@verdaccio/middleware 8.0.5 → 8.1.0

package/build/middlewares/token-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-auth.js","names":["_core","require","WRITE_METHODS","Set","getClientAddress","req","ipUtils","normalizeAddress","ip","socket","remoteAddress","findToken","tokens","tokenKey","find","key","enforceGeneratedTokenMetadata","storage","logger","_res","next","remoteUser","remote_user","token","user","name","errorUtils","getForbidden","API_ERROR","UNAUTHORIZED_ACCESS","readTokens","warn","isAddressAllowed","cidr","readonly","has","method","error","msg","getInternalError","message"],"sources":["../../src/middlewares/token-auth.ts"],"sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from 'express';\n\nimport { API_ERROR, errorUtils, ipUtils } from '@verdaccio/core';\nimport type { Logger, Token } from '@verdaccio/types';\n\nimport type { $RequestExtend } from '../types';\n\nconst WRITE_METHODS = new Set(['DELETE', 'PATCH', 'POST', 'PUT']);\n\n/**\n * Minimal storage surface required to enforce generated token metadata. Typed\n * structurally so this package does not need to depend on `@verdaccio/store`.\n */\nexport interface TokenReadableStorage {\n  /**\n   * Load the generated tokens stored for a user.\n   *\n   * @param filter narrows the lookup to a single `user`\n   * @returns the user's persisted tokens\n   */\n  readTokens(filter: { user: string }): Promise<Token[]>;\n}\n\n/**\n * Resolve the client address of an incoming request for CIDR matching.\n *\n * Uses Express' `req.ip`, which already honors the application's `trust proxy`\n * setting (`config.server.trustProxy`): when the operator has declared trusted\n * proxies, `req.ip` is the upstream-most untrusted address parsed from\n * `X-Forwarded-For`; otherwise it is the direct socket peer and the forwarded\n * header is ignored entirely.\n *\n * The middleware must NOT read `X-Forwarded-For` on its own — doing so\n * unconditionally would let any client spoof its address (and bypass a token's\n * CIDR whitelist) simply by sending the header. Falls back to the raw socket\n * address and is normalized (trimmed, IPv4-mapped IPv6 prefix stripped) via\n * {@link ipUtils.normalizeAddress}.\n *\n * @param req the incoming Express request\n * @returns the normalized client address, or `undefined` when none can be determined\n */\nfunction getClientAddress(req: Request): string | undefined {\n  return ipUtils.normalizeAddress(req.ip || req.socket.remoteAddress);\n}\n\n/**\n * Find the stored token whose `key` matches the key carried by the request.\n *\n * @param tokens the tokens persisted for the authenticated user\n * @param tokenKey the key extracted from the presented generated token\n * @returns the matching {@link Token}, or `undefined` when it has been revoked / never existed\n */\nfunction findToken(tokens: Token[], tokenKey: string): Token | undefined {\n  return tokens.find(({ key }) => key === tokenKey);\n}\n\n/**\n * Express middleware that enforces the metadata of npm-style generated tokens\n * (created via `POST /-/npm/v1/tokens`).\n *\n * A generated token embeds a server-issued `key` that is recovered from the\n * verified credentials as `remote_user.token.key`. This middleware looks that\n * key up in storage and rejects the request when the token:\n * - is missing from storage (revoked or never issued);\n * - is used from a client address outside its `cidr` whitelist;\n * - is `readonly` and the request uses a write method (`DELETE`/`PATCH`/`POST`/`PUT`).\n *\n * Requests that do not carry a generated token key (e.g. interactive logins)\n * pass through untouched. It must run after the JWT/auth middleware has\n * populated `remote_user`. Failures fail closed: a storage lookup error yields\n * an internal error rather than allowing the request.\n *\n * @param storage storage exposing {@link TokenReadableStorage.readTokens} to load the user's tokens\n * @param logger logger used to record rejected attempts and lookup failures\n * @returns an Express {@link RequestHandler} that calls `next()` to allow or `next(error)` to reject\n */\nexport function enforceGeneratedTokenMetadata(\n  storage: TokenReadableStorage,\n  logger: Logger\n): RequestHandler {\n  return async function (req: Request, _res: Response, next: NextFunction): Promise<void> {\n    const remoteUser = (req as $RequestExtend).remote_user;\n    const tokenKey = remoteUser?.token?.key;\n\n    if (!tokenKey) {\n      return next();\n    }\n\n    const user = remoteUser?.name;\n\n    if (typeof user !== 'string') {\n      return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n    }\n\n    try {\n      const token = findToken(await storage.readTokens({ user }), tokenKey);\n\n      if (!token) {\n        logger.warn({ tokenKey, user }, 'generated token @{tokenKey} for user @{user} is missing');\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      if (!ipUtils.isAddressAllowed(getClientAddress(req), token.cidr)) {\n        logger.warn(\n          { tokenKey, user },\n          'generated token @{tokenKey} for user @{user} was used outside its CIDR whitelist'\n        );\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      if (token.readonly && WRITE_METHODS.has(req.method)) {\n        logger.warn(\n          { tokenKey, user },\n          'readonly generated token @{tokenKey} for user @{user} was used for a write request'\n        );\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      return next();\n    } catch (error: any) {\n      logger.error({ error: error.msg }, 'generated token metadata lookup failed: @{error}');\n      return next(errorUtils.getInternalError(error.message));\n    }\n  };\n}\n"],"mappings":";;;;;;AAEA,IAAAA,KAAA,GAAAC,OAAA;AAKA,MAAMC,aAAa,GAAG,IAAIC,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;;AAEjE;AACA;AACA;AACA;;AAWA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,gBAAgBA,CAACC,GAAY,EAAsB;EAC1D,OAAOC,aAAO,CAACC,gBAAgB,CAACF,GAAG,CAACG,EAAE,IAAIH,GAAG,CAACI,MAAM,CAACC,aAAa,CAAC;AACrE;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,SAASA,CAACC,MAAe,EAAEC,QAAgB,EAAqB;EACvE,OAAOD,MAAM,CAACE,IAAI,CAAC,CAAC;IAAEC;EAAI,CAAC,KAAKA,GAAG,KAAKF,QAAQ,CAAC;AACnD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASG,6BAA6BA,CAC3CC,OAA6B,EAC7BC,MAAc,EACE;EAChB,OAAO,gBAAgBb,GAAY,EAAEc,IAAc,EAAEC,IAAkB,EAAiB;IACtF,MAAMC,UAAU,GAAIhB,GAAG,CAAoBiB,WAAW;IACtD,MAAMT,QAAQ,GAAGQ,UAAU,EAAEE,KAAK,EAAER,GAAG;IAEvC,IAAI,CAACF,QAAQ,EAAE;MACb,OAAOO,IAAI,CAAC,CAAC;IACf;IAEA,MAAMI,IAAI,GAAGH,UAAU,EAAEI,IAAI;IAE7B,IAAI,OAAOD,IAAI,KAAK,QAAQ,EAAE;MAC5B,OAAOJ,IAAI,CAACM,gBAAU,CAACC,YAAY,CAACC,eAAS,CAACC,mBAAmB,CAAC,CAAC;IACrE;IAEA,IAAI;MACF,MAAMN,KAAK,GAAGZ,SAAS,CAAC,MAAMM,OAAO,CAACa,UAAU,CAAC;QAAEN;MAAK,CAAC,CAAC,EAAEX,QAAQ,CAAC;MAErE,IAAI,CAACU,KAAK,EAAE;QACVL,MAAM,CAACa,IAAI,CAAC;UAAElB,QAAQ;UAAEW;QAAK,CAAC,EAAE,yDAAyD,CAAC;QAC1F,OAAOJ,IAAI,CAACM,gBAAU,CAACC,YAAY,CAACC,eAAS,CAACC,mBAAmB,CAAC,CAAC;MACrE;MAEA,IAAI,CAACvB,aAAO,CAAC0B,gBAAgB,CAAC5B,gBAAgB,CAACC,GAAG,CAAC,EAAEkB,KAAK,CAACU,IAAI,CAAC,EAAE;QAChEf,MAAM,CAACa,IAAI,CACT;UAAElB,QAAQ;UAAEW;QAAK,CAAC,EAClB,kFACF,CAAC;QACD,OAAOJ,IAAI,CAACM,gBAAU,CAACC,YAAY,CAACC,eAAS,CAACC,mBAAmB,CAAC,CAAC;MACrE;MAEA,IAAIN,KAAK,CAACW,QAAQ,IAAIhC,aAAa,CAACiC,GAAG,CAAC9B,GAAG,CAAC+B,MAAM,CAAC,EAAE;QACnDlB,MAAM,CAACa,IAAI,CACT;UAAElB,QAAQ;UAAEW;QAAK,CAAC,EAClB,oFACF,CAAC;QACD,OAAOJ,IAAI,CAACM,gBAAU,CAACC,YAAY,CAACC,eAAS,CAACC,mBAAmB,CAAC,CAAC;MACrE;MAEA,OAAOT,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,OAAOiB,KAAU,EAAE;MACnBnB,MAAM,CAACmB,KAAK,CAAC;QAAEA,KAAK,EAAEA,KAAK,CAACC;MAAI,CAAC,EAAE,kDAAkD,CAAC;MACtF,OAAOlB,IAAI,CAACM,gBAAU,CAACa,gBAAgB,CAACF,KAAK,CAACG,OAAO,CAAC,CAAC;IACzD;EACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"file":"token-auth.js","names":[],"sources":["../../src/middlewares/token-auth.ts"],"sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from 