verdaccio 6.7.0 → 6.7.2

package/build/api/debug/index.d.ts

@@ -0,0 +1,3 @@
+import { Application } from 'express';
+declare const _default: (app: Application, selfPath: string) => void;
+export default _default;

package/build/api/endpoint/api/dist-tags.d.ts

@@ -0,0 +1,4 @@
+import type { Router } from 'express';
+import type { Auth } from '@verdaccio/auth';
+import type Storage from '../../../lib/storage';
+export default function (route: Router, auth: Auth, storage: Storage): void;

package/build/api/endpoint/api/package.d.ts

@@ -0,0 +1,5 @@
+import type { Router } from 'express';
+import type { Auth } from '@verdaccio/auth';
+import type { Config } from '@verdaccio/types';
+import type Storage from '../../../lib/storage';
+export default function (route: Router, auth: Auth, storage: Storage, config: Config): void;

package/build/api/endpoint/api/ping.d.ts

@@ -0,0 +1,2 @@
+import type { Router } from 'express';
+export default function (route: Router): void;

package/build/api/endpoint/api/publish.d.ts

@@ -0,0 +1,26 @@
+import type { Router } from 'express';
+import type { Auth } from '@verdaccio/auth';
+import type { Config } from '@verdaccio/types';
+import type Storage from '../../../lib/storage';
+import type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../../../types';
+export default function publish(router: Router, auth: Auth, storage: Storage, config: Config): void;
+/**
+ * Publish a package
+ */
+export declare function publishPackage(storage: Storage, config: Config, auth: Auth): any;
+/**
+ * un-publish a package
+ */
+export declare function unPublishPackage(storage: Storage): (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) => void;
+/**
+ * Delete tarball
+ */
+export declare function removeTarball(storage: Storage): (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) => void;
+/**
+ * Adds a new version
+ */
+export declare function addVersion(storage: Storage): (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) => void;
+/**
+ * uploadPackageTarball
+ */
+export declare function uploadPackageTarball(storage: Storage): (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) => void;

package/build/api/endpoint/api/search.d.ts

@@ -0,0 +1 @@
+export default function (route: any, auth: any, storage: any): void;

package/build/api/endpoint/api/star.d.ts

@@ -0,0 +1,4 @@
+import type { Response } from 'express';
+import type Storage from '../../../lib/storage';
+import type { $NextFunctionVer, $RequestExtend } from '../../../types';
+export default function (storage: Storage): (req: $RequestExtend, res: Response, next: $NextFunctionVer) => void;

package/build/api/endpoint/api/stars.d.ts

@@ -0,0 +1,3 @@
+import type { Router } from 'express';
+import type Storage from '../../../lib/storage';
+export default function (route: Router, storage: Storage): void;

package/build/api/endpoint/api/user.d.ts

@@ -0,0 +1,4 @@
+import type { Router } from 'express';
+import type { Auth } from '@verdaccio/auth';
+import type { Config } from '@verdaccio/types';
+export default function (route: Router, auth: Auth, config: Config): void;

package/build/api/endpoint/api/v1/profile.d.ts

@@ -0,0 +1,14 @@
+import type { Router } from 'express';
+import type { Auth } from '@verdaccio/auth';
+import type { ConfigYaml } from '@verdaccio/types';
+export interface Profile {
+    tfa: boolean;
+    name: string;
+    email: string;
+    email_verified: boolean;
+    created: string;
+    updated: string;
+    cidr_whitelist: string[] | null;
+    fullname: string;
+}
+export default function (router: Router, auth: Auth, config: ConfigYaml): void;

package/build/api/endpoint/api/v1/search.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Endpoint for npm search v1
+ * req: 'GET /-/v1/search?text=react&size=20&from=0&quality=0.65&popularity=0.98&maintenance=0.5'
+ */
+export default function (route: any, auth: any, storage: any): void;

package/build/api/endpoint/api/v1/token.d.ts

@@ -0,0 +1,8 @@
+import type { Router } from 'express';
+import type { Auth } from '@verdaccio/auth';
+import type { Config, Token } from '@verdaccio/types';
+import type Storage from '../../../../lib/storage';
+export type NormalizeToken = Token & {
+    created: string;
+};
+export default function (router: Router, auth: Auth, storage: Storage, config: Config): void;

package/build/api/endpoint/api/whoami.d.ts

@@ -0,0 +1,2 @@
+import type { Router } from 'express';
+export default function (route: Router): void;

package/build/api/endpoint/index.d.ts

@@ -0,0 +1,4 @@
+import type { Auth } from '@verdaccio/auth';
+import type { Config } from '@verdaccio/types';
+import type Storage from '../../lib/storage';
+export default function (config: Config, auth: Auth, storage: Storage): import("express-serve-static-core").Router;

package/build/api/index.d.ts

@@ -0,0 +1,4 @@
+import express from 'express';
+import type { ConfigYaml } from '@verdaccio/types';
+declare const _default: (configHash: ConfigYaml) => Promise<express.Application>;
+export default _default;

