ic-mops 0.32.2 → 0.33.0

package/dist/commands/install-all.js

@@ -4,7 +4,8 @@ import { checkConfigFile, readConfig } from '../mops.js';
 import { install } from './install.js';
 import { installFromGithub } from '../vessel.js';
 import { notifyInstalls } from '../notify-installs.js';
-export async function installAll({ verbose = false, silent = false } = {}) {
+import { checkIntegrity } from '../integrity.js';
+export async function installAll({ verbose = false, silent = false, lockfile } = {}) {
     if (!checkConfigFile()) {
         return;
     }
@@ -25,7 +26,13 @@ export async function installAll({ verbose = false, silent = false } = {}) {
             installedPackages = { ...installedPackages, ...res };
         }
     }
-    await notifyInstalls(Object.keys(installedPackages));
+    if (!silent && lockfile !== 'ignore') {
+        logUpdate('Checking integrity...');
+    }
+    await Promise.all([
+        notifyInstalls(Object.keys(installedPackages)),
+        checkIntegrity(lockfile),
+    ]);
     if (!silent) {
         logUpdate.clear();
         console.log(chalk.green('All packages installed'));

package/dist/commands/install.js

@@ -118,8 +118,8 @@ export async function install(pkg, version = '', { verbose = false, silent = fal
     if (!alreadyInstalled) {
         installedDeps = { ...installedDeps, [pkg]: version };
     }
-    if (ok) {
-        return installedDeps;
+    if (!ok) {
+        return false;
     }
-    return false;
+    return installedDeps;
 }

package/dist/commands/remove.d.ts

@@ -1,5 +1,8 @@
-export declare function remove(name: string, { dev, verbose, dryRun }?: {
-    dev?: boolean | undefined;
-    verbose?: boolean | undefined;
-    dryRun?: boolean | undefined;
-}): Promise<void>;
+type RemoveOptions = {
+    verbose?: boolean;
+    dev?: boolean;
+    dryRun?: boolean;
+    lockfile?: 'save' | 'ignore';
+};
+export declare function remove(name: string, { dev, verbose, dryRun, lockfile }?: RemoveOptions): Promise<void>;
+export {};

package/dist/commands/remove.js

@@ -2,7 +2,8 @@ import fs from 'node:fs';
 import { deleteSync } from 'del';
 import chalk from 'chalk';
 import { formatDir, formatGithubDir, checkConfigFile, readConfig, writeConfig } from '../mops.js';
-export async function remove(name, { dev = false, verbose = false, dryRun = false } = {}) {
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+export async function remove(name, { dev = false, verbose = false, dryRun = false, lockfile } = {}) {
     if (!checkConfigFile()) {
         return;
     }
@@ -79,5 +80,6 @@ export async function remove(name, { dev = false, verbose = false, dryRun = fals
         delete config['dev-dependencies'][name];
     }
     dryRun || writeConfig(config);
+    // await checkIntegrity(lockfile);
     console.log(chalk.green('Package removed ') + `${name} = "${version}"`);
 }

package/dist/commands/sync.d.ts

@@ -1 +1,5 @@
-export declare function sync(): Promise<void>;
+type SyncOptions = {
+    lockfile?: 'save' | 'ignore';
+};
+export declare function sync({ lockfile }?: SyncOptions): Promise<void>;
+export {};

