@vltpkg/query 1.0.0-rc.9 → 1.0.1

package/dist/{esm/attribute.d.ts → attribute.d.ts}

@@ -12,4 +12,3 @@ export declare const attributeSelectorsMap: Map<string, ComparatorFn>;
  * Parse attributes selectors, e.g: `[name]`, `[name=value]`, etc
  */
 export declare const attribute: (state: ParserState) => Promise<ParserState>;
-//# sourceMappingURL=attribute.d.ts.map

package/dist/{esm/attribute.js → attribute.js}

@@ -130,4 +130,3 @@ export const attribute = async (state) => {
     state.specificity.commonCounter += 1;
     return filterAttributes(state, operatorFn, value, propertyName, insensitive);
 };
-//# sourceMappingURL=attribute.js.map

package/dist/{esm/combinator.d.ts → combinator.d.ts}

@@ -3,4 +3,3 @@ import type { ParserState } from './types.ts';
  * Parse css-style combinators, e.g: `>`, `~` and ` `
  */
 export declare const combinator: (state: ParserState) => Promise<ParserState>;
-//# sourceMappingURL=combinator.d.ts.map

package/dist/{esm/combinator.js → combinator.js}

@@ -109,4 +109,3 @@ export const combinator = async (state) => {
     }
     return parserFn(state);
 };
-//# sourceMappingURL=combinator.js.map

package/dist/{esm/id.d.ts → id.d.ts}

@@ -3,4 +3,3 @@ import type { ParserState } from './types.ts';
  * Parse ids, e.g: `#foo`
  */
 export declare const id: (state: ParserState) => Promise<ParserState>;
-//# sourceMappingURL=id.d.ts.map

package/dist/{esm/id.js → id.js}

@@ -33,4 +33,3 @@ export const id = async (state) => {
     state.specificity.idCounter += 1;
     return state;
 };
-//# sourceMappingURL=id.js.map

package/dist/{esm/index.d.ts → index.d.ts}

@@ -1,6 +1,6 @@
 import type { EdgeLike, NodeLike } from '@vltpkg/types';
 import type { SecurityArchiveLike } from '@vltpkg/security-archive';
-import type { HostContextsMap, ParsedSelectorToken, ParserState, QueryResponse } from './types.ts';
+import type { DiffFilesProvider, HostContextsMap, ParsedSelectorToken, ParserState, QueryResponse } from './types.ts';
 import type { DepID } from '@vltpkg/dep-id';
 export * from './types.ts';
 export type SearchOptions = {
@@ -15,6 +15,7 @@ export type QueryOptions = {
     retries?: number;
     securityArchive: SecurityArchiveLike | undefined;
     hostContexts?: HostContextsMap;
+    diffFiles?: DiffFilesProvider;
 };
 /**
  * The Query class is used to search the graph for nodes and edges
@@ -35,7 +36,7 @@ export declare class Query {
      * the original order is preserved.
      */
     static specificitySort(responses: QueryResponse[]): QueryResponse[];
-    constructor({ edges, nodes, importers, retries, securityArchive, hostContexts, }: QueryOptions);
+    constructor({ edges, nodes, importers, retries, securityArchive, hostContexts, diffFiles, }: QueryOptions);
     /**
      * Search the graph for nodes and edges that match the given query.
      */
@@ -45,4 +46,3 @@ export declare class Query {
      */
     static getQueryTokens(query: string): ParsedSelectorToken[];
 }
-//# sourceMappingURL=index.d.ts.map

