ovsx 1.1.1 → 1.3.0

package/lib/util.js

@@ -9,63 +9,110 @@
  * SPDX-License-Identifier: EPL-2.0
  ********************************************************************************/
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.promisify = void 0;
+exports.DEFAULT_TIMEOUT = void 0;
 exports.addEnvOptions = addEnvOptions;
+exports.addTrustedPublishingEnvOptions = addTrustedPublishingEnvOptions;
+exports.configuredTimeout = configuredTimeout;
+exports.parseNonNegativeInt = parseNonNegativeInt;
 exports.matchExtensionId = matchExtensionId;
-exports.optionalStat = optionalStat;
-exports.makeDirs = makeDirs;
-exports.createTempFile = createTempFile;
+exports.levenshtein = levenshtein;
+exports.getTempFilePath = getTempFilePath;
 exports.rejectError = rejectError;
 exports.handleError = handleError;
+exports.formatBytes = formatBytes;
+exports.withStatus = withStatus;
+exports.redactUrl = redactUrl;
 exports.statusError = statusError;
-exports.readFile = readFile;
 exports.readManifest = readManifest;
 exports.validateManifest = validateManifest;
-exports.writeFile = writeFile;
 exports.writeManifest = writeManifest;
+const crypto = require("crypto");
 const fs = require("fs");
+const os = require("os");
 const path = require("path");
-const tmp = require("tmp");
-var util_1 = require("util");
-Object.defineProperty(exports, "promisify", { enumerable: true, get: function () { return util_1.promisify; } });
 function addEnvOptions(options) {
     options.registryUrl ?? (options.registryUrl = process.env.OVSX_REGISTRY_URL);
     options.pat ?? (options.pat = process.env.OVSX_PAT);
     options.username ?? (options.username = process.env.OVSX_USERNAME);
     options.password ?? (options.password = process.env.OVSX_PASSWORD);
+    options.timeout ?? (options.timeout = parseIntEnv(process.env.OVSX_TIMEOUT));
+}
+function addTrustedPublishingEnvOptions(options) {
+    options.trustedPublishing ?? (options.trustedPublishing = parseBooleanEnv(process.env.OVSX_TRUSTED_PUBLISHING));
+    options.idToken ?? (options.idToken = process.env.OVSX_ID_TOKEN);
+    options.oidcAudience ?? (options.oidcAudience = process.env.OVSX_OIDC_AUDIENCE);
+}
+/** How long a request may make no progress before it is abandoned; see RegistryOptions.timeout. */
+exports.DEFAULT_TIMEOUT = 30000;
+/**
+ * The configured request timeout, for requests that have no RegistryOptions to read it from - the CI
+ * token exchange deliberately shares nothing with the registry, but there is no reason for it to be
+ * on a different clock.
+ */
+function configuredTimeout() {
+    return parseIntEnv(process.env.OVSX_TIMEOUT) ?? exports.DEFAULT_TIMEOUT;
+}
+function parseIntEnv(value) {
+    if (value === undefined || value.trim().length === 0) {
+        return undefined;
+    }
+    const parsed = Number(value.trim());
+    // Left undefined rather than throwing, so a mistyped variable falls back to the default instead
+    // of stopping a command that would otherwise work.
+    return Number.isInteger(parsed) && parsed >= 0 ? parsed : undefined;
+}
+function parseBooleanEnv(value) {
+    if (value === undefined || value.trim().length === 0) {
+        return undefined;
+    }
+    return ['true', '1', 'yes'].includes(value.trim().toLowerCase());
+}
+/**
+ * Parses a commander option that must be a non-negative whole number, so a typo is reported by the
+ * CLI rather than sent to the registry as a bad request.
+ */
+function parseNonNegativeInt(value) {
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 0) {
+        throw new Error(`Expected a non-negative whole number, got '${value}'.`);
+    }
+    return parsed;
 }
 function matchExtensionId(id) {
     return /^([\w-]+)(?:\.|\/)([\w-]+)$/.exec(id);
 }
-function optionalStat(path) {
-    return new Promise((resolve, reject) => {
-        fs.stat(path, (err, stats) => resolve(stats));
-    });
-}
-function makeDirs(path) {
-    return new Promise((resolve, reject) => {
-        if (fs.existsSync(path)) {
-            resolve();
-        }
-        else {
-            fs.mkdir(path, { recursive: true }, (err) => {
-                if (err)
-                    reject(err);
-                else
-                    resolve();
-            });
+/**
+ * Levenshtein distance between `a` and `b`: the minimum number of single-character insertions,
+ * deletions or substitutions needed to turn one into the other. Used to suggest the closest known
+ * command for a typo.
+ */
+function levenshtein(a, b) {
+    if (a === b) {
+        return 0;
+    }
+    // The distance is symmetric, so keep the shorter string in `b` to bound the row size.
+    if (b.length > a.length) {
+        [a, b] = [b, a];
+    }
+    // A single row of the edit distance matrix, seeded with the distance between the empty prefix
