@verdaccio/package-filter 14.0.0-next-9.30

package/build/packageFilter.mjs

@@ -0,0 +1,78 @@
+import { parseConfig } from "./config/parser.mjs";
+import { filterBlockedVersions } from "./filtering/packageVersion.mjs";
+import { filterVersionsByPublishDate } from "./filtering/publishDate.mjs";
+import { jsonLogReplacer } from "./utils/jsonUtils.mjs";
+import { cleanupDistFiles, cleanupTags, cleanupTime, getManifestClone, setupCreatedAndModified, setupLatestTag } from "./utils/manifestUtils.mjs";
+import buildDebug from "debug";
+import { pluginUtils } from "@verdaccio/core";
+//#region src/packageFilter.ts
+var debug = buildDebug("verdaccio:plugin:package-filter");
+var PackageFilterPlugin = class extends pluginUtils.Plugin {
+	config;
+	parsedConfig;
+	logger;
+	constructor(config, options) {
+		super(config, options);
+		this.config = config ?? {};
+		this.logger = options.logger;
+		this.parsedConfig = parseConfig(this.config);
+		debug("plugin loaded: block rules: %d, allow rules: %d", this.parsedConfig.blockRules.size, this.parsedConfig.allowRules.size);
+		this.logger.debug({ config: JSON.stringify(this.parsedConfig, jsonLogReplacer) }, "package-filter loaded with config: @{config}");
+		this.logger.trace({
+			blockRules: this.parsedConfig.blockRules.size,
+			allowRules: this.parsedConfig.allowRules.size
+		}, "package-filter plugin initialized: @{blockRules} block rules, @{allowRules} allow rules");
+		if (this.parsedConfig.dateThreshold) {
+			debug("date threshold: %s", this.parsedConfig.dateThreshold.toISOString());
+			this.logger.trace({ dateThreshold: this.parsedConfig.dateThreshold.toISOString() }, "package-filter date threshold: @{dateThreshold}");
+		}
+		if (this.parsedConfig.minAgeMs) {
+			const minAgeDays = this.parsedConfig.minAgeMs / (1440 * 60 * 1e3);
+			debug("min age: %d days", minAgeDays);
+			this.logger.trace({ minAgeDays }, "package-filter min age: @{minAgeDays} days");
+		}
+	}
+	async filter_metadata(manifest) {
+		const { dateThreshold, minAgeMs, blockRules, allowRules } = this.parsedConfig;
+		const versionCount = Object.keys(manifest.versions ?? {}).length;
+		debug("filtering manifest for %s (%d versions)", manifest.name, versionCount);
+		this.logger.trace({
+			name: manifest.name,
+			versionCount
+		}, "package-filter processing @{name} (@{versionCount} versions)");
+		let newManifest = getManifestClone(manifest);
+		if (blockRules.size > 0) newManifest = filterBlockedVersions(newManifest, blockRules, allowRules, this.logger);
+		let earliestDateThreshold = null;
+		if (minAgeMs) earliestDateThreshold = new Date(Date.now() - minAgeMs);
+		if (dateThreshold && (!earliestDateThreshold || dateThreshold < earliestDateThreshold)) earliestDateThreshold = dateThreshold;
+		if (earliestDateThreshold) {
+			debug("applying date filter for %s, threshold: %s", manifest.name, earliestDateThreshold.toISOString());
+			this.logger.trace({
+				name: manifest.name,
+				threshold: earliestDateThreshold.toISOString()
+			}, "applying date filter for @{name}, cutoff: @{threshold}");
+			newManifest = filterVersionsByPublishDate(newManifest, earliestDateThreshold, allowRules);
+		}
+		cleanupTags(newManifest);
+		setupLatestTag(newManifest);
+		cleanupTime(newManifest);
+		setupCreatedAndModified(newManifest);
+		cleanupDistFiles(newManifest);
+		const filteredCount = Object.keys(newManifest.versions).length;
+		const removedCount = versionCount - filteredCount;
+		if (filteredCount !== versionCount) {
+			debug("filtered %s: %d -> %d versions (%d removed)", manifest.name, versionCount, filteredCount, removedCount);
+			this.logger.trace({
+				name: manifest.name,
+				before: versionCount,
+				after: filteredCount,
+				removed: removedCount
+			}, "package-filter @{name}: @{before} -> @{after} versions (@{removed} removed)");
+		} else debug("no versions filtered for %s", manifest.name);
+		return newManifest;
+	}
+};
+//#endregion
+export { PackageFilterPlugin };
+
+//# sourceMappingURL=packageFilter.mjs.map

