@zof-ai/api-contract-check 0.0.0-stage → 0.1.1

package/CHANGELOG.md

@@ -0,0 +1,9 @@
+# Changelog
+
+## 0.1.1
+
+Document public installation, executable entry points and reproducible packaged examples. Align release dependency pins; runtime behavior is unchanged.
+
+## 0.1.0 (unreleased)
+
+Initial independently authored public implementation, distributed under Apache-2.0.

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,3 @@
+# Community conduct
+
+Be respectful, constructive and specific. Harassment, discrimination, personal attacks and publication of private information are unacceptable. Maintainers may remove harmful content and restrict participation. Report conduct privately through a verified organization maintainer channel; avoid exposing personal information in public issues.

package/CONTRIBUTING.md

@@ -0,0 +1,5 @@
+# Contributing
+
+Use Node.js 22 or 24, run `npm ci --ignore-scripts`, `npm run build`, and `npm test`. Add a regression test for functional or security changes. Keep changes independently authored and free of proprietary code, credentials and customer data. Discuss incompatible API changes before implementation. Contributions use the repository license and require maintainer review; dependency updates are never automatically merged.
+
+Maintainers review issue reproductions, security boundaries, tests, compatibility and package contents. Use semantic versioning; announce breaking interfaces in the changelog. Deprecations require a documented replacement and at least one minor release before removal.

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,90 @@
-# Temporary Holding Version
+# Zof API Contract Check
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Compare local OpenAPI 3.0/3.1 JSON contracts or a supported JSON Schema subset. Findings explain endpoint/method removal, required inputs, incompatible request/response types, constraints, media types and authentication changes. The implementation is independently authored and works offline without a Zof account.
+
+<!-- ZOF_NPM_INSTALL_START -->
+## Install from npm
+
+Use Node.js 22 or 24 and npm. File-based operations require Linux or macOS with Python 3.10 or newer; Windows file operations fail closed. In a new project directory, install the version used by this guide:
+
+```sh
+npm install --ignore-scripts --save-exact @zof-ai/api-contract-check@0.1.1
+npx --no-install zof-api-contract-check --help
+```
+
+The package includes compiled JavaScript, TypeScript declarations and its runtime dependencies. No source build, Zof account or repository upload is required. `--ignore-scripts` disables installation lifecycle scripts; `--no-install` keeps the example commands from downloading another package.
+
+Confirm the public ESM entry point; this prints `function`:
+
+```sh
+node --input-type=module -e "import('@zof-ai/api-contract-check').then(api => console.log(typeof api.compareContracts))"
+```
+
+Run a packaged example from the same directory:
+
+```sh
+npx --no-install zof-api-contract-check baseline.json compatible.json --root node_modules/@zof-ai/api-contract-check/examples --kind openapi --json
+```
+
+The compatible OpenAPI example reports `compatible: true`; the breaking example described below exits 1.
+
+Package: [@zof-ai/api-contract-check](https://www.npmjs.com/package/@zof-ai/api-contract-check). The source-checkout instructions and three additional workflows follow.
+<!-- ZOF_NPM_INSTALL_END -->
+
+<!-- ZOF_RELEASE_INSTALL_START -->
+## Install from GitHub source
+
+Requires Node.js 22 or 24, npm, and Git. Filesystem operations require Linux or macOS with Python 3.10 or newer; Windows file operations fail closed. Clone this repository and explicitly prepare its reviewed release dependencies:
+
+```sh
+git clone --branch v0.1.1 --depth 1 https://github.com/Zof-AI/zof-api-contract-check.git
+cd zof-api-contract-check
+node scripts/bootstrap.mjs --allow-network
+npm ci --ignore-scripts --prefer-offline
+npm run build
+npm test
+```
+
+The bootstrap downloads only the exact versioned dependency assets from [GitHub Releases](https://github.com/Zof-AI/zof-api-contract-check/releases), as listed in `scripts/release-dependencies.json`, verifies SHA256 and byte size, and adds them to the npm cache. It does not extract archives, run package scripts, collect application data, or send credentials. Downloads require the explicit flag and follow only HTTPS GitHub asset redirects. Installation then fetches ordinary third-party dependencies from npm. Use a writable npm cache; set `npm_config_cache` consistently for both commands if needed. An unavailable asset, changed hash, or oversized response stops installation.
+
+<!-- ZOF_RELEASE_INSTALL_END -->
+
+## Local installation
+
+Use Node.js 22 or 24. After the source installation above:
+
+```sh
+npm ci --ignore-scripts
+npm run build
+npm test
+npm pack --ignore-scripts
+```
+
+Use the GitHub source installation above to obtain the exact release dependencies before building or importing the library. The npm package name is an identifier; registry publication remains separate.
+
+## Three examples
+
+Run from the repository root after building, or substitute the installed `zof-api-contract-check` executable.
+
+```sh
+# Compatible optional response field: exit 0
+node dist/cli.js examples/baseline.json examples/compatible.json --json
+# Response integer changed to string: exit 1
+node dist/cli.js examples/baseline.json examples/breaking.json --markdown
+# Authentication rollout review with explicit policy: exit 1
+node dist/cli.js examples/baseline.json examples/authentication.json --policy examples/policy.json --json
+```
+
+Pass `--root DIR` to set the only readable workspace root. For standalone JSON Schema comparisons use `--kind json-schema`; this compares accepted inputs, so narrower candidate constraints are incompatible. Default reports are Markdown. Exit codes: 0 completed below the policy threshold, 1 findings at or above it, 2 invalid input or unsupported/incomplete analysis. All findings remain in the report when policy lowers severity.
+
+## Library
+
+```js
+import { compareContracts, readContract, renderMarkdown } from '@zof-ai/api-contract-check';
+const baseline = await readContract(process.cwd(), 'baseline.json');
+const candidate = await readContract(process.cwd(), 'candidate.json');
+const report = compareContracts(baseline, candidate, { failOn: 'high' });
+console.log(renderMarkdown(report));
+```
+
+See [API](docs/API.md), [limitations](docs/LIMITATIONS.md), [security](SECURITY.md), and [release gates](docs/RELEASE.md). No hosted integration or telemetry is implemented.

