@vltpkg/query 1.5.0 → 1.6.0

package/src/pseudo/severity.ts

@@ -1,231 +0,0 @@
-import { error } from '@vltpkg/error-cause'
-import {
-  asPostcssNodeWithChildren,
-  asStringNode,
-  asTagNode,
-  isStringNode,
-  isTagNode,
-} from '@vltpkg/dss-parser'
-import {
-  assertSecurityArchive,
-  removeDanglingEdges,
-  removeNode,
-  removeQuotes,
-} from './helpers.ts'
-import type { ParserState } from '../types.ts'
-import type { PostcssNode } from '@vltpkg/dss-parser'
-
-export type SeverityKinds =
-  | '0'
-  | '1'
-  | '2'
-  | '3'
-  | 'critical'
-  | 'high'
-  | 'medium'
-  | 'low'
-  | undefined
-
-export type SeverityAlertTypes =
-  | 'criticalCVE'
-  | 'cve'
-  | 'potentialVulnerability'
-  | 'mildCVE'
-  | undefined
-
-export type SeverityComparator = '>' | '<' | '>=' | '<=' | undefined
-
-const kindsMap = new Map<SeverityKinds, SeverityAlertTypes>([
-  ['critical', 'criticalCVE'],
-  ['high', 'cve'],
-  ['medium', 'potentialVulnerability'],
-  ['low', 'mildCVE'],
-  ['0', 'criticalCVE'],
-  ['1', 'cve'],
-  ['2', 'potentialVulnerability'],
-  ['3', 'mildCVE'],
-])
-
-// Map numerical values to their respective kinds for comparison operations
-const kindLevelMap = new Map<SeverityKinds, number>([
-  ['critical', 0],
-  ['high', 1],
-  ['medium', 2],
-  ['low', 3],
-  ['0', 0],
-  ['1', 1],
-  ['2', 2],
-  ['3', 3],
-])
-
-const kinds = new Set(kindsMap.keys())
-
-export const isSeverityKind = (
-  value?: string,
-): value is SeverityKinds => kinds.has(value as SeverityKinds)
-
-export const asSeverityKind = (value?: string): SeverityKinds => {
-  if (!isSeverityKind(value)) {
-    throw error('Expected a valid severity kind', {
-      found: value,
-      validOptions: Array.from(kinds),
-    })
-  }
-  return value
-}
-
-export const parseInternals = (
-  nodes: PostcssNode[],
-): {
-  kind: SeverityKinds
-  comparator: SeverityComparator
-} => {
-  let kind: SeverityKinds
-  let comparator: SeverityComparator
-
-  if (nodes.length === 0) {
-    throw error('Missing severity kind parameter')
-  }
-
-  let kindValue = ''
-  if (isStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])) {
-    kindValue = removeQuotes(
-      asStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
-        .value,
-    )
-  } else if (
-    isTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
-  ) {
-    kindValue = asTagNode(
-      asPostcssNodeWithChildren(nodes[0]).nodes[0],
-    ).value
-  }
-
-  // Extract comparator if present
-  if (kindValue.startsWith('>=')) {
-    comparator = '>='
-    kindValue = kindValue.substring(2)
-  } else if (kindValue.startsWith('<=')) {
-    comparator = '<='
-    kindValue = kindValue.substring(2)
-  } else if (kindValue.startsWith('>')) {
-    comparator = '>'
-    kindValue = kindValue.substring(1)
-  } else if (kindValue.startsWith('<')) {
-    comparator = '<'
-    kindValue = kindValue.substring(1)
-  }
-
-  // Parse kind value
-  if (kindValue) {
-    if (isSeverityKind(kindValue)) {
-      kind = kindValue
-    } else {
-      throw error(
-        'Expected a valid severity kind or number between 0-3',
-        {
-          found: kindValue,
-        },
-      )
-    }
-  }
-
-  return { kind, comparator }
-}
-
-export const severity = async (state: ParserState) => {
-  assertSecurityArchive(state, 'severity')
-
-  let internals
-  try {
-    internals = parseInternals(
-      asPostcssNodeWithChildren(state.current).nodes,
-    )
-  } catch (err) {
-    throw error('Failed to parse :severity selector', { cause: err })
-  }
-
-  const { kind, comparator } = internals
-
-  for (const node of state.partial.nodes) {
-    const report = state.securityArchive.get(node.id)
-    // Always exclude nodes that don't have security data or alerts
-    if (!report?.alerts || report.alerts.length === 0) {
-      removeNode(state, node)
-    }
-  }
-
-  for (const node of state.partial.nodes) {
-    const report = state.securityArchive.get(node.id)
-    let exclude = true
-
-    if (report) {
-      if (comparator) {
-        // retrieve the value to compare against
-        const kindLevel = kindLevelMap.get(kind)
-        // the kindLevel value has already been validated at this point
-        // and thus can never return an undefined value but ts doesn't
-        // know about that, so we have the extra check here
-        /* c8 ignore next - impossible */
-        if (kindLevel == null) break
-
-        // Check each alert to find any that match our comparison criteria
-        for (const alert of report.alerts) {
-          // Get the numerical value of the alert type
-          const alertType = alert.type
-
-          // retrieve a key to the current alert level to be compared against
-          const currentAlertLevelKey = [...kindsMap.entries()].find(
-            ([_, alertValue]) => alertValue === alertType,
-          )?.[0]
-
-          // perform the comparison based on the user-provided kindLevel
-          if (currentAlertLevelKey) {
-            const currentAlertLevel = kindLevelMap.get(
-              currentAlertLevelKey,
-            )
-            /* c8 ignore next - impossible but ts doesn't know */
-            if (currentAlertLevel == null) continue
-
-            switch (comparator) {
-              case '>':
-                if (currentAlertLevel > kindLevel) {
-                  exclude = false
-                }
-                break
-              case '<':
-                if (currentAlertLevel < kindLevel) {
-                  exclude = false
-                }
-                break
-              case '>=':
-                if (currentAlertLevel >= kindLevel) {
-                  exclude = false
-                }
-                break
-              case '<=':
-                if (currentAlertLevel <= kindLevel) {
-                  exclude = false
-                }
-                break
-            }
-          }
-        }
-      } else {
-        // Original exact match behavior
-        const alertName = kindsMap.get(kind)
-        exclude = !report.alerts.some(
-          alert => alert.type === alertName,
-        )
-      }
-    }
-
-    if (exclude) {
-      removeNode(state, node)
-    }
-  }
-
-  removeDanglingEdges(state)
-
-  return state
-}

