@vltpkg/query 1.0.0-rc.32 → 1.0.0-rc.34

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (215) hide show
  1. package/dist/index.js +10 -6
  2. package/dist/parser.js +2 -1
  3. package/dist/pseudo/hostname.js +3 -1
  4. package/dist/pseudo/malware.d.ts +3 -16
  5. package/dist/pseudo/malware.js +11 -171
  6. package/dist/pseudo/scripts.js +1 -1
  7. package/dist/pseudo/vuln.d.ts +22 -0
  8. package/dist/pseudo/vuln.js +220 -0
  9. package/dist/pseudo.js +3 -3
  10. package/dist/types.d.ts +3 -2
  11. package/package.json +19 -10
  12. package/skills/dss-query/REFERENCE.md +123 -0
  13. package/skills/dss-query/SKILL.md +190 -0
  14. package/skills/dss-query/evals/README.md +79 -0
  15. package/skills/dss-query/evals/evals.json +89 -0
  16. package/skills/dss-query/evals/grade.mjs +480 -0
  17. package/src/attribute.ts +186 -0
  18. package/src/combinator.ts +132 -0
  19. package/src/id.ts +46 -0
  20. package/src/index.ts +620 -0
  21. package/src/parser.ts +122 -0
  22. package/src/pseudo/abandoned.ts +9 -0
  23. package/src/pseudo/attr.ts +92 -0
  24. package/src/pseudo/built.ts +19 -0
  25. package/src/pseudo/confused.ts +29 -0
  26. package/src/pseudo/cve.ts +93 -0
  27. package/src/pseudo/cwe.ts +97 -0
  28. package/src/pseudo/debug.ts +9 -0
  29. package/src/pseudo/deprecated.ts +9 -0
  30. package/src/pseudo/dev.ts +18 -0
  31. package/src/pseudo/diff.ts +90 -0
  32. package/src/pseudo/dist.ts +144 -0
  33. package/src/pseudo/dynamic.ts +9 -0
  34. package/src/pseudo/empty.ts +15 -0
  35. package/src/pseudo/entropic.ts +9 -0
  36. package/src/pseudo/env.ts +6 -0
  37. package/src/pseudo/eval.ts +9 -0
  38. package/src/pseudo/fs.ts +9 -0
  39. package/src/pseudo/helpers.ts +106 -0
  40. package/src/pseudo/host.ts +111 -0
  41. package/src/pseudo/hostname.ts +156 -0
  42. package/src/pseudo/license.ts +134 -0
  43. package/src/pseudo/link.ts +30 -0
  44. package/src/pseudo/malware.ts +41 -0
  45. package/src/pseudo/minified.ts +9 -0
  46. package/src/pseudo/missing.ts +16 -0
  47. package/src/pseudo/native.ts +9 -0
  48. package/src/pseudo/network.ts +9 -0
  49. package/src/pseudo/obfuscated.ts +9 -0
  50. package/src/pseudo/optional.ts +18 -0
  51. package/src/pseudo/outdated.ts +305 -0
  52. package/src/pseudo/overridden.ts +20 -0
  53. package/src/pseudo/path.ts +146 -0
  54. package/src/pseudo/peer.ts +18 -0
  55. package/src/pseudo/prerelease.ts +47 -0
  56. package/src/pseudo/private.ts +19 -0
  57. package/src/pseudo/prod.ts +18 -0
  58. package/src/pseudo/published.ts +248 -0
  59. package/src/pseudo/registry.ts +29 -0
  60. package/src/pseudo/root.ts +19 -0
  61. package/src/pseudo/scanned.ts +20 -0
  62. package/src/pseudo/score.ts +186 -0
  63. package/src/pseudo/scripts.ts +54 -0
  64. package/src/pseudo/semver.ts +320 -0
  65. package/src/pseudo/severity.ts +231 -0
  66. package/src/pseudo/shell.ts +9 -0
  67. package/src/pseudo/shrinkwrap.ts +9 -0
  68. package/src/pseudo/spec.ts +131 -0
  69. package/src/pseudo/squat.ts +225 -0
  70. package/src/pseudo/suspicious.ts +9 -0
  71. package/src/pseudo/tracker.ts +9 -0
  72. package/src/pseudo/trivial.ts +9 -0
  73. package/src/pseudo/type.ts +26 -0
