@verdaccio/package-filter 13.0.4 → 13.1.0

package/build/packageFilter.js

@@ -0,0 +1,86 @@
+const require_runtime = require("./_virtual/_rolldown/runtime.js");
+const require_parser = require("./config/parser.js");
+const require_packageVersion = require("./filtering/packageVersion.js");
+const require_publishDate = require("./filtering/publishDate.js");
+const require_jsonUtils = require("./utils/jsonUtils.js");
+const require_manifestUtils = require("./utils/manifestUtils.js");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+let _verdaccio_core = require("@verdaccio/core");
+//#region src/packageFilter.ts
+var debug$1 = (0, debug.default)("verdaccio:plugin:package-filter");
+var PackageFilterPlugin = class extends _verdaccio_core.pluginUtils.Plugin {
+	config;
+	parsedConfig;
+	logger;
+	constructor(config, options) {
+		super(config, options);
+		this.config = config ?? {};
+		this.logger = options.logger;
+		this.parsedConfig = require_parser.parseConfig(this.config);
+		debug$1("plugin loaded: block rules: %d, allow rules: %d", this.parsedConfig.blockRules.size, this.parsedConfig.allowRules.size);
+		this.logger.debug({ config: JSON.stringify(this.parsedConfig, require_jsonUtils.jsonLogReplacer) }, "package-filter loaded with config: @{config}");
+		this.logger.trace({
+			blockRules: this.parsedConfig.blockRules.size,
+			allowRules: this.parsedConfig.allowRules.size
+		}, "package-filter plugin initialized: @{blockRules} block rules, @{allowRules} allow rules");
+		if (this.parsedConfig.dateThreshold) {
+			debug$1("date threshold: %s", this.parsedConfig.dateThreshold.toISOString());
+			this.logger.trace({ dateThreshold: this.parsedConfig.dateThreshold.toISOString() }, "package-filter date threshold: @{dateThreshold}");
+		}
+		if (this.parsedConfig.minAgeMs) {
+			const minAgeDays = this.parsedConfig.minAgeMs / (1440 * 60 * 1e3);
+			debug$1("min age: %d days", minAgeDays);
+			this.logger.trace({ minAgeDays }, "package-filter min age: @{minAgeDays} days");
+		}
+	}
+	async filter_metadata(manifest) {
+		const { dateThreshold, minAgeMs, blockRules, allowRules } = this.parsedConfig;
+		const versionCount = Object.keys(manifest.versions ?? {}).length;
+		debug$1("filtering manifest for %s (%d versions)", manifest.name, versionCount);
+		this.logger.trace({
+			name: manifest.name,
+			versionCount
+		}, "package-filter processing @{name} (@{versionCount} versions)");
+		let earliestDateThreshold = null;
+		if (minAgeMs) earliestDateThreshold = new Date(Date.now() - minAgeMs);
+		if (dateThreshold && (!earliestDateThreshold || dateThreshold < earliestDateThreshold)) earliestDateThreshold = dateThreshold;
+		if (blockRules.size === 0 && !earliestDateThreshold) {
+			debug$1("no filters configured, returning manifest untouched for %s", manifest.name);
+			return manifest;
+		}
+		let newManifest = require_manifestUtils.getManifestClone(manifest);
+		if (blockRules.size > 0) newManifest = require_packageVersion.filterBlockedVersions(newManifest, blockRules, allowRules, this.logger);
+		if (earliestDateThreshold) {
+			debug$1("applying date filter for %s, threshold: %s", manifest.name, earliestDateThreshold.toISOString());
+			this.logger.trace({
+				name: manifest.name,
+				threshold: earliestDateThreshold.toISOString()
+			}, "applying date filter for @{name}, cutoff: @{threshold}");
+			newManifest = require_publishDate.filterVersionsByPublishDate(newManifest, earliestDateThreshold, allowRules);
+		}
+		const filteredCount = Object.keys(newManifest.versions).length;
+		const removedCount = versionCount - filteredCount;
+		if (removedCount > 0 || newManifest.readme !== manifest.readme) {
+			require_manifestUtils.cleanupTags(newManifest);
+			require_manifestUtils.setupLatestTag(newManifest);
+			require_manifestUtils.cleanupTime(newManifest);
+			require_manifestUtils.setupCreatedAndModified(newManifest);
+			require_manifestUtils.cleanupDistFiles(newManifest);
+		}
+		if (removedCount > 0) {
+			debug$1("filtered %s: %d -> %d versions (%d removed)", manifest.name, versionCount, filteredCount, removedCount);
+			this.logger.trace({
+				name: manifest.name,
+				before: versionCount,
+				after: filteredCount,
+				removed: removedCount
+			}, "package-filter @{name}: @{before} -> @{after} versions (@{removed} removed)");
+		} else debug$1("no versions filtered for %s", manifest.name);
+		return newManifest;
+	}
+};
+//#endregion
+exports.PackageFilterPlugin = PackageFilterPlugin;
+
+//# sourceMappingURL=packageFilter.js.map

