@verdaccio/config 6.0.0-6-next.13 → 6.0.0-6-next.16

package/CHANGELOG.md

@@ -1,5 +1,95 @@
 # @verdaccio/config
 
+## 6.0.0-6-next.16
+
+### Patch Changes
+
+- Updated dependencies [351aeeaa]
+  - @verdaccio/core@6.0.0-6-next.7
+  - @verdaccio/utils@6.0.0-6-next.13
+
+## 6.0.0-6-next.15
+
+### Major Changes
+
+- 292c0a37: feat!: replace deprecated request dependency by got
+
+  This is a big refactoring of the core, fetching dependencies, improve code, more tests and better stability. This is essential for the next release, will take some time but would allow modularize more the core.
+
+  ## Notes
+
+  - Remove deprecated `request` by other `got`, retry improved, custom Agent ( got does not include it built-in)
+  - Remove `async` dependency from storage (used by core) it was linked with proxy somehow safe to remove now
+  - Refactor with promises instead callback wherever is possible
+  - ~Document the API~
+  - Improve testing, integration tests
+  - Bugfix
+  - Clean up old validations
+  - Improve performance
+
+  ## 💥 Breaking changes
+
+  - Plugin API methods were callbacks based are returning promises, this will break current storage plugins, check documentation for upgrade.
+  - Write Tarball, Read Tarball methods parameters change, a new set of options like `AbortController` signals are being provided to the `addAbortSignal` can be internally used with Streams when a request is aborted. eg: `addAbortSignal(signal, fs.createReadStream(pathName));`
+  - `@verdaccio/streams` stream abort support is legacy is being deprecated removed
+  - Remove AWS and Google Cloud packages for future refactoring [#2574](https://github.com/verdaccio/verdaccio/pull/2574).
+
+### Patch Changes
+
+- Updated dependencies [292c0a37]
+- Updated dependencies [a3a209b5]
+- Updated dependencies [00d1d2a1]
+  - @verdaccio/core@6.0.0-6-next.6
+  - @verdaccio/utils@6.0.0-6-next.12
+
+## 6.0.0-6-next.14
+
+### Minor Changes
+
+- d43894e8: feat: rework web header for mobile, add new settings and raw manifest button
+
+  ### New set of variables to hide features
+
+  Add set of new variables that allow hide different parts of the UI, buttons, footer or download tarballs. _All are
+  enabled by default_.
+
+  ```yaml
+  # login: true <-- already exist but worth the reminder
+  # showInfo: true
+  # showSettings: true
+  # In combination with darkMode you can force specific theme
+  # showThemeSwitch: true
+  # showFooter: true
+  # showSearch: true
+  # showDownloadTarball: true
+  ```
+
+  > If you disable `showThemeSwitch` and force `darkMode: true` the local storage settings would be
+  > ignored and force all themes to the one in the configuration file.
+
+  Future could be extended to
+
+  ### Raw button to display manifest package
+
+  A new experimental feature (enabled by default), button named RAW to be able navigate on the package manifest directly on the ui, kudos to [react-json-view](https://www.npmjs.com/package/react-json-view) that allows an easy integration, not configurable yet until get more feedback.
+
+  ```yaml
+  showRaw: true
+  ```
+
+  #### Rework header buttons
+
+  - The header has been rework, the mobile was not looking broken.
+  - Removed info button in the header and moved to a dialog
+  - Info dialog now contains more information about the project, license and the aid content for Ukrania now is inside of the info modal.
+  - Separate settings and info to avoid collapse too much info (for mobile still need some work)
+
+- d08fe29d: feat(web): add a config item to web，let the developer can select whet……her enable the html cache
+
+### Patch Changes
+
+- @verdaccio/core@6.0.0-6-next.5
+
 ## 6.0.0-6-next.13
 
 ### Major Changes

package/build/agent.js

@@ -5,19 +5,9 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.getUserAgent = getUserAgent;
 
