@vltpkg/query 1.0.0-rc.9 → 1.0.1

package/src/pseudo/path.ts

@@ -0,0 +1,146 @@
+import { minimatch } from 'minimatch'
+import { error } from '@vltpkg/error-cause'
+import { splitDepID } from '@vltpkg/dep-id/browser'
+import { asError } from '@vltpkg/types'
+import {
+  asPostcssNodeWithChildren,
+  asStringNode,
+  isStringNode,
+} from '@vltpkg/dss-parser'
+import {
+  removeNode,
+  removeDanglingEdges,
+  removeQuotes,
+  clear,
+} from './helpers.ts'
+import type { ParserState } from '../types.ts'
+
+/**
+ * Normalizes a path by trimming whitespace and removing leading './' or '.' prefix.
+ * This ensures consistent path comparison regardless of how paths are specified.
+ */
+export function normalizePath(path: string): string {
+  const trimmed = path.trim().replaceAll('\\', '/')
+
+  if (trimmed === '.') {
+    return ''
+  }
+
+  if (trimmed.startsWith('./')) {
+    return trimmed.slice(2)
+  }
+
+  return trimmed
+}
+
+/**
+ * Creates a path matcher function that tests if
+ * a given path matches a glob pattern.
+ */
+export function createPathMatcher(pattern: string, loose = false) {
+  const normalizedPattern = normalizePath(pattern)
+  const isRoot = normalizedPattern === '' || pattern.trim() === '.'
+
+  return (path: string) => {
+    const normalizedPath = normalizePath(path)
+
+    if (isRoot) {
+      return normalizedPath === '' || normalizedPath === '.'
+    }
+    try {
+      return minimatch(normalizedPath, normalizedPattern, {
+        dot: true,
+        nocase: false,
+        matchBase: normalizedPattern === '*',
+      })
+    } catch (err) {
+      // In loose mode, return false for invalid patterns
+      if (loose) {
+        return false
+      }
+      // In strict mode, throw an error
+      throw error(
+        'Invalid glob pattern in :path selector',
+        asError(err),
+      )
+    }
+  }
+}
+
+/**
+ * :path("glob") Pseudo-Selector will match only workspace & file
+ * nodes whose file path matches the provided glob pattern relative
+ * to the project root. Path patterns must be quoted strings to avoid
+ * parser conflicts with special characters.
+ */
+export const path = async (state: ParserState) => {
+  // Extract path container and handle empty parameters
+  const pathContainer = asPostcssNodeWithChildren(state.current)
+  if (!pathContainer.nodes[0]) {
+    return clear(state)
+  }
+
+  // Extract the selector node and handle empty selectors
+  const selector = asPostcssNodeWithChildren(pathContainer.nodes[0])
+  if (!selector.nodes[0]) {
+    return clear(state)
+  }
+
+  // Extract and validate the path pattern
+  let pathPattern = ''
+  if (isStringNode(selector.nodes[0])) {
+    pathPattern = removeQuotes(asStringNode(selector.nodes[0]).value)
+  } else {
+    if (state.loose) {
+      return clear(state)
+    }
+    throw error(
+      'Failed to parse path pattern in :path selector',
+      new Error('Path pattern must be a quoted string'),
+    )
+  }
+
+  // If no pattern provided, match nothing
+  if (!pathPattern) {
+    return clear(state)
+  }
+
+  // Check for unmatched brackets
+  if (
+    pathPattern === '[' ||
+    (pathPattern.includes('[') && !pathPattern.includes(']'))
+  ) {
+    if (state.loose) {
+      return clear(state)
+    }
+    throw error(
+      'Invalid glob pattern in :path selector',
+      new Error(`Unmatched bracket in pattern: ${pathPattern}`),
+    )
+  }
+
+  // Create path matcher function
+  const matchPath = createPathMatcher(pathPattern, state.loose)
+
+  // Filter nodes by path
+  for (const node of state.partial.nodes) {
+    /* c8 ignore next */
+    const nodePath = node.location || ''
+    const [type] = splitDepID(node.id)
+
+    // Special case for main importer with root path pattern
+    if (pathPattern === '.' && node.mainImporter) {
+      continue // Keep main importer node for root path pattern
+    }
+
+    // Only match workspace or file nodes with matching paths
+    const pathBased = type === 'workspace' || type === 'file'
+    if (!pathBased || !matchPath(nodePath)) {
+      removeNode(state, node)
+    }
+  }
+
+  // Clean up any dangling edges
+  removeDanglingEdges(state)
+  return state
+}