package/build/packageFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"packageFilter.js","names":[],"sources":["../src/packageFilter.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { pluginUtils } from '@verdaccio/core';\nimport type { Logger, Manifest } from '@verdaccio/types';\n\nimport { parseConfig } from './config/parser';\nimport type { ParsedConfig, PluginConfig } from './config/types';\nimport { filterBlockedVersions } from './filtering/packageVersion';\nimport { filterVersionsByPublishDate } from './filtering/publishDate';\nimport { jsonLogReplacer } from './utils/jsonUtils';\nimport {\n  cleanupDistFiles,\n  cleanupTags,\n  cleanupTime,\n  getManifestClone,\n  setupCreatedAndModified,\n  setupLatestTag,\n} from './utils/manifestUtils';\n\nconst debug = buildDebug('verdaccio:plugin:package-filter');\n\nexport class PackageFilterPlugin\n  extends pluginUtils.Plugin<PluginConfig>\n  implements pluginUtils.ManifestFilter<PluginConfig>\n{\n  public readonly config: PluginConfig;\n  private readonly parsedConfig: ParsedConfig;\n  protected readonly logger: Logger;\n\n  public constructor(config: PluginConfig, options: pluginUtils.PluginOptions) {\n    super(config, options);\n    this.config = config ?? {};\n    this.logger = options.logger;\n    this.parsedConfig = parseConfig(this.config);\n\n    debug(\n      'plugin loaded: block rules: %d, allow rules: %d',\n      this.parsedConfig.blockRules.size,\n      this.parsedConfig.allowRules.size\n    );\n    this.logger.debug(\n      { config: JSON.stringify(this.parsedConfig, jsonLogReplacer) },\n      'package-filter loaded with config: @{config}'\n    );\n    this.logger.trace(\n      {\n        blockRules: this.parsedConfig.blockRules.size,\n        allowRules: this.parsedConfig.allowRules.size,\n      },\n      'package-filter plugin initialized: @{blockRules} block rules, @{allowRules} allow rules'\n    );\n    if (this.parsedConfig.dateThreshold) {\n      debug('date threshold: %s', this.parsedConfig.dateThreshold.toISOString());\n      this.logger.trace(\n        { dateThreshold: this.parsedConfig.dateThreshold.toISOString() },\n        'package-filter date threshold: @{dateThreshold}'\n      );\n    }\n    if (this.parsedConfig.minAgeMs) {\n      const minAgeDays = this.parsedConfig.minAgeMs / (24 * 60 * 60 * 1000);\n      debug('min age: %d days', minAgeDays);\n      this.logger.trace({ minAgeDays }, 'package-filter min age: @{minAgeDays} days');\n    }\n  }\n\n  public async filter_metadata(manifest: Readonly<Manifest>): Promise<Manifest> {\n    const { dateThreshold, minAgeMs, blockRules, allowRules } = this.parsedConfig;\n    const versionCount = Object.keys(manifest.versions ?? {}).length;\n    debug('filtering manifest for %s (%d versions)', manifest.name, versionCount);\n    this.logger.trace(\n      { name: manifest.name, versionCount },\n      'package-filter processing @{name} (@{versionCount} versions)'\n    );\n\n    let earliestDateThreshold: Date | null = null;\n    if (minAgeMs) {\n      earliestDateThreshold = new Date(Date.now() - minAgeMs);\n    }\n\n    if (dateThreshold && (!earliestDateThreshold || dateThreshold < earliestDateThreshold)) {\n      earliestDateThreshold = dateThreshold;\n    }\n\n    // Fast path: when neither block rules nor a date threshold are configured there\n    // is nothing this filter can change. Returning the manifest untouched avoids the\n    // clone and the cleanup passes below. This matters most for `npm search`, which\n    // invokes filter_metadata once per matched package (see issue #5837).\n    if (blockRules.size === 0 && !earliestDateThreshold) {\n      debug('no filters configured, returning manifest untouched for %s', manifest.name);\n      return manifest as Manifest;\n    }\n\n    let newManifest = getManifestClone(manifest);\n    if (blockRules.size > 0) {\n      newManifest = filterBlockedVersions(newManifest, blockRules, allowRules, this.logger);\n    }\n\n    if (earliestDateThreshold) {\n      debug(\n        'applying date filter for %s, threshold: %s',\n        manifest.name,\n        earliestDateThreshold.toISOString()\n      );\n      this.logger.trace(\n        { name: manifest.name, threshold: earliestDateThreshold.toISOString() },\n        'applying date filter for @{name}, cutoff: @{threshold}'\n      );\n      newManifest = filterVersionsByPublishDate(newManifest, earliestDateThreshold, allowRules);\n    }\n\n    const filteredCount = Object.keys(newManifest.versions).length;\n    const removedCount = versionCount - filteredCount;\n    // The cleanup passes only repair inconsistencies introduced by filtering:\n    // orphaned dist-tags/time/_distfiles entries and a `latest` tag pointing at a\n    // removed version. When the filters left the manifest untouched (no version\n    // removed or replaced) it is already consistent, so the passes are skipped.\n    // `readme` changing is the signal that the (count-preserving) replace strategy\n    // rewrote version content and the cleanup still needs to run.\n    const wasModified = removedCount > 0 || newManifest.readme !== manifest.readme;\n    if (wasModified) {\n      cleanupTags(newManifest);\n      setupLatestTag(newManifest);\n      cleanupTime(newManifest);\n      setupCreatedAndModified(newManifest);\n      cleanupDistFiles(newManifest);\n    }\n\n    if (removedCount > 0) {\n      debug(\n        'filtered %s: %d -> %d versions (%d removed)',\n        manifest.name,\n        versionCount,\n        filteredCount,\n        removedCount\n      );\n      this.logger.trace(\n        { name: manifest.name, before: versionCount, after: filteredCount, removed: removedCount },\n        'package-filter @{name}: @{before} -> @{after} versions (@{removed} removed)'\n      );\n    } else {\n      debug('no versions filtered for %s', manifest.name);\n    }\n\n    return newManifest;\n  }\n}\n"],"mappings":";;;;;;;;;;AAmBA,IAAM,WAAA,GAAA,MAAA,SAAmB,iCAAiC;AAE1D,IAAa,sBAAb,cACU,gBAAA,YAAY,OAEtB;CACE;CACA;CACA;CAEA,YAAmB,QAAsB,SAAoC;EAC3E,MAAM,QAAQ,OAAO;EACrB,KAAK,SAAS,UAAU,CAAC;EACzB,KAAK,SAAS,QAAQ;EACtB,KAAK,eAAe,eAAA,YAAY,KAAK,MAAM;EAE3C,QACE,mDACA,KAAK,aAAa,WAAW,MAC7B,KAAK,aAAa,WAAW,IAC/B;EACA,KAAK,OAAO,MACV,EAAE,QAAQ,KAAK,UAAU,KAAK,cAAc,kBAAA,eAAe,EAAE,GAC7D,8CACF;EACA,KAAK,OAAO,MACV;GACE,YAAY,KAAK,aAAa,WAAW;GACzC,YAAY,KAAK,aAAa,WAAW;EAC3C,GACA,yFACF;EACA,IAAI,KAAK,aAAa,eAAe;GACnC,QAAM,sBAAsB,KAAK,aAAa,cAAc,YAAY,CAAC;GACzE,KAAK,OAAO,MACV,EAAE,eAAe,KAAK,aAAa,cAAc,YAAY,EAAE,GAC/D,iDACF;EACF;EACA,IAAI,KAAK,aAAa,UAAU;GAC9B,MAAM,aAAa,KAAK,aAAa,YAAY,OAAU,KAAK;GAChE,QAAM,oBAAoB,UAAU;GACpC,KAAK,OAAO,MAAM,EAAE,WAAW,GAAG,4CAA4C;EAChF;CACF;CAEA,MAAa,gBAAgB,UAAiD;EAC5E,MAAM,EAAE,eAAe,UAAU,YAAY,eAAe,KAAK;EACjE,MAAM,eAAe,OAAO,KAAK,SAAS,YAAY,CAAC,CAAC,EAAE;EAC1D,QAAM,2CAA2C,SAAS,MAAM,YAAY;EAC5E,KAAK,OAAO,MACV;GAAE,MAAM,SAAS;GAAM;EAAa,GACpC,8DACF;EAEA,IAAI,wBAAqC;EACzC,IAAI,UACF,wBAAwB,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ;EAGxD,IAAI,kBAAkB,CAAC,yBAAyB,gBAAgB,wBAC9D,wBAAwB;EAO1B,IAAI,WAAW,SAAS,KAAK,CAAC,uBAAuB;GACnD,QAAM,8DAA8D,SAAS,IAAI;GACjF,OAAO;EACT;EAEA,IAAI,cAAc,sBAAA,iBAAiB,QAAQ;EAC3C,IAAI,WAAW,OAAO,GACpB,cAAc,uBAAA,sBAAsB,aAAa,YAAY,YAAY,KAAK,MAAM;EAGtF,IAAI,uBAAuB;GACzB,QACE,8CACA,SAAS,MACT,sBAAsB,YAAY,CACpC;GACA,KAAK,OAAO,MACV;IAAE,MAAM,SAAS;IAAM,WAAW,sBAAsB,YAAY;GAAE,GACtE,wDACF;GACA,cAAc,oBAAA,4BAA4B,aAAa,uBAAuB,UAAU;EAC1F;EAEA,MAAM,gBAAgB,OAAO,KAAK,YAAY,QAAQ,EAAE;EACxD,MAAM,eAAe,eAAe;EAQpC,IADoB,eAAe,KAAK,YAAY,WAAW,SAAS,QACvD;GACf,sBAAA,YAAY,WAAW;GACvB,sBAAA,eAAe,WAAW;GAC1B,sBAAA,YAAY,WAAW;GACvB,sBAAA,wBAAwB,WAAW;GACnC,sBAAA,iBAAiB,WAAW;EAC9B;EAEA,IAAI,eAAe,GAAG;GACpB,QACE,+CACA,SAAS,MACT,cACA,eACA,YACF;GACA,KAAK,OAAO,MACV;IAAE,MAAM,SAAS;IAAM,QAAQ;IAAc,OAAO;IAAe,SAAS;GAAa,GACzF,6EACF;EACF,OACE,QAAM,+BAA+B,SAAS,IAAI;EAGpD,OAAO;CACT;AACF"}