package/dist/commands/sync.js

@@ -5,6 +5,29 @@ import chalk from 'chalk';
 import { checkConfigFile, getRootDir, readConfig } from '../mops.js';
 import { add } from './add.js';
 import { remove } from './remove.js';
+import { checkIntegrity } from '../integrity.js';
+export async function sync({ lockfile } = {}) {
+    if (!checkConfigFile()) {
+        return;
+    }
+    let missing = await getMissingPackages();
+    let unused = await getUnusedPackages();
+    missing.length && console.log(`${chalk.yellow('Missing packages:')} ${missing.join(', ')}`);
+    unused.length && console.log(`${chalk.yellow('Unused packages:')} ${unused.join(', ')}`);
+    let config = readConfig();
+    let deps = new Set(Object.keys(config.dependencies || {}));
+    let devDeps = new Set(Object.keys(config['dev-dependencies'] || {}));
+    // add missing packages
+    for (let pkg of missing) {
+        await add(pkg, { lockfile: 'ignore' });
+    }
+    // remove unused packages
+    for (let pkg of unused) {
+        let dev = devDeps.has(pkg) && !deps.has(pkg);
+        await remove(pkg, { dev, lockfile: 'ignore' });
+    }
+    await checkIntegrity(lockfile);
+}
 let ignore = [
     '**/node_modules/**',
     '**/.vessel/**',
@@ -63,24 +86,3 @@ async function getUnusedPackages() {
     }
     return [...allDeps];
 }
-export async function sync() {
-    if (!checkConfigFile()) {
-        return;
-    }
-    let missing = await getMissingPackages();
-    let unused = await getUnusedPackages();
-    missing.length && console.log(`${chalk.yellow('Missing packages:')} ${missing.join(', ')}`);
-    unused.length && console.log(`${chalk.yellow('Unused packages:')} ${unused.join(', ')}`);
-    let config = readConfig();
-    let deps = new Set(Object.keys(config.dependencies || {}));
-    let devDeps = new Set(Object.keys(config['dev-dependencies'] || {}));
-    // add missing packages
-    for (let pkg of missing) {
-        await add(pkg);
-    }
-    // remove unused packages
-    for (let pkg of unused) {
-        let dev = devDeps.has(pkg) && !deps.has(pkg);
-        await remove(pkg, { dev });
-    }
-}

package/dist/commands/test/test.js

@@ -123,7 +123,13 @@ export async function testWithReporter(reporter, filter = '', mode = 'interprete
                         return;
                     }
                     // run
-                    let proc = spawn('wasmtime', ['--max-wasm-stack=2000000', wasmFile]);
+                    let proc = spawn('wasmtime', [
+                        '--max-wasm-stack=2000000',
+                        '--enable-cranelift-nan-canonicalization',
+                        '--wasm-features',
+                        'multi-memory,bulk-memory',
+                        wasmFile,
+                    ]);
                     await pipeMMF(proc, mmf);
                 }).finally(() => {
                     fs.rmSync(wasmFile, { force: true });

package/dist/commands/update.d.ts

@@ -1 +1,7 @@
-export declare function update(pkg?: string): Promise<void>;
+type UpdateOptions = {
+    verbose?: boolean;
+    dev?: boolean;
+    lockfile?: 'save' | 'ignore';
+};
+export declare function update(pkg?: string, { lockfile }?: UpdateOptions): Promise<void>;
+export {};

package/dist/commands/update.js

@@ -2,7 +2,8 @@ import chalk from 'chalk';
 import { checkConfigFile, getGithubCommit, parseGithubURL, readConfig } from '../mops.js';
 import { add } from './add.js';
 import { getAvailableUpdates } from './available-updates.js';
-export async function update(pkg) {
+import { checkIntegrity } from '../integrity.js';
+export async function update(pkg, { lockfile } = {}) {
     if (!checkConfigFile()) {
         return;
     }
@@ -42,4 +43,5 @@ export async function update(pkg) {
             await add(`${dep[0]}@${dep[2]}`, { dev });
         }
     }
+    await checkIntegrity(lockfile);
 }

