coderifts 8.6.2 → 8.6.3

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## Unreleased
 
+## 8.6.3 - 2026-09-12
+
+js-yaml moves to 4.3.2 in the shipped dependency set. The generated strict workflow pins contract-gate v0.9.5, following the gate release. The package metadata points at the public site rather than the private app repository.
+
+
 ## 8.6.2 - 2026-09-10
 
 The generated strict workflow pins contract-gate v0.9.3 (f288c4b), following the gate release. The Atomic-V2 installer teaches ENFORCING_ATOMIC_V2 with the v2 factors required, not Strict.

package/dist/.build-source-sha

@@ -1,5 +1,5 @@
 {
-  "$comment": "GENERATED by scripts/build.js. sha256 over src/**.js + bin/**.js (path + bytes). test/build-freshness.test.js recomputes it; a mismatch means dist/cli.js is stale.",
-  "sha256": "3eec93dc767975626ebdebc8fe9ab226e6ea24668e2721af17e41ebc5c214495",
-  "file_count": 49
+  "$comment": "GENERATED by scripts/build.js. sha256 over src/** + bin/** (path + bytes), for every extension esbuild bundles — .js AND .json. scripts/lib/source-fingerprint.js is the single implementation; test/build-freshness.test.js recomputes it from there rather than from a copy. A mismatch means dist/cli.js is stale.",
+  "sha256": "161a9dee4c63f32c2a90dda17091ef50d667bcc084bdd25ae62b1cfe804eea68",
+  "file_count": 51
 }