package/build/packageFilter.mjs

@@ -0,0 +1,84 @@
+import { parseConfig } from "./config/parser.mjs";
+import { filterBlockedVersions } from "./filtering/packageVersion.mjs";
+import { filterVersionsByPublishDate } from "./filtering/publishDate.mjs";
+import { jsonLogReplacer } from "./utils/jsonUtils.mjs";
+import { cleanupDistFiles, cleanupTags, cleanupTime, getManifestClone, setupCreatedAndModified, setupLatestTag } from "./utils/manifestUtils.mjs";
+import buildDebug from "debug";
+import { pluginUtils } from "@verdaccio/core";
+//#region src/packageFilter.ts
+var debug = buildDebug("verdaccio:plugin:package-filter");
+var PackageFilterPlugin = class extends pluginUtils.Plugin {
+	config;
+	parsedConfig;
+	logger;
+	constructor(config, options) {
+		super(config, options);
+		this.config = config ?? {};
+		this.logger = options.logger;
+		this.parsedConfig = parseConfig(this.config);
+		debug("plugin loaded: block rules: %d, allow rules: %d", this.parsedConfig.blockRules.size, this.parsedConfig.allowRules.size);
+		this.logger.debug({ config: JSON.stringify(this.parsedConfig, jsonLogReplacer) }, "package-filter loaded with config: @{config}");
+		this.logger.trace({
+			blockRules: this.parsedConfig.blockRules.size,
+			allowRules: this.parsedConfig.allowRules.size
+		}, "package-filter plugin initialized: @{blockRules} block rules, @{allowRules} allow rules");
+		if (this.parsedConfig.dateThreshold) {
+			debug("date threshold: %s", this.parsedConfig.dateThreshold.toISOString());
+			this.logger.trace({ dateThreshold: this.parsedConfig.dateThreshold.toISOString() }, "package-filter date threshold: @{dateThreshold}");
+		}
+		if (this.parsedConfig.minAgeMs) {
+			const minAgeDays = this.parsedConfig.minAgeMs / (1440 * 60 * 1e3);
+			debug("min age: %d days", minAgeDays);
+			this.logger.trace({ minAgeDays }, "package-filter min age: @{minAgeDays} days");
+		}
+	}
+	async filter_metadata(manifest) {
+		const { dateThreshold, minAgeMs, blockRules, allowRules } = this.parsedConfig;
+		const versionCount = Object.keys(manifest.versions ?? {}).length;
+		debug("filtering manifest for %s (%d versions)", manifest.name, versionCount);
+		this.logger.trace({
+			name: manifest.name,
+			versionCount
+		}, "package-filter processing @{name} (@{versionCount} versions)");
+		let earliestDateThreshold = null;
+		if (minAgeMs) earliestDateThreshold = new Date(Date.now() - minAgeMs);
+		if (dateThreshold && (!earliestDateThreshold || dateThreshold < earliestDateThreshold)) earliestDateThreshold = dateThreshold;
+		if (blockRules.size === 0 && !earliestDateThreshold) {
+			debug("no filters configured, returning manifest untouched for %s", manifest.name);
+			return manifest;
+		}
+		let newManifest = getManifestClone(manifest);
+		if (blockRules.size > 0) newManifest = filterBlockedVersions(newManifest, blockRules, allowRules, this.logger);
+		if (earliestDateThreshold) {
+			debug("applying date filter for %s, threshold: %s", manifest.name, earliestDateThreshold.toISOString());
+			this.logger.trace({
+				name: manifest.name,
+				threshold: earliestDateThreshold.toISOString()
+			}, "applying date filter for @{name}, cutoff: @{threshold}");
+			newManifest = filterVersionsByPublishDate(newManifest, earliestDateThreshold, allowRules);
+		}
+		const filteredCount = Object.keys(newManifest.versions).length;
+		const removedCount = versionCount - filteredCount;
+		if (removedCount > 0 || newManifest.readme !== manifest.readme) {
+			cleanupTags(newManifest);
+			setupLatestTag(newManifest);
+			cleanupTime(newManifest);
+			setupCreatedAndModified(newManifest);
+			cleanupDistFiles(newManifest);
+		}
+		if (removedCount > 0) {
+			debug("filtered %s: %d -> %d versions (%d removed)", manifest.name, versionCount, filteredCount, removedCount);
+			this.logger.trace({
+				name: manifest.name,
+				before: versionCount,
+				after: filteredCount,
+				removed: removedCount
+			}, "package-filter @{name}: @{before} -> @{after} versions (@{removed} removed)");
+		} else debug("no versions filtered for %s", manifest.name);
+		return newManifest;
+	}
+};
+//#endregion
+export { PackageFilterPlugin };
+
+//# sourceMappingURL=packageFilter.mjs.map

package/build/packageFilter.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"packageFilter.mjs","names":[],"sources":["../src/packageFilter.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { pluginUtils } from '@verdaccio/core';\nimport type { Logger, Manifest } from '@verdaccio/types';\n\nimport { parseConfig } from './config/parser';\nimport type { ParsedConfig, PluginConfig } from './config/types';\nimport { filterBlockedVersions } from './filtering/packageVersion';\nimport { filterVersionsByPublishDate } from './filtering/publishDate';\nimport { jsonLogReplacer } from './utils/jsonUtils';\nimport {\n  cleanupDistFiles,\n  cleanupTags,\n  cleanupTime,\n  getManifestClone,\n  setupCreatedAndModified,\n  setupLatestTag,\n} from './utils/manifestUtils';\n\nconst debug = buildDebug('verdaccio:plugin:package-filter');\n\nexport class PackageFilterPlugin\n  extends pluginUtils.Plugin<PluginConfig>\n  implements pluginUtils.ManifestFilter<PluginConfig>\n{\n  public readonly config: PluginConfig;\n  private readonly parsedConfig: ParsedConfig;\n  protected readonly logger: Logger;\n\n  public constructor(config: PluginConfig, options: pluginUtils.PluginOptions) {\n    super(config, options);\n    this.config = config ?? {};\n    this.logger = options.logger;\n    this.parsedConfig = parseConfig(this.config);\n\n    debug(\n      'plugin loaded: block rules: %d, allow rules: %d',\n      this.parsedConfig.blockRules.size,\n      this.parsedConfig.allowRules.size\n    );\n    this.logger.debug(\n      { config: JSON.stringify(this.parsedConfig, jsonLogReplacer) },\n      'package-filter loaded with config: @{config}'\n    );\n    this.logger.trace(\n      {\n        blockRules: this.parsedConfig.blockRules.size,\n        allowRules: this.parsedConfig.allowRules.size,\n      },\n      'package-filter plugin initialized: @{blockRules} block rules, @{allowRules} allow rules'\n    );\n    if (this.parsedConfig.dateThreshold) {\n      debug('date threshold: %s', this.parsedConfig.dateThreshold.toISOString());\n      this.logger.trace(\n        { dateThreshold: this.parsedConfig.dateThreshold.toISOString() },\n        'package-filter date threshold: @{dateThreshold}'\n      );\n    }\n    if (this.parsedConfig.minAgeMs) {\n      const minAgeDays = this.parsedConfig.minAgeMs / (24 * 60 * 60 * 1000);\n      debug('min age: %d days', minAgeDays);\n      this.logger.trace({ minAgeDays }, 'package-filter min age: @{minAgeDays} days');\n    }\n  }\n\n  public async filter_metadata(manifest: Readonly<Manifest>): Promise<Manifest> {\n    const { dateThreshold, minAgeMs, blockRules, allowRules } = this.parsedConfig;\n    const versionCount = Object.keys(manifest.versions ?? {}).length;\n    debug('filtering manifest for %s (%d versions)', manifest.name, versionCount);\n    this.logger.trace(\n      { name: manifest.name, versionCount },\n      'package-filter processing @{name} (@{versionCount} versions)'\n    );\n\n    let earliestDateThreshold: Date | null = null;\n    if (minAgeMs) {\n      earliestDateThreshold = new Date(Date.now() - minAgeMs);\n    }\n\n    if (dateThreshold && (!earliestDateThreshold || dateThreshold < earliestDateThreshold)) {\n      earliestDateThreshold = dateThreshold;\n    }\n\n    // Fast path: when neither block rules nor a date threshold are configured there\n    // is nothing this filter can change. Returning the manifest untouched avoids the\n    // clone and the cleanup passes below. This matters most for `npm search`, which\n    // invokes filter_metadata once per matched package (see issue #5837).\n    if (blockRules.size === 0 && !earliestDateThreshold) {\n      debug('no filters configured, returning manifest untouched for %s', manifest.name);\n      return manifest as Manifest;\n    }\n\n    let newManifest = getManifestClone(manifest);\n    if (blockRules.size > 0) {\n      newManifest = filterBlockedVersions(newManifest, blockRules, allowRules, this.logger);\n    }\n\n    if (earliestDateThreshold) {\n      debug(\n        'applying date filter for %s, threshold: %s',\n        manifest.name,\n        earliestDateThreshold.toISOString()\n      );\n      this.logger.trace(\n        { name: manifest.name, threshold: earliestDateThreshold.toISOString() },\n        'applying date filter for @{name}, cutoff: @{threshold}'\n      );\n      newManifest = filterVersionsByPublishDate(newManifest, earliestDateThreshold, allowRules);\n    }\n\n    const filteredCount = Object.keys(newManifest.versions).length;\n    const removedCount = versionCount - filteredCount;\n    // The cleanup passes only repair inconsistencies introduced by filtering:\n    // orphaned dist-tags/time/_distfiles entries and a `latest` tag pointing at a\n    // removed version. When the filters left the manifest untouched (no version\n    // removed or replaced) it is already consistent, so the passes are skipped.\n    // `readme` changing is the signal that the (count-preserving) replace strategy\n    // rewrote version content and the cleanup still needs to run.\n    const wasModified = removedCount > 0 || newManifest.readme !== manifest.readme;\n    if (wasModified) {\n      cleanupTags(newManifest);\n      setupLatestTag(newManifest);\n      cleanupTime(newManifest);\n      setupCreatedAndModified(newManifest);\n      cleanupDistFiles(newManifest);\n    }\n\n    if (removedCount > 0) {\n      debug(\n        'filtered %s: %d -> %d versions (%d removed)',\n        manifest.name,\n        versionCount,\n        filteredCount,\n        removedCount\n      );\n      this.logger.trace(\n        { name: manifest.name, before: versionCount, after: filteredCount, removed: removedCount },\n        'package-filter @{name}: @{before} -> @{after} versions (@{removed} removed)'\n      );\n    } else {\n      debug('no versions filtered for %s', manifest.name);\n    }\n\n    return newManifest;\n  }\n}\n"],"mappings":";;;;;;;;AAmBA,IAAM,QAAQ,WAAW,iCAAiC;AAE1D,IAAa,sBAAb,cACU,YAAY,OAEtB;CACE;CACA;CACA;CAEA,YAAmB,QAAsB,SAAoC;EAC3E,MAAM,QAAQ,OAAO;EACrB,KAAK,SAAS,UAAU,CAAC;EACzB,KAAK,SAAS,QAAQ;EACtB,KAAK,eAAe,YAAY,KAAK,MAAM;EAE3C,MACE,mDACA,KAAK,aAAa,WAAW,MAC7B,KAAK,aAAa,WAAW,IAC/B;EACA,KAAK,OAAO,MACV,EAAE,QAAQ,KAAK,UAAU,KAAK,cAAc,eAAe,EAAE,GAC7D,8CACF;EACA,KAAK,OAAO,MACV;GACE,YAAY,KAAK,aAAa,WAAW;GACzC,YAAY,KAAK,aAAa,WAAW;EAC3C,GACA,yFACF;EACA,IAAI,KAAK,aAAa,eAAe;GACnC,MAAM,sBAAsB,KAAK,aAAa,cAAc,YAAY,CAAC;GACzE,KAAK,OAAO,MACV,EAAE,eAAe,KAAK,aAAa,cAAc,YAAY,EAAE,GAC/D,iDACF;EACF;EACA,IAAI,KAAK,aAAa,UAAU;GAC9B,MAAM,aAAa,KAAK,aAAa,YAAY,OAAU,KAAK;GAChE,MAAM,oBAAoB,UAAU;GACpC,KAAK,OAAO,MAAM,EAAE,WAAW,GAAG,4CAA4C;EAChF;CACF;CAEA,MAAa,gBAAgB,UAAiD;EAC5E,MAAM,EAAE,eAAe,UAAU,YAAY,eAAe,KAAK;EACjE,MAAM,eAAe,OAAO,KAAK,SAAS,YAAY,CAAC,CAAC,EAAE;EAC1D,MAAM,2CAA2C,SAAS,MAAM,YAAY;EAC5E,KAAK,OAAO,MACV;GAAE,MAAM,SAAS;GAAM;EAAa,GACpC,8DACF;EAEA,IAAI,wBAAqC;EACzC,IAAI,UACF,wBAAwB,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ;EAGxD,IAAI,kBAAkB,CAAC,yBAAyB,gBAAgB,wBAC9D,wBAAwB;EAO1B,IAAI,WAAW,SAAS,KAAK,CAAC,uBAAuB;GACnD,MAAM,8DAA8D,SAAS,IAAI;GACjF,OAAO;EACT;EAEA,IAAI,cAAc,iBAAiB,QAAQ;EAC3C,IAAI,WAAW,OAAO,GACpB,cAAc,sBAAsB,aAAa,YAAY,YAAY,KAAK,MAAM;EAGtF,IAAI,uBAAuB;GACzB,MACE,8CACA,SAAS,MACT,sBAAsB,YAAY,CACpC;GACA,KAAK,OAAO,MACV;IAAE,MAAM,SAAS;IAAM,WAAW,sBAAsB,YAAY;GAAE,GACtE,wDACF;GACA,cAAc,4BAA4B,aAAa,uBAAuB,UAAU;EAC1F;EAEA,MAAM,gBAAgB,OAAO,KAAK,YAAY,QAAQ,EAAE;EACxD,MAAM,eAAe,eAAe;EAQpC,IADoB,eAAe,KAAK,YAAY,WAAW,SAAS,QACvD;GACf,YAAY,WAAW;GACvB,eAAe,WAAW;GAC1B,YAAY,WAAW;GACvB,wBAAwB,WAAW;GACnC,iBAAiB,WAAW;EAC9B;EAEA,IAAI,eAAe,GAAG;GACpB,MACE,+CACA,SAAS,MACT,cACA,eACA,YACF;GACA,KAAK,OAAO,MACV;IAAE,MAAM,SAAS;IAAM,QAAQ;IAAc,OAAO;IAAe,SAAS;GAAa,GACzF,6EACF;EACF,OACE,MAAM,+BAA+B,SAAS,IAAI;EAGpD,OAAO;CACT;AACF"}

