@vltpkg/query 1.0.0-rc.9 → 1.0.1

package/src/pseudo.ts

@@ -0,0 +1,413 @@
+import { error } from '@vltpkg/error-cause'
+import { removeDanglingEdges, removeNode } from './pseudo/helpers.ts'
+import {
+  asPostcssNodeWithChildren,
+  asPseudoNode,
+  isSelectorNode,
+} from '@vltpkg/dss-parser'
+
+// imported pseudo selectors
+import { abandoned } from './pseudo/abandoned.ts'
+import { attr } from './pseudo/attr.ts'
+import { built } from './pseudo/built.ts'
+import { confused } from './pseudo/confused.ts'
+import { cve } from './pseudo/cve.ts'
+import { cwe } from './pseudo/cwe.ts'
+import { debug } from './pseudo/debug.ts'
+import { deprecated } from './pseudo/deprecated.ts'
+import { dev } from './pseudo/dev.ts'
+import { diff } from './pseudo/diff.ts'
+import { dist } from './pseudo/dist.ts'
+import { dynamic } from './pseudo/dynamic.ts'
+import { empty } from './pseudo/empty.ts'
+import { entropic } from './pseudo/entropic.ts'
+import { env } from './pseudo/env.ts'
+import { evalParser } from './pseudo/eval.ts'
+import { fs } from './pseudo/fs.ts'
+import { hostContext } from './pseudo/host.ts'
+import { hostname } from './pseudo/hostname.ts'
+import { license } from './pseudo/license.ts'
+import { link } from './pseudo/link.ts'
+import { malware } from './pseudo/malware.ts'
+import { minified } from './pseudo/minified.ts'
+import { missing } from './pseudo/missing.ts'
+import { nativeParser } from './pseudo/native.ts'
+import { network } from './pseudo/network.ts'
+import { obfuscated } from './pseudo/obfuscated.ts'
+import { optional } from './pseudo/optional.ts'
+import { outdated } from './pseudo/outdated.ts'
+import { overridden } from './pseudo/overridden.ts'
+import { path } from './pseudo/path.ts'
+import { peer } from './pseudo/peer.ts'
+import { prerelease } from './pseudo/prerelease.ts'
+import { published } from './pseudo/published.ts'
+import { privateParser } from './pseudo/private.ts'
+import { registry } from './pseudo/registry.ts'
+import { prod } from './pseudo/prod.ts'
+import { root } from './pseudo/root.ts'
+import { scanned } from './pseudo/scanned.ts'
+import { score } from './pseudo/score.ts'
+import { scripts } from './pseudo/scripts.ts'
+import { shell } from './pseudo/shell.ts'
+import { semverParser as semver } from './pseudo/semver.ts'
+import { severity } from './pseudo/severity.ts'
+import { spec } from './pseudo/spec.ts'
+import { shrinkwrap } from './pseudo/shrinkwrap.ts'
+import { squat } from './pseudo/squat.ts'
+import { suspicious } from './pseudo/suspicious.ts'
+import { tracker } from './pseudo/tracker.ts'
+import { trivial } from './pseudo/trivial.ts'
+import { type } from './pseudo/type.ts'
+import { undesirable } from './pseudo/undesirable.ts'
+import { unknown } from './pseudo/unknown.ts'
+import { unmaintained } from './pseudo/unmaintained.ts'
+import { unpopular } from './pseudo/unpopular.ts'
+import { unstable } from './pseudo/unstable.ts'
+import { vuln } from './pseudo/vuln.ts'
+import { workspace } from './pseudo/workspace.ts'
+
+import type { EdgeLike, NodeLike } from '@vltpkg/types'
+import type { ParserFn, ParserState } from './types.ts'
+
+/**
+ * :has Pseudo-Selector, matches only nodes that have valid results
+ * for its nested selector expressions.
