ovsx 1.1.1 → 1.3.0

package/lib/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;+EAW+E;;AAiB/E,wBAsCC;AArDD,iCAAiC;AACjC,yBAAyB;AACzB,yCAAiD;AACjD,iCAAwD;AACxD,+BAAiD;AAGjD,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEzC;;;;;GAKG;AACI,KAAK,UAAU,MAAM,CAAC,OAAsB;IAC/C,IAAA,oBAAa,EAAC,OAAO,CAAC,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,mBAAQ,CAAC,OAAO,CAAC,CAAC;IAEvC,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAe,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACrC,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC;IAEpC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACpF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,GAAG,SAAS,IAAI,aAAa,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;IAE1E,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;IAC/C,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;IAC/C,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,8DAA8D,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,iBAAiB,CAAC,QAAQ,EAAE,YAAY,CAAC;QACzC,iBAAiB,CAAC,QAAQ,EAAE,YAAY,CAAC;KAC5C,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAEzE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACX,GAAG,WAAW,4CAA4C,QAAQ,CAAC,GAAG,IAAI;cACxE,8EAA8E,CACnF,CAAC;IACN,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,mCAAmC,WAAW,oBAAoB,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC;AACnG,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAAC,QAAkB,EAAE,SAAoB,EAAE,OAAe;IACnF,IAAI,SAAS,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,UAAU,GAAG,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,8BAA8B,OAAO,IAAI,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,QAAkB,EAAE,GAAW;IAC5D,MAAM,UAAU,GAAG,IAAA,sBAAe,EAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC;QACD,MAAM,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,IAAA,aAAO,EAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,6CAA6C,eAAe,UAAU,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;YAAS,CAAC;QACP,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,QAAkB,EAAE,GAAW;IAC5D,MAAM,aAAa,GAAG,IAAA,sBAAe,EAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC;QACD,MAAM,QAAQ,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACP,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;AACL,CAAC"}

package/lib/zip.d.ts

@@ -1,3 +1,13 @@
 import { Manifest } from './util';
+export declare function readZip(packagePath: string, filter: (name: string) => boolean): Promise<Map<string, Buffer>>;
+/**
+ * Computes the SHA256 digest of every non-directory entry of a zip file, keyed by its exact
+ * (case-preserving) name - unlike {@link readZip}, which lowercases names for its
+ * case-insensitive-filter callers. Used where entry names and digests are compared against another
+ * source of truth, such as a signature manifest that records the original names, without also
+ * having to hold every entry's full content in memory at once alongside it - each entry's content
+ * is streamed straight into a hash and discarded, one entry at a time.
+ */
+export declare function hashAllZipEntries(packagePath: string): Promise<Map<string, string>>;
 export declare function readVSIXPackage(packagePath: string): Promise<Manifest>;
 //# sourceMappingURL=zip.d.ts.map

package/lib/zip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zip.d.ts","sourceRoot":"","sources":["../src/zip.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AA8BlC,wBAAsB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAQ5E"}
+{"version":3,"file":"zip.d.ts","sourceRoot":"","sources":["../src/zip.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAElC,wBAAsB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAgBlH;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAkBzF;AAED,wBAAsB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAQ5E"}