  74. package/src/pseudo/undesirable.ts +9 -0
  75. package/src/pseudo/unknown.ts +9 -0
  76. package/src/pseudo/unmaintained.ts +9 -0
  77. package/src/pseudo/unpopular.ts +9 -0
  78. package/src/pseudo/unstable.ts +9 -0
  79. package/src/pseudo/vuln.ts +273 -0
  80. package/src/pseudo/workspace.ts +22 -0
  81. package/src/pseudo.ts +413 -0
  82. package/src/types.ts +165 -0
  83. package/tap-snapshots/test/attribute.ts.test.cjs +304 -0
  84. package/tap-snapshots/test/combinator.ts.test.cjs +333 -0
  85. package/tap-snapshots/test/id.ts.test.cjs +118 -0
  86. package/tap-snapshots/test/parser.ts.test.cjs +344 -0
  87. package/tap-snapshots/test/pseudo/abandoned.ts.test.cjs +18 -0
  88. package/tap-snapshots/test/pseudo/attr.ts.test.cjs +161 -0
  89. package/tap-snapshots/test/pseudo/built.ts.test.cjs +70 -0
  90. package/tap-snapshots/test/pseudo/confused.ts.test.cjs +32 -0
  91. package/tap-snapshots/test/pseudo/cve.ts.test.cjs +49 -0
  92. package/tap-snapshots/test/pseudo/cwe.ts.test.cjs +49 -0
  93. package/tap-snapshots/test/pseudo/debug.ts.test.cjs +18 -0
  94. package/tap-snapshots/test/pseudo/deprecated.ts.test.cjs +18 -0
  95. package/tap-snapshots/test/pseudo/dist.ts.test.cjs +30 -0
  96. package/tap-snapshots/test/pseudo/dynamic.ts.test.cjs +18 -0
  97. package/tap-snapshots/test/pseudo/empty.ts.test.cjs +50 -0
  98. package/tap-snapshots/test/pseudo/entropic.ts.test.cjs +18 -0
  99. package/tap-snapshots/test/pseudo/env.ts.test.cjs +18 -0
  100. package/tap-snapshots/test/pseudo/eval.ts.test.cjs +18 -0
  101. package/tap-snapshots/test/pseudo/fs.ts.test.cjs +18 -0
  102. package/tap-snapshots/test/pseudo/helpers.ts.test.cjs +18 -0
  103. package/tap-snapshots/test/pseudo/hostname.ts.test.cjs +148 -0
  104. package/tap-snapshots/test/pseudo/license.ts.test.cjs +41 -0
  105. package/tap-snapshots/test/pseudo/link.ts.test.cjs +36 -0
  106. package/tap-snapshots/test/pseudo/malware.ts.test.cjs +22 -0
  107. package/tap-snapshots/test/pseudo/minified.ts.test.cjs +18 -0
  108. package/tap-snapshots/test/pseudo/missing.ts.test.cjs +30 -0
  109. package/tap-snapshots/test/pseudo/native.ts.test.cjs +18 -0
  110. package/tap-snapshots/test/pseudo/network.ts.test.cjs +18 -0
  111. package/tap-snapshots/test/pseudo/obfuscated.ts.test.cjs +18 -0
  112. package/tap-snapshots/test/pseudo/outdated.ts.test.cjs +130 -0
  113. package/tap-snapshots/test/pseudo/overridden.ts.test.cjs +75 -0
  114. package/tap-snapshots/test/pseudo/prerelease.ts.test.cjs +101 -0
  115. package/tap-snapshots/test/pseudo/private.ts.test.cjs +38 -0
  116. package/tap-snapshots/test/pseudo/published.ts.test.cjs +171 -0
  117. package/tap-snapshots/test/pseudo/registry.ts.test.cjs +68 -0
  118. package/tap-snapshots/test/pseudo/root.ts.test.cjs +24 -0
  119. package/tap-snapshots/test/pseudo/scanned.ts.test.cjs +18 -0
  120. package/tap-snapshots/test/pseudo/score.ts.test.cjs +239 -0
  121. package/tap-snapshots/test/pseudo/scripts.ts.test.cjs +61 -0
  122. package/tap-snapshots/test/pseudo/semver.ts.test.cjs +575 -0
  123. package/tap-snapshots/test/pseudo/severity.ts.test.cjs +95 -0
  124. package/tap-snapshots/test/pseudo/shell.ts.test.cjs +18 -0
  125. package/tap-snapshots/test/pseudo/shrinkwrap.ts.test.cjs +18 -0
