ovsx 1.2.0 → 1.3.0

package/src/main.ts

@@ -9,12 +9,13 @@
  ********************************************************************************/
 
 import * as commander from 'commander';
-import * as leven from 'leven';
+import { readFileSync } from 'fs';
+import { join } from 'path';
 import { createNamespace } from './create-namespace';
 import { verifyPat } from './verify-pat';
 import { publish } from './publish';
 import { unpublish } from './unpublish';
-import { handleError, parseNonNegativeInt } from './util';
+import { handleError, levenshtein, parseNonNegativeInt } from './util';
 import { getExtension } from './get';
 import { list } from './list';
 import { DEFAULT_SEARCH_SIZE, SORT_KEYS, SORT_ORDERS, search } from './search';
@@ -23,10 +24,13 @@ import { verify } from './verify';
 import { verifySignature } from './verify-signature';
 import login from './login';
 import logout from './logout';
-import { LIB_VERSION } from './version';
+
+// Resolves from both src/ (tests) and lib/ (published build); npm always ships package.json.
+const LIB_VERSION: string = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8')).version;
 
 module.exports = function (argv: string[]): void {
     const program = new commander.Command();
+    program.nameFromFilename(argv[1]);
     program.usage('<command> [options]')
         .option('-r, --registryUrl <url>', 'Use the registry API at this base URL.')
         .option('-p, --pat <token>', 'Personal access token.')
@@ -36,17 +40,17 @@ module.exports = function (argv: string[]): void {
     const createNamespaceCmd = program.command('create-namespace <name>');
     createNamespaceCmd.description('Create a new namespace')
         .action((name: string) => {
-            const { registryUrl, pat } = program.opts();
+            const { registryUrl, pat, debug } = program.opts();
             createNamespace({ name, registryUrl, pat })
-                .catch(handleError(program.debug));
+                .catch(handleError(debug));
         });
 
     const verifyTokenCmd = program.command('verify-pat [namespace]');
     verifyTokenCmd.description('Verify that a personal access token can publish to a namespace')
         .action((namespace?: string) => {
-            const { registryUrl, pat } = program.opts();
+            const { registryUrl, pat, debug } = program.opts();
             verifyPat({ namespace, registryUrl, pat })
-                .catch(handleError(program.debug));
+                .catch(handleError(debug));
         });
 
     const publishCmd = program.command('publish [extension.vsix]');
@@ -86,7 +90,7 @@ module.exports = function (argv: string[]): void {
                 console.warn("Ignoring option '--packageVersion' for prepackaged extension.");
             if (extensionFile !== undefined && allowMissingRepository !== undefined)
                 console.warn("Ignoring option '--allow-missing-repository' for prepackaged extension.");
-            const { registryUrl, pat } = program.opts();
+            const { registryUrl, pat, debug } = program.opts();
             publish({ extensionFile, registryUrl, pat, targets: typeof target === 'string' ? [target] : target, packagePath: typeof packagePath === 'string' ? [packagePath] : packagePath, baseContentUrl, baseImagesUrl, yarn, followSymlinks, preRelease, allowMissingRepository, dependencies, skipDuplicate, packageVersion, trustedPublishing, idToken, oidcAudience })
                 .then(results => {
                     const reasons = results.filter(result => result.status === 'rejected')
@@ -95,7 +99,7 @@ module.exports = function (argv: string[]): void {
                     if (reasons.length > 0) {
                         const message = 'See the documentation for more information:\n'
                             + 'https://github.com/eclipse/openvsx/wiki/Publishing-Extensions';
-                        const errorHandler = handleError(program.debug, message, false);
+                        const errorHandler = handleError(debug, message, false);
                         for (const reason of reasons) {
                             errorHandler(reason);
                         }
@@ -111,7 +115,7 @@ module.exports = function (argv: string[]): void {
         .option('-t, --target <targets...>', 'Only delete the given target architectures of the given versions.')
         .option('-f, --force', 'Skip the confirmation prompt.')
         .action((extensionId: string | undefined, { versions, target, force }) => {
-            const { registryUrl, pat } = program.opts();
+            const { registryUrl, pat, debug } = program.opts();
             unpublish({
                 extensionId,
                 versions: typeof versions === 'string' ? [versions] : versions,
@@ -119,7 +123,7 @@ module.exports = function (argv: string[]): void {
                 force,
                 registryUrl,
                 pat
-            }).catch(handleError(program.debug));
+            }).catch(handleError(debug));
         });
 