package/lib/zip.js

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.readZip = readZip;
+exports.hashAllZipEntries = hashAllZipEntries;
 exports.readVSIXPackage = readVSIXPackage;
 /********************************************************************************
  * Copyright (c) 2024 Precies. Software and others
@@ -10,15 +12,10 @@ exports.readVSIXPackage = readVSIXPackage;
  *
  * SPDX-License-Identifier: EPL-2.0
  ********************************************************************************/
+const crypto = require("crypto");
 const yauzl = require("yauzl-promise");
-async function bufferStream(stream) {
-    return await new Promise((resolve, reject) => {
-        const buffers = [];
-        stream.on('data', buffer => buffers.push(buffer));
-        stream.once('error', reject);
-        stream.once('end', () => resolve(Buffer.concat(buffers)));
-    });
-}
+const consumers_1 = require("stream/consumers");
+const promises_1 = require("stream/promises");
 async function readZip(packagePath, filter) {
     const result = new Map();
     const zipfile = await yauzl.open(packagePath);
@@ -27,9 +24,35 @@ async function readZip(packagePath, filter) {
             const name = entry.filename.toLowerCase();
             if (filter(name)) {
                 const stream = await zipfile.openReadStream(entry);
-                const buffer = await bufferStream(stream);
-                result.set(name, buffer);
+                result.set(name, await (0, consumers_1.buffer)(stream));
+            }
+        }
+    }
+    finally {
+        await zipfile.close();
+    }
+    return result;
+}
+/**
+ * Computes the SHA256 digest of every non-directory entry of a zip file, keyed by its exact
+ * (case-preserving) name - unlike {@link readZip}, which lowercases names for its
+ * case-insensitive-filter callers. Used where entry names and digests are compared against another
+ * source of truth, such as a signature manifest that records the original names, without also
+ * having to hold every entry's full content in memory at once alongside it - each entry's content
+ * is streamed straight into a hash and discarded, one entry at a time.
+ */
+async function hashAllZipEntries(packagePath) {
+    const result = new Map();
+    const zipfile = await yauzl.open(packagePath);
+    try {
+        for await (const entry of zipfile) {
+            if (entry.filename.endsWith('/')) {
+                continue;
             }
+            const stream = await zipfile.openReadStream(entry);
+            const hash = crypto.createHash('sha256');
+            await (0, promises_1.pipeline)(stream, hash);
+            result.set(entry.filename, hash.digest('base64'));
         }
     }
     finally {

