@verdaccio/middleware 9.0.0-next-9.3 → 9.0.0-next-9.5

package/build/middlewares/antiLoop.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"antiLoop.mjs","names":[],"sources":["../../src/middlewares/antiLoop.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport type { Config } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n/**\n * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.\n * @param config\n * @returns\n */\nexport function antiLoop(config: Config) {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    if (req?.headers?.via != null) {\n      const arr = req.get('via')?.split(',');\n      if (Array.isArray(arr)) {\n        for (let i = 0; i < arr.length; i++) {\n          // the \"via\" header must contain a specific value, this has to be in sync\n          // with the proxy request\n          // match eg: Server 1 or Server 2\n\n          // RFC 7230: Via = 1*( \",\" OWS Via-value )\n          //           Via-value = received-protocol RWS received-by [ RWS comment ]\n          //           received-protocol = [ protocol-name \"/\" ] protocol-version\n          //           received-by = ( uri-host [ \":\" port ] ) / pseudonym\n\n          // Split the trimmed header value into parts\n          const parts = arr[i].trim().split(/\\s+/);\n          // Check if we have at least protocol/version and received-by parts\n          if (parts.length >= 2) {\n            // Get the received-by value (server id), removing any comment\n            const serverId = parts[1].split('(')[0].trim();\n            if (serverId === config.server_id) {\n              return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n            }\n          }\n        }\n      }\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;AAUA,SAAgB,SAAS,QAAgB;AACvC,QAAO,SAAU,KAAqB,KAAsB,MAA8B;AACxF,MAAI,KAAK,SAAS,OAAO,MAAM;GAC7B,MAAM,MAAM,IAAI,IAAI,MAAM,EAAE,MAAM,IAAI;AACtC,OAAI,MAAM,QAAQ,IAAI,CACpB,MAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;IAWnC,MAAM,QAAQ,IAAI,GAAG,MAAM,CAAC,MAAM,MAAM;AAExC,QAAI,MAAM,UAAU;SAED,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,MAAM,KAC7B,OAAO,UACtB,QAAO,KAAK,WAAW,QAAQ,YAAY,eAAe,gBAAgB,CAAC;;;;AAMrF,QAAM"}

