/pseudo/scripts.ts

@@ -0,0 +1,54 @@
+import type { NodeLike } from '@vltpkg/types'
+import type { ParserState } from '../types.ts'
+import { removeNode, removeDanglingEdges } from './helpers.ts'
+
+/**
+ * Checks if a node needs to be built based on the conditions from the reify build process:
+ * 1. Has install lifecycle scripts (install, preinstall, postinstall)
+ * 2. Is an importer or git dependency with prepare scripts (prepare, preprepare, postprepare)
+ */
+const nodeNeedsBuild = (node: NodeLike): boolean => {
+  const { manifest } = node
+  /* c8 ignore next */
+  if (!manifest) return false
+
+  const { scripts = {} } = manifest
+
+  // Check for install lifecycle scripts
+  const runInstall = !!(
+    scripts.install ||
+    scripts.preinstall ||
+    scripts.postinstall
+  )
+  if (runInstall) return true
+
+  // Check for prepare scripts on importers or git dependencies
+  const prepable = node.id.startsWith('git') || node.importer
+  const runPrepare =
+    !!(
+      scripts.prepare || scripts.preprepare || scripts.postprepare
+      /* c8 ignore next 2 */
+    ) && prepable
+  if (runPrepare) return true
+
+  return false
+}
+
+/**
+ * :scripts Pseudo-Selector filters nodes based on whether they need to be built.
+ *
+ * A node needs to be built if it has:
+ * - Install lifecycle scripts (install, preinstall, postinstall)
+ * - Prepare scripts on importers or git dependencies (prepare, preprepare, postprepare)
+ */
+export const scripts = async (state: ParserState) => {
+  for (const node of state.partial.nodes) {
+    if (!nodeNeedsBuild(node)) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}