package/src/pseudo/peer.ts

@@ -0,0 +1,18 @@
+import type { ParserState } from '../types.ts'
+import { removeEdge, removeUnlinkedNodes } from './helpers.ts'
+
+/**
+ * :peer Pseudo-Selector will only match peer dependencies.
+ */
+export const peer = async (state: ParserState) => {
+  // filter edges that aren't marked as peer
+  for (const edge of state.partial.edges) {
+    if (!edge.peer) {
+      removeEdge(state, edge)
+    }
+  }
+
+  removeUnlinkedNodes(state)
+
+  return state
+}

package/src/pseudo/prerelease.ts

@@ -0,0 +1,47 @@
+import { parse } from '@vltpkg/semver'
+import { removeNode, removeDanglingEdges } from './helpers.ts'
+import type { ParserState } from '../types.ts'
+
+/**
+ * :prerelease Pseudo-selector, matches only nodes that have prerelease
+ * elements in their parsed semver value.
+ *
+ * Examples of versions that should match:
+ * - 19.2.0-canary-fa3feba6-20250623
+ * - 1.0.0-beta.0
+ * - 0.0.0-16
+ * - 1.2.3-rc.1+rev.2
+ *
+ * Examples of versions that should NOT match:
+ * - 1.0.0
+ * - 99.9.9
+ * - 0.0.1
+ */
+export const prerelease = async (state: ParserState) => {
+  for (const node of state.partial.nodes) {
+    const version = node.manifest?.version
+
+    // Skip nodes without a version (like root/importer nodes)
+    if (!version) {
+      removeNode(state, node)
+      continue
+    }
+
+    const parsedVersion = parse(version)
+    if (!parsedVersion) {
+      // Remove nodes with invalid semver versions
+      removeNode(state, node)
+      continue
+    }
+
+    // Check if the version has prerelease identifiers
+    if (!parsedVersion.prerelease?.length) {
+      // Remove nodes that don't have prerelease identifiers
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}

package/src/pseudo/private.ts

@@ -0,0 +1,19 @@
+import { asManifest } from '@vltpkg/types'
+import type { ParserState } from '../types.ts'
+import { removeNode, removeDanglingEdges } from './helpers.ts'
+
+/**
+ * :private Pseudo-Selector will only match packages that have
+ * a `private: true` key set in their `package.json` metadata.
+ */
+export const privateParser = async (state: ParserState) => {
+  for (const node of state.partial.nodes) {
+    if (!node.manifest || !asManifest(node.manifest).private) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}

package/src/pseudo/prod.ts

@@ -0,0 +1,18 @@
+import type { ParserState } from '../types.ts'
+import { removeEdge, removeUnlinkedNodes } from './helpers.ts'
+
+/**
+ * :prod Pseudo-Selector will only match production dependencies.
+ */
+export const prod = async (state: ParserState) => {
+  // filter edges that don't have type 'prod'
+  for (const edge of state.partial.edges) {
+    if (edge.type !== 'prod') {
+      removeEdge(state, edge)
+    }
+  }
+
+  removeUnlinkedNodes(state)
+
+  return state
+}