  126. package/tap-snapshots/test/pseudo/spec.ts.test.cjs +148 -0
  127. package/tap-snapshots/test/pseudo/squat.ts.test.cjs +129 -0
  128. package/tap-snapshots/test/pseudo/suspicious.ts.test.cjs +18 -0
  129. package/tap-snapshots/test/pseudo/tracker.ts.test.cjs +18 -0
  130. package/tap-snapshots/test/pseudo/trivial.ts.test.cjs +18 -0
  131. package/tap-snapshots/test/pseudo/type.ts.test.cjs +51 -0
  132. package/tap-snapshots/test/pseudo/undesirable.ts.test.cjs +18 -0
  133. package/tap-snapshots/test/pseudo/unknown.ts.test.cjs +18 -0
  134. package/tap-snapshots/test/pseudo/unmaintained.ts.test.cjs +18 -0
  135. package/tap-snapshots/test/pseudo/unpopular.ts.test.cjs +18 -0
  136. package/tap-snapshots/test/pseudo/unstable.ts.test.cjs +18 -0
  137. package/tap-snapshots/test/pseudo/vuln.ts.test.cjs +208 -0
  138. package/tap-snapshots/test/pseudo/vulnerable.ts.test.cjs +20 -0
  139. package/tap-snapshots/test/pseudo/workspace.ts.test.cjs +19 -0
  140. package/tap-snapshots/test/pseudo.ts.test.cjs +1247 -0
  141. package/test/attribute.ts +266 -0
  142. package/test/combinator.ts +168 -0
  143. package/test/fixtures/graph.ts +999 -0
  144. package/test/fixtures/selector.ts +103 -0
  145. package/test/fixtures/types.ts +7 -0
  146. package/test/id.ts +102 -0
  147. package/test/index.ts +1000 -0
  148. package/test/parser.ts +117 -0
  149. package/test/pseudo/abandoned.ts +98 -0
  150. package/test/pseudo/attr.ts +298 -0
  151. package/test/pseudo/built.ts +214 -0
  152. package/test/pseudo/confused.ts +160 -0
  153. package/test/pseudo/cve.ts +249 -0
  154. package/test/pseudo/cwe.ts +255 -0
  155. package/test/pseudo/debug.ts +98 -0
  156. package/test/pseudo/deprecated.ts +98 -0
  157. package/test/pseudo/dev.ts +61 -0
  158. package/test/pseudo/diff.ts +417 -0
  159. package/test/pseudo/dist.ts +215 -0
  160. package/test/pseudo/dynamic.ts +98 -0
  161. package/test/pseudo/empty.ts +108 -0
  162. package/test/pseudo/entropic.ts +101 -0
  163. package/test/pseudo/env.ts +98 -0
  164. package/test/pseudo/eval.ts +98 -0
  165. package/test/pseudo/fs.ts +98 -0
  166. package/test/pseudo/helpers.ts +370 -0
  167. package/test/pseudo/host-context.ts +276 -0
  168. package/test/pseudo/hostname.ts +314 -0
  169. package/test/pseudo/license.ts +265 -0
  170. package/test/pseudo/link.ts +94 -0
  171. package/test/pseudo/malware.ts +184 -0
  172. package/test/pseudo/minified.ts +98 -0
  173. package/test/pseudo/missing.ts +111 -0
  174. package/test/pseudo/native.ts +98 -0
  175. package/test/pseudo/network.ts +98 -0
  176. package/test/pseudo/obfuscated.ts +98 -0
  177. package/test/pseudo/optional.ts +73 -0
  178. package/test/pseudo/outdated.ts +331 -0
  179. package/test/pseudo/overridden.ts +317 -0
  180. package/test/pseudo/path.ts +680 -0
  181. package/test/pseudo/peer.ts +101 -0
  182. package/test/pseudo/prerelease.ts +279 -0
  183. package/test/pseudo/private.ts +108 -0
  184. package/test/pseudo/prod.ts +61 -0
  185. package/test/pseudo/published.ts +557 -0
  186. package/test/pseudo/registry.ts +122 -0
  187. package/test/pseudo/root.ts +66 -0
  188. package/test/pseudo/scanned.ts +78 -0