package/build/api/index.js

@@ -24,7 +24,7 @@ var _endpoint = _interopRequireDefault(require("./endpoint"));
 var _middleware2 = require("./middleware");
 var _web = _interopRequireDefault(require("./web"));
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-const version = "6.7.0" || 'dev';
+const version = "6.7.2" || 'dev';
 const defineAPI = async function (config, storage) {
   const auth = new _auth.Auth(config, _logger.logger, {
     legacyMergeConfigs: true

package/build/api/middleware.d.ts

@@ -0,0 +1,3 @@
+import type { Config } from '@verdaccio/types';
+import type { $RequestExtend, $ResponseExtend } from '../types';
+export declare function serveFavicon(config: Config): (_req: $RequestExtend, res: $ResponseExtend) => void;

package/build/api/web/api/index.d.ts

@@ -0,0 +1,2 @@
+declare const _default: (auth: any, storage: any, config: any) => import("express-serve-static-core").Router;
+export default _default;

package/build/api/web/api/package.d.ts

@@ -0,0 +1,12 @@
+import { Router } from 'express';
+import type { Auth } from '@verdaccio/auth';
+import type { Config, Manifest } from '@verdaccio/types';
+import type Storage from '../../../lib/storage';
+export type PackcageExt = Manifest & {
+    author: any;
+    dist?: {
+        tarball: string;
+    };
+};
+declare function addPackageWebApi(storage: Storage, auth: Auth, config: Config): Router;
+export default addPackageWebApi;

package/build/api/web/api/search.d.ts

@@ -0,0 +1,5 @@
+import { Router } from 'express';
+import type { Auth } from '@verdaccio/auth';
+import type Storage from '../../../lib/storage';
+declare function addSearchWebApi(storage: Storage, auth: Auth): Router;
+export default addSearchWebApi;

package/build/api/web/api/user.d.ts

@@ -0,0 +1,5 @@
+import { Router } from 'express';
+import type { Auth } from '@verdaccio/auth';
+import type { Config } from '@verdaccio/types';
+declare function addUserAuthApi(auth: Auth, config: Config): Router;
+export default addUserAuthApi;

package/build/api/web/api/utils.d.ts

@@ -0,0 +1,2 @@
+export declare function wrapPath(urlPath: string): string;
+export declare function wrapSecPath(urlPath: string): string;

package/build/api/web/index.d.ts

@@ -0,0 +1,9 @@
+import type { RequestHandler } from 'express';
+import { Router } from 'express';
+export declare const PLUGIN_UI_PREFIX = "verdaccio-theme";
+export declare const DEFAULT_PLUGIN_UI_THEME = "@verdaccio/ui-theme";
+export declare function loadTheme(config: any): Promise<any>;
+export declare function webAPIMiddleware(tokenMiddleware: RequestHandler, webEndpointsApi: RequestHandler): Router;
+export declare function webMiddleware(config: any, middlewares: any, pluginOptions: any): any;
+declare const _default: (config: any, auth: any, storage: any, logger: any) => Promise<import("express-serve-static-core").Router>;
+export default _default;

package/build/index.d.ts

@@ -0,0 +1,4 @@
+export { startVerdaccio as default, startVerdaccio } from './lib/bootstrap';
+export { runServer } from './lib/run-server';
+export { ConfigBuilder, parseConfigFile, getDefaultConfig, Config } from '@verdaccio/config';
+export { fileUtils, errorUtils, cryptoUtils, pkgUtils } from '@verdaccio/core';

package/build/lib/auth-utils.d.ts

@@ -0,0 +1,2 @@
+import { Config, Security } from '@verdaccio/types';
+export declare function getSecurity(config: Config): Security;

package/build/lib/bootstrap.d.ts

@@ -0,0 +1,22 @@
+import { Application } from 'express';
+import { Callback, ConfigYaml } from '@verdaccio/types';
+/**
+ * Trigger the server after configuration has been loaded.
+ * @param {Object} config
+ * @param {Object} cliArguments
+ * @param {String} configPath
+ * @param {String} pkgVersion
+ * @param {String} pkgName
+ * @deprecated use runServer instead
+ */
+declare function startVerdaccio(config: ConfigYaml, cliListen: string, configPath: string, pkgVersion: string, pkgName: string, callback: Callback): void;
+/**
+ *
+ * @param webServer
+ * @param addr
+ * @param pkgName
+ * @param pkgVersion
+ * @deprecated use initServer instead
+ */
+declare function listenDefaultCallback(webServer: Application, addr: any, pkgName: string, pkgVersion: string): void;
+export { startVerdaccio, listenDefaultCallback };

package/build/lib/cli/cli.d.ts

@@ -0,0 +1 @@
+export {};

