contract-driven-delivery 2.0.10 → 2.0.12

package/CHANGELOG.md

@@ -1,5 +1,62 @@
 # Changelog
 
+## [2.0.12] - 2026-05-04
+
+Tiny patch — closes the last line-ending hole.
+
+### Fixed
+
+- **`cdd-kit code-map --check` is now line-ending agnostic**: 2.0.11 fixed
+  the digest paths (`# sources-digest:`) to be portable, but `--check`'s
+  string-comparison fallback still saw CRLF (committed via
+  `core.autocrlf=true`) vs LF (always emitted) as different and reported
+  "would change". The pre-commit hook then regenerated the map on every
+  commit on Windows even when content was bit-identical. Fixed by
+  normalizing CRLF/CR → LF on both sides before comparison, matching the
+  digest functions' approach.
+
+After upgrading, the hook stops triggering noisy regenerations on
+Windows. No re-scan needed; this is purely a comparison fix.
+
+## [2.0.11] - 2026-05-04
+
+Final portability fix in the digest series. After 2.0.10 made digests
+repo-relative and content-keyed, a real consumer repo on Windows
+(`core.autocrlf=true`) still produced different digests than the same
+repo on Linux/Mac (`core.autocrlf=false`) — because the file BYTES
+differ even when the file content is logically identical.
+
+### Fixed
+
+- **All hash inputs are now line-ending normalized**. `\r\n` and stand-alone
+  `\r` are converted to `\n` before SHA-256 is computed. Applied uniformly
+  across the four places that hash files for cdd-kit's digests:
+  - `inputsDigest()` in `src/commands/context-scan.ts`
+    (project-map / contracts-index)
+  - `inputDigest()` in `src/commands/doctor.ts`
+    (freshness check against committed indexes)
+  - `inputsDigest()` in `src/commands/new-change.ts`
+    (auto-rerun decision in /cdd-new flow)
+  - `computeSourcesDigest()` in `src/commands/code-map.ts`
+    (`# sources-digest:` header in code-map.yml)
+
+  All four now share `src/utils/digest.ts → sha256OfFileNormalized()`,
+  so the rule is in exactly one place.
+
+### Migration
+
+After upgrading, re-run **once**:
+
+```bash
+cdd-kit context-scan
+cdd-kit code-map
+git add specs/context/ .cdd/code-map.yml
+git commit -m "chore: regenerate indexes & code-map (cdd-kit 2.0.11)"
+```
+
+From then on, fresh clones on any OS / autocrlf setting produce identical
+digests, eliminating the last source of false-positive doctor warnings.
+
 ## [2.0.10] - 2026-05-04
 
 Two more context-scan determinism bugs, both surfaced verifying the 2.0.9

package/dist/cli/index.js

@@ -376,27 +376,44 @@ var init_update = __esm({
   }
 });
 
-// src/commands/context-scan.ts
-var context_scan_exports = {};
-__export(context_scan_exports, {
-  contextScan: () => contextScan
-});
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync6, readdirSync as readdirSync4, writeFileSync as writeFileSync3 } from "fs";
+// src/utils/digest.ts
+import { readFileSync as readFileSync6 } from "fs";
 import { createHash as createHash2 } from "crypto";
-import { basename, dirname as dirname3, join as join8, relative as relative2 } from "path";
-function sha256OfFile(path) {
+function normalizeContentForHash(buf) {
+  if (!buf.includes(13))
+    return buf;
+  const text = buf.toString("utf8").replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+  return Buffer.from(text, "utf8");
+}
+function sha256OfFileNormalized(path) {
+  let buf;
   try {
-    return createHash2("sha256").update(readFileSync6(path)).digest("hex");
+    buf = readFileSync6(path);
   } catch {
     return "";
   }
+  return createHash2("sha256").update(normalizeContentForHash(buf)).digest("hex");
 }
+var init_digest = __esm({
+  "src/utils/digest.ts"() {
+    "use strict";
+  }
+});
+
+// src/commands/context-scan.ts
+var context_scan_exports = {};
+__export(context_scan_exports, {
+  contextScan: () => contextScan
+});
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync7, readdirSync as readdirSync4, writeFileSync as writeFileSync3 } from "fs";
+import { createHash as createHash3 } from "crypto";
+import { basename, dirname as dirname3, join as join8, relative as relative2 } from "path";
 function inputsDigest(paths, cwd) {
   const combined = paths.slice().sort().map((p) => {
