@genesislcap/pbc-reconciliation-ui 0.0.21 → 0.0.23

package/.gradle/npm/npm-v10.1.0/lib/node_modules/npm/node_modules/pacote/lib/git.js

@@ -1,327 +0,0 @@
-const Fetcher = require('./fetcher.js')
-const FileFetcher = require('./file.js')
-const RemoteFetcher = require('./remote.js')
-const DirFetcher = require('./dir.js')
-const hashre = /^[a-f0-9]{40}$/
-const git = require('@npmcli/git')
-const pickManifest = require('npm-pick-manifest')
-const npa = require('npm-package-arg')
-const { Minipass } = require('minipass')
-const cacache = require('cacache')
-const log = require('proc-log')
-const npm = require('./util/npm.js')
-
-const _resolvedFromRepo = Symbol('_resolvedFromRepo')
-const _resolvedFromHosted = Symbol('_resolvedFromHosted')
-const _resolvedFromClone = Symbol('_resolvedFromClone')
-const _tarballFromResolved = Symbol.for('pacote.Fetcher._tarballFromResolved')
-const _addGitSha = Symbol('_addGitSha')
-const addGitSha = require('./util/add-git-sha.js')
-const _clone = Symbol('_clone')
-const _cloneHosted = Symbol('_cloneHosted')
-const _cloneRepo = Symbol('_cloneRepo')
-const _setResolvedWithSha = Symbol('_setResolvedWithSha')
-const _prepareDir = Symbol('_prepareDir')
-const _readPackageJson = Symbol.for('package.Fetcher._readPackageJson')
-
-// get the repository url.
-// prefer https if there's auth, since ssh will drop that.
-// otherwise, prefer ssh if available (more secure).
-// We have to add the git+ back because npa suppresses it.
-const repoUrl = (h, opts) =>
-  h.sshurl && !(h.https && h.auth) && addGitPlus(h.sshurl(opts)) ||
-  h.https && addGitPlus(h.https(opts))
-
-// add git+ to the url, but only one time.
-const addGitPlus = url => url && `git+${url}`.replace(/^(git\+)+/, 'git+')
-
-class GitFetcher extends Fetcher {
-  constructor (spec, opts) {
-    super(spec, opts)
-
-    // we never want to compare integrity for git dependencies: npm/rfcs#525
-    if (this.opts.integrity) {
-      delete this.opts.integrity
-      log.warn(`skipping integrity check for git dependency ${this.spec.fetchSpec}`)
-    }
-
-    this.resolvedRef = null
-    if (this.spec.hosted) {
-      this.from = this.spec.hosted.shortcut({ noCommittish: false })
-    }
-
-    // shortcut: avoid full clone when we can go straight to the tgz
-    // if we have the full sha and it's a hosted git platform
-    if (this.spec.gitCommittish && hashre.test(this.spec.gitCommittish)) {
-      this.resolvedSha = this.spec.gitCommittish
-      // use hosted.tarball() when we shell to RemoteFetcher later
-      this.resolved = this.spec.hosted
-        ? repoUrl(this.spec.hosted, { noCommittish: false })
-        : this.spec.rawSpec
-    } else {
-      this.resolvedSha = ''
-    }
-
-    this.Arborist = opts.Arborist || null
-  }
-
-  // just exposed to make it easier to test all the combinations
-  static repoUrl (hosted, opts) {
-    return repoUrl(hosted, opts)
-  }
-
-  get types () {
-    return ['git']
-  }
-
-  resolve () {
-    // likely a hosted git repo with a sha, so get the tarball url
-    // but in general, no reason to resolve() more than necessary!
-    if (this.resolved) {
-      return super.resolve()
-    }
-
-    // fetch the git repo and then look at the current hash
-    const h = this.spec.hosted
-    // try to use ssh, fall back to git.
