coderifts 8.6.1 → 8.6.3

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+## 8.6.3 - 2026-09-12
+
+js-yaml moves to 4.3.2 in the shipped dependency set. The generated strict workflow pins contract-gate v0.9.5, following the gate release. The package metadata points at the public site rather than the private app repository.
+
+
+## 8.6.2 - 2026-09-10
+
+The generated strict workflow pins contract-gate v0.9.3 (f288c4b), following the gate release. The Atomic-V2 installer teaches ENFORCING_ATOMIC_V2 with the v2 factors required, not Strict.
+
+
 ## 8.6.1 - 2026-09-09
 
 The generated strict workflow pins contract-gate v0.9.2 (12a2673), following the gate release.

package/dist/.build-source-sha

@@ -1,5 +1,5 @@
 {
-  "$comment": "GENERATED by scripts/build.js. sha256 over src/**.js + bin/**.js (path + bytes). test/build-freshness.test.js recomputes it; a mismatch means dist/cli.js is stale.",
-  "sha256": "d6989104c6fcc12b512fc6dee0dd50970cd88364d9e2bec09c6c50fb019c5f14",
-  "file_count": 49
+  "$comment": "GENERATED by scripts/build.js. sha256 over src/** + bin/** (path + bytes), for every extension esbuild bundles — .js AND .json. scripts/lib/source-fingerprint.js is the single implementation; test/build-freshness.test.js recomputes it from there rather than from a copy. A mismatch means dist/cli.js is stale.",
+  "sha256": "161a9dee4c63f32c2a90dda17091ef50d667bcc084bdd25ae62b1cfe804eea68",
+  "file_count": 51
 }