-var _assert = _interopRequireDefault(require("assert"));
-
-var _lodash = _interopRequireDefault(require("lodash"));
-
-function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
-
 const pkgVersion = require('../package.json').version;
 
-const pkgName = require('../package.json').name;
-
 function getUserAgent() {
-  (0, _assert.default)(_lodash.default.isString(pkgName));
-  (0, _assert.default)(_lodash.default.isString(pkgVersion));
-  return `${pkgName}/${pkgVersion}`;
+  return `verdaccio/${pkgVersion}`;
 }
 //# sourceMappingURL=agent.js.map

package/build/agent.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/agent.ts"],"names":["pkgVersion","require","version","pkgName","name","getUserAgent","_","isString"],"mappings":";;;;;;;AAAA;;AACA;;;;AAEA,MAAMA,UAAU,GAAGC,OAAO,CAAC,iBAAD,CAAP,CAA2BC,OAA9C;;AACA,MAAMC,OAAO,GAAGF,OAAO,CAAC,iBAAD,CAAP,CAA2BG,IAA3C;;AAEO,SAASC,YAAT,GAAgC;AACrC,uBAAOC,gBAAEC,QAAF,CAAWJ,OAAX,CAAP;AACA,uBAAOG,gBAAEC,QAAF,CAAWP,UAAX,CAAP;AACA,SAAQ,GAAEG,OAAQ,IAAGH,UAAW,EAAhC;AACD","sourcesContent":["import assert from 'assert';\nimport _ from 'lodash';\n\nconst pkgVersion = require('../package.json').version;\nconst pkgName = require('../package.json').name;\n\nexport function getUserAgent(): string {\n  assert(_.isString(pkgName));\n  assert(_.isString(pkgVersion));\n  return `${pkgName}/${pkgVersion}`;\n}\n"],"file":"agent.js"}
+{"version":3,"file":"agent.js","names":["pkgVersion","require","version","getUserAgent"],"sources":["../src/agent.ts"],"sourcesContent":["const pkgVersion = require('../package.json').version;\n\nexport function getUserAgent(): string {\n  return `verdaccio/${pkgVersion}`;\n}\n"],"mappings":";;;;;;;AAAA,MAAMA,UAAU,GAAGC,OAAO,CAAC,iBAAD,CAAP,CAA2BC,OAA9C;;AAEO,SAASC,YAAT,GAAgC;EACrC,OAAQ,aAAYH,UAAW,EAA/B;AACD"}

package/build/builder.d.ts

@@ -0,0 +1,18 @@
+import { AuthConf, ConfigYaml, LoggerConfItem, PackageAccessYaml, Security, UpLinkConf } from '@verdaccio/types';
+/**
+ * Helper configuration builder constructor, used to build the configuration for testing or
+ * programatically creating a configuration.
+ */
+export default class ConfigBuilder {
+    private config;
+    constructor(config?: Partial<ConfigYaml>);
+    static build(config?: Partial<ConfigYaml>): ConfigBuilder;
+    addPackageAccess(pattern: string, pkgAccess: PackageAccessYaml): this;
+    addUplink(id: string, uplink: UpLinkConf): this;
+    addSecurity(security: Partial<Security>): this;
+    addAuth(auth: Partial<AuthConf>): this;
+    addLogger(log: LoggerConfItem): this;
+    addStorage(storage: string | object): this;
+    getConfig(): ConfigYaml;
+    getAsYaml(): string;
+}