package/build/middlewares/api_urls.js

@@ -1,61 +1,68 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.USER_API_ENDPOINTS = exports.TOKEN_API_ENDPOINTS = exports.STARS_API_ENDPOINTS = exports.SEARCH_API_ENDPOINTS = exports.PUBLISH_API_ENDPOINTS = exports.PROFILE_API_ENDPOINTS = exports.PING_API_ENDPOINTS = exports.PACKAGE_API_ENDPOINTS = exports.LOGIN_API_ENDPOINTS = exports.DIST_TAGS_API_ENDPOINTS = void 0;
-let USER_API_ENDPOINTS = exports.USER_API_ENDPOINTS = /*#__PURE__*/function (USER_API_ENDPOINTS) {
-  USER_API_ENDPOINTS["whoami"] = "/-/whoami";
-  USER_API_ENDPOINTS["get_user"] = "/-/user/:org_couchdb_user";
-  USER_API_ENDPOINTS["add_user"] = "/-/user/:org_couchdb_user{/:_rev}{/:revision}";
-  USER_API_ENDPOINTS["user_token"] = "/-/user/token/{*subject}";
-  return USER_API_ENDPOINTS;
-}({});
-let STARS_API_ENDPOINTS = exports.STARS_API_ENDPOINTS = /*#__PURE__*/function (STARS_API_ENDPOINTS) {
-  STARS_API_ENDPOINTS["get_user_starred_packages"] = "/-/_view/starredByUser";
-  return STARS_API_ENDPOINTS;
-}({});
-let SEARCH_API_ENDPOINTS = exports.SEARCH_API_ENDPOINTS = /*#__PURE__*/function (SEARCH_API_ENDPOINTS) {
-  SEARCH_API_ENDPOINTS["search"] = "/-/v1/search";
-  SEARCH_API_ENDPOINTS["deprecated_search"] = "/-/all{/:since}";
-  return SEARCH_API_ENDPOINTS;
-}({});
-let PUBLISH_API_ENDPOINTS = exports.PUBLISH_API_ENDPOINTS = /*#__PURE__*/function (PUBLISH_API_ENDPOINTS) {
-  PUBLISH_API_ENDPOINTS["add_package"] = "/:package";
-  PUBLISH_API_ENDPOINTS["publish_package"] = "/:package/-rev/:revision";
-  PUBLISH_API_ENDPOINTS["remove_tarball"] = "/:package/-/:filename/-rev/:revision";
-  return PUBLISH_API_ENDPOINTS;
-}({});
-let PING_API_ENDPOINTS = exports.PING_API_ENDPOINTS = /*#__PURE__*/function (PING_API_ENDPOINTS) {
-  PING_API_ENDPOINTS["ping"] = "/-/ping";
-  return PING_API_ENDPOINTS;
-}({});
-let PACKAGE_API_ENDPOINTS = exports.PACKAGE_API_ENDPOINTS = /*#__PURE__*/function (PACKAGE_API_ENDPOINTS) {
-  PACKAGE_API_ENDPOINTS["get_package_by_version"] = "/:package{/:version}";
-  PACKAGE_API_ENDPOINTS["get_package_tarball"] = "/:package/-/:filename";
-  return PACKAGE_API_ENDPOINTS;
-}({});
-let DIST_TAGS_API_ENDPOINTS = exports.DIST_TAGS_API_ENDPOINTS = /*#__PURE__*/function (DIST_TAGS_API_ENDPOINTS) {
-  DIST_TAGS_API_ENDPOINTS["tagging"] = "/:package/:tag";
-  DIST_TAGS_API_ENDPOINTS["tagging_package"] = "/-/package/:package/dist-tags/:tag";
-  DIST_TAGS_API_ENDPOINTS["get_dist_tags"] = "/-/package/:package/dist-tags";
-  return DIST_TAGS_API_ENDPOINTS;
-}({});
-let PROFILE_API_ENDPOINTS = exports.PROFILE_API_ENDPOINTS = /*#__PURE__*/function (PROFILE_API_ENDPOINTS) {
-  PROFILE_API_ENDPOINTS["get_profile"] = "/-/npm/v1/user";
-  return PROFILE_API_ENDPOINTS;
-}({});
-let TOKEN_API_ENDPOINTS = exports.TOKEN_API_ENDPOINTS = /*#__PURE__*/function (TOKEN_API_ENDPOINTS) {
-  TOKEN_API_ENDPOINTS["get_tokens"] = "/-/npm/v1/tokens";
-  TOKEN_API_ENDPOINTS["delete_token"] = "/-/npm/v1/tokens/token/:tokenKey";
-  return TOKEN_API_ENDPOINTS;
-}({});
-let LOGIN_API_ENDPOINTS = exports.LOGIN_API_ENDPOINTS = /*#__PURE__*/function (LOGIN_API_ENDPOINTS) {
-  LOGIN_API_ENDPOINTS["login"] = "/-/v1/login";
-  LOGIN_API_ENDPOINTS["login_cli"] = "/-/v1/login_cli";
-  LOGIN_API_ENDPOINTS["login_cli_session"] = "/-/v1/login_cli/:sessionId";
-  LOGIN_API_ENDPOINTS["login_done"] = "/-/v1/done";
-  LOGIN_API_ENDPOINTS["login_done_session"] = "/-/v1/done/:sessionId";
-  return LOGIN_API_ENDPOINTS;
+//#region src/middlewares/api_urls.ts
+var USER_API_ENDPOINTS = /* @__PURE__ */ function(USER_API_ENDPOINTS) {
+	USER_API_ENDPOINTS["whoami"] = "/-/whoami";
+	USER_API_ENDPOINTS["get_user"] = "/-/user/:org_couchdb_user";
+	USER_API_ENDPOINTS["add_user"] = "/-/user/:org_couchdb_user{/:_rev}{/:revision}";
+	USER_API_ENDPOINTS["user_token"] = "/-/user/token/{*subject}";
+	return USER_API_ENDPOINTS;
+}({});
+var STARS_API_ENDPOINTS = /* @__PURE__ */ function(STARS_API_ENDPOINTS) {
+	STARS_API_ENDPOINTS["get_user_starred_packages"] = "/-/_view/starredByUser";
+	return STARS_API_ENDPOINTS;
+}({});
+var SEARCH_API_ENDPOINTS = /* @__PURE__ */ function(SEARCH_API_ENDPOINTS) {
+	SEARCH_API_ENDPOINTS["search"] = "/-/v1/search";
+	SEARCH_API_ENDPOINTS["deprecated_search"] = "/-/all{/:since}";
+	return SEARCH_API_ENDPOINTS;
+}({});
+var PUBLISH_API_ENDPOINTS = /* @__PURE__ */ function(PUBLISH_API_ENDPOINTS) {
+	PUBLISH_API_ENDPOINTS["add_package"] = "/:package";
+	PUBLISH_API_ENDPOINTS["publish_package"] = "/:package/-rev/:revision";
+	PUBLISH_API_ENDPOINTS["remove_tarball"] = "/:package/-/:filename/-rev/:revision";
+	return PUBLISH_API_ENDPOINTS;
+}({});
+var PING_API_ENDPOINTS = /* @__PURE__ */ function(PING_API_ENDPOINTS) {
+	PING_API_ENDPOINTS["ping"] = "/-/ping";
+	return PING_API_ENDPOINTS;
+}({});
+var PACKAGE_API_ENDPOINTS = /* @__PURE__ */ function(PACKAGE_API_ENDPOINTS) {
+	PACKAGE_API_ENDPOINTS["get_package_by_version"] = "/:package{/:version}";
+	PACKAGE_API_ENDPOINTS["get_package_tarball"] = "/:package/-/:filename";
+	return PACKAGE_API_ENDPOINTS;
 }({});
+var DIST_TAGS_API_ENDPOINTS = /* @__PURE__ */ function(DIST_TAGS_API_ENDPOINTS) {
+	DIST_TAGS_API_ENDPOINTS["tagging"] = "/:package/:tag";
+	DIST_TAGS_API_ENDPOINTS["tagging_package"] = "/-/package/:package/dist-tags/:tag";
+	DIST_TAGS_API_ENDPOINTS["get_dist_tags"] = "/-/package/:package/dist-tags";
+	return DIST_TAGS_API_ENDPOINTS;
+}({});
+var PROFILE_API_ENDPOINTS = /* @__PURE__ */ function(PROFILE_API_ENDPOINTS) {
+	PROFILE_API_ENDPOINTS["get_profile"] = "/-/npm/v1/user";
+	return PROFILE_API_ENDPOINTS;
+}({});
+var TOKEN_API_ENDPOINTS = /* @__PURE__ */ function(TOKEN_API_ENDPOINTS) {
+	TOKEN_API_ENDPOINTS["get_tokens"] = "/-/npm/v1/tokens";
+	TOKEN_API_ENDPOINTS["delete_token"] = "/-/npm/v1/tokens/token/:tokenKey";
+	return TOKEN_API_ENDPOINTS;
+}({});
+var LOGIN_API_ENDPOINTS = /* @__PURE__ */ function(LOGIN_API_ENDPOINTS) {
+	LOGIN_API_ENDPOINTS["login"] = "/-/v1/login";
+	LOGIN_API_ENDPOINTS["login_cli"] = "/-/v1/login_cli";
+	LOGIN_API_ENDPOINTS["login_cli_session"] = "/-/v1/login_cli/:sessionId";
+	LOGIN_API_ENDPOINTS["login_done"] = "/-/v1/done";
+	LOGIN_API_ENDPOINTS["login_done_session"] = "/-/v1/done/:sessionId";
+	return LOGIN_API_ENDPOINTS;
+}({});
+//#endregion
+exports.DIST_TAGS_API_ENDPOINTS = DIST_TAGS_API_ENDPOINTS;
+exports.LOGIN_API_ENDPOINTS = LOGIN_API_ENDPOINTS;
+exports.PACKAGE_API_ENDPOINTS = PACKAGE_API_ENDPOINTS;
+exports.PING_API_ENDPOINTS = PING_API_ENDPOINTS;
+exports.PROFILE_API_ENDPOINTS = PROFILE_API_ENDPOINTS;
+exports.PUBLISH_API_ENDPOINTS = PUBLISH_API_ENDPOINTS;
+exports.SEARCH_API_ENDPOINTS = SEARCH_API_ENDPOINTS;
+exports.STARS_API_ENDPOINTS = STARS_API_ENDPOINTS;
+exports.TOKEN_API_ENDPOINTS = TOKEN_API_ENDPOINTS;
+exports.USER_API_ENDPOINTS = USER_API_ENDPOINTS;
+
 //# sourceMappingURL=api_urls.js.map