+    // of `a` and every prefix of `b`.
+    const row = Array.from({ length: b.length + 1 }, (_, j) => j);
+    for (let i = 1; i <= a.length; i++) {
+        let diagonal = row[0];
+        row[0] = i;
+        for (let j = 1; j <= b.length; j++) {
+            const above = row[j];
+            row[j] = Math.min(row[j - 1] + 1, above + 1, diagonal + (a[i - 1] === b[j - 1] ? 0 : 1));
+            diagonal = above;
         }
-    });
-}
-function createTempFile(options) {
-    return new Promise((resolve, reject) => {
-        tmp.tmpName(options, (err, name) => {
-            if (err)
-                reject(err);
-            else
-                resolve(name);
-        });
-    });
+    }
+    return row[b.length];
+}
+/**
+ * Returns a random, not-yet-created file path ending in `postfix`, directly in the OS temp directory.
+ */
+function getTempFilePath(postfix = '') {
+    return path.join(os.tmpdir(), `ovsx-${crypto.randomUUID()}${postfix}`);
 }
 function rejectError(err) {
     const reason = err instanceof Error ? err : new Error(String(err));
@@ -93,26 +140,54 @@ function handleError(debug, additionalMessage, exit = true) {
         }
     };
 }
+/**
+ * Formats a byte count for display, e.g. `1536` -> `1.5 KB`. Mirrors the registry's own
+ * `FileUtils.byteCountToDisplaySize` formatting so client- and server-side size limit messages read
+ * the same way.
+ */
+function formatBytes(bytes) {
+    const units = ['bytes', 'KB', 'MB', 'GB', 'TB', 'PB', 'EB'];
+    let size = bytes;
+    let unit = 0;
+    while (size >= 1024 && unit < units.length - 1) {
+        size /= 1024;
+        unit++;
+    }
+    return `${Math.floor(size)} ${units[unit]}`;
+}
+function withStatus(error, status) {
+    const withStatusCode = error;
+    withStatusCode.status = status;
+    return withStatusCode;
+}
+/**
+ * A URL in the form it can safely be printed: no user info and no query string.
+ *
+ * The personal access token travels in a header now, but `createNamespace`, `verifyPat`, `publish`
+ * and `delete` still carry it in the query string too when talking to a registry too old to resolve
+ * it from the header (see `Registry.tokenQuery`, #1344). An error message goes straight to stderr
+ * and from there into CI logs, and the query carries nothing an error needs - so it stays dropped
+ * whole rather than filtered key by key, a filter having to be kept in step with every parameter
+ * anyone ever adds.
+ */
+function redactUrl(url) {
+    try {
+        const parsed = typeof url === 'string' ? new URL(url) : url;
+        return `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
+    }
+    catch {
+        // Not parseable, so nothing can be assumed about what it holds.
+        return '<url>';
+    }
+}
 function statusError(response) {
-    if (response.statusMessage)
-        return new Error(`The server responded with status ${response.statusCode}: ${response.statusMessage}`);
-    else
-        return new Error(`The server responded with status ${response.statusCode}.`);
-}
-function readFile(name, packagePath, encoding = 'utf-8') {
-    return new Promise((resolve, reject) => {
-        fs.readFile(path.join(packagePath ?? process.cwd(), name), { encoding }, (err, content) => {
-            if (err) {
-                reject(err);
-            }
-            else {
-                resolve(content);
-            }
-        });
-    });
+    const message = response.statusMessage
+        ? `The server responded with status ${response.statusCode}: ${response.statusMessage}`
+        : `The server responded with status ${response.statusCode}.`;
+    return withStatus(new Error(message), response.statusCode);
 }
 async function readManifest(packagePath) {
-    const content = await readFile('package.json', packagePath);
+    const content = await fs.promises.readFile(path.join(packagePath ?? process.cwd(), 'package.json'), 'utf-8');
     return JSON.parse(content);
 }
 function validateManifest(manifest) {
@@ -126,20 +201,8 @@ function validateManifest(manifest) {
         throw new Error("Missing required field 'version'.");
     }
 }
-function writeFile(name, content, packagePath, encoding = 'utf-8') {
-    return new Promise((resolve, reject) => {
-        fs.writeFile(path.join(packagePath ?? process.cwd(), name), content, { encoding }, (err) => {
-            if (err) {
-                reject(err);
-            }
-            else {
-                resolve();
-            }
-        });
-    });
-}
 function writeManifest(manifest, packagePath) {
     const content = JSON.stringify(manifest, null, 4);
-    return writeFile('package.json', content, packagePath);
+    return fs.promises.writeFile(path.join(packagePath ?? process.cwd(), 'package.json'), content, 'utf-8');
 }
 //# sourceMappingURL=util.js.map