'express';\n\nimport { API_ERROR, errorUtils, ipUtils } from '@verdaccio/core';\nimport type { Logger, Token } from '@verdaccio/types';\n\nimport type { $RequestExtend } from '../types';\n\nconst WRITE_METHODS = new Set(['DELETE', 'PATCH', 'POST', 'PUT']);\n\n/**\n * Minimal storage surface required to enforce generated token metadata. Typed\n * structurally so this package does not need to depend on `@verdaccio/store`.\n */\nexport interface TokenReadableStorage {\n  /**\n   * Load the generated tokens stored for a user.\n   *\n   * @param filter narrows the lookup to a single `user`\n   * @returns the user's persisted tokens\n   */\n  readTokens(filter: { user: string }): Promise<Token[]>;\n}\n\n/**\n * Resolve the client address of an incoming request for CIDR matching.\n *\n * Uses Express' `req.ip`, which already honors the application's `trust proxy`\n * setting (`config.server.trustProxy`): when the operator has declared trusted\n * proxies, `req.ip` is the upstream-most untrusted address parsed from\n * `X-Forwarded-For`; otherwise it is the direct socket peer and the forwarded\n * header is ignored entirely.\n *\n * The middleware must NOT read `X-Forwarded-For` on its own — doing so\n * unconditionally would let any client spoof its address (and bypass a token's\n * CIDR whitelist) simply by sending the header. Falls back to the raw socket\n * address and is normalized (trimmed, IPv4-mapped IPv6 prefix stripped) via\n * {@link ipUtils.normalizeAddress}.\n *\n * @param req the incoming Express request\n * @returns the normalized client address, or `undefined` when none can be determined\n */\nfunction getClientAddress(req: Request): string | undefined {\n  return ipUtils.normalizeAddress(req.ip || req.socket.remoteAddress);\n}\n\n/**\n * Find the stored token whose `key` matches the key carried by the request.\n *\n * @param tokens the tokens persisted for the authenticated user\n * @param tokenKey the key extracted from the presented generated token\n * @returns the matching {@link Token}, or `undefined` when it has been revoked / never existed\n */\nfunction findToken(tokens: Token[], tokenKey: string): Token | undefined {\n  return tokens.find(({ key }) => key === tokenKey);\n}\n\n/**\n * Express middleware that enforces the metadata of npm-style generated tokens\n * (created via `POST /-/npm/v1/tokens`).\n *\n * A generated token embeds a server-issued `key` that is recovered from the\n * verified credentials as `remote_user.token.key`. This middleware looks that\n * key up in storage and rejects the request when the token:\n * - is missing from storage (revoked or never issued);\n * - is used from a client address outside its `cidr` whitelist;\n * - is `readonly` and the request uses a write method (`DELETE`/`PATCH`/`POST`/`PUT`).\n *\n * Requests that do not carry a generated token key (e.g. interactive logins)\n * pass through untouched. It must run after the JWT/auth middleware has\n * populated `remote_user`. Failures fail closed: a storage lookup error yields\n * an internal error rather than allowing the request.\n *\n * @param storage storage exposing {@link TokenReadableStorage.readTokens} to load the user's tokens\n * @param logger logger used to record rejected attempts and lookup failures\n * @returns an Express {@link RequestHandler} that calls `next()` to allow or `next(error)` to reject\n */\nexport function enforceGeneratedTokenMetadata(\n  storage: TokenReadableStorage,\n  logger: Logger\n): RequestHandler {\n  return async function (req: Request, _res: Response, next: NextFunction): Promise<void> {\n    const remoteUser = (req as $RequestExtend).remote_user;\n    const tokenKey = remoteUser?.token?.key;\n\n    if (!tokenKey) {\n      return next();\n    }\n\n    const user = remoteUser?.name;\n\n    if (typeof user !== 'string') {\n      return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n    }\n\n    try {\n      const token = findToken(await storage.readTokens({ user }), tokenKey);\n\n      if (!token) {\n        logger.warn({ tokenKey, user }, 'generated token @{tokenKey} for user @{user} is missing');\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      if (!ipUtils.isAddressAllowed(getClientAddress(req), token.cidr)) {\n        logger.warn(\n          { tokenKey, user },\n          'generated token @{tokenKey} for user @{user} was used outside its CIDR whitelist'\n        );\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      if (token.readonly && WRITE_METHODS.has(req.method)) {\n        logger.warn(\n          { tokenKey, user },\n          'readonly generated token @{tokenKey} for user @{user} was used for a write request'\n        );\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      return next();\n    } catch (error: any) {\n      logger.error({ error: error.msg }, 'generated token metadata lookup failed: @{error}');\n      return next(errorUtils.getInternalError(error.message));\n    }\n  };\n}\n"],"mappings":";;AAOA,IAAM,gBAAgB,IAAI,IAAI;CAAC;CAAU;CAAS;CAAQ;AAAK,CAAC;;;;;;;;;;;;;;;;;;;AAkChE,SAAS,iBAAiB,KAAkC;CAC1D,OAAO,gBAAA,QAAQ,iBAAiB,IAAI,MAAM,IAAI,OAAO,aAAa;AACpE;;;;;;;;AASA,SAAS,UAAU,QAAiB,UAAqC;CACvE,OAAO,OAAO,MAAM,EAAE,UAAU,QAAQ,QAAQ;AAClD;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,8BACd,SACA,QACgB;CAChB,OAAO,eAAgB,KAAc,MAAgB,MAAmC;EACtF,MAAM,aAAc,IAAuB;EAC3C,MAAM,WAAW,YAAY,OAAO;EAEpC,IAAI,CAAC,UACH,OAAO,KAAK;EAGd,MAAM,OAAO,YAAY;EAEzB,IAAI,OAAO,SAAS,UAClB,OAAO,KAAK,gBAAA,WAAW,aAAa,gBAAA,UAAU,mBAAmB,CAAC;EAGpE,IAAI;GACF,MAAM,QAAQ,UAAU,MAAM,QAAQ,WAAW,EAAE,KAAK,CAAC,GAAG,QAAQ;GAEpE,IAAI,CAAC,OAAO;IACV,OAAO,KAAK;KAAE;KAAU;IAAK,GAAG,yDAAyD;IACzF,OAAO,KAAK,gBAAA,WAAW,aAAa,gBAAA,UAAU,mBAAmB,CAAC;GACpE;GAEA,IAAI,CAAC,gBAAA,QAAQ,iBAAiB,iBAAiB,GAAG,GAAG,MAAM,IAAI,GAAG;IAChE,OAAO,KACL;KAAE;KAAU;IAAK,GACjB,kFACF;IACA,OAAO,KAAK,gBAAA,WAAW,aAAa,gBAAA,UAAU,mBAAmB,CAAC;GACpE;GAEA,IAAI,MAAM,YAAY,cAAc,IAAI,IAAI,MAAM,GAAG;IACnD,OAAO,KACL;KAAE;KAAU;IAAK,GACjB,oFACF;IACA,OAAO,KAAK,gBAAA,WAAW,aAAa,gBAAA,UAAU,mBAAmB,CAAC;GACpE;GAEA,OAAO,KAAK;EACd,SAAS,OAAY;GACnB,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI,GAAG,kDAAkD;GACrF,OAAO,KAAK,gBAAA,WAAW,iBAAiB,MAAM,OAAO,CAAC;EACxD;CACF;AACF"}

