@vltpkg/query 1.0.0-rc.33 → 1.0.0-rc.34

package/src/index.ts

@@ -186,6 +186,8 @@ const securitySelectors = new Set([
   ':unmaintained',
   ':unpopular',
   ':unstable',
+  ':vuln',
+  ':vulnerable',
 ])
 
 const setMethodToJSON = (node: QueryResponseNode) => {
@@ -360,20 +362,9 @@ export class Query {
             i => i.type === 'licenseException',
           ),
         },
-        malware: {
-          low: securityArchiveEntry.alerts.some(
-            i => i.type === 'gptAnomaly',
-          ),
-          medium: securityArchiveEntry.alerts.some(
-            i => i.type === 'gptSecurity',
-          ),
-          high: securityArchiveEntry.alerts.some(
-            i => i.type === 'gptMalware',
-          ),
-          critical: securityArchiveEntry.alerts.some(
-            i => i.type === 'malware',
-          ),
-        },
+        malware: securityArchiveEntry.alerts.some(
+          i => i.type === 'malware' || i.type === 'gptMalware',
+        ),
         minified: securityArchiveEntry.alerts.some(
           i => i.type === 'minifiedFile',
         ),
@@ -441,6 +432,22 @@ export class Query {
         unstable: securityArchiveEntry.alerts.some(
           i => i.type === 'unstableOwnership',
         ),
+        vuln: {
+          low: securityArchiveEntry.alerts.some(
+            i => i.type === 'mildCVE' || i.type === 'gptAnomaly',
+          ),
+          medium: securityArchiveEntry.alerts.some(
+            i =>
+              i.type === 'potentialVulnerability' ||
+              i.type === 'gptSecurity',
+          ),
+          high: securityArchiveEntry.alerts.some(
+            i => i.type === 'cve',
+          ),
+          critical: securityArchiveEntry.alerts.some(
+            i => i.type === 'criticalCVE',
+          ),
+        },
       }
 
       setMethodToJSON(node)

package/src/parser.ts

@@ -28,12 +28,13 @@ export const unescapeDots = (query: string): string =>
 const pseudoCleanUpNeeded = new Set([
   ':published',
   ':score',
-  ':malware',
   ':severity',
   ':sev',
   ':squat',
   ':semver',
   ':v',
+  ':vuln',
+  ':vulnerable',
   ':path',
 ])
 

package/src/pseudo/malware.ts

@@ -1,244 +1,36 @@
 import { error } from '@vltpkg/error-cause'
-import {
-  asPostcssNodeWithChildren,
-  asStringNode,
-  asTagNode,
-  isStringNode,
-  isTagNode,
-} from '@vltpkg/dss-parser'
+import { asPostcssNodeWithChildren } from '@vltpkg/dss-parser'
 import {
   assertSecurityArchive,
   removeDanglingEdges,
   removeNode,
-  removeQuotes,
 } from './helpers.ts'
 import type { ParserState } from '../types.ts'
-import type { PostcssNode } from '@vltpkg/dss-parser'
-
-export type MalwareKinds =
-  | '0'
-  | '1'
-  | '2'
-  | '3'
-  | 'critical'
-  | 'high'
-  | 'medium'
-  | 'low'
-  | undefined
-
-export type MalwareAlertTypes =
-  'malware' | 'gptMalware' | 'gptSecurity' | 'gptAnomaly' | undefined
-
-export type MalwareComparator = '>' | '<' | '>=' | '<=' | undefined
-
-const kindsMap = new Map<MalwareKinds, MalwareAlertTypes>([
-  ['critical', 'malware'],
-  ['high', 'gptMalware'],
-  ['medium', 'gptSecurity'],
-  ['low', 'gptAnomaly'],
-  ['0', 'malware'],
-  ['1', 'gptMalware'],
-  ['2', 'gptSecurity'],
-  ['3', 'gptAnomaly'],
-])
-
-// Map numerical values to their respective kinds for comparison operations
-const kindLevelMap = new Map<MalwareKinds, number>([
-  ['critical', 0],
-  ['high', 1],
-  ['medium', 2],
-  ['low', 3],
-  ['0', 0],
-  ['1', 1],
-  ['2', 2],
-  ['3', 3],
-])
 