package/src/pseudo/shell.ts

@@ -1,9 +0,0 @@
-import { createSecuritySelectorFilter } from './helpers.ts'
-
-/**
- * Filters out any node that does not have a **shellAccess** report alert.
- */
-export const shell = createSecuritySelectorFilter(
-  'shell',
-  'shellAccess',
-)

package/src/pseudo/shrinkwrap.ts

@@ -1,9 +0,0 @@
-import { createSecuritySelectorFilter } from './helpers.ts'
-
-/**
- * Filters out any node that does not have a **shrinkwrap** report alert.
- */
-export const shrinkwrap = createSecuritySelectorFilter(
-  'shrinkwrap',
-  'shrinkwrap',
-)

package/src/pseudo/skill.ts

@@ -1,59 +0,0 @@
-import { asPseudoNode } from '@vltpkg/dss-parser'
-import { queryError } from '../error.ts'
-import { removeQuotes } from './helpers.ts'
-import type { ParserState } from '../types.ts'
-
-/**
- * `:skill(<pattern>, ...)`: picks agent skills of the packages its
- * selector matched. Never filters nodes: the walker stores the
- * patterns in the selector's `parts` entry. Opt-in only.
- */
-export const skill = async (state: ParserState) => {
-  const curr = asPseudoNode(state.current)
-  const sel = curr.parent
-  const fail = (message: string) => queryError(message, state.current)
-  if (
-    sel?.parent?.type !== 'root' ||
-    sel.nodes
-      .slice(sel.index(curr) + 1)
-      .some(n => n.type !== 'comment')
-  ) {
-    throw fail(':skill() must end a top-level selector')
-  }
-  if (!state.partSelectors?.has('skill')) {
-    throw fail(
-      ':skill() only applies to --allow-skills and vlt skills',
-    )
-  }
-  if (!curr.nodes.length) throw fail('Missing skill name in :skill()')
-  const patterns = curr.nodes.map(arg => {
-    let pattern = ''
-    for (const n of arg.nodes) {
-      if (n.type === 'comment') continue
-      // `a|b` is tag `b` in namespace `a`: never drop the `a`
-      if (
-        (n.type === 'tag' || n.type === 'universal') &&
-        !String(n).includes('|')
-      ) {
-        pattern += n.value
-      } else if (n.type === 'string') {
-        if (n.value.startsWith("'")) {
-          throw fail(
-            'Invalid skill name in :skill(), use double quotes',
-          )
-        }
-        pattern += removeQuotes(n.value)
-      } else {
-        throw fail(
-          n.type === 'combinator' ?
-            'Invalid skill name in :skill(), quote names with spaces'
-          : 'Invalid skill name in :skill()',
-        )
-      }
-    }
-    if (!pattern) throw fail('Missing skill name in :skill()')
-    return pattern
-  })
-  state.part = { name: 'skill', patterns }
-  return state
-}