package/dist/declarations/main/main.did

@@ -73,6 +73,14 @@ type Script =
    name: text;
    value: text;
  };
+type Result_8 = 
+ variant {
+   err: Err;
+   ok: vec record {
+             FileId;
+             blob;
+           };
+ };
 type Result_7 = 
  variant {
    err: Err;
@@ -145,6 +153,7 @@ type PackageSummary__1 =
    owner: principal;
    ownerInfo: User;
    publication: PackagePublication;
+   quality: PackageQuality;
  };
 type PackageSummaryWithChanges__1 = 
  record {
@@ -156,6 +165,7 @@ type PackageSummaryWithChanges__1 =
    owner: principal;
    ownerInfo: User;
    publication: PackagePublication;
+   quality: PackageQuality;
  };
 type PackageSummaryWithChanges = 
  record {
@@ -167,6 +177,7 @@ type PackageSummaryWithChanges =
    owner: principal;
    ownerInfo: User;
    publication: PackagePublication;
+   quality: PackageQuality;
  };
 type PackageSummary = 
  record {
@@ -177,6 +188,18 @@ type PackageSummary =
    owner: principal;
    ownerInfo: User;
    publication: PackagePublication;
+   quality: PackageQuality;
+ };
+type PackageQuality = 
+ record {
+   depsStatus: DepsStatus;
+   hasDescription: bool;
+   hasDocumentation: bool;
+   hasKeywords: bool;
+   hasLicense: bool;
+   hasReleaseNotes: bool;
+   hasRepository: bool;
+   hasTests: bool;
  };
 type PackagePublication = 
  record {
@@ -207,6 +230,7 @@ type PackageDetails =
    owner: principal;
    ownerInfo: User;
    publication: PackagePublication;
+   quality: PackageQuality;
    testStats: TestStats__1;
    versionHistory: vec PackageSummaryWithChanges__1;
  };
@@ -281,6 +305,12 @@ type DownloadsSnapshot =
    endTime: Time;
    startTime: Time;
  };
+type DepsStatus = 
+ variant {
+   allLatest;
+   tooOld;
+   updatesAvailable;
+ };
 type DependencyV2 = 
  record {
    name: PackageName__1;
@@ -296,6 +326,7 @@ type DepChange =
 service : {
   backup: () -> ();
   claimAirdrop: (principal) -> (text);
+  computeHashesForExistingFiles: () -> ();
   diff: (text, text) -> (PackageChanges__1) query;
   finishPublish: (PublishingId) -> (Result);
   getAirdropAmount: () -> (nat) query;
@@ -311,6 +342,15 @@ service : {
    (vec DownloadsSnapshot__1) query;
   getDownloadTrendByPackageName: (PackageName) ->
    (vec DownloadsSnapshot__1) query;
+  getFileHashes: (PackageName, PackageVersion) -> (Result_8);
+  getFileHashesByPackageIds: (vec PackageId) ->
+   (vec record {
+          PackageId;
+          vec record {
+                FileId;
+                blob;
+              };
+        });
   getFileIds: (PackageName, PackageVersion) -> (Result_7) query;
   getHighestSemverBatch:
    (vec record {

