ovsx 1.2.0 → 1.4.0

package/src/http.ts

@@ -0,0 +1,176 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+
+import * as http from 'http';
+import * as https from 'https';
+import * as fs from 'fs';
+import { redactUrl, statusError, withStatus } from './util';
+
+// Hop limit the fetch standard uses.
+const MAX_REDIRECTS = 20;
+
+// Dropped on a redirect to another origin; X-OpenVSX-Token carries the PAT just like Authorization.
+const CREDENTIAL_HEADERS = /^(?:authorization|cookie|proxy-authorization|x-openvsx-token)$/i;
+
+export type RequestBody = () => string | Buffer | Uint8Array | fs.ReadStream;
+
+/**
+ * Sends a request and follows redirects to `onResponse`'s final response, reporting any failure
+ * to `fail`. A GET follows every redirect; a request with a body follows only 307/308, sending
+ * the body again, because 301/302/303 turn it into a GET without one. Credentials are dropped
+ * once a redirect leaves the origin. Only the headers in `options` are sent, so a caller that
+ * passes none carries no credentials.
+ */
+export function send(
+    url: URL,
+    options: http.RequestOptions,
+    body: RequestBody | undefined,
+    onResponse: (response: http.IncomingMessage) => void,
+    fail: (err: Error) => void,
+    hops = 0
+): void {
+    const protocol = url.protocol === 'https:' ? https : http;
+    const request = protocol.request(url, options, response => {
+        const status = response.statusCode ?? 0;
+        const location = response.headers.location;
+        if (status < 300 || status > 399 || !location) {
+            onResponse(response);
+            return;
+        }
+        response.resume();
+
+        let next: URL;
+        try {
+            next = new URL(location, url);
+        } catch (err) {
+            fail(err as Error);
+            return;
+        }
+        if (hops >= MAX_REDIRECTS) {
+            fail(new Error(`The request to ${redactUrl(url)} was redirected more than ${MAX_REDIRECTS} times.`));
+        } else if (next.protocol !== 'https:' && next.protocol !== 'http:') {
+            fail(new Error(`The request to ${redactUrl(url)} was redirected to unsupported URL ${redactUrl(next)}.`));
+        } else if (body && status !== 307 && status !== 308) {
+            fail(withStatus(new Error(`The ${options.method} request to ${redactUrl(url)} was redirected to ${redactUrl(next)} `
+                + `with status ${status}, which drops the request body. Use the redirect target as the registry URL.`), status));
+        } else {
+            // The server may answer before reading the body: abandon this hop so its stream
+            // releases the file and a late reset on its socket can't fail the next hop.
+            request.removeListener('error', fail);
+            request.on('error', () => { /* abandoned */ });
+            if (content instanceof fs.ReadStream) {
+                content.unpipe(request);
+                content.destroy();
+            }
+            request.destroy();
+            const headers = next.origin === url.origin ? options.headers : withoutCredentials(options.headers as http.OutgoingHttpHeaders);
+            send(next, { ...options, headers }, body, onResponse, fail, hops + 1);
+        }
+    });
+    request.on('error', fail);
+    failOnTimeout(request, url, options.timeout, fail);
+
+    const content = body?.();
+    if (content instanceof fs.ReadStream) {
+        content.on('error', (err: Error) => {
+            request.destroy();
+            fail(err);
+        });
+        request.on('error', () => content.close());
+        content.on('open', () => content.pipe(request));
+    } else {
+        request.end(content);
+    }
+}
+
+/** Sends a GET with only the given headers and resolves with the parsed JSON response. */
+export function getJson<T>(url: URL, headers: http.OutgoingHttpHeaders, timeout: number): Promise<T> {
+    return new Promise((resolve, reject) => {
+        send(url, { method: 'GET', headers, timeout }, undefined, jsonResponse<T>(resolve, reject), reject);
+    });
+}
+
+/**
+ * Reads a response as JSON. A non-2xx status rejects with the `message` or `error` of a JSON
+ * error body when there is one, and with the status otherwise. An HTML page rejects with an
+ * Error rather than its markup, since it usually means the URL points at a website, not an API.
+ */
+export function jsonResponse<T>(resolve: (value: T) => void, reject: (reason: any) => void): (res: http.IncomingMessage) => void {
+    return response => {
+        response.setEncoding('utf-8');
+        let json = '';
+        // A connection lost after the headers have arrived ends the response without 'end' ever
+        // firing, so without this the promise is never settled and the command waits on a body
+        // that is not coming. The configured timeout would eventually rescue it, but rejecting
+        // here reports what actually happened instead of thirty seconds of silence.
+        response.on('error', reject);
+        response.on('data', chunk => json += chunk);
+        response.on('end', () => {
+            if (response.statusCode !== undefined && (response.statusCode < 200 || response.statusCode > 299)) {
+                if (json.trimStart().startsWith('{')) {
+                    try {
+                        const parsed = JSON.parse(json) as { message?: string; error?: string };
+                        const message = parsed.message || parsed.error;
+                        if (message) {
+                            // keep the status: the message alone cannot say whether retrying is worth it
+                            reject(withStatus(new Error(message), response.statusCode));
+                            return;
+                        }
+                    } catch (err) {
+                        // Ignore the error and reject with response status
+                    }
+                }
+                reject(statusError(response));
+            } else if (isHtml(response, json)) {
+                reject(withStatus(new Error(`The server responded with status ${response.statusCode} and an HTML page instead of JSON.`),
+                    response.statusCode));
+            } else {
+                try {
+                    resolve(JSON.parse(json));
+                } catch (err) {
+                    reject(err);
+                }
+            }
+        });
+    };
+}
+
+/**
+ * Node's `timeout` option only raises an event - the request stays open, which is why a server
+ * that accepts a connection and then says nothing used to hold a command open indefinitely.
+ * Destroying the request with an error routes through the error handling each caller already
+ * has, so a stalled request rejects the way any other failure does. With a timeout of zero the
+ * event never fires and this does nothing.
+ */
+function failOnTimeout(request: http.ClientRequest, url: URL, timeout: number | undefined, fail: (err: Error) => void): void {
+    request.on('timeout', () => {
+        // Reported before the request is torn down, rather than by destroying it with the error.
+        // Destroying raises errors of its own - ECONNRESET on the response, a premature close
+        // from pipeline - and node guarantees no order between those and the request's own. In
+        // practice the request's arrives first, so this is belt and braces rather than the thing
+        // that stops the wrong error being reported; that is the caller claiming the failure
+        // before it does any asynchronous cleanup.
+        fail(new Error(`No response from ${redactUrl(url)} for ${timeout} ms.`));
+        request.destroy();
+    });
+}
+
+// The body check covers servers that send HTML without a text/html Content-Type.
+function isHtml(response: http.IncomingMessage, body: string): boolean {
+    const contentType = response.headers['content-type']?.split(';')[0].trim().toLowerCase();
+    return contentType === 'text/html' || /^\s*<(?:!doctype\s+html|html)[\s>]/i.test(body);
+}
+
+function withoutCredentials(headers: http.OutgoingHttpHeaders = {}): http.OutgoingHttpHeaders {
+    return Object.fromEntries(Object.entries(headers).filter(([name]) => !CREDENTIAL_HEADERS.test(name)));
+}

