ovsx 1.1.1 → 1.3.0

package/lib/trusted-publishing.d.ts

@@ -0,0 +1,35 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+import { Registry } from './registry';
+import { TrustedPublishingOptions } from './trusted-publishing-options';
+/**
+ * Whether the given options ask for trusted publishing. If the user did not decide explicitly,
+ * it is used whenever the surrounding CI system can provide an OIDC ID token.
+ */
+export declare function useTrustedPublishing(options: TrustedPublishingOptions): boolean;
+/**
+ * Exchanges an OIDC ID token for a short-lived access token that can publish the given extension.
+ * The token is not stored, it is only valid for a few minutes.
+ */
+export declare function getTrustedPublishingToken(registry: Registry, namespace: string, extension: string, options: TrustedPublishingOptions): Promise<string>;
+/**
+ * Exchanges the ID token again after the registry refused the one this extension was publishing with.
+ * The issued token is short-lived and shared by every target platform of a release, so a slow fan-out
+ * can outlive it and be refused partway through.
+ *
+ * `stale` is the token that was refused. If the cache no longer holds it, another target has already
+ * replaced it and that exchange is awaited instead, so one expiry costs one exchange however many
+ * targets hit it at once.
+ */
+export declare function refreshTrustedPublishingToken(registry: Registry, namespace: string, extension: string, options: TrustedPublishingOptions, stale: string): Promise<string>;
+//# sourceMappingURL=trusted-publishing.d.ts.map

package/lib/trusted-publishing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-publishing.d.ts","sourceRoot":"","sources":["../src/trusted-publishing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;+EAW+E;AAG/E,OAAO,EAAe,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAQxE;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAE/E;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACrC,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,wBAAwB,GAClC,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CACzC,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,wBAAwB,EACjC,KAAK,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAQjB"}

package/lib/trusted-publishing.js

@@ -0,0 +1,112 @@
+"use strict";
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.useTrustedPublishing = useTrustedPublishing;
+exports.getTrustedPublishingToken = getTrustedPublishingToken;
+exports.refreshTrustedPublishingToken = refreshTrustedPublishingToken;
+const oidc_1 = require("./oidc");
+const tokens = new Map();
+// The value each cached exchange resolved to, so a token a publish was refused with can be told from one
+// another publish has already replaced. Cleared while an exchange is in flight.
+const issued = new Map();
+/**
+ * Whether the given options ask for trusted publishing. If the user did not decide explicitly,
+ * it is used whenever the surrounding CI system can provide an OIDC ID token.
+ */
+function useTrustedPublishing(options) {
+    return options.trustedPublishing ?? (0, oidc_1.hasIdTokenSource)(options);
+}
+/**
+ * Exchanges an OIDC ID token for a short-lived access token that can publish the given extension.
+ * The token is not stored, it is only valid for a few minutes.
+ */
+function getTrustedPublishingToken(registry, namespace, extension, options) {
+    // publishing fans out over targets and package paths, but one token is enough per extension
+    const key = `${namespace}.${extension}`;
+    return tokens.get(key) ?? exchange(key, registry, namespace, extension, options);
+}
+/**
+ * Exchanges the ID token again after the registry refused the one this extension was publishing with.
+ * The issued token is short-lived and shared by every target platform of a release, so a slow fan-out
+ * can outlive it and be refused partway through.
+ *
+ * `stale` is the token that was refused. If the cache no longer holds it, another target has already
+ * replaced it and that exchange is awaited instead, so one expiry costs one exchange however many
+ * targets hit it at once.
+ */
+function refreshTrustedPublishingToken(registry, namespace, extension, options, stale) {
+    const key = `${namespace}.${extension}`;
+    const current = tokens.get(key);
+    if (current && issued.get(key) !== stale) {
+        return current;
+    }
+    return exchange(key, registry, namespace, extension, options);
+}
+function exchange(key, registry, namespace, extension, options) {
+    // Dropped up front, so a refresh that is still in flight does not look like the stale token to the
+    // next caller and start a second exchange of its own.
+    issued.delete(key);
+    const token = requestToken(registry, namespace, extension, options).then(value => {
+        issued.set(key, value);
+        return value;
+    });
+    tokens.set(key, token);
+    return token;
+}
+// The registry answers 503 when it could not reach the identity provider to check the token, as opposed
+// to checking it and refusing. That is worth another go: publishing runs unattended on CI, and a blip
+// reaching GitHub or GitLab should not fail a release build. A refusal is never retried.
+const RETRYABLE_STATUS = [502, 503, 504];
+const RETRY_DELAYS_MS = [1000, 4000];
+async function requestToken(registry, namespace, extension, options) {
+    const audience = options.oidcAudience ?? registry.url;
+    const idToken = await (0, oidc_1.getIdToken)(audience, options);
+    let result;
+    try {
+        result = await exchangeWithRetry(registry, namespace, extension, idToken);
+    }
+    catch (err) {
+        throw new Error(`${err.message}\n${registrationHint(registry, namespace, extension)}`);
+    }
+    if (result.error) {
+        throw new Error(`${result.error}\n${registrationHint(registry, namespace, extension)}`);
+    }
+    if (!result.value) {
+        throw new Error('The registry did not return a publishing token.');
+    }
+    const expires = result.expiresTimestamp ? `, expires at ${result.expiresTimestamp}` : '';
+    console.log(`\ud83d\udd10  Trusted publishing token issued for ${namespace}.${extension}${expires}`);
+    return result.value;
+}
+async function exchangeWithRetry(registry, namespace, extension, idToken) {
+    for (let attempt = 0;; attempt++) {
+        try {
+            return await registry.requestTrustedPublishingToken(namespace, extension, idToken);
+        }
+        catch (err) {
+            const status = err?.status;
+            if (attempt >= RETRY_DELAYS_MS.length || status === undefined || !RETRYABLE_STATUS.includes(status)) {
+                throw err;
+            }
+            const delay = RETRY_DELAYS_MS[attempt];
+            console.log(`The registry could not verify the token (${status}), retrying in ${delay / 1000}s`);
+            await new Promise(resolve => setTimeout(resolve, delay));
+        }
+    }
+}
+function registrationHint(registry, namespace, extension) {
+    return `Check the trusted publishers registered for '${namespace}.${extension}' at `
+        + `${registry.url}/user-settings/trusted-publishers.`;
+}
+//# sourceMappingURL=trusted-publishing.js.map

