@vltpkg/query 1.4.0 → 1.6.0

package/src/pseudo/dist.ts

@@ -1,148 +0,0 @@
-import pRetry, { AbortError } from 'p-retry'
-import { hydrate, splitDepID } from '@vltpkg/dep-id/browser'
-import { error } from '@vltpkg/error-cause'
-import { userAgentHeaders } from '@vltpkg/user-agent'
-import {
-  asPostcssNodeWithChildren,
-  asTagNode,
-  asStringNode,
-  isTagNode,
-} from '@vltpkg/dss-parser'
-import {
-  removeDanglingEdges,
-  removeNode,
-  removeQuotes,
-} from './helpers.ts'
-import type { NodeLike, Packument } from '@vltpkg/types'
-import type { ParserState } from '../types.ts'
-
-/**
- * Fetches the dist-tags of a package from the registry.
- */
-export const retrieveDistTags = async (
-  node: NodeLike,
-  signal?: AbortSignal,
-): Promise<Record<string, string>> => {
-  const spec = hydrate(node.id, String(node.name), node.options)
-  if (!spec.registry || !node.name) {
-    return {}
-  }
-
-  const url = new URL(spec.registry)
-  url.pathname = `/${node.name}`
-
-  // Corgi is safe here: raw fetch (never the RegistryClient disk cache),
-  // and only dist-tags are read.
-  const response = await fetch(String(url), {
-    headers: {
-      Accept: 'application/vnd.npm.install-v1+json',
-      ...userAgentHeaders,
-    },
-    signal,
-  })
-  if (response.status === 404) {
-    throw new AbortError('Missing API')
-  }
-  if (!response.ok) {
-    throw error('Failed to fetch packument', {
-      name: node.name,
-      spec,
-      response,
-    })
-  }
-  const packument = (await response.json()) as Packument
-  return packument['dist-tags']
-}
-
-/**
- * Checks whether a node's installed version matches the version
- * associated with the given dist-tag. Returns the node if it should
- * be removed (does NOT match), or undefined if it matches.
- */
-export const queueNode = async (
-  state: ParserState,
-  node: NodeLike,
-  tagName: string,
-): Promise<NodeLike | undefined> => {
-  if (!node.name || !node.version) {
-    return node
-  }
-
-  let distTags: Record<string, string>
-  try {
-    distTags = await pRetry(
-      () => retrieveDistTags(node, state.signal),
-      {
-        retries: state.retries,
-        signal: state.signal,
-      },
-    )
-  } catch (err) {
-    // eslint-disable-next-line no-console
-    console.warn(
-      error('Could not retrieve dist-tags', {
-        name: node.name,
-        cause: err,
-      }),
-    )
-    return node
-  }
-
-  const tagVersion = distTags[tagName]
-  if (tagVersion !== node.version) {
-    return node
-  }
-
-  return undefined
-}
-
-/**
- * :dist(tag) Pseudo-Selector, matches only nodes whose installed
- * version corresponds to the given dist-tag in the registry.
- *
- * Examples:
- * - :dist(latest) — matches packages at the `latest` dist-tag version
- * - :dist(nightly) — matches packages at the `nightly` dist-tag version
- * - :not(:dist(nightly)) — excludes nightly-tagged versions
- */
-export const dist = async (state: ParserState) => {
-  const top = asPostcssNodeWithChildren(state.current)
-  const selector = asPostcssNodeWithChildren(top.nodes[0])
-  const firstChild = selector.nodes[0]
-
-  let tagName: string
-  try {
-    tagName = removeQuotes(asStringNode(firstChild).value)
-  } catch {
-    if (isTagNode(firstChild)) {
-      tagName = asTagNode(firstChild).value
-      /* c8 ignore start */
-    } else {
-      throw error('Failed to parse :dist selector', {
-        found: firstChild,
-      })
-    }
-    /* c8 ignore stop */
-  }
-
-  const queue = []
-
-  for (const node of state.partial.nodes) {
-    if (splitDepID(node.id)[0] !== 'registry') {
-      removeNode(state, node)
-      continue
-    }
-    queue.push(queueNode(state, node, tagName))
-  }
-
-  const removeNodeQueue = await Promise.all(queue)
-  for (const node of removeNodeQueue) {
-    if (node) {
-      removeNode(state, node)
-    }
-  }
-
-  removeDanglingEdges(state)
-
-  return state
-}