     const rel = relative2(cwd, p).replace(/\\/g, "/");
-    return `${rel}:${sha256OfFile(p)}`;
+    return `${rel}:${sha256OfFileNormalized(p)}`;
   }).join("\n");
-  return createHash2("sha256").update(combined).digest("hex");
+  return createHash3("sha256").update(combined).digest("hex");
 }
 function stripGlobSuffix(pattern) {
   return pattern.replace(/\/\*\*$/, "").replace(/\/\*$/, "");
@@ -406,7 +423,7 @@ function getForbiddenPaths(cwd) {
   const policyPath = join8(cwd, ".cdd", "context-policy.json");
   try {
     if (existsSync7(policyPath)) {
-      const policy = JSON.parse(readFileSync6(policyPath, "utf8"));
+      const policy = JSON.parse(readFileSync7(policyPath, "utf8"));
       for (const pattern of policy.forbiddenPaths ?? []) {
         forbidden.add(stripGlobSuffix(pattern));
       }
@@ -580,7 +597,7 @@ async function contextScan(opts = {}) {
   for (const file of contractFiles) {
     const relPath = relative2(cwd, file).replace(/\\/g, "/");
     const dir = dirname3(relPath).replace(/\\/g, "/");
-    const { title, summary, metadata } = parseContractMetadata(readFileSync6(file, "utf8"));
+    const { title, summary, metadata } = parseContractMetadata(readFileSync7(file, "utf8"));
     const contractType = deriveContractType(relPath, metadata);
     const owner = metadata.owner ?? "unknown";
     const surface2 = metadata.surface ?? dir;
@@ -647,6 +664,7 @@ var init_context_scan = __esm({
   "src/commands/context-scan.ts"() {
     "use strict";
     init_logger();
+    init_digest();
     DEFAULT_FORBIDDEN = [
       ".claude",
       ".git",
@@ -7482,7 +7500,7 @@ var require_dist = __commonJS({
 });
 
 // src/code-map/config.ts
-import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
 import { join as join11 } from "path";
 import { load as yamlLoad } from "js-yaml";
 function asStringArray(value, key, where) {
@@ -7509,7 +7527,7 @@ function loadCodeMapConfig(cwd) {
   }
   let text;
   try {
-    text = readFileSync8(filePath, "utf8");
+    text = readFileSync9(filePath, "utf8");
   } catch (err) {
     throw new Error(`failed to read ${CONFIG_REL_PATH}: ${err.message}`);
   }
@@ -7993,7 +8011,7 @@ __export(javascript_exports, {
   parseJsSource: () => parseJsSource,
   parseSourceWithPlugins: () => parseSourceWithPlugins
 });
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync11 } from "fs";
 import { parse } from "@babel/parser";
 function parseSourceWithPlugins(source, plugins) {
   return parse(source, {
@@ -8295,7 +8313,7 @@ var init_javascript = __esm({
       async scan(absolutePath, repoRoot) {
         let source;
         try {
-          source = readFileSync10(absolutePath, "utf8");
+          source = readFileSync11(absolutePath, "utf8");
         } catch (err) {
           throw err;
         }
@@ -8315,7 +8333,7 @@ var typescript_exports = {};
 __export(typescript_exports, {
   tsScanner: () => tsScanner
 });
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 var TypeScriptScanner, tsScanner;
 var init_typescript = __esm({
   "src/code-map/scanners/typescript.ts"() {
@@ -8327,7 +8345,7 @@ var init_typescript = __esm({
       async scan(absolutePath, repoRoot) {
         let source;
         try {
-          source = readFileSync11(absolutePath, "utf8");
+          source = readFileSync12(absolutePath, "utf8");
         } catch (err) {
           throw err;
         }
@@ -8363,7 +8381,7 @@ var vue_exports = {};
 __export(vue_exports, {
   vueScanner: () => vueScanner
 });
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 import { parse as parse2 } from "@vue/compiler-sfc";
 var VueScanner, vueScanner;
 var init_vue = __esm({
@@ -8376,7 +8394,7 @@ var init_vue = __esm({
       async scan(absolutePath, repoRoot) {
         let source;
         try {
-          source = readFileSync12(absolutePath, "utf8");
+          source = readFileSync13(absolutePath, "utf8");
         } catch (err) {
           throw err;
         }
@@ -8463,24 +8481,19 @@ __export(code_map_exports, {
   codeMap: () => codeMap,
   computeSourcesDigest: () => computeSourcesDigest
 });
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync14, writeFileSync as writeFileSync6 } from "fs";