     const searchCmd = program.command('search [text]');
@@ -136,17 +140,17 @@ module.exports = function (argv: string[]): void {
         .option('--sort-order <order>', `Sort order: ${SORT_ORDERS.join(', ')}.`)
         .option('--json', 'Print the raw results as JSON.')
         .action((text: string | undefined, { category, target, size, offset, sortBy, sortOrder, json }) => {
-            const { registryUrl } = program.opts();
+            const { registryUrl, debug } = program.opts();
             search({ text, category, target, size, offset, sortBy, sortOrder, json, registryUrl })
-                .catch(handleError(program.debug));
+                .catch(handleError(debug));
         });
 
     const listCmd = program.command('list <namespace>');
     listCmd.description('List the extensions published in a namespace.')
         .option('--json', 'Print the raw namespace metadata as JSON.')
         .action((namespace: string, { json }) => {
-            const { registryUrl } = program.opts();
-            list({ namespace, json, registryUrl }).catch(handleError(program.debug));
+            const { registryUrl, debug } = program.opts();
+            list({ namespace, json, registryUrl }).catch(handleError(debug));
         });
 
     const showCmd = program.command('show <namespace.extension[@version]>');
@@ -155,8 +159,8 @@ module.exports = function (argv: string[]): void {
         .option('--all-versions', 'List every published version instead of the most recent few.')
         .option('--json', 'Print the raw metadata as JSON.')
         .action((extensionId: string, { target, allVersions, json }) => {
-            const { registryUrl } = program.opts();
-            show({ extensionId, target, allVersions, json, registryUrl }).catch(handleError(program.debug));
+            const { registryUrl, debug } = program.opts();
+            show({ extensionId, target, allVersions, json, registryUrl }).catch(handleError(debug));
         });
 
     const getCmd = program.command('get <namespace.extension>');
@@ -166,18 +170,18 @@ module.exports = function (argv: string[]): void {
         .option('-o, --output <path>', 'Save the output in the specified file or directory.')
         .option('--metadata', 'Print the extension\'s metadata instead of downloading it.')
         .action((extensionId: string, { target, versionRange, output, metadata }) => {
-            const { registryUrl } = program.opts();
+            const { registryUrl, debug } = program.opts();
             getExtension({ extensionId, target: target, version: versionRange, registryUrl, output, metadata })
-                .catch(handleError(program.debug));
+                .catch(handleError(debug));
         });
 
     const verifyCmd = program.command('verify <extension.vsix>');
     verifyCmd.description('Verify a downloaded package\'s signature against the registry\'s public key.')
         .option('-t, --target <target>', 'Target architecture')
         .action((packagePath: string, { target }) => {
-            const { registryUrl } = program.opts();
+            const { registryUrl, debug } = program.opts();
             verify({ packagePath, target, registryUrl })
-                .catch(handleError(program.debug));
+                .catch(handleError(debug));
         });
 
     const verifySignatureCmd = program.command('verify-signature');
@@ -187,43 +191,44 @@ module.exports = function (argv: string[]): void {
         .requiredOption('-s, --signaturePath <path>', 'Path to the signature file.')
         .requiredOption('-k, --publicKeyPath <path>', 'Path to the registry\'s public key file.')
         .action(({ packagePath, manifestPath, signaturePath, publicKeyPath }) => {
+            const { debug } = program.opts();
             verifySignature({ packagePath, manifestPath, signaturePath, publicKeyPath })
-                .catch(handleError(program.debug));
+                .catch(handleError(debug));
         });
 
     const loginCmd = program.command('login <namespace>');
     loginCmd.description('Adds a namespace to the list of known namespaces')
         .action((namespace: string) => {
-            const { registryUrl, pat } = program.opts();
-            login({ namespace, registryUrl, pat }).catch(handleError(program.debug));
+            const { registryUrl, pat, debug } = program.opts();
+            login({ namespace, registryUrl, pat }).catch(handleError(debug));
         });
 
     const logoutCmd = program.command('logout <namespace>');
     logoutCmd.description('Removes a namespace from the list of known namespaces')
         .action((namespace: string) => {
-            logout(namespace).catch(handleError(program.debug));
-        });
-
-    program
-        .command('*', '', { noHelp: true })
-        .action((cmd: commander.Command) => {
-            const availableCommands = program.commands.map((c: any) => c._name) as string[];
-            const actualCommand = cmd.args[0];
-            if (actualCommand) {
-                const suggestion = availableCommands.find(c => leven(c, actualCommand) < c.length * 0.4);
-                if (suggestion)
-                    console.error(`Unknown command '${actualCommand}', did you mean '${suggestion}'?\n`);
-                else
-                    console.error(`Unknown command '${actualCommand}'.\n`);
-            } else {
-                console.error('Unknown command.');
-            }
-            program.help();
+            const { debug } = program.opts();
+            logout(namespace).catch(handleError(debug));
         });
 
