Multi-file and directory selection with normalized, deterministic code-point path ordering.
SHA-256 and SHA-512 content manifests recording source kind, generator version, algorithms and operation semantics.
Reference comparison showing matching, changed, missing and unexpected files.
Stable JSON and spreadsheet-safe CSV reports.
Deterministic ZIP output with sorted entries, fixed ZIP-epoch timestamps and an embedded manifest.
Optional P-256 signature envelopes using a fresh non-exportable, memory-only private key.
Offline PWA, responsive shell and light/dark/system themes.

Limits and interpretation

Files are limited to 64 MiB each, 256 MiB per selection and 10,000 entries. Individual UTF-8 paths are capped at 4 KiB and aggregate path metadata at 4 MiB. Reference manifests are schema-, count-, digest- and path-validated before comparison. In-browser ZIP creation is capped at 128 MiB and can require substantially more temporary memory than the source files. Timestamps are omitted by default; enabling them deliberately makes the manifest different on every run.

Session signatures prove integrity relative to their public key, not the identity of a person or build system. Authenticate the public key independently. ECDSA signatures are intentionally not byte-reproducible.

Development

npm ci
npm run check
npm run test:browser
npm run package:release -- --force

Node.js 22+ and npm 11 are required. The deterministic release is release/repro-tools-0.1.0.zip with its SHA-256 sidecar.

Licence

GPL-3.0-or-later.