ovsx 1.1.0 → 1.2.0

package/lib/show.js

@@ -0,0 +1,289 @@
+"use strict";
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.show = show;
+const semver = require("semver");
+const registry_1 = require("./registry");
+const table_1 = require("./table");
+const util_1 = require("./util");
+/**
+ * How many versions the history table prints unless `--all-versions` is given. Matches what
+ * `vsce show` lists; the remainder is reported as a count rather than dropped silently.
+ */
+const VERSION_HISTORY_SIZE = 6;
+/**
+ * Tags starting with `__` are internal bookkeeping (e.g. `__web_extension`) rather than anything
+ * the publisher wrote, and the web UI hides them too.
+ */
+const INTERNAL_TAG_PREFIX = '__';
+/**
+ * Page size for the version-reference listing. Versions come back newest first, and each version
+ * contributes one entry per target platform, so a page has to be comfortably larger than the
+ * number of versions shown for the default table to be filled from a single request.
+ */
+const VERSION_PAGE_SIZE = 100;
+/**
+ * Prints an extension's metadata.
+ */
+async function show(options) {
+    (0, util_1.addEnvOptions)(options);
+    const { id, version } = splitVersion(options.extensionId);
+    const match = (0, util_1.matchExtensionId)(id);
+    if (!match) {
+        throw new Error('The extension identifier must have the form `namespace.extension` or `namespace/extension`.');
+    }
+    const [, namespace, name] = match;
+    const registry = new registry_1.Registry(options);
+    const extension = await registry.getMetadata(namespace, name, options.target, version);
+    if (extension.error) {
+        throw new Error(extension.error);
+    }
+    if (options.json) {
+        console.log(JSON.stringify(extension, null, 4));
+        return;
+    }
+    const allVersions = options.allVersions === true;
+    const versions = await getVersions(registry, namespace, name, options.target, allVersions);
+    printSummary(extension, versions, allVersions);
+}
+/**
+ * Splits a trailing `@<version>` off the identifier, the way `vsce show` accepts it. Only the last
+ * `@` is considered, so it stays out of the way of the identifier itself.
+ *
+ * An `@` with nothing after it is rejected rather than read as "no version given". It usually means a
+ * shell variable that did not expand - `ovsx show redhat.java@$VERSION` with `VERSION` unset - and
+ * reporting the latest version for that would answer a question the caller did not ask.
+ */
+function splitVersion(extensionId) {
+    const at = extensionId.lastIndexOf('@');
+    if (at <= 0) {
+        return { id: extensionId };
+    }
+    const version = extensionId.substring(at + 1);
+    if (version.length === 0) {
+        throw new Error('A version must follow `@`, as in `namespace.extension@1.2.3`.');
+    }
+    return { id: extensionId.substring(0, at), version };
+}
+/**
+ * Collects the version history, collapsing the one-entry-per-target-platform rows the registry
+ * returns into a single row per version. Fetches one page unless every version is wanted, in which
+ * case it pages to the end - `totalSize` counts version/target-platform pairs, not versions, so
+ * paging has to run on what has actually been returned rather than on a version count.
+ *
+ * Best-effort: a registry that doesn't serve this endpoint still gets everything else, just
+ * without the history table.
+ */
+async function getVersions(registry, namespace, name, target, allVersions) {
+    const references = [];
+    let offset = 0;
+    try {
+        for (;;) {
+            const page = await registry.getVersionReferences(namespace, name, target, VERSION_PAGE_SIZE, offset);
+            if (page.error) {
+                return [];
+            }
+            const versions = page.versions ?? [];
+            references.push(...versions);
+            offset += versions.length;
+            if (!allVersions || versions.length === 0 || offset >= page.totalSize) {
+                break;
+            }
+        }
+    }
+    catch {
+        return [];
+    }
+    const byVersion = new Map();
+    for (const reference of references) {
+        let summary = byVersion.get(reference.version);
+        if (!summary) {
+            summary = { version: reference.version, targetPlatforms: [] };
+            byVersion.set(reference.version, summary);
+        }
+        if (reference.targetPlatform && !summary.targetPlatforms.includes(reference.targetPlatform)) {
+            summary.targetPlatforms.push(reference.targetPlatform);
+        }
+    }
+    return [...byVersion.values()].sort(byNewestFirst);
+}
+/**
+ * Newest version first. Anything that isn't valid semver (the registry accepts such versions from
+ * a mirror) sorts after everything that is, rather than being compared incomparably.
+ *
+ * Deliberately `valid` and not `coerce`: coerce drops prerelease identifiers, so `1.2.0-alpha.1`
+ * and `1.2.0` would compare equal and order unstably, and it accepts inputs semver itself rejects
+ * (`v1.2` becomes `1.2.0`), which would defeat the fallback below.
+ */
+function byNewestFirst(a, b) {
+    const left = semver.valid(a.version);
+    const right = semver.valid(b.version);
+    if (left && right) {
+        return semver.rcompare(left, right);
+    }
+    if (left) {
+        return -1;
+    }
+    if (right) {
+        return 1;
+    }
+    return b.version.localeCompare(a.version);
+}
+function printSummary(extension, versions, allVersions) {
+    const publisher = extension.namespaceDisplayName || extension.namespace;
+    console.log(extension.displayName || extension.name);