package/lib/zip.js.map

@@ -1 +1 @@
-{"version":3,"file":"zip.js","sourceRoot":"","sources":["../src/zip.ts"],"names":[],"mappings":";;AAyCA,0CAQC;AAjDD;;;;;;;;kFAQkF;AAClF,uCAAuC;AAIvC,KAAK,UAAU,YAAY,CAAC,MAAgB;IAC3C,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,WAAmB,EAAE,MAAiC;IAC5E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,CAAC;QACJ,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1C,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;gBACnD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC1B,CAAC;QACF,CAAC;IACF,CAAC;YAAS,CAAC;QACV,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,WAAmB;IACxD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzF,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACtD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAa,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"zip.js","sourceRoot":"","sources":["../src/zip.ts"],"names":[],"mappings":";;AAeA,0BAgBC;AAUD,8CAkBC;AAED,0CAQC;AArED;;;;;;;;kFAQkF;AAClF,iCAAiC;AACjC,uCAAuC;AACvC,gDAA0C;AAC1C,8CAA2C;AAGpC,KAAK,UAAU,OAAO,CAAC,WAAmB,EAAE,MAAiC;IACnF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,CAAC;QACJ,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1C,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;gBACnD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,IAAA,kBAAM,EAAC,MAAM,CAAC,CAAC,CAAC;YACxC,CAAC;QACF,CAAC;IACF,CAAC;YAAS,CAAC;QACV,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,iBAAiB,CAAC,WAAmB;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,CAAC;QACJ,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YACnC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,SAAS;YACV,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,IAAA,mBAAQ,EAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnD,CAAC;IACF,CAAC;YAAS,CAAC;QACV,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,WAAmB;IACxD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzF,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACtD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAa,CAAC;AAC7D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "ovsx",
-    "version": "1.1.1",
+    "version": "1.3.0",
     "description": "Command line interface for Eclipse Open VSX",
     "keywords": [
         "cli",
@@ -21,6 +21,14 @@
             "name": "Miro Spönemann",
             "email": "miro.spoenemann@typefox.io",
             "url": "https://www.typefox.io"
+        },
+        {
+            "name": "Thomas Neidhart",
+            "email": "thomas.neidhart@eclipse-foundation.org"
+        },
+        {
+            "name": "Jordi Gómez Hidalgo",
+            "email": "jordi.gomez@eclipse-foundation.org"
         }
     ],
     "files": [
@@ -31,44 +39,43 @@
     "types": "lib/index",
     "bin": "bin/ovsx",
     "engines": {
-        "node": ">= 20"
+        "node": ">=22.0.0"
     },
     "dependencies": {
         "@inquirer/prompts": "^7.10.1",
-        "@vscode/vsce": "^3.7.1",
-        "commander": "^6.2.1",
+        "@vscode/vsce": "^4.0.0",
+        "commander": "^14.0.3",
         "cross-keychain": "^1.1.0",
-        "follow-redirects": "^1.16.0",
         "is-ci": "^2.0.0",
-        "leven": "^3.1.0",
         "semver": "^7.6.0",
-        "tmp": "^0.2.3",
         "yauzl-promise": "^4.0.0"
     },
     "devDependencies": {
         "@eslint/eslintrc": "^3.2.0",
         "@eslint/js": "^9.15.0",
         "@stylistic/eslint-plugin": "^2.11.0",
-        "@types/follow-redirects": "^1.13.1",
         "@types/is-ci": "^2.0.0",
-        "@types/node": "^20.14.8",
+        "@types/node": "^22.0.0",
         "@types/semver": "^7.5.8",
-        "@types/tmp": "^0.2.2",
         "@types/yauzl-promise": "^4",
+        "@types/yazl": "^3.3.1",
         "@typescript-eslint/eslint-plugin": "^8.15.0",
         "@typescript-eslint/parser": "^8.15.0",
         "eslint": "^9.15.0",
         "limiter": "^2.1.0",
         "rimraf": "^6.0.1",
-        "typescript": "^5.6.3"
+        "typescript": "^5.6.3",
+        "vite": "^8.3.2",
+        "vitest": "^5.0.3",
+        "yazl": "^3.3.1"
     },
     "scripts": {
         "clean": "rimraf lib",
-        "prebuild": "node -p \"'export const LIB_VERSION = ' + JSON.stringify(require('./package.json').version) + ';'\" > src/version.ts",
         "build": "tsc -p ./tsconfig.json && yarn run lint",
         "watch": "tsc -w -p ./tsconfig.json",
-        "lint": "eslint -c ./configs/eslintrc.mjs src",
-        "prepare": "yarn run clean && yarn run prebuild && yarn run build",
+        "test": "vitest run",
+        "lint": "eslint -c ./configs/eslintrc.mjs src test",
+        "prepare": "yarn run clean && yarn run build",
         "publish:next": "yarn npm publish --tag next",
         "publish:latest": "yarn npm publish --tag latest",
         "load-extensions": "node scripts/load-test-extensions.js"

package/src/check-license.ts

@@ -9,10 +9,11 @@
  ********************************************************************************/
 
 import * as fs from 'fs';
+import * as path from 'path';
 import * as isCI from 'is-ci';
 import { input, select } from '@inquirer/prompts';
 import {
-    readManifest, writeManifest, Manifest, writeFile, validateManifest, promisify
+    readManifest, writeManifest, Manifest, validateManifest
 } from './util';
 
 async function addLicense(packagePath: string, manifest: Manifest): Promise<void> {
@@ -87,14 +88,14 @@ async function useMITLicense(manifest: Manifest, packagePath?: string) {
     manifest.license = 'MIT';
     await writeManifest(manifest, packagePath);
     const license = MIT_LICENSE_TEXT.replace('<YEAR> <COPYRIGHT HOLDER>', copyright);
-    await writeFile('LICENSE', license, packagePath);
+    await fs.promises.writeFile(path.join(packagePath ?? process.cwd(), 'LICENSE'), license, 'utf-8');
     console.log('LICENSE file has been written. Please commit it to the source repository.');
 }
 
 const LICENSE_FILE_NAMES = ['license.md', 'license', 'license.txt', 'licence.md', 'licence', 'licence.txt'];
 
 async function hasLicenseFile(packagePath?: string): Promise<boolean> {
-    const fileNames = await promisify(fs.readdir)(packagePath ?? '.');
+    const fileNames = await fs.promises.readdir(packagePath ?? '.');
     for (const fileName of fileNames) {
         for (const licFileName of LICENSE_FILE_NAMES) {
             if (fileName.toLowerCase() === licFileName) {

package/src/get.ts

@@ -12,7 +12,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as semver from 'semver';
 import { Registry, Extension } from "./registry";
-import { promisify, matchExtensionId, optionalStat, makeDirs, addEnvOptions, rejectError } from './util';
+import { matchExtensionId, addEnvOptions, rejectError } from './util';
 import { GetOptions } from './get-options';
 