-    return h ? this[_resolvedFromHosted](h)
-      : this[_resolvedFromRepo](this.spec.fetchSpec)
-  }
-
-  // first try https, since that's faster and passphrase-less for
-  // public repos, and supports private repos when auth is provided.
-  // Fall back to SSH to support private repos
-  // NB: we always store the https url in resolved field if auth
-  // is present, otherwise ssh if the hosted type provides it
-  [_resolvedFromHosted] (hosted) {
-    return this[_resolvedFromRepo](hosted.https && hosted.https())
-      .catch(er => {
-        // Throw early since we know pathspec errors will fail again if retried
-        if (er instanceof git.errors.GitPathspecError) {
-          throw er
-        }
-        const ssh = hosted.sshurl && hosted.sshurl()
-        // no fallthrough if we can't fall through or have https auth
-        if (!ssh || hosted.auth) {
-          throw er
-        }
-        return this[_resolvedFromRepo](ssh)
-      })
-  }
-
-  [_resolvedFromRepo] (gitRemote) {
-    // XXX make this a custom error class
-    if (!gitRemote) {
-      return Promise.reject(new Error(`No git url for ${this.spec}`))
-    }
-    const gitRange = this.spec.gitRange
-    const name = this.spec.name
-    return git.revs(gitRemote, this.opts).then(remoteRefs => {
-      return gitRange ? pickManifest({
-        versions: remoteRefs.versions,
-        'dist-tags': remoteRefs['dist-tags'],
-        name,
-      }, gitRange, this.opts)
-        : this.spec.gitCommittish ?
-          remoteRefs.refs[this.spec.gitCommittish] ||
-          remoteRefs.refs[remoteRefs.shas[this.spec.gitCommittish]]
-          : remoteRefs.refs.HEAD // no git committish, get default head
-    }).then(revDoc => {
-      // the committish provided isn't in the rev list
-      // things like HEAD~3 or @yesterday can land here.
-      if (!revDoc || !revDoc.sha) {
-        return this[_resolvedFromClone]()
-      }
-
-      this.resolvedRef = revDoc
-      this.resolvedSha = revDoc.sha
-      this[_addGitSha](revDoc.sha)
-      return this.resolved
-    })
-  }
-
-  [_setResolvedWithSha] (withSha) {
-    // we haven't cloned, so a tgz download is still faster
-    // of course, if it's not a known host, we can't do that.
-    this.resolved = !this.spec.hosted ? withSha
-      : repoUrl(npa(withSha).hosted, { noCommittish: false })
-  }
-
-  // when we get the git sha, we affix it to our spec to build up
-  // either a git url with a hash, or a tarball download URL
-  [_addGitSha] (sha) {
-    this[_setResolvedWithSha](addGitSha(this.spec, sha))
-  }
-
-  [_resolvedFromClone] () {
-    // do a full or shallow clone, then look at the HEAD
-    // kind of wasteful, but no other option, really
-    return this[_clone](dir => this.resolved)
-  }
-
-  [_prepareDir] (dir) {
-    return this[_readPackageJson](dir + '/package.json').then(mani => {
-      // no need if we aren't going to do any preparation.
-      const scripts = mani.scripts
-      if (!mani.workspaces && (!scripts || !(
-        scripts.postinstall ||
-          scripts.build ||
-          scripts.preinstall ||
-          scripts.install ||
-          scripts.prepack ||
-          scripts.prepare))) {
-        return
-      }
-
-      // to avoid cases where we have an cycle of git deps that depend
-      // on one another, we only ever do preparation for one instance
-      // of a given git dep along the chain of installations.
-      // Note that this does mean that a dependency MAY in theory end up
-      // trying to run its prepare script using a dependency that has not
-      // been properly prepared itself, but that edge case is smaller
-      // and less hazardous than a fork bomb of npm and git commands.