+    console.log(`  ${publisher}${extension.verified ? ' (verified publisher)' : ''}`);
+    console.log(`  ${(0, table_1.formatCount)(extension.downloadCount, 'download')}  ${formatRating(extension)}`);
+    if (extension.description) {
+        console.log();
+        console.log(`  ${extension.description}`);
+    }
+    printNotices(extension);
+    printVersionHistory(versions, allVersions);
+    printList('Categories', extension.categories);
+    printList('Tags', extension.tags?.filter(tag => !tag.startsWith(INTERNAL_TAG_PREFIX)));
+    printTable('More Info', moreInfo(extension));
+    printTable('Registry', registryInfo(extension));
+    printTable('Statistics', statistics(extension));
+}
+/**
+ * Anything a consumer of this extension should see before its metadata: deprecation first, since
+ * it changes whether they should install it at all.
+ */
+function printNotices(extension) {
+    const notices = [];
+    if (extension.deprecated) {
+        const replacement = extension.replacement;
+        notices.push(replacement
+            ? `Deprecated - superseded by ${replacement.displayName ?? replacement.url}`
+            : 'Deprecated');
+    }
+    if (extension.downloadable === false) {
+        notices.push('Not downloadable from this registry');
+    }
+    if (extension.preview) {
+        notices.push('Preview');
+    }
+    if (extension.namespaceOwnershipConflict) {
+        notices.push('The namespace ownership of this extension is disputed');
+    }
+    if (notices.length > 0) {
+        console.log();
+        for (const notice of notices) {
+            console.log(`  ! ${notice}`);
+        }
+    }
+}
+function printVersionHistory(versions, allVersions) {
+    if (versions.length === 0) {
+        return;
+    }
+    const shown = allVersions ? versions : versions.slice(0, VERSION_HISTORY_SIZE);
+    const rows = shown.map(v => [v.version, v.targetPlatforms.join(', ')]);
+    console.log();
+    console.log('Version History:');
+    (0, table_1.printRows)([['Version', 'Target Platforms'], ...rows]);
+    const remaining = versions.length - shown.length;
+    if (remaining > 0) {
+        console.log(`  ... and ${remaining} more (pass --all-versions to list them)`);
+    }
+}
+function moreInfo(extension) {
+    const rows = [
+        ['Unique Identifier', `${extension.namespace}.${extension.name}`],
+        ['Version', extension.version]
+    ];
+    if (extension.versionAlias?.length > 0) {
+        rows.push(['Version Aliases', extension.versionAlias.join(', ')]);
+    }
+    if (extension.targetPlatform) {
+        rows.push(['Target Platform', extension.targetPlatform]);
+    }
+    rows.push(['Last Updated', extension.timestamp]);
+    rows.push(['Published By', extension.publishedBy?.loginName ?? '']);
+    addIfPresent(rows, 'License', extension.license);
+    addIfPresent(rows, 'Homepage', extension.homepage);
+    addIfPresent(rows, 'Repository', extension.repository);
+    addIfPresent(rows, 'Bugs', extension.bugs);
+    addIfPresent(rows, 'Q&A', extension.qna);
+    addIfPresent(rows, 'Sponsor', extension.sponsorLink);
+    if (extension.engines) {
+        rows.push(['Engines', Object.entries(extension.engines).map(([e, v]) => `${e} ${v}`).join(', ')]);
+    }
+    return rows;
+}
+/**
+ * The parts an Open VSX compatible registry reports that the Marketplace has no equivalent for.
+ * Kept in its own block rather than mixed into "More Info" so it's obvious what is registry
+ * specific, and omitted entirely when none of it applies.
+ */
+function registryInfo(extension) {
+    const rows = [];
+    if (extension.verified !== undefined) {
+        rows.push(['Verified Publisher', yesNo(extension.verified)]);
+    }
+    if (extension.publishedWithTrustedPublishing) {
+        rows.push(['Trusted Publishing', 'yes']);
+    }
+    if (extension.preRelease !== undefined) {
+        rows.push(['Pre-Release', yesNo(extension.preRelease)]);
+    }
+    addIfPresent(rows, 'Extension Kind', extension.extensionKind?.join(', '));
+    addIfPresent(rows, 'Localized', extension.localizedLanguages?.join(', '));
+    addIfPresent(rows, 'Dependencies', extension.dependencies?.map(referenceId).join(', '));
+    addIfPresent(rows, 'Bundled Extensions', extension.bundledExtensions?.map(referenceId).join(', '));
+    return rows;
+}
+function statistics(extension) {
+    const rows = [['Downloads', (0, table_1.formatNumber)(extension.downloadCount)]];
+    if (extension.averageRating !== undefined) {
+        rows.push(['Average Rating', `${extension.averageRating.toFixed(1)}/5`]);
+    }
+    rows.push(['Reviews', (0, table_1.formatNumber)(Number(extension.reviewCount ?? 0))]);
+    return rows;
+}
+function referenceId(reference) {
+    return `${reference.namespace}.${reference.extension}`;
+}
+function addIfPresent(rows, label, value) {
+    if (value) {
+        rows.push([label, value]);
+    }
+}
+function printList(title, values) {
+    if (!values || values.length === 0) {
+        return;
+    }
+    console.log();
+    console.log(`${title}:`);
+    console.log(`  ${values.join(', ')}`);
+}
+function printTable(title, rows) {
+    if (rows.length === 0) {
+        return;
+    }
+    console.log();
+    console.log(`${title}:`);
+    (0, table_1.printRows)(rows);
+}
+function formatRating(extension) {
+    if (extension.averageRating === undefined) {
+        return 'no ratings';
+    }
+    return `${extension.averageRating.toFixed(1)}/5 from ${(0, table_1.formatCount)(extension.reviewCount, 'review')}`;
+}
+function yesNo(value) {
+    return value ? 'yes' : 'no';
+}
+//# sourceMappingURL=show.js.map