 import { resolve, dirname as dirname4, relative as relative5 } from "path";
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { createRequire } from "module";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { join as join14 } from "path";
 function computeSourcesDigest(absolutePaths, cwd) {
   const lines = absolutePaths.slice().sort().map((p) => {
     const rel = relative5(cwd, p).replace(/\\/g, "/");
-    let contentHash;
-    try {
-      contentHash = createHash4("sha256").update(readFileSync13(p)).digest("hex");
-    } catch {
-      contentHash = "missing";
-    }
+    const contentHash = sha256OfFileNormalized(p) || "missing";
     return `${rel}:${contentHash}`;
   });
-  return createHash4("sha256").update(lines.join("\n")).digest("hex");
+  return createHash5("sha256").update(lines.join("\n")).digest("hex");
 }
 async function codeMap(opts) {
   const root = resolve(process.cwd(), opts.path);
@@ -8552,8 +8565,8 @@ async function codeMap(opts) {
     log.warn(`${w.path}: ${w.message}`);
   }
   if (opts.check) {
-    const existing = existsSync11(opts.out) ? readFileSync13(opts.out, "utf8") : "";
-    const normalize = (s) => s.replace(/^# generated: [^\n]+\n/m, "# generated: <normalized>\n");
+    const existing = existsSync11(opts.out) ? readFileSync14(opts.out, "utf8") : "";
+    const normalize = (s) => s.replace(/\r\n/g, "\n").replace(/\r/g, "\n").replace(/^# generated: [^\n]+\n/m, "# generated: <normalized>\n");
     if (normalize(existing) !== normalize(yamlBody)) {
       log.error(`code-map out of date: ${opts.out} would change. Run \`cdd-kit code-map\` to regenerate.`);
       return 1;
@@ -8574,9 +8587,10 @@ var init_code_map = __esm({
     init_yaml_writer();
     init_orchestrator();
     init_config();
+    init_digest();
     _require = createRequire(import.meta.url);
     _pkgPath = join14(fileURLToPath2(import.meta.url), "..", "..", "..", "package.json");
-    _pkg = JSON.parse(readFileSync13(_pkgPath, "utf8"));
+    _pkg = JSON.parse(readFileSync14(_pkgPath, "utf8"));
   }
 });
 
@@ -8585,7 +8599,7 @@ var freshness_exports = {};
 __export(freshness_exports, {
   checkCodeMapFreshness: () => checkCodeMapFreshness
 });
-import { existsSync as existsSync12, readFileSync as readFileSync14, statSync as statSync3 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync15, statSync as statSync3 } from "fs";
 import { join as join15 } from "path";
 function checkCodeMapFreshness(cwd, mapRel = ".cdd/code-map.yml", include, exclude) {
   const mapPath = join15(cwd, mapRel);
@@ -8641,7 +8655,7 @@ function checkCodeMapFreshness(cwd, mapRel = ".cdd/code-map.yml", include, exclu
 }
 function readSourcesDigest(mapPath) {
   try {
-    const head = readFileSync14(mapPath, "utf8").slice(0, 2048);
+    const head = readFileSync15(mapPath, "utf8").slice(0, 2048);
     const m = head.match(/^# sources-digest:\s*([a-f0-9]+)/m);
     return m ? m[1] : null;
   } catch {
@@ -8663,7 +8677,7 @@ __export(migrate_exports, {
   migrate: () => migrate
 });
 import { join as join18 } from "path";
-import { cpSync as cpSync2, existsSync as existsSync15, mkdirSync as mkdirSync7, readdirSync as readdirSync8, readFileSync as readFileSync17, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync8 } from "fs";
+import { cpSync as cpSync2, existsSync as existsSync15, mkdirSync as mkdirSync7, readdirSync as readdirSync8, readFileSync as readFileSync18, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync8 } from "fs";
 import yaml3 from "js-yaml";
 function backupChangeDir(cwd, changeId, sessionStamp) {
   const backupRoot = join18(cwd, ".cdd", "migrate-backup", sessionStamp);
@@ -8812,7 +8826,7 @@ function migrateTasksFile(changeId, changeDir, enableContextGovernance, detected
     warnings.push("tasks.md not found and tasks.yml missing \u2014 skipping tasks migration");
     return;
   }
-  const raw = readFileSync17(legacyPath, "utf8");
+  const raw = readFileSync18(legacyPath, "utf8");
   const fm = parseLegacyFrontmatter(raw);
   const bodyMatch = raw.match(/^---\r?\n[\s\S]*?\r?\n---\r?\n?([\s\S]*)$/);
   const body = bodyMatch ? bodyMatch[1] : raw;
