@vscode/vsce 3.9.3-1 → 3.9.3-10

package/README.md

@@ -15,14 +15,7 @@ Read the [**Documentation**](https://code.visualstudio.com/api/working-with-exte
 
 ### Linux
 
-In order to save credentials safely, this project uses [`keytar`](https://www.npmjs.com/package/keytar) which uses `libsecret`, which you may need to install before publishing extensions. Setting the `VSCE_STORE=file` environment variable will revert back to the file credential store. Using the `VSCE_PAT` environment variable will also avoid using `keytar`.
-
-Depending on your distribution, you will need to run the following command:
-
-- Debian/Ubuntu: `sudo apt-get install libsecret-1-dev`
-- Alpine: `apk add libsecret`
-- Red Hat-based: `sudo yum install libsecret-devel`
-- Arch Linux: `sudo pacman -S libsecret`
+In order to save credentials safely, this project uses [`@napi-rs/keyring`](https://www.npmjs.com/package/@napi-rs/keyring), which uses the system Secret Service and falls back to the Linux kernel keyring. Setting the `VSCE_STORE=file` environment variable will revert back to the file credential store. Using the `VSCE_PAT` environment variable will also avoid using the system credential store.
 
 ## Usage
 
@@ -58,6 +51,31 @@ Or you can also set them in the `package.json`, so that you avoid having to rety
 }
 ```
 
+### Trusted publishing
+
+`vsce publish --oidc` publishes from GitHub Actions without storing a Personal Access Token. Configure a trusted
+publishing policy for the repository and workflow on the Visual Studio Marketplace, then grant the workflow permission
+to request an OIDC token:
+
+```yaml
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: npm ci
+      - run: npx @vscode/vsce publish --oidc
+```
+
+OIDC publishing requests a GitHub Actions token for the `marketplace.visualstudio.com` audience and exchanges it for a
+short-lived Marketplace credential. It does not fall back to a PAT when token acquisition or exchange fails.
+
 ## Development
 
 First clone this repository, then:

package/dist/vsce.d.ts

@@ -174,6 +174,10 @@ export declare interface IPublishOptions {
      */
     readonly pat?: string;
     readonly azureCredential?: boolean;
+    /**
+     * Use OpenID Connect trusted publishing to acquire a short-lived Marketplace credential.
+     */
+    readonly oidc?: boolean;
     readonly allowProposedApi?: boolean;
     readonly noVerify?: boolean;
     readonly allowProposedApis?: string[];

package/out/main.js

@@ -173,6 +173,9 @@ module.exports = function (argv) {
         .description('Publishes an extension')
         .option('-p, --pat <token>', 'Personal Access Token (defaults to VSCE_PAT environment variable)', process.env['VSCE_PAT'])
         .option('--azure-credential', 'Use Microsoft Entra ID for authentication')
+        .addOption(new commander_1.Option('--oidc', 'Use OpenID Connect trusted publishing for authentication')
+        .conflicts(['pat', 'azureCredential'])
+        .hideHelp(true))
         .option('-t, --target <targets...>', `Target architectures. Valid targets: ${ValidTargets}`)
         .option('--ignore-other-target-folders', `Ignore other target folders. Valid only when --target <target> is provided.`)
         .option('--readme-path <path>', 'Path to README file (defaults to README.md)')
@@ -209,9 +212,10 @@ module.exports = function (argv) {
         .option('--skip-duplicate', 'Fail silently if version already exists on the marketplace')
         .option('--skip-license', 'Allow publishing without license file')
         .option('--follow-symlinks', 'Recurse into symlinked directories instead of treating them as files')