package/src/pseudo/dynamic.ts

@@ -1,9 +0,0 @@
-import { createSecuritySelectorFilter } from './helpers.ts'
-
-/**
- * Filters out any node that does not have a **dynamicRequire** report alert.
- */
-export const dynamic = createSecuritySelectorFilter(
-  'dynamic',
-  'dynamicRequire',
-)

package/src/pseudo/empty.ts

@@ -1,15 +0,0 @@
-import type { ParserState } from '../types.ts'
-import { removeNode } from './helpers.ts'
-
-/**
- * :empty Pseudo-Selector, matches only nodes that have no children.
- * It filters out any node that has edges out, i.e., has dependencies.
- */
-export const empty = async (state: ParserState) => {
-  for (const node of state.partial.nodes) {
-    if (node.edgesOut.size > 0) {
-      removeNode(state, node)
-    }
-  }
-  return state
-}

package/src/pseudo/entropic.ts

@@ -1,9 +0,0 @@
-import { createSecuritySelectorFilter } from './helpers.ts'
-
-/**
- * Filters out any node that does not have a **highEntropyStrings** report alert.
- */
-export const entropic = createSecuritySelectorFilter(
-  'entropic',
-  'highEntropyStrings',
-)

package/src/pseudo/env.ts

@@ -1,6 +0,0 @@
-import { createSecuritySelectorFilter } from './helpers.ts'
-
-/**
- * Filters out any node that does not have a **envVars** report alert.
- */
-export const env = createSecuritySelectorFilter('env', 'envVars')

package/src/pseudo/eval.ts

@@ -1,9 +0,0 @@
-import { createSecuritySelectorFilter } from './helpers.ts'
-
-/**
- * Filters out any node that does not have a **usesEval** report alert.
- */
-export const evalParser = createSecuritySelectorFilter(
-  'eval',
-  'usesEval',
-)

package/src/pseudo/fs.ts

@@ -1,9 +0,0 @@
-import { createSecuritySelectorFilter } from './helpers.ts'
-
-/**
- * Filters out any node that does not have a **filesystemAccess** report alert.
- */
-export const fs = createSecuritySelectorFilter(
-  'fs',
-  'filesystemAccess',
-)

package/src/pseudo/helpers.ts

@@ -1,106 +0,0 @@
-import { error } from '@vltpkg/error-cause'
-import type { EdgeLike, NodeLike } from '@vltpkg/types'
-import type { ParserState } from '../types.js'
-
-/**
- * Removes a node and its incoming edges from the results.
- */
-export const removeNode = (state: ParserState, node: NodeLike) => {
-  for (const edge of node.edgesIn) {
-    state.partial.edges.delete(edge)
-  }
-  state.partial.nodes.delete(node)
-}
-
-/**
- * Removes an edge and its outgoing node from the results.
- */
-export const removeEdge = (state: ParserState, edge: EdgeLike) => {
-  state.partial.edges.delete(edge)
-  if (edge.to?.edgesIn.size === 1) {
-    state.partial.nodes.delete(edge.to)
-  }
-}
-
-/**
- * Removes any edges that have no destination node from the results.
- */
-export const removeDanglingEdges = (state: ParserState) => {
-  for (const edge of state.partial.edges) {
-    if (!edge.to || !state.partial.nodes.has(edge.to)) {
-      state.partial.edges.delete(edge)
-    }
-  }
-}
-
-/**
- * Removes any nodes that have no incoming edges from the results.
- */
-export const removeUnlinkedNodes = (state: ParserState) => {
-  nodeLoop: for (const node of state.partial.nodes) {
-    for (const edge of state.partial.edges) {
-      if (edge.to === node) {
-        continue nodeLoop
-      }
-    }
-    state.partial.nodes.delete(node)
-  }
-}
-
-/**
- * Removes quotes from a string value.
- */
-export const removeQuotes = (value: string) =>
-  value.replace(/^"(.*?)"$/, '$1')
-
-/**
- * Asserts that the security archive is present.
- */
-export const assertSecurityArchive: (
-  state: ParserState,
-  name: string,
-) => asserts state is ParserState & {
-  securityArchive: NonNullable<ParserState['securityArchive']>
-} = (state, name) => {
-  if (!state.securityArchive) {
-    throw error(
-      `Missing security archive while trying to parse the :${name} selector`,
-      { found: state },
-    )
-  }
-}
-
-/**
- * Clears all nodes and edges from the results.
- */
-export const clear = (state: ParserState): ParserState => {
-  state.partial.nodes.clear()
-  state.partial.edges.clear()
-  return state
-}
-
-/**
- * Reusable security selector alert filter.
- */
-export const createSecuritySelectorFilter = (
-  name: string,
-  type: string,
-) => {
-  return async (state: ParserState) => {
-    assertSecurityArchive(state, name)
-
-    for (const node of state.partial.nodes) {
-      const report = state.securityArchive.get(node.id)
-      const exclude = !report?.alerts.some(
-        alert => alert.type === type,
-      )
-      if (exclude) {
-        removeNode(state, node)
-      }
-    }
-
-    removeDanglingEdges(state)
-
-    return state
-  }
-}