@@ -8906,7 +8920,7 @@ function migrateAgentLogs(changeDir, changed, pendingWrites, pendingDeletes) {
     const yamlFull = join18(agentLogDir, yamlName);
     if (existsSync15(yamlFull))
       continue;
-    const raw = readFileSync17(fullPath, "utf8");
+    const raw = readFileSync18(fullPath, "utf8");
     const parsed = parseLegacyAgentLog(raw);
     const yamlOut = yaml3.dump(parsed, { lineWidth: -1, noRefs: true });
     pendingWrites.push({ path: yamlFull, content: yamlOut });
@@ -8922,7 +8936,7 @@ function migrateOne(changeId, changeDir, enableContextGovernance) {
   let detectedTier = null;
   const classifPath = join18(changeDir, "change-classification.md");
   if (existsSync15(classifPath)) {
-    const content = readFileSync17(classifPath, "utf8");
+    const content = readFileSync18(classifPath, "utf8");
     const hasNewTierFormat = /^## Tier\s*\n\s*-\s*\d\s*$/m.test(content);
     const oldMatch = content.match(/\*\*Tier[:\*]+\s*(?:Tier\s*)?(\d)/i) ?? content.match(/^-?\s*Tier:\s*(?:Tier\s*)?(\d)/mi);
     if (oldMatch)
@@ -9087,7 +9101,7 @@ function ensureGitignoreEntry(cwd, entry) {
   const re = new RegExp(`^\\s*${trimmed.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\$&")}\\s*$`, "m");
   let existing = "";
   if (existsSync15(path))
-    existing = readFileSync17(path, "utf8");
+    existing = readFileSync18(path, "utf8");
   if (re.test(existing))
     return false;
   const sep = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
@@ -9112,7 +9126,7 @@ var upgrade_exports = {};
 __export(upgrade_exports, {
   upgrade: () => upgrade
 });
-import { existsSync as existsSync16, mkdirSync as mkdirSync8, readdirSync as readdirSync9, copyFileSync as copyFileSync3, readFileSync as readFileSync18, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync8, readdirSync as readdirSync9, copyFileSync as copyFileSync3, readFileSync as readFileSync19, writeFileSync as writeFileSync9 } from "fs";
 import { dirname as dirname5, join as join19, relative as relative6 } from "path";
 function planMissingFiles(srcDir, destDir, label, planned) {
   if (!existsSync16(srcDir))
@@ -9203,7 +9217,7 @@ async function upgrade(opts = {}) {
   if (existsSync16(modelPolicyPath)) {
     let existing = {};
     try {
-      existing = JSON.parse(readFileSync18(modelPolicyPath, "utf8"));
+      existing = JSON.parse(readFileSync19(modelPolicyPath, "utf8"));
     } catch {
     }
     const merged = {
@@ -9243,11 +9257,11 @@ var refresh_exports = {};
 __export(refresh_exports, {
   refresh: () => refresh
 });
-import { existsSync as existsSync17, mkdirSync as mkdirSync9, readdirSync as readdirSync10, copyFileSync as copyFileSync4, readFileSync as readFileSync19, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync9, readdirSync as readdirSync10, copyFileSync as copyFileSync4, readFileSync as readFileSync20, writeFileSync as writeFileSync10 } from "fs";
 import { dirname as dirname6, join as join20, relative as relative7 } from "path";
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 function fileHash2(filePath) {
-  return createHash5("sha256").update(readFileSync19(filePath)).digest("hex");
+  return createHash6("sha256").update(readFileSync20(filePath)).digest("hex");
 }
 function planForceRefresh(srcDir, destDir, sectionLabel) {
   const plan = [];
@@ -9299,7 +9313,7 @@ function ensureGitignoreEntry2(cwd, entry) {
   const re = new RegExp(`^\\s*${trimmed.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\$&")}\\s*$`, "m");
   let existing = "";
   if (existsSync17(path))
-    existing = readFileSync19(path, "utf8");
+    existing = readFileSync20(path, "utf8");
   if (re.test(existing))
     return false;
   const sep = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
@@ -9355,7 +9369,7 @@ function resyncModelPolicy(cwd) {
   const desired = {};
   const agentFiles = readdirSync10(AGENTS_HOME, { withFileTypes: true }).filter((d) => d.isFile() && d.name.endsWith(".md"));
   for (const f of agentFiles) {
-    const content = readFileSync19(join20(AGENTS_HOME, f.name), "utf8");
+    const content = readFileSync20(join20(AGENTS_HOME, f.name), "utf8");