-      const noPrepare = !process.env._PACOTE_NO_PREPARE_ ? []
-        : process.env._PACOTE_NO_PREPARE_.split('\n')
-      if (noPrepare.includes(this.resolved)) {
-        log.info('prepare', 'skip prepare, already seen', this.resolved)
-        return
-      }
-      noPrepare.push(this.resolved)
-
-      // the DirFetcher will do its own preparation to run the prepare scripts
-      // All we have to do is put the deps in place so that it can succeed.
-      return npm(
-        this.npmBin,
-        [].concat(this.npmInstallCmd).concat(this.npmCliConfig),
-        dir,
-        { ...process.env, _PACOTE_NO_PREPARE_: noPrepare.join('\n') },
-        { message: 'git dep preparation failed' }
-      )
-    })
-  }
-
-  [_tarballFromResolved] () {
-    const stream = new Minipass()
-    stream.resolved = this.resolved
-    stream.from = this.from
-
-    // check it out and then shell out to the DirFetcher tarball packer
-    this[_clone](dir => this[_prepareDir](dir)
-      .then(() => new Promise((res, rej) => {
-        if (!this.Arborist) {
-          throw new Error('GitFetcher requires an Arborist constructor to pack a tarball')
-        }
-        const df = new DirFetcher(`file:${dir}`, {
-          ...this.opts,
-          Arborist: this.Arborist,
-          resolved: null,
-          integrity: null,
-        })
-        const dirStream = df[_tarballFromResolved]()
-        dirStream.on('error', rej)
-        dirStream.on('end', res)
-        dirStream.pipe(stream)
-      }))).catch(
-      /* istanbul ignore next: very unlikely and hard to test */
-      er => stream.emit('error', er)
-    )
-    return stream
-  }
-
-  // clone a git repo into a temp folder (or fetch and unpack if possible)
-  // handler accepts a directory, and returns a promise that resolves
-  // when we're done with it, at which point, cacache deletes it
-  //
-  // TODO: after cloning, create a tarball of the folder, and add to the cache
-  // with cacache.put.stream(), using a key that's deterministic based on the
-  // spec and repo, so that we don't ever clone the same thing multiple times.
-  [_clone] (handler, tarballOk = true) {
-    const o = { tmpPrefix: 'git-clone' }
-    const ref = this.resolvedSha || this.spec.gitCommittish
-    const h = this.spec.hosted
-    const resolved = this.resolved
-
-    // can be set manually to false to fall back to actual git clone
-    tarballOk = tarballOk &&
-      h && resolved === repoUrl(h, { noCommittish: false }) && h.tarball
-
-    return cacache.tmp.withTmp(this.cache, o, async tmp => {
-      // if we're resolved, and have a tarball url, shell out to RemoteFetcher
-      if (tarballOk) {
-        const nameat = this.spec.name ? `${this.spec.name}@` : ''
-        return new RemoteFetcher(h.tarball({ noCommittish: false }), {
-          ...this.opts,
-          allowGitIgnore: true,
-          pkgid: `git:${nameat}${this.resolved}`,
-          resolved: this.resolved,
-          integrity: null, // it'll always be different, if we have one
-        }).extract(tmp).then(() => handler(tmp), er => {
-          // fall back to ssh download if tarball fails
-          if (er.constructor.name.match(/^Http/)) {
-            return this[_clone](handler, false)
-          } else {
-            throw er
-          }
-        })
-      }
-
-      const sha = await (
-        h ? this[_cloneHosted](ref, tmp)
-        : this[_cloneRepo](this.spec.fetchSpec, ref, tmp)
-      )
-      this.resolvedSha = sha
-      if (!this.resolved) {
-        await this[_addGitSha](sha)
-      }
-      return handler(tmp)
-    })
-  }
-
-  // first try https, since that's faster and passphrase-less for
-  // public repos, and supports private repos when auth is provided.