-        .action((version, { pat, azureCredential, target, ignoreOtherTargetFolders, readmePath, changelogPath, message, gitTagVersion, updatePackageJson, packagePath, manifestPath, signaturePath, sigzipPath, githubBranch, gitlabBranch, baseContentUrl, baseImagesUrl, yarn, verify, noVerify, allowProposedApis, allowAllProposedApis, allowPackageSecrets, allowPackageAllSecrets, allowPackageEnvFile, ignoreFile, dependencies, preRelease, allowStarActivation, allowMissingRepository, allowUnusedFilesPattern, skipDuplicate, skipLicense, signTool, followSymlinks, }) => main((0, publish_1.publish)({
-        pat,
+        .action((version, { pat, azureCredential, oidc, target, ignoreOtherTargetFolders, readmePath, changelogPath, message, gitTagVersion, updatePackageJson, packagePath, manifestPath, signaturePath, sigzipPath, githubBranch, gitlabBranch, baseContentUrl, baseImagesUrl, yarn, verify, noVerify, allowProposedApis, allowAllProposedApis, allowPackageSecrets, allowPackageAllSecrets, allowPackageEnvFile, ignoreFile, dependencies, preRelease, allowStarActivation, allowMissingRepository, allowUnusedFilesPattern, skipDuplicate, skipLicense, signTool, followSymlinks, }) => main((0, publish_1.publish)({
+        pat: oidc ? undefined : pat,
         azureCredential,
+        oidc,
         version,
         targets: target,
         ignoreOtherTargetFolders,

package/out/npm.js

@@ -32,9 +32,6 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectYarn = detectYarn;
 exports.getDependencies = getDependencies;
@@ -42,8 +39,8 @@ exports.getLatestVersion = getLatestVersion;
 const path = __importStar(require("path"));
 const fs = __importStar(require("fs"));
 const cp = __importStar(require("child_process"));
-const parse_semver_1 = __importDefault(require("parse-semver"));
 const util_1 = require("./util");
+const packageSpec_1 = require("./packageSpec");
 const exists = (file) => fs.promises.stat(file).then(_ => true, _ => false);
 function parseStdout({ stdout }) {
     return stdout.split(/[\r\n]/).filter(line => !!line)[0];
@@ -87,7 +84,7 @@ function asYarnDependency(prefix, tree, prune) {
     }
     let name;
     try {
-        const parseResult = (0, parse_semver_1.default)(tree.name);
+        const parseResult = (0, packageSpec_1.parsePackageSpec)(tree.name);
         name = parseResult.name;
     }
     catch (err) {
@@ -105,8 +102,8 @@ function asYarnDependency(prefix, tree, prune) {
 }
 function selectYarnDependencies(deps, packagedDependencies) {
     const index = new (class {
+        data = Object.create(null);
         constructor() {
-            this.data = Object.create(null);
             for (const dep of deps) {
                 if (this.data[dep.name]) {
                     throw Error(`Dependency seen more than once: ${dep.name}`);
@@ -123,9 +120,7 @@ function selectYarnDependencies(deps, packagedDependencies) {
         }
     })();
     const reached = new (class {
-        constructor() {
-            this.values = [];
-        }
+        values = [];
         add(dep) {
             if (this.values.indexOf(dep) < 0) {
                 this.values.push(dep);

package/out/oidc.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OIDC_AUDIENCE = void 0;
+exports.getOIDCCredential = getOIDCCredential;
+const util_1 = require("./util");
+exports.OIDC_AUDIENCE = 'marketplace.visualstudio.com';
+class GitHubActionsOIDCTokenProvider {
+    name = 'GitHub Actions';
+    isAvailable(environment) {
+        return environment['GITHUB_ACTIONS']?.toLowerCase() === 'true';
+    }
+    async getToken(audience, { environment, request }) {
+        const requestUrl = environment['ACTIONS_ID_TOKEN_REQUEST_URL'];
+        const requestToken = environment['ACTIONS_ID_TOKEN_REQUEST_TOKEN'];
+        if (!requestUrl || !requestToken) {
+            throw new Error('GitHub Actions did not provide an OIDC token request URL and token. Add `permissions: id-token: write` to the workflow or job.');
+        }
+        let tokenUrl;
+        try {
+            tokenUrl = new URL(requestUrl);
+        }
