@verdaccio/package-filter 14.0.0-next-9.30

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Verdaccio contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,277 @@
+# @verdaccio/package-filter
+
+[![Verdaccio Home](https://img.shields.io/badge/Homepage-Verdaccio-405236?style=flat)](https://verdaccio.org)
+[![MIT License](https://img.shields.io/github/license/verdaccio/verdaccio?label=License&color=405236)](https://github.com/verdaccio/verdaccio/blob/master/LICENSE)
+[![Verdaccio Latest](https://img.shields.io/npm/v/verdaccio?label=Latest%20Version&color=405236)](https://github.com/verdaccio/verdaccio)
+
+[![Documentation](https://img.shields.io/badge/Help-Verdaccio?style=flat&logo=Verdaccio&label=Verdaccio&color=cd4000)](https://verdaccio.org/docs)
+[![Discord](https://img.shields.io/badge/Chat-Discord?style=flat&logo=Discord&label=Discord&color=cd4000)](https://discord.com/channels/388674437219745793)
+
+A built-in Verdaccio filter plugin for controlling which package versions are visible to consumers. It intercepts every manifest response and removes or replaces versions that match configurable rules.
+
+## Use Cases
+
+- **Supply-chain security** - block known-malicious packages, scopes, or version ranges.
+- **Version quarantine** - hide versions younger than N days so newly published code has time to be reviewed before adoption.
+- **Date freeze** - pin the registry to a point-in-time snapshot (e.g., only serve versions published before a specific date).
+- **Emergency response** - immediately block a compromised version while keeping older safe versions available.
+
+## How It Works
+
+The plugin implements Verdaccio's `ManifestFilter` interface. Every time Verdaccio serves a package manifest (via `npm install`, `npm view`, search, or the web UI), the manifest passes through `filter_metadata()` before reaching the client.
+
+The processing pipeline:
+
+```
+Incoming manifest
+  1. Clone manifest (avoids mutating cached data)
+  2. Apply block/replace rules by package name, scope, or version range
+  3. Apply date-based filtering (minAgeDays / dateThreshold)
+  4. Cleanup: remove orphaned dist-tags, time entries, and dist files
+  5. Recalculate "latest" tag from remaining versions
+Output filtered manifest
+```
+
+Filtered versions are removed from the manifest metadata only. Tarballs already downloaded or cached are not affected.
+
+## Configuration
+
+The plugin is enabled by default in Verdaccio's `config.yaml`. With no rules configured, it acts as a no-op passthrough.
+
+### Minimal Configuration (no-op)
+
+```yaml
+filters:
+  '@verdaccio/package-filter':
+```
+
+### Block Versions by Age
+
+Hide versions published less than N days ago. This is a global rule applied to all packages.
+
+```yaml
+filters:
+  '@verdaccio/package-filter':
+    minAgeDays: 30
+```
+
+### Block Versions by Date
+
+Only serve versions published before a specific date.
+
+```yaml
+filters:
+  '@verdaccio/package-filter':
+    dateThreshold: '2024-01-01'
+```
+
+When both `minAgeDays` and `dateThreshold` are set, the **earlier** cutoff wins (more versions are filtered).
+
+### Block by Scope
+
+Block all packages under a scope.
+
+```yaml
+filters:
+  '@verdaccio/package-filter':
+    block:
+      - scope: '@evilscope'
+```
+
+### Block by Package Name
+
+Block all versions of a specific package.
+
+```yaml
+filters:
+  '@verdaccio/package-filter':
+    block:
+      - package: 'malicious-pkg'
+      - package: '@coolauthor/stolen'
+```
+
+### Block by Version Range
+
+Block specific semver ranges of a package. Uses [semver](https://www.npmjs.com/package/semver) syntax.
+
+```yaml
+filters:
+  '@verdaccio/package-filter':
+    block:
+      - package: '@coolauthor/stolen'
+        versions: '>2.0.1'
+```
+
+Multiple version ranges for the same package are merged:
+
+```yaml
+filters:
+  '@verdaccio/package-filter':
+    block:
+      - package: 'some-pkg'
+        versions: '>2.0.0'
+      - package: 'some-pkg'
+        versions: '<1.3.0'
+```
+
+This leaves only versions in `[1.3.0, 2.0.0]` visible.
+
+### Replace Strategy
+
+Instead of removing blocked versions, substitute them with the nearest older safe version. Useful when a blocked version is a transitive dependency and removing it would break installs.
+
+```yaml
+filters:
+  '@verdaccio/package-filter':
+    block:
+      - package: '@coolauthor/stolen'
+        versions: '>2.0.1'
+        strategy: replace
+```
+
+With `replace`, `npm install @coolauthor/stolen@3.0.0` still resolves, but the client receives the content of `2.0.1`.
+
+### Whitelisting Blocked Packages
+
+In some cases, you may need to bypass your own rules and whitelist certain scopes, packages, or package versions even though they fall within a blocked area. For example, this might happen when you own some private registry or you really need the latest version of some package and you ensured that its code is safe. You can configure whitelist rules with the `allow` clause, which follows the same rules as `block`. Rules specified in `allow` take precedence over all blocking rules (even `minAgeDays` and `dateThreshold`).
+
+```yaml
+filters:
+  '@verdaccio/package-filter':
+    minAgeDays: 30 # Block versions younger than 30 days
+    allow:
+      - scope: '@my-company-scope' # Don't block the scope that belongs to you
+      - package: '@coolauthor/not-stolen' # Don't block package you really trust
+      - package: semver
+        versions: '7.7.3' # Don't block specific package version that you know is not malicious
+```
+
+You can also combine `allow` with `block` rules to create fine-grained exceptions:
+
+```yaml
+filters:
+  '@verdaccio/package-filter':
+    block:
