File Explorer

1'use strict'2 3const { resolve } = require('node:path')4const { parser, arrayDelimiter } = require('@npmcli/query')5const localeCompare = require('@isaacs/string-locale-compare')('en')6const { log } = require('proc-log')7const { minimatch } = require('minimatch')8const npa = require('npm-package-arg')9const pacote = require('pacote')10const semver = require('semver')11const npmFetch = require('npm-registry-fetch')12const { isReleaseAgeExcluded } = require('./release-age-exclude.js')13 14// handle results for parsed query asts, results are stored in a map that has a15// key that points to each ast selector node and stores the resulting array of16// arborist nodes as its value, that is essential to how we handle multiple17// query selectors, e.g: `#a, #b, #c` <- 3 diff ast selector nodes18class Results {19  #currentAstSelector20  #initialItems21  #inventory22  #outdatedCache = new Map()23  #vulnCache24  #pendingCombinator25  #results = new Map()26  #targetNode27 28  constructor (opts) {29    this.#currentAstSelector = opts.rootAstNode.nodes[0]30    this.#inventory = opts.inventory31    this.#initialItems = opts.initialItems32    this.#vulnCache = opts.vulnCache33    this.#targetNode = opts.targetNode34 35    this.currentResults = this.#initialItems36 37    // We get this when first called and need to pass it to pacote38    this.flatOptions = opts.flatOptions || {}39 40    // reset by rootAstNode walker41    this.currentAstNode = opts.rootAstNode42  }43 44  get currentResults () {45    return this.#results.get(this.#currentAstSelector)46  }47 48  set currentResults (value) {49    this.#results.set(this.#currentAstSelector, value)50  }51 52  // retrieves the initial items to which start the filtering / matching53  // for most of the different types of recognized ast nodes, e.g: class (aka54  // depType), id, *, etc in different contexts we need to start with the55  // current list of filtered results, for example a query for `.workspace`56  // actually means the same as `*.workspace` so we want to start with the full57  // inventory if that's the first ast node we're reading but if it appears in58  // the middle of a query it should respect the previous filtered results,59  // combinators are a special case in which we always want to have the60  // complete inventory list in order to use the left-hand side ast node as a61  // filter combined with the element on its right-hand side62  get initialItems () {63    const firstParsed =64      (this.currentAstNode.parent.nodes[0] === this.currentAstNode) &&65      (this.currentAstNode.parent.parent.type === 'root')66 67    if (firstParsed) {68      return this.#initialItems69    }70 71    if (this.currentAstNode.prev().type === 'combinator') {72      return this.#inventory73    }74    return this.currentResults75  }76 77  // combinators need information about previously filtered items along78  // with info of the items parsed / retrieved from the selector right79  // past the combinator, for this reason combinators are stored and80  // only ran as the last part of each selector logic81  processPendingCombinator (nextResults) {82    if (this.#pendingCombinator) {83      const res = this.#pendingCombinator(this.currentResults, nextResults)84      this.#pendingCombinator = null85      this.currentResults = res86    } else {87      this.currentResults = nextResults88    }89  }90 91  // when collecting results to a root astNode, we traverse the list of child92  // selector nodes and collect all of their resulting arborist nodes into a93  // single/flat Set of items, this ensures we also deduplicate items94  collect (rootAstNode) {95    return new Set(rootAstNode.nodes.flatMap(n => this.#results.get(n)))96  }97 98  // selector types map to the '.type' property of the ast nodes via `${astNode.type}Type`99  //100  // attribute selector [name=value], etc101  attributeType () {102    const nextResults = this.initialItems.filter(node =>103      attributeMatch(this.currentAstNode, node.package)104    )105    this.processPendingCombinator(nextResults)106  }107 108  // dependency type selector (i.e. .prod, .dev, etc)109  // css calls this class, we interpret is as dependency type110  classType () {111    const depTypeFn = depTypes[String(this.currentAstNode)]112    if (!depTypeFn) {113      throw Object.assign(114        new Error(`\`${String(this.currentAstNode)}\` is not a supported dependency type.`),115        { code: 'EQUERYNODEPTYPE' }116      )117    }118    const nextResults = depTypeFn(this.initialItems)119    this.processPendingCombinator(nextResults)120  }121 122  // combinators (i.e. '>', ' ', '~')123  combinatorType () {124    this.