 /**
@@ -23,7 +23,7 @@ export async function getExtension(options: GetOptions): Promise<void> {
     const registry = new Registry(options);
     const match = matchExtensionId(options.extensionId);
     if (!match) {
-        throw new Error('The extension identifier must have the form `namespace.extension`.');
+        throw new Error('The extension identifier must have the form `namespace.extension` or `namespace/extension`.');
     }
 
     const extension = await registry.getMetadata(match[1], match[2], options.target);
@@ -70,15 +70,15 @@ async function printMetadata(registry: Registry, extension: Extension, output?:
         return;
     }
     let filePath: string | undefined;
-    const stats = await optionalStat(output);
+    const stats = fs.statSync(output, { throwIfNoEntry: false });
     if (stats?.isDirectory() || !stats && output.endsWith(path.sep)) {
         const fileName = `${extension.namespace}.${extension.name}-${extension.version}.json`;
         filePath = path.resolve(process.cwd(), output, fileName);
     } else {
         filePath = path.resolve(process.cwd(), output);
     }
-    await makeDirs(path.dirname(filePath));
-    await promisify(fs.writeFile)(filePath, metadata);
+    await fs.promises.mkdir(path.dirname(filePath), { recursive: true });
+    await fs.promises.writeFile(filePath, metadata);
 }
 
 async function download(registry: Registry, extension: Extension, output?: string): Promise<void> {
@@ -90,7 +90,7 @@ async function download(registry: Registry, extension: Extension, output?: strin
     const fileName = decodeURIComponent(downloadUrl.substring(fileNameIndex + 1));
     let filePath: string | undefined;
     if (output) {
-        const stats = await optionalStat(output);
+        const stats = fs.statSync(output, { throwIfNoEntry: false });
         if (stats?.isDirectory() || !stats && output.endsWith(path.sep)) {
             filePath = path.resolve(process.cwd(), output, fileName);
         } else {
@@ -99,7 +99,7 @@ async function download(registry: Registry, extension: Extension, output?: strin
     } else {
         filePath = path.resolve(process.cwd(), fileName);
     }
-    await makeDirs(path.dirname(filePath));
+    await fs.promises.mkdir(path.dirname(filePath), { recursive: true });
     const target = extension.targetPlatform !== 'universal' ? '@' + extension.targetPlatform : '';
     console.log(`Downloading ${extension.namespace}.${extension.name}-${extension.version}${target} to ${filePath}`);
     await registry.download(filePath, new URL(downloadUrl));