+      - scope: '@untrusted'
+    allow:
+      - package: '@untrusted/but-verified'
+      - package: 'some-pkg'
+        versions: '2.1.0'
+```
+
+Allow rules are checked before block rules. The granularity levels:
+
+| Allow rule                           | Effect                              |
+| ------------------------------------ | ----------------------------------- |
+| `scope: '@x'`                        | Entire scope bypasses all rules     |
+| `package: 'x'`                       | Entire package bypasses all rules   |
+| `package: 'x'` + `versions: '1.0.0'` | Only matching versions are exempted |
+
+### Full Example
+
+```yaml
+filters:
+  '@verdaccio/package-filter':
+    minAgeDays: 7
+    dateThreshold: '2025-01-01'
+    block:
+      - scope: '@malicious'
+      - package: 'typosquat-pkg'
+      - package: 'compromised-lib'
+        versions: '>=3.0.0'
+      - package: 'legacy-lib'
+        versions: '>=2.0.0'
+        strategy: replace
+    allow:
+      - scope: '@my-org'
+      - package: 'compromised-lib'
+        versions: '3.0.1'
+```
+
+### Disabling the Plugin
+
+Remove or comment out the `filters` section in `config.yaml`:
+
+```yaml
+# filters:
+#   '@verdaccio/package-filter':
+```
+
+## Manifest Cleanup
+
+After filtering, the plugin automatically cleans up the manifest:
+
+- **Dist-tags**: tags pointing to removed versions are deleted.
+- **Latest tag**: if `latest` was removed, the most recent remaining stable version becomes `latest`. If no stable version exists, the most recent pre-release is used.
+- **Time entries**: publish timestamps for removed versions are deleted.
+- **Created/modified**: recalculated from remaining time entries.
+- **Dist files**: `_distfiles` entries not referenced by any remaining version are removed.
+
+## Debugging
+
+The plugin uses the [`debug`](https://www.npmjs.com/package/debug) library under the `verdaccio:plugin:package-filter` namespace.
+
+```bash
+# See all plugin debug output
+DEBUG=verdaccio:plugin:package-filter* verdaccio
+
+# See only config parsing
+DEBUG=verdaccio:plugin:package-filter:config verdaccio
+
+# See only filtering decisions
+DEBUG=verdaccio:plugin:package-filter:filter verdaccio
+
+# See manifest cleanup details
+DEBUG=verdaccio:plugin:package-filter:manifest verdaccio
+
+# Combine with other verdaccio debug namespaces
+DEBUG=verdaccio:plugin:package-filter*,verdaccio:storage verdaccio
+```
+
+## Plugin History
+
+Originally authored by Ansile as [verdaccio-plugin-secfilter](https://github.com/Ansile/verdaccio-plugin-secfilter) (MIT license). Forked by Vitalii Sugrobov as [verdaccio-plugin-delay-filter](https://github.com/vsugrob/verdaccio-plugin-delay-filter). Now maintained as a built-in plugin in the Verdaccio monorepo.
+
+## Donations
+
+Verdaccio is run by **volunteers**; nobody is working full-time on it. If you find this project to be useful and would like to support its development, consider making a donation - **your logo might end up in this readme.**
+
+**[Donate](https://opencollective.com/verdaccio)** starting from _\$1/month_ or just one single contribution.
+
+## Report a vulnerability
+
+If you want to report a security vulnerability, please follow the steps which we have defined for you in our [security policy](https://github.com/verdaccio/verdaccio/security/policy).
+
+## Open Collective Sponsors
+
+Support this project by becoming a sponsor. Your logo will show up here with a link to your website. [[Become a sponsor](https://opencollective.com/verdaccio/contribute)]
+
+[![sponsor](https://opencollective.com/verdaccio/sponsor/0/avatar.svg)](https://opencollective.com/verdaccio/sponsor/0/website)
+[![sponsor](https://opencollective.com/verdaccio/sponsor/1/avatar.svg)](https://opencollective.com/verdaccio/sponsor/1/website)
+[![sponsor](https://opencollective.com/verdaccio/sponsor/2/avatar.svg)](https://opencollective.com/verdaccio/sponsor/2/website)
+[![sponsor](https://opencollective.com/verdaccio/sponsor/3/avatar.svg)](https://opencollective.com/verdaccio/sponsor/3/website)
+[![sponsor](https://opencollective.com/verdaccio/sponsor/4/avatar.svg)](https://opencollective.com/verdaccio/sponsor/4/website)
+[![sponsor](https://opencollective.com/verdaccio/sponsor/5/avatar.svg)](https://opencollective.com/verdaccio/sponsor/5/website)
+[![sponsor](https://opencollective.com/verdaccio/sponsor/6/avatar.svg)](https://opencollective.com/verdaccio/sponsor/6/website)
+[![sponsor](https://opencollective.com/verdaccio/sponsor/7/avatar.svg)](https://opencollective.com/verdaccio/sponsor/7/website)
+[![sponsor](https://opencollective.com/verdaccio/sponsor/8/avatar.svg)](https://opencollective.com/verdaccio/sponsor/8/website)
+[![sponsor](https://opencollective.com/verdaccio/sponsor/9/avatar.svg)](https://opencollective.com/verdaccio/sponsor/9/website)
+
+## Open Collective Backers
+
+Thank you to all our backers! [[Become a backer](https://opencollective.com/verdaccio/contribute)]
+
+[![backers](https://opencollective.com/verdaccio/backers.svg?width=890)](https://opencollective.com/verdaccio/contributes)
+
+## Contributors
+
+This project exists thanks to all the people who contribute. [[Contribute](https://github.com/verdaccio/verdaccio/blob/master/CONTRIBUTING.md)].
+
+[![contributors](https://opencollective.com/verdaccio/contributors.svg?width=890&button=true)](https://github.com/verdaccio/verdaccio/graphs/contributors)
+
+## License
+
+Verdaccio is [MIT licensed](https://github.com/verdaccio/verdaccio/blob/master/LICENSE).
+
+The Verdaccio documentation and logos (excluding /thanks, e.g., .md, .png, .sketch files within the /assets folder) are
+[Creative Commons licensed](https://creativecommons.org/licenses/by/4.0/).