package/dist/{esm/index.js → index.js}

@@ -124,6 +124,8 @@ const securitySelectors = new Set([
     ':unmaintained',
     ':unpopular',
     ':unstable',
+    ':vuln',
+    ':vulnerable',
 ]);
 const setMethodToJSON = (node) => {
     const { toJSON } = node;
@@ -139,6 +141,7 @@ const setMethodToJSON = (node) => {
  */
 export class Query {
     #cache;
+    #diffFiles;
     #edges;
     #nodes;
     #importers;
@@ -178,8 +181,9 @@ export class Query {
             return 0;
         });
     }
-    constructor({ edges, nodes, importers, retries, securityArchive, hostContexts, }) {
+    constructor({ edges, nodes, importers, retries, securityArchive, hostContexts, diffFiles, }) {
         this.#cache = new Map();
+        this.#diffFiles = diffFiles;
         this.#edges = edges;
         this.#nodes = nodes;
         this.#importers = importers;
@@ -232,12 +236,7 @@ export class Query {
                     none: securityArchiveEntry.alerts.some(i => i.type === 'noLicenseFound'),
                     exception: securityArchiveEntry.alerts.some(i => i.type === 'licenseException'),
                 },
-                malware: {
-                    low: securityArchiveEntry.alerts.some(i => i.type === 'gptAnomaly'),
-                    medium: securityArchiveEntry.alerts.some(i => i.type === 'gptSecurity'),
-                    high: securityArchiveEntry.alerts.some(i => i.type === 'gptMalware'),
-                    critical: securityArchiveEntry.alerts.some(i => i.type === 'malware'),
-                },
+                malware: securityArchiveEntry.alerts.some(i => i.type === 'malware' || i.type === 'gptMalware'),
                 minified: securityArchiveEntry.alerts.some(i => i.type === 'minifiedFile'),
                 native: securityArchiveEntry.alerts.some(i => i.type === 'hasNativeCode'),
                 network: securityArchiveEntry.alerts.some(i => i.type === 'networkAccess'),
@@ -263,6 +262,13 @@ export class Query {
                 unmaintained: securityArchiveEntry.alerts.some(i => i.type === 'unmaintained'),
                 unpopular: securityArchiveEntry.alerts.some(i => i.type === 'unpopularPackage'),
                 unstable: securityArchiveEntry.alerts.some(i => i.type === 'unstableOwnership'),
+                vuln: {
+                    low: securityArchiveEntry.alerts.some(i => i.type === 'mildCVE' || i.type === 'gptAnomaly'),
+                    medium: securityArchiveEntry.alerts.some(i => i.type === 'potentialVulnerability' ||
+                        i.type === 'gptSecurity'),
+                    high: securityArchiveEntry.alerts.some(i => i.type === 'cve'),
+                    critical: securityArchiveEntry.alerts.some(i => i.type === 'criticalCVE'),
+                },
             };
             setMethodToJSON(node);
         }
@@ -322,6 +328,7 @@ export class Query {
                 edges: new Set(),
             },
             comment: '',
+            diffFiles: this.#diffFiles,
             loose,
             importers,
             partial: { nodes, edges },
@@ -405,4 +412,3 @@ export class Query {
         return tokens;
     }
 }
-//# sourceMappingURL=index.js.map

package/dist/{esm/parser.d.ts → parser.d.ts}

@@ -12,4 +12,3 @@ export declare const unescapeDots: (query: string) => string;
  * Handles escaping of forward slashes in specific patterns
  */
 export declare const parse: (query: string) => Root;
-//# sourceMappingURL=parser.d.ts.map

package/dist/{esm/parser.js → parser.js}

@@ -11,12 +11,13 @@ export const unescapeDots = (query) => query.replaceAll('\\.', '.');
 const pseudoCleanUpNeeded = new Set([
     ':published',
     ':score',
-    ':malware',
     ':severity',
     ':sev',
     ':squat',
     ':semver',
     ':v',
+    ':vuln',
+    ':vulnerable',
     ':path',
 ]);
 const hasParamsToEscape = (node) => pseudoCleanUpNeeded.has(node.value);
@@ -90,4 +91,3 @@ export const parse = (query) => {
     };
     return postcssSelectorParser(transformAst).astSync(escapedQuery);
 };
-//# sourceMappingURL=parser.js.map

package/dist/{esm/pseudo → pseudo}/abandoned.d.ts

@@ -4,4 +4,3 @@
 export declare const abandoned: (state: import("../types.ts").ParserState) => Promise<import("../types.ts").ParserState & {
     securityArchive: NonNullable<import("../types.ts").ParserState["securityArchive"]>;
 }>;
-//# sourceMappingURL=abandoned.d.ts.map

