@vltpkg/query 1.0.0-rc.8 → 1.0.1

package/src/pseudo/dist.ts

@@ -0,0 +1,144 @@
+import pRetry, { AbortError } from 'p-retry'
+import { hydrate, splitDepID } from '@vltpkg/dep-id/browser'
+import { error } from '@vltpkg/error-cause'
+import {
+  asPostcssNodeWithChildren,
+  asTagNode,
+  asStringNode,
+  isTagNode,
+} from '@vltpkg/dss-parser'
+import {
+  removeDanglingEdges,
+  removeNode,
+  removeQuotes,
+} from './helpers.ts'
+import type { NodeLike, Packument } from '@vltpkg/types'
+import type { ParserState } from '../types.ts'
+
+/**
+ * Fetches the dist-tags of a package from the registry.
+ */
+export const retrieveDistTags = async (
+  node: NodeLike,
+  signal?: AbortSignal,
+): Promise<Record<string, string>> => {
+  const spec = hydrate(node.id, String(node.name), node.options)
+  if (!spec.registry || !node.name) {
+    return {}
+  }
+
+  const url = new URL(spec.registry)
+  url.pathname = `/${node.name}`
+
+  const response = await fetch(String(url), {
+    headers: {
+      Accept: 'application/vnd.npm.install-v1+json',
+    },
+    signal,
+  })
+  if (response.status === 404) {
+    throw new AbortError('Missing API')
+  }
+  if (!response.ok) {
+    throw error('Failed to fetch packument', {
+      name: node.name,
+      spec,
+      response,
+    })
+  }
+  const packument = (await response.json()) as Packument
+  return packument['dist-tags']
+}
+
+/**
+ * Checks whether a node's installed version matches the version
+ * associated with the given dist-tag. Returns the node if it should
+ * be removed (does NOT match), or undefined if it matches.
+ */
+export const queueNode = async (
+  state: ParserState,
+  node: NodeLike,
+  tagName: string,
+): Promise<NodeLike | undefined> => {
+  if (!node.name || !node.version) {
+    return node
+  }
+
+  let distTags: Record<string, string>
+  try {
+    distTags = await pRetry(
+      () => retrieveDistTags(node, state.signal),
+      {
+        retries: state.retries,
+        signal: state.signal,
+      },
+    )
+  } catch (err) {
+    // eslint-disable-next-line no-console
+    console.warn(
+      error('Could not retrieve dist-tags', {
+        name: node.name,
+        cause: err,
+      }),
+    )
+    return node
+  }
+
+  const tagVersion = distTags[tagName]
+  if (tagVersion !== node.version) {
+    return node
+  }
+
+  return undefined
+}
+
+/**
+ * :dist(tag) Pseudo-Selector, matches only nodes whose installed
+ * version corresponds to the given dist-tag in the registry.
+ *
+ * Examples:
+ * - :dist(latest) — matches packages at the `latest` dist-tag version
+ * - :dist(nightly) — matches packages at the `nightly` dist-tag version
+ * - :not(:dist(nightly)) — excludes nightly-tagged versions
+ */
+export const dist = async (state: ParserState) => {
+  const top = asPostcssNodeWithChildren(state.current)
+  const selector = asPostcssNodeWithChildren(top.nodes[0])
+  const firstChild = selector.nodes[0]
+
+  let tagName: string
+  try {
+    tagName = removeQuotes(asStringNode(firstChild).value)
+  } catch {
+    if (isTagNode(firstChild)) {
+      tagName = asTagNode(firstChild).value
+      /* c8 ignore start */
+    } else {
+      throw error('Failed to parse :dist selector', {
+        found: firstChild,
+      })
+    }
+    /* c8 ignore stop */
+  }
+
+  const queue = []
+
+  for (const node of state.partial.nodes) {
+    if (splitDepID(node.id)[0] !== 'registry') {
+      removeNode(state, node)
+      continue
+    }
+    queue.push(queueNode(state, node, tagName))
+  }
+
+  const removeNodeQueue = await Promise.all(queue)
+  for (const node of removeNodeQueue) {
+    if (node) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}

package/src/pseudo/dynamic.ts

@@ -0,0 +1,9 @@
+import { createSecuritySelectorFilter } from './helpers.ts'
+
+/**
+ * Filters out any node that does not have a **dynamicRequire** report alert.
+ */
+export const dynamic = createSecuritySelectorFilter(
+  'dynamic',
+  'dynamicRequire',
+)