package/build/utils/jsonUtils.d.ts

@@ -0,0 +1 @@
+export declare function jsonLogReplacer(_key: string, value: unknown): any;

package/build/utils/jsonUtils.js

@@ -0,0 +1,11 @@
+let semver = require("semver");
+//#region src/utils/jsonUtils.ts
+function jsonLogReplacer(_key, value) {
+	if (value instanceof Map) return Object.fromEntries(value);
+	if (value instanceof semver.Range) return value.range;
+	return value;
+}
+//#endregion
+exports.jsonLogReplacer = jsonLogReplacer;
+
+//# sourceMappingURL=jsonUtils.js.map

package/build/utils/jsonUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonUtils.js","names":[],"sources":["../../src/utils/jsonUtils.ts"],"sourcesContent":["import { Range } from 'semver';\n\nexport function jsonLogReplacer(_key: string, value: unknown) {\n  if (value instanceof Map) {\n    return Object.fromEntries(value);\n  }\n\n  if (value instanceof Range) {\n    return value.range;\n  }\n\n  return value;\n}\n"],"mappings":";;AAEA,SAAgB,gBAAgB,MAAc,OAAgB;CAC5D,IAAI,iBAAiB,KACnB,OAAO,OAAO,YAAY,KAAK;CAGjC,IAAI,iBAAiB,OAAA,OACnB,OAAO,MAAM;CAGf,OAAO;AACT"}

package/build/utils/jsonUtils.mjs

@@ -0,0 +1,11 @@
+import { Range } from "semver";
+//#region src/utils/jsonUtils.ts
+function jsonLogReplacer(_key, value) {
+	if (value instanceof Map) return Object.fromEntries(value);
+	if (value instanceof Range) return value.range;
+	return value;
+}
+//#endregion
+export { jsonLogReplacer };
+
+//# sourceMappingURL=jsonUtils.mjs.map

package/build/utils/jsonUtils.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonUtils.mjs","names":[],"sources":["../../src/utils/jsonUtils.ts"],"sourcesContent":["import { Range } from 'semver';\n\nexport function jsonLogReplacer(_key: string, value: unknown) {\n  if (value instanceof Map) {\n    return Object.fromEntries(value);\n  }\n\n  if (value instanceof Range) {\n    return value.range;\n  }\n\n  return value;\n}\n"],"mappings":";;AAEA,SAAgB,gBAAgB,MAAc,OAAgB;CAC5D,IAAI,iBAAiB,KACnB,OAAO,OAAO,YAAY,KAAK;CAGjC,IAAI,iBAAiB,OACnB,OAAO,MAAM;CAGf,OAAO;AACT"}

package/build/utils/manifestUtils.d.ts

@@ -0,0 +1,36 @@
+import type { Manifest } from '@verdaccio/types';
+/**
+ * Delete `dist-tags` entries corresponding to missing versions.
+ */
+export declare function cleanupTags(manifest: Manifest): void;
+/**
+ * Delete `time` entries corresponding to missing versions.
+ */
+export declare function cleanupTime(manifest: Manifest): void;
+/**
+ * Get the latest version from a list of versions,
+ * ordered by time of their publication stored in the manifest.
+ */
+export declare function getLatestVersion(manifest: Manifest, versions: string[]): string | undefined;
+/**
+ * Set the latest tag if dist-tags/latest is missing.
+ * The last stable version available is used when possible.
+ * Otherwise, it uses the latest version not found in dist-tags.
+ */
+export declare function setupLatestTag(manifest: Manifest): void;
+/**
+ * Set the created and modified times.
+ */
+export declare function setupCreatedAndModified(manifest: Manifest): void;
+/**
+ * Remove `_distfiles` entries which are not used by any version.
+ */
+export declare function cleanupDistFiles(manifest: Manifest): void;
+/**
+ * Creates a copy of a manifest suitable for safe, localized mutation.
+ *
+ * The returned object is shallow-cloned, except for `versions`, `dist-tags`,
+ * `time`, and `_distfiles`, which are cloned as independent maps so they can be
+ * filtered or modified without affecting the original manifest.
+ */
+export declare function getManifestClone(manifest: Readonly<Manifest>): Manifest;