+        catch {
+            throw new Error('GitHub Actions provided an invalid ACTIONS_ID_TOKEN_REQUEST_URL.');
+        }
+        tokenUrl.searchParams.set('audience', audience);
+        const result = await requestJSON('GitHub Actions OIDC token request', tokenUrl.toString(), request, {
+            method: 'GET',
+            headers: {
+                Accept: 'application/json',
+                Authorization: `Bearer ${requestToken}`,
+            },
+        });
+        if (!isRecord(result) || typeof result.value !== 'string' || !result.value) {
+            throw new Error('GitHub Actions OIDC token request returned an invalid response without a token.');
+        }
+        return result.value;
+    }
+}
+const oidcTokenProviders = [new GitHubActionsOIDCTokenProvider()];
+async function getOIDCCredential(publisherName, options = {}) {
+    const environment = options.environment ?? process.env;
+    const request = options.request ?? defaultRequest;
+    const provider = oidcTokenProviders.find(candidate => candidate.isAvailable(environment));
+    if (!provider) {
+        throw new Error('No supported OIDC provider was detected. OIDC publishing currently supports GitHub Actions only.');
+    }
+    const oidcToken = await provider.getToken(exports.OIDC_AUDIENCE, { environment, request });
+    return await exchangeOIDCToken(publisherName, oidcToken, options.marketplaceUrl ?? (0, util_1.getMarketplaceUrl)(), request);
+}
+async function exchangeOIDCToken(publisherName, oidcToken, marketplaceUrl, request) {
+    const result = await requestJSON('Marketplace OIDC token exchange', `${marketplaceUrl.replace(/\/$/, '')}/_apis/gallery/token`, request, {
+        method: 'POST',
+        headers: {
+            Accept: 'application/json',
+            Authorization: `Bearer ${oidcToken}`,
+            'Content-Type': 'application/json',
+            'User-Agent': 'vsce',
+        },
+        body: JSON.stringify({ publisherName }),
+    });
+    if (!isRecord(result) || typeof result.credential !== 'string' || !result.credential) {
+        throw new Error('Marketplace OIDC token exchange returned an invalid response without a credential.');
+    }
+    return result.credential;
+}
+async function defaultRequest(url, request) {
+    const response = await fetch(url, request);
+    return {
+        statusCode: response.status,
+        statusMessage: response.statusText,
+        readBody: () => response.text(),
+    };
+}
+async function requestJSON(operation, url, request, init) {
+    let response;
+    try {
+        response = await request(url, init);
+    }
+    catch (error) {
+        throw new Error(`${operation} failed: ${getErrorMessage(error)}`);
+    }
+    let body;
+    try {
+        body = await response.readBody();
+    }
+    catch (error) {
+        throw new Error(`${operation} failed while reading the response: ${getErrorMessage(error)}`);
+    }
+    if (response.statusCode < 200 || response.statusCode >= 300) {
+        const status = `${response.statusCode}${response.statusMessage ? ` ${response.statusMessage}` : ''}`;
+        throw new Error(`${operation} failed with ${status}${getResponseDetails(body)}`);
+    }
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        throw new Error(`${operation} returned an invalid JSON response.`);
+    }
+}
+function getResponseDetails(body) {
+    const trimmedBody = body.trim();
+    if (!trimmedBody) {
+        return '.';
+    }
+    try {
+        const parsed = JSON.parse(trimmedBody);
+        if (isRecord(parsed)) {
+            const message = parsed.message ?? parsed.error_description ?? parsed.error;
+            if (typeof message === 'string' && message) {
+                return `: ${message}`;
+            }
+        }
+    }
+    catch {
+        // Use the plain response body below.