-const kinds = new Set(kindsMap.keys())
-
-export const isMalwareKind = (
-  value?: string,
-): value is MalwareKinds => kinds.has(value as MalwareKinds)
-
-export const asMalwareKind = (value?: string): MalwareKinds => {
-  if (!isMalwareKind(value)) {
-    throw error('Expected a valid malware kind', {
-      found: value,
-      validOptions: Array.from(kinds),
-    })
-  }
-  return value
-}
-
-export const parseInternals = (
-  nodes: PostcssNode[],
-): { kind: MalwareKinds; comparator: MalwareComparator } => {
-  // Handle case where no parameters are provided (parameterless :malware)
-  if (!nodes[0]) {
-    return { kind: undefined, comparator: undefined }
-  }
-
-  const selectorNode = asPostcssNodeWithChildren(nodes[0])
-  if (!selectorNode.nodes[0]) {
-    return { kind: undefined, comparator: undefined }
-  }
-
-  let kindValue = ''
-  let comparator: MalwareComparator = undefined
-  let kind: MalwareKinds
-
-  // Parse the parameter (kind with optional comparator)
-  if (isStringNode(selectorNode.nodes[0])) {
-    kindValue = removeQuotes(
-      asStringNode(selectorNode.nodes[0]).value,
-    )
-  } else if (isTagNode(selectorNode.nodes[0])) {
-    kindValue = asTagNode(selectorNode.nodes[0]).value
-  }
-
-  // Extract comparator if present
-  if (kindValue.startsWith('>=')) {
-    comparator = '>='
-    kindValue = kindValue.substring(2)
-  } else if (kindValue.startsWith('<=')) {
-    comparator = '<='
-    kindValue = kindValue.substring(2)
-  } else if (kindValue.startsWith('>')) {
-    comparator = '>'
-    kindValue = kindValue.substring(1)
-  } else if (kindValue.startsWith('<')) {
-    comparator = '<'
-    kindValue = kindValue.substring(1)
-  }
-
-  // Validate the kind without comparator
-  if (!comparator) {
-    kind = asMalwareKind(kindValue)
-  } else {
-    // For comparisons, just make sure it's a valid numeric value or a valid kind
-    if (isMalwareKind(kindValue)) {
-      kind = kindValue
-    } else {
-      throw error(
-        'Expected a valid malware kind or number between 0-3',
-        {
-          found: kindValue,
-        },
-      )
-    }
-  }
-
-  return { kind, comparator }
-}
+const malwareAlertTypes = new Set(['malware', 'gptMalware'])
 
 /**
- * :malware Pseudo-Selector, matches nodes with malware alerts.
+ * :malware Pseudo-Selector, matches nodes with any malware-related alert.
  *
- * Usage:
- * - :malware - matches malware with severity >= medium (critical, high, medium but not low)
- * - :malware(critical) - matches specific malware kind
- * - :malware(>1) - matches malware with severity greater than 1
- * - :malware(">=medium") - matches malware with severity >= medium
+ * This is a binary selector — no parameters. A node matches if it has
+ * at least one alert whose type is `malware` or `gptMalware`.
  */
 export const malware = async (state: ParserState) => {
   assertSecurityArchive(state, 'malware')
 
-  let internals
-  try {
-    internals = parseInternals(
-      asPostcssNodeWithChildren(state.current).nodes,
+  const currentNode = asPostcssNodeWithChildren(state.current)
+  if (currentNode.nodes.length > 0) {
+    throw error(
+      ':malware selector does not accept parameters. Use :vuln(<severity>) for severity-based filtering.',
     )
-  } catch (err) {
-    throw error('Failed to parse :malware selector', { cause: err })
-  }
-
-  const { kind, comparator } = internals
-  const alertName = comparator ? undefined : kindsMap.get(kind)
-
-  for (const node of state.partial.nodes) {
-    const report = state.securityArchive.get(node.id)
-    // Always exclude nodes that don't have security data or alerts
-    if (!report?.alerts || report.alerts.length === 0) {
-      removeNode(state, node)
-    }
   }
 