package/dist/{esm/pseudo → pseudo}/abandoned.js

@@ -3,4 +3,3 @@ import { createSecuritySelectorFilter } from "./helpers.js";
  * Filters out any node that does not have a **missingAuthor** report alert.
  */
 export const abandoned = createSecuritySelectorFilter('abandoned', 'missingAuthor');
-//# sourceMappingURL=abandoned.js.map

package/dist/{esm/pseudo → pseudo}/attr.d.ts

@@ -16,4 +16,3 @@ export declare const parseInternals: (nodes: PostcssNode[]) => AttrInternals;
  * properties of the `package.json` metadata.
  */
 export declare const attr: (state: ParserState) => Promise<ParserState>;
-//# sourceMappingURL=attr.d.ts.map

package/dist/{esm/pseudo → pseudo}/attr.js

@@ -55,4 +55,3 @@ export const attr = async (state) => {
     const prefixProperties = internals.properties;
     return filterAttributes(state, comparator, value, propertyName, insensitive, prefixProperties);
 };
-//# sourceMappingURL=attr.js.map

package/dist/{esm/pseudo → pseudo}/built.d.ts

@@ -5,4 +5,3 @@ import type { ParserState } from '../types.ts';
  * been successfully built during the reify process.
  */
 export declare const built: (state: ParserState) => Promise<ParserState>;
-//# sourceMappingURL=built.d.ts.map

package/dist/{esm/pseudo → pseudo}/built.js

@@ -13,4 +13,3 @@ export const built = async (state) => {
     removeDanglingEdges(state);
     return state;
 };
-//# sourceMappingURL=built.js.map

package/dist/{esm/pseudo → pseudo}/confused.d.ts

@@ -6,4 +6,3 @@ import type { ParserState } from '../types.js';
 export declare const confused: (state: ParserState) => Promise<ParserState & {
     securityArchive: NonNullable<ParserState["securityArchive"]>;
 }>;
-//# sourceMappingURL=confused.d.ts.map

package/dist/{esm/pseudo → pseudo}/confused.js

@@ -16,4 +16,3 @@ export const confused = async (state) => {
     removeDanglingEdges(state);
     return state;
 };
-//# sourceMappingURL=confused.js.map

package/dist/{esm/pseudo → pseudo}/cve.d.ts

@@ -1,13 +1,16 @@
 import type { ParserState } from '../types.ts';
 import type { PostcssNode } from '@vltpkg/dss-parser';
 export type CveInternals = {
-    cveId: string;
+    cveId: string | undefined;
 };
 export declare const parseInternals: (nodes: PostcssNode[]) => CveInternals;
 /**
- * Filters out any node that does not have a CVE alert with the specified CVE ID.
+ * Filters out any node that does not have a CVE alert.
+ *
+ * Usage:
+ * - :cve - matches any package with at least one CVE alert
+ * - :cve(CVE-2023-1234) - matches only the specific CVE ID
  */
 export declare const cve: (state: ParserState) => Promise<ParserState & {
     securityArchive: NonNullable<ParserState["securityArchive"]>;
 }>;
-//# sourceMappingURL=cve.d.ts.map

