@vltpkg/query 1.5.0 → 1.6.1

package/src/pseudo/license.ts

@@ -1,134 +0,0 @@
-import { error } from '@vltpkg/error-cause'
-import { asError } from '@vltpkg/types'
-import {
-  asPostcssNodeWithChildren,
-  asStringNode,
-  asTagNode,
-  isStringNode,
-  isTagNode,
-} from '@vltpkg/dss-parser'
-import {
-  assertSecurityArchive,
-  removeDanglingEdges,
-  removeNode,
-  removeQuotes,
-} from './helpers.ts'
-import type { ParserState } from '../types.ts'
-import type { PostcssNode } from '@vltpkg/dss-parser'
-
-export type LicenseKinds =
-  | 'unlicensed'
-  | 'misc'
-  | 'restricted'
-  | 'ambiguous'
-  | 'copyleft'
-  | 'unknown'
-  | 'none'
-  | 'exception'
-  | undefined
-
-export type LicenseAlertTypes =
-  | 'explicitlyUnlicensedItem'
-  | 'miscLicenseIssues'
-  | 'nonpermissiveLicense'
-  | 'ambiguousClassifier'
-  | 'copyleftLicense'
-  | 'unidentifiedLicense'
-  | 'noLicenseFound'
-  | 'licenseException'
-  | undefined
-
-const kindsMap = new Map<LicenseKinds, LicenseAlertTypes>([
-  ['unlicensed', 'explicitlyUnlicensedItem'],
-  ['misc', 'miscLicenseIssues'],
-  ['restricted', 'nonpermissiveLicense'],
-  ['ambiguous', 'ambiguousClassifier'],
-  ['copyleft', 'copyleftLicense'],
-  ['unknown', 'unidentifiedLicense'],
-  ['none', 'noLicenseFound'],
-  ['exception', 'licenseException'],
-  [undefined, undefined],
-])
-const kinds = new Set(kindsMap.keys())
-
-export const isLicenseKind = (
-  value?: string,
-): value is LicenseKinds => kinds.has(value as LicenseKinds)
-
-export const asLicenseKind = (value?: string): LicenseKinds => {
-  if (!isLicenseKind(value)) {
-    throw error('Expected a valid license kind', {
-      found: value,
-      validOptions: Array.from(kinds),
-    })
-  }
-  return value
-}
-
-export const parseInternals = (
-  nodes: PostcssNode[],
-): { kind: LicenseKinds } => {
-  let kind: LicenseKinds
-
-  if (isStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])) {
-    kind = asLicenseKind(
-      removeQuotes(
-        asStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
-          .value,
-      ),
-    )
-  } else if (
-    isTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
-  ) {
-    kind = asLicenseKind(
-      asTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0]).value,
-    )
-  }
-
-  return { kind }
-}
-
-export const license = async (state: ParserState) => {
-  assertSecurityArchive(state, 'license')
-
-  let internals
-  try {
-    internals = parseInternals(
-      asPostcssNodeWithChildren(state.current).nodes,
-    )
-  } catch (err) {
-    if (asError(err).message === 'Expected a query node') {
-      // No parameters provided - pseudo state form: match ANY license defined (not 'none')
-      for (const node of state.partial.nodes) {
-        const report = state.securityArchive.get(node.id)
-        // Exclude if no report or if it has 'noLicenseFound' alert
-        const exclude =
-          !report?.alerts ||
-          report.alerts.some(alert => alert.type === 'noLicenseFound')
-        if (exclude) {
-          removeNode(state, node)
-        }
-      }
-      removeDanglingEdges(state)
-      return state
-    } else {
-      throw error('Failed to parse :license selector', { cause: err })
-    }
-  }
-
-  const { kind } = internals
-  const alertName = kindsMap.get(kind)
-  for (const node of state.partial.nodes) {
-    const report = state.securityArchive.get(node.id)
-    const exclude = !report?.alerts.some(
-      alert => alert.type === alertName,
-    )
-    if (exclude) {
-      removeNode(state, node)
-    }
-  }
-
-  removeDanglingEdges(state)
-
-  return state
-}

