
Product
Socket Firewall Now Blocks Malicious VS Code and Open VSX Extensions
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.
@edge.app/drupe
Advanced tools
> Tiny helper that lets you run [Mango selectors](https://docs.couchdb.org/en/stable/api/database/find.html#selector-syntax) anywhere you need a JavaScript predicate.
Tiny helper that lets you run Mango selectors anywhere you need a JavaScript predicate.
drupe is inspired by the ergonomics of sift but speaks Mango—the JSON-based query language used by CouchDB and PouchDB. Pass a Mango selector in and get back a function that tests plain JavaScript objects, arrays, or any iterable source.
Array.prototype.filter, find, or any higher-order utility—no extra plumbing required.matchesSelector implementation.Install from JSR:
# From NPM
yarn add @edge.app/drupe
# From JSR
npx jsr add @edgeapp/drupe
import { drupe } from 'drupe'
const isPublishedTechArticle = drupe({
type: 'article',
publishedAt: { $exists: true },
tags: { $in: ['databases', 'javascript'] }
})
const articles = [
{ type: 'article', slug: 'mango-101', tags: ['databases'], publishedAt: '2024-05-02' },
{ type: 'article', slug: 'draft-post', tags: ['javascript'] },
{ type: 'note', slug: 'retro' }
]
const published = articles.filter(isPublishedTechArticle)
// -> [{ type: 'article', slug: 'mango-101', tags: ['databases'], publishedAt: '2024-05-02' }]
The same selector you use in a db.find() call now works as an in-memory predicate.
All Mango selector operators are supported because drupe simply forwards to PouchDB’s selector engine. For a full reference, see the PouchDB guide on Mango queries and the CouchDB documentation linked above.
import { drupe } from 'drupe'
const isHighValueCustomer = drupe({
$and: [
{ spend: { $gte: 1000 } },
{ status: { $in: ['gold', 'platinum'] } }
]
})
const customers = [
{ name: 'Ada', spend: 3200, status: 'platinum' },
{ name: 'Lin', spend: 840, status: 'gold' },
{ name: 'Edsger', spend: 1500, status: 'silver' }
]
customers.filter(isHighValueCustomer)
// -> [{ name: 'Ada', spend: 3200, status: 'platinum' }]
You can also use $not, $regex, $size, $elemMatch, and any other Mango operator:
const containsLargeAttachment = drupe({
attachments: {
$elemMatch: {
content_type: { $regex: '^image/' },
length: { $gt: 1_000_000 }
}
}
})
docs.filter(containsLargeAttachment)
const predicate = drupe(selector)
predicate(document) // -> boolean
selector – Any valid Mango selector object.TypeScript: The exported signature is intentionally loose—(selector: any) => (subject: unknown) => boolean—so you can refine the shape that makes sense for your app.
drupe is intentionally tiny:
import { matchesSelector } from 'pouchdb-selector-core'
export const drupe = (selector: any) => (subject: unknown) => {
return matchesSelector(subject, selector)
}
When you call drupe(selector), it defers entirely to matchesSelector, the same function PouchDB uses internally to evaluate Mango selectors. That means:
pouchdb-selector-core.sift lets you filter arrays with MongoDB selectors—check it out at https://github.com/crcn/sift.jsMIT © Sam Holmes
FAQs
> Tiny helper that lets you run [Mango selectors](https://docs.couchdb.org/en/stable/api/database/find.html#selector-syntax) anywhere you need a JavaScript predicate.
The npm package @edge.app/drupe receives a total of 273 weekly downloads. As such, @edge.app/drupe popularity was classified as not popular.
We found that @edge.app/drupe demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.

Research
More than 140 Mastra npm packages were compromised in a supply chain attack that used a typosquatted dependency to deliver a cross-platform infostealer during installation.

Research
/Security News
A new npm package tests AI malware scanners with prompt injection, safety-triggering comments, context flooding, and obfuscated JavaScript.