package/SECURITY.md

@@ -0,0 +1,7 @@
+# Security policy
+
+The 0.1.x line is the initial supported release line. Local analyses are bounded and offline unless an operation is explicitly documented otherwise. Do not provide production secrets or execute untrusted generated code.
+
+Use GitHub private vulnerability reporting when enabled for this repository. If it is unavailable, contact an organization owner through an already verified private channel; do not file credentials, exploit details, or customer data in a public issue. Reports will be triaged, reproduced using synthetic data, fixed and reviewed before coordinated disclosure. No response SLA is promised for this initial release.
+
+Filesystem operations use bounded, directory-relative descriptors on Linux/macOS with Python 3.10 or newer. Symlinks, hard-linked inputs, special files and traversal are rejected. Open descriptors remain attached to the original directory when names change. File contents can still change during a read or snapshot; this is not an atomic filesystem snapshot. Windows filesystem operations fail closed; in-memory JSON validation and analysis do not require the file helper.

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+import { compareContracts, readContract, renderMarkdown, } from "./index.js";
+import { cliError, fail, record } from "./common.js";
+try {
+    const args = process.argv.slice(2);
+    if (args.includes("--help")) {
+        console.log("zof-api-contract-check BASELINE.json CANDIDATE.json [--root DIR] [--kind openapi|json-schema] [--policy POLICY.json] [--json|--markdown]\nOffline JSON contracts. Exit 0: completed below threshold; 1: findings; 2: invalid/unsupported input.");
+    }
+    else if (args.includes("--version"))
+        console.log("0.1.1");
+    else {
+        let root = process.cwd(), format = "markdown", policy, kind;
+        const files = [];
+        for (let i = 0; i < args.length; i++) {
+            const a = args[i];
+            if (a === "--root") {
+                root = args[++i] ?? fail("ARGUMENT_REQUIRED");
+            }
+            else if (a === "--policy")
+                policy = args[++i] ?? fail("ARGUMENT_REQUIRED");
+            else if (a === "--kind")
+                kind = args[++i];
+            else if (a === "--json")
+                format = "json";
+            else if (a === "--markdown")
+                format = "markdown";
+            else if (a.startsWith("-"))
+                fail("ARGUMENT_UNKNOWN");
+            else
+                files.push(a);
+        }
+        if (files.length !== 2)
+            fail("TWO_FILES_REQUIRED");
+        const options = policy
+            ? record(await readContract(root, policy))
+            : {};
+        if (kind)
+            options.kind = kind;
+        const result = compareContracts(await readContract(root, files[0]), await readContract(root, files[1]), options);
+        console.log(format === "json"
+            ? JSON.stringify(result, null, 2)
+            : renderMarkdown(result));
+        process.exitCode = result.compatible ? 0 : 1;
+    }
+}
+catch (error) {
+    cliError(error);
+}

package/dist/common.d.ts

@@ -0,0 +1,26 @@
+export declare const MAX_INPUT_BYTES: number;
+export type Severity = "info" | "low" | "medium" | "high" | "critical";
+export interface Finding {
+    id: string;
+    severity: Severity;
+    message: string;
+    path?: string;
+}
+export declare class SafeInputError extends Error {
+    readonly code: string;
+    constructor(code: string);
+}
+export declare function fail(code: string): never;
+export declare function record(v: unknown): Record<string, unknown>;
+export declare function guard(v: unknown, depth?: number, budget?: {
+    n: number;
+    bytes: number;
+}): void;
+export declare function parseJson(text: string): unknown;
+export declare function relativePath(path: string): void;
+export declare function readBounded(root: string, path: string): Promise<string>;
+export declare function severity(value: unknown): Severity;
+export declare function exceeds(findings: Finding[], level?: Severity): boolean;
+export declare function display(path: string): string;
+export declare function markdown(title: string, findings: Finding[], limitations: string[]): string;
+export declare function cliError(error: unknown): void;