package/build/middlewares/api_urls.js.map

@@ -1 +1 @@
-{"version":3,"file":"api_urls.js","names":["USER_API_ENDPOINTS","exports","STARS_API_ENDPOINTS","SEARCH_API_ENDPOINTS","PUBLISH_API_ENDPOINTS","PING_API_ENDPOINTS","PACKAGE_API_ENDPOINTS","DIST_TAGS_API_ENDPOINTS","PROFILE_API_ENDPOINTS","TOKEN_API_ENDPOINTS","LOGIN_API_ENDPOINTS"],"sources":["../../src/middlewares/api_urls.ts"],"sourcesContent":["export enum USER_API_ENDPOINTS {\n  whoami = '/-/whoami',\n  get_user = '/-/user/:org_couchdb_user',\n  add_user = '/-/user/:org_couchdb_user{/:_rev}{/:revision}',\n  user_token = '/-/user/token/{*subject}',\n}\n\nexport enum STARS_API_ENDPOINTS {\n  get_user_starred_packages = '/-/_view/starredByUser',\n}\n\nexport enum SEARCH_API_ENDPOINTS {\n  search = '/-/v1/search',\n  deprecated_search = '/-/all{/:since}',\n}\n\nexport enum PUBLISH_API_ENDPOINTS {\n  add_package = '/:package',\n  publish_package = '/:package/-rev/:revision',\n  remove_tarball = '/:package/-/:filename/-rev/:revision',\n}\n\nexport enum PING_API_ENDPOINTS {\n  ping = '/-/ping',\n}\n\nexport enum PACKAGE_API_ENDPOINTS {\n  get_package_by_version = '/:package{/:version}',\n  get_package_tarball = '/:package/-/:filename',\n}\n\nexport enum DIST_TAGS_API_ENDPOINTS {\n  tagging = '/:package/:tag',\n  tagging_package = '/-/package/:package/dist-tags/:tag',\n  get_dist_tags = '/-/package/:package/dist-tags',\n}\n\nexport enum PROFILE_API_ENDPOINTS {\n  get_profile = '/-/npm/v1/user',\n}\n\nexport enum TOKEN_API_ENDPOINTS {\n  get_tokens = '/-/npm/v1/tokens',\n  delete_token = '/-/npm/v1/tokens/token/:tokenKey',\n}\n\nexport enum LOGIN_API_ENDPOINTS {\n  login = '/-/v1/login',\n  login_cli = '/-/v1/login_cli',\n  login_cli_session = '/-/v1/login_cli/:sessionId',\n  login_done = '/-/v1/done',\n  login_done_session = '/-/v1/done/:sessionId',\n}\n"],"mappings":";;;;;;IAAYA,kBAAkB,GAAAC,OAAA,CAAAD,kBAAA,0BAAlBA,kBAAkB;EAAlBA,kBAAkB;EAAlBA,kBAAkB;EAAlBA,kBAAkB;EAAlBA,kBAAkB;EAAA,OAAlBA,kBAAkB;AAAA;AAAA,IAOlBE,mBAAmB,GAAAD,OAAA,CAAAC,mBAAA,0BAAnBA,mBAAmB;EAAnBA,mBAAmB;EAAA,OAAnBA,mBAAmB;AAAA;AAAA,IAInBC,oBAAoB,GAAAF,OAAA,CAAAE,oBAAA,0BAApBA,oBAAoB;EAApBA,oBAAoB;EAApBA,oBAAoB;EAAA,OAApBA,oBAAoB;AAAA;AAAA,IAKpBC,qBAAqB,GAAAH,OAAA,CAAAG,qBAAA,0BAArBA,qBAAqB;EAArBA,qBAAqB;EAArBA,qBAAqB;EAArBA,qBAAqB;EAAA,OAArBA,qBAAqB;AAAA;AAAA,IAMrBC,kBAAkB,GAAAJ,OAAA,CAAAI,kBAAA,0BAAlBA,kBAAkB;EAAlBA,kBAAkB;EAAA,OAAlBA,kBAAkB;AAAA;AAAA,IAIlBC,qBAAqB,GAAAL,OAAA,CAAAK,qBAAA,0BAArBA,qBAAqB;EAArBA,qBAAqB;EAArBA,qBAAqB;EAAA,OAArBA,qBAAqB;AAAA;AAAA,IAKrBC,uBAAuB,GAAAN,OAAA,CAAAM,uBAAA,0BAAvBA,uBAAuB;EAAvBA,uBAAuB;EAAvBA,uBAAuB;EAAvBA,uBAAuB;EAAA,OAAvBA,uBAAuB;AAAA;AAAA,IAMvBC,qBAAqB,GAAAP,OAAA,CAAAO,qBAAA,0BAArBA,qBAAqB;EAArBA,qBAAqB;EAAA,OAArBA,qBAAqB;AAAA;AAAA,IAIrBC,mBAAmB,GAAAR,OAAA,CAAAQ,mBAAA,0BAAnBA,mBAAmB;EAAnBA,mBAAmB;EAAnBA,mBAAmB;EAAA,OAAnBA,mBAAmB;AAAA;AAAA,IAKnBC,mBAAmB,GAAAT,OAAA,CAAAS,mBAAA,0BAAnBA,mBAAmB;EAAnBA,mBAAmB;EAAnBA,mBAAmB;EAAnBA,mBAAmB;EAAnBA,mBAAmB;EAAnBA,mBAAmB;EAAA,OAAnBA,mBAAmB;AAAA","ignoreList":[]}
+{"version":3,"file":"api_urls.js","names":[],"sources":["../../src/middlewares/api_urls.ts"],"sourcesContent":["export enum USER_API_ENDPOINTS {\n  whoami = '/-/whoami',\n  get_user = '/-/user/:org_couchdb_user',\n  add_user = '/-/user/:org_couchdb_user{/:_rev}{/:revision}',\n  user_token = '/-/user/token/{*subject}',\n}\n\nexport enum STARS_API_ENDPOINTS {\n  get_user_starred_packages = '/-/_view/starredByUser',\n}\n\nexport enum SEARCH_API_ENDPOINTS {\n  search = '/-/v1/search',\n  deprecated_search = '/-/all{/:since}',\n}\n\nexport enum PUBLISH_API_ENDPOINTS {\n  add_package = '/:package',\n  publish_package = '/:package/-rev/:revision',\n  remove_tarball = '/:package/-/:filename/-rev/:revision',\n}\n\nexport enum PING_API_ENDPOINTS {\n  ping = '/-/ping',\n}\n\nexport enum PACKAGE_API_ENDPOINTS {\n  get_package_by_version = '/:package{/:version}',\n  get_package_tarball = '/:package/-/:filename',\n}\n\nexport enum DIST_TAGS_API_ENDPOINTS {\n  tagging = '/:package/:tag',\n  tagging_package = '/-/package/:package/dist-tags/:tag',\n  get_dist_tags = '/-/package/:package/dist-tags',\n}\n\nexport enum PROFILE_API_ENDPOINTS {\n  get_profile = '/-/npm/v1/user',\n}\n\nexport enum TOKEN_API_ENDPOINTS {\n  get_tokens = '/-/npm/v1/tokens',\n  delete_token = '/-/npm/v1/tokens/token/:tokenKey',\n}\n\nexport enum LOGIN_API_ENDPOINTS {\n  login = '/-/v1/login',\n  login_cli = '/-/v1/login_cli',\n  login_cli_session = '/-/v1/login_cli/:sessionId',\n  login_done = '/-/v1/done',\n  login_done_session = '/-/v1/done/:sessionId',\n}\n"],"mappings":";AAAA,IAAY,qBAAL,yBAAA,oBAAA;AACL,oBAAA,YAAA;AACA,oBAAA,cAAA;AACA,oBAAA,cAAA;AACA,oBAAA,gBAAA;;KACD;AAED,IAAY,sBAAL,yBAAA,qBAAA;AACL,qBAAA,+BAAA;;KACD;AAED,IAAY,uBAAL,yBAAA,sBAAA;AACL,sBAAA,YAAA;AACA,sBAAA,uBAAA;;KACD;AAED,IAAY,wBAAL,yBAAA,uBAAA;AACL,uBAAA,iBAAA;AACA,uBAAA,qBAAA;AACA,uBAAA,oBAAA;;KACD;AAED,IAAY,qBAAL,yBAAA,oBAAA;AACL,oBAAA,UAAA;;KACD;AAED,IAAY,wBAAL,yBAAA,uBAAA;AACL,uBAAA,4BAAA;AACA,uBAAA,yBAAA;;KACD;AAED,IAAY,0BAAL,yBAAA,yBAAA;AACL,yBAAA,aAAA;AACA,yBAAA,qBAAA;AACA,yBAAA,mBAAA;;KACD;AAED,IAAY,wBAAL,yBAAA,uBAAA;AACL,uBAAA,iBAAA;;KACD;AAED,IAAY,sBAAL,yBAAA,qBAAA;AACL,qBAAA,gBAAA;AACA,qBAAA,kBAAA;;KACD;AAED,IAAY,sBAAL,yBAAA,qBAAA;AACL,qBAAA,WAAA;AACA,qBAAA,eAAA;AACA,qBAAA,uBAAA;AACA,qBAAA,gBAAA;AACA,qBAAA,wBAAA;;KACD"}