package/build/packageFilter.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"packageFilter.mjs","names":[],"sources":["../src/packageFilter.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { pluginUtils } from '@verdaccio/core';\nimport type { Logger, Manifest } from '@verdaccio/types';\n\nimport { parseConfig } from './config/parser';\nimport type { ParsedConfig, PluginConfig } from './config/types';\nimport { filterBlockedVersions } from './filtering/packageVersion';\nimport { filterVersionsByPublishDate } from './filtering/publishDate';\nimport { jsonLogReplacer } from './utils/jsonUtils';\nimport {\n  cleanupDistFiles,\n  cleanupTags,\n  cleanupTime,\n  getManifestClone,\n  setupCreatedAndModified,\n  setupLatestTag,\n} from './utils/manifestUtils';\n\nconst debug = buildDebug('verdaccio:plugin:package-filter');\n\nexport class PackageFilterPlugin\n  extends pluginUtils.Plugin<PluginConfig>\n  implements pluginUtils.ManifestFilter<PluginConfig>\n{\n  public readonly config: PluginConfig;\n  private readonly parsedConfig: ParsedConfig;\n  protected readonly logger: Logger;\n\n  public constructor(config: PluginConfig, options: pluginUtils.PluginOptions) {\n    super(config, options);\n    this.config = config ?? {};\n    this.logger = options.logger;\n    this.parsedConfig = parseConfig(this.config);\n\n    debug(\n      'plugin loaded: block rules: %d, allow rules: %d',\n      this.parsedConfig.blockRules.size,\n      this.parsedConfig.allowRules.size\n    );\n    this.logger.debug(\n      { config: JSON.stringify(this.parsedConfig, jsonLogReplacer) },\n      'package-filter loaded with config: @{config}'\n    );\n    this.logger.trace(\n      {\n        blockRules: this.parsedConfig.blockRules.size,\n        allowRules: this.parsedConfig.allowRules.size,\n      },\n      'package-filter plugin initialized: @{blockRules} block rules, @{allowRules} allow rules'\n    );\n    if (this.parsedConfig.dateThreshold) {\n      debug('date threshold: %s', this.parsedConfig.dateThreshold.toISOString());\n      this.logger.trace(\n        { dateThreshold: this.parsedConfig.dateThreshold.toISOString() },\n        'package-filter date threshold: @{dateThreshold}'\n      );\n    }\n    if (this.parsedConfig.minAgeMs) {\n      const minAgeDays = this.parsedConfig.minAgeMs / (24 * 60 * 60 * 1000);\n      debug('min age: %d days', minAgeDays);\n      this.logger.trace({ minAgeDays }, 'package-filter min age: @{minAgeDays} days');\n    }\n  }\n\n  public async filter_metadata(manifest: Readonly<Manifest>): Promise<Manifest> {\n    const { dateThreshold, minAgeMs, blockRules, allowRules } = this.parsedConfig;\n    const versionCount = Object.keys(manifest.versions ?? {}).length;\n    debug('filtering manifest for %s (%d versions)', manifest.name, versionCount);\n    this.logger.trace(\n      { name: manifest.name, versionCount },\n      'package-filter processing @{name} (@{versionCount} versions)'\n    );\n\n    let newManifest = getManifestClone(manifest);\n    if (blockRules.size > 0) {\n      newManifest = filterBlockedVersions(newManifest, blockRules, allowRules, this.logger);\n    }\n\n    let earliestDateThreshold: Date | null = null;\n    if (minAgeMs) {\n      earliestDateThreshold = new Date(Date.now() - minAgeMs);\n    }\n\n    if (dateThreshold && (!earliestDateThreshold || dateThreshold < earliestDateThreshold)) {\n      earliestDateThreshold = dateThreshold;\n    }\n\n    if (earliestDateThreshold) {\n      debug(\n        'applying date filter for %s, threshold: %s',\n        manifest.name,\n        earliestDateThreshold.toISOString()\n      );\n      this.logger.trace(\n        { name: manifest.name, threshold: earliestDateThreshold.toISOString() },\n        'applying date filter for @{name}, cutoff: @{threshold}'\n      );\n      newManifest = filterVersionsByPublishDate(newManifest, earliestDateThreshold, allowRules);\n    }\n\n    cleanupTags(newManifest);\n    setupLatestTag(newManifest);\n    cleanupTime(newManifest);\n    setupCreatedAndModified(newManifest);\n    cleanupDistFiles(newManifest);\n\n    const filteredCount = Object.keys(newManifest.versions).length;\n    const removedCount = versionCount - filteredCount;\n    if (filteredCount !== versionCount) {\n      debug(\n        'filtered %s: %d -> %d versions (%d removed)',\n        manifest.name,\n        versionCount,\n        filteredCount,\n        removedCount\n      );\n      this.logger.trace(\n        { name: manifest.name, before: versionCount, after: filteredCount, removed: removedCount },\n        'package-filter @{name}: @{before} -> @{after} versions (@{removed} removed)'\n      );\n    } else {\n      debug('no versions filtered for %s', manifest.name);\n    }\n\n    return newManifest;\n  }\n}\n"],"mappings":";;;;;;;;AAmBA,IAAM,QAAQ,WAAW,kCAAkC;AAE3D,IAAa,sBAAb,cACU,YAAY,OAEtB;CACE;CACA;CACA;CAEA,YAAmB,QAAsB,SAAoC;AAC3E,QAAM,QAAQ,QAAQ;AACtB,OAAK,SAAS,UAAU,EAAE;AAC1B,OAAK,SAAS,QAAQ;AACtB,OAAK,eAAe,YAAY,KAAK,OAAO;AAE5C,QACE,mDACA,KAAK,aAAa,WAAW,MAC7B,KAAK,aAAa,WAAW,KAC9B;AACD,OAAK,OAAO,MACV,EAAE,QAAQ,KAAK,UAAU,KAAK,cAAc,gBAAgB,EAAE,EAC9D,+CACD;AACD,OAAK,OAAO,MACV;GACE,YAAY,KAAK,aAAa,WAAW;GACzC,YAAY,KAAK,aAAa,WAAW;GAC1C,EACD,0FACD;AACD,MAAI,KAAK,aAAa,eAAe;AACnC,SAAM,sBAAsB,KAAK,aAAa,cAAc,aAAa,CAAC;AAC1E,QAAK,OAAO,MACV,EAAE,eAAe,KAAK,aAAa,cAAc,aAAa,EAAE,EAChE,kDACD;;AAEH,MAAI,KAAK,aAAa,UAAU;GAC9B,MAAM,aAAa,KAAK,aAAa,YAAY,OAAU,KAAK;AAChE,SAAM,oBAAoB,WAAW;AACrC,QAAK,OAAO,MAAM,EAAE,YAAY,EAAE,6CAA6C;;;CAInF,MAAa,gBAAgB,UAAiD;EAC5E,MAAM,EAAE,eAAe,UAAU,YAAY,eAAe,KAAK;EACjE,MAAM,eAAe,OAAO,KAAK,SAAS,YAAY,EAAE,CAAC,CAAC;AAC1D,QAAM,2CAA2C,SAAS,MAAM,aAAa;AAC7E,OAAK,OAAO,MACV;GAAE,MAAM,SAAS;GAAM;GAAc,EACrC,+DACD;EAED,IAAI,cAAc,iBAAiB,SAAS;AAC5C,MAAI,WAAW,OAAO,EACpB,eAAc,sBAAsB,aAAa,YAAY,YAAY,KAAK,OAAO;EAGvF,IAAI,wBAAqC;AACzC,MAAI,SACF,yBAAwB,IAAI,KAAK,KAAK,KAAK,GAAG,SAAS;AAGzD,MAAI,kBAAkB,CAAC,yBAAyB,gBAAgB,uBAC9D,yBAAwB;AAG1B,MAAI,uBAAuB;AACzB,SACE,8CACA,SAAS,MACT,sBAAsB,aAAa,CACpC;AACD,QAAK,OAAO,MACV;IAAE,MAAM,SAAS;IAAM,WAAW,sBAAsB,aAAa;IAAE,EACvE,yDACD;AACD,iBAAc,4BAA4B,aAAa,uBAAuB,WAAW;;AAG3F,cAAY,YAAY;AACxB,iBAAe,YAAY;AAC3B,cAAY,YAAY;AACxB,0BAAwB,YAAY;AACpC,mBAAiB,YAAY;EAE7B,MAAM,gBAAgB,OAAO,KAAK,YAAY,SAAS,CAAC;EACxD,MAAM,eAAe,eAAe;AACpC,MAAI,kBAAkB,cAAc;AAClC,SACE,+CACA,SAAS,MACT,cACA,eACA,aACD;AACD,QAAK,OAAO,MACV;IAAE,MAAM,SAAS;IAAM,QAAQ;IAAc,OAAO;IAAe,SAAS;IAAc,EAC1F,8EACD;QAED,OAAM,+BAA+B,SAAS,KAAK;AAGrD,SAAO"}