package/lib/util.js.map

@@ -1 +1 @@
-{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":";AAAA;;;;;;;;kFAQkF;;;AAUlF,sCAKC;AAED,4CAEC;AAED,oCAIC;AAED,4BAaC;AAED,wCASC;AAED,kCAGC;AAED,kCAmBC;AAED,kCAKC;AAED,4BAcC;AAED,oCAGC;AAED,4CAUC;AAED,8BAeC;AAED,sCAGC;AAzID,yBAAyB;AACzB,6BAA6B;AAC7B,2BAA2B;AAI3B,6BAAiC;AAAxB,iGAAA,SAAS,OAAA;AAElB,SAAgB,aAAa,CAAC,OAAwB;IAClD,OAAO,CAAC,WAAW,KAAnB,OAAO,CAAC,WAAW,GAAK,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAC;IACtD,OAAO,CAAC,GAAG,KAAX,OAAO,CAAC,GAAG,GAAK,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAC;IACrC,OAAO,CAAC,QAAQ,KAAhB,OAAO,CAAC,QAAQ,GAAK,OAAO,CAAC,GAAG,CAAC,aAAa,EAAC;IAC/C,OAAO,CAAC,QAAQ,KAAhB,OAAO,CAAC,QAAQ,GAAK,OAAO,CAAC,GAAG,CAAC,aAAa,EAAC;AACnD,CAAC;AAED,SAAgB,gBAAgB,CAAC,EAAU;IACvC,OAAO,6BAA6B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,SAAgB,YAAY,CAAC,IAAiB;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAgB,QAAQ,CAAC,IAAiB;IACtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,CAAC;QACd,CAAC;aAAM,CAAC;YACJ,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,GAAiC,EAAE,EAAE;gBACtE,IAAI,GAAG;oBACH,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAEZ,OAAO,EAAE,CAAC;YAClB,CAAC,CAAC,CAAC;QACP,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAgB,cAAc,CAAC,OAA2B;IACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAiB,EAAE,IAAY,EAAE,EAAE;YACrD,IAAI,GAAG;gBACH,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAEZ,OAAO,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAgB,WAAW,CAAC,GAAQ;IAChC,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,SAAgB,WAAW,CAAC,KAAe,EAAE,iBAA0B,EAAE,OAAgB,IAAI;IACzF,OAAO,MAAM,CAAC,EAAE;QACZ,IAAI,MAAM,YAAY,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,WAAW,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3C,IAAI,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACrC,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC;aAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,IAAI,EAAE,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC,CAAC;AACN,CAAC;AAED,SAAgB,WAAW,CAAC,QAA8B;IACtD,IAAI,QAAQ,CAAC,aAAa;QACtB,OAAO,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;;QAEvG,OAAO,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC;AACrF,CAAC;AAED,SAAgB,QAAQ,CAAC,IAAY,EAAE,WAAoB,EAAE,WAA2B,OAAO;IAC3F,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,EAAE,CAAC,QAAQ,CACP,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,EAC7C,EAAE,QAAQ,EAAE,EACZ,CAAC,GAAiC,EAAE,OAAe,EAAE,EAAE;YACnD,IAAI,GAAG,EAAE,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACJ,OAAO,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;QACL,CAAC,CACJ,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,WAAoB;IACnD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,SAAgB,gBAAgB,CAAC,QAAkB;IAC/C,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACzD,CAAC;AACL,CAAC;AAED,SAAgB,SAAS,CAAC,IAAY,EAAE,OAAe,EAAE,WAAoB,EAAE,WAA2B,OAAO;IAC7G,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,EAAE,CAAC,SAAS,CACR,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,EAC7C,OAAO,EACP,EAAE,QAAQ,EAAE,EACZ,CAAC,GAAiC,EAAE,EAAE;YAClC,IAAI,GAAG,EAAE,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACJ,OAAO,EAAE,CAAC;YACd,CAAC;QACL,CAAC,CACJ,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAgB,aAAa,CAAC,QAAkB,EAAE,WAAoB;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAClD,OAAO,SAAS,CAAC,cAAc,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":";AAAA;;;;;;;;kFAQkF;;;AAUlF,sCAMC;AAED,wEAIC;AAUD,8CAEC;AAuBD,kDAMC;AAED,4CAEC;AAOD,kCAqBC;AAKD,0CAEC;AAED,kCAGC;AAED,kCAmBC;AAOD,kCASC;AAUD,gCAIC;AAYD,8BAQC;AAED,kCAKC;AAED,oCAGC;AAED,4CAUC;AAED,sCAGC;AA7MD,iCAAiC;AACjC,yBAAyB;AACzB,yBAAyB;AACzB,6BAA6B;AAK7B,SAAgB,aAAa,CAAC,OAAwB;IAClD,OAAO,CAAC,WAAW,KAAnB,OAAO,CAAC,WAAW,GAAK,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAC;IACtD,OAAO,CAAC,GAAG,KAAX,OAAO,CAAC,GAAG,GAAK,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAC;IACrC,OAAO,CAAC,QAAQ,KAAhB,OAAO,CAAC,QAAQ,GAAK,OAAO,CAAC,GAAG,CAAC,aAAa,EAAC;IAC/C,OAAO,CAAC,QAAQ,KAAhB,OAAO,CAAC,QAAQ,GAAK,OAAO,CAAC,GAAG,CAAC,aAAa,EAAC;IAC/C,OAAO,CAAC,OAAO,KAAf,OAAO,CAAC,OAAO,GAAK,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAC;AAC9D,CAAC;AAED,SAAgB,8BAA8B,CAAC,OAAiC;IAC5E,OAAO,CAAC,iBAAiB,KAAzB,OAAO,CAAC,iBAAiB,GAAK,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAC;IACnF,OAAO,CAAC,OAAO,KAAf,OAAO,CAAC,OAAO,GAAK,OAAO,CAAC,GAAG,CAAC,aAAa,EAAC;IAC9C,OAAO,CAAC,YAAY,KAApB,OAAO,CAAC,YAAY,GAAK,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAC;AAC5D,CAAC;AAED,mGAAmG;AACtF,QAAA,eAAe,GAAG,KAAM,CAAC;AAEtC;;;;GAIG;AACH,SAAgB,iBAAiB;IAC7B,OAAO,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,uBAAe,CAAC;AACpE,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,gGAAgG;IAChG,mDAAmD;IACnD,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,KAAa;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,8CAA8C,KAAK,IAAI,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAgB,gBAAgB,CAAC,EAAU;IACvC,OAAO,6BAA6B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,CAAS,EAAE,CAAS;IAC5C,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC;IACb,CAAC;IACD,sFAAsF;IACtF,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QACtB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,8FAA8F;IAC9F,kCAAkC;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,IAAI,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACtB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACrB,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzF,QAAQ,GAAG,KAAK,CAAC;QACrB,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,OAAO,GAAG,EAAE;IACxC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,MAAM,CAAC,UAAU,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,SAAgB,WAAW,CAAC,GAAQ;IAChC,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,SAAgB,WAAW,CAAC,KAAe,EAAE,iBAA0B,EAAE,OAAgB,IAAI;IACzF,OAAO,MAAM,CAAC,EAAE;QACZ,IAAI,MAAM,YAAY,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,WAAW,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3C,IAAI,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACrC,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC;aAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,IAAI,EAAE,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,IAAI,IAAI,IAAI,CAAC;QACb,IAAI,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;AAChD,CAAC;AAUD,SAAgB,UAAU,CAAC,KAAY,EAAE,MAAe;IACpD,MAAM,cAAc,GAAG,KAAoB,CAAC;IAC5C,cAAc,CAAC,MAAM,GAAG,MAAM,CAAC;IAC/B,OAAO,cAAc,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,SAAS,CAAC,GAAiB;IACvC,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5D,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACL,gEAAgE;QAChE,OAAO,OAAO,CAAC;IACnB,CAAC;AACL,CAAC;AAED,SAAgB,WAAW,CAAC,QAA8B;IACtD,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa;QAClC,CAAC,CAAC,oCAAoC,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,aAAa,EAAE;QACtF,CAAC,CAAC,oCAAoC,QAAQ,CAAC,UAAU,GAAG,CAAC;IACjE,OAAO,UAAU,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC/D,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,WAAoB;IACnD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7G,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,SAAgB,gBAAgB,CAAC,QAAkB;IAC/C,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACzD,CAAC;AACL,CAAC;AAED,SAAgB,aAAa,CAAC,QAAkB,EAAE,WAAoB;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAClD,OAAO,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5G,CAAC"}