package/src/http.ts

@@ -0,0 +1,176 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+
+import * as http from 'http';
+import * as https from 'https';
+import * as fs from 'fs';
+import { redactUrl, statusError, withStatus } from './util';
+
+// Hop limit the fetch standard uses.
+const MAX_REDIRECTS = 20;
+
+// Dropped on a redirect to another origin; X-OpenVSX-Token carries the PAT just like Authorization.
+const CREDENTIAL_HEADERS = /^(?:authorization|cookie|proxy-authorization|x-openvsx-token)$/i;
+
+export type RequestBody = () => string | Buffer | Uint8Array | fs.ReadStream;
+
+/**
+ * Sends a request and follows redirects to `onResponse`'s final response, reporting any failure
+ * to `fail`. A GET follows every redirect; a request with a body follows only 307/308, sending
+ * the body again, because 301/302/303 turn it into a GET without one. Credentials are dropped
+ * once a redirect leaves the origin. Only the headers in `options` are sent, so a caller that
+ * passes none carries no credentials.
+ */
+export function send(
+    url: URL,
+    options: http.RequestOptions,
+    body: RequestBody | undefined,
+    onResponse: (response: http.IncomingMessage) => void,
+    fail: (err: Error) => void,
+    hops = 0
+): void {
+    const protocol = url.protocol === 'https:' ? https : http;
+    const request = protocol.request(url, options, response => {
+        const status = response.statusCode ?? 0;
+        const location = response.headers.location;
+        if (status < 300 || status > 399 || !location) {
+            onResponse(response);
+            return;
+        }
+        response.resume();
+
+        let next: URL;
+        try {
+            next = new URL(location, url);
+        } catch (err) {
+            fail(err as Error);
+            return;
+        }
+        if (hops >= MAX_REDIRECTS) {
+            fail(new Error(`The request to ${redactUrl(url)} was redirected more than ${MAX_REDIRECTS} times.`));
+        } else if (next.protocol !== 'https:' && next.protocol !== 'http:') {
+            fail(new Error(`The request to ${redactUrl(url)} was redirected to unsupported URL ${redactUrl(next)}.`));
+        } else if (body && status !== 307 && status !== 308) {
+            fail(withStatus(new Error(`The ${options.method} request to ${redactUrl(url)} was redirected to ${redactUrl(next)} `
+                + `with status ${status}, which drops the request body. Use the redirect target as the registry URL.`), status));
+        } else {
+            // The server may answer before reading the body: abandon this hop so its stream
+            // releases the file and a late reset on its socket can't fail the next hop.
+            request.removeListener('error', fail);
+            request.on('error', () => { /* abandoned */ });
+            if (content instanceof fs.ReadStream) {
+                content.unpipe(request);
+                content.destroy();
+            }
+            request.destroy();
+            const headers = next.origin === url.origin ? options.headers : withoutCredentials(options.headers as http.OutgoingHttpHeaders);
+            send(next, { ...options, headers }, body, onResponse, fail, hops + 1);
+        }
+    });
+    request.on('error', fail);
+    failOnTimeout(request, url, options.timeout, fail);
+
+    const content = body?.();
+    if (content instanceof fs.ReadStream) {
+        content.on('error', (err: Error) => {
+            request.destroy();
+            fail(err);
+        });
+        request.on('error', () => content.close());
+        content.on('open', () => content.pipe(request));
+    } else {
+        request.end(content);
+    }
+}
+
+/** Sends a GET with only the given headers and resolves with the parsed JSON response. */
+export function getJson<T>(url: URL, headers: http.OutgoingHttpHeaders, timeout: number): Promise<T> {
+    return new Promise((resolve, reject) => {
+        send(url, { method: 'GET', headers, timeout }, undefined, jsonResponse<T>(resolve, reject), reject);
+    });
+}
+
+/**
+ * Reads a response as JSON. A non-2xx status rejects with the `message` or `error` of a JSON
+ * error body when there is one, and with the status otherwise. An HTML page rejects with an
+ * Error rather than its markup, since it usually means the URL points at a website, not an API.
+ */
+export function jsonResponse<T>(resolve: (value: T) => void, reject: (reason: any) => void): (res: http.IncomingMessage) => void {
+    return response => {
+        response.setEncoding('utf-8');
+        let json = '';
+        // A connection lost after the headers have arrived ends the response without 'end' ever
+        // firing, so without this the promise is never settled and the command waits on a body
+        // that is not coming. The configured timeout would eventually rescue it, but rejecting
+        // here reports what actually happened instead of thirty seconds of silence.
+        response.on('error', reject);
+        response.on('data', chunk => json += chunk);
+        response.on('end', () => {
+            if (response.statusCode !== undefined && (response.statusCode < 200 || response.statusCode > 299)) {
+                if (json.trimStart().startsWith('{')) {
+                    try {
+                        const parsed = JSON.parse(json) as { message?: string; error?: string };
+                        const message = parsed.message || parsed.error;
+                        if (message) {
+                            // keep the status: the message alone cannot say whether retrying is worth it
+                            reject(withStatus(new Error(message), response.statusCode));
+                            return;
+                        }
+                    } catch (err) {
+                        // Ignore the error and reject with response status
+                    }
+                }
+                reject(statusError(response));
+            } else if (isHtml(response, json)) {
+                reject(withStatus(new Error(`The server responded with status ${response.statusCode} and an HTML page instead of JSON.`),
+                    response.statusCode));
+            } else {
+                try {
+                    resolve(JSON.parse(json));
+                } catch (err) {
+                    reject(err);
+                }
+            }
+        });
+    };
+}
+
+/**
+ * Node's `timeout` option only raises an event - the request stays open, which is why a server
+ * that accepts a connection and then says nothing used to hold a command open indefinitely.
+ * Destroying the request with an error routes through the error handling each caller already
+ * has, so a stalled request rejects the way any other failure does. With a timeout of zero the
+ * event never fires and this does nothing.
+ */
+function failOnTimeout(request: http.ClientRequest, url: URL, timeout: number | undefined, fail: (err: Error) => void): void {
+    request.on('timeout', () => {
+        // Reported before the request is torn down, rather than by destroying it with the error.
+        // Destroying raises errors of its own - ECONNRESET on the response, a premature close
+        // from pipeline - and node guarantees no order between those and the request's own. In
+        // practice the request's arrives first, so this is belt and braces rather than the thing
+        // that stops the wrong error being reported; that is the caller claiming the failure
+        // before it does any asynchronous cleanup.
+        fail(new Error(`No response from ${redactUrl(url)} for ${timeout} ms.`));
+        request.destroy();
+    });
+}
+
+// The body check covers servers that send HTML without a text/html Content-Type.
+function isHtml(response: http.IncomingMessage, body: string): boolean {
+    const contentType = response.headers['content-type']?.split(';')[0].trim().toLowerCase();
+    return contentType === 'text/html' || /^\s*<(?:!doctype\s+html|html)[\s>]/i.test(body);
+}
+
+function withoutCredentials(headers: http.OutgoingHttpHeaders = {}): http.OutgoingHttpHeaders {
+    return Object.fromEntries(Object.entries(headers).filter(([name]) => !CREDENTIAL_HEADERS.test(name)));
+}