package/lib/show.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"show.js","sourceRoot":"","sources":["../src/show.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;+EAW+E;;AAoC/E,oBAuBC;AAzDD,iCAAiC;AACjC,yCAAmE;AACnE,mCAA+D;AAE/D,iCAAyD;AAEzD;;;GAGG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAE/B;;;GAGG;AACH,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAQjC;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B;;GAEG;AACI,KAAK,UAAU,IAAI,CAAC,OAAoB;IAC3C,IAAA,oBAAa,EAAC,OAAO,CAAC,CAAC;IACvB,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAA,uBAAgB,EAAC,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IACnH,CAAC;IAED,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,mBAAQ,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvF,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChD,OAAO;IACX,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC3F,YAAY,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,WAAmB;IACrC,MAAM,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACV,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,WAAW,CACtB,QAAkB,EAClB,SAAiB,EACjB,IAAY,EACZ,MAA0B,EAC1B,WAAoB;IAEpB,MAAM,UAAU,GAAuB,EAAE,CAAC;IAC1C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,CAAC;QACD,SAAS,CAAC;YACN,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;YACrG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,OAAO,EAAE,CAAC;YACd,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YACrC,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;YAC7B,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC;YAC1B,IAAI,CAAC,WAAW,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpE,MAAM;YACV,CAAC;QACL,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;IACpD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACjC,IAAI,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;YAC9D,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,SAAS,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1F,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC3D,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,CAAiB,EAAE,CAAiB;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACP,OAAO,CAAC,CAAC,CAAC;IACd,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACR,OAAO,CAAC,CAAC;IACb,CAAC;IACD,OAAO,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,YAAY,CAAC,SAAoB,EAAE,QAA0B,EAAE,WAAoB;IACxF,MAAM,SAAS,GAAG,SAAS,CAAC,oBAAoB,IAAI,SAAS,CAAC,SAAS,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,mBAAW,EAAC,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,KAAK,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACjG,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,YAAY,CAAC,SAAS,CAAC,CAAC;IACxB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3C,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9C,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;IACvF,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7C,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;IAChD,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,SAAoB;IACtC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;QAC1C,OAAO,CAAC,IAAI,CACR,WAAW;YACP,CAAC,CAAC,8BAA8B,WAAW,CAAC,WAAW,IAAI,WAAW,CAAC,GAAG,EAAE;YAC5E,CAAC,CAAC,YAAY,CACrB,CAAC;IACN,CAAC;IACD,IAAI,SAAS,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,SAAS,CAAC,0BAA0B,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC;QACjC,CAAC;IACL,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,QAA0B,EAAE,WAAoB;IACzE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;IACX,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAEvE,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,IAAA,iBAAS,EAAC,CAAC,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IACjD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,aAAa,SAAS,0CAA0C,CAAC,CAAC;IAClF,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,SAAoB;IAClC,MAAM,IAAI,GAAe;QACrB,CAAC,mBAAmB,EAAE,GAAG,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;QACjE,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC;KACjC,CAAC;IACF,IAAI,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,SAAS,CAAC,cAAc,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IACjD,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IACnD,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IACvD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3C,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;IACzC,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;IACrD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,SAAoB;IACtC,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,IAAI,SAAS,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,SAAS,CAAC,8BAA8B,EAAE,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,YAAY,CAAC,IAAI,EAAE,gBAAgB,EAAE,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,YAAY,CAAC,IAAI,EAAE,oBAAoB,EAAE,SAAS,CAAC,iBAAiB,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,SAAoB;IACpC,MAAM,IAAI,GAAe,CAAC,CAAC,WAAW,EAAE,IAAA,oBAAY,EAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAChF,IAAI,SAAS,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,GAAG,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,IAAA,oBAAY,EAAC,MAAM,CAAC,SAAS,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,SAAmD;IACpE,OAAO,GAAG,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,YAAY,CAAC,IAAgB,EAAE,KAAa,EAAE,KAAc;IACjE,IAAI,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9B,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,MAAiB;IAC/C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO;IACX,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACzB,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,IAAgB;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO;IACX,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACzB,IAAA,iBAAS,EAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,YAAY,CAAC,SAAoB;IACtC,IAAI,SAAS,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,YAAY,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,IAAA,mBAAW,EAAC,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;AAC1G,CAAC;AAED,SAAS,KAAK,CAAC,KAAc;IACzB,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC"}