     const fm = parseAgentFrontmatter(content);
     if (fm.name && fm.model)
       desired[fm.name] = fm.model;
@@ -9365,7 +9379,7 @@ function resyncModelPolicy(cwd) {
   let existing = {};
   if (existsSync17(policyPath)) {
     try {
-      existing = JSON.parse(readFileSync19(policyPath, "utf8"));
+      existing = JSON.parse(readFileSync20(policyPath, "utf8"));
     } catch {
     }
   }
@@ -9574,8 +9588,8 @@ var doctor_exports = {};
 __export(doctor_exports, {
   doctor: () => doctor
 });
-import { existsSync as existsSync18, readdirSync as readdirSync11, readFileSync as readFileSync20 } from "fs";
-import { createHash as createHash6 } from "crypto";
+import { existsSync as existsSync18, readdirSync as readdirSync11, readFileSync as readFileSync21 } from "fs";
+import { createHash as createHash7 } from "crypto";
 import { join as join21, relative as relative8 } from "path";
 function fileExists(cwd, relPath) {
   return existsSync18(join21(cwd, relPath));
@@ -9592,24 +9606,17 @@ function findFiles(dir, predicate, found = []) {
   }
   return found;
 }
-function sha256OfFile3(path) {
-  try {
-    return createHash6("sha256").update(readFileSync20(path)).digest("hex");
-  } catch {
-    return "";
-  }
-}
 function inputDigest(paths, cwd) {
   const combined = paths.slice().sort().map((p) => {
     const rel = relative8(cwd, p).replace(/\\/g, "/");
-    return `${rel}:${sha256OfFile3(p)}`;
+    return `${rel}:${sha256OfFileNormalized(p)}`;
   }).join("\n");
-  return createHash6("sha256").update(combined).digest("hex");
+  return createHash7("sha256").update(combined).digest("hex");
 }
 function readContextIndexMetadata(filePath) {
   if (!existsSync18(filePath))
     return {};
-  const text = readFileSync20(filePath, "utf8");
+  const text = readFileSync21(filePath, "utf8");
   const out = {};
   const digestMatch = text.match(/^inputs-digest:\s*([a-f0-9]+)/m);
   if (digestMatch)
@@ -9674,7 +9681,7 @@ function checkContextFreshness(cwd) {
 }
 function readAgentModel(path) {
   try {
-    const text = readFileSync20(path, "utf8");
+    const text = readFileSync21(path, "utf8");
     const m = text.match(/^model:\s*(\S+)/m);
     return m ? m[1] : null;
   } catch {
@@ -9687,7 +9694,7 @@ function checkModelPolicyDrift(cwd) {
     return [];
   let policy;
   try {
-    policy = JSON.parse(readFileSync20(policyPath, "utf8"));
+    policy = JSON.parse(readFileSync21(policyPath, "utf8"));
   } catch {
     return [{ level: "warning", message: ".cdd/model-policy.json is not valid JSON" }];
   }
@@ -9788,7 +9795,7 @@ function checkCodeMap(cwd) {
     const more = probe.staleCount > 3 ? ` (+${probe.staleCount - 3} more)` : "";
     findings.push({ level: "warning", message: `code-map stale: ${top}${more}; run \`cdd-kit code-map\`` });
   }
-  const text = readFileSync20(mapPath, "utf8");
+  const text = readFileSync21(mapPath, "utf8");
   const m = text.match(/^# files: (\d+), src-lines: (\d+), map-lines: (\d+), compression: ([\d.]+)x/m);
   if (m) {
     findings.push({ level: "ok", message: `code-map: ${m[1]} files, ${m[4]}x compression` });
@@ -9868,7 +9875,7 @@ async function attemptAutoFixes(cwd, report) {
       try {
         let existing = {};
         try {
-          existing = JSON.parse(readFileSync20(policyPath, "utf8"));
+          existing = JSON.parse(readFileSync21(policyPath, "utf8"));
         } catch {
         }
         const merged = {
@@ -9961,6 +9968,7 @@ var init_doctor = __esm({
     init_logger();
     init_provider();
     init_freshness();
+    init_digest();
   }
 });
 
@@ -9969,7 +9977,7 @@ var lint_agents_exports = {};
 __export(lint_agents_exports, {
   lintAgents: () => lintAgents
 });
-import { readdirSync as readdirSync12, readFileSync as readFileSync21 } from "fs";
+import { readdirSync as readdirSync12, readFileSync as readFileSync22 } from "fs";
 import { join as join22 } from "path";
 import { load as yamlLoad2 } from "js-yaml";
 function extractRequiredArtifactsSection(content) {
@@ -10024,7 +10032,7 @@ async function lintAgents(opts) {
     const filePath = join22(agentsDir, filename);
     let content;
     try {
-      content = readFileSync21(filePath, "utf8");