+    }
+    return `: ${trimmedBody.slice(0, 500)}`;
+}
+function getErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+//# sourceMappingURL=oidc.js.map

package/out/package.js

@@ -65,10 +65,10 @@ const cp = __importStar(require("child_process"));
 const yazl = __importStar(require("yazl"));
 const nls_1 = require("./nls");
 const util = __importStar(require("./util"));
-const glob_1 = require("glob");
+const tinyglobby_1 = require("tinyglobby");
 const minimatch_1 = require("minimatch");
-const markdown_it_1 = __importDefault(require("markdown-it"));
-const cheerio = __importStar(require("cheerio"));
+const parse5_1 = require("parse5");
+const marked_1 = require("marked");
 const url = __importStar(require("url"));
 const mime_1 = __importDefault(require("mime"));
 const semver = __importStar(require("semver"));
@@ -77,10 +77,10 @@ const chalk_1 = __importDefault(require("chalk"));
 const validation_1 = require("./validation");
 const npm_1 = require("./npm");
 const GitHost = __importStar(require("hosted-git-info"));
-const parse_semver_1 = __importDefault(require("parse-semver"));
 const jsonc = __importStar(require("jsonc-parser"));
 const vsceSign = __importStar(require("@vscode/vsce-sign"));
 const secretLint_1 = require("./secretLint");
+const packageSpec_1 = require("./packageSpec");
 const minimatchOptions = { dot: true };
 function isInMemoryFile(file) {
     return !!file.contents;
@@ -94,12 +94,13 @@ function read(file) {
     }
 }
 class BaseProcessor {
+    manifest;
     constructor(manifest) {
         this.manifest = manifest;
-        this.assets = [];
-        this.tags = [];
-        this.vsix = Object.create(null);
     }
+    assets = [];
+    tags = [];
+    vsix = Object.create(null);
     async onFile(file) {
         return file;
     }
@@ -299,6 +300,7 @@ exports.Targets = new Set([
     'web',
 ]);
 class ManifestProcessor extends BaseProcessor {
+    options;
     constructor(manifest, options = {}) {
         super(manifest);
         this.options = options;
@@ -326,7 +328,7 @@ class ManifestProcessor extends BaseProcessor {
         if (target || preRelease) {
             let engineSemver;
             try {
-                engineSemver = (0, parse_semver_1.default)(`vscode@${manifest.engines.vscode}`);
+                engineSemver = (0, packageSpec_1.parsePackageSpec)(`vscode@${manifest.engines.vscode}`);
             }
             catch (err) {
                 throw new Error('Failed to parse semver of engines.vscode');
@@ -430,6 +432,44 @@ class ManifestProcessor extends BaseProcessor {
 }
 exports.ManifestProcessor = ManifestProcessor;
 class TagsProcessor extends BaseProcessor {
+    static Keywords = {
+        git: ['git'],
+        npm: ['node'],
+        spell: ['markdown'],
+        bootstrap: ['bootstrap'],
+        lint: ['linters'],
+        linting: ['linters'],
+        react: ['javascript'],
+        js: ['javascript'],
+        node: ['javascript', 'node'],
+        'c++': ['c++'],
+        Cplusplus: ['c++'],
+        xml: ['xml'],
+        angular: ['javascript'],
+        jquery: ['javascript'],
+        php: ['php'],
+        python: ['python'],
+        latex: ['latex'],
+        ruby: ['ruby'],
+        java: ['java'],
+        erlang: ['erlang'],
+        sql: ['sql'],
+        nodejs: ['node'],
+        'c#': ['c#'],
+        css: ['css'],
+        javascript: ['javascript'],
+        ftp: ['ftp'],
+        haskell: ['haskell'],
+        unity: ['unity'],
+        terminal: ['terminal'],
+        powershell: ['powershell'],
+        laravel: ['laravel'],
+        meteor: ['meteor'],
+        emmet: ['emmet'],
+        eslint: ['linters'],