package/lib/trusted-publishing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-publishing.js","sourceRoot":"","sources":["../src/trusted-publishing.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;+EAW+E;;AAiB/E,oDAEC;AAMD,8DASC;AAWD,sEAcC;AAzDD,iCAAsD;AAKtD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;AAElD,yGAAyG;AACzG,gFAAgF;AAChF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEzC;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,OAAiC;IAClE,OAAO,OAAO,CAAC,iBAAiB,IAAI,IAAA,uBAAgB,EAAC,OAAO,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CACrC,QAAkB,EAClB,SAAiB,EACjB,SAAiB,EACjB,OAAiC;IAEjC,4FAA4F;IAC5F,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;IACxC,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,6BAA6B,CACzC,QAAkB,EAClB,SAAiB,EACjB,SAAiB,EACjB,OAAiC,EACjC,KAAa;IAEb,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,OAAO,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,QAAQ,CACb,GAAW,EACX,QAAkB,EAClB,SAAiB,EACjB,SAAiB,EACjB,OAAiC;IAEjC,mGAAmG;IACnG,sDAAsD;IACtD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAC7E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvB,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,wGAAwG;AACxG,sGAAsG;AACtG,yFAAyF;AACzF,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AACzC,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAErC,KAAK,UAAU,YAAY,CACvB,QAAkB,EAClB,SAAiB,EACjB,SAAiB,EACjB,OAAiC;IAEjC,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,IAAI,QAAQ,CAAC,GAAG,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,IAAA,iBAAU,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEpD,IAAI,MAAmB,CAAC;IACxB,IAAI,CAAC;QACD,MAAM,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,KAAK,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,KAAK,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,qDAAqD,SAAS,IAAI,SAAS,GAAG,OAAO,EAAE,CAAC,CAAC;IACrG,OAAO,MAAM,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC5B,QAAkB,EAClB,SAAiB,EACjB,SAAiB,EACjB,OAAe;IAEf,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC;YACD,OAAO,MAAM,QAAQ,CAAC,6BAA6B,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACvF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,MAAM,GAAI,GAAmB,EAAE,MAAM,CAAC;YAC5C,IAAI,OAAO,IAAI,eAAe,CAAC,MAAM,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClG,MAAM,GAAG,CAAC;YACd,CAAC;YACD,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,4CAA4C,MAAM,kBAAkB,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC;YACjG,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7D,CAAC;IACL,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB,EAAE,SAAiB,EAAE,SAAiB;IAC9E,OAAO,gDAAgD,SAAS,IAAI,SAAS,OAAO;UAC9E,GAAG,QAAQ,CAAC,GAAG,oCAAoC,CAAC;AAC9D,CAAC"}