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "8.6.1",
+      version: "8.6.3",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -3056,13 +3056,12 @@ var require_package = __commonJS({
         "swagger",
         "devtools"
       ],
-      repository: {
-        type: "git",
-        url: "git+https://github.com/coderifts/app.git",
-        directory: "packages/cli"
-      },
+      repository: "https://coderifts.com",
       homepage: "https://coderifts.com",
-      bugs: "https://github.com/coderifts/app/issues",
+      bugs: {
+        url: "https://coderifts.com",
+        email: "support@coderifts.com"
+      },
       engines: {
         node: ">=20.0.0"
       },
@@ -3080,7 +3079,7 @@ var require_package = __commonJS({
         "cli-table3": "^0.6.4",
         commander: "^12.0.0",
         inquirer: "^8.2.6",
-        "js-yaml": "^4.3.1",
+        "js-yaml": "^4.3.2",
         "openapi-diff": "^0.24.1",
         ora: "^5.4.1"
       },
@@ -11701,16 +11700,21 @@ var require_loader = __commonJS({
         state.result += _result;
       }
     }
+    function chargeMergeWork(state) {
+      state.totalMergeKeys++;
+      if (state.maxTotalMergeKeys !== -1 && state.totalMergeKeys > state.maxTotalMergeKeys) {
+        throwError(state, "merge keys exceeded maxTotalMergeKeys (" + state.maxTotalMergeKeys + ")");
+      }
+    }
     function mergeMappings(state, destination, source, overridableKeys) {
       if (!common.isObject(source)) {
         throwError(state, "cannot merge mappings; the provided source object is unacceptable");
       }
+      chargeMergeWork(state);
       const sourceKeys = Object.keys(source);
       for (let index = 0, quantity = sourceKeys.length; index < quantity; index += 1) {
         const key = sourceKeys[index];
-        if (state.maxTotalMergeKeys !== -1 && ++state.totalMergeKeys > state.maxTotalMergeKeys) {
-          throwError(state, "merge keys exceeded maxTotalMergeKeys (" + state.maxTotalMergeKeys + ")");
-        }
+        chargeMergeWork(state);
         if (!_hasOwnProperty.call(destination, key)) {
           setProperty(destination, key, source[key]);
           overridableKeys[key] = true;
@@ -11738,6 +11742,9 @@ var require_loader = __commonJS({
       }
       if (keyTag === "tag:yaml.org,2002:merge") {
         if (Array.isArray(valueNode)) {
+          if (valueNode.length > 100) {
+            throwError(state, "abnormal merge sequence size");
+          }
           for (let index = 0, quantity = valueNode.length; index < quantity; index += 1) {
             mergeMappings(state, _result, valueNode[index], overridableKeys);
           }
@@ -163516,16 +163523,21 @@ var require_loader2 = __commonJS({
         state.result += _result;
       }
     }
+    function chargeMergeWork(state) {
+      state.totalMergeKeys++;
+      if (state.maxTotalMergeKeys !== -1 && state.totalMergeKeys > state.maxTotalMergeKeys) {
+        throwError(state, "merge keys exceeded maxTotalMergeKeys (" + state.maxTotalMergeKeys + ")");
+      }
+    }
     function mergeMappings(state, destination, source, overridableKeys) {
       if (!common.isObject(source)) {
         throwError(state, "cannot merge mappings; the provided source object is unacceptable");
       }
+      chargeMergeWork(state);
       const sourceKeys = Object.keys(source);
       for (let index = 0, quantity = sourceKeys.length; index < quantity; index += 1) {
         const key = sourceKeys[index];
-        if (state.maxTotalMergeKeys !== -1 && ++state.totalMergeKeys > state.maxTotalMergeKeys) {
-          throwError(state, "merge keys exceeded maxTotalMergeKeys (" + state.maxTotalMergeKeys + ")");
-        }
+        chargeMergeWork(state);
         if (!_hasOwnProperty.call(destination, key)) {
           setProperty(destination, key, source[key]);
           overridableKeys[key] = true;
@@ -163553,6 +163565,9 @@ var require_loader2 = __commonJS({
       }
       if (keyTag === "tag:yaml.org,2002:merge") {
         if (Array.isArray(valueNode)) {
+          if (valueNode.length > 100) {
+            throwError(state, "abnormal merge sequence size");
+          }
           for (let index = 0, quantity = valueNode.length; index < quantity; index += 1) {
             mergeMappings(state, _result, valueNode[index], overridableKeys);
           }
@@ -231520,10 +231535,10 @@ var require_gate_pin = __commonJS({
   "src/generated/gate-pin.json"(exports2, module2) {
     module2.exports = {
       repo: "coderifts/contract-gate",
-      sha: "12a2673d9bf094a1a97cb1387348018332a5c33f",
-      tag: "v0.9.2",
+      sha: "15c19a6373ad69f5a8aaee992b69bc38baf98f14",
+      tag: "v0.9.5",
       resolved_from: "https://github.com/coderifts/contract-gate refs/tags/v0",
-      resolved_at: "2026-09-09T18:05:11Z",
+      resolved_at: "2026-09-12T19:02:41Z",
       note: "STRICT template pins this full commit SHA (GitHub: only a full SHA is immutable). v0 is a tag we move on every release, so it is NOT a pin. Re-run scripts/generate-gate-pin.js on each gate release; Dependabot bumps adopters."
     };
   }
@@ -233296,7 +233311,29 @@ var require_agent_host_files_embedded = __commonJS({
       ".claude/settings.json": '{\n  "hooks": {\n    "PreToolUse": [\n      {\n        "matcher": "Write|Edit|MultiEdit",\n        "hooks": [\n          {\n            "type": "command",\n            "command": "coderifts claude-hook",\n            "timeout": 60\n          }\n        ]\n      }\n    ]\n  }\n}\n',
       ".cursor/hooks.json": '{\n  "version": 1,\n  "hooks": {\n    "preToolUse": [\n      {\n        "command": "coderifts cursor-hook",\n        "matcher": "Write|Delete",\n        "timeout": 60,\n        "failClosed": true\n      }\n    ]\n  }\n}\n'
     });
-    module2.exports = { AGENT_HOST_FILES, AGENT_HOST_PATHS };
+    var AGENT_HOST_FILES_ATOMIC_V2 = Object.freeze({
+      "AGENTS.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent rules\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. This install is locked with `profile: ENFORCING_ATOMIC_V2` on withCodeRifts \u2014 the fail-closed conjunction plus the atomic execution factors below. Do not weaken it to `ENFORCING_STRICT`.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nThis install runs the atomic execution profile, so these are REQUIRED here, not optional: a `cr.exec.v2` execution grant, the state challenge it binds, an executor that consumes the `state_nonce` exactly once, an executor attestation over the committed state, and a readback of the resulting state. A step you skipped is not a step that passed \u2014 see `docs/grant-versions.md`.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      "CLAUDE.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. This install is locked with `profile: ENFORCING_ATOMIC_V2` on withCodeRifts \u2014 the fail-closed conjunction plus the atomic execution factors below. Do not weaken it to `ENFORCING_STRICT`.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nThis install runs the atomic execution profile, so these are REQUIRED here, not optional: a `cr.exec.v2` execution grant, the state challenge it binds, an executor that consumes the `state_nonce` exactly once, an executor attestation over the committed state, and a readback of the resulting state. A step you skipped is not a step that passed \u2014 see `docs/grant-versions.md`.