package/dist/pseudo/cve.js

@@ -0,0 +1,61 @@
+import { error } from '@vltpkg/error-cause';
+import { asPostcssNodeWithChildren, asStringNode, asTagNode, isStringNode, isTagNode, } from '@vltpkg/dss-parser';
+import { assertSecurityArchive, removeDanglingEdges, removeNode, removeQuotes, } from "./helpers.js";
+export const parseInternals = (nodes) => {
+    if (!nodes[0]) {
+        return { cveId: undefined };
+    }
+    const selectorNode = asPostcssNodeWithChildren(nodes[0]);
+    if (!selectorNode.nodes[0]) {
+        return { cveId: undefined };
+    }
+    let cveId = '';
+    if (isStringNode(selectorNode.nodes[0])) {
+        cveId = removeQuotes(asStringNode(selectorNode.nodes[0]).value);
+    }
+    else if (isTagNode(selectorNode.nodes[0])) {
+        cveId = asTagNode(selectorNode.nodes[0]).value;
+    }
+    /* c8 ignore start - unreachable via normal parser */
+    if (!cveId) {
+        throw error('Expected a CVE ID', {
+            found: selectorNode.nodes[0],
+        });
+    }
+    /* c8 ignore stop */
+    return { cveId };
+};
+/**
+ * Filters out any node that does not have a CVE alert.
+ *
+ * Usage:
+ * - :cve - matches any package with at least one CVE alert
+ * - :cve(CVE-2023-1234) - matches only the specific CVE ID
+ */
+export const cve = async (state) => {
+    assertSecurityArchive(state, 'cve');
+    let internals;
+    try {
+        internals = parseInternals(asPostcssNodeWithChildren(state.current).nodes);
+    }
+    catch (err) /* c8 ignore start */ {
+        throw error('Failed to parse :cve selector', { cause: err });
+    } /* c8 ignore stop */
+    const { cveId } = internals;
+    for (const node of state.partial.nodes) {
+        const report = state.securityArchive.get(node.id);
+        let exclude;
+        if (cveId === undefined) {
+            exclude = !report?.alerts.some(alert => alert.props?.cveId);
+        }
+        else {
+            exclude = !report?.alerts.some(alert => alert.props?.cveId?.trim().toLowerCase() ===
+                cveId.trim().toLowerCase());
+        }
+        if (exclude) {
+            removeNode(state, node);
+        }
+    }
+    removeDanglingEdges(state);
+    return state;
+};

package/dist/{esm/pseudo → pseudo}/cwe.d.ts

@@ -1,13 +1,16 @@
 import type { ParserState } from '../types.ts';
 import type { PostcssNode } from '@vltpkg/dss-parser';
 export type CweInternals = {
-    cweId: string;
+    cweId: string | undefined;
 };
 export declare const parseInternals: (nodes: PostcssNode[]) => CweInternals;
 /**
- * Filters out any node that does not have a CWE alert with the specified CWE ID.
+ * Filters out any node that does not have a CWE alert.
+ *
+ * Usage:
+ * - :cwe - matches any package with at least one CWE alert
+ * - :cwe(CWE-79) - matches only the specific CWE ID
  */
 export declare const cwe: (state: ParserState) => Promise<ParserState & {
     securityArchive: NonNullable<ParserState["securityArchive"]>;
 }>;
-//# sourceMappingURL=cwe.d.ts.map

package/dist/pseudo/cwe.js

@@ -0,0 +1,61 @@
+import { error } from '@vltpkg/error-cause';
+import { asPostcssNodeWithChildren, asStringNode, asTagNode, isStringNode, isTagNode, } from '@vltpkg/dss-parser';
+import { assertSecurityArchive, removeDanglingEdges, removeNode, removeQuotes, } from "./helpers.js";
+export const parseInternals = (nodes) => {
+    if (!nodes[0]) {
+        return { cweId: undefined };
+    }
+    const selectorNode = asPostcssNodeWithChildren(nodes[0]);
+    if (!selectorNode.nodes[0]) {
+        return { cweId: undefined };
+    }
+    let cweId = '';
+    if (isStringNode(selectorNode.nodes[0])) {
+        cweId = removeQuotes(asStringNode(selectorNode.nodes[0]).value);
+    }
+    else if (isTagNode(selectorNode.nodes[0])) {
+        cweId = asTagNode(selectorNode.nodes[0]).value;
+    }
+    /* c8 ignore start - unreachable via normal parser */
+    if (!cweId) {
+        throw error('Expected a CWE ID', {
+            found: selectorNode.nodes[0],
+        });
+    }
+    /* c8 ignore stop */
+    return { cweId };
+};
+/**
+ * Filters out any node that does not have a CWE alert.
+ *
+ * Usage:
+ * - :cwe - matches any package with at least one CWE alert
+ * - :cwe(CWE-79) - matches only the specific CWE ID
+ */
+export const cwe = async (state) => {
+    assertSecurityArchive(state, 'cwe');
+    let internals;
+    try {
+        internals = parseInternals(asPostcssNodeWithChildren(state.current).nodes);
+    }
+    catch (err) /* c8 ignore start */ {
+        throw error('Failed to parse :cwe selector', { cause: err });
+    } /* c8 ignore stop */
+    const { cweId } = internals;
+    for (const node of state.partial.nodes) {
+        const report = state.securityArchive.get(node.id);
+        let exclude;
+        if (cweId === undefined) {
+            exclude = !report?.alerts.some(alert => alert.props?.cwes && alert.props.cwes.length > 0);
+        }
+        else {
+            exclude = !report?.alerts.some(alert => alert.props?.cwes?.some(cwe => cwe.id.trim().toLowerCase() ===
+                cweId.trim().toLowerCase()));
+        }
+        if (exclude) {
+            removeNode(state, node);
+        }
+    }
+    removeDanglingEdges(state);
+    return state;
+};