package/build/lib/cli/cli.js

@@ -5,7 +5,7 @@ var _info = require("./commands/info");
 var _init = require("./commands/init");
 var _version = require("./commands/version");
 var _utils = require("./utils");
-const pkgVersion = "6.7.0" || 'dev';
+const pkgVersion = "6.7.2" || 'dev';
 if (process.getuid && process.getuid() === 0) {
   process.emitWarning(`Verdaccio doesn't need superuser privileges. don't run it under root`);
 }

package/build/lib/cli/commands/info.d.ts

@@ -0,0 +1,5 @@
+import { Command } from 'clipanion';
+export declare class InfoCommand extends Command {
+    static paths: string[][];
+    execute(): Promise<void>;
+}

package/build/lib/cli/commands/init.d.ts

@@ -0,0 +1,9 @@
+import { Command } from 'clipanion';
+export declare const DEFAULT_PROCESS_NAME: string;
+export declare class InitCommand extends Command {
+    static paths: never[][];
+    listen: string | undefined;
+    static usage: import("clipanion").Usage;
+    config: string | undefined;
+    execute(): Promise<void>;
+}

package/build/lib/cli/commands/init.js

@@ -13,7 +13,7 @@ var _runServer = require("../../run-server");
 var _utils = require("../../utils");
 var _utils2 = require("../utils");
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-const pkgVersion = "6.7.0" || 'dev';
+const pkgVersion = "6.7.2" || 'dev';
 const pkgName = 'verdaccio';
 const DEFAULT_PROCESS_NAME = exports.DEFAULT_PROCESS_NAME = 'verdaccio';
 class InitCommand extends _clipanion.Command {

package/build/lib/cli/commands/version.d.ts

@@ -0,0 +1,5 @@
+import { Command } from 'clipanion';
+export declare class VersionCommand extends Command {
+    static paths: string[][];
+    execute(): Promise<void>;
+}

package/build/lib/cli/commands/version.js

@@ -5,7 +5,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.VersionCommand = void 0;
 var _clipanion = require("clipanion");
-const pkgVersion = "6.7.0" || 'dev';
+const pkgVersion = "6.7.2" || 'dev';
 class VersionCommand extends _clipanion.Command {
   static paths = [[`--version`], [`-v`]];
   async execute() {

package/build/lib/cli/utils.d.ts

@@ -0,0 +1,4 @@
+export declare const MIN_NODE_VERSION = "18";
+export declare const RECOMMENDED_NODE_VERSION = "22";
+export declare function isVersionValid(version: any): boolean;
+export declare function isVersionRecommended(version: any): boolean;

package/build/lib/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import './cli/cli';

package/build/lib/config.d.ts

@@ -0,0 +1,5 @@
+import { Config as ConfigCore } from '@verdaccio/config';
+declare class Config extends ConfigCore {
+    constructor(config: any);
+}
+export default Config;

package/build/lib/constants.d.ts

@@ -0,0 +1,25 @@
+export { API_ERROR, API_MESSAGE, HTTP_STATUS, HEADERS, HEADER_TYPE, CHARACTER_ENCODING, TOKEN_BASIC, TOKEN_BEARER, SUPPORT_ERRORS, APP_ERROR, DEFAULT_PROTOCOL, DEFAULT_DOMAIN, } from '@verdaccio/core';
+export { ROLES, PACKAGE_ACCESS } from '@verdaccio/utils';
+export declare const TIME_EXPIRATION_24H = "24h";
+export declare const TIME_EXPIRATION_1H = "1h";
+export declare const DIST_TAGS = "dist-tags";
+export declare const LATEST = "latest";
+export declare const USERS = "users";
+export declare const DEFAULT_MIN_LIMIT_PASSWORD = 3;
+export declare const keyPem = "verdaccio-key.pem";
+export declare const certPem = "verdaccio-cert.pem";
+export declare const csrPem = "verdaccio-csr.pem";
+export declare const ERROR_CODE: {
+    token_required: string;
+};
+export declare const DEFAULT_REGISTRY = "https://registry.npmjs.org";
+export declare const DEFAULT_UPLINK = "npmjs";
+export declare const DEFAULT_NO_README = "ERROR: No README data found!";
+export declare const MODULE_NOT_FOUND = "MODULE_NOT_FOUND";
+export declare const WEB_TITLE = "Verdaccio";
+export declare const STORAGE: {
+    PACKAGE_FILE_NAME: string;
+    FILE_EXIST_ERROR: string;
+    NO_SUCH_FILE_ERROR: string;
+    DEFAULT_REVISION: string;
+};

package/build/lib/experiments.d.ts

@@ -0,0 +1 @@
+export declare function displayExperimentsInfoBox(flags: any): any;