package/dist/declarations/main/main.did.d.ts

@@ -11,6 +11,9 @@ export interface DependencyV2 {
   'repo' : string,
   'version' : string,
 }
+export type DepsStatus = { 'allLatest' : null } |
+  { 'tooOld' : null } |
+  { 'updatesAvailable' : null };
 export interface DownloadsSnapshot {
   'startTime' : Time,
   'endTime' : Time,
@@ -76,6 +79,7 @@ export interface PackageDetails {
   'ownerInfo' : User,
   'owner' : Principal,
   'deps' : Array<PackageSummary__1>,
+  'quality' : PackageQuality,
   'testStats' : TestStats__1,
   'downloadsTotal' : bigint,
   'downloadsInLast30Days' : bigint,
@@ -101,9 +105,20 @@ export interface PackagePublication {
   'time' : Time,
   'user' : Principal,
 }
+export interface PackageQuality {
+  'depsStatus' : DepsStatus,
+  'hasDescription' : boolean,
+  'hasKeywords' : boolean,
+  'hasLicense' : boolean,
+  'hasDocumentation' : boolean,
+  'hasTests' : boolean,
+  'hasRepository' : boolean,
+  'hasReleaseNotes' : boolean,
+}
 export interface PackageSummary {
   'ownerInfo' : User,
   'owner' : Principal,
+  'quality' : PackageQuality,
   'downloadsTotal' : bigint,
   'downloadsInLast30Days' : bigint,
   'downloadsInLast7Days' : bigint,
@@ -113,6 +128,7 @@ export interface PackageSummary {
 export interface PackageSummaryWithChanges {
   'ownerInfo' : User,
   'owner' : Principal,
+  'quality' : PackageQuality,
   'downloadsTotal' : bigint,
   'downloadsInLast30Days' : bigint,
   'downloadsInLast7Days' : bigint,
@@ -123,6 +139,7 @@ export interface PackageSummaryWithChanges {
 export interface PackageSummaryWithChanges__1 {
   'ownerInfo' : User,
   'owner' : Principal,
+  'quality' : PackageQuality,
   'downloadsTotal' : bigint,
   'downloadsInLast30Days' : bigint,
   'downloadsInLast7Days' : bigint,
@@ -133,6 +150,7 @@ export interface PackageSummaryWithChanges__1 {
 export interface PackageSummary__1 {
   'ownerInfo' : User,
   'owner' : Principal,
+  'quality' : PackageQuality,
   'downloadsTotal' : bigint,
   'downloadsInLast30Days' : bigint,
   'downloadsInLast7Days' : bigint,
@@ -173,6 +191,8 @@ export type Result_6 = { 'ok' : Array<[PackageName, PackageVersion]> } |
   { 'err' : Err };
 export type Result_7 = { 'ok' : Array<FileId> } |
   { 'err' : Err };
+export type Result_8 = { 'ok' : Array<[FileId, Uint8Array | number[]]> } |
+  { 'err' : Err };
 export interface Script { 'value' : string, 'name' : string }
 export type SemverPart = { 'major' : null } |
   { 'minor' : null } |
@@ -233,6 +253,7 @@ export interface User__1 {
 export interface _SERVICE {
   'backup' : ActorMethod<[], undefined>,
   'claimAirdrop' : ActorMethod<[Principal], string>,
+  'computeHashesForExistingFiles' : ActorMethod<[], undefined>,
   'diff' : ActorMethod<[string, string], PackageChanges__1>,
   'finishPublish' : ActorMethod<[PublishingId], Result>,
   'getAirdropAmount' : ActorMethod<[], bigint>,
@@ -251,6 +272,11 @@ export interface _SERVICE {
     [PackageName],
     Array<DownloadsSnapshot__1>
   >,
+  'getFileHashes' : ActorMethod<[PackageName, PackageVersion], Result_8>,
+  'getFileHashesByPackageIds' : ActorMethod<
+    [Array<PackageId>],
+    Array<[PackageId, Array<[FileId, Uint8Array | number[]]>]>
+  >,
   'getFileIds' : ActorMethod<[PackageName, PackageVersion], Result_7>,
   'getHighestSemverBatch' : ActorMethod<
     [Array<[PackageName, PackageVersion, SemverPart]>],