package/build/utils/manifestUtils.js

@@ -0,0 +1,129 @@
+const require_runtime = require("../_virtual/_rolldown/runtime.js");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+let _verdaccio_core = require("@verdaccio/core");
+let semver = require("semver");
+semver = require_runtime.__toESM(semver);
+//#region src/utils/manifestUtils.ts
+var debug$1 = (0, debug.default)("verdaccio:plugin:package-filter:manifest");
+/**
+* Delete `dist-tags` entries corresponding to missing versions.
+*/
+function cleanupTags(manifest) {
+	const distTags = manifest[_verdaccio_core.DIST_TAGS];
+	Object.entries(distTags).forEach(([tag, tagVersion]) => {
+		if (!manifest.versions[tagVersion]) {
+			debug$1("removing orphaned dist-tag %s -> %s from %s", tag, tagVersion, manifest.name);
+			delete distTags[tag];
+		}
+	});
+}
+/**
+* Delete `time` entries corresponding to missing versions.
+*/
+function cleanupTime(manifest) {
+	const time = manifest.time;
+	if (!time) return;
+	Object.keys(time).forEach((version) => {
+		if (!manifest.versions[version]) delete time[version];
+	});
+}
+/**
+* Get the latest version from a list of versions,
+* ordered by time of their publication stored in the manifest.
+*/
+function getLatestVersion(manifest, versions) {
+	const time = manifest.time;
+	if (!time) return versions.sort(semver.default.rcompare)[0];
+	const timedVersions = versions.map((v) => ({
+		version: v,
+		time: time[v]
+	})).filter((v) => v.time);
+	if (timedVersions.length === 0) return;
+	return timedVersions.sort((a, b) => new Date(b.time).getTime() - new Date(a.time).getTime())[0].version;
+}
+/**
+* Set the latest tag if dist-tags/latest is missing.
+* The last stable version available is used when possible.
+* Otherwise, it uses the latest version not found in dist-tags.
+*/
+function setupLatestTag(manifest) {
+	const distTags = manifest[_verdaccio_core.DIST_TAGS];
+	if (distTags.latest) return;
+	const versions = Object.keys(manifest.versions);
+	if (versions.length === 0) return;
+	const distTagsVersions = Object.values(distTags);
+	const untaggedVersions = versions.filter((v) => semver.default.valid(v) && !distTagsVersions.includes(v));
+	if (untaggedVersions.length === 0) return;
+	const latestStableVersion = getLatestVersion(manifest, untaggedVersions.filter((v) => !semver.default.prerelease(v)));
+	if (latestStableVersion) {
+		debug$1("reassigned latest tag to stable version %s for %s", latestStableVersion, manifest.name);
+		distTags.latest = latestStableVersion;
+		return;
+	}
+	const latestVersion = getLatestVersion(manifest, untaggedVersions);
+	if (!latestVersion) return;
+	debug$1("reassigned latest tag to pre-release version %s for %s", latestVersion, manifest.name);
+	distTags.latest = latestVersion;
+}
+/**
+* Set the created and modified times.
+*/
+function setupCreatedAndModified(manifest) {
+	const time = manifest.time;
+	if (!time) return;
+	const times = Object.values(time);
+	if (times.length === 0) return;
+	let earliest = times[0];
+	let latest = times[0];
+	let earliestMs = new Date(earliest).getTime();
+	let latestMs = earliestMs;
+	for (let i = 1; i < times.length; i++) {
+		const currentMs = new Date(times[i]).getTime();
+		if (currentMs < earliestMs) {
+			earliestMs = currentMs;
+			earliest = times[i];
+		}
+		if (currentMs > latestMs) {
+			latestMs = currentMs;
+			latest = times[i];
+		}
+	}
+	time.created = earliest;
+	time.modified = latest;
+}
+/**
+* Remove `_distfiles` entries which are not used by any version.
+*/
+function cleanupDistFiles(manifest) {
+	const distFiles = manifest._distfiles;
+	const activeTarballs = new Set(Object.values(manifest.versions).map((v) => v.dist?.tarball).filter((tarball) => typeof tarball === "string"));
+	Object.keys(distFiles).forEach((key) => {
+		if (!activeTarballs.has(distFiles[key].url)) delete distFiles[key];
+	});
+}
+/**
+* Creates a copy of a manifest suitable for safe, localized mutation.
+*
+* The returned object is shallow-cloned, except for `versions`, `dist-tags`,
+* `time`, and `_distfiles`, which are cloned as independent maps so they can be
+* filtered or modified without affecting the original manifest.
+*/
+function getManifestClone(manifest) {
+	return {
+		...manifest,
+		versions: { ...manifest.versions },
+		[_verdaccio_core.DIST_TAGS]: { ...manifest[_verdaccio_core.DIST_TAGS] },
+		time: { ...manifest.time },
+		_distfiles: { ...manifest._distfiles }
+	};
+}
+//#endregion
+exports.cleanupDistFiles = cleanupDistFiles;
+exports.cleanupTags = cleanupTags;
+exports.cleanupTime = cleanupTime;
+exports.getManifestClone = getManifestClone;
+exports.setupCreatedAndModified = setupCreatedAndModified;
+exports.setupLatestTag = setupLatestTag;
+
+//# sourceMappingURL=manifestUtils.js.map