package/lib/unpublish-options.d.ts

@@ -0,0 +1,34 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+import { RegistryOptions } from './registry-options';
+export interface UnpublishOptions extends RegistryOptions {
+    /**
+     * Identifier in the form `namespace.extension` or `namespace/extension`.
+     * Read from the `package.json` in the current directory if omitted.
+     */
+    extensionId?: string;
+    /**
+     * Versions to delete. All versions are deleted if omitted.
+     */
+    versions?: string[];
+    /**
+     * Target platforms to delete. All target platforms of the selected versions
+     * are deleted if omitted. Can only be used together with `versions`.
+     */
+    targets?: string[];
+    /**
+     * Delete without asking for confirmation.
+     */
+    force?: boolean;
+}
+//# sourceMappingURL=unpublish-options.d.ts.map

package/lib/unpublish-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unpublish-options.d.ts","sourceRoot":"","sources":["../src/unpublish-options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;+EAW+E;AAE/E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACrD;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACnB"}

package/lib/unpublish-options.js

@@ -0,0 +1,15 @@
+"use strict";
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=unpublish-options.js.map

package/lib/unpublish-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unpublish-options.js","sourceRoot":"","sources":["../src/unpublish-options.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;+EAW+E"}

package/lib/unpublish.d.ts

@@ -0,0 +1,22 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+import { UnpublishOptions } from './unpublish-options';
+/**
+ * Oldest registry version that exposes the `delete` endpoint used by this command.
+ */
+export declare const MIN_UNPUBLISH_REGISTRY_VERSION = "1.2.0";
+/**
+ * Deletes an extension or some of its versions from the registry.
+ */
+export declare function unpublish(options?: UnpublishOptions): Promise<void>;
+//# sourceMappingURL=unpublish.d.ts.map

package/lib/unpublish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unpublish.d.ts","sourceRoot":"","sources":["../src/unpublish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;+EAW+E;AAY/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGvD;;GAEG;AACH,eAAO,MAAM,8BAA8B,UAAU,CAAC;AAEtD;;GAEG;AACH,wBAAsB,SAAS,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2B7E"}

