fix: avoid unnecessary TUF initialization

[vadimpiven]

Summary

• defer Sigstore verifier initialization until an npm provenance attestation exists
• serialize TUF setup in integration tests

Testing

• pnpm exec vitest run tests/cli.test.ts
• pnpm exec vitest run tests/verify.integration.test.ts

[semanticdiff-com]

Review changes with  

Changed Files

File	Status
package/src/verify/verify.ts	60% smaller
package/tests/verify.integration.test.ts	43% smaller
pnpm-workspace.yaml	9% smaller
patches/tuf-js@6.0.0.patch	Unsupported file format
pnpm-lock.yaml	0% smaller

[codecov]

Codecov Report

❌ Patch coverage is 50.00000% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
package/src/verify/verify.ts	50.00%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[greptile-apps]

Greptile Summary

Defers default Sigstore verifier creation until an npm provenance attestation is available, avoiding unnecessary TUF initialization on earlier failure paths.

• Preserves explicitly supplied verifier configuration while lazily creating the default verifier.
• Serializes verifier and trust-material initialization in the integration test file.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness or security issues identified.

Configuration preserves supplied verifiers, the default verifier is still created before bundle verification, and the test setup change intentionally serializes the shared TUF initialization.

Important Files Changed

Filename	Overview
package/src/verify/verify.ts	Moves default verifier creation after provenance-attestation selection without changing verifier choice or verification semantics.
package/tests/verify.integration.test.ts	Consolidates TUF-dependent integration setup into a serial file-level hook.

_{Reviews (1): Last reviewed commit: "fix: avoid unnecessary TUF initializatio..." | Re-trigger Greptile}