   for (const node of state.partial.nodes) {
     const report = state.securityArchive.get(node.id)
-    let exclude = true
-
-    if (report) {
-      if (kind === undefined && comparator === undefined) {
-        // Parameterless :malware - match malware alerts with severity >= medium (exclude low/gptAnomaly)
-        exclude = !report.alerts.some(
-          alert =>
-            alert.type === 'malware' ||
-            alert.type === 'gptMalware' ||
-            alert.type === 'gptSecurity',
-        )
-      } else if (comparator) {
-        // retrieve the value to compare against
-        const kindLevel = kindLevelMap.get(kind)
-        // the kindLevel value has already been validated at this point
-        // and thus can never return an undefined/falsy value but ts doesn't
-        // know about that, so we have the extra check here
-        /* c8 ignore next - impossible */
-        if (kindLevel == null) break
-
-        // Check each alert to find any that match our comparison criteria
-        for (const alert of report.alerts) {
-          // Get the numerical value of the alert type
-          const alertType = alert.type
-
-          // retrieve a key to the current alert level to be compared against
-          const currentAlertLevelKey = [...kindsMap.entries()].find(
-            ([_, alertValue]) => alertValue === alertType,
-          )?.[0]
-
-          // perform the comparison based on the user-provided kindLevel
-          if (currentAlertLevelKey) {
-            const currentAlertLevel = kindLevelMap.get(
-              currentAlertLevelKey,
-            )
-            /* c8 ignore next - impossible but ts doesn't know */
-            if (currentAlertLevel == null) continue
-
-            switch (comparator) {
-              case '>':
-                if (currentAlertLevel > kindLevel) {
-                  exclude = false
-                }
-                break
-              case '<':
-                if (currentAlertLevel < kindLevel) {
-                  exclude = false
-                }
-                break
-              case '>=':
-                if (currentAlertLevel >= kindLevel) {
-                  exclude = false
-                }
-                break
-              case '<=':
-                if (currentAlertLevel <= kindLevel) {
-                  exclude = false
-                }
-                break
-            }
-
-            // If we've found a match, no need to check other alerts
-            if (!exclude) break
-          }
-        }
-      } else {
-        // Original exact match behavior
-        exclude = !report.alerts.some(
-          alert => alert.type === alertName,
-        )
-      }
-    }
-
-    if (exclude) {
+    const hasMalware = report?.alerts.some(alert =>
+      malwareAlertTypes.has(alert.type),
+    )
+    if (!hasMalware) {
       removeNode(state, node)
     }
   }

