v1.1.1 — Publish Fix, Transformers.js v4 Support, Documentation

What's Fixed

Broken install on v1.1.0

The v1.1.0 packages were published with unresolved workspace:^ references, which meant npm install would fail with EUNSUPPORTEDPROTOCOL. This happened because the packages were published with npm instead of pnpm (pnpm is the only tool that resolves workspace protocol references).

All five packages now install correctly:

npm install verifyfetch
npm install @verifyfetch/cli
npm install @verifyfetch/transformers
npm install @verifyfetch/webllm
npm install @verifyfetch/manifests

Publish safeguards

Added multiple layers to make sure this can't happen again:

• prepack guard on every package that blocks npm/yarn from packing workspace packages
• `only-allow pnpm` preinstall that rejects npm/yarn at install time
• CI tarball validation that inspects packed output for unresolved workspace references on every push

Transformers.js v4 compatibility

• Replaced the `quantized` pipeline option (which was silently ignored by Transformers.js since v3) with `dtype`, which actually works
• Tested and verified against `@huggingface/transformers@4.0.1`

Documentation fixes

• Fixed incorrect CLI commands in core and webllm READMEs (`npx verifyfetch` doesn't work since the core package has no bin entry, corrected to `npx @verifyfetch/cli`)
• Fixed webllm README referencing `sign --chunked` instead of `hash-model` for generating model manifests
• Added missing README for `@verifyfetch/transformers`
• Added missing README for `@verifyfetch/manifests`

Full Changelog

v1.1.0...v1.1.1

v1.1.0 — Transformers.js Integration, CLI Manifest Generator, Pre-computed Manifests

What's New

@verifyfetch/transformers (NEW)

Drop-in integrity verification and resumable downloads for Transformers.js. Works through env.fetch — zero changes to your existing pipeline code.

import { pipeline } from '@huggingface/transformers';
import { enableVerification } from '@verifyfetch/transformers';

enableVerification({ manifestUrl: '/models.vf.manifest.json' });
const pipe = await pipeline('sentiment-analysis', 'Xenova/distilbert-base-uncased-finetuned-sst-2-english');
// Every file is now verified + resumable automatically

Or use the one-shot API:

import { verifiedPipeline } from '@verifyfetch/transformers';

const pipe = await verifiedPipeline('sentiment-analysis', 'Xenova/distilbert-base-uncased-finetuned-sst-2-english', {
  manifestUrl: '/models.vf.manifest.json',
  onProgress: ({ file, percent }) => console.log(`${file}: ${percent}%`)
});

hash-model CLI (NEW)

Generate verification manifests for any Hugging Face model in one command:

npx @verifyfetch/cli hash-model Xenova/distilbert-base-uncased-finetuned-sst-2-english
npx @verifyfetch/cli hash-model onnx-community/Qwen2.5-Coder-0.5B-Instruct --chunked

@verifyfetch/manifests (NEW)

Pre-computed integrity manifests for popular models — ready to use, no hashing required:

import manifest from '@verifyfetch/manifests/transformers/Xenova--all-MiniLM-L6-v2.json';

Install

# Core
npm install verifyfetch

# Transformers.js integration
npm install @verifyfetch/transformers @huggingface/transformers

# WebLLM integration
npm install @verifyfetch/webllm @mlc-ai/web-llm

Full Changelog

v1.0.0...v1.1.0

v1.0.0 — WebLLM Integration, Resumable Downloads, Chunked Verification

Highlights

• @verifyfetch/webllm — Drop-in verified model loading for WebLLM/MLC
• Resumable downloads — Interrupted downloads resume from the last verified chunk via IndexedDB
• Chunked verification — Fail-fast corruption detection for multi-GB files
• Service Worker — Transparent verification proxy for any fetch request
• Constant memory — Streaming verification, never buffers the full file

Install

npm install verifyfetch
npm install @verifyfetch/webllm @mlc-ai/web-llm

v0.2.0 — Streaming API, Merkle Trees, Service Worker

Highlights

• Streaming verification — Verify files as they download, constant memory usage
• Merkle tree hashing — Efficient chunk-level integrity for large files
• Service Worker integration — Intercept and verify fetch requests transparently
• Multi-CDN support — Failover between CDN sources with per-chunk verification