package/src/pseudo/empty.ts

@@ -0,0 +1,15 @@
+import type { ParserState } from '../types.ts'
+import { removeNode } from './helpers.ts'
+
+/**
+ * :empty Pseudo-Selector, matches only nodes that have no children.
+ * It filters out any node that has edges out, i.e., has dependencies.
+ */
+export const empty = async (state: ParserState) => {
+  for (const node of state.partial.nodes) {
+    if (node.edgesOut.size > 0) {
+      removeNode(state, node)
+    }
+  }
+  return state
+}

package/src/pseudo/entropic.ts

@@ -0,0 +1,9 @@
+import { createSecuritySelectorFilter } from './helpers.ts'
+
+/**
+ * Filters out any node that does not have a **highEntropyStrings** report alert.
+ */
+export const entropic = createSecuritySelectorFilter(
+  'entropic',
+  'highEntropyStrings',
+)

package/src/pseudo/env.ts

@@ -0,0 +1,6 @@
+import { createSecuritySelectorFilter } from './helpers.ts'
+
+/**
+ * Filters out any node that does not have a **envVars** report alert.
+ */
+export const env = createSecuritySelectorFilter('env', 'envVars')

package/src/pseudo/eval.ts

@@ -0,0 +1,9 @@
+import { createSecuritySelectorFilter } from './helpers.ts'
+
+/**
+ * Filters out any node that does not have a **usesEval** report alert.
+ */
+export const evalParser = createSecuritySelectorFilter(
+  'eval',
+  'usesEval',
+)

package/src/pseudo/fs.ts

@@ -0,0 +1,9 @@
+import { createSecuritySelectorFilter } from './helpers.ts'
+
+/**
+ * Filters out any node that does not have a **filesystemAccess** report alert.
+ */
+export const fs = createSecuritySelectorFilter(
+  'fs',
+  'filesystemAccess',
+)

package/src/pseudo/helpers.ts

@@ -0,0 +1,106 @@
+import { error } from '@vltpkg/error-cause'
+import type { EdgeLike, NodeLike } from '@vltpkg/types'
+import type { ParserState } from '../types.js'
+
+/**
+ * Removes a node and its incoming edges from the results.
+ */
+export const removeNode = (state: ParserState, node: NodeLike) => {
+  for (const edge of node.edgesIn) {
+    state.partial.edges.delete(edge)
+  }
+  state.partial.nodes.delete(node)
+}
+
+/**
+ * Removes an edge and its outgoing node from the results.
+ */
+export const removeEdge = (state: ParserState, edge: EdgeLike) => {
+  state.partial.edges.delete(edge)
+  if (edge.to?.edgesIn.size === 1) {
+    state.partial.nodes.delete(edge.to)
+  }
+}
+
+/**
+ * Removes any edges that have no destination node from the results.
+ */
+export const removeDanglingEdges = (state: ParserState) => {
+  for (const edge of state.partial.edges) {
+    if (!edge.to || !state.partial.nodes.has(edge.to)) {
+      state.partial.edges.delete(edge)
+    }
+  }
+}
+
+/**
+ * Removes any nodes that have no incoming edges from the results.
+ */
+export const removeUnlinkedNodes = (state: ParserState) => {
+  nodeLoop: for (const node of state.partial.nodes) {
+    for (const edge of state.partial.edges) {
+      if (edge.to === node) {
+        continue nodeLoop
+      }
+    }
+    state.partial.nodes.delete(node)
+  }
+}
+
+/**
+ * Removes quotes from a string value.
+ */
+export const removeQuotes = (value: string) =>
+  value.replace(/^"(.*?)"$/, '$1')
+
+/**
+ * Asserts that the security archive is present.
+ */
+export const assertSecurityArchive: (
+  state: ParserState,
+  name: string,
+) => asserts state is ParserState & {
+  securityArchive: NonNullable<ParserState['securityArchive']>
+} = (state, name) => {
+  if (!state.securityArchive) {
+    throw error(
+      `Missing security archive while trying to parse the :${name} selector`,
+      { found: state },
+    )
+  }
+}
+
+/**
+ * Clears all nodes and edges from the results.
+ */
+export const clear = (state: ParserState): ParserState => {
+  state.partial.nodes.clear()
+  state.partial.edges.clear()
+  return state
+}
+
+/**
+ * Reusable security selector alert filter.
+ */
+export const createSecuritySelectorFilter = (
+  name: string,
+  type: string,
+) => {
+  return async (state: ParserState) => {
+    assertSecurityArchive(state, name)
+
+    for (const node of state.partial.nodes) {
+      const report = state.securityArchive.get(node.id)
+      const exclude = !report?.alerts.some(
+        alert => alert.type === type,
+      )
+      if (exclude) {
+        removeNode(state, node)
+      }
+    }
+
+    removeDanglingEdges(state)
+
+    return state
+  }
+}

