@vltpkg/cli-js 1.0.2 → 1.0.3

package/chunk-G7UPIJAP.js

@@ -0,0 +1,903 @@
+var global = globalThis;
+import {Buffer} from "node:buffer";
+import {setTimeout as _vlt_setTimeout,clearTimeout as _vlt_clearTimeout,setImmediate as _vlt_setImmediate,clearImmediate as _vlt_clearImmediate,setInterval as _vlt_setInterval,clearInterval as _vlt_clearInterval} from "node:timers";
+globalThis.setTimeout = _vlt_setTimeout;
+globalThis.clearTimeout = _vlt_clearTimeout;
+globalThis.setImmediate = _vlt_setImmediate;
+globalThis.clearImmediate = _vlt_clearImmediate;
+globalThis.setInterval = _vlt_setInterval;
+globalThis.clearInterval = _vlt_clearInterval;
+import {createRequire as _vlt_createRequire} from "node:module";
+var require = _vlt_createRequire(import.meta.filename);
+import {
+  Qn,
+  require_lib
+} from "./chunk-FWKQ7YDF.js";
+import {
+  Monorepo,
+  PackageJson,
+  clone,
+  pickManifest,
+  resolve,
+  revs
+} from "./chunk-FFOXTPQA.js";
+import {
+  Spec
+} from "./chunk-XU5SMHXP.js";
+import {
+  XDG
+} from "./chunk-XNLSTHDK.js";
+import {
+  asPackument
+} from "./chunk-IITIX4ID.js";
+import {
+  error
+} from "./chunk-WZWDS3W4.js";
+import {
+  __toESM
+} from "./chunk-PZLD7RTK.js";
+
+// ../../src/package-info/src/index.ts
+var import_ssri = __toESM(require_lib(), 1);
+import { createHash, randomBytes } from "node:crypto";
+import {
+  mkdir,
+  readFile,
+  rm as rm2,
+  stat,
+  symlink,
+  unlink,
+  writeFile
+} from "node:fs/promises";
+import {
+  basename,
+  dirname,
+  resolve as pathResolve,
+  relative
+} from "node:path";
+
+// ../../src/package-info/src/rename.ts
+import { rename as fsRename, rm } from "node:fs/promises";
+var { platform } = process;
+var rename = platform !== "win32" ? fsRename : (async function(oldPath, newPath) {
+  let retries = 3;
+  const retry = async (er) => {
+    if (retries > 0 && er.code === "EPERM") {
+      retries--;
+      await rm(newPath, { recursive: true, force: true });
+      return fsRename(oldPath, newPath).then(() => {
+      }, retry);
+    } else {
+      throw er;
+    }
+  };
+  return fsRename(oldPath, newPath).then(() => {
+  }, retry);
+});
+
+// ../../src/package-info/src/index.ts
+var xdg = new XDG("vlt");
+var delimiter = "~";
+var manifestCacheMaxAge = 5 * 60 * 1e3;
+var noRegistryError = (spec) => error(
+  'No registry configured to resolve this spec. Set "registry" in vlt.json, pass --registry, or run `vlt login --registry=<url>`. See https://docs.vlt.sh/cli',
+  { code: "ECONFIG", spec }
+);
+var PackageInfoClient = class {
+  #registryClient;
+  #projectRoot;
+  #tarPool;
+  options;
+  #resolutions = /* @__PURE__ */ new Map();
+  packageJson;
+  monorepo;
+  #trustedIntegrities = /* @__PURE__ */ new Map();
+  #manifestCacheMinAge = Date.now() - manifestCacheMaxAge;
+  #cachePath;
+  // In-flight coalescing key is `${registry}${name}` — no representation
+  // component. Safe only because every caller requests the same full
+  // packument (see #fetchPackument).
+  #packumentPromises = /* @__PURE__ */ new Map();
+  // unique temp file names for atomic manifest cache writes
+  #manifestWriteRandom = randomBytes(6).toString("hex");
+  #manifestWriteCount = 0;
+  // cache paths already written this run. manifest() is called many
+  // times for the same cache key per install and content for a given
+  // path is deterministic within a run, so only the first write is
+  // needed. entries are removed when the on-disk file is invalidated
+  // so the refreshed manifest can be written again.