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "8.6.2",
+      version: "8.6.3",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -3056,13 +3056,12 @@ var require_package = __commonJS({
         "swagger",
         "devtools"
       ],
-      repository: {
-        type: "git",
-        url: "git+https://github.com/coderifts/app.git",
-        directory: "packages/cli"
-      },
+      repository: "https://coderifts.com",
       homepage: "https://coderifts.com",
-      bugs: "https://github.com/coderifts/app/issues",
+      bugs: {
+        url: "https://coderifts.com",
+        email: "support@coderifts.com"
+      },
       engines: {
         node: ">=20.0.0"
       },
@@ -3080,7 +3079,7 @@ var require_package = __commonJS({
         "cli-table3": "^0.6.4",
         commander: "^12.0.0",
         inquirer: "^8.2.6",
-        "js-yaml": "^4.3.1",
+        "js-yaml": "^4.3.2",
         "openapi-diff": "^0.24.1",
         ora: "^5.4.1"
       },
@@ -11701,16 +11700,21 @@ var require_loader = __commonJS({
         state.result += _result;
       }
     }
+    function chargeMergeWork(state) {
+      state.totalMergeKeys++;
+      if (state.maxTotalMergeKeys !== -1 && state.totalMergeKeys > state.maxTotalMergeKeys) {
+        throwError(state, "merge keys exceeded maxTotalMergeKeys (" + state.maxTotalMergeKeys + ")");
+      }
+    }
     function mergeMappings(state, destination, source, overridableKeys) {
       if (!common.isObject(source)) {
         throwError(state, "cannot merge mappings; the provided source object is unacceptable");
       }
+      chargeMergeWork(state);
       const sourceKeys = Object.keys(source);
       for (let index = 0, quantity = sourceKeys.length; index < quantity; index += 1) {
         const key = sourceKeys[index];
-        if (state.maxTotalMergeKeys !== -1 && ++state.totalMergeKeys > state.maxTotalMergeKeys) {
-          throwError(state, "merge keys exceeded maxTotalMergeKeys (" + state.maxTotalMergeKeys + ")");
-        }
+        chargeMergeWork(state);
         if (!_hasOwnProperty.call(destination, key)) {
           setProperty(destination, key, source[key]);
           overridableKeys[key] = true;
@@ -11738,6 +11742,9 @@ var require_loader = __commonJS({
       }
       if (keyTag === "tag:yaml.org,2002:merge") {
         if (Array.isArray(valueNode)) {
+          if (valueNode.length > 100) {
+            throwError(state, "abnormal merge sequence size");
+          }
           for (let index = 0, quantity = valueNode.length; index < quantity; index += 1) {
             mergeMappings(state, _result, valueNode[index], overridableKeys);
           }
@@ -163516,16 +163523,21 @@ var require_loader2 = __commonJS({
         state.result += _result;
       }
     }
+    function chargeMergeWork(state) {
+      state.totalMergeKeys++;
+      if (state.maxTotalMergeKeys !== -1 && state.totalMergeKeys > state.maxTotalMergeKeys) {
+        throwError(state, "merge keys exceeded maxTotalMergeKeys (" + state.maxTotalMergeKeys + ")");
+      }
+    }
     function mergeMappings(state, destination, source, overridableKeys) {
       if (!common.isObject(source)) {
         throwError(state, "cannot merge mappings; the provided source object is unacceptable");
       }
+      chargeMergeWork(state);
       const sourceKeys = Object.keys(source);
       for (let index = 0, quantity = sourceKeys.length; index < quantity; index += 1) {
         const key = sourceKeys[index];
-        if (state.maxTotalMergeKeys !== -1 && ++state.totalMergeKeys > state.maxTotalMergeKeys) {
-          throwError(state, "merge keys exceeded maxTotalMergeKeys (" + state.maxTotalMergeKeys + ")");
-        }
+        chargeMergeWork(state);
         if (!_hasOwnProperty.call(destination, key)) {
           setProperty(destination, key, source[key]);
           overridableKeys[key] = true;
@@ -163553,6 +163565,9 @@ var require_loader2 = __commonJS({
       }
       if (keyTag === "tag:yaml.org,2002:merge") {
         if (Array.isArray(valueNode)) {
+          if (valueNode.length > 100) {
+            throwError(state, "abnormal merge sequence size");
+          }
           for (let index = 0, quantity = valueNode.length; index < quantity; index += 1) {
             mergeMappings(state, _result, valueNode[index], overridableKeys);
           }
@@ -231520,10 +231535,10 @@ var require_gate_pin = __commonJS({
   "src/generated/gate-pin.json"(exports2, module2) {
     module2.exports = {
       repo: "coderifts/contract-gate",
-      sha: "f288c4bea752db6b405367c8e3b81e7885c54b20",
-      tag: "v0.9.3",
+      sha: "15c19a6373ad69f5a8aaee992b69bc38baf98f14",
+      tag: "v0.9.5",
       resolved_from: "https://github.com/coderifts/contract-gate refs/tags/v0",
-      resolved_at: "2026-09-10T06:43:53Z",
+      resolved_at: "2026-09-12T19:02:41Z",
       note: "STRICT template pins this full commit SHA (GitHub: only a full SHA is immutable). v0 is a tag we move on every release, so it is NOT a pin. Re-run scripts/generate-gate-pin.js on each gate release; Dependabot bumps adopters."
     };
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "8.6.2",
+  "version": "8.6.3",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",
@@ -28,13 +28,12 @@
     "swagger",
     "devtools"
   ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/coderifts/app.git",
-    "directory": "packages/cli"
-  },
+  "repository": "https://coderifts.com",
   "homepage": "https://coderifts.com",
-  "bugs": "https://github.com/coderifts/app/issues",
+  "bugs": {
+    "url": "https://coderifts.com",
+    "email": "support@coderifts.com"
+  },
   "engines": {
     "node": ">=20.0.0"
   },
@@ -52,7 +51,7 @@
     "cli-table3": "^0.6.4",
     "commander": "^12.0.0",
     "inquirer": "^8.2.6",
-    "js-yaml": "^4.3.1",
+    "js-yaml": "^4.3.2",
     "openapi-diff": "^0.24.1",
     "ora": "^5.4.1"
   },

package/scripts/build.js

@@ -11,6 +11,7 @@ const path = require('path');
 const fs = require('fs');
 const crypto = require('crypto');
 const esbuild = require('esbuild');
+const { sourceFingerprint } = require('./lib/source-fingerprint');
 