+        tfs: ['tfs'],
+        rust: ['rust'],
+    };
     async onEnd() {
         const keywords = this.manifest.keywords ?? [];
         const contributes = this.manifest.contributes;
@@ -493,51 +533,25 @@ class TagsProcessor extends BaseProcessor {
     }
 }
 exports.TagsProcessor = TagsProcessor;
-TagsProcessor.Keywords = {
-    git: ['git'],
-    npm: ['node'],
-    spell: ['markdown'],
-    bootstrap: ['bootstrap'],
-    lint: ['linters'],
-    linting: ['linters'],
-    react: ['javascript'],
-    js: ['javascript'],
-    node: ['javascript', 'node'],
-    'c++': ['c++'],
-    Cplusplus: ['c++'],
-    xml: ['xml'],
-    angular: ['javascript'],
-    jquery: ['javascript'],
-    php: ['php'],
-    python: ['python'],
-    latex: ['latex'],
-    ruby: ['ruby'],
-    java: ['java'],
-    erlang: ['erlang'],
-    sql: ['sql'],
-    nodejs: ['node'],
-    'c#': ['c#'],
-    css: ['css'],
-    javascript: ['javascript'],
-    ftp: ['ftp'],
-    haskell: ['haskell'],
-    unity: ['unity'],
-    terminal: ['terminal'],
-    powershell: ['powershell'],
-    laravel: ['laravel'],
-    meteor: ['meteor'],
-    emmet: ['emmet'],
-    eslint: ['linters'],
-    tfs: ['tfs'],
-    rust: ['rust'],
-};
 class MarkdownProcessor extends BaseProcessor {
+    name;
+    assetType;
+    options;
+    regexp;
+    baseContentUrl;
+    baseImagesUrl;
+    rewriteRelativeLinks;
+    isGitHub;
+    isGitLab;
+    repositoryUrl;
+    gitHubIssueLinking;
+    gitLabIssueLinking;
+    filesProcessed = 0;
     constructor(manifest, name, filePath, assetType, options = {}) {
         super(manifest);
         this.name = name;
         this.assetType = assetType;
         this.options = options;
-        this.filesProcessed = 0;
         this.regexp = new RegExp(`^${util.filePathToVsixPath(filePath)}$`, 'i');
         const guess = this.guessBaseUrls(options.githubBranch || options.gitlabBranch);
         this.baseContentUrl = options.baseContentUrl || (guess && guess.content);
@@ -627,11 +641,33 @@ class MarkdownProcessor extends BaseProcessor {
                 contents = contents.replace(markdownIssueRegex, issueReplace);
             }
         }
-        const html = (0, markdown_it_1.default)({ html: true }).render(contents);
-        const $ = cheerio.load(html);
+        const html = marked_1.marked.parse(contents, { async: false });
+        const document = (0, parse5_1.parse)(html);
+        const images = [];
+        let hasSvg = false;
+        const nodes = [document];
+        while (nodes.length > 0) {
+            const node = nodes.pop();
+            if ('tagName' in node) {
+                if (node.tagName === 'img') {
+                    images.push(node);
+                }
+                else if (node.tagName === 'svg') {
+                    hasSvg = true;
+                }
+            }
+            const children = 'content' in node
+                ? node.content.childNodes
+                : 'childNodes' in node
+                    ? node.childNodes
+                    : [];
+            for (let index = children.length - 1; index >= 0; index--) {
+                nodes.push(children[index]);
+            }
+        }
         if (this.rewriteRelativeLinks) {
-            $('img').each((_, img) => {
-                const rawSrc = $(img).attr('src');
+            for (const image of images) {
+                const rawSrc = image.attrs.find(attribute => attribute.name === 'src')?.value;
                 if (!rawSrc) {
                     throw new Error(`Images in ${this.name} must have a source.`);
                 }
@@ -652,11 +688,11 @@ class MarkdownProcessor extends BaseProcessor {