package/lib/verify-options.d.ts

@@ -0,0 +1,24 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+import { RegistryOptions } from './registry-options';
+export interface VerifyOptions extends RegistryOptions {
+    /**
+     * Path to the downloaded .vsix package to verify.
+     */
+    packagePath: string;
+    /**
+     * Target platform. Defaults to universal.
+     */
+    target?: string;
+}
+//# sourceMappingURL=verify-options.d.ts.map

package/lib/verify-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-options.d.ts","sourceRoot":"","sources":["../src/verify-options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;+EAW+E;AAE/E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,WAAW,aAAc,SAAQ,eAAe;IAClD;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB"}

package/lib/verify-options.js

@@ -0,0 +1,15 @@
+"use strict";
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=verify-options.js.map

package/lib/verify-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-options.js","sourceRoot":"","sources":["../src/verify-options.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;+EAW+E"}

package/lib/verify-signature-options.d.ts

@@ -0,0 +1,32 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+export interface VerifySignatureOptions {
+    /**
+     * Path to the .vsix package.
+     */
+    packagePath: string;
+    /**
+     * Path to the signature manifest file (the `.signature.manifest` entry of a registry's
+     * signature archive).
+     */
+    manifestPath: string;
+    /**
+     * Path to the signature file (the `.signature.sig` entry of a registry's signature archive).
+     */
+    signaturePath: string;
+    /**
+     * Path to the registry's public key file, in PEM format.
+     */
+    publicKeyPath: string;
+}
+//# sourceMappingURL=verify-signature-options.d.ts.map

