ovsx 1.1.1 → 1.3.0

package/README.md

@@ -10,6 +10,10 @@ npm install --global ovsx
 
 `ovsx` uses open-vsx.org as default instance for publishing and downloading extensions. If you are using a different instance, specify it via the `--registryUrl` (or `-r`) argument or an environment variable named `OVSX_REGISTRY_URL`.
 
+If your registry sits behind a reverse proxy that requires its own HTTP Basic auth (separate from your Open VSX personal access token), set `OVSX_USERNAME` and `OVSX_PASSWORD`.
+
+Requests give up if they stop making progress for 30 seconds, so a registry that accepts a connection and then goes quiet does not leave the command hanging. `OVSX_TIMEOUT` changes that, in milliseconds; `OVSX_TIMEOUT=0` disables it. It measures inactivity rather than total time, so a large extension downloading slowly is not cut off, and it covers the ID token request made for trusted publishing as well as the registry's own.
+
 ### Publish Extensions
 
 You can use `ovsx` for publishing [VS Code extensions](https://code.visualstudio.com/api) to an Open VSX instance. This is very similar to [vsce](https://github.com/microsoft/vscode-vsce), the publishing tool for the [Visual Studio Code Marketplace](https://marketplace.visualstudio.com/vscode).
@@ -24,12 +28,68 @@ Variants:
  * `ovsx publish <file>`
    publishes an already packaged file.
 
+Before uploading, `ovsx` checks the packaged extension's size against the limit the registry reports on `/api/version`, so an oversized package is rejected locally instead of failing after the whole file has been uploaded.
+
+#### Package managers
+
+Packaging is done by `vsce`, which walks your production dependencies to decide what goes into the `.vsix`. It knows how to do that for two package managers only - npm, and yarn v1 via `--yarn` - and [will not be adding more](https://github.com/microsoft/vscode-vsce/issues/421#issuecomment-1853665094). For anything else, pnpm included, there are two options:
+
+ * `ovsx publish --no-dependencies`
+   skips the dependency walk altogether. This is the right answer for a bundled extension - one built with esbuild, webpack or similar, where the bundle already contains everything the extension needs at runtime - regardless of which package manager installed the sources.
+ * `ovsx publish --follow-symlinks`
+   recurses into symlinked directories instead of packing each symlink as a file. A `node_modules` assembled out of symlinks, as pnpm's is, needs this for the walk to reach the real dependency files.
+
+### Trusted Publishing
+
+Instead of a long-lived personal access token, `ovsx` can publish from a CI workflow with a short-lived token that the registry issues in exchange for an OIDC ID token of the workflow. The registry only issues such a token if the workflow matches a trusted publisher that a namespace owner registered under [trusted publishers](https://open-vsx.org/user-settings/trusted-publishers). No access token needs to be stored as a secret.
+
+On GitHub Actions the workflow needs the `id-token: write` permission, everything else is detected automatically:
+
+```yaml
+permissions:
+  contents: read
+  id-token: write
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    # only needed if the trusted publisher pins an environment
+    environment: publish
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+      - run: npm ci
+      - run: npx ovsx publish --trusted-publishing
+```
+
+Options:
+ * `--trusted-publishing` requires trusted publishing and fails if no ID token can be obtained. Without it, trusted publishing is used whenever an ID token is available and no access token was given; a `--pat` (or `OVSX_PAT`) always takes precedence.
+ * `--idToken <token>` passes the ID token explicitly. Use this on CI systems that expose the token as a variable, for example with GitLab CI's [`id_tokens`](https://docs.gitlab.com/ci/yaml/#id_tokens) keyword. The environment variable `OVSX_ID_TOKEN` does the same.
+ * `--oidcAudience <audience>` sets the audience requested for the ID token, by default the registry URL. Use it if the registry expects a different audience, and make sure it matches the `aud` claim the registry validates. The environment variable `OVSX_OIDC_AUDIENCE` does the same.
+
+The issued token is valid for a few minutes only and is never written to the token store, but it does carry publishing rights, so treat CI logs accordingly.
+
+### Delete Extensions
+
+You can delete extensions you published with `ovsx unpublish`, the counterpart of `vsce unpublish`. This requires an access token as described above, and the token's user must be a member of the extension's namespace: namespace owners may delete any version, other members only the versions they published themselves. This requires a registry running version 1.2.0 or later.
+
+Deleting is irreversible: the files of a deleted version are removed and its version number stays reserved, so the same version can never be published again. You will be asked for confirmation unless you pass `--force` (or `-f`).
+
+Variants:
+ * `ovsx unpublish`
+   deletes all versions of the extension in the current working directory, as identified by the `publisher` and `name` fields of its package.json.
+ * `ovsx unpublish <extension>`
+   deletes all versions of the given extension, identified with the format `namespace.extension`.
+ * `ovsx unpublish <extension> --versions <versions...>`
+   deletes only the given versions, e.g. `ovsx unpublish foo.bar -v 1.0.0 1.0.1`.
+ * `ovsx unpublish <extension> --versions <versions...> --target <targets...>`
+   deletes only the given [target platforms](https://code.visualstudio.com/api/working-with-extensions/publishing-extension#platformspecific-extensions) of the given versions, e.g. `ovsx unpublish foo.bar -v 1.0.0 -t linux-x64`.
+
 ### Create a Namespace
 
 The `publisher` field of your extension's package.json defines the namespace into which the extension will be published. Before you publish the first extension in a namespace, you must create it. This requires an access token as described above.
 