package/dist/common.js

@@ -0,0 +1,114 @@
+import { redactText, safeReadFile } from "@zof-ai/evidence-spec";
+import { isAbsolute } from "node:path";
+export const MAX_INPUT_BYTES = 4 * 1024 * 1024;
+export class SafeInputError extends Error {
+    code;
+    constructor(code) {
+        super(`Input rejected (${code}).`);
+        this.code = code;
+        this.name = "SafeInputError";
+    }
+}
+export function fail(code) {
+    throw new SafeInputError(code);
+}
+export function record(v) {
+    if (!v || typeof v !== "object" || Array.isArray(v))
+        fail("OBJECT_REQUIRED");
+    return v;
+}
+export function guard(v, depth = 0, budget = { n: 0, bytes: 0 }) {
+    if (depth > 48 || ++budget.n > 100000)
+        fail("INPUT_COMPLEXITY");
+    if (v === null || typeof v === "boolean")
+        return;
+    if (typeof v === "string") {
+        budget.bytes += Buffer.byteLength(v);
+        if (budget.bytes > MAX_INPUT_BYTES)
+            fail("INPUT_SIZE");
+        return;
+    }
+    if (typeof v === "number") {
+        if (!Number.isFinite(v))
+            fail("NUMBER_INVALID");
+        return;
+    }
+    if (typeof v !== "object")
+        fail("JSON_REQUIRED");
+    if (!Array.isArray(v) &&
+        Object.getPrototypeOf(v) !== Object.prototype &&
+        Object.getPrototypeOf(v) !== null)
+        fail("JSON_REQUIRED");
+    for (const d of Object.values(Object.getOwnPropertyDescriptors(v))) {
+        if (d.get || d.set)
+            fail("ACCESSOR_REJECTED");
+        guard(d.value, depth + 1, budget);
+    }
+}
+export function parseJson(text) {
+    if (Buffer.byteLength(text) > MAX_INPUT_BYTES)
+        fail("INPUT_SIZE");
+    let v;
+    try {
+        v = JSON.parse(text);
+    }
+    catch {
+        fail("JSON_INVALID");
+    }
+    guard(v);
+    return v;
+}
+export function relativePath(path) {
+    if (typeof path !== "string" ||
+        path.length > 512 ||
+        isAbsolute(path) ||
+        path.includes("\\") ||
+        path.includes("\0") ||
+        path.includes(":") ||
+        path.split("/").some((x) => !x || x === "." || x === ".."))
+        fail("PATH_INVALID");
+}
+export async function readBounded(root, path) {
+    relativePath(path);
+    try {
+        const data = await safeReadFile(root, path, MAX_INPUT_BYTES);
+        return new TextDecoder("utf-8", { fatal: true }).decode(data);
+    }
+    catch (e) {
+        if (e instanceof SafeInputError)
+            throw e;
+        fail("FILE_UNAVAILABLE");
+    }
+}
+const severityOrder = ["info", "low", "medium", "high", "critical"];
+export function severity(value) {
+    if (!severityOrder.includes(value))
+        fail("SEVERITY_INVALID");
+    return value;
+}
+export function exceeds(findings, level = "high") {
+    return findings.some((f) => severityOrder.indexOf(f.severity) >= severityOrder.indexOf(level));
+}
+export function display(path) {
+    path = redactText(path);
+    return /^[\w/.{}~:$ -]{1,400}$/.test(path) && !path.includes("://")
+        ? path
+        : "[location omitted]";
+}
+export function markdown(title, findings, limitations) {
+    return (`# ${title}\n\n` +
+        (findings.length
+            ? findings
+                .map((f) => `- **${f.severity}** ${f.id}: ${f.message}${f.path ? " (" + display(f.path) + ")" : ""}`)
+                .join("\n")
+            : "No findings in the supported static checks.") +
+        "\n\nLimitations:\n" +
+        limitations.map((s) => "- " + s).join("\n") +
+        "\n");
+}
+export function cliError(error) {
+    process.stderr.write(error instanceof SafeInputError
+        ? error.message + "\n"
+        : "Operation failed safely.\n");
+    process.exitCode = 2;
+}

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+import { type Finding, type Severity } from "./common.js";
+export { SafeInputError, type Finding, type Severity } from "./common.js";
+export interface ContractOptions {
+    kind?: "openapi" | "json-schema";
+    failOn?: Severity;
+    severity?: Record<string, Severity>;
+}
+export interface ContractReport {
+    kind: "openapi" | "json-schema";
+    compatible: boolean;
+    findings: Finding[];
+    limitations: string[];
+}
+export declare function compareContracts(baseline: unknown, candidate: unknown, options?: ContractOptions): ContractReport;
+export declare const readContract: (root: string, path: string) => Promise<unknown>;
+export declare const renderMarkdown: (report: ContractReport) => string;