#pendingCombinator = combinators[String(this.currentAstNode)]125  }126 127  // name selectors (i.e. #foo)128  // css calls this id, we interpret it as name129  idType () {130    const name = this.currentAstNode.value131    const nextResults = this.initialItems.filter(node =>132      (name === node.name) || (name === node.package.name)133    )134    this.processPendingCombinator(nextResults)135  }136 137  // pseudo selectors (prefixed with :)138  async pseudoType () {139    const pseudoFn = `${this.currentAstNode.value.slice(1)}Pseudo`140    if (!this[pseudoFn]) {141      throw Object.assign(142        new Error(`\`${this.currentAstNode.value143        }\` is not a supported pseudo selector.`),144        { code: 'EQUERYNOPSEUDO' }145      )146    }147    const nextResults = await this[pseudoFn]()148    this.processPendingCombinator(nextResults)149  }150 151  selectorType () {152    this.#currentAstSelector = this.currentAstNode153    // starts a new array in which resulting items154    // can be stored for each given ast selector155    if (!this.currentResults) {156      this.currentResults = []157    }158  }159 160  universalType () {161    this.processPendingCombinator(this.initialItems)162  }163 164  // pseudo selectors map to the 'value' property of the pseudo selectors in the ast nodes165  // via selectors via `${value.slice(1)}Pseudo`166  attrPseudo () {167    const { lookupProperties, attributeMatcher } = this.currentAstNode168 169    return this.initialItems.filter(node => {170      let objs = [node.package]171      for (const prop of lookupProperties) {172        // if an isArray symbol is found that means we'll need to iterate173        // over the previous found array to basically make sure we traverse174        // all its indexes testing for possible objects that may eventually175        // hold more keys specified in a selector176        if (prop === arrayDelimiter) {177          objs = objs.flat()178          continue179        }180 181        // otherwise just maps all currently found objs182        // to the next prop from the lookup properties list,183        // filters out any empty key lookup184        objs = objs.flatMap(obj => obj[prop] || [])185 186        // in case there's no property found in the lookup187        // just filters that item out188        const noAttr = objs.every(obj => !obj)189        if (noAttr) {190          return false191        }192      }193 194      // if any of the potential object matches195      // that item should be in the final result196      return objs.some(obj => attributeMatch(attributeMatcher, obj))197    })198  }199 200  emptyPseudo () {201    return this.initialItems.filter(node => node.edgesOut.size === 0)202  }203 204  extraneousPseudo () {205    return this.initialItems.filter(node => node.extraneous)206  }207 208  async hasPseudo () {209    const found = []210    for (const item of this.initialItems) {211      // This is the one time initialItems differs from inventory212      const res = await retrieveNodesFromParsedAst({213        flatOptions: this.flatOptions,214        initialItems: [item],215        inventory: this.#inventory,216        rootAstNode: this.currentAstNode.nestedNode,217        targetNode: item,218        vulnCache: this.#vulnCache,219      })220      if (res.size > 0) {221        found.push(item)222      }223    }224    return found225  }226 227  invalidPseudo () {228    const found = []229    for (const node of this.initialItems) {230      for (const edge of node.edgesIn) {231        if (edge.invalid) {232          found.push(node)233          break234        }235      }236    }237    return found238  }239 240  async isPseudo () {241    const res = await retrieveNodesFromParsedAst({242      flatOptions: this.flatOptions,243      initialItems: this.initialItems,244      inventory: this.#inventory,245      rootAstNode: this.currentAstNode.nestedNode,246      targetNode: this.currentAstNode,247      vulnCache: this.#vulnCache,248    })249    return [...res]250  }251 252  linkPseudo () {253    return this.initialItems.filter(node => node.isLink || (node.isTop && !node.isRoot))254  }255 256  missingPseudo () {257    return this.#inventory.reduce((res, node) => {258      for (const edge of node.edgesOut.values()) {259        if (edge.missing) {260          const pkg = { name: edge.name, version: edge.spec }261          const item = new this.#targetNode.constructor({ pkg })262          item.queryContext = {263            missing: true,264          }265          item.edgesIn = new Set([edge])266          res.push(item)267        }268      }269      return res270    }, [])271  }272 273  async notPseudo () {274    const res = await retrieveNodesFromParsedAst({275      flatOptions: this.flatOptions,276      initialItems: this.initialItems,277      inventory: this.