package/build/lib/local-storage.d.ts

@@ -0,0 +1,182 @@
+import { ReadTarball, UploadTarball } from '@verdaccio/streams';
+import { Callback, Config, Logger, Manifest, MergeTags, Token, TokenFilter, Version } from '@verdaccio/types';
+import { StoragePluginLegacy } from '../../types/custom';
+import { StringValue } from '../types';
+export type StoragePlugin = StoragePluginLegacy<Config> | any;
+/**
+ * Implements Storage interface (same for storage.js, local-storage.js, up-storage.js).
+ */
+declare class LocalStorage {
+    config: Config;
+    storagePlugin: StoragePlugin;
+    logger: Logger;
+    constructor(config: Config, logger: Logger, localStorage: StoragePlugin);
+    addPackage(name: string, pkg: Manifest, callback: Callback): void;
+    /**
+     * Remove package.
+     * @param {*} name
+     * @param {*} callback
+     * @return {Function}
+     */
+    removePackage(name: string, callback: Callback): void;
+    /**
+     * Synchronize remote package info with the local one
+     * @param {*} name
+     * @param {*} packageInfo
+     * @param {*} callback
+     */
+    updateVersions(name: string, packageInfo: Manifest, callback: Callback): void;
+    /**
+     * Add a new version to a previous local package.
+     * @param {*} name
+     * @param {*} version
+     * @param {*} metadata
+     * @param {*} tag
+     * @param {*} callback
+     */
+    addVersion(name: string, version: string, metadata: Version, tag: StringValue, callback: Callback): void;
+    /**
+     * Merge a new list of tags for a local packages with the existing one.
+     * @param {*} pkgName
+     * @param {*} tags
+     * @param {*} callback
+     */
+    mergeTags(pkgName: string, tags: MergeTags, callback: Callback): void;
+    /**
+     * Return version not found
+     * @return {String}
+     * @private
+     */
+    private _getVersionNotFound;
+    /**
+     * Return file no available
+     * @return {String}
+     * @private
+     */
+    private _getFileNotAvailable;
+    /**
+     * Update the package metadata, tags and attachments (tarballs).
+     * Note: Currently supports unpublishing and deprecation.
+     * @param {*} name
+     * @param {*} incomingPkg
+     * @param {*} revision
+     * @param {*} callback
+     * @return {Function}
+     */
+    changePackage(name: string, incomingPkg: Manifest, revision: string | void, callback: Callback): void;
+    /**
+     * Remove a tarball.
+     * @param {*} name
+     * @param {*} filename
+     * @param {*} revision
+     * @param {*} callback
+     */
+    removeTarball(name: string, filename: string, revision: string, callback: Callback): void;
+    /**
+     * Add a tarball.
+     * @param {String} name
+     * @param {String} filename
+     * @return {Stream}
+     */
+    addTarball(name: string, filename: string): UploadTarball;
+    /**
+     * Get a tarball.
+     * @param {*} name
+     * @param {*} filename
+     * @return {ReadTarball}
+     */
+    getTarball(name: string, filename: string): ReadTarball;
+    /**
+     * Return a stream that emits a read failure.
+     * @private
+     * @return {ReadTarball}
+     */
+    private _createFailureStreamResponse;
+    /**
+     * Return a stream that emits the tarball data
+     * @param {Object} storage
+     * @param {String} filename
+     * @private
+     * @return {ReadTarball}
+     */
+    private _streamSuccessReadTarBall;
+    /**
+     * Retrieve a package by name.
+     * @param {*} name
+     * @param {*} callback
+     * @return {Function}
+     */
+    getPackageMetadata(name: string, callback?: Callback): void;
+    getPackageMetadataAsync(name: string): Promise<Manifest>;
+    updateVersionsAsync(name: string, packageInfo: Manifest): Promise<Manifest>;
+    /**
+     * Search a local package.
+     * @param {*} startKey
+     * @param {*} options
+     * @return {Function}
+     */
+    search(startKey: string, options: any): ReadTarball;
+    /**
+     * Retrieve a wrapper that provide access to the package location.
+     * @param {Object} pkgName package name.
+     * @return {Object}
+     */
+    private _getLocalStorage;
+    /**
+     * Read a json file from storage.
+     * @param {Object} storage
+     * @param {Function} callback
+     */
+    private _readPackage;
+    /**
+     * Walks through each package and calls `on_package` on them.
+     * @param {*} onPackage
+     * @param {*} onEnd
+     */
+    private _searchEachPackage;
+    /**
+     * Retrieve either a previous created local package or a boilerplate.
+     * @param {*} pkgName
+     * @param {*} callback
+     * @return {Function}
+     */
+    private _readCreatePackage;
+    private _createNewPackage;
+    /**
+     * Handle internal error
+     * @param {*} err
+     * @param {*} file
+     * @param {*} message
+     * @return {Object} Error instance
+     */
+    private _internalError;
+    /**
+     * @param {*} name package name
+     * @param {*} updateHandler function(package, cb) - update function
+     * @param {*} callback callback that gets invoked after it's all updated
+     * @return {Function}
+     */
+    private _updatePackage;
+    /**
+     * Update the revision (_rev) string for a package.
+     * @param {*} name
+     * @param {*} json
+     * @param {*} callback
+     * @return {Function}
+     */
+    private _writePackage;
+    private _setDefaultRevision;
+    private _deleteAttachments;
+    /**
+     * Ensure the dist file remains as the same protocol
+     * @param {Object} hash metadata
+     * @param {String} upLinkKey registry key
+     * @private
+     */
+    private _updateUplinkToRemoteProtocol;
+    getSecret(config: Config): Promise<string>;
+    saveToken(token: Token): Promise<any>;
+    deleteToken(user: string, tokenKey: string): Promise<any>;
+    readTokens(filter: TokenFilter): Promise<Token[]>;
+}
+export default LocalStorage;