package/lib/verify-signature-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-signature-options.d.ts","sourceRoot":"","sources":["../src/verify-signature-options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;+EAW+E;AAE/E,MAAM,WAAW,sBAAsB;IACnC;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;CACzB"}

package/lib/verify-signature-options.js

@@ -0,0 +1,15 @@
+"use strict";
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=verify-signature-options.js.map

package/lib/verify-signature-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-signature-options.js","sourceRoot":"","sources":["../src/verify-signature-options.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;+EAW+E"}

package/lib/verify-signature.d.ts

@@ -0,0 +1,28 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+import { VerifySignatureOptions } from './verify-signature-options';
+/**
+ * Verifies a package/manifest/signature file trio entirely offline, the same way `vsce
+ * verify-signature` does - no registry involved, every input is a local file. Unlike `verify`,
+ * which fetches everything it needs from a registry for a package identified by name, this is for
+ * a signature archive you already extracted yourself (e.g. the `.sigzip` a registry serves has a
+ * `.signature.sig` and a `.signature.manifest` entry, matching `--signaturePath` and
+ * `--manifestPath` here).
+ *
+ * `vsce verify-signature` validates against Microsoft's own (closed-source) signing scheme and
+ * has no need for a public key argument - VS Code's Marketplace keys are baked into its verifier.
+ * Open VSX's registries each hold their own Ed25519 key pair instead, so `--publicKeyPath` is
+ * required here to say which registry's signature this is supposed to be.
+ */
+export declare function verifySignature(options: VerifySignatureOptions): Promise<void>;
+//# sourceMappingURL=verify-signature.d.ts.map

package/lib/verify-signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-signature.d.ts","sourceRoot":"","sources":["../src/verify-signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;+EAW+E;AAK/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAYpE;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BpF"}

package/lib/verify-signature.js

@@ -0,0 +1,105 @@
+"use strict";
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifySignature = verifySignature;
+const crypto = require("crypto");
+const fs = require("fs");
+const zip_1 = require("./zip");
+/**
+ * Verifies a package/manifest/signature file trio entirely offline, the same way `vsce
+ * verify-signature` does - no registry involved, every input is a local file. Unlike `verify`,
+ * which fetches everything it needs from a registry for a package identified by name, this is for
+ * a signature archive you already extracted yourself (e.g. the `.sigzip` a registry serves has a
+ * `.signature.sig` and a `.signature.manifest` entry, matching `--signaturePath` and
+ * `--manifestPath` here).
+ *
+ * `vsce verify-signature` validates against Microsoft's own (closed-source) signing scheme and
+ * has no need for a public key argument - VS Code's Marketplace keys are baked into its verifier.
+ * Open VSX's registries each hold their own Ed25519 key pair instead, so `--publicKeyPath` is
+ * required here to say which registry's signature this is supposed to be.
+ */
+async function verifySignature(options) {
+    const [packageBytes, manifestJson, signature, publicKeyPem] = await Promise.all([
+        fs.promises.readFile(options.packagePath),
+        fs.promises.readFile(options.manifestPath, 'utf-8'),
+        fs.promises.readFile(options.signaturePath),
+        fs.promises.readFile(options.publicKeyPath, 'utf-8')
+    ]);
+    let manifest;
+    try {
+        manifest = JSON.parse(manifestJson);
+    }
+    catch (err) {
+        throw new Error(`Failed to parse the manifest file as JSON: ${err instanceof Error ? err.message : err}`);
+    }
+    const publicKey = crypto.createPublicKey({ key: publicKeyPem, format: 'pem' });
+    const signatureValid = crypto.verify(null, packageBytes, publicKey, signature);
+    if (!signatureValid) {
+        throw new Error('Signature verification failed. The package may have been tampered with.');
+    }
+    const manifestIssues = await checkManifest(options.packagePath, packageBytes, manifest);
+    if (manifestIssues.length > 0) {
+        throw new Error('The signature is valid, but the package does not match the manifest:\n'
+            + manifestIssues.map(issue => `  - ${issue}`).join('\n'));
+    }
+    console.log('✅  Signature is valid.');
+}
+function sha256Base64(content) {
+    return crypto.createHash('sha256').update(content).digest('base64');
+}
+/**
+ * The manifest itself isn't part of what the signature covers - only the raw package bytes are
+ * signed - so this can't add cryptographic trust on its own. It does confirm the manifest wasn't
+ * corrupted or is stale relative to the actual package, and unlike the signature check alone, can
+ * point at exactly which entry doesn't match.
+ */
+async function checkManifest(packagePath, packageBytes, manifest) {
+    const issues = [];
+    const packageDigest = manifest.package?.digests?.sha256;
+    if (packageDigest === undefined) {
+        issues.push('the manifest does not record a package digest');
+    }
+    else if (packageDigest !== sha256Base64(packageBytes)) {
+        issues.push('the package digest does not match the manifest');
+    }
+    const manifestEntries = manifest.entries ?? {};
+    const seenKeys = new Set();
+    // Streamed straight into a digest one entry at a time, rather than buffering every entry's
+    // full content into memory alongside the already-loaded package bytes.
+    const packageEntryDigests = await (0, zip_1.hashAllZipEntries)(packagePath);
+    for (const [name, actualDigest] of packageEntryDigests) {
+        const key = Buffer.from(name, 'utf-8').toString('base64');
+        seenKeys.add(key);
+        const entry = manifestEntries[key];
+        if (!entry) {
+            issues.push(`'${name}' is present in the package but missing from the manifest`);
+            continue;
+        }
+        const entryDigest = entry.digests?.sha256;
+        if (entryDigest === undefined) {
+            issues.push(`'${name}' has no recorded digest in the manifest`);
+        }
+        else if (entryDigest !== actualDigest) {
+            issues.push(`'${name}' does not match its digest in the manifest`);
+        }
+    }
+    for (const key of Object.keys(manifestEntries)) {
+        if (!seenKeys.has(key)) {
+            const name = Buffer.from(key, 'base64').toString('utf-8');
+            issues.push(`'${name}' is listed in the manifest but missing from the package`);
+        }
+    }
+    return issues;
+}
+//# sourceMappingURL=verify-signature.js.map