+ */
+const has = async (state: ParserState) => {
+  const top = asPostcssNodeWithChildren(state.current)
+  const collectNodes = new Set<NodeLike>()
+  const collectEdges = new Set<EdgeLike>()
+
+  for (const node of top.nodes) {
+    if (isSelectorNode(node)) {
+      const nestedState = await state.walk({
+        cancellable: state.cancellable,
+        initial: {
+          edges: new Set(state.initial.edges),
+          nodes: new Set(state.initial.nodes),
+        },
+        current: node,
+        walk: state.walk,
+        collect: {
+          edges: new Set(),
+          nodes: new Set(),
+        },
+        partial: {
+          edges: new Set(state.partial.edges),
+          nodes: new Set(state.partial.nodes),
+        },
+        diffFiles: state.diffFiles,
+        loose: state.loose,
+        hostContexts: state.hostContexts,
+        importers: state.importers,
+        retries: state.retries,
+        securityArchive: state.securityArchive,
+        signal: state.signal,
+        scopeIDs: state.scopeIDs,
+        comment: state.comment,
+        specificity: { ...state.specificity },
+      })
+      for (const n of nestedState.collect.nodes) {
+        collectNodes.add(n)
+      }
+      for (const e of nestedState.partial.edges) {
+        collectEdges.add(e)
+      }
+    }
+  }
+
+  // if the nested selector did not match anything, that means
+  // no current node has any matches
+  if (collectNodes.size === 0) {
+    state.partial.edges.clear()
+    state.partial.nodes.clear()
+    return state
+  }
+
+  // handles transitive dependencies
+  // compareNodes collects a list of all ancestor nodes
+  // from the resulting nodes of the nested selector
+  const compareNodes = new Set<NodeLike>()
+  const traverse = new Set(collectNodes)
+  for (const node of traverse) {
+    for (const edge of node.edgesIn) {
+      compareNodes.add(edge.from)
+      if (edge.from.edgesIn.size) {
+        traverse.add(edge.from)
+      }
+    }
+  }
+
+  // for each node in the current list checks to see if
+  // it has a node in the resulting nested state that is
+  // a transitive dependency / children.
+  nodesLoop: for (const node of state.partial.nodes) {
+    if (node.edgesOut.size === 0 || !compareNodes.has(node)) {
+      removeNode(state, node)
+      continue
+    }
+
+    for (const edge of node.edgesOut.values()) {
+      if (collectEdges.has(edge)) {
+        continue nodesLoop
+      }
+    }
+    removeNode(state, node)
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}
+
+/**
+ * :is Pseudo-selector, acts as a shortcut for writing more compact expressions
+ * by allowing multiple nested selectors to match on the previous results.
+ *
+ * It also enables the loose parsing mode, skipping instead of erroring usage
+ * of non-existing classes, identifiers, pseudo-classes, etc.
+ */
+const is = async (state: ParserState) => {
+  const top = asPostcssNodeWithChildren(state.current)
+  const collect = new Set()
+  for (const node of top.nodes) {
+    if (isSelectorNode(node)) {
+      const nestedState = await state.walk({
+        cancellable: state.cancellable,
+        collect: {
+          edges: new Set(),
+          nodes: new Set(),
+        },
+        current: node,
+        diffFiles: state.diffFiles,
+        initial: state.initial,
+        loose: true,
+        partial: {
+          nodes: new Set(state.partial.nodes),
+          edges: new Set(state.partial.edges),
+        },
+        importers: state.importers,
+        hostContexts: state.hostContexts,
+        walk: state.walk,
+        retries: state.retries,
+        securityArchive: state.securityArchive,
+        signal: state.signal,
+        scopeIDs: state.scopeIDs,
+        comment: state.comment,
+        specificity: { ...state.specificity },
+      })
+      for (const n of nestedState.collect.nodes) {
+        collect.add(n)
+      }
+    }
+  }
+  for (const node of state.partial.nodes) {
+    if (!collect.has(node)) {
+      removeNode(state, node)
+    }
+  }
+  return state
+}
+
+/**
+ * :not Pseudo-class, serves to create negate expressions, anything that
+ * matches selectors declared inside the `:not()` expression is going to be
+ * filtered out in the final result.