package/build/lib/logger/index.d.ts

@@ -0,0 +1,6 @@
+import { setup as setupModule } from '@verdaccio/logger';
+import { Logger } from '@verdaccio/types';
+declare let logger: Logger;
+type SetupModuleOptions = Parameters<typeof setupModule>[0];
+export declare function setup(options: SetupModuleOptions): void;
+export { logger };

package/build/lib/metadata-utils.d.ts

@@ -0,0 +1,10 @@
+import { Package } from '@verdaccio/types';
+/**
+ * Function gets a local info and an info from uplinks and tries to merge it
+ exported for unit tests only.
+  * @param {*} local
+  * @param {*} up
+  * @param {*} config
+  * @static
+  */
+export declare function mergeVersions(local: Package, up: Package): void;

package/build/lib/run-server.d.ts

@@ -0,0 +1,22 @@
+import { ConfigYaml } from '@verdaccio/types';
+/**
+ * Exposes a server factory to be instantiated programmatically.
+ *
+    const app = await runServer(); // default configuration
+    const app = await runServer('./config/config.yaml');
+    const app = await runServer({ configuration });
+    app.listen(4000, (event) => {
+      // do something
+    });
+ * @param config
+ */
+export declare function runServer(config?: string | ConfigYaml, options?: {
+    listenArg?: string;
+}): Promise<any>;
+/**
+ * Return a native HTTP/HTTPS server instance
+ * @param config
+ * @param addr
+ * @param app
+ */
+export declare function createServerFactory(config: ConfigYaml, addr: any, app: any): any;

package/build/lib/storage-utils.d.ts

@@ -0,0 +1,30 @@
+import { AbbreviatedManifest, Manifest, Version } from '@verdaccio/types';
+import LocalStorage from './local-storage';
+export declare function generatePackageTemplate(name: string): Manifest;
+/**
+ * Normalize package properties, tags, revision id.
+ * @param {Object} pkg package reference.
+ */
+export declare function normalizePackage(pkg: Manifest): Manifest;
+export declare function generateRevision(rev: string): string;
+export declare function getLatestReadme(pkg: Manifest): string;
+export declare function cleanUpReadme(version: Version): Version;
+export declare const WHITELIST: string[];
+export declare function cleanUpLinksRef(keepUpLinkData: boolean, result: Manifest): Manifest;
+/**
+ * Check whether a package it is already a local package
+ * @param {*} name
+ * @param {*} localStorage
+ */
+export declare function checkPackageLocal(name: string, localStorage: LocalStorage): Promise<void>;
+export declare function publishPackage(name: string, metadata: any, localStorage: LocalStorage): Promise<void>;
+export declare function checkPackageRemote(name: string, isAllowPublishOffline: boolean, syncMetadata: any): Promise<void>;
+export declare function mergeUplinkTimeIntoLocal(cacheManifest: Manifest, remoteManifest: Manifest): any;
+export declare function prepareSearchPackage(data: Manifest, time: unknown): any;
+/**
+ * Check whether the package metadta has enough data to be published
+ * @param pkg metadata
+ */
+export declare function isPublishablePackage(pkg: Manifest): boolean;
+export declare function hasInstallScript(version: Version): boolean;
+export declare function convertAbbreviatedManifest(manifest: Manifest): AbbreviatedManifest;