package/build/middlewares/api_urls.mjs

@@ -0,0 +1,59 @@
+//#region src/middlewares/api_urls.ts
+var USER_API_ENDPOINTS = /* @__PURE__ */ function(USER_API_ENDPOINTS) {
+	USER_API_ENDPOINTS["whoami"] = "/-/whoami";
+	USER_API_ENDPOINTS["get_user"] = "/-/user/:org_couchdb_user";
+	USER_API_ENDPOINTS["add_user"] = "/-/user/:org_couchdb_user{/:_rev}{/:revision}";
+	USER_API_ENDPOINTS["user_token"] = "/-/user/token/{*subject}";
+	return USER_API_ENDPOINTS;
+}({});
+var STARS_API_ENDPOINTS = /* @__PURE__ */ function(STARS_API_ENDPOINTS) {
+	STARS_API_ENDPOINTS["get_user_starred_packages"] = "/-/_view/starredByUser";
+	return STARS_API_ENDPOINTS;
+}({});
+var SEARCH_API_ENDPOINTS = /* @__PURE__ */ function(SEARCH_API_ENDPOINTS) {
+	SEARCH_API_ENDPOINTS["search"] = "/-/v1/search";
+	SEARCH_API_ENDPOINTS["deprecated_search"] = "/-/all{/:since}";
+	return SEARCH_API_ENDPOINTS;
+}({});
+var PUBLISH_API_ENDPOINTS = /* @__PURE__ */ function(PUBLISH_API_ENDPOINTS) {
+	PUBLISH_API_ENDPOINTS["add_package"] = "/:package";
+	PUBLISH_API_ENDPOINTS["publish_package"] = "/:package/-rev/:revision";
+	PUBLISH_API_ENDPOINTS["remove_tarball"] = "/:package/-/:filename/-rev/:revision";
+	return PUBLISH_API_ENDPOINTS;
+}({});
+var PING_API_ENDPOINTS = /* @__PURE__ */ function(PING_API_ENDPOINTS) {
+	PING_API_ENDPOINTS["ping"] = "/-/ping";
+	return PING_API_ENDPOINTS;
+}({});
+var PACKAGE_API_ENDPOINTS = /* @__PURE__ */ function(PACKAGE_API_ENDPOINTS) {
+	PACKAGE_API_ENDPOINTS["get_package_by_version"] = "/:package{/:version}";
+	PACKAGE_API_ENDPOINTS["get_package_tarball"] = "/:package/-/:filename";
+	return PACKAGE_API_ENDPOINTS;
+}({});
+var DIST_TAGS_API_ENDPOINTS = /* @__PURE__ */ function(DIST_TAGS_API_ENDPOINTS) {
+	DIST_TAGS_API_ENDPOINTS["tagging"] = "/:package/:tag";
+	DIST_TAGS_API_ENDPOINTS["tagging_package"] = "/-/package/:package/dist-tags/:tag";
+	DIST_TAGS_API_ENDPOINTS["get_dist_tags"] = "/-/package/:package/dist-tags";
+	return DIST_TAGS_API_ENDPOINTS;
+}({});
+var PROFILE_API_ENDPOINTS = /* @__PURE__ */ function(PROFILE_API_ENDPOINTS) {
+	PROFILE_API_ENDPOINTS["get_profile"] = "/-/npm/v1/user";
+	return PROFILE_API_ENDPOINTS;
+}({});
+var TOKEN_API_ENDPOINTS = /* @__PURE__ */ function(TOKEN_API_ENDPOINTS) {
+	TOKEN_API_ENDPOINTS["get_tokens"] = "/-/npm/v1/tokens";
+	TOKEN_API_ENDPOINTS["delete_token"] = "/-/npm/v1/tokens/token/:tokenKey";
+	return TOKEN_API_ENDPOINTS;
+}({});
+var LOGIN_API_ENDPOINTS = /* @__PURE__ */ function(LOGIN_API_ENDPOINTS) {
+	LOGIN_API_ENDPOINTS["login"] = "/-/v1/login";
+	LOGIN_API_ENDPOINTS["login_cli"] = "/-/v1/login_cli";
+	LOGIN_API_ENDPOINTS["login_cli_session"] = "/-/v1/login_cli/:sessionId";
+	LOGIN_API_ENDPOINTS["login_done"] = "/-/v1/done";
+	LOGIN_API_ENDPOINTS["login_done_session"] = "/-/v1/done/:sessionId";
+	return LOGIN_API_ENDPOINTS;
+}({});
+//#endregion
+export { DIST_TAGS_API_ENDPOINTS, LOGIN_API_ENDPOINTS, PACKAGE_API_ENDPOINTS, PING_API_ENDPOINTS, PROFILE_API_ENDPOINTS, PUBLISH_API_ENDPOINTS, SEARCH_API_ENDPOINTS, STARS_API_ENDPOINTS, TOKEN_API_ENDPOINTS, USER_API_ENDPOINTS };
+
+//# sourceMappingURL=api_urls.mjs.map

