@dk/hipp 0.1.35 → 0.1.37

package/README.md

@@ -140,10 +140,10 @@ npx @dk/hipp -- --access public --tag beta
 HIPP provides out-of-band verification to prove package integrity:
 
 ```bash
-npx @dk/hipp verify                       # auto-detect: local hipp repo → published version, else @dk/hipp
-npx @dk/hipp verify --self                # always verifies @dk/hipp itself
-npx @dk/hipp verify @scope/package         # verifies latest of a package
-npx @dk/hipp verify @scope/package@1.0.0   # verifies specific version
+npx @dk/hipp --verify                       # auto-detect: local hipp repo → published version, else @dk/hipp
+npx @dk/hipp --verify --self                # always verifies @dk/hipp itself
+npx @dk/hipp --verify @scope/package         # verifies latest of a package
+npx @dk/hipp --verify @scope/package@1.0.0   # verifies specific version
 ```
 
 ### How Verification Works
@@ -273,21 +273,21 @@ PERFORMANCE OF THIS SOFTWARE.
 Verify this package with [@dk/hipp](https://www.npmjs.com/package/@dk/hipp):
 
 ```bash
-npx @dk/hipp verify @dk/hipp@0.1.35
+npx @dk/hipp --verify @dk/hipp@0.1.37
 ```
 
 ```json
 {
   "origin": "git@github.com:dmytri/hipp.git",
-  "tag": "v0.1.35",
-  "revision": "1867eb114a7c672dd23da33d6b6b4375077faf4d",
-  "hash": "8a48b6de8cdfd06b93177720f9701b77dc96263b20c10902a8b5780f5941489a",
-  "signature": "R5wbqWXbsV4269e78lDuN92FyWkWk0L4jSsQgLQSVc1/vOis/IKWA+UFMxdIKOfThczLLNm98YDpcu4QEITNBA==",
+  "tag": "v0.1.37",
+  "revision": "3efc2c67bcb1e75b9fb3c44a2e572dba1aa1703d",
+  "hash": "f3cae0034df0aaa5382c0d047fff684ab30354eab2a3b7f280438a95a7ef9488",
+  "signature": "c7ck6ex7mu5OqR2JiRnlnU0nnBHoYPqQkSvKDnvhfyBGUKnOUyT/uEyxifj+UW+s3GB4m651zDauhjWsqVMIDw==",
   "name": "Dmytri Kleiner",
   "email": "dev@dmytri.to",
   "npm": "11.12.1",
   "node": "v25.8.2",
   "git": "git version 2.47.3",
-  "hipp": "0.1.35"
+  "hipp": "0.1.37"
 }
 ```

package/hipp.js

@@ -178,24 +178,25 @@ function findLastJsonBlock(readmeContent) {
   return lastValid;
 }
 
-function packAndHash(stageDir) {
-  const result = spawnSync('npm', ['pack'], {
-    cwd: stageDir,
-    encoding: 'utf8',
-    stdio: ['pipe', 'pipe', 'pipe'],
-  });
-
-  if (result.status !== 0) {
-    throw new Error(`npm pack failed: ${result.stderr}`);
-  }
-
-  const tarballName = result.stdout.trim().split('\n').pop();
-  const tarballPath = path.join(stageDir, tarballName);
-
-  const tarballContent = fs.readFileSync(tarballPath);
-  fs.unlinkSync(tarballPath);
-
-  return { tarballName, tarballHash: sha256(tarballContent) };
+function hashFiles(dir) {
+  const entries = [];
+  const walk = (d, prefix = '') => {
+    const items = fs.readdirSync(d);
+    for (const item of items.sort()) {
+      if (item === 'node_modules' || item === '.git' || item === 'hipp.priv') continue;
+      const full = path.join(d, item);
+      const rel = prefix ? prefix + '/' + item : item;
+      const stat = fs.statSync(full);
+      if (stat.isDirectory()) {
+        walk(full, rel);
+      } else {
+        const content = fs.readFileSync(full);
+        entries.push(rel + ':' + sha256(content));
+      }
+    }
+  };
+  walk(dir);
+  return sha256(entries.join('\n'));
 }
 
 function safeStageName(name) {
@@ -455,10 +456,6 @@ async function runVerify(packageSpec) {
       fail(`❌ Failed to download tarball`);
     }
 
-    const npmTarballContent = fs.readFileSync(tarballPath);
-    const npmHash = sha256(npmTarballContent);
-    log.success(`📦 NPM tarball hash: ${npmHash.slice(0, 12)}...`);
-
     if (fs.existsSync(extractDir)) {
       fs.rmSync(extractDir, { recursive: true });
     }
@@ -531,8 +528,8 @@ async function runVerify(packageSpec) {
         const trackedFiles = getTrackedFilesFromDir(tmpDir);
         copyTrackedFilesFromDir(stageDir, tmpDir, trackedFiles);
 