package/build/_virtual/_rolldown/runtime.js

@@ -0,0 +1,23 @@
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+exports.__toESM = __toESM;

package/build/config/parser.d.ts

@@ -0,0 +1,2 @@
+import { ParsedConfig, PluginConfig } from './types';
+export declare function parseConfig(config: PluginConfig): ParsedConfig;

package/build/config/parser.js

@@ -0,0 +1,56 @@
+const require_runtime = require("../_virtual/_rolldown/runtime.js");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+let semver = require("semver");
+//#region src/config/parser.ts
+var debug$1 = (0, debug.default)("verdaccio:plugin:package-filter:config");
+function parseConfigRules(configRules) {
+	const ruleMap = /* @__PURE__ */ new Map();
+	for (const rule of configRules) {
+		if ("scope" in rule && typeof rule.scope === "string") {
+			if (!rule.scope.startsWith("@")) throw new TypeError(`Scope value must start with @, found: ${rule.scope}`);
+			ruleMap.set(rule.scope, "scope");
+			continue;
+		}
+		if ("package" in rule && !("versions" in rule)) {
+			ruleMap.set(rule.package, "package");
+			continue;
+		}
+		if ("package" in rule && "versions" in rule) {
+			const previousConfig = ruleMap.get(rule.package) || { versions: [] };
+			if (typeof previousConfig === "string") throw new Error(`Package ${rule.package} is already specified by another strict rule ${previousConfig}`);
+			const range = new semver.Range(rule.versions);
+			ruleMap.set(rule.package, {
+				versions: [...previousConfig.versions, range],
+				strategy: rule.strategy ?? "block"
+			});
+			continue;
+		}
+		throw new TypeError(`Could not parse rule ${JSON.stringify(rule, null, 4)}`);
+	}
+	return ruleMap;
+}
+function parseConfig(config) {
+	debug$1("parsing config: %o", config);
+	const blockMap = parseConfigRules(config.block ?? []);
+	const allowMap = parseConfigRules(config.allow ?? []);
+	debug$1("parsed %d block rules, %d allow rules", blockMap.size, allowMap.size);
+	const dateThreshold = config.dateThreshold ? new Date(config.dateThreshold) : null;
+	if (dateThreshold && isNaN(dateThreshold.getTime())) throw new TypeError(`Invalid date ${config.dateThreshold} was provided for dateThreshold`);
+	const minAgeDays = config.minAgeDays ? Number(config.minAgeDays) : null;
+	let minAgeMs = null;
+	if (minAgeDays !== null) {
+		if (isNaN(minAgeDays) || minAgeDays < 0) throw new TypeError(`Invalid number ${config.minAgeDays} was provided for minAgeDays`);
+		minAgeMs = minAgeDays * 24 * 60 * 60 * 1e3;
+	}
+	return {
+		dateThreshold,
+		minAgeMs,
+		blockRules: blockMap,
+		allowRules: allowMap
+	};
+}
+//#endregion
+exports.parseConfig = parseConfig;
+
+//# sourceMappingURL=parser.js.map