+ */
+const not = async (state: ParserState) => {
+  const top = asPostcssNodeWithChildren(state.current)
+  const collect = new Set()
+  for (const node of top.nodes) {
+    if (isSelectorNode(node)) {
+      const nestedState = await state.walk({
+        cancellable: state.cancellable,
+        collect: {
+          edges: new Set(),
+          nodes: new Set(),
+        },
+        current: node,
+        diffFiles: state.diffFiles,
+        initial: state.initial,
+        loose: state.loose,
+        partial: {
+          nodes: new Set(state.partial.nodes),
+          edges: new Set(state.partial.edges),
+        },
+        importers: state.importers,
+        hostContexts: state.hostContexts,
+        walk: state.walk,
+        retries: state.retries,
+        securityArchive: state.securityArchive,
+        signal: state.signal,
+        scopeIDs: state.scopeIDs,
+        comment: state.comment,
+        specificity: { ...state.specificity },
+      })
+      for (const n of nestedState.collect.nodes) {
+        collect.add(n)
+      }
+      /* c8 ignore start - should be impossible */
+    } else {
+      throw error('Error parsing :not() selectors', {
+        wanted: { type: 'selector' },
+        found: node,
+      })
+    }
+    /* c8 ignore stop */
+  }
+  for (const node of state.partial.nodes) {
+    if (collect.has(node)) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}
+
+/**
+ * :project Pseudo-Class, matches only graph importers (e.g: the
+ * root node along with any configured workspace)
+ */
+const project = async (state: ParserState) => {
+  for (const node of state.partial.nodes) {
+    if (!node.importer) {
+      removeNode(state, node)
+    }
+  }
+  for (const edge of state.partial.edges) {
+    if (!edge.to?.importer) {
+      state.partial.edges.delete(edge)
+    }
+  }
+  return state
+}
+
+/**
+ * :scope Pseudo-Element, returns only the nodes that match the provided scopeIDs
+ * from the Query.search method.
+ */
+const scope = async (state: ParserState) => {
+  const scopeIDSet = new Set(state.scopeIDs)
+
+  for (const node of state.partial.nodes) {
+    if (!scopeIDSet.has(node.id)) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}
+
+const pseudoSelectors = new Map<string, ParserFn>(
+  Object.entries({
+    abandoned,
+    attr,
+    built,
+    confused,
+    cve,
+    cwe,
+    debug,
+    deprecated,
+    dev,
+    diff,
+    dist,
+    dynamic,
+    eval: evalParser,
+    empty,
+    entropic,
+    env,
+    fs,
+    has,
+    host: hostContext,
+    hostname,
+    is,
+    license,
+    link,
+    malware,
+    minified,
+    missing,
+    native: nativeParser,
+    network,
+    not,
+    obfuscated,
+    optional,
+    outdated,
+    overridden,
+    path,
+    peer,
+    prerelease,
+    published,
+    private: privateParser,
+    prod,
+    registry,
+    project,
+    root,
+    scanned,
+    scope,
+    score,
+    scripts,
+    semver,
+    sev: severity,
+    spec,
+    severity,
+    shell,
+    shrinkwrap,
+    squat,
+    suspicious,
+    tracker,
+    trivial,
+    type,
+    undesirable,
+    unknown,
+    unmaintained,
+    unpopular,
+    unstable,
+    v: semver,
+    vuln,
+    vulnerable: vuln,
+    workspace,
+  }),
+)
+
+/**
+ * Parsers the `pseudo` node types.
+ */
+export const pseudo = async (state: ParserState) => {
+  await state.cancellable()
+
+  const curr = asPseudoNode(state.current)
+  const parserFn =
+    curr.value && pseudoSelectors.get(curr.value.slice(1))
+
+  if (!parserFn) {
+    if (state.loose) {
+      state.partial.edges.clear()
+      state.partial.nodes.clear()
+      return state
+    }
+
+    throw error(`Unsupported pseudo-class: ${state.current.value}`, {
+      found: state.current,
+    })
+  }
+
+  const result = await parserFn(state)
+
+  // Increment the commonCounter for specificity, except for
+  // nesting selectors which don't contribute to specificity
+  const pseudoValue = curr.value.slice(1)
+  if (
+    pseudoValue &&
+    pseudoValue !== 'not' &&
+    pseudoValue !== 'is' &&
+    pseudoValue !== 'has'
+  ) {
+    result.specificity.commonCounter += 1
+  }
+
+  return result
+}

package/src/types.ts

@@ -0,0 +1,165 @@
+import type { EdgeLike, NodeLike } from '@vltpkg/types'
+import type {
+  SecurityArchiveLike,
+  PackageScore,
+} from '@vltpkg/security-archive'
+import type { DepID } from '@vltpkg/dep-id'
+import type { PostcssNode } from '@vltpkg/dss-parser'
+
+export type HostContextsMapResult = {
+  initialEdges: EdgeLike[]
+  initialNodes: NodeLike[]
+  edges: EdgeLike[]
+  nodes: NodeLike[]
+  securityArchive: SecurityArchiveLike | undefined
+}
+
+export type HostContextsMap = Map<
+  string,
+  () => Promise<HostContextsMapResult>
+>
+
+export type Specificity = {
+  idCounter: number
+  commonCounter: number
+}
+
+export type GraphSelectionState = {
+  nodes: Set<NodeLike>
+  edges: Set<EdgeLike>
+}
+
+/**
+ * Callback that returns changed file paths for a given
+ * commitish reference. Used by the :diff() pseudo selector.