package/build/middlewares/token-auth.mjs

@@ -0,0 +1,100 @@
+import { API_ERROR, errorUtils, ipUtils } from "@verdaccio/core";
+//#region src/middlewares/token-auth.ts
+var WRITE_METHODS = new Set([
+	"DELETE",
+	"PATCH",
+	"POST",
+	"PUT"
+]);
+/**
+* Resolve the client address of an incoming request for CIDR matching.
+*
+* Uses Express' `req.ip`, which already honors the application's `trust proxy`
+* setting (`config.server.trustProxy`): when the operator has declared trusted
+* proxies, `req.ip` is the upstream-most untrusted address parsed from
+* `X-Forwarded-For`; otherwise it is the direct socket peer and the forwarded
+* header is ignored entirely.
+*
+* The middleware must NOT read `X-Forwarded-For` on its own — doing so
+* unconditionally would let any client spoof its address (and bypass a token's
+* CIDR whitelist) simply by sending the header. Falls back to the raw socket
+* address and is normalized (trimmed, IPv4-mapped IPv6 prefix stripped) via
+* {@link ipUtils.normalizeAddress}.
+*
+* @param req the incoming Express request
+* @returns the normalized client address, or `undefined` when none can be determined
+*/
+function getClientAddress(req) {
+	return ipUtils.normalizeAddress(req.ip || req.socket.remoteAddress);
+}
+/**
+* Find the stored token whose `key` matches the key carried by the request.
+*
+* @param tokens the tokens persisted for the authenticated user
+* @param tokenKey the key extracted from the presented generated token
+* @returns the matching {@link Token}, or `undefined` when it has been revoked / never existed
+*/
+function findToken(tokens, tokenKey) {
+	return tokens.find(({ key }) => key === tokenKey);
+}
+/**
+* Express middleware that enforces the metadata of npm-style generated tokens
+* (created via `POST /-/npm/v1/tokens`).
+*
+* A generated token embeds a server-issued `key` that is recovered from the
+* verified credentials as `remote_user.token.key`. This middleware looks that
+* key up in storage and rejects the request when the token:
+* - is missing from storage (revoked or never issued);
+* - is used from a client address outside its `cidr` whitelist;
+* - is `readonly` and the request uses a write method (`DELETE`/`PATCH`/`POST`/`PUT`).
+*
+* Requests that do not carry a generated token key (e.g. interactive logins)
+* pass through untouched. It must run after the JWT/auth middleware has
+* populated `remote_user`. Failures fail closed: a storage lookup error yields
+* an internal error rather than allowing the request.
+*
+* @param storage storage exposing {@link TokenReadableStorage.readTokens} to load the user's tokens
+* @param logger logger used to record rejected attempts and lookup failures
+* @returns an Express {@link RequestHandler} that calls `next()` to allow or `next(error)` to reject
+*/
+function enforceGeneratedTokenMetadata(storage, logger) {
+	return async function(req, _res, next) {
+		const remoteUser = req.remote_user;
+		const tokenKey = remoteUser?.token?.key;
+		if (!tokenKey) return next();
+		const user = remoteUser?.name;
+		if (typeof user !== "string") return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));
+		try {
+			const token = findToken(await storage.readTokens({ user }), tokenKey);
+			if (!token) {
+				logger.warn({
+					tokenKey,
+					user
+				}, "generated token @{tokenKey} for user @{user} is missing");
+				return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));
+			}
+			if (!ipUtils.isAddressAllowed(getClientAddress(req), token.cidr)) {
+				logger.warn({
+					tokenKey,
+					user
+				}, "generated token @{tokenKey} for user @{user} was used outside its CIDR whitelist");
+				return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));
+			}
+			if (token.readonly && WRITE_METHODS.has(req.method)) {
+				logger.warn({
+					tokenKey,
+					user
+				}, "readonly generated token @{tokenKey} for user @{user} was used for a write request");
+				return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));
+			}
+			return next();
+		} catch (error) {
+			logger.error({ error: error.msg }, "generated token metadata lookup failed: @{error}");
+			return next(errorUtils.getInternalError(error.message));
+		}
+	};
+}
+//#endregion
+export { enforceGeneratedTokenMetadata };
+
+//# sourceMappingURL=token-auth.mjs.map

package/build/middlewares/token-auth.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-auth.mjs","names":[],"sources":["../../src/middlewares/token-auth.ts"],"sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from 'express';\n\nimport { API_ERROR, errorUtils, ipUtils } from '@verdaccio/core';\nimport type { Logger, Token } from '@verdaccio/types';\n\nimport type { $RequestExtend } from '../types';\n\nconst WRITE_METHODS = new Set(['DELETE', 'PATCH', 'POST', 'PUT']);\n\n/**\n * Minimal storage surface required to enforce generated token metadata. Typed\n * structurally so this package does not need to depend on `@verdaccio/store`.\n */\nexport interface TokenReadableStorage {\n  /**\n   * Load the generated tokens stored for a user.\n   *\n   * @param filter narrows the lookup to a single `user`\n   * @returns the user's persisted tokens\n   */\n  readTokens(filter: { user: string }): Promise<Token[]>;\n}\n\n/**\n * Resolve the client address of an incoming request for CIDR matching.\n *\n * Uses Express' `req.ip`, which already honors the application's `trust proxy`\n * setting (`config.server.trustProxy`): when the operator has declared trusted\n * proxies, `req.ip` is the upstream-most untrusted address parsed from\n * `X-Forwarded-For`; otherwise it is the direct socket peer and the forwarded\n * header is ignored entirely.\n *\n * The middleware must NOT read `X-Forwarded-For` on its own — doing so\n * unconditionally would let any client spoof its address (and bypass a token's\n * CIDR whitelist) simply by sending the header. Falls back to the raw socket\n * address and is normalized (trimmed, IPv4-mapped IPv6 prefix stripped) via\n * {@link ipUtils.normalizeAddress}.\n *\n * @param req the incoming Express request\n * @returns the normalized client address, or `undefined` when none can be determined\n */\nfunction getClientAddress(req: Request): string | undefined {\n  return ipUtils.normalizeAddress(req.ip || req.socket.remoteAddress);\n}\n\n/**\n * Find the stored token whose `key` matches the key carried by the request.\n *\n * @param tokens the tokens persisted for the authenticated user\n * @param tokenKey the key extracted from the presented generated token\n * @returns the matching {@link Token}, or `undefined` when it has been revoked / never existed\n */\nfunction findToken(tokens: Token[], tokenKey: string): Token | undefined {\n  return tokens.find(({ key }) => key === tokenKey);\n}\n\n/**\n * Express middleware that enforces the metadata of npm-style generated tokens\n * (created via `POST /-/npm/v1/tokens`).\n *\n * A generated token embeds a server-issued `key` that is recovered from the\n * verified credentials as `remote_user.token.key`. This middleware looks that\n * key up in storage and rejects the request when the token:\n * - is missing from storage (revoked or never issued);\n * - is used from a client address outside its `cidr` whitelist;\n * - is `readonly` and the request uses a write method (`DELETE`/`PATCH`/`POST`/`PUT`).\n *\n * Requests that do not carry a generated token key (e.g. interactive logins)\n * pass through untouched. It must run after the JWT/auth middleware has\n * populated `remote_user`. Failures fail closed: a storage lookup error yields\n * an internal error rather than allowing the request.\n *\n * @param storage storage exposing {@link TokenReadableStorage.readTokens} to load the user's tokens\n * @param logger logger used to record rejected attempts and lookup failures\n * @returns an Express {@link RequestHandler} that calls `next()` to allow or `next(error)` to reject\n */\nexport function enforceGeneratedTokenMetadata(\n  storage: TokenReadableStorage,\n  logger: Logger\n): RequestHandler {\n  return async function (req: Request, _res: Response, next: NextFunction): Promise<void> {\n    const remoteUser = (req as $RequestExtend).remote_user;\n    const tokenKey = remoteUser?.token?.key;\n\n    if (!tokenKey) {\n      return next();\n    }\n\n    const user = remoteUser?.name;\n\n    if (typeof user !== 'string') {\n      return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n    }\n\n    try {\n      const token = findToken(await storage.readTokens({ user }), tokenKey);\n\n      if (!token) {\n        logger.warn({ tokenKey, user }, 'generated token @{tokenKey} for user @{user} is missing');\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      if (!ipUtils.isAddressAllowed(getClientAddress(req), token.cidr)) {\n        logger.warn(\n          { tokenKey, user },\n          'generated token @{tokenKey} for user @{user} was used outside its CIDR whitelist'\n        );\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      if (token.readonly && WRITE_METHODS.has(req.method)) {\n        logger.warn(\n          { tokenKey, user },\n          'readonly generated token @{tokenKey} for user @{user} was used for a write request'\n        );\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      return next();\n    } catch (error: any) {\n      logger.error({ error: error.msg }, 'generated token metadata lookup failed: @{error}');\n      return next(errorUtils.getInternalError(error.message));\n    }\n  };\n}\n"],"mappings":";;AAOA,IAAM,gBAAgB,IAAI,IAAI;CAAC;CAAU;CAAS;CAAQ;AAAK,CAAC;;;;;;;;;;;;;;;;;;;AAkChE,SAAS,iBAAiB,KAAkC;CAC1D,OAAO,QAAQ,iBAAiB,IAAI,MAAM,IAAI,OAAO,aAAa;AACpE;;;;;;;;AASA,SAAS,UAAU,QAAiB,UAAqC;CACvE,OAAO,OAAO,MAAM,EAAE,UAAU,QAAQ,QAAQ;AAClD;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,8BACd,SACA,QACgB;CAChB,OAAO,eAAgB,KAAc,MAAgB,MAAmC;EACtF,MAAM,aAAc,IAAuB;EAC3C,MAAM,WAAW,YAAY,OAAO;EAEpC,IAAI,CAAC,UACH,OAAO,KAAK;EAGd,MAAM,OAAO,YAAY;EAEzB,IAAI,OAAO,SAAS,UAClB,OAAO,KAAK,WAAW,aAAa,UAAU,mBAAmB,CAAC;EAGpE,IAAI;GACF,MAAM,QAAQ,UAAU,MAAM,QAAQ,WAAW,EAAE,KAAK,CAAC,GAAG,QAAQ;GAEpE,IAAI,CAAC,OAAO;IACV,OAAO,KAAK;KAAE;KAAU;IAAK,GAAG,yDAAyD;IACzF,OAAO,KAAK,WAAW,aAAa,UAAU,mBAAmB,CAAC;GACpE;GAEA,IAAI,CAAC,QAAQ,iBAAiB,iBAAiB,GAAG,GAAG,MAAM,IAAI,GAAG;IAChE,OAAO,KACL;KAAE;KAAU;IAAK,GACjB,kFACF;IACA,OAAO,KAAK,WAAW,aAAa,UAAU,mBAAmB,CAAC;GACpE;GAEA,IAAI,MAAM,YAAY,cAAc,IAAI,IAAI,MAAM,GAAG;IACnD,OAAO,KACL;KAAE;KAAU;IAAK,GACjB,oFACF;IACA,OAAO,KAAK,WAAW,aAAa,UAAU,mBAAmB,CAAC;GACpE;GAEA,OAAO,KAAK;EACd,SAAS,OAAY;GACnB,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI,GAAG,kDAAkD;GACrF,OAAO,KAAK,WAAW,iBAAiB,MAAM,OAAO,CAAC;EACxD;CACF;AACF"}