-    program.parse(argv);
+    // 'command:*' is deprecated in favor of catching the commander.unknownCommand error, but that
+    // error is reported (message written, process exited) by commander itself before a catch runs,
+    // so it can't reproduce this suggestion wording. Still supported for backwards compatibility.
+    program.on('command:*', (operands: string[]) => {
+        const availableCommands = program.commands.map(c => c.name());
+        const actualCommand = operands[0];
+        const suggestion = availableCommands.find(c => levenshtein(c, actualCommand) < c.length * 0.4);
+        if (suggestion)
+            console.error(`Unknown command '${actualCommand}', did you mean '${suggestion}'?\n`);
+        else
+            console.error(`Unknown command '${actualCommand}'.\n`);
+        process.exitCode = 1;
+        program.help();
+    });
 
     if (process.argv.length <= 2) {
+        // Commander 14 would otherwise print this to stderr and exit 1 during program.parse(argv) below.
         program.help();
     }
+
+    program.parse(argv);
 };

package/src/oidc.ts

@@ -11,10 +11,9 @@
  * SPDX-License-Identifier: EPL-2.0
  *****************************************************************************/
 
-import * as http from 'http';
-import * as followRedirects from 'follow-redirects';
+import { getJson } from './http';
 import { TrustedPublishingOptions } from './trusted-publishing-options';
-import { configuredTimeout, redactUrl, statusError } from './util';
+import { configuredTimeout } from './util';
 
 /**
  * Whether an OIDC ID token can be obtained without user interaction.
@@ -48,59 +47,18 @@ async function getGitHubActionsIdToken(audience: string): Promise<string> {
     // the request URL already carries an api-version query parameter, so keep its query intact
     const url = new URL(process.env.ACTIONS_ID_TOKEN_REQUEST_URL!);
     url.searchParams.set('audience', audience);
+    // Sent with only these headers, so none of the registry's credentials reach the CI system's
+    // token service. OVSX_TIMEOUT still applies, as there are no registry options to read it from.
     const response = await getJson<GitHubIdTokenResponse>(url, {
         'Authorization': `Bearer ${process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN}`,
         'Accept': 'application/json'
-    });
+    }, configuredTimeout());
     if (!response.value) {
         throw new Error('GitHub Actions did not return an OIDC ID token.');
     }
     return response.value;
 }
 
-/**
- * Minimal JSON GET that is not bound to the registry: the request must not carry any registry
- * credentials, as it is sent to the CI system's token service.
- */
-function getJson<T>(url: URL, headers: http.OutgoingHttpHeaders): Promise<T> {
-    return new Promise((resolve, reject) => {
-        const protocol = url.protocol === 'https:' ? followRedirects.https : followRedirects.http;
-        // OVSX_TIMEOUT covers this request too. Read here rather than taken from the registry's
-        // options, since this one carries none of the registry's configuration - only the clock is
-        // shared, and having two of those to explain would be worse.
-        const timeout = configuredTimeout();
-        const request = protocol.request(url, { method: 'GET', headers, timeout }, response => {
-            response.setEncoding('utf-8');
-            let json = '';
-            // See Registry.getJsonResponse: a connection lost mid-body never fires 'end', so the
-            // response's own error has to be what settles the promise.
-            response.on('error', reject);
-            response.on('data', chunk => json += chunk);
-            response.on('end', () => {
-                if (response.statusCode !== undefined && (response.statusCode < 200 || response.statusCode > 299)) {
-                    reject(statusError(response));
-                } else {
-                    try {
-                        resolve(JSON.parse(json));
-                    } catch (err) {
-                        reject(err);
-                    }
-                }
-            });
-        });
-        request.on('error', reject);
-        // The timeout option only raises an event, so the request has to be destroyed for it to mean
-        // anything; the error then arrives at the handler above.
-        request.on('timeout', () => {
-            // Rejected before the teardown, so the timeout is what the caller sees rather than
-            // whichever error destroying the request happens to raise first.
-            reject(new Error(`No response from ${redactUrl(url)} for ${timeout} ms.`));
-            request.destroy();
-        });
-        request.end();
-    });
-}
-
 interface GitHubIdTokenResponse {
     count?: number;
     value?: string;