package/lib/table.d.ts

@@ -0,0 +1,27 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+/**
+ * Prints rows as an aligned table, indented by two spaces. Every column but the last is padded,
+ * so a trailing empty cell doesn't leave ragged whitespace behind.
+ */
+export declare function printRows(rows: string[][]): void;
+/** Formats a count with thousands separators, and the noun pluralised to match. */
+export declare function formatCount(count: number | undefined, noun: string): string;
+export declare function formatNumber(value: number | undefined): string;
+/**
+ * Shortens `text` to at most `max` characters, marking that it was cut. A `max` of zero or less
+ * leaves no room for the marker either, so it yields nothing rather than an ellipsis wider than the
+ * budget it was given.
+ */
+export declare function truncate(text: string, max: number): string;
+//# sourceMappingURL=table.d.ts.map

package/lib/table.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"table.d.ts","sourceRoot":"","sources":["../src/table.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;+EAW+E;AAE/E;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,CAYhD;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAG3E;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAE9D;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAM1D"}

package/lib/table.js

@@ -0,0 +1,56 @@
+"use strict";
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.printRows = printRows;
+exports.formatCount = formatCount;
+exports.formatNumber = formatNumber;
+exports.truncate = truncate;
+/**
+ * Prints rows as an aligned table, indented by two spaces. Every column but the last is padded,
+ * so a trailing empty cell doesn't leave ragged whitespace behind.
+ */
+function printRows(rows) {
+    const widths = [];
+    for (const row of rows) {
+        row.forEach((cell, i) => widths[i] = Math.max(widths[i] ?? 0, cell.length));
+    }
+    for (const row of rows) {
+        const line = row
+            .map((cell, i) => (i === row.length - 1 ? cell : cell.padEnd(widths[i])))
+            .join('  ')
+            .trimEnd();
+        console.log(`  ${line}`);
+    }
+}
+/** Formats a count with thousands separators, and the noun pluralised to match. */
+function formatCount(count, noun) {
+    const value = count ?? 0;
+    return `${formatNumber(value)} ${value === 1 ? noun : noun + 's'}`;
+}
+function formatNumber(value) {
+    return (value ?? 0).toLocaleString('en-US');
+}
+/**
+ * Shortens `text` to at most `max` characters, marking that it was cut. A `max` of zero or less
+ * leaves no room for the marker either, so it yields nothing rather than an ellipsis wider than the
+ * budget it was given.
+ */
+function truncate(text, max) {
+    if (max <= 0) {
+        return '';
+    }
+    const collapsed = text.replace(/\s+/g, ' ').trim();
+    return collapsed.length <= max ? collapsed : `${collapsed.substring(0, max - 1)}…`;
+}
+//# sourceMappingURL=table.js.map