package/src/pseudo/link.ts

@@ -1,30 +0,0 @@
-import { splitDepID } from '@vltpkg/dep-id/browser'
-import type { ParserState } from '../types.ts'
-import { removeNode } from './helpers.ts'
-
-/**
- * :link Pseudo-Selector, matches only nodes that are file links.
- *
- * It filters out any node that is not of type 'file' or nodes of 'file'
- * type that ends with 'tar.gz' since these are local tarballs.
- */
-export const link = async (state: ParserState) => {
-  for (const node of state.partial.nodes) {
-    const [type, path] = splitDepID(node.id)
-    if (type !== 'file' || path.endsWith('tar.gz') || path === '.') {
-      removeNode(state, node)
-    }
-  }
-
-  for (const edge of state.partial.edges) {
-    if (
-      !edge.spec.file ||
-      edge.spec.file.endsWith('tar.gz') ||
-      edge.spec.file === '.'
-    ) {
-      state.partial.edges.delete(edge)
-    }
-  }
-
-  return state
-}

package/src/pseudo/malware.ts

@@ -1,41 +0,0 @@
-import { error } from '@vltpkg/error-cause'
-import { asPostcssNodeWithChildren } from '@vltpkg/dss-parser'
-import {
-  assertSecurityArchive,
-  removeDanglingEdges,
-  removeNode,
-} from './helpers.ts'
-import type { ParserState } from '../types.ts'
-
-const malwareAlertTypes = new Set(['malware', 'gptMalware'])
-
-/**
- * :malware Pseudo-Selector, matches nodes with any malware-related alert.
- *
- * This is a binary selector — no parameters. A node matches if it has
- * at least one alert whose type is `malware` or `gptMalware`.
- */
-export const malware = async (state: ParserState) => {
-  assertSecurityArchive(state, 'malware')
-
-  const currentNode = asPostcssNodeWithChildren(state.current)
-  if (currentNode.nodes.length > 0) {
-    throw error(
-      ':malware selector does not accept parameters. Use :vuln(<severity>) for severity-based filtering.',
-    )
-  }
-
-  for (const node of state.partial.nodes) {
-    const report = state.securityArchive.get(node.id)
-    const hasMalware = report?.alerts.some(alert =>
-      malwareAlertTypes.has(alert.type),
-    )
-    if (!hasMalware) {
-      removeNode(state, node)
-    }
-  }
-
-  removeDanglingEdges(state)
-
-  return state
-}

package/src/pseudo/minified.ts

@@ -1,9 +0,0 @@
-import { createSecuritySelectorFilter } from './helpers.ts'
-
-/**
- * Filters out any node that does not have a **minifiedFile** report alert.
- */
-export const minified = createSecuritySelectorFilter(
-  'minified',
-  'minifiedFile',
-)

package/src/pseudo/missing.ts

@@ -1,16 +0,0 @@
-import type { ParserState } from '../types.ts'
-
-/**
- * :missing Pseudo-Selector, matches only edges that are not linked to any node.
- * It filters out any edges that have a 'to' property, keeping only dangling edges
- * and clears all nodes from the result.
- */
-export const missing = async (state: ParserState) => {
-  for (const edge of state.partial.edges) {
-    if (edge.to) {
-      state.partial.edges.delete(edge)
-    }
-  }
-  state.partial.nodes.clear()
-  return state
-}

package/src/pseudo/native.ts

@@ -1,9 +0,0 @@
-import { createSecuritySelectorFilter } from './helpers.ts'
-
-/**
- * Filters out any node that does not have a **hasNativeCode** report alert.
- */
-export const nativeParser = createSecuritySelectorFilter(
-  'native',
-  'hasNativeCode',
-)