package/build/lib/storage.d.ts

@@ -0,0 +1,136 @@
+import { ReadTarball } from '@verdaccio/streams';
+import { Callback, Config, Logger, Manifest, MergeTags, Version, Versions } from '@verdaccio/types';
+import { Token, TokenFilter } from '@verdaccio/types';
+import { IPluginFilters, ISyncUplinks, StringValue } from '../types';
+import LocalStorage from './local-storage';
+import ProxyStorage from './up-storage';
+declare class Storage {
+    localStorage: LocalStorage;
+    config: Config;
+    logger: Logger;
+    uplinks: Record<string, ProxyStorage>;
+    filters: IPluginFilters | undefined;
+    constructor(config: Config);
+    init(config: Config, filters?: IPluginFilters): Promise<void>;
+    private loadStorage;
+    private loadStorePlugin;
+    /**
+     *  Add a {name} package to a system
+     Function checks if package with the same name is available from uplinks.
+     If it isn't, we create package locally
+     Used storages: local (write) && uplinks
+     */
+    addPackage(name: string, metadata: any, callback: any): Promise<void>;
+    private _isAllowPublishOffline;
+    readTokens(filter: TokenFilter): Promise<Token[]>;
+    saveToken(token: Token): Promise<void>;
+    deleteToken(user: string, tokenKey: string): Promise<any>;
+    /**
+     * Add a new version of package {name} to a system
+     Used storages: local (write)
+     */
+    addVersion(name: string, version: string, metadata: Version, tag: StringValue, callback: Callback): void;
+    /**
+     * Tags a package version with a provided tag
+     Used storages: local (write)
+     */
+    mergeTags(name: string, tagHash: MergeTags, callback: Callback): void;
+    /**
+     * Change an existing package (i.e. unpublish one version)
+     Function changes a package info from local storage and all uplinks with write access./
+     Used storages: local (write)
+     */
+    changePackage(name: string, metadata: Manifest, revision: string, callback: Callback): void;
+    /**
+     * Remove a package from a system
+     Function removes a package from local storage
+     Used storages: local (write)
+     */
+    removePackage(name: string, callback: Callback): void;
+    /**
+     Remove a tarball from a system
+     Function removes a tarball from local storage.
+     Tarball in question should not be linked to in any existing
+     versions, i.e. package version should be unpublished first.
+     Used storage: local (write)
+     */
+    removeTarball(name: string, filename: string, revision: string, callback: Callback): void;
+    /**
+     * Upload a tarball for {name} package
+     Function is synchronous and returns a WritableStream
+     Used storages: local (write)
+     */
+    addTarball(name: string, filename: string): import("@verdaccio/streams").UploadTarball;
+    hasLocalTarball(name: string, filename: string): Promise<boolean>;
+    /**
+     Get a tarball from a storage for {name} package
+     Function is synchronous and returns a ReadableStream
+     Function tries to read tarball locally, if it fails then it reads package
+     information in order to figure out where we can get this tarball from
+     Used storages: local || uplink (just one)
+     */
+    getTarball(name: string, filename: string): ReadTarball;
+    /**
+     Retrieve a package metadata for {name} package
+     Function invokes localStorage.getPackage and uplink.get_package for every
+     uplink with proxy_access rights against {name} and combines results
+     into one json object
+     Used storages: local && uplink (proxy_access)
+  
+     * @param {object} options
+     * @property {string} options.name Package Name
+     * @property {object}  options.req Express `req` object
+     * @property {boolean} options.keepUpLinkData keep up link info in package meta, last update, etc.
+     * @property {function} options.callback Callback for receive data
+     */
+    getPackage(options: any): void;
+    /**
+     Retrieve remote and local packages more recent than {startkey}
+     Function streams all packages from all uplinks first, and then
+     local packages.
+     Note that local packages could override registry ones just because
+     they appear in JSON last. That's a trade-off we make to avoid
+     memory issues.
+     Used storages: local && uplink (proxy_access)
+     * @param {*} startkey
+     * @param {*} options
+     * @return {Stream}
+     */
+    search(startkey: string, options: any): any;
+    /**
+     * Retrieve only private local packages
+     * @param {*} callback
+     */
+    getLocalDatabase(callback: Callback): void;
+    /**
+     * Read each local package name, apply filters, and collect the latest version.
+     */
+    private _collectLocalPackages;
+    /**
+     * Function fetches package metadata from uplinks and synchronizes it with local data
+     if package is available locally, it MUST be provided in pkginfo
+     returns callback(err, result, uplink_errors)
+     */
+    _syncUplinksMetadata(name: string, packageInfo: Manifest, options: ISyncUplinks, callback: Callback): void;
+    /**
+     * Apply all configured filter plugins to a package manifest sequentially.
+     * Each filter's output is passed as input to the next filter.
+     * Returns the filtered manifest and any errors that occurred.
+     */
+    private _applyFilters;
+    /**
+     * Check if a tarball should be served based on filter plugins, using only
+     * local metadata. Returns true (defer) when the version isn't cached locally
+     * — the uplink-sync path in getTarball re-checks filters after sync, which
+     * avoids a redundant uplink round-trip and double filter application.
+     */
+    private _isTarballAllowedByFilters;
+    /**
+     * Set a hidden value for each version.
+     * @param {Array} versions list of version
+     * @param {String} upLink uplink name
+     * @private
+     */
+    _updateVersionsHiddenUpLink(versions: Versions, upLink: ProxyStorage): void;
+}
+export default Storage;