package/src/pseudo/skills.ts

@@ -1,29 +0,0 @@
-import { asPseudoNode } from '@vltpkg/dss-parser'
-import { queryError } from '../error.ts'
-import { clear, removeDanglingEdges, removeNode } from './helpers.ts'
-import type { ParserState } from '../types.ts'
-
-/**
- * `:skills`: matches installed packages that ship agent skills, as
- * told by the `hasSkills` provider.
- */
-export const skills = async (state: ParserState) => {
-  // `:skills(x)`: likely a `:skill(x)` typo
-  if (asPseudoNode(state.current).nodes.length) {
-    if (state.loose) return clear(state)
-    throw queryError(':skills takes no arguments', state.current, {
-      wanted: ':skill',
-    })
-  }
-  if (!state.hasSkills) {
-    throw queryError(
-      'The :skills selector is not supported here',
-      state.current,
-    )
-  }
-  for (const node of state.partial.nodes) {
-    if (!(await state.hasSkills(node))) removeNode(state, node)
-  }
-  removeDanglingEdges(state)
-  return state
-}

package/src/pseudo/spec.ts

@@ -1,131 +0,0 @@
-import { error } from '@vltpkg/error-cause'
-import { asError } from '@vltpkg/types'
-import {
-  asPostcssNodeWithChildren,
-  asStringNode,
-  asTagNode,
-  isTagNode,
-} from '@vltpkg/dss-parser'
-import {
-  removeEdge,
-  removeUnlinkedNodes,
-  removeQuotes,
-} from './helpers.ts'
-import type { ParserState } from '../types.ts'
-import type { PostcssNode } from '@vltpkg/dss-parser'
-
-export type SpecInternals = {
-  specValue: string
-}
-
-export const parseInternals = (
-  nodes: PostcssNode[],
-): SpecInternals => {
-  // tries to parse the first param as a string node, otherwise defaults
-  // to reading all postcss nodes as just strings, since it just means
-  // the value was defined as an unquoted string
-  let specValue = ''
-
-  if (nodes.length === 0) {
-    throw new Error('No nodes provided to parseInternals')
-  }
-
-  const firstNode = asPostcssNodeWithChildren(nodes[0])
-
-  if (firstNode.nodes.length === 0) {
-    throw new Error('First node has no child nodes')
-  }
-
-  // Try to parse as a quoted string first (single string node)
-  if (firstNode.nodes.length === 1) {
-    const targetNode = firstNode.nodes[0]
-    try {
-      specValue = removeQuotes(asStringNode(targetNode).value)
-      return { specValue }
-    } catch (err) {
-      if (
-        asError(err).message === 'Mismatching query node' &&
-        isTagNode(targetNode)
-        /* c8 ignore start */
-      ) {
-        // Handle simple unquoted single-token values like "1"
-        const tagNode = asTagNode(targetNode)
-        specValue = tagNode.value
-        return { specValue }
-        /* c8 ignore stop */
-      } else {
-        throw err
-      }
-    }
-  }
-
-  // Handle unquoted complex values that get parsed into multiple nodes
-  // This happens when unquoted values contain dots, like ^1.0.0 which becomes:
-  // - Tag: "^1"
-  // - ClassName: "0" (from .0)
-  // - ClassName: "0" (from .0)
-  // We need to reconstruct the original value by concatenating all nodes
-  const parts: string[] = []
-
-  for (const node of firstNode.nodes) {
-    switch (node.type) {
-      case 'tag':
-        parts.push(asTagNode(node).value)
-        break
-      case 'class':
-        // Class nodes represent .className in CSS, so we need to add the dot back
-        parts.push('.' + node.value)
-        break
-      case 'id':
-        // ID nodes represent #idName in CSS, so we need to add the hash back
-        parts.push('#' + node.value)
-        break
-      case 'string':
-        parts.push(removeQuotes(asStringNode(node).value))
-        break
-      default:
-        // For other node types, try to get the value property or convert to string
-        /* c8 ignore next */
-        parts.push(node.value ?? String(node))
-        break
-    }
-  }
-
-  specValue = parts.join('')
-  return { specValue }
-}
-
-/**
- * :spec Pseudo-Selector, matches edges where edge.spec.bareSpec equals the provided value.
- *
- * Examples:
- * - :spec("*") matches edges with a package specifier equal to "*"
- * - :spec(^1.0.0) matches edges with a package specifier equal to "^1.0.0"
- * - :spec("catalog:") matches edges with a package specifier equal to "catalog:"
- * - :spec("workspace:dev") matches edges with a package specifier equal to "workspace:dev"
- */
-export const spec = async (state: ParserState) => {
-  let internals
-  try {
-    internals = parseInternals(
-      asPostcssNodeWithChildren(state.current).nodes,
-    )
-  } catch (err) {
-    throw error('Failed to parse :spec selector', {
-      cause: err,
-    })
-  }
-
-  const { specValue } = internals
-
-  for (const edge of state.partial.edges) {
-    if (edge.spec.bareSpec !== specValue) {
-      removeEdge(state, edge)
-    }
-  }
-
-  // Clean up unlinked nodes after removing edges
-  removeUnlinkedNodes(state)
-
-  return state
-}