package/src/publish.ts

@@ -8,15 +8,26 @@
  * SPDX-License-Identifier: EPL-2.0
  ********************************************************************************/
 import * as fs from 'fs';
+import * as semver from 'semver';
 import { createVSIX, IPackageOptions } from '@vscode/vsce';
 import { getPAT } from './pat';
-import { createTempFile, addEnvOptions, addTrustedPublishingEnvOptions, formatBytes, StatusError } from './util';
+import {
+    getTempFilePath,
+    addEnvOptions,
+    addTrustedPublishingEnvOptions,
+    formatBytes,
+    Manifest,
+    StatusError
+} from './util';
 import { Extension, Registry } from './registry';
 import { checkLicense } from './check-license';
 import { readVSIXPackage } from './zip';
 import { PublishOptions, PublishCommonOptions } from './publish-options';
 import { getTrustedPublishingToken, refreshTrustedPublishingToken, useTrustedPublishing } from './trusted-publishing';
 
+/** Registries older than this cannot report the limit that applies to a namespace. */
+const MIN_SIZE_LIMIT_REGISTRY_VERSION = '1.3.0';
+
 /**
  * Publishes an extension.
  */
@@ -24,8 +35,11 @@ export async function publish(options: PublishOptions = {}): Promise<PromiseSett
     addEnvOptions(options);
     addTrustedPublishingEnvOptions(options);
 
-    // Looked up once and shared by every target/package below, rather than once per artifact.
-    const maxExtensionSize = await getMaxExtensionSize(new Registry(options));
+    // Shared by every target/package below, rather than one per artifact: besides saving the extra
+    // `/api/version` round trips, it's also where the registry's reported version is cached (see
+    // Registry.tokenQuery), so a wide fan-out doesn't repeat that lookup once per target either.
+    const registry = new Registry(options);
+    const maxExtensionSize = await getMaxExtensionSize(registry);
 
     const internalPublishOptions: InternalPublishOptions[] = [];
     const packagePaths = options.packagePath || [undefined];
@@ -36,15 +50,15 @@ export async function publish(options: PublishOptions = {}): Promise<PromiseSett
         }
     }
 
-    return Promise.allSettled(internalPublishOptions.map(publishOptions => doPublish(publishOptions)));
+    return Promise.allSettled(internalPublishOptions.map(publishOptions => doPublish(registry, publishOptions)));
 }
 
 /**
- * Looks up the registry's configured extension size limit, so an oversized package can be rejected
- * locally before the upload instead of after transferring the whole payload.
+ * Looks up the registry's default extension size limit, so an oversized package can be flagged
+ * before the upload instead of after transferring the whole payload.
  *
  * Best-effort: registries that don't expose `/api/version`, or don't report a limit, return
- * `undefined` here, and the upload proceeds to let the server enforce its own limit as before.
+ * `undefined` here, and nothing is said about the size.
  */
 async function getMaxExtensionSize(registry: Registry): Promise<number | undefined> {
     try {
@@ -54,28 +68,43 @@ async function getMaxExtensionSize(registry: Registry): Promise<number | undefin
     }
 }
 
-async function doPublish(options: InternalPublishOptions = {}): Promise<void> {
+async function doPublish(registry: Registry, options: InternalPublishOptions = {}): Promise<void> {
     // if the packagePath is a link to a vsix, don't need to package it
     if (options.packagePath?.endsWith('.vsix')) {
         options.extensionFile = options.packagePath;
         delete options.packagePath;
         delete options.target;
     }
-    const registry = new Registry(options);
-    if (!options.extensionFile) {
-        await packageExtension(options, registry);
-        console.log(); // new line
-    } else if (options.preRelease) {
-        console.warn("Ignoring option '--pre-release' for prepackaged extension.");
+    // Only a package created here is a temp file; one the user supplied must never be deleted.
+    const packaged = !options.extensionFile;
+    try {
+        if (packaged) {
+            await packageExtension(options, registry);
+            console.log(); // new line
+        } else if (options.preRelease) {
+            console.warn("Ignoring option '--pre-release' for prepackaged extension.");
+        }
+        await publishExtensionFile(registry, options);
+    } finally {
+        if (packaged && options.extensionFile) {
+            // Caught rather than awaited plainly: a failure here (e.g. the temp dir is locked or
+            // read-only) must not replace whatever error publishExtensionFile already threw above.
+            await fs.promises.rm(options.extensionFile, { force: true }).catch(err => {
+                console.warn(`Could not delete temporary file ${options.extensionFile}: ${err.message}`);
+            });
+        }
     }
+}
 