package/build/builder.js

@@ -0,0 +1,77 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = void 0;
+
+var _lodash = require("lodash");
+
+var _ = require(".");
+
+/**
+ * Helper configuration builder constructor, used to build the configuration for testing or
+ * programatically creating a configuration.
+ */
+class ConfigBuilder {
+  constructor(config) {
+    // @ts-ignore
+    this.config = config ?? {
+      uplinks: {},
+      packages: {},
+      security: {}
+    };
+  }
+
+  static build(config) {
+    return new ConfigBuilder(config);
+  }
+
+  addPackageAccess(pattern, pkgAccess) {
+    // @ts-ignore
+    this.config.packages[pattern] = pkgAccess;
+    return this;
+  }
+
+  addUplink(id, uplink) {
+    this.config.uplinks[id] = uplink;
+    return this;
+  }
+
+  addSecurity(security) {
+    this.config.security = (0, _lodash.merge)(this.config.security, security);
+    return this;
+  }
+
+  addAuth(auth) {
+    this.config.auth = (0, _lodash.merge)(this.config.auth, auth);
+    return this;
+  }
+
+  addLogger(log) {
+    this.config.log = log;
+    return this;
+  }
+
+  addStorage(storage) {
+    if (typeof storage === 'string') {
+      this.config.storage = storage;
+    } else {
+      this.config.store = storage;
+    }
+
+    return this;
+  }
+
+  getConfig() {
+    return this.config;
+  }
+
+  getAsYaml() {
+    return (0, _.fromJStoYAML)(this.config);
+  }
+
+}
+
+exports.default = ConfigBuilder;
+//# sourceMappingURL=builder.js.map

package/build/builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder.js","names":["ConfigBuilder","constructor","config","uplinks","packages","security","build","addPackageAccess","pattern","pkgAccess","addUplink","id","uplink","addSecurity","merge","addAuth","auth","addLogger","log","addStorage","storage","store","getConfig","getAsYaml","fromJStoYAML"],"sources":["../src/builder.ts"],"sourcesContent":["import { merge } from 'lodash';\n\nimport {\n  AuthConf,\n  ConfigYaml,\n  LoggerConfItem,\n  PackageAccessYaml,\n  Security,\n  UpLinkConf,\n} from '@verdaccio/types';\n\nimport { fromJStoYAML } from '.';\n\n/**\n * Helper configuration builder constructor, used to build the configuration for testing or\n * programatically creating a configuration.\n */\nexport default class ConfigBuilder {\n  private config: ConfigYaml;\n\n  public constructor(config?: Partial<ConfigYaml>) {\n    // @ts-ignore\n    this.config = config ?? { uplinks: {}, packages: {}, security: {} };\n  }\n\n  public static build(config?: Partial<ConfigYaml>): ConfigBuilder {\n    return new ConfigBuilder(config);\n  }\n\n  public addPackageAccess(pattern: string, pkgAccess: PackageAccessYaml) {\n    // @ts-ignore\n    this.config.packages[pattern] = pkgAccess;\n    return this;\n  }\n\n  public addUplink(id: string, uplink: UpLinkConf) {\n    this.config.uplinks[id] = uplink;\n    return this;\n  }\n\n  public addSecurity(security: Partial<Security>) {\n    this.config.security = merge(this.config.security, security);\n    return this;\n  }\n\n  public addAuth(auth: Partial<AuthConf>) {\n    this.config.auth = merge(this.config.auth, auth);\n    return this;\n  }\n\n  public addLogger(log: LoggerConfItem) {\n    this.config.log = log;\n    return this;\n  }\n\n  public addStorage(storage: string | object) {\n    if (typeof storage === 'string') {\n      this.config.storage = storage;\n    } else {\n      this.config.store = storage;\n    }\n    return this;\n  }\n\n  public getConfig(): ConfigYaml {\n    return this.config;\n  }\n\n  public getAsYaml(): string {\n    return fromJStoYAML(this.config) as string;\n  }\n}\n"],"mappings":";;;;;;;AAAA;;AAWA;;AAEA;AACA;AACA;AACA;AACe,MAAMA,aAAN,CAAoB;EAG1BC,WAAW,CAACC,MAAD,EAA+B;IAC/C;IACA,KAAKA,MAAL,GAAcA,MAAM,IAAI;MAAEC,OAAO,EAAE,EAAX;MAAeC,QAAQ,EAAE,EAAzB;MAA6BC,QAAQ,EAAE;IAAvC,CAAxB;EACD;;EAEkB,OAALC,KAAK,CAACJ,MAAD,EAA8C;IAC/D,OAAO,IAAIF,aAAJ,CAAkBE,MAAlB,CAAP;EACD;;EAEMK,gBAAgB,CAACC,OAAD,EAAkBC,SAAlB,EAAgD;IACrE;IACA,KAAKP,MAAL,CAAYE,QAAZ,CAAqBI,OAArB,IAAgCC,SAAhC;IACA,OAAO,IAAP;EACD;;EAEMC,SAAS,CAACC,EAAD,EAAaC,MAAb,EAAiC;IAC/C,KAAKV,MAAL,CAAYC,OAAZ,CAAoBQ,EAApB,IAA0BC,MAA1B;IACA,OAAO,IAAP;EACD;;EAEMC,WAAW,CAACR,QAAD,EAA8B;IAC9C,KAAKH,MAAL,CAAYG,QAAZ,GAAuB,IAAAS,aAAA,EAAM,KAAKZ,MAAL,CAAYG,QAAlB,EAA4BA,QAA5B,CAAvB;IACA,OAAO,IAAP;EACD;;EAEMU,OAAO,CAACC,IAAD,EAA0B;IACtC,KAAKd,MAAL,CAAYc,IAAZ,GAAmB,IAAAF,aAAA,EAAM,KAAKZ,MAAL,CAAYc,IAAlB,EAAwBA,IAAxB,CAAnB;IACA,OAAO,IAAP;EACD;;EAEMC,SAAS,CAACC,GAAD,EAAsB;IACpC,KAAKhB,MAAL,CAAYgB,GAAZ,GAAkBA,GAAlB;IACA,OAAO,IAAP;EACD;;EAEMC,UAAU,CAACC,OAAD,EAA2B;IAC1C,IAAI,OAAOA,OAAP,KAAmB,QAAvB,EAAiC;MAC/B,KAAKlB,MAAL,CAAYkB,OAAZ,GAAsBA,OAAtB;IACD,CAFD,MAEO;MACL,KAAKlB,MAAL,CAAYmB,KAAZ,GAAoBD,OAApB;IACD;;IACD,OAAO,IAAP;EACD;;EAEME,SAAS,GAAe;IAC7B,OAAO,KAAKpB,MAAZ;EACD;;EAEMqB,SAAS,GAAW;IACzB,OAAO,IAAAC,cAAA,EAAa,KAAKtB,MAAlB,CAAP;EACD;;AArDgC"}