package/src/index.ts

@@ -12,9 +12,6 @@ export * from './create-namespace';
 export * from './create-namespace-options';
 export * from './get';
 export * from './get-options';
-export * from './login';
-export * from './login-options';
-export * from './logout';
 export * from './publish';
 export * from './publish-options';
 export * from './registry';

package/src/main.ts

@@ -9,12 +9,13 @@
  ********************************************************************************/
 
 import * as commander from 'commander';
-import * as leven from 'leven';
+import { readFileSync } from 'fs';
+import { join } from 'path';
 import { createNamespace } from './create-namespace';
 import { verifyPat } from './verify-pat';
 import { publish } from './publish';
 import { unpublish } from './unpublish';
-import { handleError, parseNonNegativeInt } from './util';
+import { handleError, levenshtein, parseNonNegativeInt } from './util';
 import { getExtension } from './get';
 import { list } from './list';
 import { DEFAULT_SEARCH_SIZE, SORT_KEYS, SORT_ORDERS, search } from './search';
@@ -23,10 +24,13 @@ import { verify } from './verify';
 import { verifySignature } from './verify-signature';
 import login from './login';
 import logout from './logout';
-import { LIB_VERSION } from './version';
+
+// Resolves from both src/ (tests) and lib/ (published build); npm always ships package.json.
+const LIB_VERSION: string = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8')).version;
 