package/lib/table.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"table.js","sourceRoot":"","sources":["../src/table.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;+EAW+E;;AAM/E,8BAYC;AAGD,kCAGC;AAED,oCAEC;AAOD,4BAMC;AAvCD;;;GAGG;AACH,SAAgB,SAAS,CAAC,IAAgB;IACtC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,GAAG;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACxE,IAAI,CAAC,IAAI,CAAC;aACV,OAAO,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC;AACL,CAAC;AAED,mFAAmF;AACnF,SAAgB,WAAW,CAAC,KAAyB,EAAE,IAAY;IAC/D,MAAM,KAAK,GAAG,KAAK,IAAI,CAAC,CAAC;IACzB,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;AACvE,CAAC;AAED,SAAgB,YAAY,CAAC,KAAyB;IAClD,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAgB,QAAQ,CAAC,IAAY,EAAE,GAAW;IAC9C,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,SAAS,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;AACvF,CAAC"}

package/lib/trusted-publishing-options.d.ts

@@ -0,0 +1,30 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+export interface TrustedPublishingOptions {
+    /**
+     * Obtain a short-lived publishing token by exchanging an OIDC ID token. If unset, trusted
+     * publishing is used whenever an ID token source is detected and no access token is available.
+     */
+    trustedPublishing?: boolean;
+    /**
+     * The OIDC ID token to exchange. Only needed for CI systems that expose the token directly,
+     * such as GitLab CI; on GitHub Actions the token is requested from the workflow runtime.
+     */
+    idToken?: string;
+    /**
+     * The audience to request for the OIDC ID token. Defaults to the registry URL and must match
+     * the audience the registry expects.
+     */
+    oidcAudience?: string;
+}
+//# sourceMappingURL=trusted-publishing-options.d.ts.map

package/lib/trusted-publishing-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-publishing-options.d.ts","sourceRoot":"","sources":["../src/trusted-publishing-options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;+EAW+E;AAE/E,MAAM,WAAW,wBAAwB;IACrC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB"}

package/lib/trusted-publishing-options.js

@@ -0,0 +1,15 @@
+"use strict";
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=trusted-publishing-options.js.map

package/lib/trusted-publishing-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-publishing-options.js","sourceRoot":"","sources":["../src/trusted-publishing-options.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;+EAW+E"}

package/lib/trusted-publishing.d.ts

@@ -0,0 +1,35 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+import { Registry } from './registry';
+import { TrustedPublishingOptions } from './trusted-publishing-options';
+/**
+ * Whether the given options ask for trusted publishing. If the user did not decide explicitly,
+ * it is used whenever the surrounding CI system can provide an OIDC ID token.
+ */
+export declare function useTrustedPublishing(options: TrustedPublishingOptions): boolean;
+/**
+ * Exchanges an OIDC ID token for a short-lived access token that can publish the given extension.
+ * The token is not stored, it is only valid for a few minutes.
+ */
+export declare function getTrustedPublishingToken(registry: Registry, namespace: string, extension: string, options: TrustedPublishingOptions): Promise<string>;
+/**
+ * Exchanges the ID token again after the registry refused the one this extension was publishing with.
+ * The issued token is short-lived and shared by every target platform of a release, so a slow fan-out
+ * can outlive it and be refused partway through.
+ *
+ * `stale` is the token that was refused. If the cache no longer holds it, another target has already
+ * replaced it and that exchange is awaited instead, so one expiry costs one exchange however many
+ * targets hit it at once.
+ */
+export declare function refreshTrustedPublishingToken(registry: Registry, namespace: string, extension: string, options: TrustedPublishingOptions, stale: string): Promise<string>;
+//# sourceMappingURL=trusted-publishing.d.ts.map