+  #manifestWritePaths = /* @__PURE__ */ new Set();
+  #registryClientPromise;
+  #tarPoolPromise;
+  async getRegistryClient() {
+    if (this.#registryClient) return this.#registryClient;
+    this.#registryClientPromise ??= import("./src-6OKPBJJT.js").then(({ RegistryClient }) => {
+      this.#registryClient = new RegistryClient(this.options);
+      return this.#registryClient;
+    });
+    return this.#registryClientPromise;
+  }
+  async getTarPool() {
+    if (this.#tarPool) return this.#tarPool;
+    this.#tarPoolPromise ??= import("./src-M5RRGKUM.js").then(
+      ({ Pool }) => {
+        this.#tarPool = new Pool();
+        return this.#tarPool;
+      }
+    );
+    return this.#tarPoolPromise;
+  }
+  constructor(options = {}) {
+    this.options = options;
+    this.#projectRoot = options.projectRoot || process.cwd();
+    this.packageJson = options.packageJson ?? new PackageJson();
+    const wsLoad = {
+      ...options.workspace?.length && { paths: options.workspace },
+      ...options["workspace-group"]?.length && {
+        groups: options["workspace-group"]
+      }
+    };
+    this.monorepo = options.monorepo ?? Monorepo.maybeLoad(this.#projectRoot, {
+      load: wsLoad,
+      packageJson: this.packageJson
+    });
+    this.#cachePath = options.cache ?? xdg.cache();
+    void mkdir(pathResolve(this.#cachePath, "package-info"), {
+      recursive: true
+    }).catch(() => {
+    });
+  }
+  async extract(spec, target, options = {}) {
+    if (typeof spec === "string")
+      spec = Spec.parse(spec, this.options);
+    const {
+      from = this.#projectRoot,
+      integrity,
+      resolved,
+      fromLockfile = false
+    } = options;
+    const f = spec.final;
+    const alreadyResolved = !!(integrity && resolved);
+    const r = alreadyResolved ? { resolved, integrity, spec } : await this.resolve(spec, options);
+    switch (f.type) {
+      case "git": {
+        const {
+          gitRemote,
+          gitCommittish,
+          remoteURL,
+          gitSelectorParsed
+        } = f;
+        if (!remoteURL) {
+          if (!gitRemote)
+            throw this.#resolveError(
+              spec,
+              options,
+              "no remote on git: specifier"
+            );
+          const { path } = gitSelectorParsed ?? {};
+          if (path !== void 0) {
+            const tmp = pathResolve(
+              dirname(target),
+              `.TEMP.${basename(target)}-${randomBytes(6).toString("hex")}`
+            );
+            await clone(gitRemote, gitCommittish, tmp, { spec });
+            const src = pathResolve(tmp, path);
+            await rename(src, target);
+            void rm2(tmp, { recursive: true, force: true });
+          } else {
+            await clone(gitRemote, gitCommittish, target, { spec });
+            void rm2(target + "/.git", { recursive: true });
+          }
+          return r;
+        }
+      }
+      case "registry": {
+        const fetchTarball = async (useCache) => {
+          const trustIntegrity = this.#trustedIntegrities.get(r.resolved) === r.integrity;
+          const response = await (await this.getRegistryClient()).request(r.resolved, {
+            integrity: r.integrity,
+            trustIntegrity,
+            ...useCache === false ? { useCache } : {}
+          });
+          if (response.statusCode !== 200) {
+            throw this.#resolveError(
+              spec,
+              options,
+              `Registry returned HTTP ${response.statusCode} when fetching the tarball for ${spec}. The resolved version may have been unpublished, or the registry may be misconfigured or unreachable.`,
+              {
+                url: r.resolved,
+                response
+              }
+            );
+          }
+          if (!trustIntegrity && response.checkIntegrity({ spec, url: resolved })) {
+            this.#trustedIntegrities.set(
+              r.resolved,
+              response.integrity
+            );
+          }
+          const buf2 = response.buffer();
+          if (r.integrity && !fromLockfile && !response.fromCache) {
+            const hash = createHash("sha512");
+            hash.update(buf2);
+            const computed = `sha512-${hash.digest("base64")}`;
+            if (computed !== r.integrity) {
+              throw error("Tarball integrity check failed", {
+                code: "EINTEGRITY",