 module.exports = function (argv: string[]): void {
     const program = new commander.Command();
+    program.nameFromFilename(argv[1]);
     program.usage('<command> [options]')
         .option('-r, --registryUrl <url>', 'Use the registry API at this base URL.')
         .option('-p, --pat <token>', 'Personal access token.')
@@ -36,17 +40,17 @@ module.exports = function (argv: string[]): void {
     const createNamespaceCmd = program.command('create-namespace <name>');
     createNamespaceCmd.description('Create a new namespace')
         .action((name: string) => {
-            const { registryUrl, pat } = program.opts();
+            const { registryUrl, pat, debug } = program.opts();
             createNamespace({ name, registryUrl, pat })
-                .catch(handleError(program.debug));
+                .catch(handleError(debug));
         });
 
     const verifyTokenCmd = program.command('verify-pat [namespace]');
     verifyTokenCmd.description('Verify that a personal access token can publish to a namespace')
         .action((namespace?: string) => {
-            const { registryUrl, pat } = program.opts();
+            const { registryUrl, pat, debug } = program.opts();
             verifyPat({ namespace, registryUrl, pat })
-                .catch(handleError(program.debug));
+                .catch(handleError(debug));
         });
 
     const publishCmd = program.command('publish [extension.vsix]');
@@ -65,29 +69,14 @@ module.exports = function (argv: string[]): void {
         .option('--trusted-publishing', 'Exchange an OIDC ID token for a short-lived publishing token. Enabled automatically when a CI system provides an ID token and no access token is given.')
         .option('--idToken <token>', 'The OIDC ID token to exchange. Only needed on CI systems that provide the token directly, e.g. GitLab CI.')
         .option('--oidcAudience <audience>', 'Audience to request for the OIDC ID token. Defaults to the registry URL.')
-        .action((extensionFile: string, { target, packagePath, baseContentUrl, baseImagesUrl, yarn, followSymlinks, preRelease, allowMissingRepository, dependencies, skipDuplicate, packageVersion, trustedPublishing, idToken, oidcAudience }) => {
+        .option('--registrationCode <code>', 'The registration code of a pending trusted publisher (a private repository); completes its registration on the first publish.')
+        .action((extensionFile: string, { target, packagePath, baseContentUrl, baseImagesUrl, yarn, followSymlinks, preRelease, allowMissingRepository, dependencies, skipDuplicate, packageVersion, trustedPublishing, idToken, oidcAudience, registrationCode }) => {
             if (extensionFile !== undefined && packagePath !== undefined) {
                 console.error('\u274c  Please specify either a package file or a package path, but not both.\n');
                 publishCmd.help();
             }
-            if (extensionFile !== undefined && target !== undefined) {
-                console.warn("Ignoring option '--target' for prepackaged extension.");
-                target = undefined;
-            }
-            if (extensionFile !== undefined && baseContentUrl !== undefined)
-                console.warn("Ignoring option '--baseContentUrl' for prepackaged extension.");
-            if (extensionFile !== undefined && baseImagesUrl !== undefined)
-                console.warn("Ignoring option '--baseImagesUrl' for prepackaged extension.");
-            if (extensionFile !== undefined && yarn !== undefined)
-                console.warn("Ignoring option '--yarn' for prepackaged extension.");
-            if (extensionFile !== undefined && followSymlinks !== undefined)
-                console.warn("Ignoring option '--follow-symlinks' for prepackaged extension.");
-            if (extensionFile !== undefined && packageVersion !== undefined)
-                console.warn("Ignoring option '--packageVersion' for prepackaged extension.");
-            if (extensionFile !== undefined && allowMissingRepository !== undefined)
-                console.warn("Ignoring option '--allow-missing-repository' for prepackaged extension.");
-            const { registryUrl, pat } = program.opts();
-            publish({ extensionFile, registryUrl, pat, targets: typeof target === 'string' ? [target] : target, packagePath: typeof packagePath === 'string' ? [packagePath] : packagePath, baseContentUrl, baseImagesUrl, yarn, followSymlinks, preRelease, allowMissingRepository, dependencies, skipDuplicate, packageVersion, trustedPublishing, idToken, oidcAudience })
+            const { registryUrl, pat, debug } = program.opts();
+            publish({ extensionFile, registryUrl, pat, targets: typeof target === 'string' ? [target] : target, packagePath: typeof packagePath === 'string' ? [packagePath] : packagePath, baseContentUrl, baseImagesUrl, yarn, followSymlinks, preRelease, allowMissingRepository, dependencies, skipDuplicate, packageVersion, trustedPublishing, idToken, oidcAudience, registrationCode })
                 .then(results => {
                     const reasons = results.filter(result => result.status === 'rejected')
                         .map(rejectedResult => rejectedResult.reason);
@@ -95,14 +84,15 @@ module.exports = function (argv: string[]): void {
                     if (reasons.length > 0) {
                         const message = 'See the documentation for more information:\n'
                             + 'https://github.com/eclipse/openvsx/wiki/Publishing-Extensions';
-                        const errorHandler = handleError(program.debug, message, false);
+                        const errorHandler = handleError(debug, message, false);
                         for (const reason of reasons) {
                             errorHandler(reason);
                         }
 