-    await ensureWithinSizeLimit(options.extensionFile!, options.maxExtensionSize, registry.url);
+async function publishExtensionFile(registry: Registry, options: InternalPublishOptions): Promise<void> {
+    // Read up front rather than only when a token has to be obtained: the size limit is looked up per
+    // namespace, and the namespace lives in the manifest.
+    const manifest = await readVSIXPackage(options.extensionFile!);
 
     // Set only when this publish obtained the token itself through trusted publishing, which is the one
     // case where a refusal can be answered by asking for a new token.
     let exchanged: { namespace: string; extension: string } | undefined;
     if (!options.pat) {
-        const manifest = await readVSIXPackage(options.extensionFile!);
         if (useTrustedPublishing(options)) {
             exchanged = { namespace: manifest.publisher, extension: manifest.name };
             options.pat = await getTrustedPublishingToken(registry, manifest.publisher, manifest.name, options);
@@ -84,9 +113,13 @@ async function doPublish(options: InternalPublishOptions = {}): Promise<void> {
         }
     }
 
+    // After the token is resolved, because the lookup is authenticated - and by here a token always
+    // exists, whether supplied, fetched, or exchanged through trusted publishing.
+    const sizeLimit = await ensureWithinSizeLimit(registry, options, manifest);
+
     let extension: Extension | undefined;
     try {
-        extension = await doRegistryPublish(registry, options, exchanged);
+        extension = await doRegistryPublish(registry, options, exchanged, sizeLimit);
     } catch (err) {
         if (options.skipDuplicate && err.message.endsWith('is already published.')) {
             console.log(err.message + ' Skipping publish.');
@@ -123,10 +156,11 @@ async function doPublish(options: InternalPublishOptions = {}): Promise<void> {
 async function doRegistryPublish(
     registry: Registry,
     options: InternalPublishOptions,
-    exchanged: { namespace: string; extension: string } | undefined
+    exchanged: { namespace: string; extension: string } | undefined,
+    sizeLimit?: number
 ): Promise<Extension> {
     try {
-        return await registry.publish(options.extensionFile!, options.pat!);
+        return await registry.publish(options.extensionFile!, options.pat!, sizeLimit);
     } catch (err) {
         if (!exchanged || (err as StatusError)?.status !== 401) {
             throw err;
@@ -140,28 +174,95 @@ async function doRegistryPublish(
             options,
             options.pat!
         );
-        return registry.publish(options.extensionFile!, options.pat);
+        return registry.publish(options.extensionFile!, options.pat, sizeLimit);
     }
 }
 
 /**
- * Fails fast with an actionable message when the packaged extension is already known to exceed the
- * registry's configured size limit, rather than uploading the whole file only to have the server
- * reject it. `maxSize` is `undefined` when the limit couldn't be determined, in which case the check
- * is skipped and the upload is left to the server to accept or reject.
+ * Refuses a package the registry would reject anyway, before uploading it, and reports how many
+ * bytes it has concluded may be sent - the caller raises the transport cap to that, so nothing we
+ * decided to upload is then refused locally.
+ *
+ * The limit is the one that applies to this package's namespace and extension, which a size override
+ * can raise above the registry default. Registries older than
+ * {@link MIN_SIZE_LIMIT_REGISTRY_VERSION} cannot report it, so there the check stays advisory: it
+ * warns against the default and publishes, rather than refusing an upload those registries would
+ * have accepted.
  */
-async function ensureWithinSizeLimit(extensionFile: string, maxSize: number | undefined, registryUrl: string): Promise<void> {
-    if (!maxSize) {
-        return;
+async function ensureWithinSizeLimit(
+    registry: Registry,
+    options: InternalPublishOptions,
+    manifest: Manifest
+): Promise<number | undefined> {
+    const { size } = await fs.promises.stat(options.extensionFile!);
+    const limit = await resolveSizeLimit(registry, options, manifest);
+
+    if (limit.kind === 'failed') {
+        // Always said, however small the package: a size override can lower a limit as well as raise
+        // it, so there is no size from which it follows that this upload is fine. Staying quiet here
+        // left a registry whose /api/-/* routes never arrive indistinguishable from a working one.
+        console.warn(
+            `Could not check the size limit for ${manifest.publisher}.${manifest.name} at ${registry.url} `
+            + `(${limit.reason}). Publishing anyway: the registry enforces its own limit, so an oversized `
+            + `package is refused after the upload rather than before it.`
+        );
+    } else if (limit.kind === 'unsupported') {
+        const fallback = options.maxExtensionSize;
+        if (fallback && size > fallback) {
+            console.warn(
+                `The extension package (${formatBytes(size)}) exceeds the default size limit of ${formatBytes(fallback)} `
+                + `reported by the registry at ${registry.url}, which is too old to report the limit for a `
+                + `single namespace. Publishing anyway: the namespace may have a different limit configured, `
+                + `and the registry decides.`
+            );
+        }
     }
 