  * `ovsx create-namespace <name>`
-   creates the specifed namespace. The name must correspond to the `publisher` of your extension.
+   creates the specified namespace. The name must correspond to the `publisher` of your extension.
 
 Creating a namespace does _not_ automatically give you the exclusive publishing rights. Initially, everyone will be able to publish an extension with the new namespace. If you want exclusive publishing rights, you can [claim ownership of a namespace](https://github.com/eclipse/openvsx/wiki/Namespace-Access).
 
@@ -47,6 +107,18 @@ Variants:
  * `ovsx get <extension> --metadata -o <path>`
    downloads the JSON metadata of an extension and saves it in the specified file or directory.
 
+### Verify a Downloaded Package
+
+If the registry signs published packages, `ovsx verify <path>` checks a downloaded `.vsix` file's signature against the registry's public key - the same check VS Code itself performs when installing a signed extension. The namespace, extension name and version are read from the package itself, so no extra arguments are needed beyond the file path (and `-t`/`--target` for a [target platform specific extension](https://code.visualstudio.com/api/working-with-extensions/publishing-extension#platformspecific-extensions)).
+
+ * `ovsx verify <extension.vsix>`
+   verifies the package's signature and exits with an error if it is missing, invalid, or does not match - meaning the package was not published by, or was tampered with after being published by, the registry it was downloaded from.
+
+If you already have the package, manifest and signature files on disk - e.g. extracted from a registry's signature archive - and don't want `ovsx` to talk to a registry at all, `ovsx verify-signature` verifies that trio entirely offline, mirroring `vsce verify-signature`:
+
+ * `ovsx verify-signature -i <package.vsix> -m <manifest> -s <signature> -k <publicKey>`
+   verifies the signature against the package, and cross-checks the manifest's recorded digests against the package's actual contents - reporting which entry doesn't match, if any. Unlike `vsce verify-signature`, a public key must be supplied explicitly (`-k`/`--publicKeyPath`): Open VSX registries each hold their own signing key, rather than trusting a single baked-in Marketplace key the way VS Code's own verifier does.
+
 ### Store Access Tokens
 
 The `login` command lets you store an access token for a namespace.

package/lib/check-license.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check-license.d.ts","sourceRoot":"","sources":["../src/check-license.ts"],"names":[],"mappings":"AAAA;;;;;;;;kFAQkF;AAKlF,OAAO,EAC0B,QAAQ,EACxC,MAAM,QAAQ,CAAC;AAsChB,wBAAsB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAiB5F;AAED,wBAAsB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKrE"}
+{"version":3,"file":"check-license.d.ts","sourceRoot":"","sources":["../src/check-license.ts"],"names":[],"mappings":"AAAA;;;;;;;;kFAQkF;AAMlF,OAAO,EAC0B,QAAQ,EACxC,MAAM,QAAQ,CAAC;AAsChB,wBAAsB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAiB5F;AAED,wBAAsB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKrE"}

package/lib/check-license.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.isLicenseOk = isLicenseOk;
 exports.checkLicense = checkLicense;
 const fs = require("fs");
+const path = require("path");
 const isCI = require("is-ci");
 const prompts_1 = require("@inquirer/prompts");
 const util_1 = require("./util");
@@ -81,12 +82,12 @@ async function useMITLicense(manifest, packagePath) {
     manifest.license = 'MIT';
     await (0, util_1.writeManifest)(manifest, packagePath);
     const license = MIT_LICENSE_TEXT.replace('<YEAR> <COPYRIGHT HOLDER>', copyright);
-    await (0, util_1.writeFile)('LICENSE', license, packagePath);
+    await fs.promises.writeFile(path.join(packagePath ?? process.cwd(), 'LICENSE'), license, 'utf-8');
     console.log('LICENSE file has been written. Please commit it to the source repository.');
 }
 const LICENSE_FILE_NAMES = ['license.md', 'license', 'license.txt', 'licence.md', 'licence', 'licence.txt'];
 async function hasLicenseFile(packagePath) {
-    const fileNames = await (0, util_1.promisify)(fs.readdir)(packagePath ?? '.');
+    const fileNames = await fs.promises.readdir(packagePath ?? '.');
     for (const fileName of fileNames) {
         for (const licFileName of LICENSE_FILE_NAMES) {
             if (fileName.toLowerCase() === licFileName) {