package/dist/declarations/main/main.did.js

@@ -28,6 +28,10 @@ export const idlFactory = ({ IDL }) => {
     'downloads' : IDL.Nat,
   });
   const FileId = IDL.Text;
+  const Result_8 = IDL.Variant({
+    'ok' : IDL.Vec(IDL.Tuple(FileId, IDL.Vec(IDL.Nat8))),
+    'err' : Err,
+  });
   const Result_7 = IDL.Variant({ 'ok' : IDL.Vec(FileId), 'err' : Err });
   const SemverPart = IDL.Variant({
     'major' : IDL.Null,
@@ -51,6 +55,21 @@ export const idlFactory = ({ IDL }) => {
     'githubVerified' : IDL.Bool,
     'github' : IDL.Text,
   });
+  const DepsStatus = IDL.Variant({
+    'allLatest' : IDL.Null,
+    'tooOld' : IDL.Null,
+    'updatesAvailable' : IDL.Null,
+  });
+  const PackageQuality = IDL.Record({
+    'depsStatus' : DepsStatus,
+    'hasDescription' : IDL.Bool,
+    'hasKeywords' : IDL.Bool,
+    'hasLicense' : IDL.Bool,
+    'hasDocumentation' : IDL.Bool,
+    'hasTests' : IDL.Bool,
+    'hasRepository' : IDL.Bool,
+    'hasReleaseNotes' : IDL.Bool,
+  });
   const Script = IDL.Record({ 'value' : IDL.Text, 'name' : IDL.Text });
   const PackageName__1 = IDL.Text;
   const DependencyV2 = IDL.Record({
@@ -84,6 +103,7 @@ export const idlFactory = ({ IDL }) => {
   const PackageSummary = IDL.Record({
     'ownerInfo' : User,
     'owner' : IDL.Principal,
+    'quality' : PackageQuality,
     'downloadsTotal' : IDL.Nat,
     'downloadsInLast30Days' : IDL.Nat,
     'downloadsInLast7Days' : IDL.Nat,
@@ -93,6 +113,7 @@ export const idlFactory = ({ IDL }) => {
   const PackageSummary__1 = IDL.Record({
     'ownerInfo' : User,
     'owner' : IDL.Principal,
+    'quality' : PackageQuality,
     'downloadsTotal' : IDL.Nat,
     'downloadsInLast30Days' : IDL.Nat,
     'downloadsInLast7Days' : IDL.Nat,
@@ -121,6 +142,7 @@ export const idlFactory = ({ IDL }) => {
   const PackageSummaryWithChanges__1 = IDL.Record({
     'ownerInfo' : User,
     'owner' : IDL.Principal,
+    'quality' : PackageQuality,
     'downloadsTotal' : IDL.Nat,
     'downloadsInLast30Days' : IDL.Nat,
     'downloadsInLast7Days' : IDL.Nat,
@@ -132,6 +154,7 @@ export const idlFactory = ({ IDL }) => {
     'ownerInfo' : User,
     'owner' : IDL.Principal,
     'deps' : IDL.Vec(PackageSummary__1),
+    'quality' : PackageQuality,
     'testStats' : TestStats__1,
     'downloadsTotal' : IDL.Nat,
     'downloadsInLast30Days' : IDL.Nat,
@@ -149,6 +172,7 @@ export const idlFactory = ({ IDL }) => {
   const PackageSummaryWithChanges = IDL.Record({
     'ownerInfo' : User,
     'owner' : IDL.Principal,
+    'quality' : PackageQuality,
     'downloadsTotal' : IDL.Nat,
     'downloadsInLast30Days' : IDL.Nat,
     'downloadsInLast7Days' : IDL.Nat,
@@ -235,6 +259,7 @@ export const idlFactory = ({ IDL }) => {
   return IDL.Service({
     'backup' : IDL.Func([], [], []),
     'claimAirdrop' : IDL.Func([IDL.Principal], [IDL.Text], []),
+    'computeHashesForExistingFiles' : IDL.Func([], [], []),
     'diff' : IDL.Func([IDL.Text, IDL.Text], [PackageChanges__1], ['query']),
     'finishPublish' : IDL.Func([PublishingId], [Result], []),
     'getAirdropAmount' : IDL.Func([], [IDL.Nat], ['query']),
@@ -256,6 +281,16 @@ export const idlFactory = ({ IDL }) => {
         [IDL.Vec(DownloadsSnapshot__1)],
         ['query'],
       ),
+    'getFileHashes' : IDL.Func([PackageName, PackageVersion], [Result_8], []),
+    'getFileHashesByPackageIds' : IDL.Func(
+        [IDL.Vec(PackageId)],
+        [
+          IDL.Vec(
+            IDL.Tuple(PackageId, IDL.Vec(IDL.Tuple(FileId, IDL.Vec(IDL.Nat8))))
+          ),
+        ],
+        [],
+      ),
     'getFileIds' : IDL.Func(
         [PackageName, PackageVersion],
         [Result_7],

package/dist/integrity.d.ts

@@ -0,0 +1,5 @@
+export declare function checkIntegrity(lock?: 'save' | 'check' | 'ignore'): Promise<void>;
+export declare function getLocalFileHash(fileId: string): string;
+export declare function checkRemote(): Promise<void>;
+export declare function saveLockFile(): Promise<void>;
+export declare function checkLockFile(force?: boolean): Promise<void>;