package/build/utils/manifestUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifestUtils.js","names":[],"sources":["../../src/utils/manifestUtils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport semver from 'semver';\n\nimport { DIST_TAGS } from '@verdaccio/core';\nimport type { Manifest } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:plugin:package-filter:manifest');\n\n/**\n * Delete `dist-tags` entries corresponding to missing versions.\n */\nexport function cleanupTags(manifest: Manifest): void {\n  const distTags = manifest[DIST_TAGS];\n  Object.entries(distTags).forEach(([tag, tagVersion]) => {\n    if (!manifest.versions[tagVersion]) {\n      debug('removing orphaned dist-tag %s -> %s from %s', tag, tagVersion, manifest.name);\n      delete distTags[tag];\n    }\n  });\n}\n\n/**\n * Delete `time` entries corresponding to missing versions.\n */\nexport function cleanupTime(manifest: Manifest): void {\n  const time = manifest.time;\n  if (!time) {\n    return;\n  }\n\n  Object.keys(time).forEach((version) => {\n    if (!manifest.versions[version]) {\n      delete time[version];\n    }\n  });\n}\n\n/**\n * Get the latest version from a list of versions,\n * ordered by time of their publication stored in the manifest.\n */\nexport function getLatestVersion(manifest: Manifest, versions: string[]): string | undefined {\n  const time = manifest.time;\n  if (!time) {\n    // No time information, it's the best we can do\n    const sortedVersions = versions.sort(semver.rcompare);\n    return sortedVersions[0];\n  }\n\n  const timedVersions = versions\n    .map((v) => ({\n      version: v,\n      time: time[v],\n    }))\n    .filter((v) => v.time);\n\n  if (timedVersions.length === 0) {\n    return undefined;\n  }\n\n  const timeOrderedVersions = timedVersions.sort(\n    (a, b) => new Date(b.time).getTime() - new Date(a.time).getTime()\n  );\n  return timeOrderedVersions[0].version;\n}\n\n/**\n * Set the latest tag if dist-tags/latest is missing.\n * The last stable version available is used when possible.\n * Otherwise, it uses the latest version not found in dist-tags.\n */\nexport function setupLatestTag(manifest: Manifest): void {\n  const distTags = manifest[DIST_TAGS];\n  if (distTags.latest) {\n    // Tag 'latest' must only be fixed when latest version was blocked\n    return;\n  }\n\n  const versions = Object.keys(manifest.versions);\n  if (versions.length === 0) {\n    return;\n  }\n\n  const distTagsVersions = Object.values(distTags);\n  const untaggedVersions = versions.filter((v) => semver.valid(v) && !distTagsVersions.includes(v));\n  if (untaggedVersions.length === 0) {\n    return;\n  }\n\n  // Try stable versions first (no \"-next\" or \"-beta\", etc.)\n  const stableVersions = untaggedVersions.filter((v) => !semver.prerelease(v));\n  const latestStableVersion = getLatestVersion(manifest, stableVersions);\n  if (latestStableVersion) {\n    debug('reassigned latest tag to stable version %s for %s', latestStableVersion, manifest.name);\n    distTags.latest = latestStableVersion;\n    return;\n  }\n\n  // Fallback to all untagged versions\n  const latestVersion = getLatestVersion(manifest, untaggedVersions);\n  if (!latestVersion) {\n    return;\n  }\n\n  debug('reassigned latest tag to pre-release version %s for %s', latestVersion, manifest.name);\n  distTags.latest = latestVersion;\n}\n\n/**\n * Set the created and modified times.\n */\nexport function setupCreatedAndModified(manifest: Manifest): void {\n  const time = manifest.time;\n  if (!time) {\n    return;\n  }\n\n  const times = Object.values(time);\n  if (times.length === 0) {\n    return;\n  }\n\n  // Single O(n) pass for the earliest/latest publication time instead of an\n  // O(n log n) sort — the result is identical but cheaper on large manifests.\n  let earliest = times[0];\n  let latest = times[0];\n  let earliestMs = new Date(earliest).getTime();\n  let latestMs = earliestMs;\n  for (let i = 1; i < times.length; i++) {\n    const currentMs = new Date(times[i]).getTime();\n    if (currentMs < earliestMs) {\n      earliestMs = currentMs;\n      earliest = times[i];\n    }\n    if (currentMs > latestMs) {\n      latestMs = currentMs;\n      latest = times[i];\n    }\n  }\n  time.created = earliest;\n  time.modified = latest;\n}\n\n/**\n * Remove `_distfiles` entries which are not used by any version.\n */\nexport function cleanupDistFiles(manifest: Manifest): void {\n  const distFiles = manifest._distfiles;\n  // Build a Set of active tarball URLs in one pass — O(n) instead of O(n²)\n  const activeTarballs = new Set(\n    Object.values(manifest.versions)\n      .map((v) => v.dist?.tarball)\n      .filter((tarball): tarball is string => typeof tarball === 'string')\n  );\n  Object.keys(distFiles).forEach((key) => {\n    if (!activeTarballs.has(distFiles[key].url)) {\n      delete distFiles[key];\n    }\n  });\n}\n\n/**\n * Creates a copy of a manifest suitable for safe, localized mutation.\n *\n * The returned object is shallow-cloned, except for `versions`, `dist-tags`,\n * `time`, and `_distfiles`, which are cloned as independent maps so they can be\n * filtered or modified without affecting the original manifest.\n */\nexport function getManifestClone(manifest: Readonly<Manifest>): Manifest {\n  return {\n    ...manifest,\n    versions: {\n      ...manifest.versions,\n    },\n    [DIST_TAGS]: {\n      ...manifest[DIST_TAGS],\n    },\n    time: {\n      ...manifest.time,\n    },\n    _distfiles: {\n      ...manifest._distfiles,\n    },\n  };\n}\n"],"mappings":";;;;;;;AAMA,IAAM,WAAA,GAAA,MAAA,SAAmB,0CAA0C;;;;AAKnE,SAAgB,YAAY,UAA0B;CACpD,MAAM,WAAW,SAAS,gBAAA;CAC1B,OAAO,QAAQ,QAAQ,EAAE,SAAS,CAAC,KAAK,gBAAgB;EACtD,IAAI,CAAC,SAAS,SAAS,aAAa;GAClC,QAAM,+CAA+C,KAAK,YAAY,SAAS,IAAI;GACnF,OAAO,SAAS;EAClB;CACF,CAAC;AACH;;;;AAKA,SAAgB,YAAY,UAA0B;CACpD,MAAM,OAAO,SAAS;CACtB,IAAI,CAAC,MACH;CAGF,OAAO,KAAK,IAAI,EAAE,SAAS,YAAY;EACrC,IAAI,CAAC,SAAS,SAAS,UACrB,OAAO,KAAK;CAEhB,CAAC;AACH;;;;;AAMA,SAAgB,iBAAiB,UAAoB,UAAwC;CAC3F,MAAM,OAAO,SAAS;CACtB,IAAI,CAAC,MAGH,OADuB,SAAS,KAAK,OAAA,QAAO,QACrC,EAAe;CAGxB,MAAM,gBAAgB,SACnB,KAAK,OAAO;EACX,SAAS;EACT,MAAM,KAAK;CACb,EAAE,EACD,QAAQ,MAAM,EAAE,IAAI;CAEvB,IAAI,cAAc,WAAW,GAC3B;CAMF,OAH4B,cAAc,MACvC,GAAG,MAAM,IAAI,KAAK,EAAE,IAAI,EAAE,QAAQ,IAAI,IAAI,KAAK,EAAE,IAAI,EAAE,QAAQ,CAE3D,EAAoB,GAAG;AAChC;;;;;;AAOA,SAAgB,eAAe,UAA0B;CACvD,MAAM,WAAW,SAAS,gBAAA;CAC1B,IAAI,SAAS,QAEX;CAGF,MAAM,WAAW,OAAO,KAAK,SAAS,QAAQ;CAC9C,IAAI,SAAS,WAAW,GACtB;CAGF,MAAM,mBAAmB,OAAO,OAAO,QAAQ;CAC/C,MAAM,mBAAmB,SAAS,QAAQ,MAAM,OAAA,QAAO,MAAM,CAAC,KAAK,CAAC,iBAAiB,SAAS,CAAC,CAAC;CAChG,IAAI,iBAAiB,WAAW,GAC9B;CAKF,MAAM,sBAAsB,iBAAiB,UADtB,iBAAiB,QAAQ,MAAM,CAAC,OAAA,QAAO,WAAW,CAAC,CACnB,CAAc;CACrE,IAAI,qBAAqB;EACvB,QAAM,qDAAqD,qBAAqB,SAAS,IAAI;EAC7F,SAAS,SAAS;EAClB;CACF;CAGA,MAAM,gBAAgB,iBAAiB,UAAU,gBAAgB;CACjE,IAAI,CAAC,eACH;CAGF,QAAM,0DAA0D,eAAe,SAAS,IAAI;CAC5F,SAAS,SAAS;AACpB;;;;AAKA,SAAgB,wBAAwB,UAA0B;CAChE,MAAM,OAAO,SAAS;CACtB,IAAI,CAAC,MACH;CAGF,MAAM,QAAQ,OAAO,OAAO,IAAI;CAChC,IAAI,MAAM,WAAW,GACnB;CAKF,IAAI,WAAW,MAAM;CACrB,IAAI,SAAS,MAAM;CACnB,IAAI,aAAa,IAAI,KAAK,QAAQ,EAAE,QAAQ;CAC5C,IAAI,WAAW;CACf,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;EACrC,MAAM,YAAY,IAAI,KAAK,MAAM,EAAE,EAAE,QAAQ;EAC7C,IAAI,YAAY,YAAY;GAC1B,aAAa;GACb,WAAW,MAAM;EACnB;EACA,IAAI,YAAY,UAAU;GACxB,WAAW;GACX,SAAS,MAAM;EACjB;CACF;CACA,KAAK,UAAU;CACf,KAAK,WAAW;AAClB;;;;AAKA,SAAgB,iBAAiB,UAA0B;CACzD,MAAM,YAAY,SAAS;CAE3B,MAAM,iBAAiB,IAAI,IACzB,OAAO,OAAO,SAAS,QAAQ,EAC5B,KAAK,MAAM,EAAE,MAAM,OAAO,EAC1B,QAAQ,YAA+B,OAAO,YAAY,QAAQ,CACvE;CACA,OAAO,KAAK,SAAS,EAAE,SAAS,QAAQ;EACtC,IAAI,CAAC,eAAe,IAAI,UAAU,KAAK,GAAG,GACxC,OAAO,UAAU;CAErB,CAAC;AACH;;;;;;;;AASA,SAAgB,iBAAiB,UAAwC;CACvE,OAAO;EACL,GAAG;EACH,UAAU,EACR,GAAG,SAAS,SACd;GACC,gBAAA,YAAY,EACX,GAAG,SAAS,gBAAA,WACd;EACA,MAAM,EACJ,GAAG,SAAS,KACd;EACA,YAAY,EACV,GAAG,SAAS,WACd;CACF;AACF"}