package/src/pseudo/network.ts

@@ -1,9 +0,0 @@
-import { createSecuritySelectorFilter } from './helpers.ts'
-
-/**
- * Filters out any node that does not have a **networkAccess** report alert.
- */
-export const network = createSecuritySelectorFilter(
-  'network',
-  'networkAccess',
-)

package/src/pseudo/obfuscated.ts

@@ -1,9 +0,0 @@
-import { createSecuritySelectorFilter } from './helpers.ts'
-
-/**
- * Filters out any node that does not have an **obfuscatedFile** report alert.
- */
-export const obfuscated = createSecuritySelectorFilter(
-  'obfuscated',
-  'obfuscatedFile',
-)

package/src/pseudo/optional.ts

@@ -1,18 +0,0 @@
-import type { ParserState } from '../types.ts'
-import { removeEdge, removeUnlinkedNodes } from './helpers.ts'
-
-/**
- * :optional Pseudo-Selector will only match optional dependencies.
- */
-export const optional = async (state: ParserState) => {
-  // filter edges that aren't marked as optional
-  for (const edge of state.partial.edges) {
-    if (!edge.optional) {
-      removeEdge(state, edge)
-    }
-  }
-
-  removeUnlinkedNodes(state)
-
-  return state
-}

package/src/pseudo/outdated.ts

@@ -1,345 +0,0 @@
-import pRetry, { AbortError } from 'p-retry'
-import { hydrate, splitDepID } from '@vltpkg/dep-id/browser'
-import { error } from '@vltpkg/error-cause'
-import { userAgentHeaders } from '@vltpkg/user-agent'
-import { asError } from '@vltpkg/types'
-import {
-  compare,
-  gt,
-  major,
-  minor,
-  patch,
-  satisfies,
-} from '@vltpkg/semver'
-import {
-  asPostcssNodeWithChildren,
-  asStringNode,
-  asTagNode,
-  isStringNode,
-  isTagNode,
-} from '@vltpkg/dss-parser'
-import { removeNode, removeQuotes } from './helpers.ts'
-import type { NodeLike, Packument } from '@vltpkg/types'
-import type { GetAuthHeader, ParserState } from '../types.ts'
-import type { PostcssNode } from '@vltpkg/dss-parser'
-
-/**
- * The possible values accepted by the :outdated() pseudo selector.
- */
-export type OutdatedKinds =
-  'any' | 'major' | 'minor' | 'patch' | 'in-range' | 'out-of-range'
-
-/**
- * Result of the internal parsing of the :outdated() pseudo selector.
- */
-export type OutdatedInternals = {
-  kind: OutdatedKinds
-}
-
-/**
- * Extracts a semver type from a version string.
- */
-export type SemverTypeExtraction = (
-  version: string,
-) => number | undefined
-
-const kinds = new Set<OutdatedKinds>([
-  'any',
-  'major',
-  'minor',
-  'patch',
-  'in-range',
-  'out-of-range',
-])
-
-/**
- * Checks if a string is a valid {@link OutdatedKinds}.
- */
-export const isOutdatedKind = (
-  value: string,
-): value is OutdatedKinds => kinds.has(value as OutdatedKinds)
-
-/**
- * Asserts that a string is a valid {@link OutdatedKinds}.
- */
-export const asOutdatedKind = (value: string): OutdatedKinds => {
-  if (!isOutdatedKind(value)) {
-    throw error('Expected a valid outdated kind', {
-      found: value,
-      validOptions: Array.from(kinds),
-    })
-  }
-  return value
-}
-
-/**
- * Fetches the available versions of a package from the npm registry.
- */
-export const retrieveRemoteVersions = async (
-  node: NodeLike,
-  signal?: AbortSignal,
-  getAuthHeader?: GetAuthHeader,
-): Promise<string[]> => {
-  const spec = hydrate(node.id, String(node.name), node.options)
-  if (!spec.registry || !node.name) {
-    return []
-  }
-
-  // resolve against the registry as a base so that any path prefix
-  // (e.g: https://registry.vlt.io/vltpkg/npm/) is preserved
-  const base =
-    spec.registry.endsWith('/') ? spec.registry : `${spec.registry}/`
-  const url = new URL(node.name, base)
-
-  const headers: Record<string, string> = {
-    Accept: 'application/vnd.npm.install-v1+json',
-    ...userAgentHeaders,
-  }
-  const auth = await getAuthHeader?.(String(url))
-  if (auth) {
-    headers.authorization = auth