package/build/config/parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.js","names":[],"sources":["../../src/config/parser.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Range } from 'semver';\n\nimport type { ConfigRule, ParsedConfig, ParsedRule, PluginConfig } from './types';\n\nconst debug = buildDebug('verdaccio:plugin:package-filter:config');\n\nfunction parseConfigRules(configRules: ConfigRule[]): Map<string, ParsedRule> {\n  const ruleMap = new Map<string, ParsedRule>();\n  for (const rule of configRules) {\n    if ('scope' in rule && typeof rule.scope === 'string') {\n      if (!rule.scope.startsWith('@')) {\n        throw new TypeError(`Scope value must start with @, found: ${rule.scope}`);\n      }\n\n      ruleMap.set(rule.scope, 'scope');\n      continue;\n    }\n\n    if ('package' in rule && !('versions' in rule)) {\n      ruleMap.set(rule.package, 'package');\n      continue;\n    }\n\n    if ('package' in rule && 'versions' in rule) {\n      const previousConfig = ruleMap.get(rule.package) || { versions: [] };\n\n      if (typeof previousConfig === 'string') {\n        throw new Error(\n          `Package ${rule.package} is already specified by another strict rule ${previousConfig}`\n        );\n      }\n\n      // Merge version ranges of the rules for the same package\n      const range = new Range(rule.versions);\n      ruleMap.set(rule.package, {\n        versions: [...previousConfig.versions, range],\n        strategy: rule.strategy ?? 'block',\n      });\n\n      continue;\n    }\n\n    throw new TypeError(`Could not parse rule ${JSON.stringify(rule, null, 4)}`);\n  }\n\n  return ruleMap;\n}\n\nexport function parseConfig(config: PluginConfig): ParsedConfig {\n  debug('parsing config: %o', config);\n  const blockMap = parseConfigRules(config.block ?? []);\n  const allowMap = parseConfigRules(config.allow ?? []);\n  debug('parsed %d block rules, %d allow rules', blockMap.size, allowMap.size);\n  const dateThreshold = config.dateThreshold ? new Date(config.dateThreshold) : null;\n  if (dateThreshold && isNaN(dateThreshold.getTime())) {\n    throw new TypeError(`Invalid date ${config.dateThreshold} was provided for dateThreshold`);\n  }\n\n  const minAgeDays = config.minAgeDays ? Number(config.minAgeDays) : null;\n  let minAgeMs: number | null = null;\n  if (minAgeDays !== null) {\n    if (isNaN(minAgeDays) || minAgeDays < 0) {\n      throw new TypeError(`Invalid number ${config.minAgeDays} was provided for minAgeDays`);\n    }\n\n    minAgeMs = minAgeDays * 24 * 60 * 60 * 1000;\n  }\n\n  return {\n    dateThreshold,\n    minAgeMs,\n    blockRules: blockMap,\n    allowRules: allowMap,\n  };\n}\n"],"mappings":";;;;;AAKA,IAAM,WAAA,GAAA,MAAA,SAAmB,yCAAyC;AAElE,SAAS,iBAAiB,aAAoD;CAC5E,MAAM,0BAAU,IAAI,KAAyB;AAC7C,MAAK,MAAM,QAAQ,aAAa;AAC9B,MAAI,WAAW,QAAQ,OAAO,KAAK,UAAU,UAAU;AACrD,OAAI,CAAC,KAAK,MAAM,WAAW,IAAI,CAC7B,OAAM,IAAI,UAAU,yCAAyC,KAAK,QAAQ;AAG5E,WAAQ,IAAI,KAAK,OAAO,QAAQ;AAChC;;AAGF,MAAI,aAAa,QAAQ,EAAE,cAAc,OAAO;AAC9C,WAAQ,IAAI,KAAK,SAAS,UAAU;AACpC;;AAGF,MAAI,aAAa,QAAQ,cAAc,MAAM;GAC3C,MAAM,iBAAiB,QAAQ,IAAI,KAAK,QAAQ,IAAI,EAAE,UAAU,EAAE,EAAE;AAEpE,OAAI,OAAO,mBAAmB,SAC5B,OAAM,IAAI,MACR,WAAW,KAAK,QAAQ,+CAA+C,iBACxE;GAIH,MAAM,QAAQ,IAAI,OAAA,MAAM,KAAK,SAAS;AACtC,WAAQ,IAAI,KAAK,SAAS;IACxB,UAAU,CAAC,GAAG,eAAe,UAAU,MAAM;IAC7C,UAAU,KAAK,YAAY;IAC5B,CAAC;AAEF;;AAGF,QAAM,IAAI,UAAU,wBAAwB,KAAK,UAAU,MAAM,MAAM,EAAE,GAAG;;AAG9E,QAAO;;AAGT,SAAgB,YAAY,QAAoC;AAC9D,SAAM,sBAAsB,OAAO;CACnC,MAAM,WAAW,iBAAiB,OAAO,SAAS,EAAE,CAAC;CACrD,MAAM,WAAW,iBAAiB,OAAO,SAAS,EAAE,CAAC;AACrD,SAAM,yCAAyC,SAAS,MAAM,SAAS,KAAK;CAC5E,MAAM,gBAAgB,OAAO,gBAAgB,IAAI,KAAK,OAAO,cAAc,GAAG;AAC9E,KAAI,iBAAiB,MAAM,cAAc,SAAS,CAAC,CACjD,OAAM,IAAI,UAAU,gBAAgB,OAAO,cAAc,iCAAiC;CAG5F,MAAM,aAAa,OAAO,aAAa,OAAO,OAAO,WAAW,GAAG;CACnE,IAAI,WAA0B;AAC9B,KAAI,eAAe,MAAM;AACvB,MAAI,MAAM,WAAW,IAAI,aAAa,EACpC,OAAM,IAAI,UAAU,kBAAkB,OAAO,WAAW,8BAA8B;AAGxF,aAAW,aAAa,KAAK,KAAK,KAAK;;AAGzC,QAAO;EACL;EACA;EACA,YAAY;EACZ,YAAY;EACb"}