package/lib/check-license.js.map

@@ -1 +1 @@
-{"version":3,"file":"check-license.js","sourceRoot":"","sources":["../src/check-license.ts"],"names":[],"mappings":";AAAA;;;;;;;;kFAQkF;;AA6ClF,kCAiBC;AAED,oCAKC;AAnED,yBAAyB;AACzB,8BAA8B;AAC9B,+CAAkD;AAClD,iCAEgB;AAEhB,KAAK,UAAU,UAAU,CAAC,WAAmB,EAAE,QAAkB;IAC7D,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,QAAQ,CAAC,SAAS,GAAG,GAAG,GAAG,QAAQ,CAAC,IAAI,GAAG,gCAAgC;UAChG,8FAA8F;UAC9F,4FAA4F;UAC5F,gGAAgG;UAChG,uDAAuD,CAAC,CAAC;IAC/D,IAAI,MAA6B,CAAC;IAClC,GAAG,CAAC;QACA,MAAM,GAAG,MAAM,IAAA,gBAAM,EAAC;YAClB,OAAO,EAAE,2CAA2C;kBAC9C,QAAQ,CAAC,SAAS,GAAG,GAAG,GAAG,QAAQ,CAAC,IAAI;kBACxC,yBAAyB;YAC/B,OAAO,EAAE;gBACL,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;gBAC7B,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;gBAC/B,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;aAC9B;YACD,OAAO,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,QAAQ,MAAM,EAAE,CAAC;YACb,KAAK,KAAK;gBACN,MAAM,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;gBAC3C,MAAM;YACV,KAAK,MAAM;gBACP,OAAO,CAAC,GAAG,CAAC,8EAA8E;sBACpF,uFAAuF;sBACvF,+EAA+E;sBAC/E,yCAAyC,CAAC,CAAC;gBACjD,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBAC9B,MAAM;YACV,KAAK,IAAI;gBACL,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACxF,CAAC;IACL,CAAC,QAAQ,MAAM,KAAK,MAAM,EAAE;AAChC,CAAC;AAEM,KAAK,UAAU,WAAW,CAAC,WAAmB,EAAE,QAAmB;IACtE,4DAA4D;IAC5D,8DAA8D;IAC9D,QAAQ,GAAG,QAAQ,IAAI,MAAM,IAAA,mBAAY,EAAC,WAAW,CAAC,CAAC;IACvD,IAAA,uBAAgB,EAAC,QAAQ,CAAC,CAAC;IAE3B,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnB,qFAAqF;QACrF,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,wDAAwD;QACxD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,WAAmB;IAClD,MAAM,QAAQ,GAAG,MAAM,IAAA,mBAAY,EAAC,WAAW,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;AACL,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAkB,EAAE,WAAoB;IACjE,OAAO,CAAC,GAAG,CAAC,iEAAiE;UACvE,sCAAsC,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,IAAA,eAAK,EAAC;QAC1B,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,2DAA2D;KAC5G,CAAC,CAAC;IACH,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC;IACzB,MAAM,IAAA,oBAAa,EAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,2BAA2B,EAAE,SAAS,CAAC,CAAC;IACjF,MAAM,IAAA,gBAAS,EAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AAE5G,KAAK,UAAU,cAAc,CAAC,WAAoB;IAC9C,MAAM,SAAS,GAAG,MAAM,IAAA,gBAAS,EAAC,EAAE,CAAC,OAAO,CAAC,CAAC,WAAW,IAAI,GAAG,CAAC,CAAC;IAClE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/B,KAAK,MAAM,WAAW,IAAI,kBAAkB,EAAE,CAAC;YAC3C,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;gBACzC,OAAO,IAAI,CAAC;YAChB,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,MAAM,gBAAgB,GAAW;;;;;;;;;;;;;;;;;;UAkBvB,CAAC"}
+{"version":3,"file":"check-license.js","sourceRoot":"","sources":["../src/check-license.ts"],"names":[],"mappings":";AAAA;;;;;;;;kFAQkF;;AA8ClF,kCAiBC;AAED,oCAKC;AApED,yBAAyB;AACzB,6BAA6B;AAC7B,8BAA8B;AAC9B,+CAAkD;AAClD,iCAEgB;AAEhB,KAAK,UAAU,UAAU,CAAC,WAAmB,EAAE,QAAkB;IAC7D,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,QAAQ,CAAC,SAAS,GAAG,GAAG,GAAG,QAAQ,CAAC,IAAI,GAAG,gCAAgC;UAChG,8FAA8F;UAC9F,4FAA4F;UAC5F,gGAAgG;UAChG,uDAAuD,CAAC,CAAC;IAC/D,IAAI,MAA6B,CAAC;IAClC,GAAG,CAAC;QACA,MAAM,GAAG,MAAM,IAAA,gBAAM,EAAC;YAClB,OAAO,EAAE,2CAA2C;kBAC9C,QAAQ,CAAC,SAAS,GAAG,GAAG,GAAG,QAAQ,CAAC,IAAI;kBACxC,yBAAyB;YAC/B,OAAO,EAAE;gBACL,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;gBAC7B,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;gBAC/B,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;aAC9B;YACD,OAAO,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,QAAQ,MAAM,EAAE,CAAC;YACb,KAAK,KAAK;gBACN,MAAM,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;gBAC3C,MAAM;YACV,KAAK,MAAM;gBACP,OAAO,CAAC,GAAG,CAAC,8EAA8E;sBACpF,uFAAuF;sBACvF,+EAA+E;sBAC/E,yCAAyC,CAAC,CAAC;gBACjD,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBAC9B,MAAM;YACV,KAAK,IAAI;gBACL,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACxF,CAAC;IACL,CAAC,QAAQ,MAAM,KAAK,MAAM,EAAE;AAChC,CAAC;AAEM,KAAK,UAAU,WAAW,CAAC,WAAmB,EAAE,QAAmB;IACtE,4DAA4D;IAC5D,8DAA8D;IAC9D,QAAQ,GAAG,QAAQ,IAAI,MAAM,IAAA,mBAAY,EAAC,WAAW,CAAC,CAAC;IACvD,IAAA,uBAAgB,EAAC,QAAQ,CAAC,CAAC;IAE3B,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnB,qFAAqF;QACrF,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,wDAAwD;QACxD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,WAAmB;IAClD,MAAM,QAAQ,GAAG,MAAM,IAAA,mBAAY,EAAC,WAAW,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;AACL,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAkB,EAAE,WAAoB;IACjE,OAAO,CAAC,GAAG,CAAC,iEAAiE;UACvE,sCAAsC,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,IAAA,eAAK,EAAC;QAC1B,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,2DAA2D;KAC5G,CAAC,CAAC;IACH,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC;IACzB,MAAM,IAAA,oBAAa,EAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,2BAA2B,EAAE,SAAS,CAAC,CAAC;IACjF,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAClG,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AAE5G,KAAK,UAAU,cAAc,CAAC,WAAoB;IAC9C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC,CAAC;IAChE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/B,KAAK,MAAM,WAAW,IAAI,kBAAkB,EAAE,CAAC;YAC3C,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;gBACzC,OAAO,IAAI,CAAC;YAChB,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,MAAM,gBAAgB,GAAW;;;;;;;;;;;;;;;;;;UAkBvB,CAAC"}