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      ".cursor/rules/coderifts.mdc": '---\ndescription: CodeRifts API governance \u2014 when to preflight and how to branch\nglobs:\nalwaysApply: true\n---\n\n<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. This install is locked with `profile: ENFORCING_ATOMIC_V2` on withCodeRifts \u2014 the fail-closed conjunction plus the atomic execution factors below. Do not weaken it to `ENFORCING_STRICT`.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nThis install runs the atomic execution profile, so these are REQUIRED here, not optional: a `cr.exec.v2` execution grant, the state challenge it binds, an executor that consumes the `state_nonce` exactly once, an executor attestation over the committed state, and a readback of the resulting state. A step you skipped is not a step that passed \u2014 see `docs/grant-versions.md`.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      ".github/copilot-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts instructions for GitHub Copilot\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. This install is locked with `profile: ENFORCING_ATOMIC_V2` on withCodeRifts \u2014 the fail-closed conjunction plus the atomic execution factors below. Do not weaken it to `ENFORCING_STRICT`.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nThis install runs the atomic execution profile, so these are REQUIRED here, not optional: a `cr.exec.v2` execution grant, the state challenge it binds, an executor that consumes the `state_nonce` exactly once, an executor attestation over the committed state, and a readback of the resulting state. A step you skipped is not a step that passed \u2014 see `docs/grant-versions.md`.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      "coderifts-langgraph-policy.js": '// GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js\n// System policy string for a LangGraph (or similar) agent. Content is generated;\n// identical rule sentences to AGENTS.md / other formats.\n\'use strict\';\n\nmodule.exports = "Call `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\\n\\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\\n\\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\\n\\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\\n\\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\\n\\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not \\"proceed with caution\\" without monitoring.\\n\\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\\n\\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\\n\\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\\n\\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\\n\\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\\n\\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\\n\\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\\n\\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\\n\\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\\n\\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\\n\\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. This install is locked with `profile: ENFORCING_ATOMIC_V2` on withCodeRifts \u2014 the fail-closed conjunction plus the atomic execution factors below. Do not weaken it to `ENFORCING_STRICT`.\\n\\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\\n\\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\\n\\nThis install runs the atomic execution profile, so these are REQUIRED here, not optional: a `cr.exec.v2` execution grant, the state challenge it binds, an executor that consumes the `state_nonce` exactly once, an executor attestation over the committed state, and a readback of the resulting state. A step you skipped is not a step that passed \u2014 see `docs/grant-versions.md`.\\n\\nWith a proven tenant\u2194repo binding you may request `derivation:\\"server\\"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\\n\\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say \\"authorized, commit not proven\\".";\n',
+      "openai-agent-instructions.md": '<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\n# CodeRifts agent instructions\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. This install is locked with `profile: ENFORCING_ATOMIC_V2` on withCodeRifts \u2014 the fail-closed conjunction plus the atomic execution factors below. Do not weaken it to `ENFORCING_STRICT`.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nThis install runs the atomic execution profile, so these are REQUIRED here, not optional: a `cr.exec.v2` execution grant, the state challenge it binds, an executor that consumes the `state_nonce` exactly once, an executor attestation over the committed state, and a readback of the resulting state. A step you skipped is not a step that passed \u2014 see `docs/grant-versions.md`.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      "skills/api-governance/SKILL.md": '---\nname: api-governance\ndescription: Before merging or shipping any API or tool-contract change: preflight the change set, then branch on execution_action.\n---\n\n# CodeRifts API Governance\n\n<!-- GENERATED from CodeRifts agent-host-rule (single source). Do not edit rule sentences by hand; run: node scripts/generate-agent-host-files.js -->\n\nCall `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not "proceed with caution" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent\'s tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. This install is locked with `profile: ENFORCING_ATOMIC_V2` on withCodeRifts \u2014 the fail-closed conjunction plus the atomic execution factors below. Do not weaken it to `ENFORCING_STRICT`.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nThis install runs the atomic execution profile, so these are REQUIRED here, not optional: a `cr.exec.v2` execution grant, the state challenge it binds, an executor that consumes the `state_nonce` exactly once, an executor attestation over the committed state, and a readback of the resulting state. A step you skipped is not a step that passed \u2014 see `docs/grant-versions.md`.\n\nWith a proven tenant\u2194repo binding you may request `derivation:"server"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say "authorized, commit not proven".\n',
+      ".claude/settings.json": '{\n  "hooks": {\n    "PreToolUse": [\n      {\n        "matcher": "Write|Edit|MultiEdit",\n        "hooks": [\n          {\n            "type": "command",\n            "command": "coderifts claude-hook",\n            "timeout": 60\n          }\n        ]\n      }\n    ]\n  }\n}\n',
+      ".cursor/hooks.json": '{\n  "version": 1,\n  "hooks": {\n    "preToolUse": [\n      {\n        "command": "coderifts cursor-hook",\n        "matcher": "Write|Delete",\n        "timeout": 60,\n        "failClosed": true\n      }\n    ]\n  }\n}\n'
+    });
+    var AGENT_HOST_PROFILES = Object.freeze({ strict: "ENFORCING_STRICT", atomic_v2: "ENFORCING_ATOMIC_V2" });
+    var AGENT_HOST_FILES_BY_PROFILE = Object.freeze({
+      "ENFORCING_STRICT": AGENT_HOST_FILES,
+      "ENFORCING_ATOMIC_V2": AGENT_HOST_FILES_ATOMIC_V2
+    });
+    module2.exports = {
+      AGENT_HOST_FILES,
+      AGENT_HOST_FILES_ATOMIC_V2,
+      AGENT_HOST_FILES_BY_PROFILE,
+      AGENT_HOST_PROFILES,
+      AGENT_HOST_PATHS
+    };
   }
 });
 