-  // Fall back to SSH to support private repos
-  // NB: we always store the https url in resolved field if auth
-  // is present, otherwise ssh if the hosted type provides it
-  [_cloneHosted] (ref, tmp) {
-    const hosted = this.spec.hosted
-    return this[_cloneRepo](hosted.https({ noCommittish: true }), ref, tmp)
-      .catch(er => {
-        // Throw early since we know pathspec errors will fail again if retried
-        if (er instanceof git.errors.GitPathspecError) {
-          throw er
-        }
-        const ssh = hosted.sshurl && hosted.sshurl({ noCommittish: true })
-        // no fallthrough if we can't fall through or have https auth
-        if (!ssh || hosted.auth) {
-          throw er
-        }
-        return this[_cloneRepo](ssh, ref, tmp)
-      })
-  }
-
-  [_cloneRepo] (repo, ref, tmp) {
-    const { opts, spec } = this
-    return git.clone(repo, ref, tmp, { ...opts, spec })
-  }
-
-  manifest () {
-    if (this.package) {
-      return Promise.resolve(this.package)
-    }
-
-    return this.spec.hosted && this.resolved
-      ? FileFetcher.prototype.manifest.apply(this)
-      : this[_clone](dir =>
-        this[_readPackageJson](dir + '/package.json')
-          .then(mani => this.package = {
-            ...mani,
-            _resolved: this.resolved,
-            _from: this.from,
-          }))
-  }
-
-  packument () {
-    return FileFetcher.prototype.packument.apply(this)
-  }
-}
-module.exports = GitFetcher

package/.gradle/npm/npm-v10.1.0/lib/node_modules/npm/node_modules/pacote/lib/index.js

@@ -1,23 +0,0 @@
-const { get } = require('./fetcher.js')
-const GitFetcher = require('./git.js')
-const RegistryFetcher = require('./registry.js')
-const FileFetcher = require('./file.js')
-const DirFetcher = require('./dir.js')
-const RemoteFetcher = require('./remote.js')
-
-module.exports = {
-  GitFetcher,
-  RegistryFetcher,
-  FileFetcher,
-  DirFetcher,
-  RemoteFetcher,
-  resolve: (spec, opts) => get(spec, opts).resolve(),
-  extract: (spec, dest, opts) => get(spec, opts).extract(dest),
-  manifest: (spec, opts) => get(spec, opts).manifest(),
-  tarball: (spec, opts) => get(spec, opts).tarball(),
-  packument: (spec, opts) => get(spec, opts).packument(),
-}
-module.exports.tarball.stream = (spec, handler, opts) =>
-  get(spec, opts).tarballStream(handler)
-module.exports.tarball.file = (spec, dest, opts) =>
-  get(spec, opts).tarballFile(dest)

package/.gradle/npm/npm-v10.1.0/lib/node_modules/npm/node_modules/pacote/lib/registry.js

@@ -1,344 +0,0 @@
-const Fetcher = require('./fetcher.js')
-const RemoteFetcher = require('./remote.js')
-const _tarballFromResolved = Symbol.for('pacote.Fetcher._tarballFromResolved')
-const pacoteVersion = require('../package.json').version
-const removeTrailingSlashes = require('./util/trailing-slashes.js')
-const rpj = require('read-package-json-fast')
-const pickManifest = require('npm-pick-manifest')
-const ssri = require('ssri')
-const crypto = require('crypto')
-const npa = require('npm-package-arg')
-const sigstore = require('sigstore')
-
-// Corgis are cute. 🐕🐶
-const corgiDoc = 'application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, */*'
-const fullDoc = 'application/json'
-
-const fetch = require('npm-registry-fetch')
-
-const _headers = Symbol('_headers')
-class RegistryFetcher extends Fetcher {
-  constructor (spec, opts) {
-    super(spec, opts)
-
-    // you usually don't want to fetch the same packument multiple times in
-    // the span of a given script or command, no matter how many pacote calls
-    // are made, so this lets us avoid doing that.  It's only relevant for
-    // registry fetchers, because other types simulate their packument from
-    // the manifest, which they memoize on this.package, so it's very cheap
-    // already.