package/lib/get.js

@@ -23,7 +23,7 @@ async function getExtension(options) {
     const registry = new registry_1.Registry(options);
     const match = (0, util_1.matchExtensionId)(options.extensionId);
     if (!match) {
-        throw new Error('The extension identifier must have the form `namespace.extension`.');
+        throw new Error('The extension identifier must have the form `namespace.extension` or `namespace/extension`.');
     }
     const extension = await registry.getMetadata(match[1], match[2], options.target);
     if (extension.error) {
@@ -66,7 +66,7 @@ async function printMetadata(registry, extension, output) {
         return;
     }
     let filePath;
-    const stats = await (0, util_1.optionalStat)(output);
+    const stats = fs.statSync(output, { throwIfNoEntry: false });
     if (stats?.isDirectory() || !stats && output.endsWith(path.sep)) {
         const fileName = `${extension.namespace}.${extension.name}-${extension.version}.json`;
         filePath = path.resolve(process.cwd(), output, fileName);
@@ -74,8 +74,8 @@ async function printMetadata(registry, extension, output) {
     else {
         filePath = path.resolve(process.cwd(), output);
     }
-    await (0, util_1.makeDirs)(path.dirname(filePath));
-    await (0, util_1.promisify)(fs.writeFile)(filePath, metadata);
+    await fs.promises.mkdir(path.dirname(filePath), { recursive: true });
+    await fs.promises.writeFile(filePath, metadata);
 }
 async function download(registry, extension, output) {
     const downloadUrl = extension.files.download;
@@ -86,7 +86,7 @@ async function download(registry, extension, output) {
     const fileName = decodeURIComponent(downloadUrl.substring(fileNameIndex + 1));
     let filePath;
     if (output) {
-        const stats = await (0, util_1.optionalStat)(output);
+        const stats = fs.statSync(output, { throwIfNoEntry: false });
         if (stats?.isDirectory() || !stats && output.endsWith(path.sep)) {
             filePath = path.resolve(process.cwd(), output, fileName);
         }
@@ -97,7 +97,7 @@ async function download(registry, extension, output) {
     else {
         filePath = path.resolve(process.cwd(), fileName);
     }
-    await (0, util_1.makeDirs)(path.dirname(filePath));
+    await fs.promises.mkdir(path.dirname(filePath), { recursive: true });
     const target = extension.targetPlatform !== 'universal' ? '@' + extension.targetPlatform : '';
     console.log(`Downloading ${extension.namespace}.${extension.name}-${extension.version}${target} to ${filePath}`);
     await registry.download(filePath, new URL(downloadUrl));

package/lib/get.js.map

@@ -1 +1 @@
-{"version":3,"file":"get.js","sourceRoot":"","sources":["../src/get.ts"],"names":[],"mappings":";AAAA;;;;;;;;kFAQkF;;AAYlF,oCAuBC;AAjCD,yBAAyB;AACzB,6BAA6B;AAC7B,iCAAiC;AACjC,yCAAiD;AACjD,iCAAyG;AAGzG;;GAEG;AACI,KAAK,UAAU,YAAY,CAAC,OAAmB;IAClD,IAAA,oBAAa,EAAC,OAAO,CAAC,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,mBAAQ,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAA,uBAAgB,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACjF,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACxF,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,aAAa,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;SAAM,CAAC;QACJ,MAAM,QAAQ,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAkB,EAAE,SAAoB,EAAE,UAAmB;IACtF,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC;gBACD,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACrE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,OAAO,IAAA,kBAAW,EAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,uCAAuC,UAAU,GAAG,CAAC,CAAC,CAAC;AAC7I,CAAC;AAED,SAAS,OAAO,CAAC,SAAoB,EAAE,OAAe;IAClD,OAAO,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAkB,EAAE,SAAoB,EAAE,MAAe;IAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,OAAO;IACX,CAAC;IACD,IAAI,QAA4B,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAY,EAAC,MAAM,CAAC,CAAC;IACzC,IAAI,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,QAAQ,GAAG,GAAG,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,OAAO,OAAO,CAAC;QACtF,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACJ,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,IAAA,eAAQ,EAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,MAAM,IAAA,gBAAS,EAAC,EAAE,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB,EAAE,SAAoB,EAAE,MAAe;IAC7E,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;IAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,aAAa,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,mCAAmC,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,aAAa,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,WAAW,CAAC,SAAS,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9E,IAAI,QAA4B,CAAC;IACjC,IAAI,MAAM,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAY,EAAC,MAAM,CAAC,CAAC;QACzC,IAAI,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACJ,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;IACL,CAAC;SAAM,CAAC;QACJ,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,IAAA,eAAQ,EAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,OAAO,CAAC,GAAG,CAAC,eAAe,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,OAAO,GAAG,MAAM,OAAO,QAAQ,EAAE,CAAC,CAAC;IACjH,MAAM,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../src/get.ts"],"names":[],"mappings":";AAAA;;;;;;;;kFAQkF;;AAYlF,oCAuBC;AAjCD,yBAAyB;AACzB,6BAA6B;AAC7B,iCAAiC;AACjC,yCAAiD;AACjD,iCAAsE;AAGtE;;GAEG;AACI,KAAK,UAAU,YAAY,CAAC,OAAmB;IAClD,IAAA,oBAAa,EAAC,OAAO,CAAC,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,mBAAQ,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAA,uBAAgB,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IACnH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACjF,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACxF,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,aAAa,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;SAAM,CAAC;QACJ,MAAM,QAAQ,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAkB,EAAE,SAAoB,EAAE,UAAmB;IACtF,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC;gBACD,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACrE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,OAAO,IAAA,kBAAW,EAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,uCAAuC,UAAU,GAAG,CAAC,CAAC,CAAC;AAC7I,CAAC;AAED,SAAS,OAAO,CAAC,SAAoB,EAAE,OAAe;IAClD,OAAO,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAkB,EAAE,SAAoB,EAAE,MAAe;IAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,OAAO;IACX,CAAC;IACD,IAAI,QAA4B,CAAC;IACjC,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,IAAI,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,QAAQ,GAAG,GAAG,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,OAAO,OAAO,CAAC;QACtF,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACJ,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB,EAAE,SAAoB,EAAE,MAAe;IAC7E,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;IAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,aAAa,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,mCAAmC,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,aAAa,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,WAAW,CAAC,SAAS,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9E,IAAI,QAA4B,CAAC;IACjC,IAAI,MAAM,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,IAAI,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACJ,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;IACL,CAAC;SAAM,CAAC;QACJ,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,OAAO,CAAC,GAAG,CAAC,eAAe,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,OAAO,GAAG,MAAM,OAAO,QAAQ,EAAE,CAAC,CAAC;IACjH,MAAM,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;AAC5D,CAAC"}