package/build/utils/jsonUtils.d.ts

@@ -0,0 +1 @@
+export declare function jsonLogReplacer(_key: string, value: unknown): any;

package/build/utils/jsonUtils.js

@@ -0,0 +1,12 @@
+require("../_virtual/_rolldown/runtime.js");
+let semver = require("semver");
+//#region src/utils/jsonUtils.ts
+function jsonLogReplacer(_key, value) {
+	if (value instanceof Map) return Object.fromEntries(value);
+	if (value instanceof semver.Range) return value.range;
+	return value;
+}
+//#endregion
+exports.jsonLogReplacer = jsonLogReplacer;
+
+//# sourceMappingURL=jsonUtils.js.map

package/build/utils/jsonUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonUtils.js","names":[],"sources":["../../src/utils/jsonUtils.ts"],"sourcesContent":["import { Range } from 'semver';\n\nexport function jsonLogReplacer(_key: string, value: unknown) {\n  if (value instanceof Map) {\n    return Object.fromEntries(value);\n  }\n\n  if (value instanceof Range) {\n    return value.range;\n  }\n\n  return value;\n}\n"],"mappings":";;;AAEA,SAAgB,gBAAgB,MAAc,OAAgB;AAC5D,KAAI,iBAAiB,IACnB,QAAO,OAAO,YAAY,MAAM;AAGlC,KAAI,iBAAiB,OAAA,MACnB,QAAO,MAAM;AAGf,QAAO"}

package/build/utils/jsonUtils.mjs

@@ -0,0 +1,11 @@
+import { Range } from "semver";
+//#region src/utils/jsonUtils.ts
+function jsonLogReplacer(_key, value) {
+	if (value instanceof Map) return Object.fromEntries(value);
+	if (value instanceof Range) return value.range;
+	return value;
+}
+//#endregion
+export { jsonLogReplacer };
+
+//# sourceMappingURL=jsonUtils.mjs.map

package/build/utils/jsonUtils.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonUtils.mjs","names":[],"sources":["../../src/utils/jsonUtils.ts"],"sourcesContent":["import { Range } from 'semver';\n\nexport function jsonLogReplacer(_key: string, value: unknown) {\n  if (value instanceof Map) {\n    return Object.fromEntries(value);\n  }\n\n  if (value instanceof Range) {\n    return value.range;\n  }\n\n  return value;\n}\n"],"mappings":";;AAEA,SAAgB,gBAAgB,MAAc,OAAgB;AAC5D,KAAI,iBAAiB,IACnB,QAAO,OAAO,YAAY,MAAM;AAGlC,KAAI,iBAAiB,MACnB,QAAO,MAAM;AAGf,QAAO"}

package/build/utils/manifestUtils.d.ts

@@ -0,0 +1,36 @@
+import { Manifest } from '@verdaccio/types';
+/**
+ * Delete `dist-tags` entries corresponding to missing versions.
+ */
+export declare function cleanupTags(manifest: Manifest): void;
+/**
+ * Delete `time` entries corresponding to missing versions.
+ */
+export declare function cleanupTime(manifest: Manifest): void;
+/**
+ * Get the latest version from a list of versions,
+ * ordered by time of their publication stored in the manifest.
+ */
+export declare function getLatestVersion(manifest: Manifest, versions: string[]): string | undefined;
+/**
+ * Set the latest tag if dist-tags/latest is missing.
+ * The last stable version available is used when possible.
+ * Otherwise, it uses the latest version not found in dist-tags.
+ */
+export declare function setupLatestTag(manifest: Manifest): void;
+/**
+ * Set the created and modified times.
+ */
+export declare function setupCreatedAndModified(manifest: Manifest): void;
+/**
+ * Remove `_distfiles` entries which are not used by any version.
+ */
+export declare function cleanupDistFiles(manifest: Manifest): void;
+/**
+ * Creates a copy of a manifest suitable for safe, localized mutation.
+ *
+ * The returned object is shallow-cloned, except for `versions`, `dist-tags`,
+ * `time`, and `_distfiles`, which are cloned as independent maps so they can be
+ * filtered or modified without affecting the original manifest.
+ */
+export declare function getManifestClone(manifest: Readonly<Manifest>): Manifest;