+                spec,
+                url: r.resolved,
+                wanted: r.integrity,
+                found: computed
+              });
+            }
+          }
+          return buf2;
+        };
+        let buf;
+        try {
+          buf = await fetchTarball();
+        } catch (er) {
+          if (er instanceof Error && "cause" in er && er.cause?.code === "EINTEGRITY") {
+            buf = await fetchTarball(false);
+          } else {
+            throw er;
+          }
+        }
+        try {
+          await (await this.getTarPool()).unpack(buf, target);
+        } catch (er) {
+          throw this.#resolveError(
+            spec,
+            options,
+            "tar unpack failed",
+            { cause: er }
+          );
+        }
+        return r;
+      }
+      case "remote": {
+        const response = await (await this.getRegistryClient()).request(r.resolved);
+        if (response.statusCode !== 200) {
+          throw this.#resolveError(
+            spec,
+            options,
+            "failed to fetch remote tarball",
+            {
+              url: r.resolved,
+              response
+            }
+          );
+        }
+        const buf = response.buffer();
+        const computed = import_ssri.default.fromData(buf, { algorithms: ["sha512"] }).toString();
+        if (r.integrity && r.integrity !== computed) {
+          throw error("Integrity check failure", {
+            code: "EINTEGRITY",
+            spec,
+            url: r.resolved,
+            wanted: r.integrity,
+            found: computed
+          });
+        }
+        r.integrity = computed;
+        try {
+          await (await this.getTarPool()).unpack(buf, target);
+        } catch (er) {
+          throw this.#resolveError(
+            spec,
+            options,
+            "remote tar unpack failed",
+            { cause: er }
+          );
+        }
+        return r;
+      }
+      case "file": {
+        const { file } = f;
+        if (file === void 0)
+          throw this.#resolveError(spec, options, "no file path");
+        const path = pathResolve(from, file);
+        const st = await stat(path);
+        if (st.isFile()) {
+          try {
+            await (await this.getTarPool()).unpack(await this.tarball(spec, options), target);
+          } catch (er) {
+            throw this.#resolveError(
+              spec,
+              options,
+              "tar unpack failed",
+              { cause: er }
+            );
+          }
+        } else if (st.isDirectory()) {
+          const rel = relative(dirname(target), path);
+          await symlink(rel, target, "dir");
+        } else {
+          throw this.#resolveError(
+            spec,
+            options,
+            "file: specifier does not resolve to directory or tarball"
+          );
+        }
+        return r;
+      }
+      case "workspace": {
+        const ws = this.#getWS(spec, options);
+        const rel = relative(dirname(target), ws.fullpath);
+        await symlink(rel, target, "dir");
+        return r;
+      }
+    }
+  }
+  #getWS(spec, options) {
+    const { workspace } = spec;
+    if (workspace === void 0)
+      throw this.#resolveError(spec, options, "no workspace ID");
+    if (!this.monorepo) {
+      throw this.#resolveError(
+        spec,
+        options,
+        "Not in a monorepo, cannot resolve workspace spec"
+      );
+    }
+    const ws = this.monorepo.get(workspace);
+    if (!ws) {
+      throw this.#resolveError(spec, options, "workspace not found", {
+        wanted: workspace
+      });
+    }
+    return ws;
+  }
+  /**
+   * Return the manifest cache key for a spec and the current options.
+   */
+  #manifestCacheKey(spec, options) {
+    let extra = "";
+    if (options["node-version"]) {
+      extra += `${delimiter}node-version:${options["node-version"]}`;
+    }
+    if (options.os) {
+      extra += `${delimiter}os:${options.os}`;
+    }
+    if (options.arch) {
+      extra += `${delimiter}arch:${options.arch}`;
+    }
+    return encodeURIComponent(
+      `${spec.registry ?? ""}${delimiter}${spec}${extra}`
+    );
+  }
+  /**
+   * Conditionally return the path to the manifest cache file. The logic
+   * to determine if caching should be skipped aligns with `pickManifest`
+   * and is used to avoid caching manifest results that can be variable.