-        log.info(`📦 Packing clean git files...`);
-        const { tarballHash: cleanHash } = packAndHash(stageDir);
+        log.info(`📦 Computing logical hash of git files...`);
+        const cleanHash = hashFiles(stageDir);
         log.success(`📦 Clean hash: ${cleanHash.slice(0, 12)}...`);
 
         log.info(`🔍 Check 2: Verifying manifest hash...`);
@@ -564,21 +561,29 @@ async function runVerify(packageSpec) {
         stagedReadme = stagedReadme.trimEnd() + '\n\n## Verify\n\n' +
           'Verify this package with [@dk/hipp](https://www.npmjs.com/package/@dk/hipp):\n\n' +
           '```bash\n' +
-          `npx @dk/hipp verify ${pkgName}@${tagVersion}\n` +
+          `npx @dk/hipp --verify ${pkgName}@${tagVersion}\n` +
           '```\n\n' +
           '```json\n' + JSON.stringify(manifest, null, 2) + '\n```\n';
         fs.writeFileSync(stagedReadmePath, stagedReadme);
 
         const stagedPkgPath = path.join(stageDir, 'package.json');
         const stagedPkg = JSON.parse(fs.readFileSync(stagedPkgPath, 'utf8'));
-        stagedPkg.version = tagVersion;
         fs.writeFileSync(stagedPkgPath, JSON.stringify(stagedPkg, null, 2) + '\n');
 
-        const { tarballHash: rebuildHash } = packAndHash(stageDir);
-        log.success(`📦 Rebuild hash: ${rebuildHash.slice(0, 12)}...`);
+        const npmExtractPkgPath = path.join(packageDir, 'package.json');
+        const npmExtractPkg = JSON.parse(fs.readFileSync(npmExtractPkgPath, 'utf8'));
+        if (stagedPkg.version === '0.0.0') {
+          npmExtractPkg.version = '0.0.0';
+          fs.writeFileSync(npmExtractPkgPath, JSON.stringify(npmExtractPkg, null, 2) + '\n');
+        }
+
+        const npmExtractHash = hashFiles(packageDir);
+        const rebuildHash = hashFiles(stageDir);
+        log.success(`📦 NPM-extract hash: ${npmExtractHash.slice(0, 12)}...`);
+        log.success(`📦 Git-rebuild hash: ${rebuildHash.slice(0, 12)}...`);
 
-        if (rebuildHash !== npmHash) {
-          log.error(`❌ Rebuild mismatch: rebuild ${rebuildHash.slice(0, 12)} != npm ${npmHash.slice(0, 12)}`);
+        if (rebuildHash !== npmExtractHash) {
+          log.error(`❌ Rebuild mismatch: git ${rebuildHash.slice(0, 12)} != npm ${npmExtractHash.slice(0, 12)}`);
         } else {
           log.success(`🔄 Rebuild verified`);
           results.rebuild = true;
@@ -707,9 +712,9 @@ async function run() {
 
     const { privateKey } = loadOrGenerateKeys();
 
-    log.info(`📦 Packing to compute content hash...`);
-    const { tarballHash } = packAndHash(stageDir);
-    log.success(`🔒 Content hash: ${tarballHash.slice(0, 12)}...`);
+    log.info(`📦 Computing logical hash...`);
+    const logicalHash = hashFiles(stageDir);
+    log.success(`🔒 Content hash: ${logicalHash.slice(0, 12)}...`);
 
     const stagedReadmePath = path.join(stageDir, 'README.md');
     let stagedReadme = '';
@@ -726,14 +731,14 @@ async function run() {
     const hippPkg = JSON.parse(fs.readFileSync(hippPkgPath, 'utf8'));
     const hippVersion = hippPkg.version === '0.0.0' ? version : hippPkg.version;
     const originUrl = provenance.remoteUrl;
-    const dataToSign = buildSignData(tarballHash, originUrl, rawTag, revision, name, email);
+    const dataToSign = buildSignData(logicalHash, originUrl, rawTag, revision, name, email);
     const signature = signContent(dataToSign, privateKey);
 
     const manifestJson = {
       origin: originUrl,
       tag: rawTag,
       revision: revision,
-      hash: tarballHash,
+      hash: logicalHash,
       signature: signature,
       name: name,
       email: email,
@@ -746,7 +751,7 @@ async function run() {
     stagedReadme = stagedReadme.trimEnd() + '\n\n## Verify\n\n' +
       'Verify this package with [@dk/hipp](https://www.npmjs.com/package/@dk/hipp):\n\n' +
       '```bash\n' +
-      `npx @dk/hipp verify ${pkg.name}@${version}\n` +
+      `npx @dk/hipp --verify ${pkg.name}@${version}\n` +
       '```\n\n' +
       '```json\n' + JSON.stringify(manifestJson, null, 2) + '\n```\n';
     fs.writeFileSync(stagedReadmePath, stagedReadme);
@@ -787,8 +792,8 @@ async function run() {
   }
 }
 
-const isVerify = process.argv.includes('verify');
-const verifyIndex = process.argv.indexOf('verify');
+const isVerify = process.argv.includes('--verify');
+const verifyIndex = process.argv.indexOf('--verify');
 const packageSpec = verifyIndex !== -1 ? process.argv[verifyIndex + 1] : null;
 
 if (isVerify) {
@@ -817,8 +822,8 @@ if (isVerify) {
 
 Usage:
   npx hipp [options] [-- npm-options]
-  npx hipp verify [@package[@version]]
-  npx hipp verify --self
+  npx hipp --verify [@package[@version]]
+  npx hipp --verify --self
 
   Without arguments: in a hipp repo (package.json version 0.0.0 or matching
   a semver tag on HEAD), verifies the published package at that version.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dk/hipp",
-  "version": "0.1.35",
+  "version": "0.1.37",
   "description": "High Integrity Package Publisher",
   "main": "hipp.js",
   "bin": {