+      content = readFileSync22(filePath, "utf8");
     } catch {
       violations.push({
         file: filename,
@@ -10137,7 +10145,7 @@ __export(archive_exports, {
   archive: () => archive
 });
 import { join as join23 } from "path";
-import { existsSync as existsSync19, mkdirSync as mkdirSync10, renameSync as renameSync2, readFileSync as readFileSync22, writeFileSync as writeFileSync11, appendFileSync, cpSync as cpSync3, rmSync as rmSync3 } from "fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync10, renameSync as renameSync2, readFileSync as readFileSync23, writeFileSync as writeFileSync11, appendFileSync, cpSync as cpSync3, rmSync as rmSync3 } from "fs";
 import yaml4 from "js-yaml";
 async function archive(changeId) {
   const cwd = process.cwd();
@@ -10157,7 +10165,7 @@ async function archive(changeId) {
   const tasksPath = join23(changeDir, "tasks.yml");
   if (existsSync19(tasksPath)) {
     try {
-      const raw = readFileSync22(tasksPath, "utf8");
+      const raw = readFileSync23(tasksPath, "utf8");
       const data = yaml4.load(raw);
       if (data?.status === "gate-blocked") {
         log.warn("tasks.yml has status: gate-blocked \u2014 archiving anyway (change was paused).");
@@ -10213,7 +10221,7 @@ __export(abandon_exports, {
   abandon: () => abandon
 });
 import { join as join24 } from "path";
-import { existsSync as existsSync20, readFileSync as readFileSync23, writeFileSync as writeFileSync12, appendFileSync as appendFileSync2, mkdirSync as mkdirSync11 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync24, writeFileSync as writeFileSync12, appendFileSync as appendFileSync2, mkdirSync as mkdirSync11 } from "fs";
 import yaml5 from "js-yaml";
 async function abandon(changeId, opts) {
   const cwd = process.cwd();
@@ -10224,7 +10232,7 @@ async function abandon(changeId, opts) {
     process.exit(1);
   }
   if (existsSync20(tasksPath)) {
-    const raw = readFileSync23(tasksPath, "utf8");
+    const raw = readFileSync24(tasksPath, "utf8");
     const data = yaml5.load(raw) ?? {};
     data["status"] = "abandoned";
     if (!data["change-id"]) {
@@ -10267,7 +10275,7 @@ __export(list_changes_exports, {
   listChanges: () => listChanges
 });
 import { join as join25 } from "path";
-import { existsSync as existsSync21, readdirSync as readdirSync13, readFileSync as readFileSync24 } from "fs";
+import { existsSync as existsSync21, readdirSync as readdirSync13, readFileSync as readFileSync25 } from "fs";
 import yaml6 from "js-yaml";
 async function listChanges() {
   const cwd = process.cwd();
@@ -10287,7 +10295,7 @@ async function listChanges() {
       let pending = 0;
       if (existsSync21(tasksPath)) {
         try {
-          const raw = readFileSync24(tasksPath, "utf8");
+          const raw = readFileSync25(tasksPath, "utf8");
           const data = yaml6.load(raw);
           if (data?.status)
             status = data.status;
@@ -10318,7 +10326,7 @@ __export(context_exports, {
   rejectContextExpansion: () => rejectContextExpansion,
   requestContextExpansion: () => requestContextExpansion
 });
-import { existsSync as existsSync22, readFileSync as readFileSync25, writeFileSync as writeFileSync13 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync26, writeFileSync as writeFileSync13 } from "fs";
 import { join as join26 } from "path";
 function normalizePath(path) {
   return path.replace(/\\/g, "/").replace(/^\.\//, "").trim();
@@ -10341,7 +10349,7 @@ function readManifest(changeId) {
     log.error(`context manifest not found: specs/changes/${changeId}/context-manifest.md`);
     process.exit(1);
   }
-  return readFileSync25(manifestPath, "utf8");
+  return readFileSync26(manifestPath, "utf8");
 }
 function writeManifest(changeId, content) {
   writeFileSync13(manifestPathFor(changeId), content.endsWith("\n") ? content : `${content}
@@ -10569,7 +10577,7 @@ var init_context = __esm({
 });
 
 // src/cli/index.ts
-import { readFileSync as readFileSync26 } from "fs";
+import { readFileSync as readFileSync27 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { dirname as dirname7, join as join27 } from "path";