package/dist/{esm/pseudo → pseudo}/debug.d.ts

@@ -4,4 +4,3 @@
 export declare const debug: (state: import("../types.ts").ParserState) => Promise<import("../types.ts").ParserState & {
     securityArchive: NonNullable<import("../types.ts").ParserState["securityArchive"]>;
 }>;
-//# sourceMappingURL=debug.d.ts.map

package/dist/{esm/pseudo → pseudo}/debug.js

@@ -3,4 +3,3 @@ import { createSecuritySelectorFilter } from "./helpers.js";
  * Filters out any node that does not have a **debugAccess** report alert.
  */
 export const debug = createSecuritySelectorFilter('debug', 'debugAccess');
-//# sourceMappingURL=debug.js.map

package/dist/{esm/pseudo → pseudo}/deprecated.d.ts

@@ -4,4 +4,3 @@
 export declare const deprecated: (state: import("../types.ts").ParserState) => Promise<import("../types.ts").ParserState & {
     securityArchive: NonNullable<import("../types.ts").ParserState["securityArchive"]>;
 }>;
-//# sourceMappingURL=deprecated.d.ts.map

package/dist/{esm/pseudo → pseudo}/deprecated.js

@@ -3,4 +3,3 @@ import { createSecuritySelectorFilter } from "./helpers.js";
  * Filters out any node that does not have a **deprecated** report alert.
  */
 export const deprecated = createSecuritySelectorFilter('deprecated', 'deprecated');
-//# sourceMappingURL=deprecated.js.map

package/dist/{esm/pseudo → pseudo}/dev.d.ts

@@ -3,4 +3,3 @@ import type { ParserState } from '../types.ts';
  * :dev Pseudo-Selector will only match devDependencies.
  */
 export declare const dev: (state: ParserState) => Promise<ParserState>;
-//# sourceMappingURL=dev.d.ts.map

package/dist/{esm/pseudo → pseudo}/dev.js

@@ -12,4 +12,3 @@ export const dev = async (state) => {
     removeUnlinkedNodes(state);
     return state;
 };
-//# sourceMappingURL=dev.js.map

package/dist/pseudo/diff.d.ts

@@ -0,0 +1,26 @@
+import type { ParserState } from '../types.ts';
+/**
+ * Given a set of changed file paths and a package location
+ * (relative to the project root), returns true if any changed
+ * file belongs to that package.
+ */
+export declare const packageHasChanges: (changedFiles: Set<string>, packageLocation: string) => boolean;
+/**
+ * :diff(<commitish>) Pseudo-Selector, matches only nodes
+ * whose files have changed between the current state and
+ * the specified commitish reference.
+ *
+ * Requires a `diffFiles` provider to be set on the
+ * {@link ParserState}. The provider is a callback that
+ * takes a commitish string and returns a Set of changed
+ * file paths relative to the project root.
+ *
+ * When called with no argument, defaults to HEAD (uncommitted changes).
+ *
+ * Examples:
+ * - :diff() — packages with uncommitted changes (defaults to HEAD)
+ * - :diff(main) — packages changed since main branch
+ * - :diff(HEAD~1) — packages changed since last commit
+ * - :diff("v1.0.0") — packages changed since tag v1.0.0
+ */
+export declare const diff: (state: ParserState) => Promise<ParserState>;