  189. package/test/pseudo/score.ts +591 -0
  190. package/test/pseudo/scripts.ts +294 -0
  191. package/test/pseudo/semver.ts +822 -0
  192. package/test/pseudo/severity.ts +310 -0
  193. package/test/pseudo/shell.ts +98 -0
  194. package/test/pseudo/shrinkwrap.ts +98 -0
  195. package/test/pseudo/spec.ts +525 -0
  196. package/test/pseudo/squat.ts +565 -0
  197. package/test/pseudo/suspicious.ts +98 -0
  198. package/test/pseudo/tracker.ts +98 -0
  199. package/test/pseudo/trivial.ts +98 -0
  200. package/test/pseudo/type.ts +105 -0
  201. package/test/pseudo/undesirable.ts +98 -0
  202. package/test/pseudo/unknown.ts +98 -0
  203. package/test/pseudo/unmaintained.ts +98 -0
  204. package/test/pseudo/unpopular.ts +98 -0
  205. package/test/pseudo/unstable.ts +98 -0
  206. package/test/pseudo/vuln.ts +625 -0
  207. package/test/pseudo/vulnerable.ts +137 -0
  208. package/test/pseudo/workspace.ts +111 -0
  209. package/test/pseudo.ts +558 -0
  210. package/tsconfig.json +3 -0
  211. package/tsconfig.publish.json +19 -0
  212. package/tsconfig.publish.tsbuildinfo +1 -0
  213. package/typedoc.mjs +2 -0
  214. package/dist/pseudo/vulnerable.d.ts +0 -8
  215. package/dist/pseudo/vulnerable.js +0 -17
@@ -0,0 +1,132 @@
1
+ import { asCombinatorNode } from '@vltpkg/dss-parser'
2
+ import { error } from '@vltpkg/error-cause'
3
+ import type { EdgeLike, NodeLike } from '@vltpkg/types'
4
+ import type { ParserState, ParserFn } from './types.ts'
5
+
6
+ /**
7
+ * Returns a new set of nodes, containing all direct dependencies
8
+ * of the current list of nodes used.
9
+ *
10
+ * ref: https://developer.mozilla.org/en-US/docs/Web/CSS/Child_combinator
11
+ */
12
+ const childCombinator = async (state: ParserState) => {
13
+ const traverse = new Set(state.partial.nodes)
14
+ state.partial.edges.clear()
15
+ state.partial.nodes.clear()
16
+
17
+ // visit direct children of the current list of nodes
18
+ // collecting refs to these children and the edges that
19
+ // connected them.
20
+ for (const node of traverse) {
21
+ for (const edge of node.edgesOut.values()) {
22
+ if (edge.to) {
23
+ state.partial.edges.add(edge)
24
+ state.partial.nodes.add(edge.to)
25
+ }
26
+ }
27
+ }
28
+
29
+ return state
30
+ }
31
+
32
+ /**
33
+ * Returns a new set of nodes, containing nodes that are also children
34
+ * of all parent nodes to the current list of nodes used.
35
+ *
36
+ * Note: The subsequent-sibling comparator has a behavior that is
37
+ * somehow approximative of that of its css counterpart, given that
38
+ * in the context of dependency graphs the order of appearance is
39
+ * not necessarily controlled by the end user. The approach for
40
+ * this comparator is to match all siblings of a node.
41
+ *
42
+ * ref: https://developer.mozilla.org/en-US/docs/Web/CSS/Subsequent-sibling_combinator
43
+ */
44
+ const subsequentSiblingCombinator = async (state: ParserState) => {
45
+ const traverse = new Set(state.partial.nodes)
46
+ state.partial.edges.clear()
47
+ state.partial.nodes.clear()
48
+
49
+ // visits direct parents of the current list of node and then
50
+ // visit their children, collecting refs to all children and edges
51
+ // that are not in the original list of nodes.