package/src/pseudo/vuln.ts

@@ -0,0 +1,273 @@
+import { error } from '@vltpkg/error-cause'
+import {
+  asPostcssNodeWithChildren,
+  asStringNode,
+  asTagNode,
+  isStringNode,
+  isTagNode,
+} from '@vltpkg/dss-parser'
+import {
+  assertSecurityArchive,
+  removeDanglingEdges,
+  removeNode,
+  removeQuotes,
+} from './helpers.ts'
+import type { ParserState } from '../types.ts'
+import type { PostcssNode } from '@vltpkg/dss-parser'
+
+export type VulnKinds =
+  | '0'
+  | '1'
+  | '2'
+  | '3'
+  | 'critical'
+  | 'high'
+  | 'medium'
+  | 'low'
+  | undefined
+
+export type VulnComparator = '>' | '<' | '>=' | '<=' | undefined
+
+// Valid vulnerability kind names
+const kinds = new Set<string | undefined>([
+  'critical',
+  'high',
+  'medium',
+  'low',
+  '0',
+  '1',
+  '2',
+  '3',
+])
+
+// Map numerical values to their respective kinds for comparison operations
+const kindLevelMap = new Map<VulnKinds, number>([
+  ['critical', 0],
+  ['high', 1],
+  ['medium', 2],
+  ['low', 3],
+  ['0', 0],
+  ['1', 1],
+  ['2', 2],
+  ['3', 3],
+])
+
+// Maps alert types to their severity level for comparison operations.
+// gptSecurity maps to medium (2), gptAnomaly maps to low (3).
+const alertLevelMap = new Map<string, number>([
+  ['criticalCVE', 0],
+  ['cve', 1],
+  ['potentialVulnerability', 2],
+  ['gptSecurity', 2],
+  ['mildCVE', 3],
+  ['gptAnomaly', 3],
+])
+
+// Maps alert.severity strings to numeric levels for cveId-bearing alerts
+// whose type may not be in alertLevelMap.
+const severityLevelMap = new Map<string, number>([
+  ['critical', 0],
+  ['high', 1],
+  ['medium', 2],
+  ['low', 3],
+])
+
+/**
+ * Returns the severity level for an alert, considering both its type
+ * (via alertLevelMap) and its cveId + severity fields. Alerts with a
+ * cveId are treated as vulnerability alerts even if their type is not
+ * in the closed set.
+ */
+const getAlertLevel = (alert: {
+  type: string
+  severity?: string
+  props?: { cveId?: string }
+}): number | undefined => {
+  const level = alertLevelMap.get(alert.type)
+  if (level != null) return level
+  // Fall back to severity field for alerts carrying a CVE id
+  if (alert.props?.cveId && alert.severity) {
+    return severityLevelMap.get(alert.severity)
+  }
+  return undefined
+}
+
+export const isVulnKind = (value?: string): value is VulnKinds =>
+  kinds.has(value)
+
+export const asVulnKind = (value?: string): VulnKinds => {
+  if (!isVulnKind(value)) {
+    throw error('Expected a valid vuln kind', {
+      found: value,
+      validOptions: Array.from(kinds),
+    })
+  }
+  return value
+}
+
+export const parseInternals = (
+  nodes: PostcssNode[],
+): { kind: VulnKinds; comparator: VulnComparator } => {
+  // Handle case where no parameters are provided (parameterless :vuln)
+  if (!nodes[0]) {
+    return { kind: undefined, comparator: undefined }
+  }
+
+  const selectorNode = asPostcssNodeWithChildren(nodes[0])
+  if (!selectorNode.nodes[0]) {
+    return { kind: undefined, comparator: undefined }
+  }
+
+  let kindValue = ''
+  let comparator: VulnComparator = undefined
+  let kind: VulnKinds
+
+  // Parse the parameter (kind with optional comparator)
+  if (isStringNode(selectorNode.nodes[0])) {
+    kindValue = removeQuotes(
+      asStringNode(selectorNode.nodes[0]).value,
+    )
+  } else if (isTagNode(selectorNode.nodes[0])) {
+    kindValue = asTagNode(selectorNode.nodes[0]).value
+  }
+
+  // Extract comparator if present
+  if (kindValue.startsWith('>=')) {
+    comparator = '>='
+    kindValue = kindValue.substring(2)
+  } else if (kindValue.startsWith('<=')) {
+    comparator = '<='
+    kindValue = kindValue.substring(2)
+  } else if (kindValue.startsWith('>')) {
+    comparator = '>'
+    kindValue = kindValue.substring(1)
+  } else if (kindValue.startsWith('<')) {
+    comparator = '<'
+    kindValue = kindValue.substring(1)
+  }
+
+  // Validate the kind without comparator
+  if (!comparator) {
+    kind = asVulnKind(kindValue)
+  } else {
+    // For comparisons, just make sure it's a valid numeric value or a valid kind
+    if (isVulnKind(kindValue)) {
+      kind = kindValue
+    } else {
+      throw error(
+        'Expected a valid vuln kind or number between 0-3',
+        {
+          found: kindValue,
+        },
+      )
+    }
+  }
+
+  return { kind, comparator }
+}
+
+/**
+ * :vuln / :vulnerable Pseudo-Selector, matches nodes with vulnerability alerts.
+ *
+ * Usage:
+ * - :vuln - matches vulnerabilities with severity >= medium (critical, high, medium but not low)
+ * - :vuln(critical) - matches specific vulnerability kind
+ * - :vuln(>1) - matches vulnerabilities with severity greater than 1
+ * - :vuln(">=medium") - matches vulnerabilities with severity >= medium
+ */
+export const vuln = async (state: ParserState) => {
+  assertSecurityArchive(state, 'vuln')
+
+  let internals
+  try {
+    internals = parseInternals(
+      asPostcssNodeWithChildren(state.current).nodes,
+    )
+  } catch (err) {
+    throw error('Failed to parse :vuln selector', { cause: err })
+  }
+
+  const { kind, comparator } = internals
+
+  for (const node of state.partial.nodes) {
+    const report = state.securityArchive.get(node.id)
+    // Always exclude nodes that don't have security data or alerts
+    if (!report?.alerts || report.alerts.length === 0) {
+      removeNode(state, node)
+    }
+  }
+
+  for (const node of state.partial.nodes) {
+    const report = state.securityArchive.get(node.id)
+    let exclude = true
+
+    if (report) {
+      if (kind === undefined && comparator === undefined) {
+        // Parameterless :vuln - match vuln alerts with severity >= medium
+        // Includes: criticalCVE, cve, potentialVulnerability, gptSecurity,
+        //           and any alert carrying a cveId prop
+        // Excludes: mildCVE, gptAnomaly (low severity)
+        exclude = !report.alerts.some(alert => {
+          const level = getAlertLevel(alert)
+          return level != null && level <= 2
+        })
+      } else if (comparator) {
+        // retrieve the value to compare against
+        const kindLevel = kindLevelMap.get(kind)
+        // the kindLevel value has already been validated at this point
+        // and thus can never return an undefined/falsy value but ts doesn't
+        // know about that, so we have the extra check here
+        /* c8 ignore next - impossible */
+        if (kindLevel == null) break
+
+        // Check each alert to find any that match our comparison criteria
+        for (const alert of report.alerts) {
+          const currentAlertLevel = getAlertLevel(alert)
+          if (currentAlertLevel == null) continue
+
+          switch (comparator) {
+            case '>':
+              if (currentAlertLevel > kindLevel) {
+                exclude = false
+              }
+              break
+            case '<':
+              if (currentAlertLevel < kindLevel) {
+                exclude = false
+              }
+              break
+            case '>=':
+              if (currentAlertLevel >= kindLevel) {
+                exclude = false
+              }
+              break
+            case '<=':
+              if (currentAlertLevel <= kindLevel) {
+                exclude = false
+              }
+              break
+          }
+
+          // If we've found a match, no need to check other alerts
+          if (!exclude) break
+        }
+      } else {
+        // Exact match behavior — also matches gptSecurity/gptAnomaly
+        // at the same level as their mapped kind, and cveId-bearing alerts
+        const targetLevel = kindLevelMap.get(kind)
+        exclude = !report.alerts.some(alert => {
+          const level = getAlertLevel(alert)
+          return level != null && level === targetLevel
+        })
+      }
+    }
+
+    if (exclude) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}