package/build/middlewares/api_urls.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"api_urls.mjs","names":[],"sources":["../../src/middlewares/api_urls.ts"],"sourcesContent":["export enum USER_API_ENDPOINTS {\n  whoami = '/-/whoami',\n  get_user = '/-/user/:org_couchdb_user',\n  add_user = '/-/user/:org_couchdb_user{/:_rev}{/:revision}',\n  user_token = '/-/user/token/{*subject}',\n}\n\nexport enum STARS_API_ENDPOINTS {\n  get_user_starred_packages = '/-/_view/starredByUser',\n}\n\nexport enum SEARCH_API_ENDPOINTS {\n  search = '/-/v1/search',\n  deprecated_search = '/-/all{/:since}',\n}\n\nexport enum PUBLISH_API_ENDPOINTS {\n  add_package = '/:package',\n  publish_package = '/:package/-rev/:revision',\n  remove_tarball = '/:package/-/:filename/-rev/:revision',\n}\n\nexport enum PING_API_ENDPOINTS {\n  ping = '/-/ping',\n}\n\nexport enum PACKAGE_API_ENDPOINTS {\n  get_package_by_version = '/:package{/:version}',\n  get_package_tarball = '/:package/-/:filename',\n}\n\nexport enum DIST_TAGS_API_ENDPOINTS {\n  tagging = '/:package/:tag',\n  tagging_package = '/-/package/:package/dist-tags/:tag',\n  get_dist_tags = '/-/package/:package/dist-tags',\n}\n\nexport enum PROFILE_API_ENDPOINTS {\n  get_profile = '/-/npm/v1/user',\n}\n\nexport enum TOKEN_API_ENDPOINTS {\n  get_tokens = '/-/npm/v1/tokens',\n  delete_token = '/-/npm/v1/tokens/token/:tokenKey',\n}\n\nexport enum LOGIN_API_ENDPOINTS {\n  login = '/-/v1/login',\n  login_cli = '/-/v1/login_cli',\n  login_cli_session = '/-/v1/login_cli/:sessionId',\n  login_done = '/-/v1/done',\n  login_done_session = '/-/v1/done/:sessionId',\n}\n"],"mappings":";AAAA,IAAY,qBAAL,yBAAA,oBAAA;AACL,oBAAA,YAAA;AACA,oBAAA,cAAA;AACA,oBAAA,cAAA;AACA,oBAAA,gBAAA;;KACD;AAED,IAAY,sBAAL,yBAAA,qBAAA;AACL,qBAAA,+BAAA;;KACD;AAED,IAAY,uBAAL,yBAAA,sBAAA;AACL,sBAAA,YAAA;AACA,sBAAA,uBAAA;;KACD;AAED,IAAY,wBAAL,yBAAA,uBAAA;AACL,uBAAA,iBAAA;AACA,uBAAA,qBAAA;AACA,uBAAA,oBAAA;;KACD;AAED,IAAY,qBAAL,yBAAA,oBAAA;AACL,oBAAA,UAAA;;KACD;AAED,IAAY,wBAAL,yBAAA,uBAAA;AACL,uBAAA,4BAAA;AACA,uBAAA,yBAAA;;KACD;AAED,IAAY,0BAAL,yBAAA,yBAAA;AACL,yBAAA,aAAA;AACA,yBAAA,qBAAA;AACA,yBAAA,mBAAA;;KACD;AAED,IAAY,wBAAL,yBAAA,uBAAA;AACL,uBAAA,iBAAA;;KACD;AAED,IAAY,sBAAL,yBAAA,qBAAA;AACL,qBAAA,gBAAA;AACA,qBAAA,kBAAA;;KACD;AAED,IAAY,sBAAL,yBAAA,qBAAA;AACL,qBAAA,WAAA;AACA,qBAAA,eAAA;AACA,qBAAA,uBAAA;AACA,qBAAA,gBAAA;AACA,qBAAA,wBAAA;;KACD"}

package/build/middlewares/body-parser.d.ts

@@ -0,0 +1,8 @@
+import { Application, Router } from 'express';
+import { Config } from '@verdaccio/types';
+/**
+ * Register JSON body parser on a router if not already registered
+ * @param app Express router instance
+ * @param config Verdaccio config
+ */
+export declare function registerBodyParser(app: Router | Application, config: Config): void;

package/build/middlewares/body-parser.js

@@ -0,0 +1,31 @@
+const require_runtime = require("../_virtual/_rolldown/runtime.js");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+let express = require("express");
+express = require_runtime.__toESM(express);
+//#region src/middlewares/body-parser.ts
+var debug$1 = (0, debug.default)("verdaccio:middleware:body-parser");
+/**
+* Check if a body parser is already registered on the router
+*/
+function hasBodyParser(app) {
+	return (app.stack || app._router?.stack || []).some((middleware) => {
+		return middleware.handle?.name === "jsonParser" || middleware.name === "jsonParser";
+	});
+}
+/**
+* Register JSON body parser on a router if not already registered
+* @param app Express router instance
+* @param config Verdaccio config
+*/
+function registerBodyParser(app, config) {
+	if (hasBodyParser(app)) debug$1("json parser already registered");
+	else app.use(express.default.json({
+		strict: false,
+		limit: config.max_body_size || "10mb"
+	}));
+}
+//#endregion
+exports.registerBodyParser = registerBodyParser;
+
+//# sourceMappingURL=body-parser.js.map

package/build/middlewares/body-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-parser.js","names":[],"sources":["../../src/middlewares/body-parser.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Application, Router } from 'express';\nimport express from 'express';\n\nimport type { Config } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:middleware:body-parser');\n\n/**\n * Check if a body parser is already registered on the router\n */\nfunction hasBodyParser(app: Router | Application): boolean {\n  // @ts-ignore - Express internals: app.stack is not part of the public API\n  const stack = (app as any).stack || (app as any)._router?.stack || [];\n  return stack.some((middleware: any) => {\n    return middleware.handle?.name === 'jsonParser' || middleware.name === 'jsonParser';\n  });\n}\n\n/**\n * Register JSON body parser on a router if not already registered\n * @param app Express router instance\n * @param config Verdaccio config\n */\nexport function registerBodyParser(app: Router | Application, config: Config): void {\n  // middleware might have registered a json parser already\n  if (hasBodyParser(app)) {\n    debug('json parser already registered');\n  } else {\n    app.use(\n      express.json({\n        strict: false,\n        limit: config.max_body_size || '10mb',\n      })\n    );\n  }\n}\n"],"mappings":";;;;;;AAMA,IAAM,WAAA,GAAA,MAAA,SAAmB,mCAAmC;;;;AAK5D,SAAS,cAAc,KAAoC;AAGzD,SADe,IAAY,SAAU,IAAY,SAAS,SAAS,EAAE,EACxD,MAAM,eAAoB;AACrC,SAAO,WAAW,QAAQ,SAAS,gBAAgB,WAAW,SAAS;GACvE;;;;;;;AAQJ,SAAgB,mBAAmB,KAA2B,QAAsB;AAElF,KAAI,cAAc,IAAI,CACpB,SAAM,iCAAiC;KAEvC,KAAI,IACF,QAAA,QAAQ,KAAK;EACX,QAAQ;EACR,OAAO,OAAO,iBAAiB;EAChC,CAAC,CACH"}

package/build/middlewares/body-parser.mjs

@@ -0,0 +1,28 @@
+import buildDebug from "debug";
+import express from "express";
+//#region src/middlewares/body-parser.ts
+var debug = buildDebug("verdaccio:middleware:body-parser");
+/**
+* Check if a body parser is already registered on the router
+*/
+function hasBodyParser(app) {
+	return (app.stack || app._router?.stack || []).some((middleware) => {
+		return middleware.handle?.name === "jsonParser" || middleware.name === "jsonParser";
+	});
+}
+/**
+* Register JSON body parser on a router if not already registered
+* @param app Express router instance
+* @param config Verdaccio config
+*/
+function registerBodyParser(app, config) {
+	if (hasBodyParser(app)) debug("json parser already registered");
+	else app.use(express.json({
+		strict: false,
+		limit: config.max_body_size || "10mb"
+	}));
+}
+//#endregion
+export { registerBodyParser };
+
+//# sourceMappingURL=body-parser.mjs.map