package/build/conf/default.yaml

@@ -1,16 +1,20 @@
 #
-# This is the default config file. It allows all users to do anything,
-# so don't use it on production systems.
+# This is the default configuration file. It allows all users to do anything,
+# please read carefully the documentation and best practices to
+# improve security.
 #
 # Look here for more config file examples:
-# https://github.com/verdaccio/verdaccio/tree/master/packages/config/src/conf
+# https://github.com/verdaccio/verdaccio/tree/5.x/packages/config/src/conf/default.yaml
 #
+# Read about the best practices
+# https://verdaccio.org/docs/best
 
 # path to a directory with all packages
 storage: ./storage
 # path to a directory with plugins to include
 plugins: ./plugins
 
+# https://verdaccio.org/docs/webui
 web:
   title: Verdaccio
   # comment out to disable gravatar support
@@ -19,6 +23,17 @@ web:
   # sort_packages: asc
   # convert your UI to the dark side
   # darkMode: true
+  # html_cache: true
+  # by default all features are displayed
+  # login: true
+  # showInfo: true
+  # showSettings: true
+  # In combination with darkMode you can force specific theme
+  # showThemeSwitch: true
+  # showFooter: true
+  # showSearch: true
+  # showRaw: true
+  # showDownloadTarball: true
   #  HTML tags injected after manifest <scripts/>
   # scriptsBodyAfter:
   #    - '<script type="text/javascript" src="https://my.company.com/customJS.min.js"></script>'
@@ -32,11 +47,8 @@ web:
   #    - '<div id="myId">html before webpack scripts</div>'
   #  Public path for template manifest scripts (only manifest)
   #  publicPath: http://somedomain.org/
-# translate your registry, api i18n not available yet
-# i18n:
-# list of the available translations https://github.com/verdaccio/ui/tree/master/i18n/translations
-#   web: en-US
 