package/build/utils/manifestUtils.js

@@ -0,0 +1,115 @@
+const require_runtime = require("../_virtual/_rolldown/runtime.js");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+let _verdaccio_core = require("@verdaccio/core");
+let semver = require("semver");
+semver = require_runtime.__toESM(semver);
+//#region src/utils/manifestUtils.ts
+var debug$1 = (0, debug.default)("verdaccio:plugin:package-filter:manifest");
+/**
+* Delete `dist-tags` entries corresponding to missing versions.
+*/
+function cleanupTags(manifest) {
+	const distTags = manifest[_verdaccio_core.DIST_TAGS];
+	Object.entries(distTags).forEach(([tag, tagVersion]) => {
+		if (!manifest.versions[tagVersion]) {
+			debug$1("removing orphaned dist-tag %s -> %s from %s", tag, tagVersion, manifest.name);
+			delete distTags[tag];
+		}
+	});
+}
+/**
+* Delete `time` entries corresponding to missing versions.
+*/
+function cleanupTime(manifest) {
+	const time = manifest.time;
+	if (!time) return;
+	Object.keys(time).forEach((version) => {
+		if (!manifest.versions[version]) delete time[version];
+	});
+}
+/**
+* Get the latest version from a list of versions,
+* ordered by time of their publication stored in the manifest.
+*/
+function getLatestVersion(manifest, versions) {
+	const time = manifest.time;
+	if (!time) return versions.sort(semver.default.rcompare)[0];
+	const timedVersions = versions.map((v) => ({
+		version: v,
+		time: time[v]
+	})).filter((v) => v.time);
+	if (timedVersions.length === 0) return;
+	return timedVersions.sort((a, b) => new Date(b.time).getTime() - new Date(a.time).getTime())[0].version;
+}
+/**
+* Set the latest tag if dist-tags/latest is missing.
+* The last stable version available is used when possible.
+* Otherwise, it uses the latest version not found in dist-tags.
+*/
+function setupLatestTag(manifest) {
+	const distTags = manifest[_verdaccio_core.DIST_TAGS];
+	if (distTags.latest) return;
+	const versions = Object.keys(manifest.versions);
+	if (versions.length === 0) return;
+	const distTagsVersions = Object.values(distTags);
+	const untaggedVersions = versions.filter((v) => semver.default.valid(v) && !distTagsVersions.includes(v));
+	if (untaggedVersions.length === 0) return;
+	const latestStableVersion = getLatestVersion(manifest, untaggedVersions.filter((v) => !semver.default.prerelease(v)));
+	if (latestStableVersion) {
+		debug$1("reassigned latest tag to stable version %s for %s", latestStableVersion, manifest.name);
+		distTags.latest = latestStableVersion;
+		return;
+	}
+	const latestVersion = getLatestVersion(manifest, untaggedVersions);
+	if (!latestVersion) return;
+	debug$1("reassigned latest tag to pre-release version %s for %s", latestVersion, manifest.name);
+	distTags.latest = latestVersion;
+}
+/**
+* Set the created and modified times.
+*/
+function setupCreatedAndModified(manifest) {
+	const time = manifest.time;
+	if (!time) return;
+	const times = Object.values(time);
+	if (times.length === 0) return;
+	const sortedTimes = times.sort((a, b) => new Date(a).getTime() - new Date(b).getTime());
+	time.created = sortedTimes[0];
+	time.modified = sortedTimes[sortedTimes.length - 1];
+}
+/**
+* Remove `_distfiles` entries which are not used by any version.
+*/
+function cleanupDistFiles(manifest) {
+	const distFiles = manifest._distfiles;
+	Object.entries(distFiles).forEach(([key, file]) => {
+		const fileUrl = file.url;
+		if (!Object.values(manifest.versions).find((v) => v.dist?.tarball === fileUrl)) delete distFiles[key];
+	});
+}
+/**
+* Creates a copy of a manifest suitable for safe, localized mutation.
+*
+* The returned object is shallow-cloned, except for `versions`, `dist-tags`,
+* `time`, and `_distfiles`, which are cloned as independent maps so they can be
+* filtered or modified without affecting the original manifest.
+*/
+function getManifestClone(manifest) {
+	return {
+		...manifest,
+		versions: { ...manifest.versions },
+		[_verdaccio_core.DIST_TAGS]: { ...manifest[_verdaccio_core.DIST_TAGS] },
+		time: { ...manifest.time },
+		_distfiles: { ...manifest._distfiles }
+	};
+}
+//#endregion
+exports.cleanupDistFiles = cleanupDistFiles;
+exports.cleanupTags = cleanupTags;
+exports.cleanupTime = cleanupTime;
+exports.getManifestClone = getManifestClone;
+exports.setupCreatedAndModified = setupCreatedAndModified;
+exports.setupLatestTag = setupLatestTag;
+
+//# sourceMappingURL=manifestUtils.js.map