#inventory,278      rootAstNode: this.currentAstNode.nestedNode,279      targetNode: this.currentAstNode,280      vulnCache: this.#vulnCache,281    })282    const internalSelector = new Set(res)283    return this.initialItems.filter(node =>284      !internalSelector.has(node))285  }286 287  overriddenPseudo () {288    return this.initialItems.filter(node => node.overridden)289  }290 291  pathPseudo () {292    return this.initialItems.filter(node => {293      if (!this.currentAstNode.pathValue) {294        return true295      }296      return minimatch(297        node.realpath.replace(/\\+/g, '/'),298        resolve(node.root.realpath, this.currentAstNode.pathValue).replace(/\\+/g, '/')299      )300    })301  }302 303  privatePseudo () {304    return this.initialItems.filter(node => node.package.private)305  }306 307  rootPseudo () {308    return this.initialItems.filter(node => node === this.#targetNode.root)309  }310 311  scopePseudo () {312    return this.initialItems.filter(node => node === this.#targetNode)313  }314 315  semverPseudo () {316    const {317      attributeMatcher,318      lookupProperties,319      semverFunc = 'infer',320      semverValue,321    } = this.currentAstNode322    const { qualifiedAttribute } = attributeMatcher323 324    if (!semverValue) {325      // DEPRECATED: remove this warning and throw an error as part of @npmcli/arborist@6326      log.warn('query', 'usage of :semver() with no parameters is deprecated')327      return this.initialItems328    }329 330    if (!semver.valid(semverValue) && !semver.validRange(semverValue)) {331      throw Object.assign(332        new Error(`\`${semverValue}\` is not a valid semver version or range`),333        { code: 'EQUERYINVALIDSEMVER' })334    }335 336    const valueIsVersion = !!semver.valid(semverValue)337 338    const nodeMatches = (node, obj) => {339      // if we already have an operator, the user provided some test as part of the selector340      // we evaluate that first because if it fails we don't want this node anyway341      if (attributeMatcher.operator) {342        if (!attributeMatch(attributeMatcher, obj)) {343          // if the initial operator doesn't match, we're done344          return false345        }346      }347 348      const attrValue = obj[qualifiedAttribute]349      // both valid and validRange return null for undefined, so this will skip both nodes that350      // do not have the attribute defined as well as those where the attribute value is invalid351      // and those where the value from the package.json is not a string352      if ((!semver.valid(attrValue) && !semver.validRange(attrValue)) ||353          typeof attrValue !== 'string') {354        return false355      }356 357      const attrIsVersion = !!semver.valid(attrValue)358 359      let actualFunc = semverFunc360 361      // if we're asked to infer, we examine outputs to make a best guess362      if (actualFunc === 'infer') {363        if (valueIsVersion && attrIsVersion) {364          // two versions -> semver.eq365          actualFunc = 'eq'366        } else if (!valueIsVersion && !attrIsVersion) {367          // two ranges -> semver.intersects368          actualFunc = 'intersects'369        } else {370          // anything else -> semver.satisfies371          actualFunc = 'satisfies'372        }373      }374 375      if (['eq', 'neq', 'gt', 'gte', 'lt', 'lte'].includes(actualFunc)) {376        // both sides must be versions, but one is not377        if (!valueIsVersion || !attrIsVersion) {378          return false379        }380 381        return semver[actualFunc](attrValue, semverValue)382      } else if (['gtr', 'ltr', 'satisfies'].includes(actualFunc)) {383        // at least one side must be a version, but neither is384        if (!valueIsVersion && !attrIsVersion) {385          return false386        }387 388        return valueIsVersion389          ? semver[actualFunc](semverValue, attrValue)390          : semver[actualFunc](attrValue, semverValue)391      } else if (['intersects', 'subset'].includes(actualFunc)) {392        // these accept two ranges and since a version is also a range, anything goes393        return semver[actualFunc](attrValue, semverValue)394      } else {395        // user provided a function we don't know about, throw an error396        throw Object.assign(new Error(`\`semver.${actualFunc}\` is not a supported operator.