@@ -235113,6 +235150,12 @@ var require_init_agents = __commonJS({
     var path = require("path");
     var chalk = require_source();
     var { writeAgentHostFiles, AGENT_HOST_FILES } = require_agent_setup();
+    var {
+      AGENT_HOST_FILES_BY_PROFILE,
+      AGENT_HOST_PROFILES
+    } = require_agent_host_files_embedded();
+    var STRICT_PROFILE = AGENT_HOST_PROFILES.strict;
+    var ATOMIC_V2_PROFILE = AGENT_HOST_PROFILES.atomic_v2;
     var { installClaudeHook, installCursorHook } = require_hook();
     var {
       MCP_HOSTS,
@@ -235446,11 +235489,16 @@ ${USAGE}`
         if (doExit) process.exit(1);
         return { exitCode: 1, code: fatal.code || "ERROR", message: fatal.message, items };
       }
+      const ruleProfile = options.atomicV2 === true ? ATOMIC_V2_PROFILE : STRICT_PROFILE;
+      const ruleFiles = AGENT_HOST_FILES_BY_PROFILE[ruleProfile];
+      if (!ruleFiles) {
+        throw new Error(`init --agents: no agent-host rule bundle for profile ${ruleProfile}`);
+      }
       const rulePaths = rulePathsForHosts(hosts, allRules);
       const ruleSummary = writeAgentHostFiles({
         outDir,
         force: false,
-        files: AGENT_HOST_FILES,
+        files: ruleFiles,
         paths: rulePaths,
         exists: fsDeps.exists,
         writeFile: fsDeps.writeFile,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "8.6.1",
+  "version": "8.6.3",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",
@@ -28,13 +28,12 @@
     "swagger",
     "devtools"
   ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/coderifts/app.git",
-    "directory": "packages/cli"
-  },
+  "repository": "https://coderifts.com",
   "homepage": "https://coderifts.com",
-  "bugs": "https://github.com/coderifts/app/issues",
+  "bugs": {
+    "url": "https://coderifts.com",
+    "email": "support@coderifts.com"
+  },
   "engines": {
     "node": ">=20.0.0"
   },
@@ -52,7 +51,7 @@
     "cli-table3": "^0.6.4",
     "commander": "^12.0.0",
     "inquirer": "^8.2.6",
-    "js-yaml": "^4.3.1",
+    "js-yaml": "^4.3.2",
     "openapi-diff": "^0.24.1",
     "ora": "^5.4.1"
   },

