@dk/hipp 0.1.26 → 0.1.28

package/README.md

@@ -110,8 +110,10 @@ npx @dk/hipp -- --access public --tag beta
 HIPP provides out-of-band verification to prove package integrity:
 
 ```bash
-npx @dk/hipp verify @dk/your-package[@version]
-npx @dk/hipp verify           # verifies the installed hipp version
+npx @dk/hipp verify                       # auto-detect: local hipp repo → published version, else @dk/hipp
+npx @dk/hipp verify --self                # always verifies @dk/hipp itself
+npx @dk/hipp verify @scope/package         # verifies latest of a package
+npx @dk/hipp verify @scope/package@1.0.0   # verifies specific version
 ```
 
 ### How Verification Works
@@ -239,20 +241,20 @@ PERFORMANCE OF THIS SOFTWARE.
 Verify this package with [@dk/hipp](https://www.npmjs.com/package/@dk/hipp):
 
 ```bash
-npx @dk/hipp verify @dk/hipp@0.1.26
+npx @dk/hipp verify @dk/hipp@0.1.28
 ```
 
 ```json
 {
   "origin": "git@github.com:dmytri/hipp.git",
-  "tag": "v0.1.26",
-  "revision": "54ec0b8b85b58aa5064a223257278218aadb4a37",
-  "hash": "86b5c3f9d90860998db29b3392a32b2d8a170b42617471684942ecc4aeb81622",
-  "signature": "+ke2wAueXxhrGaoQE1OqO40ah9j/nDfjnFMuuPILitxU3goPMg9dMtlDezTwnjtq9i/vExpYdYFodQlXumxUCg==",
+  "tag": "v0.1.28",
+  "revision": "9c14060da439f9a4c2b040c282da594703525d14",
+  "hash": "ee78fe3bba06ec7cff6f775c43c9cc4bf3fba4a3bfa64e28dd57879426890f11",
+  "signature": "0Udja52eMvhKvlJxFpwxW927lV1QzyJhF/5kMdOeTnFXy+zQuqMSUBG0fHNo7PRZ9YEDWGzN+EnyeVL5+pyYBQ==",
   "name": "Dmytri Kleiner",
   "email": "dev@dmytri.to",
   "npm": "11.12.1",
   "node": "v25.8.2",
-  "hipp": "0.1.26"
+  "hipp": "0.1.28"
 }
 ```

package/hipp.js

@@ -429,7 +429,7 @@ async function runVerify(packageSpec) {
   const npa = require('npm-package-arg');
   const parsed = npa(packageSpec);
   const pkgName = parsed.name;
-  const pkgVersion = parsed.fetchSpec;
+  const pkgVersion = parsed.fetchSpec === '*' ? null : parsed.fetchSpec;
   log.info(`🔍 HIPP Verify: ${pkgName}${pkgVersion ? '@' + pkgVersion : ''}`);
 
   const registryUrl = `https://registry.npmjs.org/${parsed.escapedName}/${pkgVersion || 'latest'}`;
@@ -751,22 +751,40 @@ const verifyIndex = process.argv.indexOf('verify');
 const packageSpec = verifyIndex !== -1 ? process.argv[verifyIndex + 1] : null;
 
 if (isVerify) {
-  const specToVerify = packageSpec;
-  if (specToVerify) {
-    runVerify(specToVerify);
-  } else {
-    const hippPkgPath = path.join(path.dirname(process.argv[1]), 'package.json');
-    const hippPkg = JSON.parse(fs.readFileSync(hippPkgPath, 'utf8'));
-    runVerify(`${hippPkg.name}@${hippPkg.version}`);
-  }
+  const hasSelf = process.argv.includes('--self');
+  if (!hasSelf) {
+    try {
+      const pkg = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'package.json'), 'utf8'));
+      if (pkg.version === '0.0.0') {
+        const rawTag = git(['describe', '--tags', '--exact-match', 'HEAD']);
+        if (rawTag.startsWith('v')) {
+          const tagVersion = semver.clean(rawTag);
+          if (tagVersion) {
+            runVerify(`${pkg.name}@${tagVersion}`);
+            return;
+          }
+        }
+      }
+    } catch {}
+  }
+  const hippPkgPath = path.join(path.dirname(process.argv[1]), 'package.json');
+  const hippPkg = JSON.parse(fs.readFileSync(hippPkgPath, 'utf8'));
+  const spec = hippPkg.version === '0.0.0'
+    ? hippPkg.name
+    : `${hippPkg.name}@${hippPkg.version}`;
+  runVerify(spec);
 } else if (process.argv.includes('--help') || process.argv.includes('-h')) {
   console.log(`\x1b[36mHIPP - High Integrity Package Publisher\x1b[0m
 
 Usage:
   npx hipp [options] [-- npm-options]
   npx hipp verify [@package[@version]]
+  npx hipp verify --self
 
-  Without arguments, verifies the installed hipp version.
+  Without arguments: in a hipp repo (package.json version 0.0.0 with a
+  semver tag on HEAD), verifies the published package at that version.
+  Otherwise verifies @dk/hipp itself.
+  --self: always verifies @dk/hipp.
 
 Options:
   -y, --yes   Skip confirmation prompt

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dk/hipp",
-  "version": "0.1.26",
+  "version": "0.1.28",
   "description": "High Integrity Package Publisher",
   "main": "hipp.js",
   "bin": {