+# https://verdaccio.org/docs/configuration#authentication
 auth:
   htpasswd:
     file: ./htpasswd
@@ -44,11 +56,15 @@ auth:
     # You can set this to -1 to disable registration.
     # max_users: 1000
 
+# https://verdaccio.org/docs/configuration#uplinks
 # a list of other known repositories we can talk to
 uplinks:
   npmjs:
     url: https://registry.npmjs.org/
 
+# Learn how to protect your packages
+# https://verdaccio.org/docs/protect-your-dependencies/
+# https://verdaccio.org/docs/configuration#packages
 packages:
   '@*/*':
     # scoped packages
@@ -65,7 +81,7 @@ packages:
     # and three keywords: "$all", "$anonymous", "$authenticated"
     access: $all
 
-    # allow all known users to publish/unpublish packages
+    # allow all known users to publish/publish packages
     # (anyone can register by default, remember?)
     publish: $authenticated
     unpublish: $authenticated
@@ -73,32 +89,104 @@ packages:
     # if package is not available locally, proxy requests to 'npmjs' registry
     proxy: npmjs
 
+# To improve your security configuration and  avoid dependency confusion
+# consider removing the proxy property for private packages
+# https://verdaccio.org/docs/best#remove-proxy-to-increase-security-at-private-packages
+
+# https://verdaccio.org/docs/configuration#server
+# You can specify HTTP/1.1 server keep alive timeout in seconds for incoming connections.
+# A value of 0 makes the http server behave similarly to Node.js versions prior to 8.0.0, which did not have a keep-alive timeout.
+# WORKAROUND: Through given configuration you can workaround following issue https://github.com/verdaccio/verdaccio/issues/301. Set to 0 in case 60 is not enough.
 server:
-  # deprecated
   keepAliveTimeout: 60
-#  rateLimit:
-#    windowMs: 1000
-#    max: 10000
+
+# https://verdaccio.org/docs/configuration#offline-publish
+# publish:
+#   allow_offline: false
+
+# https://verdaccio.org/docs/configuration#url-prefix
+# url_prefix: /verdaccio/
+# VERDACCIO_PUBLIC_URL='https://somedomain.org';
+# url_prefix: '/my_prefix'
+# // url -> https://somedomain.org/my_prefix/
+# VERDACCIO_PUBLIC_URL='https://somedomain.org';
+# url_prefix: '/'
+# // url -> https://somedomain.org/
+# VERDACCIO_PUBLIC_URL='https://somedomain.org/first_prefix';
+# url_prefix: '/second_prefix'
+# // url -> https://somedomain.org/second_prefix/'
+
+# https://verdaccio.org/docs/configuration#security
+# security:
+#   api:
+#     legacy: true
+#     jwt:
+#       sign:
+#         expiresIn: 29d
+#       verify:
+#         someProp: [value]
+#    web:
+#      sign:
+#        expiresIn: 1h # 1 hour by default
+#      verify:
+#         someProp: [value]
+
+# https://verdaccio.org/docs/configuration#user-rate-limit
+# userRateLimit:
+#   windowMs: 50000
+#   max: 1000
+
+# https://verdaccio.org/docs/configuration#max-body-size
+# max_body_size: 10mb
+
+# https://verdaccio.org/docs/configuration#listen-port
+# listen:
+# - localhost:4873            # default value
+# - http://localhost:4873     # same thing
+# - 0.0.0.0:4873              # listen on all addresses (INADDR_ANY)
+# - https://example.org:4873  # if you want to use https
+# - "[::1]:4873"                # ipv6
+# - unix:/tmp/verdaccio.sock    # unix socket
+
+# The HTTPS configuration is useful if you do not consider use a HTTP Proxy
+# https://verdaccio.org/docs/configuration#https
+# https:
+#   key: ./path/verdaccio-key.pem
+#   cert: ./path/verdaccio-cert.pem
+#   ca: ./path/verdaccio-csr.pem
+
+# https://verdaccio.org/docs/configuration#proxy
+# http_proxy: http://something.local/
+# https_proxy: https://something.local/
+
+# https://verdaccio.org/docs/configuration#notifications
+# notify:
+#   method: POST
+#   headers: [{ "Content-Type": "application/json" }]
+#   endpoint: https://usagge.hipchat.com/v2/room/3729485/notification?auth_token=mySecretToken
+#   content: '{"color":"green","message":"New package published: * {{ name }}*","notify":true,"message_format":"text"}'
 