-    this.packumentCache = this.opts.packumentCache || null
-
-    this.registry = fetch.pickRegistry(spec, opts)
-    this.packumentUrl = removeTrailingSlashes(this.registry) + '/' +
-      this.spec.escapedName
-
-    const parsed = new URL(this.registry)
-    const regKey = `//${parsed.host}${parsed.pathname}`
-    // unlike the nerf-darted auth keys, this one does *not* allow a mismatch
-    // of trailing slashes.  It must match exactly.
-    if (this.opts[`${regKey}:_keys`]) {
-      this.registryKeys = this.opts[`${regKey}:_keys`]
-    }
-
-    // XXX pacote <=9 has some logic to ignore opts.resolved if
-    // the resolved URL doesn't go to the same registry.
-    // Consider reproducing that here, to throw away this.resolved
-    // in that case.
-  }
-
-  async resolve () {
-    // fetching the manifest sets resolved and (if present) integrity
-    await this.manifest()
-    if (!this.resolved) {
-      throw Object.assign(
-        new Error('Invalid package manifest: no `dist.tarball` field'),
-        { package: this.spec.toString() }
-      )
-    }
-    return this.resolved
-  }
-
-  [_headers] () {
-    return {
-      // npm will override UA, but ensure that we always send *something*
-      'user-agent': this.opts.userAgent ||
-        `pacote/${pacoteVersion} node/${process.version}`,
-      ...(this.opts.headers || {}),
-      'pacote-version': pacoteVersion,
-      'pacote-req-type': 'packument',
-      'pacote-pkg-id': `registry:${this.spec.name}`,
-      accept: this.fullMetadata ? fullDoc : corgiDoc,
-    }
-  }
-
-  async packument () {
-    // note this might be either an in-flight promise for a request,
-    // or the actual packument, but we never want to make more than
-    // one request at a time for the same thing regardless.
-    if (this.packumentCache && this.packumentCache.has(this.packumentUrl)) {
-      return this.packumentCache.get(this.packumentUrl)
-    }
-
-    // npm-registry-fetch the packument
-    // set the appropriate header for corgis if fullMetadata isn't set
-    // return the res.json() promise
-    try {
-      const res = await fetch(this.packumentUrl, {
-        ...this.opts,
-        headers: this[_headers](),
-        spec: this.spec,
-        // never check integrity for packuments themselves
-        integrity: null,
-      })
-      const packument = await res.json()
-      packument._contentLength = +res.headers.get('content-length')
-      if (this.packumentCache) {
-        this.packumentCache.set(this.packumentUrl, packument)
-      }
-      return packument
-    } catch (err) {
-      if (this.packumentCache) {
-        this.packumentCache.delete(this.packumentUrl)
-      }
-      if (err.code !== 'E404' || this.fullMetadata) {
-        throw err
-      }
-      // possible that corgis are not supported by this registry
-      this.fullMetadata = true
-      return this.packument()
-    }
-  }
-
-  async manifest () {
-    if (this.package) {
-      return this.package
-    }
-
-    const packument = await this.packument()
-    let mani = await pickManifest(packument, this.spec.fetchSpec, {
-      ...this.opts,
-      defaultTag: this.defaultTag,
-      before: this.before,
-    })
-    mani = rpj.normalize(mani)
-    /* XXX add ETARGET and E403 revalidation of cached packuments here */
-
-    // add _resolved and _integrity from dist object
-    const { dist } = mani
-    if (dist) {
-      this.resolved = mani._resolved = dist.tarball
-      mani._from = this.from
-      const distIntegrity = dist.integrity ? ssri.parse(dist.integrity)
-        : dist.shasum ? ssri.fromHex(dist.shasum, 'sha1', { ...this.opts })
-        : null
-      if (distIntegrity) {
-        if (this.integrity && !this.integrity.match(distIntegrity)) {
-          // only bork if they have algos in common.