package/build/utils/manifestUtils.mjs

@@ -0,0 +1,121 @@
+import buildDebug from "debug";
+import { DIST_TAGS } from "@verdaccio/core";
+import semver from "semver";
+//#region src/utils/manifestUtils.ts
+var debug = buildDebug("verdaccio:plugin:package-filter:manifest");
+/**
+* Delete `dist-tags` entries corresponding to missing versions.
+*/
+function cleanupTags(manifest) {
+	const distTags = manifest[DIST_TAGS];
+	Object.entries(distTags).forEach(([tag, tagVersion]) => {
+		if (!manifest.versions[tagVersion]) {
+			debug("removing orphaned dist-tag %s -> %s from %s", tag, tagVersion, manifest.name);
+			delete distTags[tag];
+		}
+	});
+}
+/**
+* Delete `time` entries corresponding to missing versions.
+*/
+function cleanupTime(manifest) {
+	const time = manifest.time;
+	if (!time) return;
+	Object.keys(time).forEach((version) => {
+		if (!manifest.versions[version]) delete time[version];
+	});
+}
+/**
+* Get the latest version from a list of versions,
+* ordered by time of their publication stored in the manifest.
+*/
+function getLatestVersion(manifest, versions) {
+	const time = manifest.time;
+	if (!time) return versions.sort(semver.rcompare)[0];
+	const timedVersions = versions.map((v) => ({
+		version: v,
+		time: time[v]
+	})).filter((v) => v.time);
+	if (timedVersions.length === 0) return;
+	return timedVersions.sort((a, b) => new Date(b.time).getTime() - new Date(a.time).getTime())[0].version;
+}
+/**
+* Set the latest tag if dist-tags/latest is missing.
+* The last stable version available is used when possible.
+* Otherwise, it uses the latest version not found in dist-tags.
+*/
+function setupLatestTag(manifest) {
+	const distTags = manifest[DIST_TAGS];
+	if (distTags.latest) return;
+	const versions = Object.keys(manifest.versions);
+	if (versions.length === 0) return;
+	const distTagsVersions = Object.values(distTags);
+	const untaggedVersions = versions.filter((v) => semver.valid(v) && !distTagsVersions.includes(v));
+	if (untaggedVersions.length === 0) return;
+	const latestStableVersion = getLatestVersion(manifest, untaggedVersions.filter((v) => !semver.prerelease(v)));
+	if (latestStableVersion) {
+		debug("reassigned latest tag to stable version %s for %s", latestStableVersion, manifest.name);
+		distTags.latest = latestStableVersion;
+		return;
+	}
+	const latestVersion = getLatestVersion(manifest, untaggedVersions);
+	if (!latestVersion) return;
+	debug("reassigned latest tag to pre-release version %s for %s", latestVersion, manifest.name);
+	distTags.latest = latestVersion;
+}
+/**
+* Set the created and modified times.
+*/
+function setupCreatedAndModified(manifest) {
+	const time = manifest.time;
+	if (!time) return;
+	const times = Object.values(time);
+	if (times.length === 0) return;
+	let earliest = times[0];
+	let latest = times[0];
+	let earliestMs = new Date(earliest).getTime();
+	let latestMs = earliestMs;
+	for (let i = 1; i < times.length; i++) {
+		const currentMs = new Date(times[i]).getTime();
+		if (currentMs < earliestMs) {
+			earliestMs = currentMs;
+			earliest = times[i];
+		}
+		if (currentMs > latestMs) {
+			latestMs = currentMs;
+			latest = times[i];
+		}
+	}
+	time.created = earliest;
+	time.modified = latest;
+}
+/**
+* Remove `_distfiles` entries which are not used by any version.
+*/
+function cleanupDistFiles(manifest) {
+	const distFiles = manifest._distfiles;
+	const activeTarballs = new Set(Object.values(manifest.versions).map((v) => v.dist?.tarball).filter((tarball) => typeof tarball === "string"));
+	Object.keys(distFiles).forEach((key) => {
+		if (!activeTarballs.has(distFiles[key].url)) delete distFiles[key];
+	});
+}
+/**
+* Creates a copy of a manifest suitable for safe, localized mutation.
+*
+* The returned object is shallow-cloned, except for `versions`, `dist-tags`,
+* `time`, and `_distfiles`, which are cloned as independent maps so they can be
+* filtered or modified without affecting the original manifest.
+*/
+function getManifestClone(manifest) {
+	return {
+		...manifest,
+		versions: { ...manifest.versions },
+		[DIST_TAGS]: { ...manifest[DIST_TAGS] },
+		time: { ...manifest.time },
+		_distfiles: { ...manifest._distfiles }
+	};
+}
+//#endregion
+export { cleanupDistFiles, cleanupTags, cleanupTime, getManifestClone, setupCreatedAndModified, setupLatestTag };
+
+//# sourceMappingURL=manifestUtils.mjs.map