package/dist/pseudo/diff.js

@@ -0,0 +1,75 @@
+import { error } from '@vltpkg/error-cause';
+import { asPostcssNodeWithChildren } from '@vltpkg/dss-parser';
+import { removeDanglingEdges, removeNode } from "./helpers.js";
+import { parseInternals } from "./spec.js";
+/**
+ * Given a set of changed file paths and a package location
+ * (relative to the project root), returns true if any changed
+ * file belongs to that package.
+ */
+export const packageHasChanges = (changedFiles, packageLocation) => {
+    // Normalize the package location — remove leading './'
+    const normalized = packageLocation.startsWith('./') ?
+        packageLocation.slice(2)
+        : packageLocation;
+    // Root package — check if any file at root level changed
+    // (not inside a subdirectory that is another package)
+    if (!normalized || normalized === '.') {
+        // Any changed file means the root package changed
+        return changedFiles.size > 0;
+    }
+    // Check if any changed file starts with the package path
+    for (const file of changedFiles) {
+        if (file === normalized || file.startsWith(normalized + '/')) {
+            return true;
+        }
+    }
+    return false;
+};
+/**
+ * :diff(<commitish>) Pseudo-Selector, matches only nodes
+ * whose files have changed between the current state and
+ * the specified commitish reference.
+ *
+ * Requires a `diffFiles` provider to be set on the
+ * {@link ParserState}. The provider is a callback that
+ * takes a commitish string and returns a Set of changed
+ * file paths relative to the project root.
+ *
+ * When called with no argument, defaults to HEAD (uncommitted changes).
+ *
+ * Examples:
+ * - :diff() — packages with uncommitted changes (defaults to HEAD)
+ * - :diff(main) — packages changed since main branch
+ * - :diff(HEAD~1) — packages changed since last commit
+ * - :diff("v1.0.0") — packages changed since tag v1.0.0
+ */
+export const diff = async (state) => {
+    const currentNodes = asPostcssNodeWithChildren(state.current).nodes;
+    const hasArg = currentNodes.length > 0 &&
+        asPostcssNodeWithChildren(currentNodes[0]).nodes.length > 0;
+    let commitish = 'HEAD';
+    if (hasArg) {
+        try {
+            commitish = parseInternals(currentNodes).specValue;
+        }
+        catch (err) {
+            throw error('Failed to parse :diff selector', {
+                cause: err,
+            });
+        }
+    }
+    if (!state.diffFiles) {
+        throw error('The :diff() selector requires a diffFiles provider');
+    }
+    const changedFiles = state.diffFiles(commitish);
+    for (const node of state.partial.nodes) {
+        /* c8 ignore next -- location is always set on real nodes */
+        const location = node.location ?? '';
+        if (!packageHasChanges(changedFiles, location)) {
+            removeNode(state, node);
+        }
+    }
+    removeDanglingEdges(state);
+    return state;
+};

package/dist/pseudo/dist.d.ts

@@ -0,0 +1,22 @@
+import type { NodeLike } from '@vltpkg/types';
+import type { ParserState } from '../types.ts';
+/**
+ * Fetches the dist-tags of a package from the registry.
+ */
+export declare const retrieveDistTags: (node: NodeLike, signal?: AbortSignal) => Promise<Record<string, string>>;
+/**
+ * Checks whether a node's installed version matches the version
+ * associated with the given dist-tag. Returns the node if it should
+ * be removed (does NOT match), or undefined if it matches.
+ */
+export declare const queueNode: (state: ParserState, node: NodeLike, tagName: string) => Promise<NodeLike | undefined>;
+/**
+ * :dist(tag) Pseudo-Selector, matches only nodes whose installed
+ * version corresponds to the given dist-tag in the registry.
+ *
+ * Examples:
+ * - :dist(latest) — matches packages at the `latest` dist-tag version
+ * - :dist(nightly) — matches packages at the `nightly` dist-tag version
+ * - :not(:dist(nightly)) — excludes nightly-tagged versions
+ */
+export declare const dist: (state: ParserState) => Promise<ParserState>;