package/build/lib/up-storage.d.ts

@@ -0,0 +1,138 @@
+import { ReadTarball } from '@verdaccio/streams';
+import { Callback, Config, Logger, UpLinkConf } from '@verdaccio/types';
+/**
+ * Implements Storage interface
+ * (same for storage.js, local-storage.js, up-storage.js)
+ */
+declare class ProxyStorage {
+    config: UpLinkConf;
+    failed_requests: number;
+    userAgent: string;
+    ca: string | void;
+    logger: Logger;
+    server_id: string;
+    url: any;
+    maxage: number;
+    timeout: number;
+    max_fails: number;
+    fail_timeout: number;
+    agent_options: any;
+    upname: string;
+    proxy: string | void;
+    last_request_time: number | null;
+    strict_ssl: boolean;
+    /**
+     * Constructor
+     * @param {*} config
+     * @param {*} mainConfig
+     */
+    constructor(config: UpLinkConf, mainConfig: Config);
+    /**
+     * Fetch an asset.
+     * @param {*} options
+     * @param {*} cb
+     * @return {Request}
+     */
+    private request;
+    /**
+     * Set default headers.
+     * @param {Object} options
+     * @return {Object}
+     * @private
+     */
+    private _setHeaders;
+    /**
+     * Validate configuration auth and assign Header authorization
+     * @param {Object} headers
+     * @return {Object}
+     * @private
+     */
+    private _setAuth;
+    /**
+     * @param {string} message
+     * @throws {Error}
+     * @private
+     */
+    private _throwErrorAuth;
+    /**
+     * Assign Header authorization with type authentication
+     * @param {Object} headers
+     * @param {string} type
+     * @param {string} token
+     * @private
+     */
+    private _setHeaderAuthorization;
+    /**
+     * It will add or override specified headers from config file.
+     *
+     * Eg:
+     *
+     * uplinks:
+     npmjs:
+     url: https://registry.npmjs.org/
+     headers:
+     Accept: "application/vnd.npm.install-v2+json; q=1.0"
+     verdaccio-staging:
+     url: https://mycompany.com/npm
+     headers:
+     Accept: "application/json"
+     authorization: "Basic YourBase64EncodedCredentials=="
+  
+     * @param {Object} headers
+     * @private
+     */
+    private _overrideWithUpLinkConfigHeaders;
+    /**
+     * Determine whether can fetch from the provided URL
+     * @param {*} url
+     * @return {Boolean}
+     */
+    isUplinkValid(url: string): boolean;
+    /**
+     * Get a remote package metadata
+     * @param {*} name package name
+     * @param {*} options request options, eg: eTag.
+     * @param {*} callback
+     */
+    getRemoteMetadata(name: string, options: any, callback: Callback): void;
+    /**
+     * Fetch a tarball from the uplink.
+     * @param {String} url
+     * @return {Stream}
+     */
+    fetchTarball(url: string): ReadTarball;
+    /**
+     * Perform a stream search.
+     * @param {*} options request options
+     * @return {Stream}
+     */
+    search(options: any): any;
+    /**
+     * Add proxy headers.
+     * FIXME: object mutations, it should return an new object
+     * @param {*} req the http request
+     * @param {*} headers the request headers
+     */
+    private _addProxyHeaders;
+    /**
+     * Check whether the remote host is available.
+     * @param {*} alive
+     * @return {Boolean}
+     */
+    private _statusCheck;
+    /**
+     * If the request failure.
+     * @return {boolean}
+     * @private
+     */
+    private _ifRequestFailure;
+    /**
+     * Set up a proxy.
+     * @param {*} hostname
+     * @param {*} config
+     * @param {*} mainconfig
+     * @param {*} isHTTPS
+     */
+    private _setupProxy;
+}
+export default ProxyStorage;

package/build/lib/uplink-util.d.ts

@@ -0,0 +1,7 @@
+import { Config, Versions } from '@verdaccio/types';
+import ProxyStorage from './up-storage';
+/**
+ * Set up the Up Storage for each link.
+ */
+export declare function setupUpLinks(config: Config): Record<string, ProxyStorage>;
+export declare function updateVersionsHiddenUpLink(versions: Versions, upLink: any): void;