-  }
-
-  // Corgi is safe here: raw fetch (never the RegistryClient disk cache),
-  // and only versions keys are read.
-  const response = await fetch(String(url), {
-    headers,
-    signal,
-  })
-  // on missing valid auth or API, it should abort the retry logic
-  if (response.status === 404) {
-    throw new AbortError('Missing API')
-  }
-  if (!response.ok) {
-    throw error('Failed to fetch packument', {
-      name: node.name,
-      spec,
-      response,
-    })
-  }
-  const packument = (await response.json()) as Packument
-  return Object.keys(packument.versions).sort(compare)
-}
-
-/**
- * Retrieves what kind of check the :outdated selector should perform.
- */
-export const parseInternals = (
-  nodes: PostcssNode[],
-): OutdatedInternals => {
-  let kind: OutdatedKinds = 'any'
-
-  if (isStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])) {
-    kind = asOutdatedKind(
-      removeQuotes(
-        asStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
-          .value,
-      ),
-    )
-  } else if (
-    isTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
-  ) {
-    kind = asOutdatedKind(
-      asTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0]).value,
-    )
-  }
-
-  return { kind }
-}
-
-/**
- * Filter nodes by queueing up for removal those that are not outdated.
- */
-export const queueNode = async (
-  state: ParserState,
-  node: NodeLike,
-  kind: OutdatedKinds,
-  onError?: (node: NodeLike, err: unknown) => void,
-): Promise<NodeLike | undefined> => {
-  if (!node.name || !node.version) {
-    return node
-  }
-
-  const nodeVersion: string = node.version
-  let versions: string[]
-  try {
-    versions = await pRetry(
-      () =>
-        retrieveRemoteVersions(
-          node,
-          state.signal,
-          state.getAuthHeader,
-        ),
-      {
-        retries: state.retries,
-        signal: state.signal,
-      },
-    )
-  } catch (err) {
-    if (onError) {
-      onError(node, err)
-    } else {
-      // eslint-disable-next-line no-console
-      console.warn(
-        error('Could not retrieve registry versions', {
-          name: node.name,
-          cause: err,
-        }),
-      )
-    }
-    versions = []
-  }
-
-  const greaterVersions = versions.filter((version: string) =>
-    gt(version, nodeVersion),
-  )
-
-  // if there are no greater versions, then the node is not outdated
-  if (!greaterVersions.length) {
-    return node
-  }
-
-  const checkKind = new Map<OutdatedKinds, SemverTypeExtraction>([
-    ['major', major],
-    ['minor', minor],
-    ['patch', patch],
-  ])
-
-  switch (kind) {
-    case 'any':
-      return
-    case 'major':
-    case 'minor':
-    case 'patch': {
-      return (
-          greaterVersions.some((version: string) => {
-            const va = checkKind.get(kind)?.(version)
-            const vb = checkKind.get(kind)?.(nodeVersion)
-            /* c8 ignore next - impossible but typescript doesn't know */
-            if (va === undefined || vb === undefined) return false
-            return va > vb
-          })
-        ) ?
-          undefined
-        : node
-    }
-    // the node should be part of the result as long as it has at least
-    // one parent node that has a spec definition that satisfies one
-    // of the available remove versions
-    case 'in-range': {
-      for (const edge of node.edgesIn) {
-        // if the edge is not part of the partial results, skip it
-        /* c8 ignore next */
-        if (!state.partial.edges.has(edge)) continue
-
-        if (
-          greaterVersions.some(
-            version =>
-              edge.spec.final.range &&
-              satisfies(version, edge.spec.final.range),
-          )
-        ) {
-          return
-        }
-      }