package/lib/unpublish.js

@@ -0,0 +1,137 @@
+"use strict";
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MIN_UNPUBLISH_REGISTRY_VERSION = void 0;
+exports.unpublish = unpublish;
+const prompts_1 = require("@inquirer/prompts");
+// `import * as isCI from 'is-ci'` would bind to a namespace object instead of the boolean `is-ci`
+// exports whenever the importer applies ES module interop (e.g. a bundler, or vitest's own
+// transform), making the truthiness check below always true. `import = require` always binds
+// directly to the exported value, regardless of how the importing tool handles interop.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const isCI = require("is-ci");
+const semver = require("semver");
+const pat_1 = require("./pat");
+const registry_1 = require("./registry");
+const util_1 = require("./util");
+/**
+ * Oldest registry version that exposes the `delete` endpoint used by this command.
+ */
+exports.MIN_UNPUBLISH_REGISTRY_VERSION = '1.2.0';
+/**
+ * Deletes an extension or some of its versions from the registry.
+ */
+async function unpublish(options = {}) {
+    (0, util_1.addEnvOptions)(options);
+    if (options.targets && !options.versions) {
+        throw new Error("Please specify the versions to delete with '--versions' when using '--target'.");
+    }
+    const extensionId = options.extensionId ?? await readExtensionId();
+    const match = (0, util_1.matchExtensionId)(extensionId);
+    if (!match) {
+        throw new Error('The extension identifier must have the form `namespace.extension` or `namespace/extension`.');
+    }
+    const [, namespace, extension] = match;
+    const registry = new registry_1.Registry(options);
+    await ensureUnpublishSupported(registry);
+    options.pat = await (0, pat_1.getPAT)(namespace, { ...options, namespace }, false);
+    const targetVersions = getTargetVersions(options);
+    await confirmUnpublish(`${namespace}.${extension}`, targetVersions, registry.url, options.force);
+    const result = await registry.deleteExtension(namespace, extension, targetVersions, options.pat);
+    if (result.error) {
+        throw new Error(result.error);
+    }
+    // the registry reports one line per deleted version, and nothing at all if there was nothing to delete
+    console.log(`🗑  ${result.success || `Nothing to delete for ${namespace}.${extension}`}`);
+}
+/**
+ * Reads the extension identifier from the `package.json` in the current directory,
+ * so that `ovsx unpublish` can be run from an extension folder without arguments.
+ */
+async function readExtensionId() {
+    let error;
+    try {
+        const manifest = await (0, util_1.readManifest)();
+        if (manifest.publisher && manifest.name) {
+            return `${manifest.publisher}.${manifest.name}`;
+        }
+    }
+    catch (e) {
+        error = e;
+    }
+    throw new Error('Unable to read the extension identifier. Please supply it as an argument or run ovsx from the extension folder.' +
+        (error ? `\n\n${error}` : ''));
+}
+/**
+ * Fails fast with an actionable message when the registry is known to be too old to support
+ * deleting extensions, rather than letting the delete request fail with a generic 404.
+ *
+ * The check is best-effort: registries that don't expose `/api/version` at all, or report a
+ * version that can't be parsed as semver (e.g. a build without `ovsx.registry.version` set),
+ * are assumed to support the endpoint. The delete request itself will surface any real
+ * incompatibility in that case.
+ */
+async function ensureUnpublishSupported(registry) {
+    let reportedVersion;
+    try {
+        reportedVersion = (await registry.getRegistryVersion()).version;
+    }
+    catch {
+        return;
+    }
+    // `coerce` drops any prerelease/build suffix (e.g. `1.2.0-dev.0` or `1.2.0-SNAPSHOT` both
+    // become `1.2.0`), so development builds of a supported release compare as supported too.
+    const version = semver.coerce(reportedVersion);
+    if (version && semver.lt(version, exports.MIN_UNPUBLISH_REGISTRY_VERSION)) {
+        throw new Error(`The registry at ${registry.url} runs version ${reportedVersion}, but deleting extensions requires `
+            + `version ${exports.MIN_UNPUBLISH_REGISTRY_VERSION} or later.`);
+    }
+}
+/**
+ * Returns the versions to delete, or `undefined` to delete the extension as a whole.
+ * A version without target platform tells the registry to delete all target platforms
+ * of that version.
+ */
+function getTargetVersions(options) {
+    if (!options.versions) {
+        return undefined;
+    }
+    if (!options.targets) {
+        return options.versions.map(version => ({ version }));
+    }
+    return options.versions.flatMap(version => options.targets.map(targetPlatform => ({ version, targetPlatform })));
+}
+async function confirmUnpublish(extensionId, targetVersions, registryUrl, force) {
+    if (force) {
+        return;
+    }
+    if (isCI || !process.stdin.isTTY) {
+        throw new Error("Aborted. Use '--force' to delete without confirmation.");
+    }
+    const what = targetVersions
+        ? targetVersions.map(target => describe(extensionId, target)).join(', ')
+        : `all versions of ${extensionId}`;
+    const confirmed = await (0, prompts_1.confirm)({
+        message: `Delete ${what} from ${registryUrl}? Deleted versions can never be published again.`,
+        default: false
+    });
+    if (!confirmed) {
+        throw new Error('Aborted.');
+    }
+}
+function describe(extensionId, target) {
+    const version = `${extensionId} v${target.version}`;
+    return target.targetPlatform ? `${version}@${target.targetPlatform}` : version;
+}
+//# sourceMappingURL=unpublish.js.map