package/build/config/parser.mjs

@@ -0,0 +1,54 @@
+import buildDebug from "debug";
+import { Range } from "semver";
+//#region src/config/parser.ts
+var debug = buildDebug("verdaccio:plugin:package-filter:config");
+function parseConfigRules(configRules) {
+	const ruleMap = /* @__PURE__ */ new Map();
+	for (const rule of configRules) {
+		if ("scope" in rule && typeof rule.scope === "string") {
+			if (!rule.scope.startsWith("@")) throw new TypeError(`Scope value must start with @, found: ${rule.scope}`);
+			ruleMap.set(rule.scope, "scope");
+			continue;
+		}
+		if ("package" in rule && !("versions" in rule)) {
+			ruleMap.set(rule.package, "package");
+			continue;
+		}
+		if ("package" in rule && "versions" in rule) {
+			const previousConfig = ruleMap.get(rule.package) || { versions: [] };
+			if (typeof previousConfig === "string") throw new Error(`Package ${rule.package} is already specified by another strict rule ${previousConfig}`);
+			const range = new Range(rule.versions);
+			ruleMap.set(rule.package, {
+				versions: [...previousConfig.versions, range],
+				strategy: rule.strategy ?? "block"
+			});
+			continue;
+		}
+		throw new TypeError(`Could not parse rule ${JSON.stringify(rule, null, 4)}`);
+	}
+	return ruleMap;
+}
+function parseConfig(config) {
+	debug("parsing config: %o", config);
+	const blockMap = parseConfigRules(config.block ?? []);
+	const allowMap = parseConfigRules(config.allow ?? []);
+	debug("parsed %d block rules, %d allow rules", blockMap.size, allowMap.size);
+	const dateThreshold = config.dateThreshold ? new Date(config.dateThreshold) : null;
+	if (dateThreshold && isNaN(dateThreshold.getTime())) throw new TypeError(`Invalid date ${config.dateThreshold} was provided for dateThreshold`);
+	const minAgeDays = config.minAgeDays ? Number(config.minAgeDays) : null;
+	let minAgeMs = null;
+	if (minAgeDays !== null) {
+		if (isNaN(minAgeDays) || minAgeDays < 0) throw new TypeError(`Invalid number ${config.minAgeDays} was provided for minAgeDays`);
+		minAgeMs = minAgeDays * 24 * 60 * 60 * 1e3;
+	}
+	return {
+		dateThreshold,
+		minAgeMs,
+		blockRules: blockMap,
+		allowRules: allowMap
+	};
+}
+//#endregion
+export { parseConfig };
+
+//# sourceMappingURL=parser.mjs.map