                 if (/\.svg$/i.test(srcUrl.pathname) && !isHostTrusted(srcUrl)) {
                     throw new Error(`SVGs are restricted in ${this.name}; please use other file image formats, such as PNG: ${src}`);
                 }
-            });
+            }
         }
-        $('svg').each(() => {
+        if (hasSvg) {
             throw new Error(`SVG tags are not allowed in ${this.name}.`);
-        });
+        }
         return {
             path: file.path,
             contents: Buffer.from(contents, 'utf8'),
@@ -734,10 +770,13 @@ class ChangelogProcessor extends MarkdownProcessor {
 }
 exports.ChangelogProcessor = ChangelogProcessor;
 class LicenseProcessor extends BaseProcessor {
+    options;
+    didFindLicense = false;
+    expectedLicenseName;
+    filter;
     constructor(manifest, options = {}) {
         super(manifest);
         this.options = options;
-        this.didFindLicense = false;
         const match = /^SEE LICENSE IN (.*)$/.exec(manifest.license || '');
         if (!match || !match[1]) {
             this.expectedLicenseName = 'LICENSE, LICENSE.md, or LICENSE.txt';
@@ -776,9 +815,9 @@ class LicenseProcessor extends BaseProcessor {
 }
 exports.LicenseProcessor = LicenseProcessor;
 class LaunchEntryPointProcessor extends BaseProcessor {
+    seenFiles = new Set();
     constructor(manifest) {
         super(manifest);
-        this.seenFiles = new Set();
     }
     onFile(file) {
         this.seenFiles.add(util.normalize(file.path));
@@ -811,9 +850,10 @@ class LaunchEntryPointProcessor extends BaseProcessor {
     }
 }
 class IconProcessor extends BaseProcessor {
+    icon;
+    didFindIcon = false;
     constructor(manifest) {
         super(manifest);
-        this.didFindIcon = false;
         this.icon = manifest.icon && path.posix.normalize(util.filePathToVsixPath(manifest.icon));
         delete this.vsix.icon;
     }
@@ -893,9 +933,9 @@ function deduceExtensionKinds(manifest) {
     return result;
 }
 class NLSProcessor extends BaseProcessor {
+    translations = Object.create(null);
     constructor(manifest) {
         super(manifest);
-        this.translations = Object.create(null);
         if (!manifest.contributes ||
             !manifest.contributes.localizations ||
             manifest.contributes.localizations.length === 0) {
@@ -928,11 +968,8 @@ class NLSProcessor extends BaseProcessor {
 }
 exports.NLSProcessor = NLSProcessor;
 class ValidationProcessor extends BaseProcessor {
-    constructor() {
-        super(...arguments);
-        this.files = new Map();
-        this.duplicates = new Set();
-    }
+    files = new Map();
+    duplicates = new Set();
     async onFile(file) {
         const lower = file.path.toLowerCase();
         const existing = this.files.get(lower);
@@ -984,7 +1021,7 @@ function validateManifestForPackaging(manifest) {
     const hasBrowser = !!manifest.browser;
     let parsedEngineVersion;
     try {
-        const engineSemver = (0, parse_semver_1.default)(`vscode@${engines.vscode}`);
+        const engineSemver = (0, packageSpec_1.parsePackageSpec)(`vscode@${engines.vscode}`);
         parsedEngineVersion = engineSemver.version;
     }
     catch (err) {
@@ -1248,9 +1285,46 @@ const defaultIgnore = [
     '**/.vscode-test/**',
     '**/.vscode-test-web/**',
 ];
+/**
+ * `tinyglobby` skips symbolic links altogether when `followSymbolicLinks` is disabled, while
+ * vsce treats them as regular files instead (see the `--follow-symlinks` option). Presenting
+ * symbolic links to the crawler as regular files keeps them in the result without recursing
+ * into symlinked directories.