package/dist/integrity.js

@@ -0,0 +1,155 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { sha256 } from '@noble/hashes/sha256';
+import { bytesToHex } from '@noble/hashes/utils';
+import { getDependencyType, getRootDir, mainActor } from './mops.js';
+import { resolvePackages } from './resolve-packages.js';
+export async function checkIntegrity(lock) {
+    let force = !!lock;
+    if (!lock) {
+        lock = process.env['CI'] ? 'check' : 'ignore';
+    }
+    if (lock === 'save') {
+        await saveLockFile();
+        await checkLockFile(force);
+    }
+    else if (lock === 'check') {
+        await checkLockFile(force);
+    }
+}
+async function getFileHashesFromRegistry() {
+    let packageIds = await getResolvedMopsPackageIds();
+    let actor = await mainActor();
+    let fileHashesByPackageIds = await actor.getFileHashesByPackageIds(packageIds);
+    return fileHashesByPackageIds;
+}
+async function getResolvedMopsPackageIds() {
+    let resolvedPackages = await resolvePackages();
+    let packageIds = Object.entries(resolvedPackages)
+        .filter(([_, version]) => getDependencyType(version) === 'mops')
+        .map(([name, version]) => `${name}@${version}`);
+    return packageIds;
+}
+// get hash of local file from '.mops' dir by fileId
+export function getLocalFileHash(fileId) {
+    let rootDir = getRootDir();
+    let file = path.join(rootDir, '.mops', fileId);
+    if (!fs.existsSync(file)) {
+        console.error(`Missing file ${fileId} in .mops dir`);
+        process.exit(1);
+    }
+    let fileData = fs.readFileSync(file);
+    return bytesToHex(sha256(fileData));
+}
+function getMopsTomlHash() {
+    return bytesToHex(sha256(fs.readFileSync(getRootDir() + '/mops.toml')));
+}
+// compare hashes of local files with hashes from the registry
+export async function checkRemote() {
+    let fileHashesFromRegistry = await getFileHashesFromRegistry();
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    for (let [_packageId, fileHashes] of fileHashesFromRegistry) {
+        for (let [fileId, hash] of fileHashes) {
+            let remoteHash = new Uint8Array(hash);
+            let localHash = getLocalFileHash(fileId);
+            if (localHash !== bytesToHex(remoteHash)) {
+                console.error('Integrity check failed.');
+                console.error(`Mismatched hash for ${fileId}: ${localHash} vs ${bytesToHex(remoteHash)}`);
+                process.exit(1);
+            }
+        }
+    }
+}
+export async function saveLockFile() {
+    let rootDir = getRootDir();
+    let lockFile = path.join(rootDir, 'mops.lock');
+    // if lock file exists and mops.toml hasn't changed, don't update it
+    if (fs.existsSync(lockFile)) {
+        let lockFileJson = JSON.parse(fs.readFileSync(lockFile).toString());
+        let mopsTomlHash = getMopsTomlHash();
+        if (mopsTomlHash === lockFileJson.mopsTomlHash) {
+            return;
+        }
+    }
+    let fileHashes = await getFileHashesFromRegistry();
+    let lockFileJson = {
+        version: 1,
+        mopsTomlHash: getMopsTomlHash(),
+        hashes: fileHashes.reduce((acc, [packageId, fileHashes]) => {
+            acc[packageId] = fileHashes.reduce((acc, [fileId, hash]) => {
+                acc[fileId] = bytesToHex(new Uint8Array(hash));
+                return acc;
+            }, {});
+            return acc;
+        }, {}),
+    };
+    fs.writeFileSync(lockFile, JSON.stringify(lockFileJson, null, 2));
+}
+// compare hashes of local files with hashes from the lock file
+export async function checkLockFile(force = false) {
+    let rootDir = getRootDir();
+    let lockFile = path.join(rootDir, 'mops.lock');
+    // check if lock file exists
+    if (!fs.existsSync(lockFile)) {
+        if (force) {
+            console.error('Missing lock file. Run `mops install` to generate it.');
+            process.exit(1);
+        }
+        return;
+    }
+    let lockFileJson = JSON.parse(fs.readFileSync(lockFile).toString());
+    let packageIds = await getResolvedMopsPackageIds();
+    // check lock file version
+    if (lockFileJson.version !== 1) {
+        console.error('Integrity check failed');
+        console.error(`Invalid lock file version: ${lockFileJson.version}. Supported versions: 1`);
+        process.exit(1);
+    }
+    // check mops.toml hash
+    if (lockFileJson.mopsTomlHash !== getMopsTomlHash()) {
+        console.error('Integrity check failed');
+        console.error('Mismatched mops.toml hash');
+        console.error(`Locked hash: ${lockFileJson.mopsTomlHash}`);
+        console.error(`Actual hash: ${getMopsTomlHash()}`);
+        process.exit(1);
+    }
+    // check number of packages
+    if (Object.keys(lockFileJson.hashes).length !== packageIds.length) {
+        console.error('Integrity check failed');
+        console.error(`Mismatched number of resolved packages: ${JSON.stringify(Object.keys(lockFileJson.hashes).length)} vs ${JSON.stringify(packageIds.length)}`);
+        process.exit(1);
+    }
+    // check if resolved packages are in the lock file
+    for (let packageId of packageIds) {
+        if (!(packageId in lockFileJson.hashes)) {
+            console.error('Integrity check failed');
+            console.error(`Missing package ${packageId} in lock file`);
+            process.exit(1);
+        }
+    }
+    for (let [packageId, hashes] of Object.entries(lockFileJson.hashes)) {
+        // check if package is in resolved packages
+        if (!packageIds.includes(packageId)) {
+            console.error('Integrity check failed');
+            console.error(`Package ${packageId} in lock file but not in resolved packages`);
+            process.exit(1);
+        }
+        for (let [fileId, lockedHash] of Object.entries(hashes)) {
+            // check if file belongs to package
+            if (!fileId.startsWith(packageId)) {
+                console.error('Integrity check failed');
+                console.error(`File ${fileId} in lock file does not belong to package ${packageId}`);
+                process.exit(1);
+            }
+            // local file hash vs hash from lock file
+            let localHash = getLocalFileHash(fileId);
+            if (lockedHash !== localHash) {
+                console.error('Integrity check failed');
+                console.error(`Mismatched hash for ${fileId}`);
+                console.error(`Locked hash: ${lockedHash}`);
+                console.error(`Actual hash: ${localHash}`);
+                process.exit(1);
+            }
+        }
+    }
+}