package/build/middlewares/user-agent.js

@@ -1,15 +1,13 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.userAgent = userAgent;
-var _config = require("@verdaccio/config");
-var _core = require("@verdaccio/core");
+let _verdaccio_core = require("@verdaccio/core");
+let _verdaccio_config = require("@verdaccio/config");
+//#region src/middlewares/user-agent.ts
 function userAgent(config) {
-  return function (_req, res, next) {
-    res.setHeader(_core.HEADERS.POWERED_BY, (0, _config.getUserAgent)(config?.user_agent));
-    next();
-  };
+	return function(_req, res, next) {
+		res.setHeader(_verdaccio_core.HEADERS.POWERED_BY, (0, _verdaccio_config.getUserAgent)(config?.user_agent));
+		next();
+	};
 }
+//#endregion
+exports.userAgent = userAgent;
+
 //# sourceMappingURL=user-agent.js.map

package/build/middlewares/user-agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-agent.js","names":["_config","require","_core","userAgent","config","_req","res","next","setHeader","HEADERS","POWERED_BY","getUserAgent","user_agent"],"sources":["../../src/middlewares/user-agent.ts"],"sourcesContent":["import { getUserAgent } from '@verdaccio/config';\nimport { HEADERS } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function userAgent(config) {\n  return function (_req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    res.setHeader(HEADERS.POWERED_BY, getUserAgent(config?.user_agent));\n    next();\n  };\n}\n"],"mappings":";;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,KAAA,GAAAD,OAAA;AAIO,SAASE,SAASA,CAACC,MAAM,EAAE;EAChC,OAAO,UAAUC,IAAoB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;IACzFD,GAAG,CAACE,SAAS,CAACC,aAAO,CAACC,UAAU,EAAE,IAAAC,oBAAY,EAACP,MAAM,EAAEQ,UAAU,CAAC,CAAC;IACnEL,IAAI,CAAC,CAAC;EACR,CAAC;AACH","ignoreList":[]}
+{"version":3,"file":"user-agent.js","names":[],"sources":["../../src/middlewares/user-agent.ts"],"sourcesContent":["import { getUserAgent } from '@verdaccio/config';\nimport { HEADERS } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function userAgent(config) {\n  return function (_req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    res.setHeader(HEADERS.POWERED_BY, getUserAgent(config?.user_agent));\n    next();\n  };\n}\n"],"mappings":";;;AAKA,SAAgB,UAAU,QAAQ;CAChC,OAAO,SAAU,MAAsB,KAAsB,MAA8B;EACzF,IAAI,UAAU,gBAAA,QAAQ,aAAA,GAAA,kBAAA,cAAyB,QAAQ,UAAU,CAAC;EAClE,KAAK;CACP;AACF"}

package/build/middlewares/user-agent.mjs

@@ -0,0 +1,13 @@
+import { HEADERS } from "@verdaccio/core";
+import { getUserAgent } from "@verdaccio/config";
+//#region src/middlewares/user-agent.ts
+function userAgent(config) {
+	return function(_req, res, next) {
+		res.setHeader(HEADERS.POWERED_BY, getUserAgent(config?.user_agent));
+		next();
+	};
+}
+//#endregion
+export { userAgent };
+
+//# sourceMappingURL=user-agent.mjs.map

package/build/middlewares/user-agent.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-agent.mjs","names":[],"sources":["../../src/middlewares/user-agent.ts"],"sourcesContent":["import { getUserAgent } from '@verdaccio/config';\nimport { HEADERS } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function userAgent(config) {\n  return function (_req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    res.setHeader(HEADERS.POWERED_BY, getUserAgent(config?.user_agent));\n    next();\n  };\n}\n"],"mappings":";;;AAKA,SAAgB,UAAU,QAAQ;CAChC,OAAO,SAAU,MAAsB,KAAsB,MAA8B;EACzF,IAAI,UAAU,QAAQ,YAAY,aAAa,QAAQ,UAAU,CAAC;EAClE,KAAK;CACP;AACF"}

package/build/middlewares/validation.js

@@ -1,23 +1,15 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.validateName = validateName;
-exports.validatePackage = validatePackage;
-var _core = require("@verdaccio/core");
+let _verdaccio_core = require("@verdaccio/core");
+//#region src/middlewares/validation.ts
 function validateName(_req, _res, next, value, name) {
-  if (_core.validationUtils.validateName(value)) {
-    next();
-  } else {
-    next(_core.errorUtils.getBadRequest('invalid ' + name));
-  }
+	if (_verdaccio_core.validationUtils.validateName(value)) next();
+	else next(_verdaccio_core.errorUtils.getBadRequest("invalid " + name));
 }
 function validatePackage(_req, _res, next, value, name) {
-  if (_core.validationUtils.validatePackage(value)) {
-    next();
-  } else {
-    next(_core.errorUtils.getBadRequest('invalid ' + name));
-  }
+	if (_verdaccio_core.validationUtils.validatePackage(value)) next();
+	else next(_verdaccio_core.errorUtils.getBadRequest("invalid " + name));
 }
+//#endregion
+exports.validateName = validateName;
+exports.validatePackage = validatePackage;
+
 //# sourceMappingURL=validation.js.map

package/build/middlewares/validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation.js","names":["_core","require","validateName","_req","_res","next","value","name","validationUtils","errorUtils","getBadRequest","validatePackage"],"sources":["../../src/middlewares/validation.ts"],"sourcesContent":["import type { NextFunction, Request, Response } from 'express';\n\nimport { errorUtils, validationUtils } from '@verdaccio/core';\n\nexport function validateName(\n  _req: Request,\n  _res: Response,\n  next: NextFunction,\n  value: string,\n  name: string\n) {\n  if (validationUtils.validateName(value)) {\n    next();\n  } else {\n    next(errorUtils.getBadRequest('invalid ' + name));\n  }\n}\n\nexport function validatePackage(\n  _req: Request,\n  _res,\n  next: NextFunction,\n  value: string,\n  name: string\n) {\n  if (validationUtils.validatePackage(value)) {\n    next();\n  } else {\n    next(errorUtils.getBadRequest('invalid ' + name));\n  }\n}\n"],"mappings":";;;;;;;AAEA,IAAAA,KAAA,GAAAC,OAAA;AAEO,SAASC,YAAYA,CAC1BC,IAAa,EACbC,IAAc,EACdC,IAAkB,EAClBC,KAAa,EACbC,IAAY,EACZ;EACA,IAAIC,qBAAe,CAACN,YAAY,CAACI,KAAK,CAAC,EAAE;IACvCD,IAAI,CAAC,CAAC;EACR,CAAC,MAAM;IACLA,IAAI,CAACI,gBAAU,CAACC,aAAa,CAAC,UAAU,GAAGH,IAAI,CAAC,CAAC;EACnD;AACF;AAEO,SAASI,eAAeA,CAC7BR,IAAa,EACbC,IAAI,EACJC,IAAkB,EAClBC,KAAa,EACbC,IAAY,EACZ;EACA,IAAIC,qBAAe,CAACG,eAAe,CAACL,KAAK,CAAC,EAAE;IAC1CD,IAAI,CAAC,CAAC;EACR,CAAC,MAAM;IACLA,IAAI,CAACI,gBAAU,CAACC,aAAa,CAAC,UAAU,GAAGH,IAAI,CAAC,CAAC;EACnD;AACF","ignoreList":[]}
+{"version":3,"file":"validation.js","names":[],"sources":["../../src/middlewares/validation.ts"],"sourcesContent":["import type { NextFunction, Request, Response } from 'express';\n\nimport { errorUtils, validationUtils } from '@verdaccio/core';\n\nexport function validateName(\n  _req: Request,\n  _res: Response,\n  next: NextFunction,\n  value: string,\n  name: string\n) {\n  if (validationUtils.validateName(value)) {\n    next();\n  } else {\n    next(errorUtils.getBadRequest('invalid ' + name));\n  }\n}\n\nexport function validatePackage(\n  _req: Request,\n  _res,\n  next: NextFunction,\n  value: string,\n  name: string\n) {\n  if (validationUtils.validatePackage(value)) {\n    next();\n  } else {\n    next(errorUtils.getBadRequest('invalid ' + name));\n  }\n}\n"],"mappings":";;AAIA,SAAgB,aACd,MACA,MACA,MACA,OACA,MACA;CACA,IAAI,gBAAA,gBAAgB,aAAa,KAAK,GACpC,KAAK;MAEL,KAAK,gBAAA,WAAW,cAAc,aAAa,IAAI,CAAC;AAEpD;AAEA,SAAgB,gBACd,MACA,MACA,MACA,OACA,MACA;CACA,IAAI,gBAAA,gBAAgB,gBAAgB,KAAK,GACvC,KAAK;MAEL,KAAK,gBAAA,WAAW,cAAc,aAAa,IAAI,CAAC;AAEpD"}