`),397          { code: 'EQUERYINVALIDOPERATOR' })398      }399    }400 401    return this.initialItems.filter((node) => {402      // no lookupProperties just means its a top level property, see if it matches403      if (!lookupProperties.length) {404        return nodeMatches(node, node.package)405      }406 407      // this code is mostly duplicated from attrPseudo to traverse into the package until we get408      // to our deepest requested object409      let objs = [node.package]410      for (const prop of lookupProperties) {411        if (prop === arrayDelimiter) {412          objs = objs.flat()413          continue414        }415 416        objs = objs.flatMap(obj => obj[prop] || [])417        const noAttr = objs.every(obj => !obj)418        if (noAttr) {419          return false420        }421 422        return objs.some(obj => nodeMatches(node, obj))423      }424    })425  }426 427  typePseudo () {428    if (!this.currentAstNode.typeValue) {429      return this.initialItems430    }431    // TODO this differs subtly with `:type()` because it now iterates on edgesIn, which means extraneous deps won't show up432    // note how "@npmcli/abbrev@2.0.0-beta.45" is in the `:type()` results in the test but not in any of the other results.433    return this.initialItems434      .flatMap(node => {435        const found = []436        const { typeValue } = this.currentAstNode437        for (const edge of node.edgesIn) {438          const parsedArg = npa(`${edge.name}@${edge.spec}`)439          if (typeValue === 'registry') {440            if (parsedArg.registry) {441              found.push(edge.to)442            }443          } else if (parsedArg.type === typeValue) {444            found.push(edge.to)445          }446        }447        return found448      })449  }450 451  dedupedPseudo () {452    return this.initialItems.filter(node => node.target.edgesIn.size > 1)453  }454 455  async vulnPseudo () {456    if (!this.initialItems.length) {457      return this.initialItems458    }459    if (!this.#vulnCache) {460      const packages = {}461      // We have to map the items twice, once to get the request, and a second time to filter out the results of that request462      this.initialItems.map((node) => {463        if (node.isProjectRoot || node.package.private) {464          return465        }466        if (!packages[node.name]) {467          packages[node.name] = []468        }469        if (!packages[node.name].includes(node.version)) {470          packages[node.name].push(node.version)471        }472      })473      const res = await npmFetch('/-/npm/v1/security/advisories/bulk', {474        ...this.flatOptions,475        registry: this.flatOptions.auditRegistry || this.flatOptions.registry,476        method: 'POST',477        gzip: true,478        body: packages,479      })480      this.#vulnCache = await res.json()481    }482    const advisories = this.#vulnCache483    const { vulns } = this.currentAstNode484    return this.initialItems.filter(item => {485      const vulnerable = advisories[item.name]?.filter(advisory => {486        // This could be for another version of this package elsewhere in the tree487        if (!semver.intersects(advisory.vulnerable_versions, item.version)) {488          return false489        }490        if (!vulns) {491          return true492        }493        // vulns are OR with each other, if any one matches we're done494        for (const vuln of vulns) {495          if (vuln.severity && !vuln.severity.includes('*')) {496            if (!vuln.severity.includes(advisory.severity)) {497              continue498            }499          }500 501          if (vuln?.cwe) {502            // * is special, it means "has a cwe"503            if (vuln.cwe.includes('*')) {504              if (!advisory.cwe.length) {505                continue506              }507            } else if (!vuln.cwe.every(cwe => advisory.cwe.includes(`CWE-${cwe}`))) {508              continue509            }510          }511          return true512        }513      })514      if (vulnerable?.length) {515        item.queryContext = {516          advisories: vulnerable,517        }518        return true519      }520      return false521    })522  }523 524  async outdatedPseudo () {525    const { outdatedKind = 'any' } = this.currentAstNode526 527    // filter the initialItems528    // NOTE: this uses a Promise.all around a map without in-line concurrency handling529    // since the only async action taken is retrieving the packument, which is limited530    // based on the max-sockets config in make-fetch-happen531    const initialResults = await Promise.all(this.initialItems.map(async (node) => {532      // the root can't be outdated, skip it533      if (node.isProjectRoot) {534        return false535      }536 537      // private packages can't be published, skip them538      if (node.package.private) {539        return false540      }541 542      // we cache the promise representing the full versions list, this helps reduce the543      // number of requests we send by keeping population of the cache in a single tick544      // making it less likely that multiple requests for the same package will be inflight545      if (!this.