package/build/utils/manifestUtils.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifestUtils.mjs","names":[],"sources":["../../src/utils/manifestUtils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport semver from 'semver';\n\nimport { DIST_TAGS } from '@verdaccio/core';\nimport type { Manifest } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:plugin:package-filter:manifest');\n\n/**\n * Delete `dist-tags` entries corresponding to missing versions.\n */\nexport function cleanupTags(manifest: Manifest): void {\n  const distTags = manifest[DIST_TAGS];\n  Object.entries(distTags).forEach(([tag, tagVersion]) => {\n    if (!manifest.versions[tagVersion]) {\n      debug('removing orphaned dist-tag %s -> %s from %s', tag, tagVersion, manifest.name);\n      delete distTags[tag];\n    }\n  });\n}\n\n/**\n * Delete `time` entries corresponding to missing versions.\n */\nexport function cleanupTime(manifest: Manifest): void {\n  const time = manifest.time;\n  if (!time) {\n    return;\n  }\n\n  Object.keys(time).forEach((version) => {\n    if (!manifest.versions[version]) {\n      delete time[version];\n    }\n  });\n}\n\n/**\n * Get the latest version from a list of versions,\n * ordered by time of their publication stored in the manifest.\n */\nexport function getLatestVersion(manifest: Manifest, versions: string[]): string | undefined {\n  const time = manifest.time;\n  if (!time) {\n    // No time information, it's the best we can do\n    const sortedVersions = versions.sort(semver.rcompare);\n    return sortedVersions[0];\n  }\n\n  const timedVersions = versions\n    .map((v) => ({\n      version: v,\n      time: time[v],\n    }))\n    .filter((v) => v.time);\n\n  if (timedVersions.length === 0) {\n    return undefined;\n  }\n\n  const timeOrderedVersions = timedVersions.sort(\n    (a, b) => new Date(b.time).getTime() - new Date(a.time).getTime()\n  );\n  return timeOrderedVersions[0].version;\n}\n\n/**\n * Set the latest tag if dist-tags/latest is missing.\n * The last stable version available is used when possible.\n * Otherwise, it uses the latest version not found in dist-tags.\n */\nexport function setupLatestTag(manifest: Manifest): void {\n  const distTags = manifest[DIST_TAGS];\n  if (distTags.latest) {\n    // Tag 'latest' must only be fixed when latest version was blocked\n    return;\n  }\n\n  const versions = Object.keys(manifest.versions);\n  if (versions.length === 0) {\n    return;\n  }\n\n  const distTagsVersions = Object.values(distTags);\n  const untaggedVersions = versions.filter((v) => semver.valid(v) && !distTagsVersions.includes(v));\n  if (untaggedVersions.length === 0) {\n    return;\n  }\n\n  // Try stable versions first (no \"-next\" or \"-beta\", etc.)\n  const stableVersions = untaggedVersions.filter((v) => !semver.prerelease(v));\n  const latestStableVersion = getLatestVersion(manifest, stableVersions);\n  if (latestStableVersion) {\n    debug('reassigned latest tag to stable version %s for %s', latestStableVersion, manifest.name);\n    distTags.latest = latestStableVersion;\n    return;\n  }\n\n  // Fallback to all untagged versions\n  const latestVersion = getLatestVersion(manifest, untaggedVersions);\n  if (!latestVersion) {\n    return;\n  }\n\n  debug('reassigned latest tag to pre-release version %s for %s', latestVersion, manifest.name);\n  distTags.latest = latestVersion;\n}\n\n/**\n * Set the created and modified times.\n */\nexport function setupCreatedAndModified(manifest: Manifest): void {\n  const time = manifest.time;\n  if (!time) {\n    return;\n  }\n\n  const times = Object.values(time);\n  if (times.length === 0) {\n    return;\n  }\n\n  // Single O(n) pass for the earliest/latest publication time instead of an\n  // O(n log n) sort — the result is identical but cheaper on large manifests.\n  let earliest = times[0];\n  let latest = times[0];\n  let earliestMs = new Date(earliest).getTime();\n  let latestMs = earliestMs;\n  for (let i = 1; i < times.length; i++) {\n    const currentMs = new Date(times[i]).getTime();\n    if (currentMs < earliestMs) {\n      earliestMs = currentMs;\n      earliest = times[i];\n    }\n    if (currentMs > latestMs) {\n      latestMs = currentMs;\n      latest = times[i];\n    }\n  }\n  time.created = earliest;\n  time.modified = latest;\n}\n\n/**\n * Remove `_distfiles` entries which are not used by any version.\n */\nexport function cleanupDistFiles(manifest: Manifest): void {\n  const distFiles = manifest._distfiles;\n  // Build a Set of active tarball URLs in one pass — O(n) instead of O(n²)\n  const activeTarballs = new Set(\n    Object.values(manifest.versions)\n      .map((v) => v.dist?.tarball)\n      .filter((tarball): tarball is string => typeof tarball === 'string')\n  );\n  Object.keys(distFiles).forEach((key) => {\n    if (!activeTarballs.has(distFiles[key].url)) {\n      delete distFiles[key];\n    }\n  });\n}\n\n/**\n * Creates a copy of a manifest suitable for safe, localized mutation.\n *\n * The returned object is shallow-cloned, except for `versions`, `dist-tags`,\n * `time`, and `_distfiles`, which are cloned as independent maps so they can be\n * filtered or modified without affecting the original manifest.\n */\nexport function getManifestClone(manifest: Readonly<Manifest>): Manifest {\n  return {\n    ...manifest,\n    versions: {\n      ...manifest.versions,\n    },\n    [DIST_TAGS]: {\n      ...manifest[DIST_TAGS],\n    },\n    time: {\n      ...manifest.time,\n    },\n    _distfiles: {\n      ...manifest._distfiles,\n    },\n  };\n}\n"],"mappings":";;;;AAMA,IAAM,QAAQ,WAAW,0CAA0C;;;;AAKnE,SAAgB,YAAY,UAA0B;CACpD,MAAM,WAAW,SAAS;CAC1B,OAAO,QAAQ,QAAQ,EAAE,SAAS,CAAC,KAAK,gBAAgB;EACtD,IAAI,CAAC,SAAS,SAAS,aAAa;GAClC,MAAM,+CAA+C,KAAK,YAAY,SAAS,IAAI;GACnF,OAAO,SAAS;EAClB;CACF,CAAC;AACH;;;;AAKA,SAAgB,YAAY,UAA0B;CACpD,MAAM,OAAO,SAAS;CACtB,IAAI,CAAC,MACH;CAGF,OAAO,KAAK,IAAI,EAAE,SAAS,YAAY;EACrC,IAAI,CAAC,SAAS,SAAS,UACrB,OAAO,KAAK;CAEhB,CAAC;AACH;;;;;AAMA,SAAgB,iBAAiB,UAAoB,UAAwC;CAC3F,MAAM,OAAO,SAAS;CACtB,IAAI,CAAC,MAGH,OADuB,SAAS,KAAK,OAAO,QACrC,EAAe;CAGxB,MAAM,gBAAgB,SACnB,KAAK,OAAO;EACX,SAAS;EACT,MAAM,KAAK;CACb,EAAE,EACD,QAAQ,MAAM,EAAE,IAAI;CAEvB,IAAI,cAAc,WAAW,GAC3B;CAMF,OAH4B,cAAc,MACvC,GAAG,MAAM,IAAI,KAAK,EAAE,IAAI,EAAE,QAAQ,IAAI,IAAI,KAAK,EAAE,IAAI,EAAE,QAAQ,CAE3D,EAAoB,GAAG;AAChC;;;;;;AAOA,SAAgB,eAAe,UAA0B;CACvD,MAAM,WAAW,SAAS;CAC1B,IAAI,SAAS,QAEX;CAGF,MAAM,WAAW,OAAO,KAAK,SAAS,QAAQ;CAC9C,IAAI,SAAS,WAAW,GACtB;CAGF,MAAM,mBAAmB,OAAO,OAAO,QAAQ;CAC/C,MAAM,mBAAmB,SAAS,QAAQ,MAAM,OAAO,MAAM,CAAC,KAAK,CAAC,iBAAiB,SAAS,CAAC,CAAC;CAChG,IAAI,iBAAiB,WAAW,GAC9B;CAKF,MAAM,sBAAsB,iBAAiB,UADtB,iBAAiB,QAAQ,MAAM,CAAC,OAAO,WAAW,CAAC,CACnB,CAAc;CACrE,IAAI,qBAAqB;EACvB,MAAM,qDAAqD,qBAAqB,SAAS,IAAI;EAC7F,SAAS,SAAS;EAClB;CACF;CAGA,MAAM,gBAAgB,iBAAiB,UAAU,gBAAgB;CACjE,IAAI,CAAC,eACH;CAGF,MAAM,0DAA0D,eAAe,SAAS,IAAI;CAC5F,SAAS,SAAS;AACpB;;;;AAKA,SAAgB,wBAAwB,UAA0B;CAChE,MAAM,OAAO,SAAS;CACtB,IAAI,CAAC,MACH;CAGF,MAAM,QAAQ,OAAO,OAAO,IAAI;CAChC,IAAI,MAAM,WAAW,GACnB;CAKF,IAAI,WAAW,MAAM;CACrB,IAAI,SAAS,MAAM;CACnB,IAAI,aAAa,IAAI,KAAK,QAAQ,EAAE,QAAQ;CAC5C,IAAI,WAAW;CACf,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;EACrC,MAAM,YAAY,IAAI,KAAK,MAAM,EAAE,EAAE,QAAQ;EAC7C,IAAI,YAAY,YAAY;GAC1B,aAAa;GACb,WAAW,MAAM;EACnB;EACA,IAAI,YAAY,UAAU;GACxB,WAAW;GACX,SAAS,MAAM;EACjB;CACF;CACA,KAAK,UAAU;CACf,KAAK,WAAW;AAClB;;;;AAKA,SAAgB,iBAAiB,UAA0B;CACzD,MAAM,YAAY,SAAS;CAE3B,MAAM,iBAAiB,IAAI,IACzB,OAAO,OAAO,SAAS,QAAQ,EAC5B,KAAK,MAAM,EAAE,MAAM,OAAO,EAC1B,QAAQ,YAA+B,OAAO,YAAY,QAAQ,CACvE;CACA,OAAO,KAAK,SAAS,EAAE,SAAS,QAAQ;EACtC,IAAI,CAAC,eAAe,IAAI,UAAU,KAAK,GAAG,GACxC,OAAO,UAAU;CAErB,CAAC;AACH;;;;;;;;AASA,SAAgB,iBAAiB,UAAwC;CACvE,OAAO;EACL,GAAG;EACH,UAAU,EACR,GAAG,SAAS,SACd;GACC,YAAY,EACX,GAAG,SAAS,WACd;EACA,MAAM,EACJ,GAAG,SAAS,KACd;EACA,YAAY,EACV,GAAG,SAAS,WACd;CACF;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/package-filter",
-  "version": "13.0.4",
+  "version": "13.1.0",
   "description": "Package filter plugin for Verdaccio that allows blocking packages by name, scope, version or date",
   "keywords": [
     "enterprise",
@@ -33,28 +33,43 @@
     "type": "opencollective",
     "url": "https://opencollective.com/verdaccio"
   },
-  "main": "build/index.js",
-  "types": "build/index.d.ts",
+  "main": "./build/index.js",
+  "module": "./build/index.mjs",
+  "types": "./build/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./build/index.d.ts",
+        "default": "./build/index.mjs"
+      },
+      "require": {
+        "types": "./build/index.d.ts",
+        "default": "./build/index.js"
+      }
+    },
+    "./build/*": "./build/*"
+  },
   "dependencies": {
-    "@verdaccio/core": "8.1.3",
+    "@verdaccio/core": "8.2.0",
     "debug": "4.4.3",
     "semver": "7.7.4"
   },
   "devDependencies": {
     "@types/debug": "4.1.12",
-    "@verdaccio/config": "8.1.3",
-    "@verdaccio/logger": "8.0.4",
-    "@verdaccio/types": "13.0.4",
+    "@verdaccio/config": "8.2.0",
+    "@verdaccio/logger": "8.1.0",
+    "@verdaccio/types": "13.0.5",
     "vite": "8.0.16",
     "vitest": "4.1.2"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "scripts": {
     "clean": "rimraf ./build",
-    "build": "vite build --config vite.build.config.mjs",
-    "watch": "vite build --watch --config vite.build.config.mjs",
-    "test": "vitest run"
+    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.build.json",
+    "watch": "vite build --watch",
+    "test": "vitest run",
+    "type-check": "tsc --noEmit -p tsconfig.build.json"
   }
 }