package/lib/verify-signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-signature.js","sourceRoot":"","sources":["../src/verify-signature.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;+EAW+E;;AA8B/E,0CA8BC;AA1DD,iCAAiC;AACjC,yBAAyB;AACzB,+BAA0C;AAa1C;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,eAAe,CAAC,OAA+B;IACjE,MAAM,CAAC,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC5E,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;QACzC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC;QACnD,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3C,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC;KACvD,CAAC,CAAC;IAEH,IAAI,QAA2B,CAAC;IAChC,IAAI,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,8CAA8C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9G,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC/E,IAAI,CAAC,cAAc,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IACxF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACX,wEAAwE;cACtE,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3D,CAAC;IACN,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACjC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAAC,WAAmB,EAAE,YAAoB,EAAE,QAA2B;IAC/F,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;IACxD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IACjE,CAAC;SAAM,IAAI,aAAa,KAAK,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,2FAA2F;IAC3F,uEAAuE;IACvE,MAAM,mBAAmB,GAAG,MAAM,IAAA,uBAAiB,EAAC,WAAW,CAAC,CAAC;IACjE,KAAK,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1D,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,2DAA2D,CAAC,CAAC;YACjF,SAAS;QACb,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;QAC1C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,0CAA0C,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,6CAA6C,CAAC,CAAC;QACvE,CAAC;IACL,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,0DAA0D,CAAC,CAAC;QACpF,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/lib/verify.d.ts