package/build/middlewares/validation.mjs

@@ -0,0 +1,14 @@
+import { errorUtils, validationUtils } from "@verdaccio/core";
+//#region src/middlewares/validation.ts
+function validateName(_req, _res, next, value, name) {
+	if (validationUtils.validateName(value)) next();
+	else next(errorUtils.getBadRequest("invalid " + name));
+}
+function validatePackage(_req, _res, next, value, name) {
+	if (validationUtils.validatePackage(value)) next();
+	else next(errorUtils.getBadRequest("invalid " + name));
+}
+//#endregion
+export { validateName, validatePackage };
+
+//# sourceMappingURL=validation.mjs.map

package/build/middlewares/validation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.mjs","names":[],"sources":["../../src/middlewares/validation.ts"],"sourcesContent":["import type { NextFunction, Request, Response } from 'express';\n\nimport { errorUtils, validationUtils } from '@verdaccio/core';\n\nexport function validateName(\n  _req: Request,\n  _res: Response,\n  next: NextFunction,\n  value: string,\n  name: string\n) {\n  if (validationUtils.validateName(value)) {\n    next();\n  } else {\n    next(errorUtils.getBadRequest('invalid ' + name));\n  }\n}\n\nexport function validatePackage(\n  _req: Request,\n  _res,\n  next: NextFunction,\n  value: string,\n  name: string\n) {\n  if (validationUtils.validatePackage(value)) {\n    next();\n  } else {\n    next(errorUtils.getBadRequest('invalid ' + name));\n  }\n}\n"],"mappings":";;AAIA,SAAgB,aACd,MACA,MACA,MACA,OACA,MACA;CACA,IAAI,gBAAgB,aAAa,KAAK,GACpC,KAAK;MAEL,KAAK,WAAW,cAAc,aAAa,IAAI,CAAC;AAEpD;AAEA,SAAgB,gBACd,MACA,MACA,MACA,OACA,MACA;CACA,IAAI,gBAAgB,gBAAgB,KAAK,GACvC,KAAK;MAEL,KAAK,WAAW,cAAc,aAAa,IAAI,CAAC;AAEpD"}

package/build/middlewares/web/index.js

@@ -1,35 +1,4 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-Object.defineProperty(exports, "renderWebMiddleware", {
-  enumerable: true,
-  get: function () {
-    return _renderWeb.renderWebMiddleware;
-  }
-});
-Object.defineProperty(exports, "setSecurityWebHeaders", {
-  enumerable: true,
-  get: function () {
-    return _security.setSecurityWebHeaders;
-  }
-});
-Object.defineProperty(exports, "webAPIMiddleware", {
-  enumerable: true,
-  get: function () {
-    return _webApi.webAPIMiddleware;
-  }
-});
-Object.defineProperty(exports, "webMiddleware", {
-  enumerable: true,
-  get: function () {
-    return _webMiddleware.default;
-  }
-});
-var _webMiddleware = _interopRequireDefault(require("./web-middleware"));
-var _webApi = require("./web-api");
-var _security = require("./security");
-var _renderWeb = require("./render-web");
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-//# sourceMappingURL=index.js.map
+require("./security.js");
+require("./render-web.js");
+require("./web-api.js");
+require("./web-middleware.js");

package/build/middlewares/web/index.mjs

@@ -0,0 +1,4 @@
+import "./security.mjs";
+import "./render-web.mjs";
+import "./web-api.mjs";
+import "./web-middleware.mjs";

package/build/middlewares/web/render-web.js

@@ -1,119 +1,90 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.renderWebMiddleware = renderWebMiddleware;
-var _debug = _interopRequireDefault(require("debug"));
-var _express = _interopRequireDefault(require("express"));
-var _nodeFs = _interopRequireDefault(require("node:fs"));
-var _nodePath = _interopRequireDefault(require("node:path"));
-var _core = require("@verdaccio/core");
-var _url = require("@verdaccio/url");
-var _security = require("./security");
-var _renderHTML = _interopRequireDefault(require("./utils/renderHTML"));
-var _uiOptions = require("./utils/ui-options");
-var _webUrls = require("./web-urls");
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-const debug = (0, _debug.default)('verdaccio:web:render');
-const sendFileCallback = next => err => {
-  if (!err) {
-    return;
-  }
-  if (err.status === _core.HTTP_STATUS.NOT_FOUND) {
-    next();
-  } else {
-    next(err);
-  }
+const require_runtime = require("../../_virtual/_rolldown/runtime.js");
+const require_security = require("./security.js");
+const require_renderHTML = require("./utils/renderHTML.js");
+const require_ui_options = require("./utils/ui-options.js");
+const require_web_urls = require("./web-urls.js");
+let _verdaccio_core = require("@verdaccio/core");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+let express = require("express");
+express = require_runtime.__toESM(express);
+let node_fs = require("node:fs");
+node_fs = require_runtime.__toESM(node_fs);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
+let _verdaccio_url = require("@verdaccio/url");
+//#region src/middlewares/web/render-web.ts
+var debug$1 = (0, debug.default)("verdaccio:web:render");
+var sendFileCallback = (next) => (err) => {
+	if (!err) return;
+	if (err.status === _verdaccio_core.HTTP_STATUS.NOT_FOUND) next();
+	else next(err);
 };
 function renderWebMiddleware(config, tokenMiddleware, pluginOptions) {
-  const {
-    staticPath,
-    manifest,
-    manifestFiles
-  } = pluginOptions;
-  debug('static path %o', staticPath);
-
-  /* eslint new-cap:off */
-  const router = _express.default.Router();
-  if (typeof tokenMiddleware === 'function') {
-    router.use(tokenMiddleware);
-  }
-  router.use(_security.setSecurityWebHeaders);
-
-  // any match within the static is routed to the file system
-  router.get(_webUrls.WebUrlsNamespace.static + '*', function (req, res, next) {
-    const filename = req.params[0];
-    let file = `${staticPath}/${filename}`;
-    if (filename === 'favicon.ico' && config?.web?.favicon) {
-      file = config?.web?.favicon;
-      if ((0, _url.isURLhasValidProtocol)(file)) {
-        debug('redirect to favicon %s', file);
-        req.url = file;
-        return next();
-      }
-    }
-    debug('render static file %o', file);
-    res.sendFile(file, sendFileCallback(next));
-  });
-  function renderLogo(logo) {
-    // check the origin of the logo
-    if (logo && !(0, _url.isURLhasValidProtocol)(logo)) {
-      // URI related to a local file
-      const absoluteLocalFile = _nodePath.default.posix.resolve(logo);
-      debug('serve local logo %s', absoluteLocalFile);
-      try {
-        // TODO: replace existsSync by async alternative
-        if (_nodeFs.default.existsSync(absoluteLocalFile) && typeof _nodeFs.default.accessSync(absoluteLocalFile, _nodeFs.default.constants.R_OK) === 'undefined') {
-          // Note: `path.join` will break on Windows, because it transforms `/` to `\`
-          // Use POSIX version `path.posix.join` instead.
-          logo = _nodePath.default.posix.join(_webUrls.WebUrlsNamespace.static, _nodePath.default.basename(logo));
-          router.get(logo, function (_req, res, next) {
-            // @ts-ignore
-            debug('serve custom logo  web:%s - local:%s', logo, absoluteLocalFile);
-            res.sendFile(absoluteLocalFile, sendFileCallback(next));
-          });
-          debug('enabled custom logo %s', logo);
-        } else {
-          logo = undefined;
-          debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);
-        }
-      } catch {
-        logo = undefined;
-        debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);
-      }
-    }
-    return logo;
-  }
-  const logo = renderLogo(config?.web?.logo);
-  if (config?.web?.logo) {
-    config.web.logo = logo;
-  }
-  const logoDark = renderLogo(config?.web?.logoDark);
-  if (config?.web?.logoDark) {
-    config.web.logoDark = logoDark;
-  }
-
-  // Serve external script that loads UI options
-  router.get(_webUrls.WebUrlsNamespace.static + 'ui-options.js', function (req, res) {
-    const options = (0, _uiOptions.getUIOptions)(config, req, res);
-    const script = `window.__VERDACCIO_BASENAME_UI_OPTIONS=${JSON.stringify(options)};`;
-    res.setHeader(_core.HEADERS.CACHE_CONTROL, _core.HEADERS.NO_CACHE);
-    res.setHeader(_core.HEADERS.CONTENT_TYPE, _core.HEADERS.JAVASCRIPT_CHARSET);
-    res.send(script);
-  });
-
-  // Handle all web routes including security routes
-  router.get(_webUrls.WebUrlsNamespace.web + '*', function (req, res) {
-    const options = (0, _uiOptions.getUIOptions)(config, req, res);
-    (0, _renderHTML.default)(config, manifest, manifestFiles, options, res);
-    debug('render html section');
-  });
-  router.get(_webUrls.WebUrlsNamespace.root, function (req, res) {
-    const options = (0, _uiOptions.getUIOptions)(config, req, res);
-    (0, _renderHTML.default)(config, manifest, manifestFiles, options, res);
-    debug('render root');
-  });
-  return router;
+	const { staticPath, manifest, manifestFiles } = pluginOptions;
+	debug$1("static path %o", staticPath);
+	const router = express.default.Router();
+	if (typeof tokenMiddleware === "function") router.use(tokenMiddleware);
+	router.use(require_security.setSecurityWebHeaders);
+	router.get(require_web_urls.WebUrlsNamespace.static + "*", function(req, res, next) {
+		const filename = req.params[0];
+		let file = `${staticPath}/${filename}`;
+		if (filename === "favicon.ico" && config?.web?.favicon) {
+			file = config?.web?.favicon;
+			if ((0, _verdaccio_url.isURLhasValidProtocol)(file)) {
+				debug$1("redirect to favicon %s", file);
+				req.url = file;
+				return next();
+			}
+		}
+		debug$1("render static file %o", file);
+		res.sendFile(file, sendFileCallback(next));
+	});
+	function renderLogo(logo) {
+		if (logo && !(0, _verdaccio_url.isURLhasValidProtocol)(logo)) {
+			const absoluteLocalFile = node_path.default.posix.resolve(logo);
+			debug$1("serve local logo %s", absoluteLocalFile);
+			try {
+				if (node_fs.default.existsSync(absoluteLocalFile) && typeof node_fs.default.accessSync(absoluteLocalFile, node_fs.default.constants.R_OK) === "undefined") {
+					logo = node_path.default.posix.join(require_web_urls.WebUrlsNamespace.static, node_path.default.basename(logo));
+					router.get(logo, function(_req, res, next) {
+						debug$1("serve custom logo  web:%s - local:%s", logo, absoluteLocalFile);
+						res.sendFile(absoluteLocalFile, sendFileCallback(next));
+					});
+					debug$1("enabled custom logo %s", logo);
+				} else {
+					logo = void 0;
+					debug$1(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);
+				}
+			} catch {
+				logo = void 0;
+				debug$1(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);
+			}
+		}
+		return logo;
+	}
+	const logo = renderLogo(config?.web?.logo);
+	if (config?.web?.logo) config.web.logo = logo;
+	const logoDark = renderLogo(config?.web?.logoDark);
+	if (config?.web?.logoDark) config.web.logoDark = logoDark;
+	router.get(require_web_urls.WebUrlsNamespace.static + "ui-options.js", function(req, res) {
+		const options = require_ui_options.getUIOptions(config, req, res);
+		const script = `window.__VERDACCIO_BASENAME_UI_OPTIONS=${JSON.stringify(options)};`;
+		res.setHeader(_verdaccio_core.HEADERS.CACHE_CONTROL, _verdaccio_core.HEADERS.NO_CACHE);
+		res.setHeader(_verdaccio_core.HEADERS.CONTENT_TYPE, _verdaccio_core.HEADERS.JAVASCRIPT_CHARSET);
+		res.send(script);
+	});
+	router.get(require_web_urls.WebUrlsNamespace.web + "*", function(req, res) {
+		require_renderHTML.default(config, manifest, manifestFiles, require_ui_options.getUIOptions(config, req, res), res);
+		debug$1("render html section");
+	});
+	router.get(require_web_urls.WebUrlsNamespace.root, function(req, res) {
+		require_renderHTML.default(config, manifest, manifestFiles, require_ui_options.getUIOptions(config, req, res), res);
+		debug$1("render root");
+	});
+	return router;
 }
+//#endregion
+exports.renderWebMiddleware = renderWebMiddleware;
+
 //# sourceMappingURL=render-web.js.map