-      return node
-    }
-    // the node is part of the result as long as none of its parents has
-    // a spec definition that satisfies one of the available remote versions
-    case 'out-of-range': {
-      for (const edge of node.edgesIn) {
-        // if the edge is not part of the partial results, skip it
-        /* c8 ignore next */
-        if (!state.partial.edges.has(edge)) continue
-
-        if (
-          greaterVersions.some(
-            version =>
-              edge.spec.final.range &&
-              satisfies(version, edge.spec.final.range),
-          )
-        ) {
-          return node
-        }
-      }
-      return
-    }
-  }
-}
-
-/**
- * Filters out nodes that are not outdated.
- *
- * The :outdated() pseudo selector supports one `type` argument,
- * possible values are the following:
- *
- * - `any`: Selects all nodes that have a greater version available.
- * - `major`: Selects all nodes that have a greater major version available.
- * - `minor`: Selects all nodes that have a greater minor version available.
- * - `patch`: Selects all nodes that have a greater patch version available.
- * - `in-range`: Selects all nodes that have a parent node with a spec definition
- *  that satisfies one of the available remote versions.
- *  - `out-of-range`: Selects all nodes that have a parent node with a spec definition
- *  that does not satisfy any of the available remote versions.
- */
-export const outdated = async (state: ParserState) => {
-  let internals
-  try {
-    internals = parseInternals(
-      asPostcssNodeWithChildren(state.current).nodes,
-    )
-  } catch (err) {
-    if (asError(err).message === 'Expected a query node') {
-      internals = { kind: 'any' } satisfies OutdatedInternals
-    } else {
-      throw error('Failed to parse :outdated selector', {
-        cause: err,
-      })
-    }
-  }
-
-  const { kind } = internals
-  const queue = []
-  const failures: { node: NodeLike; err: unknown }[] = []
-
-  for (const node of state.partial.nodes) {
-    // filter out nodes that are always ignored by the outdated selector
-    if (
-      node.mainImporter ||
-      node.manifest?.private ||
-      splitDepID(node.id)[0] !== 'registry'
-    ) {
-      removeNode(state, node)
-      continue
-    }
-
-    // fetchs outdated info and performs checks to define
-    // whether or not a node should be filtered out
-    queue.push(
-      queueNode(state, node, kind, (node, err) =>
-        failures.push({ node, err }),
-      ),
-    )
-  }
-
-  // nodes queued for removal are then finally removed
-  const removeNodeQueue = await Promise.all(queue)
-  for (const node of removeNodeQueue) {
-    if (node) {
-      removeNode(state, node)
-    }
-  }
-
-  // collapse per-node failures into a single warning
-  if (failures.length) {
-    // eslint-disable-next-line no-console
-    console.warn(
-      error('Could not retrieve registry versions', {
-        found: failures.map(({ node }) => String(node.name)).sort(),
-        cause: failures[0]?.err,
-      }),
-    )
-  }
-
-  return state
-}

package/src/pseudo/overridden.ts

@@ -1,20 +0,0 @@
-import type { ParserState } from '../types.ts'
-import { removeEdge, removeUnlinkedNodes } from './helpers.ts'
-
-/**
- * :overridden Pseudo-Selector, matches only edges that have a truthy overridden property in their spec.
- * It filters out any edges that don't have edge.spec.overridden set to a truthy value
- * and removes any unlinked nodes from the result.
- */
-export const overridden = async (state: ParserState) => {
-  // filter edges that don't have a truthy overridden property
-  for (const edge of state.partial.edges) {
-    if (!edge.spec.overridden) {
-      removeEdge(state, edge)
-    }
-  }
-
-  removeUnlinkedNodes(state)
-
-  return state
-}