package/lib/http.d.ts

@@ -0,0 +1,32 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+import * as http from 'http';
+import * as fs from 'fs';
+export type RequestBody = () => string | Buffer | Uint8Array | fs.ReadStream;
+/**
+ * Sends a request and follows redirects to `onResponse`'s final response, reporting any failure
+ * to `fail`. A GET follows every redirect; a request with a body follows only 307/308, sending
+ * the body again, because 301/302/303 turn it into a GET without one. Credentials are dropped
+ * once a redirect leaves the origin. Only the headers in `options` are sent, so a caller that
+ * passes none carries no credentials.
+ */
+export declare function send(url: URL, options: http.RequestOptions, body: RequestBody | undefined, onResponse: (response: http.IncomingMessage) => void, fail: (err: Error) => void, hops?: number): void;
+/** Sends a GET with only the given headers and resolves with the parsed JSON response. */
+export declare function getJson<T>(url: URL, headers: http.OutgoingHttpHeaders, timeout: number): Promise<T>;
+/**
+ * Reads a response as JSON. A non-2xx status rejects with the `message` or `error` of a JSON
+ * error body when there is one, and with the status otherwise. An HTML page rejects with an
+ * Error rather than its markup, since it usually means the URL points at a website, not an API.
+ */
+export declare function jsonResponse<T>(resolve: (value: T) => void, reject: (reason: any) => void): (res: http.IncomingMessage) => void;
+//# sourceMappingURL=http.d.ts.map

package/lib/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;+EAW+E;AAE/E,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AASzB,MAAM,MAAM,WAAW,GAAG,MAAM,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC;AAE7E;;;;;;GAMG;AACH,wBAAgB,IAAI,CAChB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,IAAI,CAAC,cAAc,EAC5B,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,UAAU,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI,EACpD,IAAI,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,EAC1B,IAAI,SAAI,GACT,IAAI,CAqDN;AAED,0FAA0F;AAC1F,wBAAgB,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAInG;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI,CAsC/H"}