package/lib/trusted-publishing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-publishing.d.ts","sourceRoot":"","sources":["../src/trusted-publishing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;+EAW+E;AAG/E,OAAO,EAAe,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAQxE;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAE/E;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACrC,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,wBAAwB,GAClC,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CACzC,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,wBAAwB,EACjC,KAAK,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAQjB"}

package/lib/trusted-publishing.js

@@ -0,0 +1,112 @@
+"use strict";
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.useTrustedPublishing = useTrustedPublishing;
+exports.getTrustedPublishingToken = getTrustedPublishingToken;
+exports.refreshTrustedPublishingToken = refreshTrustedPublishingToken;
+const oidc_1 = require("./oidc");
+const tokens = new Map();
+// The value each cached exchange resolved to, so a token a publish was refused with can be told from one
+// another publish has already replaced. Cleared while an exchange is in flight.
+const issued = new Map();
+/**
+ * Whether the given options ask for trusted publishing. If the user did not decide explicitly,
+ * it is used whenever the surrounding CI system can provide an OIDC ID token.
+ */
+function useTrustedPublishing(options) {
+    return options.trustedPublishing ?? (0, oidc_1.hasIdTokenSource)(options);
+}
+/**
+ * Exchanges an OIDC ID token for a short-lived access token that can publish the given extension.
+ * The token is not stored, it is only valid for a few minutes.
+ */
+function getTrustedPublishingToken(registry, namespace, extension, options) {
+    // publishing fans out over targets and package paths, but one token is enough per extension
+    const key = `${namespace}.${extension}`;
+    return tokens.get(key) ?? exchange(key, registry, namespace, extension, options);
+}
+/**
+ * Exchanges the ID token again after the registry refused the one this extension was publishing with.
+ * The issued token is short-lived and shared by every target platform of a release, so a slow fan-out
+ * can outlive it and be refused partway through.
+ *
+ * `stale` is the token that was refused. If the cache no longer holds it, another target has already
+ * replaced it and that exchange is awaited instead, so one expiry costs one exchange however many
+ * targets hit it at once.
+ */
+function refreshTrustedPublishingToken(registry, namespace, extension, options, stale) {
+    const key = `${namespace}.${extension}`;
+    const current = tokens.get(key);
+    if (current && issued.get(key) !== stale) {
+        return current;
+    }
+    return exchange(key, registry, namespace, extension, options);
+}
+function exchange(key, registry, namespace, extension, options) {
+    // Dropped up front, so a refresh that is still in flight does not look like the stale token to the
+    // next caller and start a second exchange of its own.
+    issued.delete(key);
+    const token = requestToken(registry, namespace, extension, options).then(value => {
+        issued.set(key, value);
+        return value;
+    });
+    tokens.set(key, token);
+    return token;
+}
+// The registry answers 503 when it could not reach the identity provider to check the token, as opposed
+// to checking it and refusing. That is worth another go: publishing runs unattended on CI, and a blip
+// reaching GitHub or GitLab should not fail a release build. A refusal is never retried.
+const RETRYABLE_STATUS = [502, 503, 504];
+const RETRY_DELAYS_MS = [1000, 4000];
+async function requestToken(registry, namespace, extension, options) {
+    const audience = options.oidcAudience ?? registry.url;
+    const idToken = await (0, oidc_1.getIdToken)(audience, options);
+    let result;
+    try {
+        result = await exchangeWithRetry(registry, namespace, extension, idToken);
+    }
+    catch (err) {
+        throw new Error(`${err.message}\n${registrationHint(registry, namespace, extension)}`);
+    }
+    if (result.error) {
+        throw new Error(`${result.error}\n${registrationHint(registry, namespace, extension)}`);
+    }
+    if (!result.value) {
+        throw new Error('The registry did not return a publishing token.');
+    }
+    const expires = result.expiresTimestamp ? `, expires at ${result.expiresTimestamp}` : '';
+    console.log(`\ud83d\udd10  Trusted publishing token issued for ${namespace}.${extension}${expires}`);
+    return result.value;
+}
+async function exchangeWithRetry(registry, namespace, extension, idToken) {
+    for (let attempt = 0;; attempt++) {
+        try {
+            return await registry.requestTrustedPublishingToken(namespace, extension, idToken);
+        }
+        catch (err) {
+            const status = err?.status;
+            if (attempt >= RETRY_DELAYS_MS.length || status === undefined || !RETRYABLE_STATUS.includes(status)) {
+                throw err;
+            }
+            const delay = RETRY_DELAYS_MS[attempt];
+            console.log(`The registry could not verify the token (${status}), retrying in ${delay / 1000}s`);
+            await new Promise(resolve => setTimeout(resolve, delay));
+        }
+    }
+}
+function registrationHint(registry, namespace, extension) {
+    return `Check the trusted publishers registered for '${namespace}.${extension}' at `
+        + `${registry.url}/user-settings/trusted-publishers.`;
+}
+//# sourceMappingURL=trusted-publishing.js.map