 import { Command } from "commander";
@@ -10992,24 +11000,18 @@ init_update();
 // src/commands/new-change.ts
 init_paths();
 import { join as join9, relative as relative3 } from "path";
-import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync8, readFileSync as readFileSync7, readdirSync as readdirSync5, writeFileSync as writeFileSync4 } from "fs";
+import { createHash as createHash4 } from "crypto";
+import { existsSync as existsSync8, readFileSync as readFileSync8, readdirSync as readdirSync5, writeFileSync as writeFileSync4 } from "fs";
 import yaml from "js-yaml";
 init_logger();
 init_context_scan();
-function sha256OfFile2(path) {
-  try {
-    return createHash3("sha256").update(readFileSync7(path)).digest("hex");
-  } catch {
-    return "";
-  }
-}
+init_digest();
 function inputsDigest2(paths, cwd) {
   const combined = paths.slice().sort().map((p) => {
     const rel = relative3(cwd, p).replace(/\\/g, "/");
-    return `${rel}:${sha256OfFile2(p)}`;
+    return `${rel}:${sha256OfFileNormalized(p)}`;
   }).join("\n");
-  return createHash3("sha256").update(combined).digest("hex");
+  return createHash4("sha256").update(combined).digest("hex");
 }
 function findContractFiles2(dir, found = []) {
   if (!existsSync8(dir))
@@ -11027,7 +11029,7 @@ function findContractFiles2(dir, found = []) {
 function readIndexDigest(filePath) {
   if (!existsSync8(filePath))
     return null;
-  const m = readFileSync7(filePath, "utf8").match(/^inputs-digest:\s*([a-f0-9]+)/m);
+  const m = readFileSync8(filePath, "utf8").match(/^inputs-digest:\s*([a-f0-9]+)/m);
   return m ? m[1] : null;
 }
 async function ensureFreshContextIndexes(cwd) {
@@ -11119,7 +11121,7 @@ async function newChange(name, opts) {
   if (dependencies.length > 0) {
     const tasksPath = join9(changeDir, "tasks.yml");
     if (existsSync8(tasksPath)) {
-      const raw = readFileSync7(tasksPath, "utf8");
+      const raw = readFileSync8(tasksPath, "utf8");
       const data = yaml.load(raw) ?? {};
       data["depends-on"] = dependencies;
       writeFileSync4(tasksPath, yaml.dump(data, { lineWidth: -1, noRefs: true }), "utf8");
@@ -11223,7 +11225,7 @@ async function validate(opts) {
 var import_ajv = __toESM(require_ajv(), 1);
 var import_ajv_formats = __toESM(require_dist(), 1);
 init_logger();
-import { existsSync as existsSync13, readFileSync as readFileSync15, readdirSync as readdirSync7 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync16, readdirSync as readdirSync7 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join16 } from "path";
 import yaml2 from "js-yaml";
@@ -11411,7 +11413,7 @@ function extractRequiredArtifactTypes(cwd, agentName) {
     if (!existsSync13(candidate))
       continue;
     try {
-      content = readFileSync15(candidate, "utf8");
+      content = readFileSync16(candidate, "utf8");
       break;
     } catch {
     }
@@ -11452,7 +11454,7 @@ function loadContextPolicy(cwd) {
   if (!existsSync13(policyPath))
     return defaults;
   try {
-    const custom = JSON.parse(readFileSync15(policyPath, "utf8"));
+    const custom = JSON.parse(readFileSync16(policyPath, "utf8"));
     return {
       ...defaults,
       ...custom,
@@ -11466,7 +11468,7 @@ function loadContextPolicy(cwd) {
 }
 function loadYamlFile(path) {
   try {
-    const raw = readFileSync15(path, "utf8");
+    const raw = readFileSync16(path, "utf8");
     return { data: yaml2.load(raw), parseError: null };
   } catch (err) {
     return { data: null, parseError: err.message };
@@ -11528,7 +11530,7 @@ function lintTasksFile(tasksPath, errors, warnings) {
 function resolveTier(changeDir) {
   const classifPath = join16(changeDir, "change-classification.md");
   const classificationPresent = existsSync13(classifPath);
-  const classificationText = classificationPresent ? readFileSync15(classifPath, "utf8") : "";
+  const classificationText = classificationPresent ? readFileSync16(classifPath, "utf8") : "";
   const classificationHasLooseMarker = classificationPresent && TIER_PATTERN.test(classificationText);
   const tasksPath = join16(changeDir, "tasks.yml");
   if (existsSync13(tasksPath)) {