package/dist/index.js

@@ -0,0 +1,419 @@
+import { fail, record, guard, parseJson, readBounded, severity, exceeds, display, markdown, } from "./common.js";
+export { SafeInputError } from "./common.js";
+const methods = [
+    "get",
+    "put",
+    "post",
+    "delete",
+    "options",
+    "head",
+    "patch",
+    "trace",
+];
+const keys = new Set([
+    "type",
+    "enum",
+    "const",
+    "required",
+    "properties",
+    "items",
+    "$ref",
+    "$defs",
+    "definitions",
+    "additionalProperties",
+    "minimum",
+    "maximum",
+    "exclusiveMinimum",
+    "exclusiveMaximum",
+    "minLength",
+    "maxLength",
+    "minItems",
+    "maxItems",
+    "pattern",
+    "format",
+    "nullable",
+    "description",
+    "title",
+    "default",
+    "examples",
+    "example",
+    "deprecated",
+    "readOnly",
+    "writeOnly",
+    "xml",
+    "externalDocs",
+    "$schema",
+    "$id",
+]);
+const limits = [
+    "minimum",
+    "maximum",
+    "exclusiveMinimum",
+    "exclusiveMaximum",
+    "minLength",
+    "maxLength",
+    "minItems",
+    "maxItems",
+];
+const limitations = [
+    "Static JSON OpenAPI 3.0/3.1 and a documented JSON Schema subset only; YAML, composition and remote/file references are rejected.",
+    "No runtime implementation, production traffic or behavioral compatibility is verified.",
+    "Response property removal is conservatively flagged even when optional; severity policies change CI disposition, not the facts.",
+];
+function stable(v) {
+    if (Array.isArray(v))
+        return "[" + v.map(stable).join(",") + "]";
+    if (v && typeof v === "object")
+        return ("{" +
+            Object.keys(v)
+                .sort()
+                .map((k) => JSON.stringify(k) + ":" + stable(v[k]))
+                .join(",") +
+            "}");
+    return JSON.stringify(v);
+}
+function strings(v) {
+    if (v === undefined)
+        return [];
+    if (!Array.isArray(v) || v.some((s) => typeof s !== "string"))
+        fail("STRING_ARRAY_REQUIRED");
+    return v;
+}
+function deref(root, value, stack = []) {
+    const obj = record(value);
+    if (obj.$ref === undefined)
+        return obj;
+    const ref = obj.$ref;
+    if (typeof ref !== "string" ||
+        (ref !== "#" && !ref.startsWith("#/")) ||
+        ref.length > 512)
+        fail("REFERENCE_UNSUPPORTED");
+    if (stack.includes(ref) || stack.length >= 24)
+        fail("REFERENCE_CYCLE");
+    if (Object.keys(obj).some((k) => !["$ref", "description", "summary"].includes(k)))
+        fail("REFERENCE_SIBLING_UNSUPPORTED");
+    let target = root;
+    for (const segment of ref === "#" ? [] : ref.slice(2).split("/")) {
+        const key = segment.replace(/~1/g, "/").replace(/~0/g, "~");
+        const r = record(target);
+        if (!Object.hasOwn(r, key))
+            fail("REFERENCE_MISSING");
+        target = r[key];
+    }
+    return deref(root, target, [...stack, ref]);
+}
+function checkSchema(root, value, refs = new Set(), depth = 0) {
+    if (depth > 32 || refs.has(value))
+        fail("SCHEMA_RECURSION");
+    const next = new Set(refs);
+    next.add(value);
+    const s = deref(root, value);
+    if (next.has(s) && s !== value)
+        fail("SCHEMA_RECURSION");
+    for (const k of Object.keys(s))
+        if (!keys.has(k))
+            fail("SCHEMA_KEYWORD_UNSUPPORTED");
+    const types = s.type === undefined
+        ? []
+        : typeof s.type === "string"
+            ? [s.type]
+            : strings(s.type);
+    if (types.some((t) => ![
+        "null",
+        "string",
+        "integer",
+        "number",
+        "boolean",
+        "array",
+        "object",
+    ].includes(t)))
+        fail("SCHEMA_TYPE_INVALID");
+    strings(s.required);
+    if (s.enum !== undefined && (!Array.isArray(s.enum) || !s.enum.length))
+        fail("SCHEMA_ENUM_INVALID");
+    for (const k of limits)
+        if (s[k] !== undefined &&
+            (typeof s[k] !== "number" || !Number.isFinite(s[k])))
+            fail("SCHEMA_LIMIT_INVALID");
+    for (const k of ["pattern", "format"])
+        if (s[k] !== undefined && typeof s[k] !== "string")
+            fail("SCHEMA_STRING_INVALID");
+    for (const k of ["nullable", "readOnly", "writeOnly"])
+        if (s[k] !== undefined && typeof s[k] !== "boolean")
+            fail("SCHEMA_BOOLEAN_INVALID");
+    for (const k of ["properties", "$defs", "definitions"])
+        if (s[k] !== undefined)
+            for (const v of Object.values(record(s[k])))
+                checkSchema(root, v, next, depth + 1);
+    if (s.items !== undefined)
+        checkSchema(root, s.items, next, depth + 1);
+    if (s.additionalProperties !== undefined &&
+        typeof s.additionalProperties !== "boolean")
+        checkSchema(root, s.additionalProperties, next, depth + 1);
+}
+function schemaType(s) {
+    const t = s.type === undefined
+        ? ["any"]
+        : typeof s.type === "string"
+            ? [s.type]
+            : strings(s.type);
+    return s.nullable === true ? [...t, "null"] : t;
+}
+function isSubset(a, b) {
+    return a.every((t) => b.includes(t) ||
+        b.includes("any") ||
+        (t === "integer" && b.includes("number")));
+}
+export function compareContracts(baseline, candidate, options = {}) {
+    guard(baseline);
+    guard(candidate);
+    guard(options);
+    const b = record(baseline), c = record(candidate);
+    const kind = options.kind ?? (b.openapi !== undefined ? "openapi" : "json-schema");
+    if (!["openapi", "json-schema"].includes(kind))
+        fail("KIND_INVALID");
+    const threshold = severity(options.failOn ?? "high");
+    const policy = options.severity ?? {};
+    record(policy);
+    for (const v of Object.values(policy))
+        severity(v);
+    const findings = [];
+    const add = (id, message, path, level = "high") => {
+        if (findings.length >= 10000)
+            fail("FINDING_LIMIT");
+        findings.push({
+            id,
+            severity: policy[id] ?? level,
+            message,
+            path: display(path),