package/build/middlewares/web/render-web.js.map

@@ -1 +1 @@
-{"version":3,"file":"render-web.js","names":["_debug","_interopRequireDefault","require","_express","_nodeFs","_nodePath","_core","_url","_security","_renderHTML","_uiOptions","_webUrls","e","__esModule","default","debug","buildDebug","sendFileCallback","next","err","status","HTTP_STATUS","NOT_FOUND","renderWebMiddleware","config","tokenMiddleware","pluginOptions","staticPath","manifest","manifestFiles","router","express","Router","use","setSecurityWebHeaders","get","WebUrlsNamespace","static","req","res","filename","params","file","web","favicon","isURLhasValidProtocol","url","sendFile","renderLogo","logo","absoluteLocalFile","path","posix","resolve","fs","existsSync","accessSync","constants","R_OK","join","basename","_req","undefined","logoDark","options","getUIOptions","script","JSON","stringify","setHeader","HEADERS","CACHE_CONTROL","NO_CACHE","CONTENT_TYPE","JAVASCRIPT_CHARSET","send","renderHTML","root"],"sources":["../../../src/middlewares/web/render-web.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport express from 'express';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport { HEADERS, HTTP_STATUS } from '@verdaccio/core';\nimport { isURLhasValidProtocol } from '@verdaccio/url';\n\nimport { setSecurityWebHeaders } from './security';\nimport renderHTML from './utils/renderHTML';\nimport { getUIOptions } from './utils/ui-options';\nimport { WebUrlsNamespace } from './web-urls';\n\nconst debug = buildDebug('verdaccio:web:render');\n\nconst sendFileCallback = (next) => (err) => {\n  if (!err) {\n    return;\n  }\n  if (err.status === HTTP_STATUS.NOT_FOUND) {\n    next();\n  } else {\n    next(err);\n  }\n};\n\nexport function renderWebMiddleware(config, tokenMiddleware, pluginOptions) {\n  const { staticPath, manifest, manifestFiles } = pluginOptions;\n  debug('static path %o', staticPath);\n\n  /* eslint new-cap:off */\n  const router = express.Router();\n  if (typeof tokenMiddleware === 'function') {\n    router.use(tokenMiddleware);\n  }\n\n  router.use(setSecurityWebHeaders);\n\n  // any match within the static is routed to the file system\n  router.get(WebUrlsNamespace.static + '*', function (req, res, next) {\n    const filename = req.params[0];\n    let file = `${staticPath}/${filename}`;\n    if (filename === 'favicon.ico' && config?.web?.favicon) {\n      file = config?.web?.favicon;\n      if (isURLhasValidProtocol(file)) {\n        debug('redirect to favicon %s', file);\n        req.url = file;\n        return next();\n      }\n    }\n    debug('render static file %o', file);\n    res.sendFile(file, sendFileCallback(next));\n  });\n\n  function renderLogo(logo: string | undefined): string | undefined {\n    // check the origin of the logo\n    if (logo && !isURLhasValidProtocol(logo)) {\n      // URI related to a local file\n      const absoluteLocalFile = path.posix.resolve(logo);\n      debug('serve local logo %s', absoluteLocalFile);\n      try {\n        // TODO: replace existsSync by async alternative\n        if (\n          fs.existsSync(absoluteLocalFile) &&\n          typeof fs.accessSync(absoluteLocalFile, fs.constants.R_OK) === 'undefined'\n        ) {\n          // Note: `path.join` will break on Windows, because it transforms `/` to `\\`\n          // Use POSIX version `path.posix.join` instead.\n          logo = path.posix.join(WebUrlsNamespace.static, path.basename(logo));\n          router.get(logo, function (_req, res, next) {\n            // @ts-ignore\n            debug('serve custom logo  web:%s - local:%s', logo, absoluteLocalFile);\n            res.sendFile(absoluteLocalFile, sendFileCallback(next));\n          });\n          debug('enabled custom logo %s', logo);\n        } else {\n          logo = undefined;\n          debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n        }\n      } catch {\n        logo = undefined;\n        debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n      }\n    }\n    return logo;\n  }\n\n  const logo = renderLogo(config?.web?.logo);\n  if (config?.web?.logo) {\n    config.web.logo = logo;\n  }\n  const logoDark = renderLogo(config?.web?.logoDark);\n  if (config?.web?.logoDark) {\n    config.web.logoDark = logoDark;\n  }\n\n  // Serve external script that loads UI options\n  router.get(WebUrlsNamespace.static + 'ui-options.js', function (req, res) {\n    const options = getUIOptions(config, req, res);\n    const script = `window.