#outdatedCache.has(node.name)) {546        this.#outdatedCache.set(node.name, getPackageVersions(node.name, this.flatOptions))547      }548      const availableVersions = await this.#outdatedCache.get(node.name)549 550      // we attach _all_ versions to the queryContext to allow consumers to do their own551      // filtering and comparisons552      node.queryContext.versions = availableVersions553 554      // next we further reduce the set to versions that are greater than the current one555      const greaterVersions = availableVersions.filter((available) => {556        return semver.gt(available, node.version)557      })558 559      // no newer versions than the current one, drop this node from the result set560      if (!greaterVersions.length) {561        return false562      }563 564      // if we got here, we know that newer versions exist, if the kind is 'any' we're done565      if (outdatedKind === 'any') {566        return node567      }568 569      // look for newer versions that differ from current by a specific part of the semver version570      if (['major', 'minor', 'patch'].includes(outdatedKind)) {571        // filter the versions greater than our current one based on semver.diff572        const filteredVersions = greaterVersions.filter((version) => {573          return semver.diff(node.version, version) === outdatedKind574        })575 576        // no available versions are of the correct diff type577        if (!filteredVersions.length) {578          return false579        }580 581        return node582      }583 584      // look for newer versions that satisfy at least one edgeIn to this node585      if (outdatedKind === 'in-range') {586        const inRangeContext = []587        for (const edge of node.edgesIn) {588          const inRangeVersions = greaterVersions.filter((version) => {589            return semver.satisfies(version, edge.spec)590          })591 592          // this edge has no in-range candidates, just move on593          if (!inRangeVersions.length) {594            continue595          }596 597          inRangeContext.push({598            from: edge.from.location,599            versions: inRangeVersions,600          })601        }602 603        // if we didn't find at least one match, drop this node604        if (!inRangeContext.length) {605          return false606        }607 608        // now add to the context each version that is in-range for each edgeIn609        node.queryContext.outdated = {610          ...node.queryContext.outdated,611          inRange: inRangeContext,612        }613 614        return node615      }616 617      // look for newer versions that _do not_ satisfy at least one edgeIn618      if (outdatedKind === 'out-of-range') {619        const outOfRangeContext = []620        for (const edge of node.edgesIn) {621          const outOfRangeVersions = greaterVersions.filter((version) => {622            return !semver.satisfies(version, edge.spec)623          })624 625          // this edge has no out-of-range candidates, skip it626          if (!outOfRangeVersions.length) {627            continue628          }629 630          outOfRangeContext.push({631            from: edge.from.location,632            versions: outOfRangeVersions,633          })634        }635 636        // if we didn't add at least one thing to the context, this node is not a match637        if (!outOfRangeContext.length) {638          return false639        }640 641        // attach the out-of-range context to the node642        node.queryContext.outdated = {643          ...node.queryContext.outdated,644          outOfRange: outOfRangeContext,645        }646 647        return node648      }649 650      // any other outdatedKind is unknown and will never match651      return false652    }))653 654    // return an array with the holes for non-matching nodes removed655    return initialResults.filter(Boolean)656  }657}658 659// operators for attribute selectors660const attributeOperators = {661  // attribute value is equivalent662  '=' ({ attr, value }) {663    return attr === value664  },665  // attribute value contains word666  '~=' ({ attr, value }) {667    return (attr.match(/\w+/g) || []).includes(value)668  },669  // attribute value contains string670  '*=' ({ attr, value }) {671    return attr.includes(value)672  },673  // attribute value is equal or starts with674  '|=' ({ attr, value }) {675    return attr.startsWith(`${value}-`)676  },677  // attribute value starts with678  '^=' ({ attr, value }) {679    return attr.startsWith(value)680  },681  // attribute value ends with682  '$=' ({ attr, value }) {683    return attr.endsWith(value)684  },685}686 687const attributeOperator = ({ attr, value, insensitive, operator }) => {688  if (typeof attr === 'number') {689    attr = String(attr)690  }691  if (typeof attr !