+        });
+    };
+    function compare(bs, cs, path, direction, depth = 0) {
+        if (depth > 32)
+            fail("SCHEMA_RECURSION");
+        const x = deref(b, bs), y = deref(c, cs);
+        const left = schemaType(x), right = schemaType(y);
+        if (!(direction === "request" ? isSubset(left, right) : isSubset(right, left)))
+            add("type-incompatible", "The accepted or returned value type is incompatible.", path);
+        const requiredB = strings(x.required), requiredC = strings(y.required);
+        for (const prop of direction === "request"
+            ? requiredC.filter((k) => !requiredB.includes(k))
+            : requiredB.filter((k) => !requiredC.includes(k)))
+            add("required-field-changed", direction === "request"
+                ? "A request property became required."
+                : "A response property is no longer guaranteed.", path + "/properties/" + prop);
+        const en = (s) => s.const !== undefined
+            ? [s.const]
+            : Array.isArray(s.enum)
+                ? s.enum
+                : undefined;
+        const eb = en(x), ec = en(y);
+        if (direction === "request"
+            ? ec &&
+                (!eb || eb.some((v) => !ec.some((w) => stable(v) === stable(w))))
+            : eb &&
+                (!ec || ec.some((v) => !eb.some((w) => stable(v) === stable(w)))))
+            add("enum-incompatible", "Allowed values changed incompatibly.", path);
+        for (const k of limits) {
+            const old = x[k], now = y[k];
+            const min = k.includes("inimum") || k.startsWith("min");
+            const tight = now !== undefined &&
+                (old === undefined || (min ? now > old : now < old));
+            const loose = old !== undefined &&
+                (now === undefined || (min ? now < old : now > old));
+            if (direction === "request" ? tight : loose)
+                add("constraint-incompatible", "A value constraint changed incompatibly.", path + "/" + k);
+        }
+        for (const k of ["pattern", "format", "readOnly", "writeOnly"])
+            if (x[k] !== y[k])
+                add("constraint-changed", "A format, pattern or visibility constraint changed.", path + "/" + k);
+        const xp = x.properties === undefined ? {} : record(x.properties), yp = y.properties === undefined ? {} : record(y.properties);
+        for (const key of Object.keys(xp).sort()) {
+            if (!Object.hasOwn(yp, key)) {
+                if (direction === "response" || y.additionalProperties === false)
+                    add("property-removed", "A previously described property was removed.", path + "/properties/" + key);
+            }
+            else
+                compare(xp[key], yp[key], path + "/properties/" + key, direction, depth + 1);
+        }
+        if (direction === "request" &&
+            y.additionalProperties === false &&
+            x.additionalProperties !== false)
+            add("additional-properties-restricted", "Requests no longer permit additional properties.", path);
+        if (direction === "response" &&
+            x.additionalProperties === false &&
+            (y.additionalProperties !== false || Object.keys(yp).some(k => !Object.hasOwn(xp, k))))
+            add("additional-properties-changed", "Responses may include properties previously forbidden by the contract.", path);
+        if (typeof x.additionalProperties === "object" ||
+            typeof y.additionalProperties === "object") {
+            if (typeof x.additionalProperties === "object" &&
+                typeof y.additionalProperties === "object")
+                compare(x.additionalProperties, y.additionalProperties, path + "/additionalProperties", direction, depth + 1);
+            else if (direction === "request"
+                ? typeof y.additionalProperties === "object"
+                : typeof x.additionalProperties === "object")
+                add("additional-properties-changed", "Additional property constraints changed incompatibly.", path);
+        }
+        if (x.items !== undefined && y.items !== undefined)
+            compare(x.items, y.items, path + "/items", direction, depth + 1);
+        else if (direction === "request"
+            ? x.items === undefined && y.items !== undefined
+            : x.items !== undefined && y.items === undefined)
+            add("items-changed", "Array item constraints changed incompatibly.", path);
+    }
+    if (kind === "json-schema") {
+        checkSchema(b, b);
+        checkSchema(c, c);
+        compare(b, c, "#", "request");
+    }
+    else {
+        for (const root of [b, c]) {
+            if (typeof root.openapi !== "string" ||
+                !/^3\.(0|1)\.\d+$/.test(root.openapi))
+                fail("OPENAPI_VERSION_UNSUPPORTED");
+            if (root.paths === undefined)
+                fail("OPENAPI_PATHS_REQUIRED");
+            record(root.paths);
+            const scan = (v, depth = 0) => {
+                if (depth > 40)
+                    fail("INPUT_COMPLEXITY");
+                if (!v || typeof v !== "object")
+                    return;
+                if (Array.isArray(v)) {
+                    for (const x of v)
+                        scan(x, depth + 1);
+                    return;
+                }
+                const r = record(v);
+                if (r.$ref !== undefined)
+                    deref(root, r);
+                for (const [k, x] of Object.entries(r)) {
+                    if (k === "schema")
+                        checkSchema(root, x);
+                    else if (k === "schemas")
+                        for (const s of Object.values(record(x)))
+                            checkSchema(root, s);
+                    else
+                        scan(x, depth + 1);
+                }
+            };
+            scan(root);
+        }
+        const bp = record(b.paths), cp = record(c.paths);
+        function security(root, op) {
+            const v = op.security ?? root.security ?? [];
+            if (!Array.isArray(v))