 const stub = path.join(__dirname, '..', 'src', 'logger-stub.js');
 const appLogger = path.resolve(__dirname, '..', '..', '..', 'src', 'logger.js');
@@ -52,33 +53,16 @@ esbuild.build({
   // CONTENT-ADDRESSED, not timestamps: mtimes move on checkout, rebase and copy without the bytes
   // changing, and a freshness check that cries wolf gets deleted.
   const root = path.join(__dirname, '..');
-  const files = [];
-  const walk = (dir) => {
-    if (!fs.existsSync(dir)) return;
-    for (const e of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      if (e.name === 'node_modules' || e.name.startsWith('.')) continue;
-      const full = path.join(dir, e.name);
-      if (e.isDirectory()) walk(full);
-      else if (e.name.endsWith('.js')) files.push(full);
-    }
-  };
-  walk(path.join(root, 'src'));
-  walk(path.join(root, 'bin'));
-  const h = crypto.createHash('sha256');
-  for (const f of files.sort()) {
-    h.update(path.relative(root, f));
-    h.update('\0');
-    h.update(fs.readFileSync(f));
-    h.update('\0');
-  }
-  const sha256 = h.digest('hex');
+  const { sha256, file_count } = sourceFingerprint(root);
   fs.writeFileSync(path.join(root, 'dist', '.build-source-sha'), `${JSON.stringify({
-    $comment: 'GENERATED by scripts/build.js. sha256 over src/**.js + bin/**.js (path + bytes). '
-      + 'test/build-freshness.test.js recomputes it; a mismatch means dist/cli.js is stale.',
+    $comment: 'GENERATED by scripts/build.js. sha256 over src/** + bin/** (path + bytes), for '
+      + 'every extension esbuild bundles — .js AND .json. scripts/lib/source-fingerprint.js is '
+      + 'the single implementation; test/build-freshness.test.js recomputes it from there rather '
+      + 'than from a copy. A mismatch means dist/cli.js is stale.',
     sha256,
-    file_count: files.length,
+    file_count,
   }, null, 2)}\n`);
-  process.stdout.write(`build: source fingerprint ${sha256.slice(0, 12)}… over ${files.length} files\n`);
+  process.stdout.write(`build: source fingerprint ${sha256.slice(0, 12)}… over ${file_count} files\n`);
 }).catch((err) => {
   console.error(err);
   process.exit(1);

package/scripts/lib/source-fingerprint.js

@@ -0,0 +1,56 @@
+'use strict';
+
+/*
+ * The source fingerprint dist/cli.js is stamped with, and the one test/build-freshness.test.js
+ * recomputes. ONE implementation, required by both.
+ *
+ * WHY IT LIVES HERE. The walk used to exist twice — once in scripts/build.js and once inside the
+ * test, whose comment said the copy was "kept in step by the assertions below". No assertion
+ * compared them, so "kept in step" was a hope. MEASURED 2026-09-12: it had already failed in one
+ * direction and was about to fail in the other. A freshness gate whose recomputation is a COPY of
+ * the thing it checks can drift from it silently, which is the one failure a freshness gate must
+ * not have.
+ *
+ * .json COUNTS. esbuild inlines src/generated/gate-pin.json into dist/cli.js, so it is shipped
+ * runtime rather than configuration beside it. With a .js-only walk the pin moved from v0.9.3 to
+ * v0.9.4 while the marker stayed green and dist kept naming v0.9.3 — the marker's own comment
+ * promises that a mismatch means dist is stale, and for a bundled JSON it did not deliver.
+ */
+
+const path = require('path');
+const fs = require('fs');
+const crypto = require('crypto');
+
+/** Extensions that end up INSIDE the bundle. Anything here changes the shipped runtime. */
+const BUNDLED_EXT = Object.freeze(['.js', '.json']);
+
+/**
+ * sha256 over src/** + bin/** (path + bytes), content-addressed — never mtime: mtimes move on
+ * checkout, rebase and copy with no byte change, and a freshness check that cries wolf gets
+ * deleted.
+ * @param {string} root package root
+ */
+function sourceFingerprint(root) {
+  const files = [];
+  const walk = (dir) => {
+    if (!fs.existsSync(dir)) return;
+    for (const e of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (e.name === 'node_modules' || e.name.startsWith('.')) continue;
+      const full = path.join(dir, e.name);
+      if (e.isDirectory()) walk(full);
+      else if (BUNDLED_EXT.some((x) => e.name.endsWith(x))) files.push(full);
+    }
+  };
+  walk(path.join(root, 'src'));
+  walk(path.join(root, 'bin'));
+  const h = crypto.createHash('sha256');
+  for (const f of files.sort()) {
+    h.update(path.relative(root, f));
+    h.update('\0');
+    h.update(fs.readFileSync(f));
+    h.update('\0');
+  }
+  return { sha256: h.digest('hex'), file_count: files.length };
+}
+
+module.exports = { sourceFingerprint, BUNDLED_EXT };