 middlewares:
   audit:
     enabled: true
 
+# https://verdaccio.org/docs/logger
 # log settings
-log:
-  # Logger as STDOUT
-  { type: stdout, format: pretty, level: http }
-  # Logger as STDOUT as JSON
-  # { type: stdout, format: json, level: http }
-  # Logger as STDOUT as JSON
-  # { type: stdout, format: pretty-timestamped, level: http }
-  # Logger as STDOUT as custom prettifier
-  # { type: stdout, plugin: { dest: '@verdaccio/logger-prettify' : options: { foo: 1, bar: 2}}, level: http }
-  # Logger as file
-  # { type: file, path: verdaccio.log, level: http}
-  # FIXME: this should be documented
-  # More info about log rotation https://github.com/pinojs/pino/blob/master/docs/help.md#log-rotation
-
-# This affect the web and api (not developed yet)
+log: { type: stdout, format: pretty, level: http }
+#experiments:
+#  # support for npm token command
+#  token: false
+#  # disable writing body size to logs, read more on ticket 1912
+#  bytesin_off: false
+#  # enable tarball URL redirect for hosting tarball with a different server, the tarball_url_redirect can be a template string
+#  tarball_url_redirect: 'https://mycdn.com/verdaccio/${packageName}/${filename}'
+#  # the tarball_url_redirect can be a function, takes packageName and filename and returns the url, when working with a js configuration file
+#  tarball_url_redirect(packageName, filename) {
+#    const signedUrl = // generate a signed url
+#    return signedUrl;
+#  }
+
+# translate your registry, api i18n not available yet
 i18n:
+  # list of the available translations https://github.com/verdaccio/verdaccio/blob/master/packages/plugins/ui-theme/src/i18n/ABOUT_TRANSLATIONS.md
   web: en-US

package/build/conf/docker.yaml

@@ -1,34 +1,57 @@
 #
-# This is the config file used for the docker images.
-# It allows all users to do anything, so don't use it on production systems.
+# This is the default configuration file. As it allows all users to do anything,
+# please read carefully the documentation and best practices to improve security.
 #
 # Do not configure host and port under `listen` in this file
 # as it will be ignored when using docker.
 # see https://verdaccio.org/docs/en/docker#docker-and-custom-port-configuration
 #
 # Look here for more config file examples:
-# https://github.com/verdaccio/verdaccio/tree/master/packages/config/src/conf
+# https://github.com/verdaccio/verdaccio/tree/5.x/packages/config/src/conf/docker.yaml
 #
+# Read about the best practices
+# https://verdaccio.org/docs/best
 
 # path to a directory with all packages
 storage: /verdaccio/storage/data
 # path to a directory with plugins to include
 plugins: /verdaccio/plugins
 