+                fail("SECURITY_INVALID");
+            return v.map((x) => {
+                const r = record(x);
+                for (const a of Object.values(r))
+                    strings(a);
+                return r;
+            });
+        }
+        function parameters(root, path, op) {
+            const out = new Map();
+            for (const group of [path.parameters ?? [], op.parameters ?? []]) {
+                if (!Array.isArray(group))
+                    fail("PARAMETERS_INVALID");
+                for (const raw of group) {
+                    const p = deref(root, raw);
+                    if (typeof p.name !== "string" ||
+                        !["query", "header", "path", "cookie"].includes(p.in))
+                        fail("PARAMETER_INVALID");
+                    if (p.content !== undefined || p.schema === undefined)
+                        fail("PARAMETER_SCHEMA_REQUIRED");
+                    if (p.required !== undefined && typeof p.required !== "boolean")
+                        fail("PARAMETER_INVALID");
+                    out.set(p.in + ":" + p.name, p);
+                }
+            }
+            return out;
+        }
+        function media(old, now, path, direction) {
+            const oc = old.content === undefined ? {} : record(old.content), nc = now.content === undefined ? {} : record(now.content);
+            for (const type of Object.keys(oc)) {
+                if (!Object.hasOwn(nc, type)) {
+                    add("media-type-removed", "A documented media type was removed.", path);
+                    continue;
+                }
+                const x = record(oc[type]), y = record(nc[type]);
+                if (x.schema !== undefined && y.schema !== undefined)
+                    compare(x.schema, y.schema, path + "/schema", direction);
+                else if (x.schema !== y.schema)
+                    add("schema-presence-changed", "A documented schema was added or removed; review compatibility.", path);
+            }
+        }
+        for (const path of Object.keys(bp).sort()) {
+            if (!path.startsWith("/") || path.length > 512)
+                fail("OPENAPI_PATH_INVALID");
+            if (!Object.hasOwn(cp, path)) {
+                add("endpoint-removed", "A documented endpoint was removed.", path);
+                continue;
+            }
+            const old = deref(b, bp[path]), now = deref(c, cp[path]);
+            for (const method of methods) {
+                if (old[method] === undefined)
+                    continue;
+                const loc = method.toUpperCase() + " " + path;
+                if (now[method] === undefined) {
+                    add("method-removed", "An HTTP method was removed.", loc);
+                    continue;
+                }
+                const x = record(old[method]), y = record(now[method]);
+                if (stable(security(b, x)) !== stable(security(c, y)))
+                    add("authentication-changed", "Authentication requirements changed.", loc);
+                const xp = parameters(b, old, x), yp = parameters(c, now, y);
+                for (const [key, p] of yp) {
+                    const before = xp.get(key);
+                    if ((p.required === true || p.in === "path") &&
+                        (!before || (before.required !== true && before.in !== "path")))
+                        add("required-parameter-added", "A new request parameter is required.", loc + "/parameters/" + key);
+                    if (before)
+                        compare(before.schema, p.schema, loc + "/parameters/" + key, "request");
+                }
+                for (const [key, p] of xp)
+                    if (!yp.has(key))
+                        add("parameter-removed", "A previously documented request parameter was removed.", loc + "/parameters/" + key, "medium");
+                if (y.requestBody !== undefined) {
+                    const nr = deref(c, y.requestBody);
+                    if (x.requestBody === undefined) {
+                        if (nr.required === true)
+                            add("request-body-required", "A request body became required.", loc);
+                    }
+                    else {
+                        const br = deref(b, x.requestBody);
+                        if (nr.required === true && br.required !== true)
+                            add("request-body-required", "A request body became required.", loc);
+                        media(br, nr, loc + "/requestBody", "request");
+                    }
+                }
+                else if (x.requestBody !== undefined)
+                    add("request-body-removed", "A documented request body was removed.", loc);
+                if (x.responses === undefined || y.responses === undefined)
+                    fail("RESPONSES_REQUIRED");
+                const xr = record(x.responses), yr = record(y.responses);
+                for (const status of Object.keys(xr)) {
+                    if (!Object.hasOwn(yr, status)) {
+                        add("response-removed", "A documented response status was removed.", loc + "/responses/" + status);
+                        continue;
+                    }
+                    media(deref(b, xr[status]), deref(c, yr[status]), loc + "/responses/" + status, "response");
+                }
+            }
+        }
+        const bs = record(b.components
+            ?.securitySchemes ?? {}), cs = record(c.components
+            ?.securitySchemes ?? {});
+        if (stable(bs) !== stable(cs))
+            add("authentication-scheme-changed", "Security scheme definitions changed.", "#/components/securitySchemes");
+    }
+    return {
+        kind,
+        compatible: !exceeds(findings, threshold),
+        findings,
+        limitations: [...limitations],
+    };
+}
+export const readContract = async (root, path) => parseJson(await readBounded(root, path));
+export const renderMarkdown = (report) => markdown("API compatibility report", report.findings, report.limitations);