@@ -11593,7 +11595,7 @@ function enforceTierRequirements(changeDir, agentLogDir, errors, warnings) {
     }
   }
   if (resolution.source === "tasks-frontmatter" && resolution.classificationPresent) {
-    const text = readFileSync15(join16(changeDir, "change-classification.md"), "utf8");
+    const text = readFileSync16(join16(changeDir, "change-classification.md"), "utf8");
     const structured = text.match(/^## Tier\s*\n\s*-\s*(\d)\s*$/m);
     const bold = text.match(/\*\*Tier:\*\*\s*Tier\s*(\d)\b/i);
     const classifTier = structured ? parseInt(structured[1], 10) : bold ? parseInt(bold[1], 10) : NaN;
@@ -11710,7 +11712,7 @@ async function gate(changeId, opts = {}) {
   let approvedExpansions = [];
   errors.push(...validateDependencies(cwd, changeId, changeDir));
   if (hasManifest) {
-    const manifest = parseContextManifest(readFileSync15(manifestPath, "utf8"));
+    const manifest = parseContextManifest(readFileSync16(manifestPath, "utf8"));
     allowedPaths = manifest.allowedPaths;
     approvedExpansions = manifest.approvedExpansions;
     if (manifest.pendingExpansions > 0) {
@@ -11738,7 +11740,7 @@ async function gate(changeId, opts = {}) {
         continue;
       if (f === "tasks.yml")
         continue;
-      const content = readFileSync15(join16(changeDir, f), "utf8");
+      const content = readFileSync16(join16(changeDir, f), "utf8");
       const minChars = MIN_CHARS[f] ?? 100;
       if (meaningfulChars(content) < minChars) {
         errors.push(`${f}: appears to be a stub (< ${minChars} meaningful chars)`);
@@ -11840,7 +11842,7 @@ async function gate(changeId, opts = {}) {
         }
         const runtimeLog = join16(cwd, ".cdd", "runtime", `${changeId}-files-read.jsonl`);
         if (existsSync13(runtimeLog)) {
-          const runtimePaths = readFileSync15(runtimeLog, "utf8").split("\n").filter(Boolean).map((line) => {
+          const runtimePaths = readFileSync16(runtimeLog, "utf8").split("\n").filter(Boolean).map((line) => {
             try {
               return JSON.parse(line).path;
             } catch {
@@ -11926,7 +11928,7 @@ async function gate(changeId, opts = {}) {
 // src/commands/install-hooks.ts
 init_paths();
 init_logger();
-import { existsSync as existsSync14, readFileSync as readFileSync16, writeFileSync as writeFileSync7, chmodSync as chmodSync2, mkdirSync as mkdirSync6 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync17, writeFileSync as writeFileSync7, chmodSync as chmodSync2, mkdirSync as mkdirSync6 } from "fs";
 import { join as join17 } from "path";
 var START_MARKER2 = "# cdd-kit-managed-block-start";
 var END_MARKER2 = "# cdd-kit-managed-block-end";
@@ -11940,12 +11942,12 @@ async function installHooks() {
   const hooksDir = join17(gitDir, "hooks");
   mkdirSync6(hooksDir, { recursive: true });
   const dest = join17(hooksDir, "pre-commit");
-  const ourHook = readFileSync16(join17(ASSET.hooks, "pre-commit"), "utf8");
+  const ourHook = readFileSync17(join17(ASSET.hooks, "pre-commit"), "utf8");
   let final;
   if (!existsSync14(dest)) {
     final = ourHook;
   } else {
-    const existing = readFileSync16(dest, "utf8");
+    const existing = readFileSync17(dest, "utf8");
     const startIdx = existing.indexOf(START_MARKER2);
     const endIdx = existing.indexOf(END_MARKER2);
     if (startIdx >= 0 && endIdx > startIdx) {
@@ -11980,7 +11982,7 @@ async function installHooks() {
 
 // src/cli/index.ts
 var __dirname2 = dirname7(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync26(join27(__dirname2, "..", "..", "package.json"), "utf8"));
+var pkg = JSON.parse(readFileSync27(join27(__dirname2, "..", "..", "package.json"), "utf8"));
 var program = new Command();
 program.name("cdd-kit").description("Contract-Driven Delivery Kit CLI").version(pkg.version);
 program.command("init").description(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "contract-driven-delivery",
-  "version": "2.0.10",
+  "version": "2.0.12",
   "description": "Contract-driven delivery kit for AI coding agents with deterministic context indexes, manifest-backed read-scope governance, and orchestrated contracts-first delivery.",
   "keywords": [
     "contract-driven",