package/lib/http.js

@@ -0,0 +1,170 @@
+"use strict";
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.send = send;
+exports.getJson = getJson;
+exports.jsonResponse = jsonResponse;
+const http = require("http");
+const https = require("https");
+const fs = require("fs");
+const util_1 = require("./util");
+// Hop limit the fetch standard uses.
+const MAX_REDIRECTS = 20;
+// Dropped on a redirect to another origin; X-OpenVSX-Token carries the PAT just like Authorization.
+const CREDENTIAL_HEADERS = /^(?:authorization|cookie|proxy-authorization|x-openvsx-token)$/i;
+/**
+ * Sends a request and follows redirects to `onResponse`'s final response, reporting any failure
+ * to `fail`. A GET follows every redirect; a request with a body follows only 307/308, sending
+ * the body again, because 301/302/303 turn it into a GET without one. Credentials are dropped
+ * once a redirect leaves the origin. Only the headers in `options` are sent, so a caller that
+ * passes none carries no credentials.
+ */
+function send(url, options, body, onResponse, fail, hops = 0) {
+    const protocol = url.protocol === 'https:' ? https : http;
+    const request = protocol.request(url, options, response => {
+        const status = response.statusCode ?? 0;
+        const location = response.headers.location;
+        if (status < 300 || status > 399 || !location) {
+            onResponse(response);
+            return;
+        }
+        response.resume();
+        let next;
+        try {
+            next = new URL(location, url);
+        }
+        catch (err) {
+            fail(err);
+            return;
+        }
+        if (hops >= MAX_REDIRECTS) {
+            fail(new Error(`The request to ${(0, util_1.redactUrl)(url)} was redirected more than ${MAX_REDIRECTS} times.`));
+        }
+        else if (next.protocol !== 'https:' && next.protocol !== 'http:') {
+            fail(new Error(`The request to ${(0, util_1.redactUrl)(url)} was redirected to unsupported URL ${(0, util_1.redactUrl)(next)}.`));
+        }
+        else if (body && status !== 307 && status !== 308) {
+            fail((0, util_1.withStatus)(new Error(`The ${options.method} request to ${(0, util_1.redactUrl)(url)} was redirected to ${(0, util_1.redactUrl)(next)} `
+                + `with status ${status}, which drops the request body. Use the redirect target as the registry URL.`), status));
+        }
+        else {
+            // The server may answer before reading the body: abandon this hop so its stream
+            // releases the file and a late reset on its socket can't fail the next hop.
+            request.removeListener('error', fail);
+            request.on('error', () => { });
+            if (content instanceof fs.ReadStream) {
+                content.unpipe(request);
+                content.destroy();
+            }
+            request.destroy();
+            const headers = next.origin === url.origin ? options.headers : withoutCredentials(options.headers);
+            send(next, { ...options, headers }, body, onResponse, fail, hops + 1);
+        }
+    });
+    request.on('error', fail);
+    failOnTimeout(request, url, options.timeout, fail);
+    const content = body?.();
+    if (content instanceof fs.ReadStream) {
+        content.on('error', (err) => {
+            request.destroy();
+            fail(err);
+        });
+        request.on('error', () => content.close());
+        content.on('open', () => content.pipe(request));
+    }
+    else {
+        request.end(content);
+    }
+}
+/** Sends a GET with only the given headers and resolves with the parsed JSON response. */
+function getJson(url, headers, timeout) {
+    return new Promise((resolve, reject) => {
+        send(url, { method: 'GET', headers, timeout }, undefined, jsonResponse(resolve, reject), reject);
+    });
+}
+/**
+ * Reads a response as JSON. A non-2xx status rejects with the `message` or `error` of a JSON
+ * error body when there is one, and with the status otherwise. An HTML page rejects with an
+ * Error rather than its markup, since it usually means the URL points at a website, not an API.
+ */
+function jsonResponse(resolve, reject) {
+    return response => {
+        response.setEncoding('utf-8');
+        let json = '';
+        // A connection lost after the headers have arrived ends the response without 'end' ever
+        // firing, so without this the promise is never settled and the command waits on a body
+        // that is not coming. The configured timeout would eventually rescue it, but rejecting
+        // here reports what actually happened instead of thirty seconds of silence.
+        response.on('error', reject);
+        response.on('data', chunk => json += chunk);
+        response.on('end', () => {
+            if (response.statusCode !== undefined && (response.statusCode < 200 || response.statusCode > 299)) {
+                if (json.trimStart().startsWith('{')) {
+                    try {
+                        const parsed = JSON.parse(json);
+                        const message = parsed.message || parsed.error;
+                        if (message) {
+                            // keep the status: the message alone cannot say whether retrying is worth it
+                            reject((0, util_1.withStatus)(new Error(message), response.statusCode));
+                            return;
+                        }
+                    }
+                    catch (err) {
+                        // Ignore the error and reject with response status
+                    }
+                }
+                reject((0, util_1.statusError)(response));
+            }
+            else if (isHtml(response, json)) {
+                reject((0, util_1.withStatus)(new Error(`The server responded with status ${response.statusCode} and an HTML page instead of JSON.`), response.statusCode));
+            }
+            else {
+                try {
+                    resolve(JSON.parse(json));
+                }
+                catch (err) {
+                    reject(err);
+                }
+            }
+        });
+    };
+}
+/**
+ * Node's `timeout` option only raises an event - the request stays open, which is why a server
+ * that accepts a connection and then says nothing used to hold a command open indefinitely.
+ * Destroying the request with an error routes through the error handling each caller already
+ * has, so a stalled request rejects the way any other failure does. With a timeout of zero the
+ * event never fires and this does nothing.
+ */
+function failOnTimeout(request, url, timeout, fail) {
+    request.on('timeout', () => {
+        // Reported before the request is torn down, rather than by destroying it with the error.
+        // Destroying raises errors of its own - ECONNRESET on the response, a premature close
+        // from pipeline - and node guarantees no order between those and the request's own. In
+        // practice the request's arrives first, so this is belt and braces rather than the thing
+        // that stops the wrong error being reported; that is the caller claiming the failure
+        // before it does any asynchronous cleanup.
+        fail(new Error(`No response from ${(0, util_1.redactUrl)(url)} for ${timeout} ms.`));
+        request.destroy();
+    });
+}
+// The body check covers servers that send HTML without a text/html Content-Type.
+function isHtml(response, body) {
+    const contentType = response.headers['content-type']?.split(';')[0].trim().toLowerCase();
+    return contentType === 'text/html' || /^\s*<(?:!doctype\s+html|html)[\s>]/i.test(body);
+}
+function withoutCredentials(headers = {}) {
+    return Object.fromEntries(Object.entries(headers).filter(([name]) => !CREDENTIAL_HEADERS.test(name)));
+}
+//# sourceMappingURL=http.js.map