+   */
+  _manifestCachePath(spec, options) {
+    if (options.before) {
+      return;
+    }
+    const f = spec.final;
+    if (f.distTag || f.range?.isAny) {
+      return;
+    }
+    const key = this.#manifestCacheKey(f, options);
+    return pathResolve(this.#cachePath, "package-info", key);
+  }
+  /**
+   * Write a manifest cache file atomically (write to a temp file in
+   * the same directory, then rename over the destination) so that
+   * concurrent readers never observe a partially written manifest.
+   * Freshness is tracked via the resulting file's mtime.
+   */
+  async #writeManifestCache(cachePath, json) {
+    const tmp = `${cachePath}.${this.#manifestWriteRandom}.${this.#manifestWriteCount++}`;
+    try {
+      try {
+        await writeFile(tmp, json, "utf8");
+      } catch (err) {
+        if (!(err instanceof Error && "code" in err && err.code === "ENOENT")) {
+          throw err;
+        }
+        await mkdir(dirname(cachePath), { recursive: true });
+        await writeFile(tmp, json, "utf8");
+      }
+      await rename(tmp, cachePath);
+    } catch {
+    }
+  }
+  async tarball(spec, options = {}) {
+    if (typeof spec === "string")
+      spec = Spec.parse(spec, this.options);
+    const f = spec.final;
+    switch (f.type) {
+      case "registry": {
+        const { dist } = await this.manifest(spec, options);
+        if (!dist)
+          throw this.#resolveError(
+            spec,
+            options,
+            `The registry manifest for ${spec} has no "dist" section, so no tarball can be resolved. The package version may be malformed or unpublished.`
+          );
+        const { tarball, integrity } = dist;
+        if (!tarball) {
+          throw this.#resolveError(
+            spec,
+            options,
+            `The registry manifest for ${spec} is missing a tarball URL (dist.tarball). The package version may be malformed or unpublished in this registry.`
+          );
+        }
+        const fetchTarball = async (useCache) => {
+          const trustIntegrity = this.#trustedIntegrities.get(tarball) === integrity;
+          const response = await (await this.getRegistryClient()).request(tarball, {
+            ...options,
+            integrity,
+            trustIntegrity,
+            ...useCache === false ? { useCache } : {}
+          });
+          if (response.statusCode !== 200) {
+            throw this.#resolveError(
+              spec,
+              options,
+              `Registry returned HTTP ${response.statusCode} when fetching the tarball for ${spec} at ${tarball}. The version may have been unpublished, or the registry may be misconfigured or unreachable.`,
+              { response, url: tarball }
+            );
+          }
+          if (!trustIntegrity && response.checkIntegrity({ spec, url: tarball })) {
+            this.#trustedIntegrities.set(tarball, response.integrity);
+          }
+          const buf = response.buffer();
+          if (integrity && !response.fromCache) {
+            const hash = createHash("sha512");
+            hash.update(buf);
+            const computed = `sha512-${hash.digest("base64")}`;
+            if (computed !== integrity) {
+              throw error("Tarball integrity check failed", {
+                code: "EINTEGRITY",
+                spec,
+                url: tarball,
+                wanted: integrity,
+                found: computed
+              });
+            }
+          }
+          return buf;
+        };
+        try {
+          return await fetchTarball();
+        } catch (er) {
+          if (er instanceof Error && "cause" in er && er.cause?.code === "EINTEGRITY") {
+            return await fetchTarball(false);
+          }
+          throw er;
+        }
+      }
+      case "git": {
+        const {
+          remoteURL,
+          gitRemote,
+          gitCommittish,
+          gitSelectorParsed
+        } = f;
+        const s = spec;
+        if (!remoteURL) {
+          if (!gitRemote) {
+            throw this.#resolveError(
+              spec,
+              options,
+              "no remote on git: specifier"
+            );
+          }
+          const { path } = gitSelectorParsed ?? {};
+          return await this.#tmpdir(async (dir) => {