package/lib/unpublish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unpublish.js","sourceRoot":"","sources":["../src/unpublish.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;+EAW+E;;;AAuB/E,8BA2BC;AAhDD,+CAA4C;AAC5C,kGAAkG;AAClG,2FAA2F;AAC3F,6FAA6F;AAC7F,wFAAwF;AACxF,iEAAiE;AACjE,8BAA+B;AAC/B,iCAAiC;AACjC,+BAA+B;AAC/B,yCAA6D;AAE7D,iCAAuE;AAEvE;;GAEG;AACU,QAAA,8BAA8B,GAAG,OAAO,CAAC;AAEtD;;GAEG;AACI,KAAK,UAAU,SAAS,CAAC,UAA4B,EAAE;IAC1D,IAAA,oBAAa,EAAC,OAAO,CAAC,CAAC;IACvB,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,MAAM,eAAe,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,IAAA,uBAAgB,EAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IACnH,CAAC;IAED,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,mBAAQ,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAEzC,OAAO,CAAC,GAAG,GAAG,MAAM,IAAA,YAAM,EAAC,SAAS,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC;IAExE,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,gBAAgB,CAAC,GAAG,SAAS,IAAI,SAAS,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAEjG,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACjG,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,uGAAuG;IACvG,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,OAAO,IAAI,yBAAyB,SAAS,IAAI,SAAS,EAAE,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe;IAC1B,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAA,mBAAY,GAAE,CAAC;QACtC,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtC,OAAO,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpD,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,KAAK,GAAG,CAAC,CAAC;IACd,CAAC;IAED,MAAM,IAAI,KAAK,CACX,iHAAiH;QACjH,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAChC,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,wBAAwB,CAAC,QAAkB;IACtD,IAAI,eAAmC,CAAC;IACxC,IAAI,CAAC;QACD,eAAe,GAAG,CAAC,MAAM,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACL,OAAO;IACX,CAAC;IAED,0FAA0F;IAC1F,0FAA0F;IAC1F,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC/C,IAAI,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,sCAA8B,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACX,mBAAmB,QAAQ,CAAC,GAAG,iBAAiB,eAAe,qCAAqC;cAClG,WAAW,sCAA8B,YAAY,CAC1D,CAAC;IACN,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAAyB;IAChD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,CAC3B,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CACnF,CAAC;AACN,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC3B,WAAmB,EACnB,cAAmD,EACnD,WAAmB,EACnB,KAAe;IAEf,IAAI,KAAK,EAAE,CAAC;QACR,OAAO;IACX,CAAC;IACD,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,GAAG,cAAc;QACvB,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACxE,CAAC,CAAC,mBAAmB,WAAW,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,MAAM,IAAA,iBAAO,EAAC;QAC5B,OAAO,EAAE,UAAU,IAAI,SAAS,WAAW,kDAAkD;QAC7F,OAAO,EAAE,KAAK;KACjB,CAAC,CAAC;IAEH,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,WAAmB,EAAE,MAA6B;IAChE,MAAM,OAAO,GAAG,GAAG,WAAW,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;IACpD,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACnF,CAAC"}