__VERDACCIO_BASENAME_UI_OPTIONS=${JSON.stringify(options)};`;\n    res.setHeader(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n    res.setHeader(HEADERS.CONTENT_TYPE, HEADERS.JAVASCRIPT_CHARSET);\n    res.send(script);\n  });\n\n  // Handle all web routes including security routes\n  router.get(WebUrlsNamespace.web + '*', function (req, res) {\n    const options = getUIOptions(config, req, res);\n    renderHTML(config, manifest, manifestFiles, options, res);\n    debug('render html section');\n  });\n\n  router.get(WebUrlsNamespace.root, function (req, res) {\n    const options = getUIOptions(config, req, res);\n    renderHTML(config, manifest, manifestFiles, options, res);\n    debug('render root');\n  });\n\n  return router;\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,QAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,OAAA,GAAAH,sBAAA,CAAAC,OAAA;AACA,IAAAG,SAAA,GAAAJ,sBAAA,CAAAC,OAAA;AAEA,IAAAI,KAAA,GAAAJ,OAAA;AACA,IAAAK,IAAA,GAAAL,OAAA;AAEA,IAAAM,SAAA,GAAAN,OAAA;AACA,IAAAO,WAAA,GAAAR,sBAAA,CAAAC,OAAA;AACA,IAAAQ,UAAA,GAAAR,OAAA;AACA,IAAAS,QAAA,GAAAT,OAAA;AAA8C,SAAAD,uBAAAW,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAE9C,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,sBAAsB,CAAC;AAEhD,MAAMC,gBAAgB,GAAIC,IAAI,IAAMC,GAAG,IAAK;EAC1C,IAAI,CAACA,GAAG,EAAE;IACR;EACF;EACA,IAAIA,GAAG,CAACC,MAAM,KAAKC,iBAAW,CAACC,SAAS,EAAE;IACxCJ,IAAI,CAAC,CAAC;EACR,CAAC,MAAM;IACLA,IAAI,CAACC,GAAG,CAAC;EACX;AACF,CAAC;AAEM,SAASI,mBAAmBA,CAACC,MAAM,EAAEC,eAAe,EAAEC,aAAa,EAAE;EAC1E,MAAM;IAAEC,UAAU;IAAEC,QAAQ;IAAEC;EAAc,CAAC,GAAGH,aAAa;EAC7DX,KAAK,CAAC,gBAAgB,EAAEY,UAAU,CAAC;;EAEnC;EACA,MAAMG,MAAM,GAAGC,gBAAO,CAACC,MAAM,CAAC,CAAC;EAC/B,IAAI,OAAOP,eAAe,KAAK,UAAU,EAAE;IACzCK,MAAM,CAACG,GAAG,CAACR,eAAe,CAAC;EAC7B;EAEAK,MAAM,CAACG,GAAG,CAACC,+BAAqB,CAAC;;EAEjC;EACAJ,MAAM,CAACK,GAAG,CAACC,yBAAgB,CAACC,MAAM,GAAG,GAAG,EAAE,UAAUC,GAAG,EAAEC,GAAG,EAAErB,IAAI,EAAE;IAClE,MAAMsB,QAAQ,GAAGF,GAAG,CAACG,MAAM,CAAC,CAAC,CAAC;IAC9B,IAAIC,IAAI,GAAG,GAAGf,UAAU,IAAIa,QAAQ,EAAE;IACtC,IAAIA,QAAQ,KAAK,aAAa,IAAIhB,MAAM,EAAEmB,GAAG,EAAEC,OAAO,EAAE;MACtDF,IAAI,GAAGlB,MAAM,EAAEmB,GAAG,EAAEC,OAAO;MAC3B,IAAI,IAAAC,0BAAqB,EAACH,IAAI,CAAC,EAAE;QAC/B3B,KAAK,CAAC,wBAAwB,EAAE2B,IAAI,CAAC;QACrCJ,GAAG,CAACQ,GAAG,GAAGJ,IAAI;QACd,OAAOxB,IAAI,CAAC,CAAC;MACf;IACF;IACAH,KAAK,CAAC,uBAAuB,EAAE2B,IAAI,CAAC;IACpCH,GAAG,CAACQ,QAAQ,CAACL,IAAI,EAAEzB,gBAAgB,CAACC,IAAI,CAAC,CAAC;EAC5C,CAAC,CAAC;EAEF,SAAS8B,UAAUA,CAACC,IAAwB,EAAsB;IAChE;IACA,IAAIA,IAAI,IAAI,CAAC,IAAAJ,0BAAqB,EAACI,IAAI,CAAC,EAAE;MACxC;MACA,MAAMC,iBAAiB,GAAGC,iBAAI,CAACC,KAAK,CAACC,OAAO,CAACJ,IAAI,CAAC;MAClDlC,KAAK,CAAC,qBAAqB,EAAEmC,iBAAiB,CAAC;MAC/C,IAAI;QACF;QACA,IACEI,eAAE,CAACC,UAAU,CAACL,iBAAiB,CAAC,IAChC,OAAOI,eAAE,CAACE,UAAU,CAACN,iBAAiB,EAAEI,eAAE,CAACG,SAAS,CAACC,IAAI,CAAC,KAAK,WAAW,EAC1E;UACA;UACA;UACAT,IAAI,GAAGE,iBAAI,CAACC,KAAK,CAACO,IAAI,CAACvB,yBAAgB,CAACC,MAAM,EAAEc,iBAAI,CAACS,QAAQ,CAACX,IAAI,CAAC,CAAC;UACpEnB,MAAM,CAACK,GAAG,CAACc,IAAI,EAAE,UAAUY,IAAI,EAAEtB,GAAG,EAAErB,IAAI,EAAE;YAC1C;YACAH,KAAK,CAAC,sCAAsC,EAAEkC,IAAI,EAAEC,iBAAiB,CAAC;YACtEX,GAAG,CAACQ,QAAQ,CAACG,iBAAiB,EAAEjC,gBAAgB,CAACC,IAAI,CAAC,CAAC;UACzD,CAAC,CAAC;UACFH,KAAK,CAAC,wBAAwB,EAAEkC,IAAI,CAAC;QACvC,CAAC,MAAM;UACLA,IAAI,GAAGa,SAAS;UAChB/C,KAAK,CAAC,2BAA2BmC,iBAAiB,oCAAoC,CAAC;QACzF;MACF,CAAC,CAAC,MAAM;QACND,IAAI,GAAGa,SAAS;QAChB/C,KAAK,CAAC,2BAA2BmC,iBAAiB,oCAAoC,CAAC;MACzF;IACF;IACA,OAAOD,IAAI;EACb;EAEA,MAAMA,IAAI,GAAGD,UAAU,CAACxB,MAAM,EAAEmB,GAAG,EAAEM,IAAI,CAAC;EAC1C,IAAIzB,MAAM,EAAEmB,GAAG,EAAEM,IAAI,EAAE;IACrBzB,MAAM,CAACmB,GAAG,CAACM,IAAI,GAAGA,IAAI;EACxB;EACA,MAAMc,QAAQ,GAAGf,UAAU,CAACxB,MAAM,EAAEmB,GAAG,EAAEoB,QAAQ,CAAC;EAClD,IAAIvC,MAAM,EAAEmB,GAAG,EAAEoB,QAAQ,EAAE;IACzBvC,MAAM,CAACmB,GAAG,CAACoB,QAAQ,GAAGA,QAAQ;EAChC;;EAEA;EACAjC,MAAM,CAACK,GAAG,CAACC,yBAAgB,CAACC,MAAM,GAAG,eAAe,EAAE,UAAUC,GAAG,EAAEC,GAAG,EAAE;IACxE,MAAMyB,OAAO,GAAG,IAAAC,uBAAY,EAACzC,MAAM,EAAEc,GAAG,EAAEC,GAAG,CAAC;IAC9C,MAAM2B,MAAM,GAAG,0CAA0CC,IAAI,CAACC,SAAS,CAACJ,OAAO,CAAC,GAAG;IACnFzB,GAAG,CAAC8B,SAAS,CAACC,aAAO,CAACC,aAAa,EAAED,aAAO,CAACE,QAAQ,CAAC;IACtDjC,GAAG,CAAC8B,SAAS,CAACC,aAAO,CAACG,YAAY,EAAEH,aAAO,CAACI,kBAAkB,CAAC;IAC/DnC,GAAG,CAACoC,IAAI,CAACT,MAAM,CAAC;EAClB,CAAC,CAAC;;EAEF;EACApC,MAAM,CAACK,GAAG,CAACC,yBAAgB,CAACO,GAAG,GAAG,GAAG,EAAE,UAAUL,GAAG,EAAEC,GAAG,EAAE;IACzD,MAAMyB,OAAO,GAAG,IAAAC,uBAAY,EAACzC,MAAM,EAAEc,GAAG,EAAEC,GAAG,CAAC;IAC9C,IAAAqC,mBAAU,EAACpD,MAAM,EAAEI,QAAQ,EAAEC,aAAa,EAAEmC,OAAO,EAAEzB,GAAG,CAAC;IACzDxB,KAAK,CAAC,qBAAqB,CAAC;EAC9B,CAAC,CAAC;EAEFe,MAAM,CAACK,GAAG,CAACC,yBAAgB,CAACyC,IAAI,EAAE,UAAUvC,GAAG,EAAEC,GAAG,EAAE;IACpD,MAAMyB,OAAO,GAAG,IAAAC,uBAAY,EAACzC,MAAM,EAAEc,GAAG,EAAEC,GAAG,CAAC;IAC9C,IAAAqC,mBAAU,EAACpD,MAAM,EAAEI,QAAQ,EAAEC,aAAa,EAAEmC,OAAO,EAAEzB,GAAG,CAAC;IACzDxB,KAAK,CAAC,aAAa,CAAC;EACtB,CAAC,CAAC;EAEF,OAAOe,MAAM;AACf","ignoreList":[]}
+{"version":3,"file":"render-web.js","names":[],"sources":["../../../src/middlewares/web/render-web.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport express from 'express';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport { HEADERS, HTTP_STATUS } from '@verdaccio/core';\nimport { isURLhasValidProtocol } from '@verdaccio/url';\n\nimport { setSecurityWebHeaders } from './security';\nimport renderHTML from './utils/renderHTML';\nimport { getUIOptions } from './utils/ui-options';\nimport { WebUrlsNamespace } from './web-urls';\n\nconst debug = buildDebug('verdaccio:web:render');\n\nconst sendFileCallback = (next) => (err) => {\n  if (!err) {\n    return;\n  }\n  if (err.status === HTTP_STATUS.NOT_FOUND) {\n    next();\n  } else {\n    next(err);\n  }\n};\n\nexport function renderWebMiddleware(config, tokenMiddleware, pluginOptions) {\n  const { staticPath, manifest, manifestFiles } = pluginOptions;\n  debug('static path %o', staticPath);\n\n  const router = express.Router();\n  if (typeof tokenMiddleware === 'function') {\n    router.use(tokenMiddleware);\n  }\n\n  router.use(setSecurityWebHeaders);\n\n  // any