+ * The returned paths should be relative to the project root.
+ */
+export type DiffFilesProvider = (commitish: string) => Set<string>
+
+export type ParserState = {
+  cancellable: () => Promise<void>
+  collect: GraphSelectionState
+  comment: string
+  current: PostcssNode
+  diffFiles?: DiffFilesProvider
+  hostContexts?: HostContextsMap
+  importers: Set<NodeLike>
+  initial: GraphSelectionState
+  loose?: boolean
+  next?: PostcssNode
+  prev?: PostcssNode
+  result?: NodeLike[]
+  signal: AbortSignal
+  walk: ParserFn
+  partial: GraphSelectionState
+  retries: number
+  securityArchive: SecurityArchiveLike | undefined
+  scopeIDs?: DepID[]
+  specificity: Specificity
+}
+
+export type QueryResponse = {
+  edges: QueryResponseEdge[]
+  nodes: QueryResponseNode[]
+  importers: QueryResponseNode[]
+  comment: string
+  specificity: Specificity
+}
+
+export type QueryResponseEdge = Omit<EdgeLike, 'from' | 'to'> & {
+  from: QueryResponseNode
+  to?: QueryResponseNode
+}
+
+export type QueryResponseNode = Omit<
+  NodeLike,
+  'edgesIn' | 'edgesOut'
+> & {
+  edgesIn: Set<QueryResponseEdge>
+  edgesOut: Map<string, QueryResponseEdge>
+  insights: Insights
+  toJSON: () => Pick<
+    QueryResponseNode,
+    | 'id'
+    | 'name'
+    | 'version'
+    | 'location'
+    | 'importer'
+    | 'manifest'
+    | 'projectRoot'
+    | 'integrity'
+    | 'resolved'
+    | 'dev'
+    | 'optional'
+    | 'insights'
+    | 'confused'
+  >
+}
+
+export type Insights = {
+  abandoned?: boolean
+  confused?: boolean
+  cve?: `CVE-${string}`[]
+  cwe?: `CWE-${string}`[]
+  debug?: boolean
+  deprecated?: boolean
+  dynamic?: boolean
+  entropic?: boolean
+  env?: boolean
+  eval?: boolean
+  fs?: boolean
+  license?: LicenseInsights
+  malware?: boolean
+  minified?: boolean
+  native?: boolean
+  network?: boolean
+  obfuscated?: boolean
+  scanned: boolean
+  score?: PackageScore
+  scripts?: boolean
+  severity?: SeverityInsights
+  shell?: boolean
+  shrinkwrap?: boolean
+  squat?: SquatInsights
+  suspicious?: boolean
+  tracker?: boolean
+  trivial?: boolean
+  undesirable?: boolean
+  unknown?: boolean
+  unmaintained?: boolean
+  unpopular?: boolean
+  unstable?: boolean
+  vuln?: VulnInsights
+}
+
+export type LicenseInsights = {
+  unlicensed: boolean
+  misc: boolean
+  restricted: boolean
+  ambiguous: boolean
+  copyleft: boolean
+  unknown: boolean
+  none: boolean
+  exception: boolean
+}
+
+export type LeveledInsights = {
+  low: boolean
+  medium: boolean
+  high: boolean
+  critical: boolean
+}
+
+export type SeverityInsights = LeveledInsights
+export type VulnInsights = LeveledInsights
+
+export type SquatInsights = {
+  medium: boolean
+  critical: boolean
+}
+
+export type ParserFn = (opt: ParserState) => Promise<ParserState>
+
+export type ParsedSelectorToken = PostcssNode & {
+  token: string
+}