+            await clone(gitRemote, gitCommittish, dir + "/package", {
+              spec: s
+            });
+            let cwd = dir;
+            if (path !== void 0) {
+              const src = pathResolve(dir, "package", path);
+              cwd = dirname(src);
+              const pkg = pathResolve(cwd, "package");
+              if (src !== pkg) {
+                const rand = randomBytes(6).toString("hex");
+                await rename(pkg, pkg + rand).catch(() => {
+                });
+                await rename(src, pkg);
+              }
+            }
+            return Qn({ cwd, gzip: true }, ["package"]).concat();
+          });
+        }
+      }
+      case "remote": {
+        const { remoteURL } = f;
+        if (!remoteURL) {
+          throw this.#resolveError(spec, options);
+        }
+        const response = await (await this.getRegistryClient()).request(remoteURL);
+        if (response.statusCode !== 200) {
+          throw this.#resolveError(
+            spec,
+            options,
+            "failed to fetch URL",
+            { response, url: remoteURL }
+          );
+        }
+        return response.buffer();
+      }
+      case "file": {
+        const { file } = f;
+        if (file === void 0)
+          throw this.#resolveError(spec, options, "no file path");
+        const { from = this.#projectRoot } = options;
+        const path = pathResolve(from, file);
+        const st = await stat(path);
+        if (st.isDirectory()) {
+          const p = dirname(path);
+          const b = basename(path);
+          return Qn({ cwd: p, gzip: true }, [b]).concat();
+        }
+        return readFile(path);
+      }
+      case "workspace": {
+        const ws = this.#getWS(spec, options);
+        const p = dirname(ws.fullpath);
+        const b = basename(ws.fullpath);
+        return Qn({ cwd: p, gzip: true }, [b]).concat();
+      }
+    }
+  }
+  async manifest(spec, options = {}) {
+    const { from = this.#projectRoot } = options;
+    if (typeof spec === "string")
+      spec = Spec.parse(spec, this.options);
+    const f = spec.final;
+    switch (f.type) {
+      case "registry": {
+        const cachePath = this._manifestCachePath(spec, options);
+        if (cachePath) {
+          try {
+            const [st, cached] = await Promise.all([
+              stat(cachePath),
+              readFile(cachePath, "utf8")
+            ]);
+            const json = JSON.parse(cached);
+            if (st.mtimeMs < this.#manifestCacheMinAge || json.__VLT_MANIFEST_CACHE_TIMESTAMP !== void 0) {
+              this.#manifestWritePaths.delete(cachePath);
+              void unlink(cachePath).catch(() => {
+              });
+              throw new Error("manifest cache expired");
+            }
+            return json;
+          } catch {
+          }
+        }
+        const mani = pickManifest(
+          await this.packument(f, options),
+          spec,
+          options
+        );
+        if (!mani) throw this.#resolveError(spec, options);
+        if (cachePath && !this.#manifestWritePaths.has(cachePath)) {
+          this.#manifestWritePaths.add(cachePath);
+          void this.#writeManifestCache(
+            cachePath,
+            JSON.stringify(mani)
+          );
+        }
+        return mani;
+      }
+      case "git": {
+        const {
+          gitRemote,
+          gitCommittish,
+          remoteURL,
+          gitSelectorParsed
+        } = f;
+        if (!remoteURL) {
+          const s = spec;
+          if (!gitRemote)
+            throw this.#resolveError(spec, options, "no git remote");
+          return await this.#tmpdir(async (dir) => {
+            await clone(gitRemote, gitCommittish, dir, { spec: s });
+            const { path } = gitSelectorParsed ?? {};
+            const pkgDir = path !== void 0 ? pathResolve(dir, path) : dir;
+            return this.#readExtracted(pkgDir, s, options);
+          });
+        }
+      }
+      case "remote": {
+        const { remoteURL } = f;
+        if (!remoteURL) {
+          throw this.#resolveError(
+            spec,
+            options,
+            "no remoteURL on remote specifier"
+          );
+        }