match within the static is routed to the file system\n  router.get(WebUrlsNamespace.static + '*', function (req, res, next) {\n    const filename = req.params[0];\n    let file = `${staticPath}/${filename}`;\n    if (filename === 'favicon.ico' && config?.web?.favicon) {\n      file = config?.web?.favicon;\n      if (isURLhasValidProtocol(file)) {\n        debug('redirect to favicon %s', file);\n        req.url = file;\n        return next();\n      }\n    }\n    debug('render static file %o', file);\n    res.sendFile(file, sendFileCallback(next));\n  });\n\n  function renderLogo(logo: string | undefined): string | undefined {\n    // check the origin of the logo\n    if (logo && !isURLhasValidProtocol(logo)) {\n      // URI related to a local file\n      const absoluteLocalFile = path.posix.resolve(logo);\n      debug('serve local logo %s', absoluteLocalFile);\n      try {\n        // TODO: replace existsSync by async alternative\n        if (\n          fs.existsSync(absoluteLocalFile) &&\n          typeof fs.accessSync(absoluteLocalFile, fs.constants.R_OK) === 'undefined'\n        ) {\n          // Note: `path.join` will break on Windows, because it transforms `/` to `\\`\n          // Use POSIX version `path.posix.join` instead.\n          logo = path.posix.join(WebUrlsNamespace.static, path.basename(logo));\n          router.get(logo, function (_req, res, next) {\n            // @ts-ignore\n            debug('serve custom logo  web:%s - local:%s', logo, absoluteLocalFile);\n            res.sendFile(absoluteLocalFile, sendFileCallback(next));\n          });\n          debug('enabled custom logo %s', logo);\n        } else {\n          logo = undefined;\n          debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n        }\n      } catch {\n        logo = undefined;\n        debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n      }\n    }\n    return logo;\n  }\n\n  const logo = renderLogo(config?.web?.logo);\n  if (config?.web?.logo) {\n    config.web.logo = logo;\n  }\n  const logoDark = renderLogo(config?.web?.logoDark);\n  if (config?.web?.logoDark) {\n    config.web.logoDark = logoDark;\n  }\n\n  // Serve external script that loads UI options\n  router.get(WebUrlsNamespace.static + 'ui-options.js', function (req, res) {\n    const options = getUIOptions(config, req, res);\n    const script = `window.__VERDACCIO_BASENAME_UI_OPTIONS=${JSON.stringify(options)};`;\n    res.setHeader(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n    res.setHeader(HEADERS.CONTENT_TYPE, HEADERS.JAVASCRIPT_CHARSET);\n    res.send(script);\n  });\n\n  // Handle all web routes including security routes\n  router.get(WebUrlsNamespace.web + '*', function (req, res) {\n    const options = getUIOptions(config, req, res);\n    renderHTML(config, manifest, manifestFiles, options, res);\n    debug('render html section');\n  });\n\n  router.get(WebUrlsNamespace.root, function (req, res) {\n    const options = getUIOptions(config, req, res);\n    renderHTML(config, manifest, manifestFiles, options, res);\n    debug('render root');\n  });\n\n  return router;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAaA,IAAM,WAAA,GAAA,MAAA,SAAmB,sBAAsB;AAE/C,IAAM,oBAAoB,UAAU,QAAQ;CAC1C,IAAI,CAAC,KACH;CAEF,IAAI,IAAI,WAAW,gBAAA,YAAY,WAC7B,KAAK;MAEL,KAAK,GAAG;AAEZ;AAEA,SAAgB,oBAAoB,QAAQ,iBAAiB,eAAe;CAC1E,MAAM,EAAE,YAAY,UAAU,kBAAkB;CAChD,QAAM,kBAAkB,UAAU;CAElC,MAAM,SAAS,QAAA,QAAQ,OAAO;CAC9B,IAAI,OAAO,oBAAoB,YAC7B,OAAO,IAAI,eAAe;CAG5B,OAAO,IAAI,iBAAA,qBAAqB;CAGhC,OAAO,IAAI,iBAAA,iBAAiB,SAAS,KAAK,SAAU,KAAK,KAAK,MAAM;EAClE,MAAM,WAAW,IAAI,OAAO;EAC5B,IAAI,OAAO,GAAG,WAAW,GAAG;EAC5B,IAAI,aAAa,iBAAiB,QAAQ,KAAK,SAAS;GACtD,OAAO,QAAQ,KAAK;GACpB,KAAA,GAAA,eAAA,uBAA0B,IAAI,GAAG;IAC/B,QAAM,0BAA0B,IAAI;IACpC,IAAI,MAAM;IACV,OAAO,KAAK;GACd;EACF;EACA,QAAM,yBAAyB,IAAI;EACnC,IAAI,SAAS,MAAM,iBAAiB,IAAI,CAAC;CAC3C,CAAC;CAED,SAAS,WAAW,MAA8C;EAEhE,IAAI,QAAQ,EAAA,GAAA,eAAA,uBAAuB,IAAI,GAAG;GAExC,MAAM,oBAAoB,UAAA,QAAK,MAAM,QAAQ,IAAI;GACjD,QAAM,uBAAuB,iBAAiB;GAC9C,IAAI;IAEF,IACE,QAAA,QAAG,WAAW,iBAAiB,KAC/B,OAAO,QAAA,QAAG,WAAW,mBAAmB,QAAA,QAAG,UAAU,IAAI,MAAM,aAC/D;KAGA,OAAO,UAAA,QAAK,MAAM,KAAK,iBAAA,iBAAiB,QAAQ,UAAA,QAAK,SAAS,IAAI,CAAC;KACnE,OAAO,IAAI,MAAM,SAAU,MAAM,KAAK,MAAM;MAE1C,QAAM,wCAAwC,MAAM,iBAAiB;MACrE,IAAI,SAAS,mBAAmB,iBAAiB,IAAI,CAAC;KACxD,CAAC;KACD,QAAM,0BAA0B,IAAI;IACtC,OAAO;KACL,OAAO,KAAA;KACP,QAAM,2BAA2B,kBAAkB,mCAAmC;IACxF;GACF,QAAQ;IACN,OAAO,KAAA;IACP,QAAM,2BAA2B,kBAAkB,mCAAmC;GACxF;EACF;EACA,OAAO;CACT;CAEA,MAAM,OAAO,WAAW,QAAQ,KAAK,IAAI;CACzC,IAAI,QAAQ,KAAK,MACf,OAAO,IAAI,OAAO;CAEpB,MAAM,WAAW,WAAW,QAAQ,KAAK,QAAQ;CACjD,IAAI,QAAQ,KAAK,UACf,OAAO,IAAI,WAAW;CAIxB,OAAO,IAAI,iBAAA,iBAAiB,SAAS,iBAAiB,SAAU,KAAK,KAAK;EACxE,MAAM,UAAU,mBAAA,aAAa,QAAQ,KAAK,GAAG;EAC7C,MAAM,SAAS,0CAA0C,KAAK,UAAU,OAAO,EAAE;EACjF,IAAI,UAAU,gBAAA,QAAQ,eAAe,gBAAA,QAAQ,QAAQ;EACrD,IAAI,UAAU,gBAAA,QAAQ,cAAc,gBAAA,QAAQ,kBAAkB;EAC9D,IAAI,KAAK,MAAM;CACjB,CAAC;CAGD,OAAO,IAAI,iBAAA,iBAAiB,MAAM,KAAK,SAAU,KAAK,KAAK;EAEzD,mBAAA,QAAW,QAAQ,UAAU,eADb,mBAAA,aAAa,QAAQ,KAAK,GACE,GAAS,GAAG;EACxD,QAAM,qBAAqB;CAC7B,CAAC;CAED,OAAO,IAAI,iBAAA,iBAAiB,MAAM,SAAU,KAAK,KAAK;EAEpD,mBAAA,QAAW,QAAQ,UAAU,eADb,mBAAA,aAAa,QAAQ,KAAK,GACE,GAAS,GAAG;EACxD,QAAM,aAAa;CACrB,CAAC;CAED,OAAO;AACT"}