package/lib/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;+EAW+E;;AAsB/E,oBA4DC;AAGD,0BAIC;AAOD,oCAsCC;AApID,6BAA6B;AAC7B,+BAA+B;AAC/B,yBAAyB;AACzB,iCAA4D;AAE5D,qCAAqC;AACrC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,oGAAoG;AACpG,MAAM,kBAAkB,GAAG,iEAAiE,CAAC;AAI7F;;;;;;GAMG;AACH,SAAgB,IAAI,CAChB,GAAQ,EACR,OAA4B,EAC5B,IAA6B,EAC7B,UAAoD,EACpD,IAA0B,EAC1B,IAAI,GAAG,CAAC;IAER,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;QACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3C,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5C,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO;QACX,CAAC;QACD,QAAQ,CAAC,MAAM,EAAE,CAAC;QAElB,IAAI,IAAS,CAAC;QACd,IAAI,CAAC;YACD,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,IAAI,CAAC,GAAY,CAAC,CAAC;YACnB,OAAO;QACX,CAAC;QACD,IAAI,IAAI,IAAI,aAAa,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,KAAK,CAAC,kBAAkB,IAAA,gBAAS,EAAC,GAAG,CAAC,6BAA6B,aAAa,SAAS,CAAC,CAAC,CAAC;QACzG,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjE,IAAI,CAAC,IAAI,KAAK,CAAC,kBAAkB,IAAA,gBAAS,EAAC,GAAG,CAAC,sCAAsC,IAAA,gBAAS,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9G,CAAC;aAAM,IAAI,IAAI,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAClD,IAAI,CAAC,IAAA,iBAAU,EAAC,IAAI,KAAK,CAAC,OAAO,OAAO,CAAC,MAAM,eAAe,IAAA,gBAAS,EAAC,GAAG,CAAC,sBAAsB,IAAA,gBAAS,EAAC,IAAI,CAAC,GAAG;kBAC9G,eAAe,MAAM,8EAA8E,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACzH,CAAC;aAAM,CAAC;YACJ,gFAAgF;YAChF,4EAA4E;YAC5E,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAmB,CAAC,CAAC,CAAC;YAC/C,IAAI,OAAO,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;gBACnC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACxB,OAAO,CAAC,OAAO,EAAE,CAAC;YACtB,CAAC;YACD,OAAO,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAmC,CAAC,CAAC;YAC/H,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;QAC1E,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1B,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAEnD,MAAM,OAAO,GAAG,IAAI,EAAE,EAAE,CAAC;IACzB,IAAI,OAAO,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACnC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YAC/B,OAAO,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;AACL,CAAC;AAED,0FAA0F;AAC1F,SAAgB,OAAO,CAAI,GAAQ,EAAE,OAAiC,EAAE,OAAe;IACnF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAI,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAI,OAA2B,EAAE,MAA6B;IACtF,OAAO,QAAQ,CAAC,EAAE;QACd,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,wFAAwF;QACxF,uFAAuF;QACvF,uFAAuF;QACvF,4EAA4E;QAC5E,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC;QAC5C,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACpB,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,UAAU,GAAG,GAAG,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC;gBAChG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnC,IAAI,CAAC;wBACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyC,CAAC;wBACxE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC;wBAC/C,IAAI,OAAO,EAAE,CAAC;4BACV,6EAA6E;4BAC7E,MAAM,CAAC,IAAA,iBAAU,EAAC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;4BAC5D,OAAO;wBACX,CAAC;oBACL,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACX,mDAAmD;oBACvD,CAAC;gBACL,CAAC;gBACD,MAAM,CAAC,IAAA,kBAAW,EAAC,QAAQ,CAAC,CAAC,CAAC;YAClC,CAAC;iBAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAA,iBAAU,EAAC,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,UAAU,oCAAoC,CAAC,EACpH,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC;oBACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC9B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACX,MAAM,CAAC,GAAG,CAAC,CAAC;gBAChB,CAAC;YACL,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,OAA2B,EAAE,GAAQ,EAAE,OAA2B,EAAE,IAA0B;IACjH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACvB,yFAAyF;QACzF,sFAAsF;QACtF,uFAAuF;QACvF,yFAAyF;QACzF,qFAAqF;QACrF,2CAA2C;QAC3C,IAAI,CAAC,IAAI,KAAK,CAAC,oBAAoB,IAAA,gBAAS,EAAC,GAAG,CAAC,QAAQ,OAAO,MAAM,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACP,CAAC;AAED,iFAAiF;AACjF,SAAS,MAAM,CAAC,QAA8B,EAAE,IAAY;IACxD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzF,OAAO,WAAW,KAAK,WAAW,IAAI,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAoC,EAAE;IAC9D,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC1G,CAAC"}

package/lib/index.d.ts

@@ -18,6 +18,10 @@ export * from './publish';
 export * from './publish-options';
 export * from './registry';
 export * from './registry-options';
+export * from './trusted-publishing';
+export * from './trusted-publishing-options';
+export * from './unpublish';
+export * from './unpublish-options';
 export * from './verify-pat';
 export * from './verify-pat-options';
 export { isLicenseOk } from './check-license';