                         process.exit(1);
                     }
-                });
+                })
+                .catch(handleError(debug));
         });
 
     const unpublishCmd = program.command('unpublish [namespace.extension]');
@@ -111,7 +101,7 @@ module.exports = function (argv: string[]): void {
         .option('-t, --target <targets...>', 'Only delete the given target architectures of the given versions.')
         .option('-f, --force', 'Skip the confirmation prompt.')
         .action((extensionId: string | undefined, { versions, target, force }) => {
-            const { registryUrl, pat } = program.opts();
+            const { registryUrl, pat, debug } = program.opts();
             unpublish({
                 extensionId,
                 versions: typeof versions === 'string' ? [versions] : versions,
@@ -119,7 +109,7 @@ module.exports = function (argv: string[]): void {
                 force,
                 registryUrl,
                 pat
-            }).catch(handleError(program.debug));
+            }).catch(handleError(debug));
         });
 
     const searchCmd = program.command('search [text]');
@@ -136,17 +126,17 @@ module.exports = function (argv: string[]): void {
         .option('--sort-order <order>', `Sort order: ${SORT_ORDERS.join(', ')}.`)
         .option('--json', 'Print the raw results as JSON.')
         .action((text: string | undefined, { category, target, size, offset, sortBy, sortOrder, json }) => {
-            const { registryUrl } = program.opts();
+            const { registryUrl, debug } = program.opts();
             search({ text, category, target, size, offset, sortBy, sortOrder, json, registryUrl })
-                .catch(handleError(program.debug));
+                .catch(handleError(debug));
         });
 
     const listCmd = program.command('list <namespace>');
     listCmd.description('List the extensions published in a namespace.')
         .option('--json', 'Print the raw namespace metadata as JSON.')
         .action((namespace: string, { json }) => {
-            const { registryUrl } = program.opts();
-            list({ namespace, json, registryUrl }).catch(handleError(program.debug));
+            const { registryUrl, debug } = program.opts();
+            list({ namespace, json, registryUrl }).catch(handleError(debug));
         });
 
     const showCmd = program.command('show <namespace.extension[@version]>');
@@ -155,8 +145,8 @@ module.exports = function (argv: string[]): void {
         .option('--all-versions', 'List every published version instead of the most recent few.')
         .option('--json', 'Print the raw metadata as JSON.')
         .action((extensionId: string, { target, allVersions, json }) => {
-            const { registryUrl } = program.opts();
-            show({ extensionId, target, allVersions, json, registryUrl }).catch(handleError(program.debug));
+            const { registryUrl, debug } = program.opts();
+            show({ extensionId, target, allVersions, json, registryUrl }).catch(handleError(debug));
         });
 
     const getCmd = program.command('get <namespace.extension>');
@@ -166,18 +156,18 @@ module.exports = function (argv: string[]): void {
         .option('-o, --output <path>', 'Save the output in the specified file or directory.')
         .option('--metadata', 'Print the extension\'s metadata instead of downloading it.')
         .action((extensionId: string, { target, versionRange, output, metadata }) => {
-            const { registryUrl } = program.opts();
+            const { registryUrl, debug } = program.opts();
             getExtension({ extensionId, target: target, version: versionRange, registryUrl, output, metadata })
-                .catch(handleError(program.debug));
+                .catch(handleError(debug));
         });
 