+# https://verdaccio.org/docs/webui
 web:
-  # WebUI is enabled as default, if you want disable it, just uncomment this line
-  #enable: false
   title: Verdaccio
-  # comment out to disable gravatar support
+  # Comment out to disable gravatar support
   # gravatar: false
-  # by default packages are ordercer ascendant (asc|desc)
+  # By default packages are ordered ascendant (asc|desc)
   # sort_packages: asc
+  # Convert your UI to the dark side
   # darkMode: true
+  # html_cache: true
+  # By default all features are displayed
+  # login: true
+  # showInfo: true
+  # showSettings: true
+  # In combination with darkMode you can force a specific theme
+  # showThemeSwitch: true
+  # showFooter: true
+  # showSearch: true
+  # showRaw: true
+  # showDownloadTarball: true
+  #  HTML tags injected after manifest <scripts/>
+  # scriptsBodyAfter:
+  #    - '<script type="text/javascript" src="https://my.company.com/customJS.min.js"></script>'
+  #  HTML tags injected before end </head>
+  #  metaScripts:
+  #    - '<script type="text/javascript" src="https://code.jquery.com/jquery-3.5.1.slim.min.js"></script>'
+  #    - '<script type="text/javascript" src="https://browser.sentry-cdn.com/5.15.5/bundle.min.js"></script>'
+  #    - '<meta name="robots" content="noindex" />'
+  #  HTML tags injected as first child at <body/>
+  #  bodyBefore:
+  #    - '<div id="myId">html before webpack scripts</div>'
+  #  Public path for template manifest scripts (only manifest)
+  #  publicPath: http://somedomain.org/
 
-# translate your registry, api i18n not available yet
-# i18n:
-# list of the available translations https://github.com/verdaccio/ui/tree/master/i18n/translations
-#   web: en-US
+# https://verdaccio.org/docs/configuration#authentication
 
 auth:
   htpasswd:
@@ -37,11 +60,15 @@ auth:
     # You can set this to -1 to disable registration.
     # max_users: 1000
 
-# a list of other known repositories we can talk to
+# https://verdaccio.org/docs/configuration#uplinks
+# A list of other known repositories we can talk to
 uplinks:
   npmjs:
     url: https://registry.npmjs.org/
 
+# Learn how to protect your packages
+# https://verdaccio.org/docs/protect-your-dependencies/
+# https://verdaccio.org/docs/configuration#packages
 packages:
   '@*/*':
     # scoped packages
@@ -51,14 +78,14 @@ packages:
     proxy: npmjs
 
   '**':
-    # allow all users (including non-authenticated users) to read and
+    # Allow all users (including non-authenticated users) to read and
     # publish all packages
     #
-    # you can specify usernames/groupnames (depending on your auth plugin)
+    # You can specify usernames/groupnames (depending on your auth plugin)
     # and three keywords: "$all", "$anonymous", "$authenticated"
     access: $all
 
-    # allow all known users to publish/unpublish packages
+    # Allow all known users to publish/publish packages
     # (anyone can register by default, remember?)
     publish: $authenticated
     unpublish: $authenticated
@@ -66,31 +93,106 @@ packages:
     # if package is not available locally, proxy requests to 'npmjs' registry
     proxy: npmjs
 