package/src/pseudo/published.ts

@@ -0,0 +1,248 @@
+import pRetry, { AbortError } from 'p-retry'
+import { hydrate, splitDepID } from '@vltpkg/dep-id/browser'
+import { error } from '@vltpkg/error-cause'
+import { asError } from '@vltpkg/types'
+import {
+  asPostcssNodeWithChildren,
+  asStringNode,
+  asTagNode,
+  isStringNode,
+  isTagNode,
+} from '@vltpkg/dss-parser'
+import {
+  removeDanglingEdges,
+  removeNode,
+  removeQuotes,
+} from './helpers.ts'
+import type { NodeLike, Packument } from '@vltpkg/types'
+import type { ParserState } from '../types.ts'
+import type { PostcssNode } from '@vltpkg/dss-parser'
+
+/**
+ * The possible comparator values accepted by the :published() pseudo selector.
+ */
+export type PublishedComparator = '>' | '<' | '>=' | '<=' | undefined
+
+/**
+ * Result of the internal parsing of the :published() pseudo selector.
+ */
+export type PublishedInternals = {
+  relativeDate: string
+  comparator: PublishedComparator
+}
+
+/**
+ * Fetches the published date of a package version from the npm registry.
+ */
+export const retrieveRemoteDate = async (
+  node: NodeLike,
+  signal?: AbortSignal,
+): Promise<string | undefined> => {
+  const spec = hydrate(node.id, String(node.name), node.options)
+  if (!spec.registry || !node.name || !node.version) {
+    return undefined
+  }
+
+  const url = new URL(spec.registry)
+  url.pathname = `/${node.name}`
+
+  const response = await fetch(String(url), {
+    signal,
+  })
+  // on missing valid auth or API, it should abort the retry logic
+  if (response.status === 404) {
+    throw new AbortError('Missing API')
+  }
+  if (!response.ok) {
+    throw error('Failed to fetch packument', {
+      name: node.name,
+      spec,
+      response,
+    })
+  }
+  const packument = (await response.json()) as Packument
+  const res = packument.time?.[node.version]
+  return res
+}
+
+/**
+ * Retrieves what kind of check the :published selector should perform.
+ */
+export const parseInternals = (
+  nodes: PostcssNode[],
+): PublishedInternals => {
+  let value = ''
+
+  if (isStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])) {
+    value = removeQuotes(
+      asStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+        .value,
+    )
+  } else if (
+    isTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+  ) {
+    const tagNode = asTagNode(
+      asPostcssNodeWithChildren(nodes[0]).nodes[0],
+    )
+    value = tagNode.value
+  }
+
+  // Check if the value starts with a comparator
+  let comparator: PublishedComparator
+  let relativeDate = value
+
+  if (value.startsWith('>=')) {
+    comparator = '>='
+    relativeDate = value.slice(2)
+  } else if (value.startsWith('<=')) {
+    comparator = '<='
+    relativeDate = value.slice(2)
+  } else if (value.startsWith('>')) {
+    comparator = '>'
+    relativeDate = value.slice(1)
+  } else if (value.startsWith('<')) {
+    comparator = '<'
+    relativeDate = value.slice(1)
+  }
+
+  return { relativeDate, comparator }
+}
+
+/**
+ * Filter nodes by queueing up for removal those that don't match the date criteria.
+ */
+export const queueNode = async (
+  state: ParserState,
+  node: NodeLike,
+  relativeDate: string,
+  comparator: PublishedComparator,
+): Promise<NodeLike | undefined> => {
+  if (!node.name || !node.version) {
+    return node
+  }
+
+  let publishedDate: string | undefined
+  try {
+    publishedDate = await pRetry(
+      () => retrieveRemoteDate(node, state.signal),
+      {
+        retries: state.retries,
+        signal: state.signal,
+      },
+    )
+  } catch (err) {
+    // eslint-disable-next-line no-console
+    console.warn(
+      error('Could not retrieve registry publish date', {
+        name: node.name,
+        cause: err,
+      }),
+    )
+    return node
+  }
+
+  if (!publishedDate) {
+    return node
+  }
+
+  // only matches the same amount of date information
+  // as provided in the relative date
+  const nodeDate = new Date(
+    publishedDate.slice(0, relativeDate.length),
+  )
+  const compareDate = new Date(relativeDate)
+
+  switch (comparator) {
+    case '>':
+      return nodeDate > compareDate ? undefined : node
+    case '<':
+      return nodeDate < compareDate ? undefined : node
+    case '>=':
+      return nodeDate >= compareDate ? undefined : node
+    case '<=':
+      return nodeDate <= compareDate ? undefined : node
+    default:
+      return nodeDate.getTime() === compareDate.getTime() ?
+          undefined
+        : node
+  }
+}
+
+/**
+ * Filters out nodes that don't match the published date criteria.
+ *
+ * The :published() pseudo selector supports a date parameter that can be prefixed
+ * with a comparator (>, <, >=, <=). If no comparator is provided, it will match
+ * exact dates.
+ *
+ * Examples:
+ * - :published("2024-01-01") - Matches packages published exactly on January 1st, 2024
+ * - :published(">2024-01-01") - Matches packages published after January 1st, 2024
+ * - :published("<=2023-12-31") - Matches packages published on or before December 31st, 2023
+ */
+export const published = async (state: ParserState) => {
+  let internals
+  try {
+    internals = parseInternals(
+      asPostcssNodeWithChildren(state.current).nodes,
+    )
+  } catch (err) {
+    if (asError(err).message === 'Expected a query node') {
+      // No parameters provided - pseudo state form: match ANY published metadata
+      for (const node of state.partial.nodes) {
+        // filter out nodes that are always ignored by the published selector
+        if (
+          node.mainImporter ||
+          node.manifest?.private ||
+          splitDepID(node.id)[0] !== 'registry'
+        ) {
+          removeNode(state, node)
+          continue
+        }
+
+        // For pseudo state form, we just check if the node has published metadata
+        // This is equivalent to checking if it's a registry package with version info
+        if (!node.name || !node.version) {
+          removeNode(state, node)
+        }
+      }
+      removeDanglingEdges(state)
+      return state
+    } else {
+      throw error('Failed to parse :published selector', {
+        cause: err,
+      })
+    }
+  }
+
+  const { relativeDate, comparator } = internals
+  const queue = []
+
+  for (const node of state.partial.nodes) {
+    // filter out nodes that are always ignored by the published selector
+    if (
+      node.mainImporter ||
+      node.manifest?.private ||
+      splitDepID(node.id)[0] !== 'registry'
+    ) {
+      removeNode(state, node)
+      continue
+    }
+
+    // fetch published date info and perform checks to define
+    // whether or not a node should be filtered out
+    queue.push(queueNode(state, node, relativeDate, comparator))
+  }
+
+  // nodes queued for removal are then finally removed
+  const removeNodeQueue = await Promise.all(queue)
+  for (const node of removeNodeQueue) {
+    if (node) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}