52
+ for (const node of traverse) {
53
+ for (const edge of node.edgesIn) {
54
+ const parents: IterableIterator<EdgeLike> =
55
+ edge.from.edgesOut.values()
56
+ for (const edge of parents) {
57
+ if (edge.to && edge.to !== node) {
58
+ state.partial.edges.add(edge)
59
+ state.partial.nodes.add(edge.to)
60
+ }
61
+ }
62
+ }
63
+ }
64
+
65
+ return state
66
+ }
67
+
68
+ /**
69
+ * Returns a new set of nodes containing all nodes that are descendents
70
+ * to items in the current list of nodes.
71
+ *
72
+ * ref: https://developer.mozilla.org/en-US/docs/Web/CSS/Descendant_combinator
73
+ */
74
+ const descendentCombinator = async (state: ParserState) => {
75
+ // spaces between tags selectors are a noop
76
+ if (state.prev?.type === 'tag' || state.next?.type === 'tag') {
77
+ return state
78
+ }
79
+
80
+ const traverse = new Set<NodeLike>(state.partial.nodes)
81
+ state.partial.edges.clear()
82
+ state.partial.nodes.clear()
83
+
84
+ // breadth-first traversal of the graph, starting from the current
85
+ // list of nodes, collecting all nodes and edges along the way
86
+ for (const node of traverse) {
87
+ const children = new Set<NodeLike>()
88
+ for (const edge of node.edgesOut.values()) {
89
+ if (edge.to) {
90
+ children.add(edge.to)
91
+ state.partial.edges.add(edge)
92
+ state.partial.nodes.add(edge.to)
93
+ }
94
+ }
95
+ for (const child of children) {
96
+ traverse.add(child)
97
+ }
98
+ }
99
+
100
+ return state
101
+ }
102
+
103
+ const combinatorSelectors = {
104
+ '>': childCombinator,
105
+ '~': subsequentSiblingCombinator,
106
+ ' ': descendentCombinator,
107
+ }
108
+
109
+ const combinatorSelectorsMap = new Map<string, ParserFn>(
110
+ Object.entries(combinatorSelectors),
111
+ )
112
+
113
+ /**
114
+ * Parse css-style combinators, e.g: `>`, `~` and ` `
115
+ */
116
+ export const combinator = async (state: ParserState) => {
117
+ await state.cancellable()
118
+
119
+ const curr = asCombinatorNode(state.current)
120
+ const parserFn =
121
+ curr.value && combinatorSelectorsMap.get(curr.value)
122
+ if (!parserFn) {
123
+ if (state.loose) {
124
+ return state
125
+ }
126
+
127
+ throw error(`Unsupported combinator: ${state.current.value}`, {
128
+ found: state.current,
129
+ })
130
+ }
131
+ return parserFn(state)
132
+ }
package/src/id.ts ADDED
@@ -0,0 +1,46 @@
1
+ import { asIdentifierNode } from '@vltpkg/dss-parser'
2
+ import { error } from '@vltpkg/error-cause'
3
+ import type { ParserState } from './types.ts'
4
+
5
+ /**
6
+ * Parse ids, e.g: `#foo`
7
+ */
8
+ export const id = async (
9
+ state: ParserState,
10
+ ): Promise<ParserState> => {
11
+ const { value } = asIdentifierNode(state.current)
12
+
13
+ /* c8 ignore start - should not be possible */
14
+ if (!value) {
15
+ throw error('Missing identifier name')
16
+ }
17
+ /* c8 ignore stop */
18
+
19
+ // Filter out any edges and their linked
20
+ // nodes if they don't match the id value
21
+ for (const edge of state.partial.edges) {
22
+ if (edge.name !== value) {
23
+ state.partial.edges.delete(edge)
24
+ if (edge.to) {
25
+ state.partial.nodes.delete(edge.to)
26
+ }
27
+ }
28
+ }
29
+
30
+ // Filter out importer nodes, this extra step is needed
31
+ // to filter out nodes that have no edges linking to them
32
+ for (const node of state.partial.nodes) {
33
+ if (
34
+ node.edgesIn.size === 0 &&
35
+ node.name !== value &&
36
+ state.partial.nodes.has(node)
37
+ ) {
38
+ state.partial.nodes.delete(node)
39
+ }
40
+ }
41
+
42
+ // Increment the idCounter for specificity
43
+ state.specificity.idCounter += 1
44
+
45
+ return state
46
+ }