package/build/utils/manifestUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifestUtils.js","names":[],"sources":["../../src/utils/manifestUtils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport semver from 'semver';\n\nimport { DIST_TAGS } from '@verdaccio/core';\nimport type { Manifest } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:plugin:package-filter:manifest');\n\n/**\n * Delete `dist-tags` entries corresponding to missing versions.\n */\nexport function cleanupTags(manifest: Manifest): void {\n  const distTags = manifest[DIST_TAGS];\n  Object.entries(distTags).forEach(([tag, tagVersion]) => {\n    if (!manifest.versions[tagVersion]) {\n      debug('removing orphaned dist-tag %s -> %s from %s', tag, tagVersion, manifest.name);\n      delete distTags[tag];\n    }\n  });\n}\n\n/**\n * Delete `time` entries corresponding to missing versions.\n */\nexport function cleanupTime(manifest: Manifest): void {\n  const time = manifest.time;\n  if (!time) {\n    return;\n  }\n\n  Object.keys(time).forEach((version) => {\n    if (!manifest.versions[version]) {\n      delete time[version];\n    }\n  });\n}\n\n/**\n * Get the latest version from a list of versions,\n * ordered by time of their publication stored in the manifest.\n */\nexport function getLatestVersion(manifest: Manifest, versions: string[]): string | undefined {\n  const time = manifest.time;\n  if (!time) {\n    // No time information, it's the best we can do\n    const sortedVersions = versions.sort(semver.rcompare);\n    return sortedVersions[0];\n  }\n\n  const timedVersions = versions\n    .map((v) => ({\n      version: v,\n      time: time[v],\n    }))\n    .filter((v) => v.time);\n\n  if (timedVersions.length === 0) {\n    return undefined;\n  }\n\n  const timeOrderedVersions = timedVersions.sort(\n    (a, b) => new Date(b.time).getTime() - new Date(a.time).getTime()\n  );\n  return timeOrderedVersions[0].version;\n}\n\n/**\n * Set the latest tag if dist-tags/latest is missing.\n * The last stable version available is used when possible.\n * Otherwise, it uses the latest version not found in dist-tags.\n */\nexport function setupLatestTag(manifest: Manifest): void {\n  const distTags = manifest[DIST_TAGS];\n  if (distTags.latest) {\n    // Tag 'latest' must only be fixed when latest version was blocked\n    return;\n  }\n\n  const versions = Object.keys(manifest.versions);\n  if (versions.length === 0) {\n    return;\n  }\n\n  const distTagsVersions = Object.values(distTags);\n  const untaggedVersions = versions.filter((v) => semver.valid(v) && !distTagsVersions.includes(v));\n  if (untaggedVersions.length === 0) {\n    return;\n  }\n\n  // Try stable versions first (no \"-next\" or \"-beta\", etc.)\n  const stableVersions = untaggedVersions.filter((v) => !semver.prerelease(v));\n  const latestStableVersion = getLatestVersion(manifest, stableVersions);\n  if (latestStableVersion) {\n    debug('reassigned latest tag to stable version %s for %s', latestStableVersion, manifest.name);\n    distTags.latest = latestStableVersion;\n    return;\n  }\n\n  // Fallback to all untagged versions\n  const latestVersion = getLatestVersion(manifest, untaggedVersions);\n  if (!latestVersion) {\n    return;\n  }\n\n  debug('reassigned latest tag to pre-release version %s for %s', latestVersion, manifest.name);\n  distTags.latest = latestVersion;\n}\n\n/**\n * Set the created and modified times.\n */\nexport function setupCreatedAndModified(manifest: Manifest): void {\n  const time = manifest.time;\n  if (!time) {\n    return;\n  }\n\n  const times = Object.values(time);\n  if (times.length === 0) {\n    return;\n  }\n\n  const sortedTimes = times.sort((a, b) => new Date(a).getTime() - new Date(b).getTime());\n  time.created = sortedTimes[0];\n  time.modified = sortedTimes[sortedTimes.length - 1];\n}\n\n/**\n * Remove `_distfiles` entries which are not used by any version.\n */\nexport function cleanupDistFiles(manifest: Manifest): void {\n  const distFiles = manifest._distfiles;\n  Object.entries(distFiles).forEach(([key, file]) => {\n    const fileUrl = file.url;\n    const versionPointingToFile = Object.values(manifest.versions).find(\n      (v) => v.dist?.tarball === fileUrl\n    );\n\n    if (!versionPointingToFile) {\n      delete distFiles[key];\n    }\n  });\n}\n\n/**\n * Creates a copy of a manifest suitable for safe, localized mutation.\n *\n * The returned object is shallow-cloned, except for `versions`, `dist-tags`,\n * `time`, and `_distfiles`, which are cloned as independent maps so they can be\n * filtered or modified without affecting the original manifest.\n */\nexport function getManifestClone(manifest: Readonly<Manifest>): Manifest {\n  return {\n    ...manifest,\n    versions: {\n      ...manifest.versions,\n    },\n    [DIST_TAGS]: {\n      ...manifest[DIST_TAGS],\n    },\n    time: {\n      ...manifest.time,\n    },\n    _distfiles: {\n      ...manifest._distfiles,\n    },\n  };\n}\n"],"mappings":";;;;;;;AAMA,IAAM,WAAA,GAAA,MAAA,SAAmB,2CAA2C;;;;AAKpE,SAAgB,YAAY,UAA0B;CACpD,MAAM,WAAW,SAAS,gBAAA;AAC1B,QAAO,QAAQ,SAAS,CAAC,SAAS,CAAC,KAAK,gBAAgB;AACtD,MAAI,CAAC,SAAS,SAAS,aAAa;AAClC,WAAM,+CAA+C,KAAK,YAAY,SAAS,KAAK;AACpF,UAAO,SAAS;;GAElB;;;;;AAMJ,SAAgB,YAAY,UAA0B;CACpD,MAAM,OAAO,SAAS;AACtB,KAAI,CAAC,KACH;AAGF,QAAO,KAAK,KAAK,CAAC,SAAS,YAAY;AACrC,MAAI,CAAC,SAAS,SAAS,SACrB,QAAO,KAAK;GAEd;;;;;;AAOJ,SAAgB,iBAAiB,UAAoB,UAAwC;CAC3F,MAAM,OAAO,SAAS;AACtB,KAAI,CAAC,KAGH,QADuB,SAAS,KAAK,OAAA,QAAO,SAAS,CAC/B;CAGxB,MAAM,gBAAgB,SACnB,KAAK,OAAO;EACX,SAAS;EACT,MAAM,KAAK;EACZ,EAAE,CACF,QAAQ,MAAM,EAAE,KAAK;AAExB,KAAI,cAAc,WAAW,EAC3B;AAMF,QAH4B,cAAc,MACvC,GAAG,MAAM,IAAI,KAAK,EAAE,KAAK,CAAC,SAAS,GAAG,IAAI,KAAK,EAAE,KAAK,CAAC,SAAS,CAClE,CAC0B,GAAG;;;;;;;AAQhC,SAAgB,eAAe,UAA0B;CACvD,MAAM,WAAW,SAAS,gBAAA;AAC1B,KAAI,SAAS,OAEX;CAGF,MAAM,WAAW,OAAO,KAAK,SAAS,SAAS;AAC/C,KAAI,SAAS,WAAW,EACtB;CAGF,MAAM,mBAAmB,OAAO,OAAO,SAAS;CAChD,MAAM,mBAAmB,SAAS,QAAQ,MAAM,OAAA,QAAO,MAAM,EAAE,IAAI,CAAC,iBAAiB,SAAS,EAAE,CAAC;AACjG,KAAI,iBAAiB,WAAW,EAC9B;CAKF,MAAM,sBAAsB,iBAAiB,UADtB,iBAAiB,QAAQ,MAAM,CAAC,OAAA,QAAO,WAAW,EAAE,CAAC,CACN;AACtE,KAAI,qBAAqB;AACvB,UAAM,qDAAqD,qBAAqB,SAAS,KAAK;AAC9F,WAAS,SAAS;AAClB;;CAIF,MAAM,gBAAgB,iBAAiB,UAAU,iBAAiB;AAClE,KAAI,CAAC,cACH;AAGF,SAAM,0DAA0D,eAAe,SAAS,KAAK;AAC7F,UAAS,SAAS;;;;;AAMpB,SAAgB,wBAAwB,UAA0B;CAChE,MAAM,OAAO,SAAS;AACtB,KAAI,CAAC,KACH;CAGF,MAAM,QAAQ,OAAO,OAAO,KAAK;AACjC,KAAI,MAAM,WAAW,EACnB;CAGF,MAAM,cAAc,MAAM,MAAM,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC,SAAS,GAAG,IAAI,KAAK,EAAE,CAAC,SAAS,CAAC;AACvF,MAAK,UAAU,YAAY;AAC3B,MAAK,WAAW,YAAY,YAAY,SAAS;;;;;AAMnD,SAAgB,iBAAiB,UAA0B;CACzD,MAAM,YAAY,SAAS;AAC3B,QAAO,QAAQ,UAAU,CAAC,SAAS,CAAC,KAAK,UAAU;EACjD,MAAM,UAAU,KAAK;AAKrB,MAAI,CAJ0B,OAAO,OAAO,SAAS,SAAS,CAAC,MAC5D,MAAM,EAAE,MAAM,YAAY,QAC5B,CAGC,QAAO,UAAU;GAEnB;;;;;;;;;AAUJ,SAAgB,iBAAiB,UAAwC;AACvE,QAAO;EACL,GAAG;EACH,UAAU,EACR,GAAG,SAAS,UACb;GACA,gBAAA,YAAY,EACX,GAAG,SAAS,gBAAA,YACb;EACD,MAAM,EACJ,GAAG,SAAS,MACb;EACD,YAAY,EACV,GAAG,SAAS,YACb;EACF"}