+        const s = spec;
+        return await this.#tmpdir(async (dir) => {
+          const response = await (await this.getRegistryClient()).request(remoteURL);
+          if (response.statusCode !== 200) {
+            throw this.#resolveError(
+              s,
+              options,
+              "failed to fetch URL",
+              { response, url: remoteURL }
+            );
+          }
+          const buf = response.buffer();
+          const computed = import_ssri.default.fromData(buf, { algorithms: ["sha512"] }).toString();
+          try {
+            await (await this.getTarPool()).unpack(buf, dir);
+          } catch (er) {
+            throw this.#resolveError(
+              s,
+              options,
+              "tar unpack failed",
+              { cause: er }
+            );
+          }
+          const mani = this.#readExtracted(dir, s, options);
+          mani.dist = { integrity: computed };
+          return mani;
+        });
+      }
+      case "file": {
+        const { file } = f;
+        if (file === void 0)
+          throw this.#resolveError(spec, options, "no file path");
+        const path = pathResolve(from, file);
+        const st = await stat(path);
+        if (st.isDirectory()) {
+          return this.packageJson.read(path);
+        }
+        const s = spec;
+        return await this.#tmpdir(async (dir) => {
+          try {
+            await (await this.getTarPool()).unpack(await readFile(path), dir);
+          } catch (er) {
+            throw this.#resolveError(
+              s,
+              options,
+              "tar unpack failed",
+              { cause: er }
+            );
+          }
+          return this.#readExtracted(dir, s, options);
+        });
+      }
+      case "workspace": {
+        return this.#getWS(spec, options).manifest;
+      }
+    }
+  }
+  async packument(spec, options = {}) {
+    if (typeof spec === "string")
+      spec = Spec.parse(spec, this.options);
+    const f = spec.final;
+    switch (f.type) {
+      // RevDoc is the equivalent of a packument for a git repo
+      case "git": {
+        const { gitRemote } = f;
+        if (!gitRemote) {
+          throw this.#resolveError(
+            spec,
+            options,
+            "git remote could not be determined"
+          );
+        }
+        const revDoc = await revs(gitRemote, {
+          cwd: this.options.projectRoot
+        });
+        if (!revDoc) throw this.#resolveError(spec, options);
+        return asPackument(revDoc);
+      }
+      // these are all faked packuments
+      case "file":
+      case "workspace":
+      case "remote": {
+        const manifest = await this.manifest(f, options);
+        return {
+          name: manifest.name ?? "",
+          "dist-tags": {
+            latest: manifest.version ?? ""
+          },
+          versions: {
+            [manifest.version ?? ""]: manifest
+          }
+        };
+      }
+      case "registry": {
+        const { registry, name } = f;
+        if (!registry) throw noRegistryError(spec);
+        const packumentKey = `${registry}${name}`;
+        const inflight = this.#packumentPromises.get(packumentKey);
+        if (inflight) return inflight;
+        const pakuURL = new URL(name, registry);
+        const promise = this.#fetchPackument(spec, options, pakuURL);
+        this.#packumentPromises.set(packumentKey, promise);
+        promise.then(
+          () => this.#packumentPromises.delete(packumentKey),
+          () => this.#packumentPromises.delete(packumentKey)
+        );
+        return promise;
+      }
+    }
+  }
+  async #fetchPackument(spec, options, pakuURL, useCache) {
+    const response = await (await this.getRegistryClient()).request(pakuURL, {
+      headers: { accept: "application/json" },
+      ...useCache === false ? { useCache } : {}
+    });
+    if (response.statusCode !== 200) {
+      throw this.#resolveError(
+        spec,
+        options,
+        "failed to fetch packument",
+        {
+          url: pakuURL,
+          response
+        }
+      );
+    }
+    try {
+      return response.json();
+    } catch (er) {
+      if (useCache !== false) {
+        return this.#fetchPackument(spec, options, pakuURL, false);