package/build/config/parser.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.mjs","names":[],"sources":["../../src/config/parser.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Range } from 'semver';\n\nimport type { ConfigRule, ParsedConfig, ParsedRule, PluginConfig } from './types';\n\nconst debug = buildDebug('verdaccio:plugin:package-filter:config');\n\nfunction parseConfigRules(configRules: ConfigRule[]): Map<string, ParsedRule> {\n  const ruleMap = new Map<string, ParsedRule>();\n  for (const rule of configRules) {\n    if ('scope' in rule && typeof rule.scope === 'string') {\n      if (!rule.scope.startsWith('@')) {\n        throw new TypeError(`Scope value must start with @, found: ${rule.scope}`);\n      }\n\n      ruleMap.set(rule.scope, 'scope');\n      continue;\n    }\n\n    if ('package' in rule && !('versions' in rule)) {\n      ruleMap.set(rule.package, 'package');\n      continue;\n    }\n\n    if ('package' in rule && 'versions' in rule) {\n      const previousConfig = ruleMap.get(rule.package) || { versions: [] };\n\n      if (typeof previousConfig === 'string') {\n        throw new Error(\n          `Package ${rule.package} is already specified by another strict rule ${previousConfig}`\n        );\n      }\n\n      // Merge version ranges of the rules for the same package\n      const range = new Range(rule.versions);\n      ruleMap.set(rule.package, {\n        versions: [...previousConfig.versions, range],\n        strategy: rule.strategy ?? 'block',\n      });\n\n      continue;\n    }\n\n    throw new TypeError(`Could not parse rule ${JSON.stringify(rule, null, 4)}`);\n  }\n\n  return ruleMap;\n}\n\nexport function parseConfig(config: PluginConfig): ParsedConfig {\n  debug('parsing config: %o', config);\n  const blockMap = parseConfigRules(config.block ?? []);\n  const allowMap = parseConfigRules(config.allow ?? []);\n  debug('parsed %d block rules, %d allow rules', blockMap.size, allowMap.size);\n  const dateThreshold = config.dateThreshold ? new Date(config.dateThreshold) : null;\n  if (dateThreshold && isNaN(dateThreshold.getTime())) {\n    throw new TypeError(`Invalid date ${config.dateThreshold} was provided for dateThreshold`);\n  }\n\n  const minAgeDays = config.minAgeDays ? Number(config.minAgeDays) : null;\n  let minAgeMs: number | null = null;\n  if (minAgeDays !== null) {\n    if (isNaN(minAgeDays) || minAgeDays < 0) {\n      throw new TypeError(`Invalid number ${config.minAgeDays} was provided for minAgeDays`);\n    }\n\n    minAgeMs = minAgeDays * 24 * 60 * 60 * 1000;\n  }\n\n  return {\n    dateThreshold,\n    minAgeMs,\n    blockRules: blockMap,\n    allowRules: allowMap,\n  };\n}\n"],"mappings":";;;AAKA,IAAM,QAAQ,WAAW,yCAAyC;AAElE,SAAS,iBAAiB,aAAoD;CAC5E,MAAM,0BAAU,IAAI,KAAyB;AAC7C,MAAK,MAAM,QAAQ,aAAa;AAC9B,MAAI,WAAW,QAAQ,OAAO,KAAK,UAAU,UAAU;AACrD,OAAI,CAAC,KAAK,MAAM,WAAW,IAAI,CAC7B,OAAM,IAAI,UAAU,yCAAyC,KAAK,QAAQ;AAG5E,WAAQ,IAAI,KAAK,OAAO,QAAQ;AAChC;;AAGF,MAAI,aAAa,QAAQ,EAAE,cAAc,OAAO;AAC9C,WAAQ,IAAI,KAAK,SAAS,UAAU;AACpC;;AAGF,MAAI,aAAa,QAAQ,cAAc,MAAM;GAC3C,MAAM,iBAAiB,QAAQ,IAAI,KAAK,QAAQ,IAAI,EAAE,UAAU,EAAE,EAAE;AAEpE,OAAI,OAAO,mBAAmB,SAC5B,OAAM,IAAI,MACR,WAAW,KAAK,QAAQ,+CAA+C,iBACxE;GAIH,MAAM,QAAQ,IAAI,MAAM,KAAK,SAAS;AACtC,WAAQ,IAAI,KAAK,SAAS;IACxB,UAAU,CAAC,GAAG,eAAe,UAAU,MAAM;IAC7C,UAAU,KAAK,YAAY;IAC5B,CAAC;AAEF;;AAGF,QAAM,IAAI,UAAU,wBAAwB,KAAK,UAAU,MAAM,MAAM,EAAE,GAAG;;AAG9E,QAAO;;AAGT,SAAgB,YAAY,QAAoC;AAC9D,OAAM,sBAAsB,OAAO;CACnC,MAAM,WAAW,iBAAiB,OAAO,SAAS,EAAE,CAAC;CACrD,MAAM,WAAW,iBAAiB,OAAO,SAAS,EAAE,CAAC;AACrD,OAAM,yCAAyC,SAAS,MAAM,SAAS,KAAK;CAC5E,MAAM,gBAAgB,OAAO,gBAAgB,IAAI,KAAK,OAAO,cAAc,GAAG;AAC9E,KAAI,iBAAiB,MAAM,cAAc,SAAS,CAAC,CACjD,OAAM,IAAI,UAAU,gBAAgB,OAAO,cAAc,iCAAiC;CAG5F,MAAM,aAAa,OAAO,aAAa,OAAO,OAAO,WAAW,GAAG;CACnE,IAAI,WAA0B;AAC9B,KAAI,eAAe,MAAM;AACvB,MAAI,MAAM,WAAW,IAAI,aAAa,EACpC,OAAM,IAAI,UAAU,kBAAkB,OAAO,WAAW,8BAA8B;AAGxF,aAAW,aAAa,KAAK,KAAK,KAAK;;AAGzC,QAAO;EACL;EACA;EACA,YAAY;EACZ,YAAY;EACb"}

package/build/config/types.d.ts

@@ -0,0 +1,39 @@
+import { Range } from 'semver';
+export type BlockStrategy = 'block' | 'replace';
+export type ConfigRule = {
+    scope: string;
+} | {
+    package: string;
+} | {
+    package: string;
+    versions: string;
+    strategy?: BlockStrategy;
+};
+export interface PluginConfig {
+    /**
+     * An absolute date cutoff (e.g. '2023-01-01'). Versions published after this
+     * date will be blocked. When both `dateThreshold` and `minAgeDays` are set,
+     * the earlier (more restrictive) date wins.
+     */
+    dateThreshold?: string | number;
+    /**
+     * A relative age cutoff in days. Versions published less than this many days
+     * ago will be blocked. When both `minAgeDays` and `dateThreshold` are set,
+     * the earlier (more restrictive) date wins.
+     */
+    minAgeDays?: number;
+    block?: ConfigRule[];
+    allow?: ConfigRule[];
+}
+export interface ParsedConfigRule {
+    versions: Range[];
+    strategy?: BlockStrategy;
+}
+export type PackageScopeLevel = 'scope' | 'package' | undefined;
+export type ParsedRule = ParsedConfigRule | PackageScopeLevel;
+export interface ParsedConfig {
+    dateThreshold: Date | null;
+    minAgeMs: number | null;
+    blockRules: Map<string, ParsedRule>;
+    allowRules: Map<string, ParsedRule>;
+}