package/build/utils/manifestUtils.mjs

@@ -0,0 +1,107 @@
+import buildDebug from "debug";
+import { DIST_TAGS } from "@verdaccio/core";
+import semver from "semver";
+//#region src/utils/manifestUtils.ts
+var debug = buildDebug("verdaccio:plugin:package-filter:manifest");
+/**
+* Delete `dist-tags` entries corresponding to missing versions.
+*/
+function cleanupTags(manifest) {
+	const distTags = manifest[DIST_TAGS];
+	Object.entries(distTags).forEach(([tag, tagVersion]) => {
+		if (!manifest.versions[tagVersion]) {
+			debug("removing orphaned dist-tag %s -> %s from %s", tag, tagVersion, manifest.name);
+			delete distTags[tag];
+		}
+	});
+}
+/**
+* Delete `time` entries corresponding to missing versions.
+*/
+function cleanupTime(manifest) {
+	const time = manifest.time;
+	if (!time) return;
+	Object.keys(time).forEach((version) => {
+		if (!manifest.versions[version]) delete time[version];
+	});
+}
+/**
+* Get the latest version from a list of versions,
+* ordered by time of their publication stored in the manifest.
+*/
+function getLatestVersion(manifest, versions) {
+	const time = manifest.time;
+	if (!time) return versions.sort(semver.rcompare)[0];
+	const timedVersions = versions.map((v) => ({
+		version: v,
+		time: time[v]
+	})).filter((v) => v.time);
+	if (timedVersions.length === 0) return;
+	return timedVersions.sort((a, b) => new Date(b.time).getTime() - new Date(a.time).getTime())[0].version;
+}
+/**
+* Set the latest tag if dist-tags/latest is missing.
+* The last stable version available is used when possible.
+* Otherwise, it uses the latest version not found in dist-tags.
+*/
+function setupLatestTag(manifest) {
+	const distTags = manifest[DIST_TAGS];
+	if (distTags.latest) return;
+	const versions = Object.keys(manifest.versions);
+	if (versions.length === 0) return;
+	const distTagsVersions = Object.values(distTags);
+	const untaggedVersions = versions.filter((v) => semver.valid(v) && !distTagsVersions.includes(v));
+	if (untaggedVersions.length === 0) return;
+	const latestStableVersion = getLatestVersion(manifest, untaggedVersions.filter((v) => !semver.prerelease(v)));
+	if (latestStableVersion) {
+		debug("reassigned latest tag to stable version %s for %s", latestStableVersion, manifest.name);
+		distTags.latest = latestStableVersion;
+		return;
+	}
+	const latestVersion = getLatestVersion(manifest, untaggedVersions);
+	if (!latestVersion) return;
+	debug("reassigned latest tag to pre-release version %s for %s", latestVersion, manifest.name);
+	distTags.latest = latestVersion;
+}
+/**
+* Set the created and modified times.
+*/
+function setupCreatedAndModified(manifest) {
+	const time = manifest.time;
+	if (!time) return;
+	const times = Object.values(time);
+	if (times.length === 0) return;
+	const sortedTimes = times.sort((a, b) => new Date(a).getTime() - new Date(b).getTime());
+	time.created = sortedTimes[0];
+	time.modified = sortedTimes[sortedTimes.length - 1];
+}
+/**
+* Remove `_distfiles` entries which are not used by any version.
+*/
+function cleanupDistFiles(manifest) {
+	const distFiles = manifest._distfiles;
+	Object.entries(distFiles).forEach(([key, file]) => {
+		const fileUrl = file.url;
+		if (!Object.values(manifest.versions).find((v) => v.dist?.tarball === fileUrl)) delete distFiles[key];
+	});
+}
+/**
+* Creates a copy of a manifest suitable for safe, localized mutation.
+*
+* The returned object is shallow-cloned, except for `versions`, `dist-tags`,
+* `time`, and `_distfiles`, which are cloned as independent maps so they can be
+* filtered or modified without affecting the original manifest.
+*/
+function getManifestClone(manifest) {
+	return {
+		...manifest,
+		versions: { ...manifest.versions },
+		[DIST_TAGS]: { ...manifest[DIST_TAGS] },
+		time: { ...manifest.time },
+		_distfiles: { ...manifest._distfiles }
+	};
+}
+//#endregion
+export { cleanupDistFiles, cleanupTags, cleanupTime, getManifestClone, setupCreatedAndModified, setupLatestTag };
+
+//# sourceMappingURL=manifestUtils.mjs.map