package/scripts/build.js

@@ -11,6 +11,7 @@ const path = require('path');
 const fs = require('fs');
 const crypto = require('crypto');
 const esbuild = require('esbuild');
+const { sourceFingerprint } = require('./lib/source-fingerprint');
 
 const stub = path.join(__dirname, '..', 'src', 'logger-stub.js');
 const appLogger = path.resolve(__dirname, '..', '..', '..', 'src', 'logger.js');
@@ -52,33 +53,16 @@ esbuild.build({
   // CONTENT-ADDRESSED, not timestamps: mtimes move on checkout, rebase and copy without the bytes
   // changing, and a freshness check that cries wolf gets deleted.
   const root = path.join(__dirname, '..');
-  const files = [];
-  const walk = (dir) => {
-    if (!fs.existsSync(dir)) return;
-    for (const e of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      if (e.name === 'node_modules' || e.name.startsWith('.')) continue;
-      const full = path.join(dir, e.name);
-      if (e.isDirectory()) walk(full);
-      else if (e.name.endsWith('.js')) files.push(full);
-    }
-  };
-  walk(path.join(root, 'src'));
-  walk(path.join(root, 'bin'));
-  const h = crypto.createHash('sha256');
-  for (const f of files.sort()) {
-    h.update(path.relative(root, f));
-    h.update('\0');
-    h.update(fs.readFileSync(f));
-    h.update('\0');
-  }
-  const sha256 = h.digest('hex');
+  const { sha256, file_count } = sourceFingerprint(root);
   fs.writeFileSync(path.join(root, 'dist', '.build-source-sha'), `${JSON.stringify({
-    $comment: 'GENERATED by scripts/build.js. sha256 over src/**.js + bin/**.js (path + bytes). '
-      + 'test/build-freshness.test.js recomputes it; a mismatch means dist/cli.js is stale.',
+    $comment: 'GENERATED by scripts/build.js. sha256 over src/** + bin/** (path + bytes), for '
+      + 'every extension esbuild bundles — .js AND .json. scripts/lib/source-fingerprint.js is '
+      + 'the single implementation; test/build-freshness.test.js recomputes it from there rather '
+      + 'than from a copy. A mismatch means dist/cli.js is stale.',
     sha256,
-    file_count: files.length,
+    file_count,
   }, null, 2)}\n`);
-  process.stdout.write(`build: source fingerprint ${sha256.slice(0, 12)}… over ${files.length} files\n`);
+  process.stdout.write(`build: source fingerprint ${sha256.slice(0, 12)}… over ${file_count} files\n`);
 }).catch((err) => {
   console.error(err);
   process.exit(1);

package/scripts/lib/source-fingerprint.js

@@ -0,0 +1,56 @@
+'use strict';
+
+/*
+ * The source fingerprint dist/cli.js is stamped with, and the one test/build-freshness.test.js
+ * recomputes. ONE implementation, required by both.
+ *
+ * WHY IT LIVES HERE. The walk used to exist twice — once in scripts/build.js and once inside the
+ * test, whose comment said the copy was "kept in step by the assertions below". No assertion
+ * compared them, so "kept in step" was a hope. MEASURED 2026-09-12: it had already failed in one
+ * direction and was about to fail in the other. A freshness gate whose recomputation is a COPY of
+ * the thing it checks can drift from it silently, which is the one failure a freshness gate must
+ * not have.
+ *
+ * .json COUNTS. esbuild inlines src/generated/gate-pin.json into dist/cli.js, so it is shipped
+ * runtime rather than configuration beside it. With a .js-only walk the pin moved from v0.9.3 to
+ * v0.9.4 while the marker stayed green and dist kept naming v0.9.3 — the marker's own comment
+ * promises that a mismatch means dist is stale, and for a bundled JSON it did not deliver.
+ */
+
+const path = require('path');
+const fs = require('fs');
+const crypto = require('crypto');
+
+/** Extensions that end up INSIDE the bundle. Anything here changes the shipped runtime. */
+const BUNDLED_EXT = Object.freeze(['.js', '.json']);
+
+/**
+ * sha256 over src/** + bin/** (path + bytes), content-addressed — never mtime: mtimes move on
+ * checkout, rebase and copy with no byte change, and a freshness check that cries wolf gets
+ * deleted.
+ * @param {string} root package root
+ */
+function sourceFingerprint(root) {
+  const files = [];
+  const walk = (dir) => {
+    if (!fs.existsSync(dir)) return;
+    for (const e of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (e.name === 'node_modules' || e.name.startsWith('.')) continue;
+      const full = path.join(dir, e.name);
+      if (e.isDirectory()) walk(full);
+      else if (BUNDLED_EXT.some((x) => e.name.endsWith(x))) files.push(full);
+    }
+  };
+  walk(path.join(root, 'src'));
+  walk(path.join(root, 'bin'));
+  const h = crypto.createHash('sha256');
+  for (const f of files.sort()) {
+    h.update(path.relative(root, f));
+    h.update('\0');
+    h.update(fs.readFileSync(f));
+    h.update('\0');
+  }
+  return { sha256: h.digest('hex'), file_count: files.length };
+}
+
+module.exports = { sourceFingerprint, BUNDLED_EXT };