-          // otherwise we end up breaking if we have saved a sha512
-          // previously for the tarball, but the manifest only
-          // provides a sha1, which is possible for older publishes.
-          // Otherwise, this is almost certainly a case of holding it
-          // wrong, and will result in weird or insecure behavior
-          // later on when building package tree.
-          for (const algo of Object.keys(this.integrity)) {
-            if (distIntegrity[algo]) {
-              throw Object.assign(new Error(
-                `Integrity checksum failed when using ${algo}: ` +
-                `wanted ${this.integrity} but got ${distIntegrity}.`
-              ), { code: 'EINTEGRITY' })
-            }
-          }
-        }
-        // made it this far, the integrity is worthwhile.  accept it.
-        // the setter here will take care of merging it into what we already
-        // had.
-        this.integrity = distIntegrity
-      }
-    }
-    if (this.integrity) {
-      mani._integrity = String(this.integrity)
-      if (dist.signatures) {
-        if (this.opts.verifySignatures) {
-          // validate and throw on error, then set _signatures
-          const message = `${mani._id}:${mani._integrity}`
-          for (const signature of dist.signatures) {
-            const publicKey = this.registryKeys &&
-              this.registryKeys.filter(key => (key.keyid === signature.keyid))[0]
-            if (!publicKey) {
-              throw Object.assign(new Error(
-                  `${mani._id} has a registry signature with keyid: ${signature.keyid} ` +
-                  'but no corresponding public key can be found'
-              ), { code: 'EMISSINGSIGNATUREKEY' })
-            }
-            const validPublicKey =
-              !publicKey.expires || (Date.parse(publicKey.expires) > Date.now())
-            if (!validPublicKey) {
-              throw Object.assign(new Error(
-                  `${mani._id} has a registry signature with keyid: ${signature.keyid} ` +
-                  `but the corresponding public key has expired ${publicKey.expires}`
-              ), { code: 'EEXPIREDSIGNATUREKEY' })
-            }
-            const verifier = crypto.createVerify('SHA256')
-            verifier.write(message)
-            verifier.end()
-            const valid = verifier.verify(
-              publicKey.pemkey,
-              signature.sig,
-              'base64'
-            )
-            if (!valid) {
-              throw Object.assign(new Error(
-                  `${mani._id} has an invalid registry signature with ` +
-                  `keyid: ${publicKey.keyid} and signature: ${signature.sig}`
-              ), {
-                code: 'EINTEGRITYSIGNATURE',
-                keyid: publicKey.keyid,
-                signature: signature.sig,
-                resolved: mani._resolved,
-                integrity: mani._integrity,
-              })
-            }
-          }
-          mani._signatures = dist.signatures
-        } else {
-          mani._signatures = dist.signatures
-        }
-      }
-
-      if (dist.attestations) {
-        if (this.opts.verifyAttestations) {
-          // Always fetch attestations from the current registry host
-          const attestationsPath = new URL(dist.attestations.url).pathname
-          const attestationsUrl = removeTrailingSlashes(this.registry) + attestationsPath
-          const res = await fetch(attestationsUrl, {
-            ...this.opts,
-            // disable integrity check for attestations json payload, we check the
-            // integrity in the verification steps below
-            integrity: null,
-          })
-          const { attestations } = await res.json()
-          const bundles = attestations.map(({ predicateType, bundle }) => {
-            const statement = JSON.parse(
-              Buffer.from(bundle.dsseEnvelope.payload, 'base64').toString('utf8')
-            )
-            const keyid = bundle.dsseEnvelope.signatures[0].keyid
-            const signature = bundle.dsseEnvelope.signatures[0].sig
-
-            return {
-              predicateType,
-              bundle,
-              statement,
-              keyid,
-              signature,
-            }
-          })
-
