specshield 3.4.5 → 3.4.7

package/README.md

@@ -67,7 +67,7 @@ This CLI is one surface of the **SpecShield™ platform**. The same contract-com
 
 | Surface | Best for |
 |---|---|
-| **GitHub App** — [github.com/apps/specshield-cli](https://github.com/apps/specshield-cli) | Zero-config PR checks. Install once; every PR gets a check run and a diff comment. |
+| **GitHub App** — [github.com/apps/specshield-deploy-gate](https://github.com/apps/specshield-deploy-gate) | Zero-config PR checks. Install once; every PR gets a check run and a diff comment. |
 | **GitHub Action** — [`specshield-io/bdct-action@v1`](https://github.com/marketplace/actions/specshield-bdct) | Pinned, reproducible BDCT + governance gate in any GitHub workflow. |
 | **CLI** *(this package)* | Any CI — GitLab, Jenkins, CircleCI, Bitbucket, Drone — or your laptop. |
 | **IntelliJ plugin** — [JetBrains Marketplace](https://plugins.jetbrains.com/plugin/33137-specshield) | Inline spec findings, one-click auto-fixes, compare & explain — inside IntelliJ IDEA, WebStorm, PyCharm and more. |
@@ -1499,7 +1499,7 @@ MIT © SpecShield Software Private Limited
 
 <div align="center">
 
-**The SpecShield™ platform:** [Dashboard](https://specshield.io) · [GitHub App](https://github.com/apps/specshield-cli) · [GitHub Action](https://github.com/marketplace/actions/specshield-bdct) · [IntelliJ Plugin](https://plugins.jetbrains.com/plugin/33137-specshield) · [MCP Server](https://github.com/specshield-io/specshield-mcp-server)
+**The SpecShield™ platform:** [Dashboard](https://specshield.io) · [GitHub App](https://github.com/apps/specshield-deploy-gate) · [GitHub Action](https://github.com/marketplace/actions/specshield-bdct) · [IntelliJ Plugin](https://plugins.jetbrains.com/plugin/33137-specshield) · [MCP Server](https://github.com/specshield-io/specshield-mcp-server)
 
 **[⭐ Star on GitHub](https://github.com/specshield-io/specshield-cli) · [📦 View on npm](https://www.npmjs.com/package/specshield) · [🚀 Create free account](https://specshield.io) · [⚖️ Compare](https://specshield.io/alternatives)**
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specshield",
-  "version": "3.4.5",
+  "version": "3.4.7",
   "description": "Contract compatibility testing for APIs — catch breaking OpenAPI changes before they reach your consumers, with can-i-deploy deploy gating and GitHub PR checks. (a.k.a. bidirectional contract testing.)",
   "main": "src/cli.js",
   "homepage": "https://specshield.io",

package/src/core/classifyChanges.js

@@ -25,11 +25,6 @@ const BREAKING_TYPES = new Set([
   // that relied on the removed shape / the old discriminator.
   'SCHEMA_VARIANT_REMOVED',
   'SCHEMA_DISCRIMINATOR_CHANGED',
-  // Constraint tightening: previously-valid values become invalid → breaking.
-  'CONSTRAINT_TIGHTENED',
-  // Pattern changes are treated as breaking (semantic safety: we can't
-  // tell whether the new pattern accepts a superset of the old).
-  'CONSTRAINT_PATTERN_CHANGED',
 ]);
 
 const ADDITION_TYPES = new Set([
@@ -51,8 +46,29 @@ const MODIFICATION_TYPES = new Set([
   'CONSTRAINT_RELAXED',
 ]);
 
+/**
+ * Reported, but never fail the build (see resolveExitCode — only
+ * breakingChanges affect the exit code).
+ *
+ * Constraint changes live here because whether they break depends on WHICH SIDE
+ * of the contract they sit on, and this engine does not track that. Tightening
+ * `maxLength` on a *request* rejects payloads that used to be accepted; the same
+ * change on a *response* is harmless. The hosted engine makes that distinction
+ * (REQUEST_CONSTRAINT_TIGHTENED vs RESPONSE_CONSTRAINT_TIGHTENED) and is the
+ * authority on the verdict.
+ *
+ * Classifying them as breaking here — which this engine used to do — meant the
+ * CLI could fail a build that the hosted gate passes. Two gates that disagree
+ * is precisely the failure mode this product exists to prevent, so the CLI
+ * reports the change and declines to rule on it.
+ *
+ * The governing rule for this file: the CLI may detect FEWER change types than
+ * the backend, but it must never classify a shared type DIFFERENTLY.
+ * Subset, not variant. See engineParity.test.js.
+ */
 const WARNING_TYPES = new Set([
-  // future use
+  'CONSTRAINT_TIGHTENED',
+  'CONSTRAINT_PATTERN_CHANGED',
 ]);
 
 // Numeric order: higher = more severe

package/src/core/outputFormatter.js

@@ -64,6 +64,18 @@ function formatHuman(result) {
     for (const c of warnings) {
       lines.push(`  ${chalk.gray('!')} ${c.description}`);
     }
+    // Whether a constraint change actually breaks depends on which side of the
+    // contract it sits on, which this engine does not track. Say so rather than
+    // let the reader assume these were judged and found safe.
+    lines.push(chalk.gray('    These depend on request/response direction — the hosted gate rules on them.'));
+    lines.push('');
+  }
+
+  // "0 breaking" from a deliberately smaller local engine is not the same claim
+  // as "0 breaking" from the full one. Don't let the two look identical.
+  if (breakingChanges.length === 0) {
+    lines.push(chalk.gray('  No breaking changes found by the local engine.'));
+    lines.push(chalk.gray('  Nullability, constraint and enum-addition checks run on the hosted gate.'));
     lines.push('');
   }