package/build/middlewares/body-parser.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-parser.mjs","names":[],"sources":["../../src/middlewares/body-parser.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Application, Router } from 'express';\nimport express from 'express';\n\nimport type { Config } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:middleware:body-parser');\n\n/**\n * Check if a body parser is already registered on the router\n */\nfunction hasBodyParser(app: Router | Application): boolean {\n  // @ts-ignore - Express internals: app.stack is not part of the public API\n  const stack = (app as any).stack || (app as any)._router?.stack || [];\n  return stack.some((middleware: any) => {\n    return middleware.handle?.name === 'jsonParser' || middleware.name === 'jsonParser';\n  });\n}\n\n/**\n * Register JSON body parser on a router if not already registered\n * @param app Express router instance\n * @param config Verdaccio config\n */\nexport function registerBodyParser(app: Router | Application, config: Config): void {\n  // middleware might have registered a json parser already\n  if (hasBodyParser(app)) {\n    debug('json parser already registered');\n  } else {\n    app.use(\n      express.json({\n        strict: false,\n        limit: config.max_body_size || '10mb',\n      })\n    );\n  }\n}\n"],"mappings":";;;AAMA,IAAM,QAAQ,WAAW,mCAAmC;;;;AAK5D,SAAS,cAAc,KAAoC;AAGzD,SADe,IAAY,SAAU,IAAY,SAAS,SAAS,EAAE,EACxD,MAAM,eAAoB;AACrC,SAAO,WAAW,QAAQ,SAAS,gBAAgB,WAAW,SAAS;GACvE;;;;;;;AAQJ,SAAgB,mBAAmB,KAA2B,QAAsB;AAElF,KAAI,cAAc,IAAI,CACpB,OAAM,iCAAiC;KAEvC,KAAI,IACF,QAAQ,KAAK;EACX,QAAQ;EACR,OAAO,OAAO,iBAAiB;EAChC,CAAC,CACH"}

package/build/middlewares/dotfiles.d.ts

@@ -1,4 +1,4 @@
-import type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
 export type DotfilesPolicy = 'allow' | 'deny' | 'ignore';
 /**
  * Middleware that controls how requests with dotfile path segments

package/build/middlewares/dotfiles.js

@@ -1,31 +1,28 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.dotfiles = dotfiles;
-var _core = require("@verdaccio/core");
+require("../_virtual/_rolldown/runtime.js");
+let _verdaccio_core = require("@verdaccio/core");
+//#region src/middlewares/dotfiles.ts
 /**
- * Middleware that controls how requests with dotfile path segments
- * (e.g. /.env, /.well-known/, /.git/) are handled.
- *
- * Mirrors the semantics of serve-static's `dotfiles` option:
- * - 'deny': respond with 403
- * - 'ignore': respond with 404 (default)
- * - 'allow': pass through to next middleware
- */
-function dotfiles(policy = 'ignore') {
-  return function dotfilesMiddleware(req, res, next) {
-    if (policy !== 'allow' && req.path.split('/').some(segment => segment.startsWith('.') && segment.length > 1)) {
-      if (policy === 'deny') {
-        res.statusCode = _core.HTTP_STATUS.FORBIDDEN;
-        res.end();
-      } else {
-        next(_core.errorUtils.getNotFound('resource not found'));
-      }
-      return;
-    }
-    next();
-  };
+* Middleware that controls how requests with dotfile path segments
+* (e.g. /.env, /.well-known/, /.git/) are handled.
+*
+* Mirrors the semantics of serve-static's `dotfiles` option:
+* - 'deny': respond with 403
+* - 'ignore': respond with 404 (default)
+* - 'allow': pass through to next middleware
+*/
+function dotfiles(policy = "ignore") {
+	return function dotfilesMiddleware(req, res, next) {
+		if (policy !== "allow" && req.path.split("/").some((segment) => segment.startsWith(".") && segment.length > 1)) {
+			if (policy === "deny") {
+				res.statusCode = _verdaccio_core.HTTP_STATUS.FORBIDDEN;
+				res.end();
+			} else next(_verdaccio_core.errorUtils.getNotFound("resource not found"));
+			return;
+		}
+		next();
+	};
 }
+//#endregion
+exports.dotfiles = dotfiles;
+
 //# sourceMappingURL=dotfiles.js.map

package/build/middlewares/dotfiles.js.map

@@ -1 +1 @@
-{"version":3,"file":"dotfiles.js","names":["_core","require","dotfiles","policy","dotfilesMiddleware","req","res","next","path","split","some","segment","startsWith","length","statusCode","HTTP_STATUS","FORBIDDEN","end","errorUtils","getNotFound"],"sources":["../../src/middlewares/dotfiles.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport type DotfilesPolicy = 'allow' | 'deny' | 'ignore';\n\n/**\n * Middleware that controls how requests with dotfile path segments\n * (e.g. /.env, /.well-known/, /.git/) are handled.\n *\n * Mirrors the semantics of serve-static's `dotfiles` option:\n * - 'deny': respond with 403\n * - 'ignore': respond with 404 (default)\n * - 'allow': pass through to next middleware\n */\nexport function dotfiles(policy: DotfilesPolicy = 'ignore') {\n  return function dotfilesMiddleware(\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): void {\n    if (\n      policy !== 'allow' &&\n      req.path.split('/').some((segment) => segment.startsWith('.') && segment.length > 1)\n    ) {\n      if (policy === 'deny') {\n        res.statusCode = HTTP_STATUS.FORBIDDEN;\n        res.end();\n      } else {\n        next(errorUtils.getNotFound('resource not found'));\n      }\n      return;\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,QAAQA,CAACC,MAAsB,GAAG,QAAQ,EAAE;EAC1D,OAAO,SAASC,kBAAkBA,CAChCC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;IACN,IACEJ,MAAM,KAAK,OAAO,IAClBE,GAAG,CAACG,IAAI,CAACC,KAAK,CAAC,GAAG,CAAC,CAACC,IAAI,CAAEC,OAAO,IAAKA,OAAO,CAACC,UAAU,CAAC,GAAG,CAAC,IAAID,OAAO,CAACE,MAAM,GAAG,CAAC,CAAC,EACpF;MACA,IAAIV,MAAM,KAAK,MAAM,EAAE;QACrBG,GAAG,CAACQ,UAAU,GAAGC,iBAAW,CAACC,SAAS;QACtCV,GAAG,CAACW,GAAG,CAAC,CAAC;MACX,CAAC,MAAM;QACLV,IAAI,CAACW,gBAAU,CAACC,WAAW,CAAC,oBAAoB,CAAC,CAAC;MACpD;MACA;IACF;IACAZ,IAAI,CAAC,CAAC;EACR,CAAC;AACH","ignoreList":[]}
+{"version":3,"file":"dotfiles.js","names":[],"sources":["../../src/middlewares/dotfiles.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport type DotfilesPolicy = 'allow' | 'deny' | 'ignore';\n\n/**\n * Middleware that controls how requests with dotfile path segments\n * (e.g. /.env, /.well-known/, /.git/) are handled.\n *\n * Mirrors the semantics of serve-static's `dotfiles` option:\n * - 'deny': respond with 403\n * - 'ignore': respond with 404 (default)\n * - 'allow': pass through to next middleware\n */\nexport function dotfiles(policy: DotfilesPolicy = 'ignore') {\n  return function dotfilesMiddleware(\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): void {\n    if (\n      policy !== 'allow' &&\n      req.path.split('/').some((segment) => segment.startsWith('.') && segment.length > 1)\n    ) {\n      if (policy === 'deny') {\n        res.statusCode = HTTP_STATUS.FORBIDDEN;\n        res.end();\n      } else {\n        next(errorUtils.getNotFound('resource not found'));\n      }\n      return;\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;;;;;;AAeA,SAAgB,SAAS,SAAyB,UAAU;AAC1D,QAAO,SAAS,mBACd,KACA,KACA,MACM;AACN,MACE,WAAW,WACX,IAAI,KAAK,MAAM,IAAI,CAAC,MAAM,YAAY,QAAQ,WAAW,IAAI,IAAI,QAAQ,SAAS,EAAE,EACpF;AACA,OAAI,WAAW,QAAQ;AACrB,QAAI,aAAa,gBAAA,YAAY;AAC7B,QAAI,KAAK;SAET,MAAK,gBAAA,WAAW,YAAY,qBAAqB,CAAC;AAEpD;;AAEF,QAAM"}