package/src/pseudo/registry.ts

@@ -0,0 +1,29 @@
+import { splitDepID } from '@vltpkg/dep-id/browser'
+import {
+  asPostcssNodeWithChildren,
+  asTagNode,
+} from '@vltpkg/dss-parser'
+import { removeDanglingEdges, removeNode } from './helpers.ts'
+import type { ParserState } from '../types.ts'
+
+/**
+ * :registry(name) Pseudo-Selector, matches only nodes that
+ * belong to the specified registry configuration alias.
+ *
+ * For example, `:registry(npm)` matches deps from the default
+ * npm registry, and `:registry(custom)` matches deps from a
+ * custom-named registry.
+ */
+export const registry = async (state: ParserState) => {
+  const top = asPostcssNodeWithChildren(state.current)
+  const selector = asPostcssNodeWithChildren(top.nodes[0])
+  const name = asTagNode(selector.nodes[0]).value
+  for (const node of state.partial.nodes) {
+    const tuple = splitDepID(node.id)
+    if (tuple[0] !== 'registry' || tuple[1] !== name) {
+      removeNode(state, node)
+    }
+  }
+  removeDanglingEdges(state)
+  return state
+}

package/src/pseudo/root.ts

@@ -0,0 +1,19 @@
+import type { ParserState } from '../types.ts'
+
+/**
+ * :root Pseudo-Element will return the project root node for the graph.
+ * It matches only nodes marked as `mainImporter`.
+ */
+export const root = async (state: ParserState) => {
+  for (const edge of state.partial.edges) {
+    if (!edge.to?.mainImporter) {
+      state.partial.edges.delete(edge)
+    }
+  }
+  for (const node of state.partial.nodes) {
+    if (!node.mainImporter) {
+      state.partial.nodes.delete(node)
+    }
+  }
+  return state
+}

package/src/pseudo/scanned.ts

@@ -0,0 +1,20 @@
+import { removeDanglingEdges, removeNode } from './helpers.ts'
+import type { ParserState } from '../types.ts'
+
+/**
+ * :scanned pseudo selector.
+ *
+ * Remove all nodes that do not have available metadata
+ * in the security archive.
+ */
+export const scanned = async (state: ParserState) => {
+  for (const node of state.partial.nodes) {
+    if (!state.securityArchive?.has(node.id)) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}