package/lib/util.d.ts

@@ -7,23 +7,65 @@
  *
  * SPDX-License-Identifier: EPL-2.0
  ********************************************************************************/
-import * as fs from 'fs';
-import * as tmp from 'tmp';
 import * as http from 'http';
 import { RegistryOptions } from './registry-options';
-export { promisify } from 'util';
+import { TrustedPublishingOptions } from './trusted-publishing-options';
 export declare function addEnvOptions(options: RegistryOptions): void;
+export declare function addTrustedPublishingEnvOptions(options: TrustedPublishingOptions): void;
+/** How long a request may make no progress before it is abandoned; see RegistryOptions.timeout. */
+export declare const DEFAULT_TIMEOUT = 30000;
+/**
+ * The configured request timeout, for requests that have no RegistryOptions to read it from - the CI
+ * token exchange deliberately shares nothing with the registry, but there is no reason for it to be
+ * on a different clock.
+ */
+export declare function configuredTimeout(): number;
+/**
+ * Parses a commander option that must be a non-negative whole number, so a typo is reported by the
+ * CLI rather than sent to the registry as a bad request.
+ */
+export declare function parseNonNegativeInt(value: string): number;
 export declare function matchExtensionId(id: string): RegExpExecArray | null;
-export declare function optionalStat(path: fs.PathLike): Promise<fs.Stats | undefined>;
-export declare function makeDirs(path: fs.PathLike): Promise<void>;
-export declare function createTempFile(options: tmp.TmpNameOptions): Promise<string>;
+/**
+ * Levenshtein distance between `a` and `b`: the minimum number of single-character insertions,
+ * deletions or substitutions needed to turn one into the other. Used to suggest the closest known
+ * command for a typo.
+ */
+export declare function levenshtein(a: string, b: string): number;
+/**
+ * Returns a random, not-yet-created file path ending in `postfix`, directly in the OS temp directory.
+ */
+export declare function getTempFilePath(postfix?: string): string;
 export declare function rejectError(err: any): Promise<never>;
 export declare function handleError(debug?: boolean, additionalMessage?: string, exit?: boolean): (reason: any) => void;
-export declare function statusError(response: http.IncomingMessage): Error;
-export declare function readFile(name: string, packagePath?: string, encoding?: BufferEncoding): Promise<string>;
+/**
+ * Formats a byte count for display, e.g. `1536` -> `1.5 KB`. Mirrors the registry's own
+ * `FileUtils.byteCountToDisplaySize` formatting so client- and server-side size limit messages read
+ * the same way.
+ */
+export declare function formatBytes(bytes: number): string;
+/**
+ * An error carrying the HTTP status that produced it, so a caller can tell "the registry refused this"
+ * from "the registry could not answer right now" without matching on the message.
+ */
+export interface StatusError extends Error {
+    status?: number;
+}
+export declare function withStatus(error: Error, status?: number): StatusError;
+/**
+ * A URL in the form it can safely be printed: no user info and no query string.
+ *
+ * The personal access token travels in a header now, but `createNamespace`, `verifyPat`, `publish`
+ * and `delete` still carry it in the query string too when talking to a registry too old to resolve
+ * it from the header (see `Registry.tokenQuery`, #1344). An error message goes straight to stderr
+ * and from there into CI logs, and the query carries nothing an error needs - so it stays dropped
+ * whole rather than filtered key by key, a filter having to be kept in step with every parameter
+ * anyone ever adds.
+ */
+export declare function redactUrl(url: URL | string): string;
+export declare function statusError(response: http.IncomingMessage): StatusError;
 export declare function readManifest(packagePath?: string): Promise<Manifest>;
 export declare function validateManifest(manifest: Manifest): void;
-export declare function writeFile(name: string, content: string, packagePath?: string, encoding?: BufferEncoding): Promise<void>;
 export declare function writeManifest(manifest: Manifest, packagePath?: string): Promise<void>;
 export interface Manifest {
     publisher: string;

package/lib/util.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA;;;;;;;;kFAQkF;AAElF,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAC3B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,wBAAgB,aAAa,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAK5D;AAED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAEnE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,KAAK,GAAG,SAAS,CAAC,CAI7E;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAazD;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAS3E;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,kBAGnC;AAED,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,OAAc,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,IAAI,CAmBpH;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,GAAG,KAAK,CAKjE;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAE,cAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAchH;AAED,wBAAsB,YAAY,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAG1E;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAUzD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAE,cAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAehI;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGrF;AAED,MAAM,WAAW,QAAQ;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB"}
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA;;;;;;;;kFAQkF;AAMlF,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,wBAAgB,aAAa,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAM5D;AAED,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAItF;AAED,mGAAmG;AACnG,eAAO,MAAM,eAAe,QAAS,CAAC;AAEtC;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAmBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMzD;AAED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAqBxD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,SAAK,GAAG,MAAM,CAEpD;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,kBAGnC;AAED,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,OAAc,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,IAAI,CAmBpH;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CASjD;AAED;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,KAAK;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,WAAW,CAIrE;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,MAAM,CAQnD;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,GAAG,WAAW,CAKvE;AAED,wBAAsB,YAAY,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAG1E;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAUzD;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGrF;AAED,MAAM,WAAW,QAAQ;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB"}