+# To improve your security configuration and avoid dependency confusion
+# consider removing the proxy property for private packages
+# https://verdaccio.org/docs/best#remove-proxy-to-increase-security-at-private-packages
+
+# https://verdaccio.org/docs/configuration#server
+# You can specify the HTTP/1.1 server keep alive timeout in seconds for incoming connections.
+# A value of 0 makes the http server behave similarly to Node.js versions prior to 8.0.0, which did not have a
+# keep-alive timeout.
+# WORKAROUND: Through given configuration you can work around the following issue:
+# https://github.com/verdaccio/verdaccio/issues/301. Set to 0 in case 60 is not enough.
+server:
+  keepAliveTimeout: 60
+
+# https://verdaccio.org/docs/configuration#offline-publish
+# publish:
+#   allow_offline: false
+
+# https://verdaccio.org/docs/configuration#url-prefix
+# url_prefix: /verdaccio/
+# VERDACCIO_PUBLIC_URL='https://somedomain.org';
+# url_prefix: '/my_prefix'
+# // url -> https://somedomain.org/my_prefix/
+# VERDACCIO_PUBLIC_URL='https://somedomain.org';
+# url_prefix: '/'
+# // url -> https://somedomain.org/
+# VERDACCIO_PUBLIC_URL='https://somedomain.org/first_prefix';
+# url_prefix: '/second_prefix'
+# // url -> https://somedomain.org/second_prefix/'
+
+# https://verdaccio.org/docs/configuration#security
+# security:
+#   api:
+#     legacy: true
+#     jwt:
+#       sign:
+#         expiresIn: 29d
+#       verify:
+#         someProp: [value]
+#    web:
+#      sign:
+#        expiresIn: 1h # 1 hour by default
+#      verify:
+#         someProp: [value]
+
+# https://verdaccio.org/docs/configuration#user-rate-limit
+# userRateLimit:
+#   windowMs: 50000
+#   max: 1000
+
+# https://verdaccio.org/docs/configuration#max-body-size
+# max_body_size: 10mb
+
+# https://verdaccio.org/docs/configuration#listen-port
+# listen:
+# - localhost:4873            # default value
+# - http://localhost:4873     # same thing
+# - 0.0.0.0:4873              # listen on all addresses (INADDR_ANY)
+# - https://example.org:4873  # if you want to use https
+# - "[::1]:4873"                # ipv6
+# - unix:/tmp/verdaccio.sock    # unix socket
+
+# The HTTPS configuration is useful if you do not consider using an HTTP Proxy
+# https://verdaccio.org/docs/configuration#https
+# https:
+#   key: ./path/verdaccio-key.pem
+#   cert: ./path/verdaccio-cert.pem
+#   ca: ./path/verdaccio-csr.pem
+
+# https://verdaccio.org/docs/configuration#proxy
+# http_proxy: http://something.local/
+# https_proxy: https://something.local/
+
+# https://verdaccio.org/docs/configuration#notifications
+# notify:
+#   method: POST
+#   headers: [{ "Content-Type": "application/json" }]
+#   endpoint: https://usagge.hipchat.com/v2/room/3729485/notification?auth_token=mySecretToken
+#   content: '{"color":"green","message":"New package published: * {{ name }}*","notify":true,"message_format":"text"}'
+
 middlewares:
   audit:
     enabled: true
 
+# https://verdaccio.org/docs/logger
 # log settings
-# log settings
-log:
-  # Logger as STDOUT
-  { type: stdout, format: pretty, level: http }
-  # Logger as STDOUT as JSON
-  # { type: stdout, format: json, level: http }
-  # Logger as STDOUT as JSON
-  # { type: stdout, format: pretty-timestamped, level: http }
-  # Logger as STDOUT as custom prettifier
-  # { type: stdout, plugin: { dest: '@verdaccio/logger-prettify' : options: { foo: 1, bar: 2}}, level: http }
-  # Logger as file
-  # { type: file, path: verdaccio.log, level: http}
-  # FIXME: this should be documented
-# More info about log rotation https://github.com/pinojs/pino/blob/master/docs/help.md#log-rotation
-
-flags:
-  # support for npm token command
-  token: false
-  # support for the new v1 search endpoint, functional by incomplete read more on ticket 1732
-  search: false
-# This affect the web and api (not developed yet)
-#i18n:
-#web: en-US
+log: { type: stdout, format: pretty, level: http }
+#experiments:
+#  # Support for npm token command
+#  token: false
+#  # Enable tarball URL redirect for hosting tarball with a different server.
+#  # The tarball_url_redirect can be a template string
+#  tarball_url_redirect: 'https://mycdn.com/verdaccio/${packageName}/${filename}'
+#  # The tarball_url_redirect can be a function, takes packageName and filename and returns the url,
+#  # when working with a js configuration file
+#  tarball_url_redirect(packageName, filename) {
+#    const signedUrl = // generate a signed url
+#    return signedUrl;
+#  }
+
+# Translate your registry, api i18n not available yet
+# i18n:
+# list of the available translations https://github.com/verdaccio/verdaccio/blob/master/packages/plugins/ui-theme/src/i18n/ABOUT_TRANSLATIONS.md
+#   web: en-US

package/build/conf/index.d.ts

@@ -0,0 +1,4 @@
+export declare function getDefaultConfig(fileName?: string): import("@verdaccio/types").ConfigYaml & {
+    config_path: string;
+    configPath: string;
+};