package/src/pseudo/squat.ts

@@ -1,225 +0,0 @@
-import { error } from '@vltpkg/error-cause'
-import { asError } from '@vltpkg/types'
-import {
-  asPostcssNodeWithChildren,
-  asStringNode,
-  asTagNode,
-  isStringNode,
-  isTagNode,
-} from '@vltpkg/dss-parser'
-import {
-  assertSecurityArchive,
-  removeDanglingEdges,
-  removeNode,
-  removeQuotes,
-} from './helpers.ts'
-import type { ParserState } from '../types.ts'
-import type { PostcssNode } from '@vltpkg/dss-parser'
-
-export type SquatKinds = '0' | '2' | 'critical' | 'medium' | undefined
-
-export type SquatAlertTypes =
-  'didYouMean' | 'gptDidYouMean' | undefined
-
-export type SquatComparator = '>' | '<' | '>=' | '<=' | undefined
-
-const kindsMap = new Map<SquatKinds, SquatAlertTypes>([
-  ['critical', 'didYouMean'],
-  ['medium', 'gptDidYouMean'],
-  ['0', 'didYouMean'],
-  ['2', 'gptDidYouMean'],
-  [undefined, undefined],
-])
-
-// Map numerical values to their respective kinds for comparison operations
-const kindLevelMap = new Map<SquatKinds, number>([
-  ['critical', 0],
-  ['medium', 2],
-  ['0', 0],
-  ['2', 2],
-])
-
-const kinds = new Set(kindsMap.keys())
-
-export const isSquatKind = (value?: string): value is SquatKinds =>
-  kinds.has(value as SquatKinds)
-
-export const asSquatKind = (value?: string): SquatKinds => {
-  if (!isSquatKind(value)) {
-    throw error('Expected a valid squat kind', {
-      found: value,
-      validOptions: Array.from(kinds),
-    })
-  }
-  return value
-}
-
-export const parseInternals = (
-  nodes: PostcssNode[],
-): {
-  kind: SquatKinds
-  comparator: SquatComparator
-} => {
-  let kind: SquatKinds
-  let comparator: SquatComparator
-
-  let kindValue = ''
-  if (isStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])) {
-    kindValue = removeQuotes(
-      asStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
-        .value,
-    )
-  } else if (
-    isTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
-  ) {
-    kindValue = asTagNode(
-      asPostcssNodeWithChildren(nodes[0]).nodes[0],
-    ).value
-  }
-
-  // Extract comparator if present
-  if (kindValue.startsWith('>=')) {
-    comparator = '>='
-    kindValue = kindValue.substring(2)
-  } else if (kindValue.startsWith('<=')) {
-    comparator = '<='
-    kindValue = kindValue.substring(2)
-  } else if (kindValue.startsWith('>')) {
-    comparator = '>'
-    kindValue = kindValue.substring(1)
-  } else if (kindValue.startsWith('<')) {
-    comparator = '<'
-    kindValue = kindValue.substring(1)
-  }
-
-  // Parse kind value
-  if (kindValue) {
-    if (isSquatKind(kindValue)) {
-      kind = kindValue
-    } else {
-      throw error('Expected a valid squat kind for comparison', {
-        found: kindValue,
-        validOptions: Array.from(kinds),
-      })
-    }
-  }
-
-  return { kind, comparator }
-}
-
-export const squat = async (state: ParserState) => {
-  assertSecurityArchive(state, 'squat')
-
-  let internals
-  try {
-    internals = parseInternals(
-      asPostcssNodeWithChildren(state.current).nodes,
-    )
-  } catch (err) {
-    if (asError(err).message === 'Expected a query node') {
-      // No parameters provided - pseudo state form: match ANY squat level
-      internals = { kind: undefined, comparator: undefined }
-    } else {
-      throw error('Failed to parse :squat selector', { cause: err })
-    }
-  }
-