package/build/utils/manifestUtils.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifestUtils.mjs","names":[],"sources":["../../src/utils/manifestUtils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport semver from 'semver';\n\nimport { DIST_TAGS } from '@verdaccio/core';\nimport type { Manifest } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:plugin:package-filter:manifest');\n\n/**\n * Delete `dist-tags` entries corresponding to missing versions.\n */\nexport function cleanupTags(manifest: Manifest): void {\n  const distTags = manifest[DIST_TAGS];\n  Object.entries(distTags).forEach(([tag, tagVersion]) => {\n    if (!manifest.versions[tagVersion]) {\n      debug('removing orphaned dist-tag %s -> %s from %s', tag, tagVersion, manifest.name);\n      delete distTags[tag];\n    }\n  });\n}\n\n/**\n * Delete `time` entries corresponding to missing versions.\n */\nexport function cleanupTime(manifest: Manifest): void {\n  const time = manifest.time;\n  if (!time) {\n    return;\n  }\n\n  Object.keys(time).forEach((version) => {\n    if (!manifest.versions[version]) {\n      delete time[version];\n    }\n  });\n}\n\n/**\n * Get the latest version from a list of versions,\n * ordered by time of their publication stored in the manifest.\n */\nexport function getLatestVersion(manifest: Manifest, versions: string[]): string | undefined {\n  const time = manifest.time;\n  if (!time) {\n    // No time information, it's the best we can do\n    const sortedVersions = versions.sort(semver.rcompare);\n    return sortedVersions[0];\n  }\n\n  const timedVersions = versions\n    .map((v) => ({\n      version: v,\n      time: time[v],\n    }))\n    .filter((v) => v.time);\n\n  if (timedVersions.length === 0) {\n    return undefined;\n  }\n\n  const timeOrderedVersions = timedVersions.sort(\n    (a, b) => new Date(b.time).getTime() - new Date(a.time).getTime()\n  );\n  return timeOrderedVersions[0].version;\n}\n\n/**\n * Set the latest tag if dist-tags/latest is missing.\n * The last stable version available is used when possible.\n * Otherwise, it uses the latest version not found in dist-tags.\n */\nexport function setupLatestTag(manifest: Manifest): void {\n  const distTags = manifest[DIST_TAGS];\n  if (distTags.latest) {\n    // Tag 'latest' must only be fixed when latest version was blocked\n    return;\n  }\n\n  const versions = Object.keys(manifest.versions);\n  if (versions.length === 0) {\n    return;\n  }\n\n  const distTagsVersions = Object.values(distTags);\n  const untaggedVersions = versions.filter((v) => semver.valid(v) && !distTagsVersions.includes(v));\n  if (untaggedVersions.length === 0) {\n    return;\n  }\n\n  // Try stable versions first (no \"-next\" or \"-beta\", etc.)\n  const stableVersions = untaggedVersions.filter((v) => !semver.prerelease(v));\n  const latestStableVersion = getLatestVersion(manifest, stableVersions);\n  if (latestStableVersion) {\n    debug('reassigned latest tag to stable version %s for %s', latestStableVersion, manifest.name);\n    distTags.latest = latestStableVersion;\n    return;\n  }\n\n  // Fallback to all untagged versions\n  const latestVersion = getLatestVersion(manifest, untaggedVersions);\n  if (!latestVersion) {\n    return;\n  }\n\n  debug('reassigned latest tag to pre-release version %s for %s', latestVersion, manifest.name);\n  distTags.latest = latestVersion;\n}\n\n/**\n * Set the created and modified times.\n */\nexport function setupCreatedAndModified(manifest: Manifest): void {\n  const time = manifest.time;\n  if (!time) {\n    return;\n  }\n\n  const times = Object.values(time);\n  if (times.length === 0) {\n    return;\n  }\n\n  const sortedTimes = times.sort((a, b) => new Date(a).getTime() - new Date(b).getTime());\n  time.created = sortedTimes[0];\n  time.modified = sortedTimes[sortedTimes.length - 1];\n}\n\n/**\n * Remove `_distfiles` entries which are not used by any version.\n */\nexport function cleanupDistFiles(manifest: Manifest): void {\n  const distFiles = manifest._distfiles;\n  Object.entries(distFiles).forEach(([key, file]) => {\n    const fileUrl = file.url;\n    const versionPointingToFile = Object.values(manifest.versions).find(\n      (v) => v.dist?.tarball === fileUrl\n    );\n\n    if (!versionPointingToFile) {\n      delete distFiles[key];\n    }\n  });\n}\n\n/**\n * Creates a copy of a manifest suitable for safe, localized mutation.\n *\n * The returned object is shallow-cloned, except for `versions`, `dist-tags`,\n * `time`, and `_distfiles`, which are cloned as independent maps so they can be\n * filtered or modified without affecting the original manifest.\n */\nexport function getManifestClone(manifest: Readonly<Manifest>): Manifest {\n  return {\n    ...manifest,\n    versions: {\n      ...manifest.versions,\n    },\n    [DIST_TAGS]: {\n      ...manifest[DIST_TAGS],\n    },\n    time: {\n      ...manifest.time,\n    },\n    _distfiles: {\n      ...manifest._distfiles,\n    },\n  };\n}\n"],"mappings":";;;;AAMA,IAAM,QAAQ,WAAW,2CAA2C;;;;AAKpE,SAAgB,YAAY,UAA0B;CACpD,MAAM,WAAW,SAAS;AAC1B,QAAO,QAAQ,SAAS,CAAC,SAAS,CAAC,KAAK,gBAAgB;AACtD,MAAI,CAAC,SAAS,SAAS,aAAa;AAClC,SAAM,+CAA+C,KAAK,YAAY,SAAS,KAAK;AACpF,UAAO,SAAS;;GAElB;;;;;AAMJ,SAAgB,YAAY,UAA0B;CACpD,MAAM,OAAO,SAAS;AACtB,KAAI,CAAC,KACH;AAGF,QAAO,KAAK,KAAK,CAAC,SAAS,YAAY;AACrC,MAAI,CAAC,SAAS,SAAS,SACrB,QAAO,KAAK;GAEd;;;;;;AAOJ,SAAgB,iBAAiB,UAAoB,UAAwC;CAC3F,MAAM,OAAO,SAAS;AACtB,KAAI,CAAC,KAGH,QADuB,SAAS,KAAK,OAAO,SAAS,CAC/B;CAGxB,MAAM,gBAAgB,SACnB,KAAK,OAAO;EACX,SAAS;EACT,MAAM,KAAK;EACZ,EAAE,CACF,QAAQ,MAAM,EAAE,KAAK;AAExB,KAAI,cAAc,WAAW,EAC3B;AAMF,QAH4B,cAAc,MACvC,GAAG,MAAM,IAAI,KAAK,EAAE,KAAK,CAAC,SAAS,GAAG,IAAI,KAAK,EAAE,KAAK,CAAC,SAAS,CAClE,CAC0B,GAAG;;;;;;;AAQhC,SAAgB,eAAe,UAA0B;CACvD,MAAM,WAAW,SAAS;AAC1B,KAAI,SAAS,OAEX;CAGF,MAAM,WAAW,OAAO,KAAK,SAAS,SAAS;AAC/C,KAAI,SAAS,WAAW,EACtB;CAGF,MAAM,mBAAmB,OAAO,OAAO,SAAS;CAChD,MAAM,mBAAmB,SAAS,QAAQ,MAAM,OAAO,MAAM,EAAE,IAAI,CAAC,iBAAiB,SAAS,EAAE,CAAC;AACjG,KAAI,iBAAiB,WAAW,EAC9B;CAKF,MAAM,sBAAsB,iBAAiB,UADtB,iBAAiB,QAAQ,MAAM,CAAC,OAAO,WAAW,EAAE,CAAC,CACN;AACtE,KAAI,qBAAqB;AACvB,QAAM,qDAAqD,qBAAqB,SAAS,KAAK;AAC9F,WAAS,SAAS;AAClB;;CAIF,MAAM,gBAAgB,iBAAiB,UAAU,iBAAiB;AAClE,KAAI,CAAC,cACH;AAGF,OAAM,0DAA0D,eAAe,SAAS,KAAK;AAC7F,UAAS,SAAS;;;;;AAMpB,SAAgB,wBAAwB,UAA0B;CAChE,MAAM,OAAO,SAAS;AACtB,KAAI,CAAC,KACH;CAGF,MAAM,QAAQ,OAAO,OAAO,KAAK;AACjC,KAAI,MAAM,WAAW,EACnB;CAGF,MAAM,cAAc,MAAM,MAAM,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC,SAAS,GAAG,IAAI,KAAK,EAAE,CAAC,SAAS,CAAC;AACvF,MAAK,UAAU,YAAY;AAC3B,MAAK,WAAW,YAAY,YAAY,SAAS;;;;;AAMnD,SAAgB,iBAAiB,UAA0B;CACzD,MAAM,YAAY,SAAS;AAC3B,QAAO,QAAQ,UAAU,CAAC,SAAS,CAAC,KAAK,UAAU;EACjD,MAAM,UAAU,KAAK;AAKrB,MAAI,CAJ0B,OAAO,OAAO,SAAS,SAAS,CAAC,MAC5D,MAAM,EAAE,MAAM,YAAY,QAC5B,CAGC,QAAO,UAAU;GAEnB;;;;;;;;;AAUJ,SAAgB,iBAAiB,UAAwC;AACvE,QAAO;EACL,GAAG;EACH,UAAU,EACR,GAAG,SAAS,UACb;GACA,YAAY,EACX,GAAG,SAAS,YACb;EACD,MAAM,EACJ,GAAG,SAAS,MACb;EACD,YAAY,EACV,GAAG,SAAS,YACb;EACF"}