package/docs/API.md

@@ -0,0 +1,11 @@
+# API and compatibility policy
+
+`compareContracts(baseline, candidate, options?)` accepts JSON objects and returns `{kind, compatible, findings, limitations}`. `kind` is `openapi` or `json-schema`; omitted kind detects OpenAPI from the baseline. Options accept `failOn` (default `high`) and a `severity` map keyed by finding ID. Severities in ascending order are `info`, `low`, `medium`, `high`, `critical`. Findings contain `id`, `severity`, fixed explanatory `message`, and a sanitized location `path`.
+
+`readContract(root, relativePath)` reads bounded UTF-8 JSON below an explicit root. `renderMarkdown(report)` renders a report. `SafeInputError` has a fixed safe `code` and message. Limits: 4 MiB per file, 100,000 JSON nodes, depth 48, schema depth 32, and reference chain length 24.
+
+Finding IDs: endpoint-removed, method-removed, required-parameter-added, parameter-removed, request-body-required, request-body-removed, response-removed, media-type-removed, schema-presence-changed, authentication-changed, authentication-scheme-changed, type-incompatible, required-field-changed, enum-incompatible, constraint-incompatible, constraint-changed, property-removed, additional-properties-restricted, additional-properties-changed and items-changed. Most default to high; removed request parameters default to medium.
+
+Requests use input contravariance: newly required fields, narrower types/enums and tighter bounds may reject existing callers. Responses use output covariance: broader types/enums, weaker guaranteed fields and loosened bounds may violate consumer expectations. Integer is a subset of number. Authentication changes and format/pattern changes conservatively require review. Documentation-only changes are ignored.
+
+This 0.1.0 API is the initial public candidate. Breaking changes require a documented version change. `compatible` means below the configured threshold for completed supported static checks, never proof of runtime compatibility.

package/docs/LIMITATIONS.md

@@ -0,0 +1,9 @@
+# Supported scope and limitations
+
+Only JSON OpenAPI 3.0/3.1 and JSON Schema object schemas are accepted. YAML is not parsed. References must be local JSON Pointer fragments in the same document. Remote references, other local files, cycles, `$ref` siblings other than descriptions, boolean schemas, composition (`allOf`, `oneOf`, `anyOf`, `not`), conditionals, tuple schemas and unrecognized schema keywords are rejected, returning exit 2.
+
+Supported schema checks include type/nullable, enum/const, required, properties, homogeneous items, additionalProperties, numeric bounds, length/item bounds, pattern and format changes, and readOnly/writeOnly changes. The checker does not evaluate regular expressions or validate instance data. OpenAPI parameter schemas are required; content-based parameters are rejected. OpenAPI 3.0 boolean exclusive bounds are outside this subset.
+
+OpenAPI response-property removal is conservatively flagged even if the property was optional. Response headers, links, callbacks, webhooks, discriminator behavior, pagination semantics, authorization semantics, implementation behavior and external services are not verified. Security scheme definition changes are reported even if unused. Reports compare supported declared contracts, and do not certify full OpenAPI validity.
+
+Source errors never quote input. Findings retain sanitized specification locations; avoid placing secrets in contract names or paths. No network requests, embedded code execution or artifact retrieval occurs. Hosted capabilities are blocked pending an approved public contract and authorized live acceptance tests.