package/src/pseudo/host.ts

@@ -0,0 +1,111 @@
+import { error } from '@vltpkg/error-cause'
+import {
+  asPostcssNodeWithChildren,
+  asStringNode,
+  asTagNode,
+  isStringNode,
+  isTagNode,
+} from '@vltpkg/dss-parser'
+import { removeQuotes } from './helpers.ts'
+import type { ParserState } from '../types.ts'
+import type { PostcssNode } from '@vltpkg/dss-parser'
+
+/**
+ * Parses the internal parameters of the :host() pseudo selector.
+ * Returns the context key that should be used to look up the host context function.
+ */
+export const parseInternals = (nodes: PostcssNode[]): string => {
+  let contextKey = ''
+
+  if (isStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])) {
+    contextKey = removeQuotes(
+      asStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+        .value,
+    )
+  } else if (
+    isTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+  ) {
+    const tagNode = asTagNode(
+      asPostcssNodeWithChildren(nodes[0]).nodes[0],
+    )
+    contextKey = tagNode.value
+  }
+
+  if (!contextKey) {
+    throw error('Expected a context key parameter for :host selector')
+  }
+
+  return contextKey
+}
+
+/**
+ * :host Pseudo-Selector, switches the current graph context to a new
+ * set of graphs loaded from a specific host context.
+ *
+ * This selector accepts a single parameter that specifies which host context
+ * to use. The host context must be defined in the hostContexts map provided
+ * to the Query constructor.
+ *
+ * Example:
+ * - :host(local) - Switches to graphs loaded from the local context
+ */
+export const hostContext = async (state: ParserState) => {
+  if (!state.hostContexts) {
+    throw error('No host contexts available for :host selector')
+  }
+
+  let contextKey: string
+  try {
+    contextKey = parseInternals(
+      asPostcssNodeWithChildren(state.current).nodes,
+    )
+  } catch (err) {
+    throw error('Failed to parse :host selector', {
+      cause: err,
+    })
+  }
+
+  const contextFunction = state.hostContexts.get(contextKey)
+  if (!contextFunction) {
+    throw error(`Unknown host context: ${contextKey}`, {
+      validOptions: Array.from(state.hostContexts.keys()),
+    })
+  }
+
+  // Get the graphs from the host context function
+  const {
+    initialEdges,
+    initialNodes,
+    edges,
+    nodes,
+    securityArchive,
+  } = await contextFunction()
+
+  // Clear current nodes and edges
+  state.securityArchive = securityArchive
+  state.initial.nodes.clear()
+  state.initial.edges.clear()
+  state.partial.nodes.clear()
+  state.partial.edges.clear()
+  state.importers.clear()
+
+  // Reset the initial state
+  for (const node of initialNodes) {
+    state.initial.nodes.add(node)
+  }
+  for (const edge of initialEdges) {
+    state.initial.edges.add(edge)
+  }
+
+  // Populate with nodes and edges from all returned graphs
+  for (const node of nodes) {
+    state.partial.nodes.add(node)
+    // use the current selected nodes by the context function as importers
+    state.importers.add(node)
+  }
+  for (const edge of edges) {
+    state.partial.edges.add(edge)
+  }
+
+  return state
+}