package/build/filtering/matcher.d.ts

@@ -0,0 +1,8 @@
+import { Manifest } from '@verdaccio/types';
+import { ParsedRule } from '../config/types';
+import { MatchResult } from './types';
+/**
+ * Try to find a rule that matches the package.
+ * If found, returns the rule and the matched package versions from the manifest.
+ */
+export declare function matchRules(manifest: Manifest, rules: Map<string, ParsedRule>): MatchResult | undefined;

package/build/filtering/matcher.js

@@ -0,0 +1,71 @@
+const require_runtime = require("../_virtual/_rolldown/runtime.js");
+const require_types = require("./types.js");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+let semver = require("semver");
+//#region src/filtering/matcher.ts
+var debug$1 = (0, debug.default)("verdaccio:plugin:package-filter:filter");
+/**
+* Split a package name into name itself and scope.
+*/
+function splitName(name) {
+	if (!name) return { name: "" };
+	const parts = name.split("/");
+	if (parts.length > 1) return {
+		scope: parts[0],
+		name: parts[1]
+	};
+	else return { name: parts[0] };
+}
+/**
+* Try to find a rule that matches the package.
+* If found, returns the rule and the matched package versions from the manifest.
+*/
+function matchRules(manifest, rules) {
+	const { scope } = splitName(manifest.name);
+	if (scope) {
+		const rule = rules.get(scope);
+		if (rule === "scope") {
+			debug$1("scope match: %s matched rule for %s", manifest.name, scope);
+			return {
+				type: require_types.MatchType.SCOPE,
+				rule,
+				scope,
+				versions: Object.keys(manifest.versions)
+			};
+		}
+	}
+	const rule = rules.get(manifest.name);
+	if (!rule) return;
+	if (rule === "package") {
+		debug$1("package match: %s", manifest.name);
+		return {
+			type: require_types.MatchType.PACKAGE,
+			rule,
+			package: manifest.name,
+			versions: Object.keys(manifest.versions)
+		};
+	}
+	if (rule === "scope") throw new Error("Unexpected case - rule for package should never be \"scope\"");
+	const versionRanges = rule.versions;
+	if (versionRanges.length === 0) return;
+	const matchedVersions = [];
+	Object.keys(manifest.versions).forEach((version) => {
+		versionRanges.forEach((versionRange) => {
+			if ((0, semver.satisfies)(version, versionRange, {
+				includePrerelease: true,
+				loose: true
+			})) matchedVersions.push(version);
+		});
+	});
+	if (matchedVersions.length > 0) debug$1("version match: %s matched %d versions: %o", manifest.name, matchedVersions.length, matchedVersions);
+	return {
+		type: require_types.MatchType.VERSIONS,
+		rule,
+		versions: matchedVersions
+	};
+}
+//#endregion
+exports.matchRules = matchRules;
+
+//# sourceMappingURL=matcher.js.map