-  const { kind, comparator } = internals
-
-  // First pass: Remove nodes without security data
-  for (const node of state.partial.nodes) {
-    const report = state.securityArchive.get(node.id)
-    // Always exclude nodes that don't have security data or alerts
-    if (!report?.alerts || report.alerts.length === 0) {
-      removeNode(state, node)
-    }
-  }
-
-  // Second pass: Apply comparison filtering
-  for (const node of state.partial.nodes) {
-    const report = state.securityArchive.get(node.id)
-
-    // Skip if report is undefined
-    // (should never happen since we filtered above)
-    /* c8 ignore next - impossible */
-    if (!report) continue
-
-    // At this point we know report exists and has alerts
-    let exclude = true
-
-    if (kind === undefined && comparator === undefined) {
-      // Pseudo state form: match ANY squat level
-      exclude = !report.alerts.some(alert =>
-        [...kindsMap.values()].includes(
-          alert.type as SquatAlertTypes,
-        ),
-      )
-    } else if (comparator) {
-      // Get the value to compare against
-      const kindLevel = kindLevelMap.get(kind)
-      /* c8 ignore next - impossible */
-      if (kindLevel === undefined) break
-
-      // For each alert, check if it matches the comparison criteria
-      let matchesComparison = false
-      for (const alert of report.alerts) {
-        // Get the alert type
-        const alertType = alert.type
-
-        // Find the corresponding kind for this alert type
-        const alertLevelKey = [...kindsMap.entries()].find(
-          ([_, value]) => value === alertType,
-        )?.[0]
-
-        if (alertLevelKey) {
-          // Get the numeric level for this alert
-          const alertLevel = kindLevelMap.get(alertLevelKey)
-          /* c8 ignore next - impossible */
-          if (alertLevel === undefined) continue
-
-          // Apply the comparison based on the comparator
-          switch (comparator) {
-            case '>':
-              if (alertLevel > kindLevel) {
-                matchesComparison = true
-              }
-              break
-            case '<':
-              if (alertLevel < kindLevel) {
-                matchesComparison = true
-              }
-              break
-            case '>=':
-              if (alertLevel >= kindLevel) {
-                matchesComparison = true
-              }
-              break
-            case '<=':
-              if (alertLevel <= kindLevel) {
-                matchesComparison = true
-              }
-              break
-          }
-
-          // If we found a match, we can stop checking other alerts
-          if (matchesComparison) break
-        }
-      }
-
-      // Exclude the node if it doesn't match the comparison
-      exclude = !matchesComparison
-    } else {
-      // Original exact match behavior
-      const alertName = kindsMap.get(kind)
-      exclude = !report.alerts.some(alert => alert.type === alertName)
-    }
-
-    if (exclude) {
-      removeNode(state, node)
-    }
-  }
-
-  removeDanglingEdges(state)
-
-  return state
-}

package/src/pseudo/suspicious.ts

@@ -1,9 +0,0 @@
-import { createSecuritySelectorFilter } from './helpers.ts'
-
-/**
- * Filters out any node that does not have a **suspiciousStarActivity** report alert.
- */
-export const suspicious = createSecuritySelectorFilter(
-  'suspicious',
-  'suspiciousStarActivity',
-)