package/build/middlewares/dotfiles.mjs

@@ -0,0 +1,27 @@
+import { HTTP_STATUS, errorUtils } from "@verdaccio/core";
+//#region src/middlewares/dotfiles.ts
+/**
+* Middleware that controls how requests with dotfile path segments
+* (e.g. /.env, /.well-known/, /.git/) are handled.
+*
+* Mirrors the semantics of serve-static's `dotfiles` option:
+* - 'deny': respond with 403
+* - 'ignore': respond with 404 (default)
+* - 'allow': pass through to next middleware
+*/
+function dotfiles(policy = "ignore") {
+	return function dotfilesMiddleware(req, res, next) {
+		if (policy !== "allow" && req.path.split("/").some((segment) => segment.startsWith(".") && segment.length > 1)) {
+			if (policy === "deny") {
+				res.statusCode = HTTP_STATUS.FORBIDDEN;
+				res.end();
+			} else next(errorUtils.getNotFound("resource not found"));
+			return;
+		}
+		next();
+	};
+}
+//#endregion
+export { dotfiles };
+
+//# sourceMappingURL=dotfiles.mjs.map

package/build/middlewares/dotfiles.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"dotfiles.mjs","names":[],"sources":["../../src/middlewares/dotfiles.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport type DotfilesPolicy = 'allow' | 'deny' | 'ignore';\n\n/**\n * Middleware that controls how requests with dotfile path segments\n * (e.g. /.env, /.well-known/, /.git/) are handled.\n *\n * Mirrors the semantics of serve-static's `dotfiles` option:\n * - 'deny': respond with 403\n * - 'ignore': respond with 404 (default)\n * - 'allow': pass through to next middleware\n */\nexport function dotfiles(policy: DotfilesPolicy = 'ignore') {\n  return function dotfilesMiddleware(\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): void {\n    if (\n      policy !== 'allow' &&\n      req.path.split('/').some((segment) => segment.startsWith('.') && segment.length > 1)\n    ) {\n      if (policy === 'deny') {\n        res.statusCode = HTTP_STATUS.FORBIDDEN;\n        res.end();\n      } else {\n        next(errorUtils.getNotFound('resource not found'));\n      }\n      return;\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;;;;;AAeA,SAAgB,SAAS,SAAyB,UAAU;AAC1D,QAAO,SAAS,mBACd,KACA,KACA,MACM;AACN,MACE,WAAW,WACX,IAAI,KAAK,MAAM,IAAI,CAAC,MAAM,YAAY,QAAQ,WAAW,IAAI,IAAI,QAAQ,SAAS,EAAE,EACpF;AACA,OAAI,WAAW,QAAQ;AACrB,QAAI,aAAa,YAAY;AAC7B,QAAI,KAAK;SAET,MAAK,WAAW,YAAY,qBAAqB,CAAC;AAEpD;;AAEF,QAAM"}

package/build/middlewares/encode-pkg.d.ts

@@ -1,4 +1,4 @@
-import type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
 /**
  * Encode / in a scoped package name to be matched as a single parameter in routes
  * @param req

package/build/middlewares/encode-pkg.js

@@ -1,40 +1,24 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.encodeScopePackage = encodeScopePackage;
-var _debug = _interopRequireDefault(require("debug"));
-var _core = require("@verdaccio/core");
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-const debug = (0, _debug.default)('verdaccio:middleware:encode');
-
+const require_runtime = require("../_virtual/_rolldown/runtime.js");
+let _verdaccio_core = require("@verdaccio/core");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+//#region src/middlewares/encode-pkg.ts
+var debug$1 = (0, debug.default)("verdaccio:middleware:encode");
 /**
- * Encode / in a scoped package name to be matched as a single parameter in routes
- * @param req
- * @param res
- * @param next
- */
+* Encode / in a scoped package name to be matched as a single parameter in routes
+* @param req
+* @param res
+* @param next
+*/
 function encodeScopePackage(req, res, next) {
-  const original = req.url;
-
-  // Expect relative URLs i.e. should call makeURLrelative before this middleware
-  if (!req.url.startsWith('/')) {
-    return next(_core.errorUtils.getBadRequest(`Invalid URL: ${req.url} (must be relative)`));
-  }
-
-  // If the @ sign is encoded, we need to decode it first
-  // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3
-  // For scoped packages, encode the slash to make it a single path segment/parameter
-  // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3
-  // also handle cases for dist-tags where package is in the middle of the path and not at the beginning
-  // e.g.: /-/package/@org/pkg/dist-tags/latest -> /-/package/@org%2Fpkg/dist-tags/latest
-  req.url = req.url.replace(/\/%40/, '/@').replace(/(\/@[^\/%]+)\/(?!$)/, '$1%2F');
-  if (original !== req.url) {
-    debug('encodeScopePackage: %o -> %o', original, req.url);
-  } else {
-    debug('encodeScopePackage: %o (unchanged)', original);
-  }
-  next();
+	const original = req.url;
+	if (!req.url.startsWith("/")) return next(_verdaccio_core.errorUtils.getBadRequest(`Invalid URL: ${req.url} (must be relative)`));
+	req.url = req.url.replace(/\/%40/, "/@").replace(/(\/@[^\/%]+)\/(?!$)/, "$1%2F");
+	if (original !== req.url) debug$1("encodeScopePackage: %o -> %o", original, req.url);
+	else debug$1("encodeScopePackage: %o (unchanged)", original);
+	next();
 }
+//#endregion
+exports.encodeScopePackage = encodeScopePackage;
+
 //# sourceMappingURL=encode-pkg.js.map