package/build/filtering/matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"matcher.js","names":[],"sources":["../../src/filtering/matcher.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { satisfies } from 'semver';\n\nimport type { Manifest } from '@verdaccio/types';\n\nimport type { ParsedRule } from '../config/types';\nimport type { MatchResult } from './types';\nimport { MatchType } from './types';\n\nconst debug = buildDebug('verdaccio:plugin:package-filter:filter');\n\n/**\n * Split a package name into name itself and scope.\n */\nfunction splitName(name: string): { name: string; scope?: string } {\n  if (!name) {\n    return { name: '' };\n  }\n\n  const parts = name.split('/');\n\n  if (parts.length > 1) {\n    return {\n      scope: parts[0],\n      name: parts[1],\n    };\n  } else {\n    return {\n      name: parts[0],\n    };\n  }\n}\n\n/**\n * Try to find a rule that matches the package.\n * If found, returns the rule and the matched package versions from the manifest.\n */\nexport function matchRules(\n  manifest: Manifest,\n  rules: Map<string, ParsedRule>\n): MatchResult | undefined {\n  const { scope } = splitName(manifest.name);\n  if (scope) {\n    const rule = rules.get(scope);\n    if (rule === 'scope') {\n      debug('scope match: %s matched rule for %s', manifest.name, scope);\n      return {\n        type: MatchType.SCOPE,\n        rule,\n        scope,\n        versions: Object.keys(manifest.versions),\n      };\n    }\n  }\n\n  const rule = rules.get(manifest.name);\n  if (!rule) {\n    // No match\n    return undefined;\n  }\n\n  if (rule === 'package') {\n    debug('package match: %s', manifest.name);\n    return {\n      type: MatchType.PACKAGE,\n      rule,\n      package: manifest.name,\n      versions: Object.keys(manifest.versions),\n    };\n  }\n\n  if (rule === 'scope') {\n    throw new Error('Unexpected case - rule for package should never be \"scope\"');\n  }\n\n  const versionRanges = rule.versions;\n  if (versionRanges.length === 0) {\n    // No match\n    return undefined;\n  }\n\n  const matchedVersions: string[] = [];\n  Object.keys(manifest.versions).forEach((version) => {\n    versionRanges.forEach((versionRange) => {\n      if (\n        satisfies(version, versionRange, {\n          includePrerelease: true,\n          loose: true,\n        })\n      ) {\n        matchedVersions.push(version);\n      }\n    });\n  });\n\n  if (matchedVersions.length > 0) {\n    debug(\n      'version match: %s matched %d versions: %o',\n      manifest.name,\n      matchedVersions.length,\n      matchedVersions\n    );\n  }\n\n  return {\n    type: MatchType.VERSIONS,\n    rule,\n    versions: matchedVersions,\n  };\n}\n"],"mappings":";;;;;;AASA,IAAM,WAAA,GAAA,MAAA,SAAmB,yCAAyC;;;;AAKlE,SAAS,UAAU,MAAgD;AACjE,KAAI,CAAC,KACH,QAAO,EAAE,MAAM,IAAI;CAGrB,MAAM,QAAQ,KAAK,MAAM,IAAI;AAE7B,KAAI,MAAM,SAAS,EACjB,QAAO;EACL,OAAO,MAAM;EACb,MAAM,MAAM;EACb;KAED,QAAO,EACL,MAAM,MAAM,IACb;;;;;;AAQL,SAAgB,WACd,UACA,OACyB;CACzB,MAAM,EAAE,UAAU,UAAU,SAAS,KAAK;AAC1C,KAAI,OAAO;EACT,MAAM,OAAO,MAAM,IAAI,MAAM;AAC7B,MAAI,SAAS,SAAS;AACpB,WAAM,uCAAuC,SAAS,MAAM,MAAM;AAClE,UAAO;IACL,MAAM,cAAA,UAAU;IAChB;IACA;IACA,UAAU,OAAO,KAAK,SAAS,SAAS;IACzC;;;CAIL,MAAM,OAAO,MAAM,IAAI,SAAS,KAAK;AACrC,KAAI,CAAC,KAEH;AAGF,KAAI,SAAS,WAAW;AACtB,UAAM,qBAAqB,SAAS,KAAK;AACzC,SAAO;GACL,MAAM,cAAA,UAAU;GAChB;GACA,SAAS,SAAS;GAClB,UAAU,OAAO,KAAK,SAAS,SAAS;GACzC;;AAGH,KAAI,SAAS,QACX,OAAM,IAAI,MAAM,+DAA6D;CAG/E,MAAM,gBAAgB,KAAK;AAC3B,KAAI,cAAc,WAAW,EAE3B;CAGF,MAAM,kBAA4B,EAAE;AACpC,QAAO,KAAK,SAAS,SAAS,CAAC,SAAS,YAAY;AAClD,gBAAc,SAAS,iBAAiB;AACtC,QAAA,GAAA,OAAA,WACY,SAAS,cAAc;IAC/B,mBAAmB;IACnB,OAAO;IACR,CAAC,CAEF,iBAAgB,KAAK,QAAQ;IAE/B;GACF;AAEF,KAAI,gBAAgB,SAAS,EAC3B,SACE,6CACA,SAAS,MACT,gBAAgB,QAChB,gBACD;AAGH,QAAO;EACL,MAAM,cAAA,UAAU;EAChB;EACA,UAAU;EACX"}

package/build/filtering/matcher.mjs

@@ -0,0 +1,69 @@
+import { MatchType } from "./types.mjs";
+import buildDebug from "debug";
+import { satisfies } from "semver";
+//#region src/filtering/matcher.ts
+var debug = buildDebug("verdaccio:plugin:package-filter:filter");
+/**
+* Split a package name into name itself and scope.
+*/
+function splitName(name) {
+	if (!name) return { name: "" };
+	const parts = name.split("/");
+	if (parts.length > 1) return {
+		scope: parts[0],
+		name: parts[1]
+	};
+	else return { name: parts[0] };
+}
+/**
+* Try to find a rule that matches the package.
+* If found, returns the rule and the matched package versions from the manifest.
+*/
+function matchRules(manifest, rules) {
+	const { scope } = splitName(manifest.name);
+	if (scope) {
+		const rule = rules.get(scope);
+		if (rule === "scope") {
+			debug("scope match: %s matched rule for %s", manifest.name, scope);
+			return {
+				type: MatchType.SCOPE,
+				rule,
+				scope,
+				versions: Object.keys(manifest.versions)
+			};
+		}
+	}
+	const rule = rules.get(manifest.name);
+	if (!rule) return;
+	if (rule === "package") {
+		debug("package match: %s", manifest.name);
+		return {
+			type: MatchType.PACKAGE,
+			rule,
+			package: manifest.name,
+			versions: Object.keys(manifest.versions)
+		};
+	}
+	if (rule === "scope") throw new Error("Unexpected case - rule for package should never be \"scope\"");
+	const versionRanges = rule.versions;
+	if (versionRanges.length === 0) return;
+	const matchedVersions = [];
+	Object.keys(manifest.versions).forEach((version) => {
+		versionRanges.forEach((versionRange) => {
+			if (satisfies(version, versionRange, {
+				includePrerelease: true,
+				loose: true
+			})) matchedVersions.push(version);
+		});
+	});
+	if (matchedVersions.length > 0) debug("version match: %s matched %d versions: %o", manifest.name, matchedVersions.length, matchedVersions);
+	return {
+		type: MatchType.VERSIONS,
+		rule,
+		versions: matchedVersions
+	};
+}
+//#endregion
+export { matchRules };
+
+//# sourceMappingURL=matcher.mjs.map