Pin verified npm artifact identity before install

[solnikhil]

Summary

• resolve registry ranges and tags to one exact version before user confirmation
• fetch the candidate with npm pack into an isolated cache, then require exact agreement between metadata SRI, pack integrity, tarball URL, and independently streamed bytes
• recheck exact-version registry metadata after confirmation and install the exact version from the verified cache
• persist immutable package identity in pin schema v2, with explicit v1 migration behavior
• hard-fail same-subject, same-version integrity or tarball mutation while preserving manual review for package, namespace, registry, or version changes
• document the trust boundary: prefer-offline depends on npm honoring cached SRI; existing satisfied node_modules and transitive dependencies are outside this root-artifact guarantee

Verification

• npm test: 398/398 passing
• live Windows project/global E2E using zuraai.xyz@*
• live range resolution using lodash@^4 selected exact 4.18.1
• package verification passed
• npm audit: 0 vulnerabilities
• clean diff check passed

Closes #24

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f0f24117-0f4a-4eef-8ed5-f174b108c6fd

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}