+      }
+      throw er;
+    }
+  }
+  async resolve(spec, options = {}) {
+    const memoKey = String(spec);
+    if (typeof spec === "string")
+      spec = Spec.parse(spec, this.options);
+    const memo = this.#resolutions.get(memoKey);
+    if (memo) return memo;
+    const f = spec.final;
+    switch (f.type) {
+      case "file": {
+        const { file } = f;
+        if (!file || !f.file) {
+          throw this.#resolveError(
+            spec,
+            options,
+            "no path on file: specifier"
+          );
+        }
+        const { from = this.#projectRoot } = options;
+        const resolved = pathResolve(from, f.file);
+        const r = { resolved, spec };
+        this.#resolutions.set(memoKey, r);
+        return r;
+      }
+      case "remote": {
+        const { remoteURL } = f;
+        if (!remoteURL)
+          throw this.#resolveError(
+            spec,
+            options,
+            "no URL in remote specifier"
+          );
+        const r = { resolved: remoteURL, spec };
+        this.#resolutions.set(memoKey, r);
+        return r;
+      }
+      case "workspace": {
+        const ws = this.#getWS(spec, options);
+        return {
+          resolved: ws.fullpath,
+          spec
+        };
+      }
+      case "registry": {
+        const mani = await this.manifest(spec, options);
+        if (mani.dist) {
+          const { integrity, tarball, signatures } = mani.dist;
+          if (tarball) {
+            const r = {
+              resolved: tarball,
+              integrity,
+              signatures,
+              spec
+            };
+            this.#resolutions.set(memoKey, r);
+            return r;
+          }
+        }
+        throw this.#resolveError(spec, options);
+      }
+      case "git": {
+        const { gitRemote, remoteURL, gitSelectorParsed } = f;
+        if (remoteURL && gitSelectorParsed?.path === void 0) {
+          const r = { resolved: remoteURL, spec };
+          this.#resolutions.set(memoKey, r);
+          return r;
+        }
+        if (!gitRemote) {
+          throw this.#resolveError(
+            spec,
+            options,
+            "no remote on git specifier"
+          );
+        }
+        const rev = await resolve(gitRemote, f.gitCommittish, {
+          spec
+        });
+        if (rev) {
+          const r = {
+            resolved: `${gitRemote}#${rev.sha}`,
+            spec
+          };
+          if (gitSelectorParsed) {
+            r.resolved += Object.entries(gitSelectorParsed).filter(([_, v]) => v).map(([k, v]) => `::${k}:${v}`).join("");
+          }
+          this.#resolutions.set(memoKey, r);
+          return r;
+        }
+        const s = spec;
+        return this.#tmpdir(async (tmpdir) => {
+          const sha = await clone(
+            gitRemote,
+            s.gitCommittish,
+            tmpdir,
+            {
+              spec: s
+            }
+          );
+          const r = {
+            resolved: `${gitRemote}#${sha}`,
+            spec: s
+          };
+          this.#resolutions.set(memoKey, r);
+          return r;
+        });
+      }
+    }
+  }
+  /**
+   * Read the manifest out of a directory we cloned or unpacked. Failures are
+   * labeled with the spec, because the internal directory says nothing about
+   * which dependency is at fault.
+   */
+  #readExtracted(dir, spec, options) {
+    try {
+      return this.packageJson.read(dir);
+    } catch (er) {
+      throw this.#resolveError(
+        spec,
+        options,
+        "invalid package manifest",
+        { cause: er }
+      );
+    }
+  }
+  async #tmpdir(fn) {
+    const p = `package-info/${randomBytes(6).toString("hex")}`;
+    const dir = xdg.runtime(p);
+    try {
+      return await fn(dir);
+    } finally {
+      void rm2(dir, { recursive: true, force: true });
+    }
+  }
+  // error resolving
+  #resolveError(spec, options = {}, message = "Could not resolve", extra = {}) {
+    const { from = this.#projectRoot } = options;
+    const er = error(
+      message,
+      {
+        code: "ERESOLVE",
+        spec,
+        from,
+        ...extra
+      },
+      this.#resolveError
+    );
+    return er;
+  }
+};
+
+export {
+  PackageInfoClient
+};