package/src/index.ts

@@ -19,6 +19,10 @@ export * from './publish';
 export * from './publish-options';
 export * from './registry';
 export * from './registry-options';
+export * from './trusted-publishing';
+export * from './trusted-publishing-options';
+export * from './unpublish';
+export * from './unpublish-options';
 export * from './verify-pat';
 export * from './verify-pat-options';
 export { isLicenseOk } from './check-license';

package/src/list-options.ts

@@ -0,0 +1,25 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+
+import { RegistryOptions } from './registry-options';
+
+export interface ListOptions extends RegistryOptions {
+    /**
+     * Namespace whose extensions should be listed.
+     */
+    namespace: string;
+    /**
+     * Print the raw namespace metadata as JSON instead of a list.
+     */
+    json?: boolean;
+}

package/src/list.ts

@@ -0,0 +1,48 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+
+import { ListOptions } from './list-options';
+import { Registry } from './registry';
+import { formatCount } from './table';
+import { addEnvOptions } from './util';
+
+/**
+ * Lists the extensions published in a namespace.
+ */
+export async function list(options: ListOptions): Promise<void> {
+    addEnvOptions(options);
+    const registry = new Registry(options);
+    const namespace = await registry.getNamespace(options.namespace);
+    if (namespace.error) {
+        throw new Error(namespace.error);
+    }
+
+    if (options.json) {
+        console.log(JSON.stringify(namespace, null, 4));
+        return;
+    }
+
+    // Sorted here rather than relying on the response's key order, so the output is stable and
+    // scriptable regardless of how the registry happens to serialise the map.
+    const names = Object.keys(namespace.extensions ?? {}).sort((a, b) => a.localeCompare(b));
+    const verified = namespace.verified ? ' (verified)' : '';
+    console.log(`${namespace.name}${verified} - ${formatCount(names.length, 'extension')}`);
+    if (names.length === 0) {
+        return;
+    }
+
+    console.log();
+    for (const name of names) {
+        console.log(`  ${namespace.name}.${name}`);
+    }
+}