@@ -0,0 +1,21 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+import { VerifyOptions } from './verify-options';
+/**
+ * Verifies a downloaded .vsix package's signature against the registry's public key, the same way
+ * VS Code itself verifies signed packages on install. Mirrors `vsce verify-signature`, except the
+ * signature and public key are fetched from the registry instead of being passed in as separate
+ * files - the registry already exposes both for any published, signed version.
+ */
+export declare function verify(options: VerifyOptions): Promise<void>;
+//# sourceMappingURL=verify.d.ts.map

package/lib/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;+EAW+E;AAO/E,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAIjD;;;;;GAKG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAsClE"}

package/lib/verify.js

@@ -0,0 +1,97 @@
+"use strict";
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verify = verify;
+const crypto = require("crypto");
+const fs = require("fs");
+const registry_1 = require("./registry");
+const util_1 = require("./util");
+const zip_1 = require("./zip");
+const SIGNATURE_ENTRY = '.signature.sig';
+/**
+ * Verifies a downloaded .vsix package's signature against the registry's public key, the same way
+ * VS Code itself verifies signed packages on install. Mirrors `vsce verify-signature`, except the
+ * signature and public key are fetched from the registry instead of being passed in as separate
+ * files - the registry already exposes both for any published, signed version.
+ */
+async function verify(options) {
+    (0, util_1.addEnvOptions)(options);
+    const registry = new registry_1.Registry(options);
+    const manifest = await (0, zip_1.readVSIXPackage)(options.packagePath);
+    const namespace = manifest.publisher;
+    const extensionName = manifest.name;
+    const latest = await registry.getMetadata(namespace, extensionName, options.target);
+    if (latest.error) {
+        throw new Error(latest.error);
+    }
+    const extension = await resolveVersion(registry, latest, manifest.version);
+    const description = `${namespace}.${extensionName} v${extension.version}`;
+    const signatureUrl = extension.files.signature;
+    const publicKeyUrl = extension.files.publicKey;
+    if (!signatureUrl || !publicKeyUrl) {
+        throw new Error(`${description} is not signed by the registry - there is nothing to verify.`);
+    }
+    const [signature, publicKeyPem] = await Promise.all([
+        downloadSignature(registry, signatureUrl),
+        downloadPublicKey(registry, publicKeyUrl)
+    ]);
+    const packageBytes = await fs.promises.readFile(options.packagePath);
+    const publicKey = crypto.createPublicKey({ key: publicKeyPem, format: 'pem' });
+    const verified = crypto.verify(null, packageBytes, publicKey, signature);
+    if (!verified) {
+        throw new Error(`${description} does not match the version published to ${registry.url}. `
+            + 'The package may have been tampered with, or did not come from that registry.');
+    }
+    console.log(`✅  This package is identical to ${description} as published to ${registry.url}.`);
+}
+/**
+ * `registry.getMetadata` always returns the latest version. Follow `allVersions` to the exact
+ * version recorded in the package's own manifest when it differs.
+ */
+async function resolveVersion(registry, extension, version) {
+    if (extension.version === version) {
+        return extension;
+    }
+    const versionUrl = extension.allVersions[version];
+    if (!versionUrl) {
+        throw new Error(`${extension.namespace}.${extension.name} has no published version '${version}'.`);
+    }
+    return registry.getJson(new URL(versionUrl));
+}
+async function downloadSignature(registry, url) {
+    const sigzipPath = (0, util_1.getTempFilePath)('.sigzip');
+    try {
+        await registry.download(sigzipPath, new URL(url));
+        const entries = await (0, zip_1.readZip)(sigzipPath, name => name === SIGNATURE_ENTRY);
+        const signature = entries.get(SIGNATURE_ENTRY);
+        if (!signature) {
+            throw new Error(`The signature archive does not contain a '${SIGNATURE_ENTRY}' entry.`);
+        }
+        return signature;
+    }
+    finally {
+        await fs.promises.rm(sigzipPath, { force: true });
+    }
+}
+async function downloadPublicKey(registry, url) {
+    const publicKeyPath = (0, util_1.getTempFilePath)('.pem');
+    try {
+        await registry.download(publicKeyPath, new URL(url));
+        return await fs.promises.readFile(publicKeyPath, 'utf-8');
+    }
+    finally {
+        await fs.promises.rm(publicKeyPath, { force: true });
+    }
+}
+//# sourceMappingURL=verify.js.map