package/src/pseudo/host.ts

@@ -1,111 +0,0 @@
-import { error } from '@vltpkg/error-cause'
-import {
-  asPostcssNodeWithChildren,
-  asStringNode,
-  asTagNode,
-  isStringNode,
-  isTagNode,
-} from '@vltpkg/dss-parser'
-import { removeQuotes } from './helpers.ts'
-import type { ParserState } from '../types.ts'
-import type { PostcssNode } from '@vltpkg/dss-parser'
-
-/**
- * Parses the internal parameters of the :host() pseudo selector.
- * Returns the context key that should be used to look up the host context function.
- */
-export const parseInternals = (nodes: PostcssNode[]): string => {
-  let contextKey = ''
-
-  if (isStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])) {
-    contextKey = removeQuotes(
-      asStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
-        .value,
-    )
-  } else if (
-    isTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
-  ) {
-    const tagNode = asTagNode(
-      asPostcssNodeWithChildren(nodes[0]).nodes[0],
-    )
-    contextKey = tagNode.value
-  }
-
-  if (!contextKey) {
-    throw error('Expected a context key parameter for :host selector')
-  }
-
-  return contextKey
-}
-
-/**
- * :host Pseudo-Selector, switches the current graph context to a new
- * set of graphs loaded from a specific host context.
- *
- * This selector accepts a single parameter that specifies which host context
- * to use. The host context must be defined in the hostContexts map provided
- * to the Query constructor.
- *
- * Example:
- * - :host(local) - Switches to graphs loaded from the local context
- */
-export const hostContext = async (state: ParserState) => {
-  if (!state.hostContexts) {
-    throw error('No host contexts available for :host selector')
-  }
-
-  let contextKey: string
-  try {
-    contextKey = parseInternals(
-      asPostcssNodeWithChildren(state.current).nodes,
-    )
-  } catch (err) {
-    throw error('Failed to parse :host selector', {
-      cause: err,
-    })
-  }
-
-  const contextFunction = state.hostContexts.get(contextKey)
-  if (!contextFunction) {
-    throw error(`Unknown host context: ${contextKey}`, {
-      validOptions: Array.from(state.hostContexts.keys()),
-    })
-  }
-
-  // Get the graphs from the host context function
-  const {
-    initialEdges,
-    initialNodes,
-    edges,
-    nodes,
-    securityArchive,
-  } = await contextFunction()
-
-  // Clear current nodes and edges
-  state.securityArchive = securityArchive
-  state.initial.nodes.clear()
-  state.initial.edges.clear()
-  state.partial.nodes.clear()
-  state.partial.edges.clear()
-  state.importers.clear()
-
-  // Reset the initial state
-  for (const node of initialNodes) {
-    state.initial.nodes.add(node)
-  }
-  for (const edge of initialEdges) {
-    state.initial.edges.add(edge)
-  }
-
-  // Populate with nodes and edges from all returned graphs
-  for (const node of nodes) {
-    state.partial.nodes.add(node)
-    // use the current selected nodes by the context function as importers
-    state.importers.add(node)
-  }
-  for (const edge of edges) {
-    state.partial.edges.add(edge)
-  }
-
-  return state
-}