package/src/pseudo.ts

@@ -63,7 +63,7 @@ import { unknown } from './pseudo/unknown.ts'
 import { unmaintained } from './pseudo/unmaintained.ts'
 import { unpopular } from './pseudo/unpopular.ts'
 import { unstable } from './pseudo/unstable.ts'
-import { vulnerable } from './pseudo/vulnerable.ts'
+import { vuln } from './pseudo/vuln.ts'
 import { workspace } from './pseudo/workspace.ts'
 
 import type { EdgeLike, NodeLike } from '@vltpkg/types'
@@ -367,8 +367,8 @@ const pseudoSelectors = new Map<string, ParserFn>(
     unpopular,
     unstable,
     v: semver,
-    vuln: vulnerable,
-    vulnerable,
+    vuln,
+    vulnerable: vuln,
     workspace,
   }),
 )

package/src/types.ts

@@ -109,7 +109,7 @@ export type Insights = {
   eval?: boolean
   fs?: boolean
   license?: LicenseInsights
-  malware?: MalwareInsights
+  malware?: boolean
   minified?: boolean
   native?: boolean
   network?: boolean
@@ -129,6 +129,7 @@ export type Insights = {
   unmaintained?: boolean
   unpopular?: boolean
   unstable?: boolean
+  vuln?: VulnInsights
 }
 
 export type LicenseInsights = {
@@ -149,8 +150,8 @@ export type LeveledInsights = {
   critical: boolean
 }
 
-export type MalwareInsights = LeveledInsights
 export type SeverityInsights = LeveledInsights
+export type VulnInsights = LeveledInsights
 
 export type SquatInsights = {
   medium: boolean