+ */
+const symlinksAsFilesFileSystem = {
+    readdir: (dir, options, callback) => fs.readdir(dir, options, (err, entries) => callback(err, err ? entries : entries.map(asFile))),
+    readdirSync: (dir, options) => fs.readdirSync(dir, options).map(asFile),
+};
+function asFile(entry) {
+    if (!entry.isSymbolicLink()) {
+        return entry;
+    }
+    return Object.create(entry, {
+        isFile: { value: () => true },
+        isDirectory: { value: () => false },
+        isSymbolicLink: { value: () => false },
+    });
+}
+/**
+ * `glob` matched patterns case-insensitively on Windows and macOS and case-sensitively
+ * everywhere else, based on `process.platform` rather than on the actual filesystem.
+ * `tinyglobby` always matches case-sensitively, so this keeps the previous behaviour, which
+ * matters for the `node_modules` folder being ignored regardless of how it is cased on disk.
+ * Keep this keyed off the platform: probing the filesystem instead would change what is
+ * packaged on case-sensitive macOS volumes and case-insensitive Linux mounts.
+ */
+const caseSensitiveMatch = process.platform !== 'win32' && process.platform !== 'darwin';
 async function collectAllFiles(cwd, dependencies, dependencyEntryPoints, followSymlinks = true) {
     const deps = await (0, npm_1.getDependencies)(cwd, dependencies, dependencyEntryPoints);
-    const promises = deps.map(dep => (0, glob_1.glob)('**', { cwd: dep, nodir: true, follow: followSymlinks, dot: true, ignore: 'node_modules/**' }).then(files => files.map(f => path.relative(cwd, path.join(dep, f))).map(f => f.replace(/\\/g, '/'))));
+    const promises = deps.map(dep => (0, tinyglobby_1.glob)('**', {
+        cwd: dep,
+        onlyFiles: true,
+        followSymbolicLinks: followSymlinks,
+        fs: followSymlinks ? undefined : symlinksAsFilesFileSystem,
+        caseSensitiveMatch,
+        dot: true,
+        ignore: ['node_modules/**'],
+    }).then(files => files.map(f => path.relative(cwd, path.join(dep, f))).map(f => f.replace(/\\/g, '/'))));
     return Promise.all(promises).then(util.flatten);
 }
 function getDependenciesOption(options) {

package/out/packageSpec.js

@@ -0,0 +1,49 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePackageSpec = parsePackageSpec;
+const semver = __importStar(require("semver"));
+function parsePackageSpec(value) {
+    const separator = value.indexOf('@', value.startsWith('@') ? 1 : 0);
+    const name = separator === -1 ? value : value.slice(0, separator);
+    const originalVersion = separator === -1 ? '' : value.slice(separator + 1);
+    const range = semver.validRange(originalVersion);
+    if (originalVersion && !range) {
+        throw new Error(`Invalid semver range: ${originalVersion}`);
+    }
+    const version = originalVersion.replace(/^[^0-9]+/, '') || 'latest';
+    return { name, range: range ?? '*', version };
+}
+//# sourceMappingURL=packageSpec.js.map

package/out/publicgalleryapi.js

@@ -5,10 +5,12 @@ const HttpClient_1 = require("typed-rest-client/HttpClient");
 const GalleryInterfaces_1 = require("azure-devops-node-api/interfaces/GalleryInterfaces");
 const Serialization_1 = require("azure-devops-node-api/Serialization");
 class PublicGalleryAPI {
+    baseUrl;
+    apiVersion;
+    client = new HttpClient_1.HttpClient('vsce');
     constructor(baseUrl, apiVersion = '3.0-preview.1') {
         this.baseUrl = baseUrl;
         this.apiVersion = apiVersion;
-        this.client = new HttpClient_1.HttpClient('vsce');
     }
     post(url, data, additionalHeaders) {
         return this.client.post(`${this.baseUrl}/_apis/public${url}`, data, additionalHeaders);