     const verifyCmd = program.command('verify <extension.vsix>');
     verifyCmd.description('Verify a downloaded package\'s signature against the registry\'s public key.')
         .option('-t, --target <target>', 'Target architecture')
         .action((packagePath: string, { target }) => {
-            const { registryUrl } = program.opts();
+            const { registryUrl, debug } = program.opts();
             verify({ packagePath, target, registryUrl })
-                .catch(handleError(program.debug));
+                .catch(handleError(debug));
         });
 
     const verifySignatureCmd = program.command('verify-signature');
@@ -187,43 +177,44 @@ module.exports = function (argv: string[]): void {
         .requiredOption('-s, --signaturePath <path>', 'Path to the signature file.')
         .requiredOption('-k, --publicKeyPath <path>', 'Path to the registry\'s public key file.')
         .action(({ packagePath, manifestPath, signaturePath, publicKeyPath }) => {
+            const { debug } = program.opts();
             verifySignature({ packagePath, manifestPath, signaturePath, publicKeyPath })
-                .catch(handleError(program.debug));
+                .catch(handleError(debug));
         });
 
     const loginCmd = program.command('login <namespace>');
     loginCmd.description('Adds a namespace to the list of known namespaces')
         .action((namespace: string) => {
-            const { registryUrl, pat } = program.opts();
-            login({ namespace, registryUrl, pat }).catch(handleError(program.debug));
+            const { registryUrl, pat, debug } = program.opts();
+            login({ namespace, registryUrl, pat }).catch(handleError(debug));
         });
 
     const logoutCmd = program.command('logout <namespace>');
     logoutCmd.description('Removes a namespace from the list of known namespaces')
         .action((namespace: string) => {
-            logout(namespace).catch(handleError(program.debug));
-        });
-
-    program
-        .command('*', '', { noHelp: true })
-        .action((cmd: commander.Command) => {
-            const availableCommands = program.commands.map((c: any) => c._name) as string[];
-            const actualCommand = cmd.args[0];
-            if (actualCommand) {
-                const suggestion = availableCommands.find(c => leven(c, actualCommand) < c.length * 0.4);
-                if (suggestion)
-                    console.error(`Unknown command '${actualCommand}', did you mean '${suggestion}'?\n`);
-                else
-                    console.error(`Unknown command '${actualCommand}'.\n`);
-            } else {
-                console.error('Unknown command.');
-            }
-            program.help();
+            const { debug } = program.opts();
+            logout(namespace).catch(handleError(debug));
         });
 
-    program.parse(argv);
+    // 'command:*' is deprecated in favor of catching the commander.unknownCommand error, but that
+    // error is reported (message written, process exited) by commander itself before a catch runs,
+    // so it can't reproduce this suggestion wording. Still supported for backwards compatibility.
+    program.on('command:*', (operands: string[]) => {
+        const availableCommands = program.commands.map(c => c.name());
+        const actualCommand = operands[0];
+        const suggestion = availableCommands.find(c => levenshtein(c, actualCommand) < c.length * 0.4);
+        if (suggestion)
+            console.error(`Unknown command '${actualCommand}', did you mean '${suggestion}'?\n`);
+        else
+            console.error(`Unknown command '${actualCommand}'.\n`);
+        process.exitCode = 1;
+        program.help();
+    });
 
-    if (process.argv.length <= 2) {
+    if (argv.length <= 2) {
+        // Commander 14 would otherwise print this to stderr and exit 1 during program.parse(argv) below.
         program.help();
     }
+
+    program.parse(argv);
 };

package/src/oidc.ts

@@ -11,10 +11,9 @@
  * SPDX-License-Identifier: EPL-2.0
  *****************************************************************************/
 
-import * as http from 'http';
-import * as followRedirects from 'follow-redirects';
+import { getJson } from './http';
 import { TrustedPublishingOptions } from './trusted-publishing-options';
-import { configuredTimeout, redactUrl, statusError } from './util';
+import { configuredTimeout } from './util';
 