package/build/lib/utils.d.ts

@@ -0,0 +1,68 @@
+import { parseConfigFile } from '@verdaccio/config';
+import { errorUtils, validationUtils } from '@verdaccio/core';
+import { ConfigYaml, StringValue } from '@verdaccio/types';
+import { Config, Manifest, Version } from '@verdaccio/types';
+import { buildToken as buildTokenUtil } from '@verdaccio/utils';
+export declare function initLogger(logConfig: ConfigYaml): void;
+export declare function addScope(scope: string, packageName: string): string;
+/**
+ * Check whether an element is an Object
+ * @param {*} obj the element
+ * @return {Boolean}
+ */
+export declare const isObject: typeof validationUtils.isObject;
+/**
+ * @deprecated not used un v6
+ */
+export declare function isObjectOrArray(obj: any): boolean;
+export declare function tagVersion(data: Manifest, version: string, tag: StringValue): boolean;
+/**
+ * Gets version from a package object taking into account semver weirdness.
+ * @return {String} return the semantic version of a package
+ */
+export declare function getVersion(pkg: Manifest, version: any): Version | void;
+/**
+ * Flatten arrays of tags.
+ * @param {*} data
+ */
+export declare function normalizeDistTags(pkg: Manifest): void;
+/**
+ * Parse an internal string to number
+ * @param {*} interval
+ * @return {Number}
+ */
+export declare function parseInterval(interval: any): number;
+export declare const ErrorCode: {
+    getConflict: typeof errorUtils.getConflict;
+    getBadData: typeof errorUtils.getBadData;
+    getBadRequest: typeof errorUtils.getBadRequest;
+    getInternalError: typeof errorUtils.getInternalError;
+    getUnauthorized: typeof errorUtils.getUnauthorized;
+    getForbidden: typeof errorUtils.getForbidden;
+    getServiceUnavailable: typeof errorUtils.getServiceUnavailable;
+    getNotFound: typeof errorUtils.getNotFound;
+    getCode: typeof errorUtils.getCode;
+};
+export declare function sortByName(packages: any[], orderAscending?: boolean | void): string[];
+export declare function deleteProperties(propertiesToDelete: string[], objectItem: any): any;
+/**
+ * parse package readme - markdown/ascii
+ * @param {String} packageName name of package
+ * @param {String} readme package readme
+
+ * @return {String} converted html template
+ */
+export declare function parseReadme(packageName: string, readme: string): string | void;
+export declare function encodeScopedUri(packageName: any): string;
+export declare function hasDiffOneKey(versions: any): boolean;
+export declare function isVersionValid(packageMeta: any, packageVersion: any): boolean;
+export declare function isRelatedToDeprecation(pkgInfo: Manifest): boolean;
+export declare const resolveConfigPath: (storageLocation: string, file: string) => string;
+export declare function logHTTPSWarning(storageLocation: any): void;
+export declare function hasLogin(config: Config): boolean;
+/**
+ * Check whether any version in a package manifest has a tarball URL
+ * that matches the given filename.
+ */
+export declare function hasTarball(pkg: Manifest, filename: string): boolean;
+export { buildTokenUtil as buildToken, parseConfigFile };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verdaccio",
-  "version": "6.7.0",
+  "version": "6.7.2",
   "description": "A lightweight private npm proxy registry",
   "author": {
     "name": "Verdaccio Maintainers",
@@ -20,22 +20,22 @@
   },
   "dependencies": {
     "@cypress/request": "3.0.10",
-    "@verdaccio/auth": "8.0.1",
-    "@verdaccio/config": "8.1.0",
-    "@verdaccio/core": "8.1.0",
-    "@verdaccio/hooks": "8.0.1",
-    "@verdaccio/loaders": "8.0.1",
-    "@verdaccio/local-storage-legacy": "11.3.1",
-    "@verdaccio/logger": "8.0.1",
-    "@verdaccio/middleware": "8.0.1",
-    "@verdaccio/package-filter": "13.0.1",
-    "@verdaccio/search-indexer": "8.0.0",
-    "@verdaccio/signature": "8.0.1",
-    "@verdaccio/streams": "10.2.3",
-    "@verdaccio/tarball": "13.0.1",
+    "@verdaccio/auth": "8.0.2",
+    "@verdaccio/config": "8.1.1",
+    "@verdaccio/core": "8.1.1",
+    "@verdaccio/hooks": "8.0.2",
+    "@verdaccio/loaders": "8.0.2",
+    "@verdaccio/local-storage-legacy": "11.3.3",
+    "@verdaccio/logger": "8.0.2",
+    "@verdaccio/middleware": "8.0.2",
+    "@verdaccio/package-filter": "13.0.2",
+    "@verdaccio/search-indexer": "8.0.2",
+    "@verdaccio/signature": "8.0.2",
+    "@verdaccio/streams": "10.2.5",
+    "@verdaccio/tarball": "13.0.2",
     "@verdaccio/ui-theme": "9.0.0-next-9.14",
-    "@verdaccio/url": "13.0.1",
-    "@verdaccio/utils": "8.1.1",
+    "@verdaccio/url": "13.0.2",
+    "@verdaccio/utils": "8.1.2",
     "JSONStream": "1.3.5",
     "async": "3.2.6",
     "clipanion": "4.0.0-rc.4",
@@ -48,8 +48,8 @@
     "lru-cache": "7.18.3",
     "mime": "3.0.0",
     "semver": "7.8.0",
-    "verdaccio-audit": "13.0.1",
-    "verdaccio-htpasswd": "13.0.1"
+    "verdaccio-audit": "13.0.2",
+    "verdaccio-htpasswd": "13.0.2"
   },
   "devDependencies": {
     "@babel/cli": "7.28.6",
@@ -159,5 +159,5 @@
     "url": "https://opencollective.com/verdaccio",
     "logo": "https://opencollective.com/verdaccio/logo.txt"
   },
-  "packageManager": "yarn@4.14.1"
+  "packageManager": "yarn@4.15.0"
 }

package/vitest.setup.mjs

@@ -0,0 +1,4 @@
+import nock from 'nock';
+
+nock.disableNetConnect();
+nock.enableNetConnect((host) => host.startsWith('127.0.0.1') || host.startsWith('localhost'));