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;kFAQkF;AAElF,cAAc,oBAAoB,CAAC;AACnC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,OAAO,CAAC;AACtB,cAAc,eAAe,CAAC;AAC9B,cAAc,SAAS,CAAC;AACxB,cAAc,iBAAiB,CAAC;AAChC,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;kFAQkF;AAElF,cAAc,oBAAoB,CAAC;AACnC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,OAAO,CAAC;AACtB,cAAc,eAAe,CAAC;AAC9B,cAAc,SAAS,CAAC;AACxB,cAAc,iBAAiB,CAAC;AAChC,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC"}

package/lib/index.js

@@ -35,6 +35,10 @@ __exportStar(require("./publish"), exports);
 __exportStar(require("./publish-options"), exports);
 __exportStar(require("./registry"), exports);
 __exportStar(require("./registry-options"), exports);
+__exportStar(require("./trusted-publishing"), exports);
+__exportStar(require("./trusted-publishing-options"), exports);
+__exportStar(require("./unpublish"), exports);
+__exportStar(require("./unpublish-options"), exports);
 __exportStar(require("./verify-pat"), exports);
 __exportStar(require("./verify-pat-options"), exports);
 var check_license_1 = require("./check-license");

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;kFAQkF;;;;;;;;;;;;;;;;;AAElF,qDAAmC;AACnC,6DAA2C;AAC3C,wCAAsB;AACtB,gDAA8B;AAC9B,0CAAwB;AACxB,kDAAgC;AAChC,2CAAyB;AACzB,4CAA0B;AAC1B,oDAAkC;AAClC,6CAA2B;AAC3B,qDAAmC;AACnC,+CAA6B;AAC7B,uDAAqC;AACrC,iDAA8C;AAArC,4GAAA,WAAW,OAAA;AACpB,+BAAwD;AAA/C,wGAAA,gBAAgB,OAAA;AAAE,oGAAA,YAAY,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;kFAQkF;;;;;;;;;;;;;;;;;AAElF,qDAAmC;AACnC,6DAA2C;AAC3C,wCAAsB;AACtB,gDAA8B;AAC9B,0CAAwB;AACxB,kDAAgC;AAChC,2CAAyB;AACzB,4CAA0B;AAC1B,oDAAkC;AAClC,6CAA2B;AAC3B,qDAAmC;AACnC,uDAAqC;AACrC,+DAA6C;AAC7C,8CAA4B;AAC5B,sDAAoC;AACpC,+CAA6B;AAC7B,uDAAqC;AACrC,iDAA8C;AAArC,4GAAA,WAAW,OAAA;AACpB,+BAAwD;AAA/C,wGAAA,gBAAgB,OAAA;AAAE,oGAAA,YAAY,OAAA"}

package/lib/list-options.d.ts

@@ -0,0 +1,24 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+import { RegistryOptions } from './registry-options';
+export interface ListOptions extends RegistryOptions {
+    /**
+     * Namespace whose extensions should be listed.
+     */
+    namespace: string;
+    /**
+     * Print the raw namespace metadata as JSON instead of a list.
+     */
+    json?: boolean;
+}
+//# sourceMappingURL=list-options.d.ts.map

package/lib/list-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-options.d.ts","sourceRoot":"","sources":["../src/list-options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;+EAW+E;AAE/E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,WAAW,WAAY,SAAQ,eAAe;IAChD;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAClB"}

package/lib/list-options.js

@@ -0,0 +1,15 @@
+"use strict";
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=list-options.js.map

package/lib/list-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-options.js","sourceRoot":"","sources":["../src/list-options.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;+EAW+E"}

package/lib/list.d.ts

@@ -0,0 +1,18 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+import { ListOptions } from './list-options';
+/**
+ * Lists the extensions published in a namespace.
+ */
+export declare function list(options: ListOptions): Promise<void>;
+//# sourceMappingURL=list.d.ts.map

package/lib/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../src/list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;+EAW+E;AAE/E,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAK7C;;GAEG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B9D"}

package/lib/list.js

@@ -0,0 +1,46 @@
+"use strict";
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.list = list;
+const registry_1 = require("./registry");
+const table_1 = require("./table");
+const util_1 = require("./util");
+/**
+ * Lists the extensions published in a namespace.
+ */
+async function list(options) {
+    (0, util_1.addEnvOptions)(options);
+    const registry = new registry_1.Registry(options);
+    const namespace = await registry.getNamespace(options.namespace);
+    if (namespace.error) {
+        throw new Error(namespace.error);
+    }
+    if (options.json) {
+        console.log(JSON.stringify(namespace, null, 4));
+        return;
+    }
+    // Sorted here rather than relying on the response's key order, so the output is stable and
+    // scriptable regardless of how the registry happens to serialise the map.
+    const names = Object.keys(namespace.extensions ?? {}).sort((a, b) => a.localeCompare(b));
+    const verified = namespace.verified ? ' (verified)' : '';
+    console.log(`${namespace.name}${verified} - ${(0, table_1.formatCount)(names.length, 'extension')}`);
+    if (names.length === 0) {
+        return;
+    }
+    console.log();
+    for (const name of names) {
+        console.log(`  ${namespace.name}.${name}`);
+    }
+}
+//# sourceMappingURL=list.js.map

package/lib/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../src/list.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;+EAW+E;;AAU/E,oBA0BC;AAjCD,yCAAsC;AACtC,mCAAsC;AACtC,iCAAuC;AAEvC;;GAEG;AACI,KAAK,UAAU,IAAI,CAAC,OAAoB;IAC3C,IAAA,oBAAa,EAAC,OAAO,CAAC,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,mBAAQ,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChD,OAAO;IACX,CAAC;IAED,2FAA2F;IAC3F,0EAA0E;IAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,GAAG,QAAQ,MAAM,IAAA,mBAAW,EAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;IACxF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;IACX,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;AACL,CAAC"}