-    const { size } = await fs.promises.stat(extensionFile);
-    if (size > maxSize) {
+    if (limit.kind !== 'resolved') {
+        // The allowance is this package, not the built-in publish size: having decided to send it and
+        // let the registry answer, the transport cap must not be what refuses it instead. An older
+        // registry whose default is above 512 MiB would otherwise reject a package it would accept.
+        return size;
+    }
+
+    if (size > limit.limit) {
         throw new Error(
-            `The extension package (${formatBytes(size)}) exceeds the size limit of ${formatBytes(maxSize)} `
-            + `accepted by the registry at ${registryUrl}.`
+            `The extension package (${formatBytes(size)}) exceeds the size limit of ${formatBytes(limit.limit)} `
+            + `for ${manifest.publisher}.${manifest.name} at ${registry.url}.`
         );
     }
+    return limit.limit;
+}
+
+/**
+ * The limit for this namespace/extension. A registry too old to report one and a registry that could
+ * not answer are told apart: both publish anyway, but only the second one means a check the user is
+ * entitled to expect did not happen.
+ */
+type SizeLimitLookup =
+    | { kind: 'resolved'; limit: number }
+    | { kind: 'unsupported' }
+    | { kind: 'failed'; reason: string };
+
+async function resolveSizeLimit(
+    registry: Registry,
+    options: InternalPublishOptions,
+    manifest: Manifest
+): Promise<SizeLimitLookup> {
+    const reported = await registry.getRegistryVersion().catch(() => undefined);
+    const version = reported?.version ? semver.coerce(reported.version) : undefined;
+    if (!version || semver.lt(version, MIN_SIZE_LIMIT_REGISTRY_VERSION)) {
+        return { kind: 'unsupported' };
+    }
+
+    try {
+        const { maxSize } = await registry.getSizeLimit(manifest.publisher, manifest.name, options.pat!);
+        return { kind: 'resolved', limit: maxSize };
+    } catch (err) {
+        // The registry claims to be new enough but could not answer. It enforces the limit itself
+        // regardless, so publish rather than refusing on a failed lookup.
+        return { kind: 'failed', reason: err instanceof Error ? err.message : String(err) };
+    }
 }
 
 async function packageExtension(options: InternalPublishOptions, registry: Registry): Promise<void> {
@@ -169,7 +270,7 @@ async function packageExtension(options: InternalPublishOptions, registry: Regis
         await checkLicense(options.packagePath!);
     }
 
-    options.extensionFile = await createTempFile({ postfix: '.vsix' });
+    options.extensionFile = getTempFilePath('.vsix');
     const packageOptions: IPackageOptions = {
         packagePath: options.extensionFile,
         target: options.target,
@@ -208,8 +309,9 @@ interface InternalPublishOptions extends PublishCommonOptions {
     dependencies?: boolean;
 
     /**
-     * The registry's configured extension size limit in bytes, looked up once via `/api/version` and
-     * shared across every target/package being published. `undefined` when it couldn't be determined.
+     * The registry's default extension size limit in bytes, looked up once via `/api/version` and
+     * shared across every target/package being published. Advisory: a namespace override can allow
+     * more. `undefined` when it couldn't be determined.
      */
     maxExtensionSize?: number;
 }