-          const attestationKeyIds = bundles.map((b) => b.keyid).filter((k) => !!k)
-          const attestationRegistryKeys = (this.registryKeys || [])
-            .filter(key => attestationKeyIds.includes(key.keyid))
-          if (!attestationRegistryKeys.length) {
-            throw Object.assign(new Error(
-              `${mani._id} has attestations but no corresponding public key(s) can be found`
-            ), { code: 'EMISSINGSIGNATUREKEY' })
-          }
-
-          for (const { predicateType, bundle, keyid, signature, statement } of bundles) {
-            const publicKey = attestationRegistryKeys.find(key => key.keyid === keyid)
-            // Publish attestations have a keyid set and a valid public key must be found
-            if (keyid) {
-              if (!publicKey) {
-                throw Object.assign(new Error(
-                  `${mani._id} has attestations with keyid: ${keyid} ` +
-                  'but no corresponding public key can be found'
-                ), { code: 'EMISSINGSIGNATUREKEY' })
-              }
-
-              const validPublicKey =
-                !publicKey.expires || (Date.parse(publicKey.expires) > Date.now())
-              if (!validPublicKey) {
-                throw Object.assign(new Error(
-                  `${mani._id} has attestations with keyid: ${keyid} ` +
-                  `but the corresponding public key has expired ${publicKey.expires}`
-                ), { code: 'EEXPIREDSIGNATUREKEY' })
-              }
-            }
-
-            const subject = {
-              name: statement.subject[0].name,
-              sha512: statement.subject[0].digest.sha512,
-            }
-
-            // Only type 'version' can be turned into a PURL
-            const purl = this.spec.type === 'version' ? npa.toPurl(this.spec) : this.spec
-            // Verify the statement subject matches the package, version
-            if (subject.name !== purl) {
-              throw Object.assign(new Error(
-                `${mani._id} package name and version (PURL): ${purl} ` +
-                `doesn't match what was signed: ${subject.name}`
-              ), { code: 'EATTESTATIONSUBJECT' })
-            }
-
-            // Verify the statement subject matches the tarball integrity
-            const integrityHexDigest = ssri.parse(this.integrity).hexDigest()
-            if (subject.sha512 !== integrityHexDigest) {
-              throw Object.assign(new Error(
-                `${mani._id} package integrity (hex digest): ` +
-                `${integrityHexDigest} ` +
-                `doesn't match what was signed: ${subject.sha512}`
-              ), { code: 'EATTESTATIONSUBJECT' })
-            }
-
-            try {
-              // Provenance attestations are signed with a signing certificate
-              // (including the key) so we don't need to return a public key.
-              //
-              // Publish attestations are signed with a keyid so we need to
-              // specify a public key from the keys endpoint: `registry-host.tld/-/npm/v1/keys`
-              const options = {
-                tufCachePath: this.tufCache,
-                keySelector: publicKey ? () => publicKey.pemkey : undefined,
-              }
-              await sigstore.verify(bundle, options)
-            } catch (e) {
-              throw Object.assign(new Error(
-                `${mani._id} failed to verify attestation: ${e.message}`
-              ), {
-                code: 'EATTESTATIONVERIFY',
-                predicateType,
-                keyid,
-                signature,
-                resolved: mani._resolved,
-                integrity: mani._integrity,
-              })
-            }
-          }
-          mani._attestations = dist.attestations
-        } else {
-          mani._attestations = dist.attestations
-        }
-      }
-    }
-
-    this.package = mani
-    return this.package
-  }
-
-  [_tarballFromResolved] () {
-    // we use a RemoteFetcher to get the actual tarball stream
-    return new RemoteFetcher(this.resolved, {
-      ...this.opts,
-      resolved: this.resolved,
-      pkgid: `registry:${this.spec.name}@${this.resolved}`,
-    })[_tarballFromResolved]()
-  }
-
-  get types () {
-    return [
-      'tag',
-      'version',
-      'range',
-    ]
-  }
-}
-module.exports = RegistryFetcher