package/src/pseudo/hostname.ts

@@ -0,0 +1,156 @@
+import { splitDepID } from '@vltpkg/dep-id/browser'
+import { getOptions, gitHostWebsites } from '@vltpkg/spec/browser'
+import { asPostcssNodeWithChildren } from '@vltpkg/dss-parser'
+import { error } from '@vltpkg/error-cause'
+import { removeDanglingEdges, removeNode } from './helpers.ts'
+import { parseInternals } from './spec.ts'
+import type { ParserState } from '../types.ts'
+
+/**
+ * Given a named git host (e.g. "github"), resolve its hostname
+ * by looking up `gitHostWebsites` (e.g. "github.com"), or
+ * falling back to the `git-hosts` template URL.
+ */
+const resolveGitHostname = (
+  namedHost: string,
+  gitHosts: Record<string, string>,
+): string | undefined => {
+  // Check gitHostWebsites first (e.g. github -> github.com)
+  const website =
+    gitHostWebsites[namedHost as keyof typeof gitHostWebsites]
+  if (website) {
+    try {
+      return new URL(website).hostname
+      /* c8 ignore next */
+    } catch {}
+  }
+
+  // Fall back to parsing the git-hosts template URL
+  const template = gitHosts[namedHost]
+  if (template) {
+    try {
+      // Templates look like 'git+ssh://git@github.com:$1/$2.git'
+      // Replace colons after the host with / for URL parsing
+      const normalized = template
+        .replace(/^git\+/, '')
+        .replace(/:(\$)/, '/$1')
+      return new URL(normalized).hostname
+      /* c8 ignore next */
+    } catch {}
+  }
+  /* c8 ignore next */
+  return undefined
+}
+
+/**
+ * Resolve the hostname for a git remote string.
+ * Named hosts: "github:user/repo" -> extract "github" and look up.
+ * Full URLs: "git+ssh://git@example.com/repo.git" -> parse URL.
+ */
+const getGitHostname = (
+  gitRemote: string,
+  gitHosts: Record<string, string>,
+): string | undefined => {
+  // Check if it's a named git host like "github:user/repo"
+  const colonIdx = gitRemote.indexOf(':')
+  if (colonIdx > 0) {
+    const possibleHost = gitRemote.slice(0, colonIdx)
+    // If this is a known named git host, resolve it
+    if (possibleHost in gitHosts) {
+      return resolveGitHostname(possibleHost, gitHosts)
+    }
+    // Could be a protocol URL like git+ssh://...
+    try {
+      const normalized = gitRemote
+        .replace(/^git\+/, '')
+        .replace(/^ssh:\/\/([^@]+@)?([^:/]+)[:/]/, 'ssh://$1$2/')
+      return new URL(normalized).hostname
+      /* c8 ignore next */
+    } catch {}
+  }
+  /* c8 ignore start - git remotes always contain a colon */
+
+  // Try parsing as a plain URL
+  try {
+    return new URL(gitRemote).hostname
+  } catch {}
+
+  return undefined
+  /* c8 ignore stop */
+}
+
+/**
+ * :hostname(str) Pseudo-Selector, matches only nodes whose
+ * upstream hostname matches the provided domain string.
+ *
+ * Examples:
+ * - :hostname("registry.npmjs.org") — default npm registry deps
+ * - :hostname("github.com") — github git deps
+ * - :hostname("example.com") — custom registry deps
+ */
+export const hostname = async (state: ParserState) => {
+  let internals
+  try {
+    internals = parseInternals(
+      asPostcssNodeWithChildren(state.current).nodes,
+    )
+  } catch (err) {
+    throw error('Failed to parse :hostname selector', {
+      cause: err,
+    })
+  }
+
+  const targetHostname = internals.specValue
+
+  for (const node of state.partial.nodes) {
+    const tuple = splitDepID(node.id)
+    const type = tuple[0]
+    let nodeHostname: string | undefined
+
+    switch (type) {
+      case 'registry': {
+        const registryName = tuple[1]
+        const options = getOptions(node.options)
+        // Look up the registry URL from registries map. There is no
+        // default registry, so a node with an empty registry field and
+        // no configured registry has no hostname, and never matches.
+        const registryUrl =
+          options.registries[registryName] ?? options.registry
+        if (registryUrl) {
+          try {
+            nodeHostname = new URL(registryUrl).hostname
+            /* c8 ignore next */
+          } catch {}
+        }
+        break
+      }
+      case 'git': {
+        const gitRemote = tuple[1]
+        const options = getOptions(node.options)
+        nodeHostname = getGitHostname(gitRemote, options['git-hosts'])
+        break
+      }
+      case 'remote': {
+        const url = tuple[1]
+        try {
+          nodeHostname = new URL(url).hostname
+          /* c8 ignore next */
+        } catch {}
+        break
+      }
+      // file and workspace deps are local — no hostname
+      default: {
+        nodeHostname = undefined
+        break
+      }
+    }
+
+    if (nodeHostname !== targetHostname) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}