package/src/pseudo/hostname.ts

@@ -1,156 +0,0 @@
-import { splitDepID } from '@vltpkg/dep-id/browser'
-import { getOptions, gitHostWebsites } from '@vltpkg/spec/browser'
-import { asPostcssNodeWithChildren } from '@vltpkg/dss-parser'
-import { error } from '@vltpkg/error-cause'
-import { removeDanglingEdges, removeNode } from './helpers.ts'
-import { parseInternals } from './spec.ts'
-import type { ParserState } from '../types.ts'
-
-/**
- * Given a named git host (e.g. "github"), resolve its hostname
- * by looking up `gitHostWebsites` (e.g. "github.com"), or
- * falling back to the `git-hosts` template URL.
- */
-const resolveGitHostname = (
-  namedHost: string,
-  gitHosts: Record<string, string>,
-): string | undefined => {
-  // Check gitHostWebsites first (e.g. github -> github.com)
-  const website =
-    gitHostWebsites[namedHost as keyof typeof gitHostWebsites]
-  if (website) {
-    try {
-      return new URL(website).hostname
-      /* c8 ignore next */
-    } catch {}
-  }
-
-  // Fall back to parsing the git-hosts template URL
-  const template = gitHosts[namedHost]
-  if (template) {
-    try {
-      // Templates look like 'git+ssh://git@github.com:$1/$2.git'
-      // Replace colons after the host with / for URL parsing
-      const normalized = template
-        .replace(/^git\+/, '')
-        .replace(/:(\$)/, '/$1')
-      return new URL(normalized).hostname
-      /* c8 ignore next */
-    } catch {}
-  }
-  /* c8 ignore next */
-  return undefined
-}
-
-/**
- * Resolve the hostname for a git remote string.
- * Named hosts: "github:user/repo" -> extract "github" and look up.
- * Full URLs: "git+ssh://git@example.com/repo.git" -> parse URL.
- */
-const getGitHostname = (
-  gitRemote: string,
-  gitHosts: Record<string, string>,
-): string | undefined => {
-  // Check if it's a named git host like "github:user/repo"
-  const colonIdx = gitRemote.indexOf(':')
-  if (colonIdx > 0) {
-    const possibleHost = gitRemote.slice(0, colonIdx)
-    // If this is a known named git host, resolve it
-    if (possibleHost in gitHosts) {
-      return resolveGitHostname(possibleHost, gitHosts)
-    }
-    // Could be a protocol URL like git+ssh://...
-    try {
-      const normalized = gitRemote
-        .replace(/^git\+/, '')
-        .replace(/^ssh:\/\/([^@]+@)?([^:/]+)[:/]/, 'ssh://$1$2/')
-      return new URL(normalized).hostname
-      /* c8 ignore next */
-    } catch {}
-  }
-  /* c8 ignore start - git remotes always contain a colon */
-
-  // Try parsing as a plain URL
-  try {
-    return new URL(gitRemote).hostname
-  } catch {}
-
-  return undefined
-  /* c8 ignore stop */
-}
-
-/**
- * :hostname(str) Pseudo-Selector, matches only nodes whose
- * upstream hostname matches the provided domain string.
- *
- * Examples:
- * - :hostname("registry.npmjs.org") — default npm registry deps
- * - :hostname("github.com") — github git deps
- * - :hostname("example.com") — custom registry deps
- */
-export const hostname = async (state: ParserState) => {
-  let internals
-  try {
-    internals = parseInternals(
-      asPostcssNodeWithChildren(state.current).nodes,
-    )
-  } catch (err) {
-    throw error('Failed to parse :hostname selector', {
-      cause: err,
-    })
-  }
-
-  const targetHostname = internals.specValue
-
-  for (const node of state.partial.nodes) {
-    const tuple = splitDepID(node.id)
-    const type = tuple[0]
-    let nodeHostname: string | undefined
-
-    switch (type) {
-      case 'registry': {
-        const registryName = tuple[1]
-        const options = getOptions(node.options)
-        // Look up the registry URL from registries map. There is no
-        // default registry, so a node with an empty registry field and
-        // no configured registry has no hostname, and never matches.
-        const registryUrl =
-          options.registries[registryName] ?? options.registry
-        if (registryUrl) {
-          try {
-            nodeHostname = new URL(registryUrl).hostname
-            /* c8 ignore next */
-          } catch {}
-        }
-        break
-      }
-      case 'git': {
-        const gitRemote = tuple[1]
-        const options = getOptions(node.options)
-        nodeHostname = getGitHostname(gitRemote, options['git-hosts'])
-        break
-      }
-      case 'remote': {
-        const url = tuple[1]
-        try {
-          nodeHostname = new URL(url).hostname
-          /* c8 ignore next */
-        } catch {}
-        break
-      }
-      // file and workspace deps are local — no hostname
-      default: {
-        nodeHostname = undefined
-        break
-      }
-    }
-
-    if (nodeHostname !== targetHostname) {
-      removeNode(state, node)
-    }
-  }
-
-  removeDanglingEdges(state)
-
-  return state
-}