package/package.json

@@ -0,0 +1,73 @@
+{
+  "name": "@verdaccio/package-filter",
+  "version": "14.0.0-next-9.30",
+  "description": "Package filter plugin for Verdaccio that allows blocking packages by name, scope, version or date",
+  "keywords": [
+    "private",
+    "package",
+    "repository",
+    "registry",
+    "enterprise",
+    "modules",
+    "proxy",
+    "server",
+    "verdaccio",
+    "plugin",
+    "filter"
+  ],
+  "author": "Vitalii Sugrobov <vsugrob@hotmail.com>",
+  "contributors": [
+    "Ansile <ansilet@yandex.ru> (original project)"
+  ],
+  "license": "MIT",
+  "homepage": "https://verdaccio.org",
+  "repository": {
+    "type": "https",
+    "url": "https://github.com/verdaccio/verdaccio",
+    "directory": "packages/plugins/package-filter"
+  },
+  "bugs": {
+    "url": "https://github.com/verdaccio/verdaccio/issues"
+  },
+  "main": "build/index.js",
+  "types": "build/src/index.d.ts",
+  "engines": {
+    "node": ">=24"
+  },
+  "dependencies": {
+    "@verdaccio/core": "9.0.0-next-9.6",
+    "debug": "4.4.3",
+    "semver": "7.7.4"
+  },
+  "devDependencies": {
+    "@types/debug": "4.1.12",
+    "@verdaccio/config": "9.0.0-next-9.6",
+    "@verdaccio/logger": "9.0.0-next-9.6",
+    "@verdaccio/plugin-verifier": "1.0.0-next-9.2",
+    "@verdaccio/types": "14.0.0-next-9.3"
+  },
+  "funding": {
+    "type": "opencollective",
+    "url": "https://opencollective.com/verdaccio"
+  },
+  "module": "./build/index.mjs",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./build/index.d.ts",
+        "default": "./build/index.mjs"
+      },
+      "require": {
+        "types": "./build/index.d.ts",
+        "default": "./build/index.js"
+      }
+    },
+    "./build/*": "./build/*"
+  },
+  "scripts": {
+    "clean": "rimraf ./build",
+    "build": "vite build",
+    "watch": "vite build --watch",
+    "test": "vitest run"
+  }
+}