{"record":{"id":"19f4c4f5d6baecec","repo":"oven-sh/bun","slug":"tarballhttp402","errorCode":null,"errorMessage":"TarballHTTP402","messagePattern":"TarballHTTP402","errorType":"error_code","errorClass":"bun_install::Error","httpStatus":402,"severity":"error","filePath":"src/install/error.rs","lineNumber":23,"sourceCode":"    #[error(\"AccessDenied\")]\n    AccessDenied,\n    #[error(\"NotDir\")]\n    NotDir,\n    #[error(\"NameTooLong\")]\n    NameTooLong,\n    #[error(\"SymLinkLoop\")]\n    SymLinkLoop,\n    #[error(\"SystemFdQuotaExceeded\")]\n    SystemFdQuotaExceeded,\n    #[error(\"SystemResources\")]\n    SystemResources,\n    #[error(\"DeviceBusy\")]\n    DeviceBusy,\n    #[error(\"TarballHTTP400\")]\n    TarballHTTP400,\n    #[error(\"TarballHTTP401\")]\n    TarballHTTP401,\n    #[error(\"TarballHTTP402\")]\n    TarballHTTP402,\n    #[error(\"TarballHTTP403\")]\n    TarballHTTP403,\n    #[error(\"TarballHTTP404\")]\n    TarballHTTP404,\n    #[error(\"TarballHTTP4xx\")]\n    TarballHTTP4xx,\n    #[error(\"TarballHTTP5xx\")]\n    TarballHTTP5xx,\n    #[error(\"TarballFailedToExtract\")]\n    TarballFailedToExtract,\n    #[error(\"TarballFailedToDownload\")]\n    TarballFailedToDownload,\n    #[error(\"BadRequest\")]\n    BadRequest,\n    #[error(\"TooManyRequests\")]\n    TooManyRequests,\n    #[error(\"HTTPInternalServerError\")]","sourceCodeStart":5,"sourceCodeEnd":41,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/install/error.rs#L5-L41","documentation":"The registry returned 402 Payment Required for the tarball. npm uses this for private packages when the owning org's billing or seat situation denies access even with a valid token — the registry refuses to serve the artifact on the current plan.","triggerScenarios":"Installing a private npm package after the org's paid plan lapsed, the seat was removed, or the token's user was dropped from the org; some proxies also use 402 for quota-style denials.","commonSituations":"Org billing card expired; license seats reallocated; a teammate's token still referencing a package the org no longer pays for.","solutions":["Fix the org's billing/seats in the npm account settings","Confirm the token's user still has access to the package's org","Publish the package to a self-hosted registry you control for guaranteed availability","As a stopgap, vendor the package or pin a public equivalent"],"exampleFix":"# before\nbun add @corp/private-pkg   # org seat lapsed -> TarballHTTP402\n\n# after\n# restore the seat in npm org settings, then\nbun add @corp/private-pkg","handlingStrategy":"fallback","validationCode":"const res = await fetch(tarballUrl, { headers: { Authorization: `Bearer ${process.env.NPM_TOKEN}` } });\nif (res.status === 402) {\n  console.error(\"registry demands payment for this artifact; check org billing/seats\");\n  process.exit(1);\n}","typeGuard":null,"tryCatchPattern":"const p = Bun.spawnSync([\"bun\", \"install\"]);\nif (p.stderr.toString().includes(\"TarballHTTP402\")) {\n  // fall back to the self-hosted mirror that serves the same package\n  await Bun.write(\".npmrc\", \"@corp:registry=https://npm.corp.internal\\n\");\n  Bun.spawnSync([\"bun\", \"install\"]);\n}","preventionTips":["Monitor org seat and billing status","Mirror critical private packages to a registry you control","Document each private package's plan requirements in the repo"],"tags":["install","network","registry","billing","http-402"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}