package/build/middlewares/encode-pkg.js.map

@@ -1 +1 @@
-{"version":3,"file":"encode-pkg.js","names":["_debug","_interopRequireDefault","require","_core","e","__esModule","default","debug","buildDebug","encodeScopePackage","req","res","next","original","url","startsWith","errorUtils","getBadRequest","replace"],"sources":["../../src/middlewares/encode-pkg.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:encode');\n\n/**\n * Encode / in a scoped package name to be matched as a single parameter in routes\n * @param req\n * @param res\n * @param next\n */\nexport function encodeScopePackage(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n\n  // Expect relative URLs i.e. should call makeURLrelative before this middleware\n  if (!req.url.startsWith('/')) {\n    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (must be relative)`));\n  }\n\n  // If the @ sign is encoded, we need to decode it first\n  // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3\n  // For scoped packages, encode the slash to make it a single path segment/parameter\n  // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n  // also handle cases for dist-tags where package is in the middle of the path and not at the beginning\n  // e.g.: /-/package/@org/pkg/dist-tags/latest -> /-/package/@org%2Fpkg/dist-tags/latest\n  req.url = req.url.replace(/\\/%40/, '/@').replace(/(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n\n  if (original !== req.url) {\n    debug('encodeScopePackage: %o -> %o', original, req.url);\n  } else {\n    debug('encodeScopePackage: %o (unchanged)', original);\n  }\n  next();\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAD,OAAA;AAA6C,SAAAD,uBAAAG,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAI7C,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,6BAA6B,CAAC;;AAEvD;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,kBAAkBA,CAChCC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;EACN,MAAMC,QAAQ,GAAGH,GAAG,CAACI,GAAG;;EAExB;EACA,IAAI,CAACJ,GAAG,CAACI,GAAG,CAACC,UAAU,CAAC,GAAG,CAAC,EAAE;IAC5B,OAAOH,IAAI,CAACI,gBAAU,CAACC,aAAa,CAAC,gBAAgBP,GAAG,CAACI,GAAG,qBAAqB,CAAC,CAAC;EACrF;;EAEA;EACA;EACA;EACA;EACA;EACA;EACAJ,GAAG,CAACI,GAAG,GAAGJ,GAAG,CAACI,GAAG,CAACI,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAACA,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC;EAEhF,IAAIL,QAAQ,KAAKH,GAAG,CAACI,GAAG,EAAE;IACxBP,KAAK,CAAC,8BAA8B,EAAEM,QAAQ,EAAEH,GAAG,CAACI,GAAG,CAAC;EAC1D,CAAC,MAAM;IACLP,KAAK,CAAC,oCAAoC,EAAEM,QAAQ,CAAC;EACvD;EACAD,IAAI,CAAC,CAAC;AACR","ignoreList":[]}
+{"version":3,"file":"encode-pkg.js","names":[],"sources":["../../src/middlewares/encode-pkg.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:encode');\n\n/**\n * Encode / in a scoped package name to be matched as a single parameter in routes\n * @param req\n * @param res\n * @param next\n */\nexport function encodeScopePackage(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n\n  // Expect relative URLs i.e. should call makeURLrelative before this middleware\n  if (!req.url.startsWith('/')) {\n    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (must be relative)`));\n  }\n\n  // If the @ sign is encoded, we need to decode it first\n  // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3\n  // For scoped packages, encode the slash to make it a single path segment/parameter\n  // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n  // also handle cases for dist-tags where package is in the middle of the path and not at the beginning\n  // e.g.: /-/package/@org/pkg/dist-tags/latest -> /-/package/@org%2Fpkg/dist-tags/latest\n  req.url = req.url.replace(/\\/%40/, '/@').replace(/(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n\n  if (original !== req.url) {\n    debug('encodeScopePackage: %o -> %o', original, req.url);\n  } else {\n    debug('encodeScopePackage: %o (unchanged)', original);\n  }\n  next();\n}\n"],"mappings":";;;;;AAMA,IAAM,WAAA,GAAA,MAAA,SAAmB,8BAA8B;;;;;;;AAQvD,SAAgB,mBACd,KACA,KACA,MACM;CACN,MAAM,WAAW,IAAI;AAGrB,KAAI,CAAC,IAAI,IAAI,WAAW,IAAI,CAC1B,QAAO,KAAK,gBAAA,WAAW,cAAc,gBAAgB,IAAI,IAAI,qBAAqB,CAAC;AASrF,KAAI,MAAM,IAAI,IAAI,QAAQ,SAAS,KAAK,CAAC,QAAQ,uBAAuB,QAAQ;AAEhF,KAAI,aAAa,IAAI,IACnB,SAAM,gCAAgC,UAAU,IAAI,IAAI;KAExD,SAAM,sCAAsC,SAAS;AAEvD,OAAM"}

package/build/middlewares/encode-pkg.mjs

@@ -0,0 +1,22 @@
+import { errorUtils } from "@verdaccio/core";
+import buildDebug from "debug";
+//#region src/middlewares/encode-pkg.ts
+var debug = buildDebug("verdaccio:middleware:encode");
+/**
+* Encode / in a scoped package name to be matched as a single parameter in routes
+* @param req
+* @param res
+* @param next
+*/
+function encodeScopePackage(req, res, next) {
+	const original = req.url;
+	if (!req.url.startsWith("/")) return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (must be relative)`));
+	req.url = req.url.replace(/\/%40/, "/@").replace(/(\/@[^\/%]+)\/(?!$)/, "$1%2F");
+	if (original !== req.url) debug("encodeScopePackage: %o -> %o", original, req.url);
+	else debug("encodeScopePackage: %o (unchanged)", original);
+	next();
+}
+//#endregion
+export { encodeScopePackage };
+
+//# sourceMappingURL=encode-pkg.mjs.map

package/build/middlewares/encode-pkg.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"encode-pkg.mjs","names":[],"sources":["../../src/middlewares/encode-pkg.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:encode');\n\n/**\n * Encode / in a scoped package name to be matched as a single parameter in routes\n * @param req\n * @param res\n * @param next\n */\nexport function encodeScopePackage(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n\n  // Expect relative URLs i.e. should call makeURLrelative before this middleware\n  if (!req.url.startsWith('/')) {\n    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (must be relative)`));\n  }\n\n  // If the @ sign is encoded, we need to decode it first\n  // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3\n  // For scoped packages, encode the slash to make it a single path segment/parameter\n  // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n  // also handle cases for dist-tags where package is in the middle of the path and not at the beginning\n  // e.g.: /-/package/@org/pkg/dist-tags/latest -> /-/package/@org%2Fpkg/dist-tags/latest\n  req.url = req.url.replace(/\\/%40/, '/@').replace(/(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n\n  if (original !== req.url) {\n    debug('encodeScopePackage: %o -> %o', original, req.url);\n  } else {\n    debug('encodeScopePackage: %o (unchanged)', original);\n  }\n  next();\n}\n"],"mappings":";;;AAMA,IAAM,QAAQ,WAAW,8BAA8B;;;;;;;AAQvD,SAAgB,mBACd,KACA,KACA,MACM;CACN,MAAM,WAAW,IAAI;AAGrB,KAAI,CAAC,IAAI,IAAI,WAAW,IAAI,CAC1B,QAAO,KAAK,WAAW,cAAc,gBAAgB,IAAI,IAAI,qBAAqB,CAAC;AASrF,KAAI,MAAM,IAAI,IAAI,QAAQ,SAAS,KAAK,CAAC,QAAQ,uBAAuB,QAAQ;AAEhF,KAAI,aAAa,IAAI,IACnB,OAAM,gCAAgC,UAAU,IAAI,IAAI;KAExD,OAAM,sCAAsC,SAAS;AAEvD,OAAM"}

package/build/middlewares/error.d.ts

@@ -1,5 +1,5 @@
-import type { HttpError } from 'http-errors';
-import type { Logger } from '@verdaccio/types';
-import type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+import { HttpError } from 'http-errors';
+import { Logger } from '@verdaccio/types';
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
 export declare const handleError: (logger: Logger) => (err: HttpError, req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) => any;
 export declare const errorReportingMiddleware: (logger: Logger) => (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) => void;