package/docs/RELEASE.md

@@ -0,0 +1,13 @@
+# Release process
+
+Version 0.1.1 is distributed under [Apache-2.0](../LICENSE). [GitHub Releases](https://github.com/Zof-AI/zof-api-contract-check/releases) provides versioned source and reviewed build artifacts. Install `@zof-ai/api-contract-check@0.1.1` using the [npm quickstart](../README.md#install-from-npm). Refer to the release assets, commit SHA and recorded validation for the exact version.
+
+Start with the [source installation](../README.md#install-from-github-source). Run `node scripts/bootstrap.mjs --allow-network`, `npm ci --ignore-scripts --prefer-offline`, `npm run build`, `npm test`, and `npm pack --ignore-scripts`. The bootstrap checks the exact dependency release SHA256 and byte sizes. Do not replace failed checks with an unverified dependency or a `file:` reference in published metadata.
+
+Before releasing a new version, inspect source and Git history, dependency licenses, build outputs and every package entry. Resolve security findings; run independent negative and installation tests. Record artifact SHA256 and release commits. Maintain branch protection, private vulnerability reporting, least-privilege workflows and a protected release environment. The manual release-candidate workflow builds artifacts and does not publish automatically. Material release changes require a new review.
+
+Publish the reviewed package tarball as a GitHub Release asset. npm registry publication requires independently verified `@zof-ai` scope ownership and an authenticated publisher. Verify the registry version and integrity, then run the README commands in a fresh project before recording registry acceptance.
+
+After publication, retrieve assets anonymously, verify their checksums, install in a clean project, and execute documented examples. Check every intended distribution channel separately. Missing or unrun acceptance is not a pass. Hosted Zof integration remains unavailable until an approved public contract and real service acceptance exist.
+
+CI targets Node 22/24 on Linux/macOS. File operations require Python 3.10 or newer and fail closed on Windows; in-memory JSON operations remain portable. Only completed jobs establish platform verification. Docker acceptance runs on Linux; editor acceptance exercises a real VS Code host.

package/docs/VALIDATION.md

@@ -0,0 +1,5 @@
+# Validation and release evidence
+
+Run `npm run check` for strict TypeScript compilation plus named unit, integration, end-to-end and security tests. Run `npm run test:package` to build a tarball, install it into a temporary clean project with scripts disabled, load the public package exports and invoke the installed CLI. Tests use synthetic local fixtures, never customer data or hosted endpoints.
+
+CI targets Node 22/24 on Linux/macOS with Python 3.10 or newer; only completed jobs verify those platforms. Windows file operations fail closed. Local candidate validation is separate from anonymous public installation, registry ownership, protected release settings and independent security/QA review. Missing evidence remains unverified.

package/examples/authentication.json

@@ -0,0 +1,46 @@
+{
+  "openapi": "3.1.0",
+  "info": {
+    "title": "Synthetic catalog",
+    "version": "1.0"
+  },
+  "paths": {
+    "/items": {
+      "get": {
+        "responses": {
+          "200": {
+            "description": "Catalog item",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "id"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "integer"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+  "security": [
+    {
+      "bearer": []
+    }
+  ],
+  "components": {
+    "securitySchemes": {
+      "bearer": {
+        "type": "http",
+        "scheme": "bearer"
+      }
+    }
+  }
+}

package/examples/baseline.json

@@ -0,0 +1,33 @@
+{
+  "openapi": "3.1.0",
+  "info": {
+    "title": "Synthetic catalog",
+    "version": "1.0"
+  },
+  "paths": {
+    "/items": {
+      "get": {
+        "responses": {
+          "200": {
+            "description": "Catalog item",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "id"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "integer"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/examples/breaking.json

@@ -0,0 +1,33 @@
+{
+  "openapi": "3.1.0",
+  "info": {
+    "title": "Synthetic catalog",
+    "version": "1.0"
+  },
+  "paths": {
+    "/items": {
+      "get": {
+        "responses": {
+          "200": {
+            "description": "Catalog item",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "id"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/examples/compatible.json

@@ -0,0 +1,36 @@
+{
+  "openapi": "3.1.0",
+  "info": {
+    "title": "Synthetic catalog",
+    "version": "1.0"
+  },
+  "paths": {
+    "/items": {
+      "get": {
+        "responses": {
+          "200": {
+            "description": "Catalog item",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "id"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "integer"
+                    },
+                    "label": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/examples/policy.json

@@ -0,0 +1,6 @@
+{
+  "failOn": "medium",
+  "severity": {
+    "authentication-changed": "medium"
+  }
+}

package/package.json

@@ -1,6 +1,62 @@
 {
   "name": "@zof-ai/api-contract-check",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "Bounded offline OpenAPI and JSON Schema compatibility analysis",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "zof-api-contract-check": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md",
+    "docs",
+    "examples",
+    "SECURITY.md",
+    "CONTRIBUTING.md",
+    "CODE_OF_CONDUCT.md"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Zof-AI/zof-api-contract-check.git"
+  },
+  "homepage": "https://github.com/Zof-AI/zof-api-contract-check#readme",
+  "bugs": {
+    "url": "https://github.com/Zof-AI/zof-api-contract-check/issues"
+  },
+  "keywords": [
+    "verification",
+    "testing",
+    "zof"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "node --test tests/*.test.mjs",
+    "check": "npm run build && npm test",
+    "test:package": "node tests/package.mjs"
+  },
+  "devDependencies": {
+    "typescript": "5.9.3",
+    "@types/node": "22.19.11"
+  },
+  "dependencies": {
+    "@zof-ai/evidence-spec": "0.1.1"
+  }
+}