package/dist/pseudo/dist.js

@@ -0,0 +1,110 @@
+import pRetry, { AbortError } from 'p-retry';
+import { hydrate, splitDepID } from '@vltpkg/dep-id/browser';
+import { error } from '@vltpkg/error-cause';
+import { asPostcssNodeWithChildren, asTagNode, asStringNode, isTagNode, } from '@vltpkg/dss-parser';
+import { removeDanglingEdges, removeNode, removeQuotes, } from "./helpers.js";
+/**
+ * Fetches the dist-tags of a package from the registry.
+ */
+export const retrieveDistTags = async (node, signal) => {
+    const spec = hydrate(node.id, String(node.name), node.options);
+    if (!spec.registry || !node.name) {
+        return {};
+    }
+    const url = new URL(spec.registry);
+    url.pathname = `/${node.name}`;
+    const response = await fetch(String(url), {
+        headers: {
+            Accept: 'application/vnd.npm.install-v1+json',
+        },
+        signal,
+    });
+    if (response.status === 404) {
+        throw new AbortError('Missing API');
+    }
+    if (!response.ok) {
+        throw error('Failed to fetch packument', {
+            name: node.name,
+            spec,
+            response,
+        });
+    }
+    const packument = (await response.json());
+    return packument['dist-tags'];
+};
+/**
+ * Checks whether a node's installed version matches the version
+ * associated with the given dist-tag. Returns the node if it should
+ * be removed (does NOT match), or undefined if it matches.
+ */
+export const queueNode = async (state, node, tagName) => {
+    if (!node.name || !node.version) {
+        return node;
+    }
+    let distTags;
+    try {
+        distTags = await pRetry(() => retrieveDistTags(node, state.signal), {
+            retries: state.retries,
+            signal: state.signal,
+        });
+    }
+    catch (err) {
+        // eslint-disable-next-line no-console
+        console.warn(error('Could not retrieve dist-tags', {
+            name: node.name,
+            cause: err,
+        }));
+        return node;
+    }
+    const tagVersion = distTags[tagName];
+    if (tagVersion !== node.version) {
+        return node;
+    }
+    return undefined;
+};
+/**
+ * :dist(tag) Pseudo-Selector, matches only nodes whose installed
+ * version corresponds to the given dist-tag in the registry.
+ *
+ * Examples:
+ * - :dist(latest) — matches packages at the `latest` dist-tag version
+ * - :dist(nightly) — matches packages at the `nightly` dist-tag version
+ * - :not(:dist(nightly)) — excludes nightly-tagged versions
+ */
+export const dist = async (state) => {
+    const top = asPostcssNodeWithChildren(state.current);
+    const selector = asPostcssNodeWithChildren(top.nodes[0]);
+    const firstChild = selector.nodes[0];
+    let tagName;
+    try {
+        tagName = removeQuotes(asStringNode(firstChild).value);
+    }
+    catch {
+        if (isTagNode(firstChild)) {
+            tagName = asTagNode(firstChild).value;
+            /* c8 ignore start */
+        }
+        else {
+            throw error('Failed to parse :dist selector', {
+                found: firstChild,
+            });
+        }
+        /* c8 ignore stop */
+    }
+    const queue = [];
+    for (const node of state.partial.nodes) {
+        if (splitDepID(node.id)[0] !== 'registry') {
+            removeNode(state, node);
+            continue;
+        }
+        queue.push(queueNode(state, node, tagName));
+    }
+    const removeNodeQueue = await Promise.all(queue);
+    for (const node of removeNodeQueue) {
+        if (node) {
+            removeNode(state, node);
+        }
+    }
+    removeDanglingEdges(state);
+    return state;
+};

package/dist/{esm/pseudo → pseudo}/dynamic.d.ts

@@ -4,4 +4,3 @@
 export declare const dynamic: (state: import("../types.ts").ParserState) => Promise<import("../types.ts").ParserState & {
     securityArchive: NonNullable<import("../types.ts").ParserState["securityArchive"]>;
 }>;
-//# sourceMappingURL=dynamic.d.ts.map

package/dist/{esm/pseudo → pseudo}/dynamic.js

@@ -3,4 +3,3 @@ import { createSecuritySelectorFilter } from "./helpers.js";
  * Filters out any node that does not have a **dynamicRequire** report alert.
  */
 export const dynamic = createSecuritySelectorFilter('dynamic', 'dynamicRequire');
-//# sourceMappingURL=dynamic.js.map