package/src/pseudo/semver.ts

@@ -0,0 +1,320 @@
+import {
+  satisfies,
+  gt,
+  gte,
+  lt,
+  lte,
+  eq,
+  neq,
+  intersects,
+  subset,
+  parse,
+  parseRange,
+} from '@vltpkg/semver'
+import type { Version } from '@vltpkg/semver'
+import { error } from '@vltpkg/error-cause'
+import { asError } from '@vltpkg/types'
+import { parseInternals as parseAttrInternals } from './attr.ts'
+import type { AttrInternals } from './attr.ts'
+import { getManifestPropertyValues } from '../attribute.ts'
+import {
+  asAttributeNode,
+  asPostcssNodeWithChildren,
+  asPseudoNode,
+  asStringNode,
+  asTagNode,
+  isAttributeNode,
+  isPseudoNode,
+  isStringNode,
+  isTagNode,
+} from '@vltpkg/dss-parser'
+import {
+  removeEdge,
+  removeNode,
+  removeQuotes,
+  removeUnlinkedNodes,
+} from './helpers.ts'
+import type { ParserState } from '../types.ts'
+import type { PostcssNode } from '@vltpkg/dss-parser'
+
+export type SemverInternals = {
+  semverValue: string
+  semverFunction: SemverComparatorFn
+  semverRangeFunction: SemverRangeComparatorFn | undefined
+  compareAttribute: SemverCompareAttribute
+}
+
+export type SemverFunctionNames =
+  | 'satisfies'
+  | 'gt'
+  | 'gte'
+  | 'lt'
+  | 'lte'
+  | 'eq'
+  | 'neq'
+  | 'intersects'
+  | 'subset'
+export type SemverComparatorFn = (
+  version: Version | string,
+  range: string,
+) => boolean
+export type SemverRangeComparatorFn = (
+  r1: string,
+  r2: string,
+) => boolean
+export type SemverCompareAttribute =
+  Pick<AttrInternals, 'attribute' | 'properties'> | undefined
+
+const semverFunctionNames = new Set([
+  'satisfies',
+  'gt',
+  'gte',
+  'lt',
+  'lte',
+  'eq',
+  'neq',
+  'intersects',
+  'subset',
+])
+export const isSemverFunctionName = (
+  name: string,
+): name is SemverFunctionNames => semverFunctionNames.has(name)
+
+export const asSemverFunctionName = (
+  name: string,
+): SemverFunctionNames => {
+  if (!isSemverFunctionName(name)) {
+    throw error('Invalid semver function name', {
+      found: name,
+      validOptions: Array.from(semverFunctionNames),
+    })
+  }
+  return name
+}
+
+const semverFunctions = new Map<
+  SemverFunctionNames,
+  SemverComparatorFn
+>([
+  ['satisfies', satisfies],
+  ['gt', gt],
+  ['gte', gte],
+  ['lt', lt],
+  ['lte', lte],
+  ['eq', eq],
+  ['neq', neq],
+])
+
+const semverRangeFunctions = new Map<
+  SemverFunctionNames,
+  SemverRangeComparatorFn
+>([
+  ['intersects', intersects],
+  ['subset', subset],
+])
+
+export const parseInternals = (
+  nodes: PostcssNode[],
+  loose: boolean,
+): SemverInternals => {
+  // tries to parse the first param as a string node, otherwise defaults
+  // to reading all postcss nodes as just strings, since it just means
+  // the value was defined as an unquoted string
+  let semverValue = ''
+  try {
+    semverValue = removeQuotes(
+      asStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+        .value,
+    )
+  } catch (err) {
+    if (
+      asError(err).message === 'Mismatching query node' &&
+      isTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+    ) {
+      // Handle tag node (unquoted values like >=2.0.0)
+      const tagNode = asTagNode(
+        asPostcssNodeWithChildren(nodes[0]).nodes[0],
+      )
+      semverValue = tagNode.value
+    } else {
+      throw err
+    }
+  }
+
+  // second param is the function name
+  let fnName: SemverFunctionNames = 'satisfies'
+  try {
+    // if there is a second node defined, try to parse it as a string node
+    // first and if that fails, then parse it as a tag node which just means
+    // it was defined as an unquoted string
+    if (nodes[1]) {
+      try {
+        fnName = asSemverFunctionName(
+          removeQuotes(
+            asStringNode(asPostcssNodeWithChildren(nodes[1]).nodes[0])
+              .value,
+          ),
+        )
+      } catch (err) {
+        if (asError(err).message === 'Mismatching query node') {
+          fnName = asSemverFunctionName(
+            asTagNode(asPostcssNodeWithChildren(nodes[1]).nodes[0])
+              .value,
+          )
+        } else {
+          throw err
+        }
+      }
+    }
+  } catch (e) {
+    // allow invalid semver function names in loose mode, defaults to satisfies
+    if (!loose) {
+      throw e
+    }
+  }
+
+  const semverFunction = semverFunctions.get(fnName)
+  const semverRangeFunction = semverRangeFunctions.get(fnName)
+  // the following should never happen as long as the semver function names
+  // type and Set are correctly mirroring each other values
+  /* c8 ignore start */
+  if (!semverFunction && !semverRangeFunction) {
+    throw error('Invalid semver function name', {
+      found: fnName,
+      validOptions: [
+        ...Array.from(semverFunctions.keys()),
+        ...Array.from(semverRangeFunctions.keys()),
+      ],
+    })
+  }
+  /* c8 ignore stop */
+
+  // optional third param is the compare value
+  let compareAttribute: SemverCompareAttribute
+  if (nodes[2]) {
+    const parentNode = asPostcssNodeWithChildren(nodes[2])
+    const currNode = parentNode.nodes[0]
+    if (isAttributeNode(currNode)) {
+      const { attribute } = asAttributeNode(currNode)
+      compareAttribute = {
+        attribute,
+        properties: [attribute],
+      }
+    } else if (isPseudoNode(currNode)) {
+      compareAttribute = parseAttrInternals(
+        asPseudoNode(currNode).nodes,
+      )
+    } else if (isStringNode(currNode)) {
+      const attribute = removeQuotes(asStringNode(currNode).value)
+      compareAttribute = {
+        attribute,
+        properties: [attribute],
+      }
+    }
+  }
+
+  return {
+    semverValue,
+    semverFunction: semverFunction ?? satisfies,
+    semverRangeFunction,
+    compareAttribute,
+  }
+}
+
+export const semverParser = async (state: ParserState) => {
+  let internals
+  try {
+    internals = parseInternals(
+      asPostcssNodeWithChildren(state.current).nodes,
+      !!state.loose,
+    )
+  } catch (err) {
+    throw error('Failed to parse :semver selector', {
+      cause: err,
+    })
+  }
+
+  const {
+    semverValue,
+    semverFunction,
+    semverRangeFunction,
+    compareAttribute,
+  } = internals
+
+  // Range-vs-range functions (subset, intersects) operate on edges by default
+  if (semverRangeFunction) {
+    if (compareAttribute) {
+      // Compare the semverValue against a manifest property value as ranges
+      for (const node of state.partial.nodes) {
+        const compareValues = getManifestPropertyValues(
+          node,
+          compareAttribute.properties,
+          compareAttribute.attribute,
+        )
+        const compareValue = compareValues?.[0]
+        if (
+          !compareValue ||
+          !semverRangeFunction(compareValue, semverValue)
+        ) {
+          removeNode(state, node)
+        }
+      }
+    } else {
+      // Default: operate on edges using bareSpec
+      for (const edge of state.partial.edges) {
+        const edgeRange = edge.spec.semver ?? edge.spec.bareSpec
+        if (
+          !edgeRange ||
+          !semverRangeFunction(edgeRange, semverValue)
+        ) {
+          removeEdge(state, edge)
+        }
+      }
+      removeUnlinkedNodes(state)
+    }
+    return state
+  }
+
+  for (const node of state.partial.nodes) {
+    if (compareAttribute) {
+      const compareValues = getManifestPropertyValues(
+        node,
+        compareAttribute.properties,
+        compareAttribute.attribute,
+      )
+
+      // if the provided semver value is a fixed semver version and the
+      // compare attribute is resolving to a range value, then we flip the
+      // order of comparison, in case it's a "satisfies" function check
+      const compareValue = compareValues?.[0]
+      const semverValueVersion = parse(semverValue)
+      const compareValueRange =
+        compareValue && parseRange(compareValue)
+      if (
+        semverFunction === satisfies &&
+        semverValueVersion &&
+        compareValueRange
+      ) {
+        if (!satisfies(semverValueVersion, compareValueRange)) {
+          removeNode(state, node)
+        }
+        // otherwise just compares the read attribute to the semver value
+      } else if (
+        !compareValue ||
+        !semverFunction(compareValue, semverValue)
+      ) {
+        removeNode(state, node)
+      }
+    } else {
+      const manifestVersion = node.manifest?.version
+      if (
+        !manifestVersion ||
+        !semverFunction(manifestVersion, semverValue)
+      ) {
+        removeNode(state, node)
+      }
+    }
+  }
+
+  return state
+}