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ic-mops",
-  "version": "0.32.2",
+  "version": "0.33.0",
   "type": "module",
   "bin": {
     "mops": "dist/cli.js"
@@ -38,6 +38,7 @@
     "@dfinity/identity-secp256k1": "^0.18.1",
     "@dfinity/principal": "^0.18.1",
     "@iarna/toml": "^2.2.5",
+    "@noble/hashes": "1.3.2",
     "as-table": "^1.0.55",
     "cacheable-request": "10.2.12",
     "camelcase": "^7.0.1",

package/dist/vessel.js

@@ -120,11 +120,11 @@ export const installFromGithub = async (name, repo, { verbose = false, dep = fal
     let dir = formatGithubDir(name, repo);
     let cacheName = `_github/${name}#${branch}` + (commitHash ? `@${commitHash}` : '');
     if (existsSync(dir)) {
-        silent || logUpdate(`${dep ? 'Dependency' : 'Installing'} ${repo} (local cache) from Github`);
+        silent || logUpdate(`${dep ? 'Dependency' : 'Installing'} ${repo} (local cache)`);
     }
     else if (isCached(cacheName)) {
         await copyCache(cacheName, dir);
-        silent || logUpdate(`${dep ? 'Dependency' : 'Installing'} ${repo} (global cache) from Github`);
+        silent || logUpdate(`${dep ? 'Dependency' : 'Installing'} ${repo} (global cache)`);
     }
     else {
         mkdirSync(dir, { recursive: true });