 /**
  * Whether an OIDC ID token can be obtained without user interaction.
@@ -48,59 +47,18 @@ async function getGitHubActionsIdToken(audience: string): Promise<string> {
     // the request URL already carries an api-version query parameter, so keep its query intact
     const url = new URL(process.env.ACTIONS_ID_TOKEN_REQUEST_URL!);
     url.searchParams.set('audience', audience);
+    // Sent with only these headers, so none of the registry's credentials reach the CI system's
+    // token service. OVSX_TIMEOUT still applies, as there are no registry options to read it from.
     const response = await getJson<GitHubIdTokenResponse>(url, {
         'Authorization': `Bearer ${process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN}`,
         'Accept': 'application/json'
-    });
+    }, configuredTimeout());
     if (!response.value) {
         throw new Error('GitHub Actions did not return an OIDC ID token.');
     }
     return response.value;
 }
 
-/**
- * Minimal JSON GET that is not bound to the registry: the request must not carry any registry
- * credentials, as it is sent to the CI system's token service.
- */
-function getJson<T>(url: URL, headers: http.OutgoingHttpHeaders): Promise<T> {
-    return new Promise((resolve, reject) => {
-        const protocol = url.protocol === 'https:' ? followRedirects.https : followRedirects.http;
-        // OVSX_TIMEOUT covers this request too. Read here rather than taken from the registry's
-        // options, since this one carries none of the registry's configuration - only the clock is
-        // shared, and having two of those to explain would be worse.
-        const timeout = configuredTimeout();
-        const request = protocol.request(url, { method: 'GET', headers, timeout }, response => {
-            response.setEncoding('utf-8');
-            let json = '';
-            // See Registry.getJsonResponse: a connection lost mid-body never fires 'end', so the
-            // response's own error has to be what settles the promise.
-            response.on('error', reject);
-            response.on('data', chunk => json += chunk);
-            response.on('end', () => {
-                if (response.statusCode !== undefined && (response.statusCode < 200 || response.statusCode > 299)) {
-                    reject(statusError(response));
-                } else {
-                    try {
-                        resolve(JSON.parse(json));
-                    } catch (err) {
-                        reject(err);
-                    }
-                }
-            });
-        });
-        request.on('error', reject);
-        // The timeout option only raises an event, so the request has to be destroyed for it to mean
-        // anything; the error then arrives at the handler above.
-        request.on('timeout', () => {
-            // Rejected before the teardown, so the timeout is what the caller sees rather than
-            // whichever error destroying the request happens to raise first.
-            reject(new Error(`No response from ${redactUrl(url)} for ${timeout} ms.`));
-            request.destroy();
-        });
-        request.end();
-    });
-}
-
 interface GitHubIdTokenResponse {
     count?: number;
     value?: string;

package/src/pat.ts

@@ -38,19 +38,32 @@ export async function requestPAT(namespace: string, options: CreateNamespaceOpti
     return pat;
 }
 
-export async function getPAT(namespace: string, options: CreateNamespaceOptions | PublishOptions | VerifyPatOptions, verify: boolean = true): Promise<string> {
+export interface ResolvedPAT {
+    pat: string;
+    /** Stores a prompted token, warning instead of throwing; call it only once the registry has accepted the token. */
+    save(): Promise<void>;
+}
+
+export async function getPAT(namespace: string, options: CreateNamespaceOptions | PublishOptions | VerifyPatOptions, verify: boolean = true): Promise<ResolvedPAT> {
+    const nothingToSave = async () => undefined;
     if (options?.pat) {
-        return options.pat;
+        return { pat: options.pat, save: nothingToSave };
     }
 
     const store = await openDefaultStore();
-    let pat = await store.get(namespace);
-    if (pat) {
-        return pat;
+    const stored = await store.get(namespace);
+    if (stored) {
+        return { pat: stored, save: nothingToSave };
     }
 
-    pat = await requestPAT(namespace, options, verify);
-    await store.add(namespace, pat);
-
-    return pat;
+    const pat = await requestPAT(namespace, options, verify);
+    // a storage failure must not turn a completed registry operation into a reported failure
+    const save = async () => {
+        try {
+            await store.add(namespace, pat);
+        } catch (e) {
+            console.warn(`Could not store the token: ${e instanceof Error ? e.message : e}`);
+        }
+    };
+    return { pat, save };
 }