package/lib/trusted-publishing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-publishing.js","sourceRoot":"","sources":["../src/trusted-publishing.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;+EAW+E;;AAiB/E,oDAEC;AAMD,8DASC;AAWD,sEAcC;AAzDD,iCAAsD;AAKtD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;AAElD,yGAAyG;AACzG,gFAAgF;AAChF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEzC;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,OAAiC;IAClE,OAAO,OAAO,CAAC,iBAAiB,IAAI,IAAA,uBAAgB,EAAC,OAAO,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CACrC,QAAkB,EAClB,SAAiB,EACjB,SAAiB,EACjB,OAAiC;IAEjC,4FAA4F;IAC5F,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;IACxC,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,6BAA6B,CACzC,QAAkB,EAClB,SAAiB,EACjB,SAAiB,EACjB,OAAiC,EACjC,KAAa;IAEb,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,OAAO,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,QAAQ,CACb,GAAW,EACX,QAAkB,EAClB,SAAiB,EACjB,SAAiB,EACjB,OAAiC;IAEjC,mGAAmG;IACnG,sDAAsD;IACtD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAC7E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvB,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,wGAAwG;AACxG,sGAAsG;AACtG,yFAAyF;AACzF,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AACzC,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAErC,KAAK,UAAU,YAAY,CACvB,QAAkB,EAClB,SAAiB,EACjB,SAAiB,EACjB,OAAiC;IAEjC,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,IAAI,QAAQ,CAAC,GAAG,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,IAAA,iBAAU,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEpD,IAAI,MAAmB,CAAC;IACxB,IAAI,CAAC;QACD,MAAM,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,KAAK,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,KAAK,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,qDAAqD,SAAS,IAAI,SAAS,GAAG,OAAO,EAAE,CAAC,CAAC;IACrG,OAAO,MAAM,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC5B,QAAkB,EAClB,SAAiB,EACjB,SAAiB,EACjB,OAAe;IAEf,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC;YACD,OAAO,MAAM,QAAQ,CAAC,6BAA6B,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACvF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,MAAM,GAAI,GAAmB,EAAE,MAAM,CAAC;YAC5C,IAAI,OAAO,IAAI,eAAe,CAAC,MAAM,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClG,MAAM,GAAG,CAAC;YACd,CAAC;YACD,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,4CAA4C,MAAM,kBAAkB,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC;YACjG,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7D,CAAC;IACL,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB,EAAE,SAAiB,EAAE,SAAiB;IAC9E,OAAO,gDAAgD,SAAS,IAAI,SAAS,OAAO;UAC9E,GAAG,QAAQ,CAAC,GAAG,oCAAoC,CAAC;AAC9D,CAAC"}

package/lib/unpublish-options.d.ts

@@ -0,0 +1,34 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+import { RegistryOptions } from './registry-options';
+export interface UnpublishOptions extends RegistryOptions {
+    /**
+     * Identifier in the form `namespace.extension` or `namespace/extension`.
+     * Read from the `package.json` in the current directory if omitted.
+     */
+    extensionId?: string;
+    /**
+     * Versions to delete. All versions are deleted if omitted.
+     */
+    versions?: string[];
+    /**
+     * Target platforms to delete. All target platforms of the selected versions
+     * are deleted if omitted. Can only be used together with `versions`.
+     */
+    targets?: string[];
+    /**
+     * Delete without asking for confirmation.
+     */
+    force?: boolean;
+}
+//# sourceMappingURL=unpublish-options.d.ts.map

package/lib/unpublish-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unpublish-options.d.ts","sourceRoot":"","sources":["../src/unpublish-options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;+EAW+E;AAE/E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACrD;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACnB"}