== 'string') {692    // It's an object or an array, bail693    return false694  }695  if (insensitive) {696    attr = attr.toLowerCase()697  }698 699  return attributeOperators[operator]({700    attr,701    insensitive,702    value,703  })704}705 706const attributeMatch = (matcher, obj) => {707  const insensitive = !!matcher.insensitive708  const operator = matcher.operator || ''709  const attribute = matcher.qualifiedAttribute710  let value = matcher.value || ''711  // return early if checking existence712  if (operator === '') {713    return Boolean(obj[attribute])714  }715  if (insensitive) {716    value = value.toLowerCase()717  }718  // in case the current object is an array719  // then we try to match every item in the array720  if (Array.isArray(obj[attribute])) {721    return obj[attribute].find((i, index) => {722      const attr = obj[attribute][index] || ''723      return attributeOperator({ attr, value, insensitive, operator })724    })725  } else {726    const attr = obj[attribute] || ''727    return attributeOperator({ attr, value, insensitive, operator })728  }729}730 731const edgeIsType = (node, type, seen = new Set()) => {732  for (const edgeIn of node.edgesIn) {733    // TODO Need a test with an infinite loop734    if (seen.has(edgeIn)) {735      continue736    }737    seen.add(edgeIn)738    if (edgeIn.type === type || edgeIn.from[type] || edgeIsType(edgeIn.from, type, seen)) {739      return true740    }741  }742  return false743}744 745const filterByType = (nodes, type) => {746  const found = []747  for (const node of nodes) {748    if (node[type] || edgeIsType(node, type)) {749      found.push(node)750    }751  }752  return found753}754 755const depTypes = {756  // dependency757  '.prod' (prevResults) {758    const found = []759    for (const node of prevResults) {760      if (!node.dev) {761        found.push(node)762      }763    }764    return found765  },766  // devDependency767  '.dev' (prevResults) {768    return filterByType(prevResults, 'dev')769  },770  // optionalDependency771  '.optional' (prevResults) {772    return filterByType(prevResults, 'optional')773  },774  // peerDependency775  '.peer' (prevResults) {776    return filterByType(prevResults, 'peer')777  },778  // workspace779  '.workspace' (prevResults) {780    return prevResults.filter(node => node.isWorkspace)781  },782  // bundledDependency783  '.bundled' (prevResults) {784    return prevResults.filter(node => node.inBundle)785  },786}787 788// checks if a given node has a direct parent in any of the nodes provided in789// the compare nodes array790const hasParent = (node, compareNodes) => {791  // All it takes is one so we loop and return on the first hit792  for (let compareNode of compareNodes) {793    if (compareNode.isLink) {794      compareNode = compareNode.target795    }796 797    // Follows logical parent for link ancestors (e.g. workspaces whose target lives outside node_modules).798    // Only match if the node has a link whose parent is the compareNode. Without this check, nodes deep in the store (linked strategy) would incorrectly match as children of root via their fsParent chain.799    if (node.isTop && (node.resolveParent === compareNode)) {800      for (const link of node.linksIn) {801        // A store-backing node (linked strategy) is reached through its logical Link, which matches via edgesIn below, so the store node itself is never a direct child.802        if (link.parent === compareNode && !node.isInStore) {803          return true804        }805      }806    }807    // follows edges-in to check if they match a possible parent808    for (const edge of node.edgesIn) {809      if (edge && edge.from === compareNode) {810        return true811      }812    }813  }814  return false815}816 817// checks if a given node is a descendant of any of the nodes provided in the818// compareNodes array819const hasAscendant = (node, compareNodes, seen = new Set()) => {820  // TODO (future) loop over ancestry property821  if (hasParent(node, compareNodes)) {822    return true823  }824 825  if (node.isTop && node.resolveParent) {826    /* istanbul ignore if - investigate if linksIn check obviates need for this */827    if (hasAscendant(node.resolveParent, compareNodes)) {828      return true829    }830  }831  for (const edge of node.edgesIn) {832    // TODO Need a test with an infinite loop833    if (seen.has(edge)) {834      continue835    }836    seen.add(edge)837    if (edge && edge.from && hasAscendant(edge.from, compareNodes, seen)) {838      return true839    }840  }841  for (const linkNode of node.linksIn) {842    if (hasAscendant(linkNode, compareNodes, seen)) {843      return true844    }845  }846  return false847}848 849const combinators = {850  // direct descendant851  '>' (prevResults, nextResults) {852    return nextResults.filter(node => hasParent(node, prevResults))853  },854  // any descendant855  ' ' (prevResults, nextResults) {856    return nextResults.filter(node => hasAscendant(node, prevResults))857  },858  // sibling859  '~' (prevResults, nextResults) {860    // Return any node in nextResults that is a sibling of (aka shares a861    // parent with) a node in prevResults862    const parentNodes = new Set() // Parents of everything in prevResults863    for (const node of prevResults) {864      for (const edge of node.edgesIn) {865        // edge.from always exists cause it's from another node's edgesIn866        parentNodes.add(edge.from)867      }868    }869    return nextResults.filter(node =>870      !prevResults.includes(node) && hasParent(node, [...parentNodes])871    )872  },873}874 875// get a list of available versions of a package filtered to respect --before876// NOTE: this runs over each node and should not throw877const getPackageVersions = async (name, opts) => {878  let packument879  try {880    packument = await pacote.packument(name, {881      ...opts,882      fullMetadata: false, // we only need the corgi883    })884  } catch (err) {885    // if the fetch fails, log a warning and pretend there are no versions886    log.warn('query', `could not retrieve packument for ${name}: ${err.message}`)887    return []888  }889 890  // start with a sorted list of all versions (lowest first)891  let candidates = Object.keys(packument.versions).sort(semver.compare)892 893  // if the packument has a time property, and the user passed a before flag, then894  // we filter this list down to only those versions that existed before the specified date.895  // packages matching `min-release-age-exclude` are exempt from this filter.896  if (packument.time && opts.before && !isReleaseAgeExcluded(name, opts.minReleaseAgeExclude)) {897    candidates = candidates.filter((version) => {898      // this version isn't found in the times at all, drop it899      if (!packument.time[version]) {900        return false901      }902 903      return Date.parse(packument.time[version]) <= opts.before904    })905  }906 907  return candidates908}909 910const retrieveNodesFromParsedAst = async (opts) => {911  // when we first call this it's the parsed query.  all other times it's912  // results.currentNode.nestedNode913  const rootAstNode = opts.rootAstNode914 915  if (!rootAstNode.nodes) {916    return new Set()917  }918 919  const results = new Results(opts)920 921  const astNodeQueue = new Set()922  // walk is sync, so we have to build up our async functions and then await them later923  rootAstNode.walk((nextAstNode) => {924    astNodeQueue.add(nextAstNode)925  })926 927  for (const nextAstNode of astNodeQueue) {928    // This is the only place we reset currentAstNode929    results.currentAstNode = nextAstNode930    const updateFn = `${results.currentAstNode.type}Type`931    if (typeof results[updateFn] !== 'function') {932      throw Object.assign(933        new Error(`\`${results.currentAstNode.type}\` is not a supported selector.`),934        { code: 'EQUERYNOSELECTOR' }935      )936    }937    await results[updateFn]()938  }939 940  return results.collect(rootAstNode)941}942 943const querySelectorAll = async (targetNode, query, flatOptions) => {944  // This never changes ever we just pass it around. But we can't scope it to945  // this whole file if we ever want to support concurrent calls to this946  // function.947  const inventory = [...targetNode.root.inventory.values()]948  // res is a Set of items returned for each parsed css ast selector949  const res = await retrieveNodesFromParsedAst({950    initialItems: inventory,951    inventory,952    flatOptions,953    rootAstNode: parser(query),954    targetNode,955  })956 957  // returns nodes ordered by realpath958  return [...res].sort((a, b) => localeCompare(a.location, b.location))959}960 961module.exports = querySelectorAll962