specshield 3.4.6 → 3.4.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specshield",
-  "version": "3.4.6",
+  "version": "3.4.8",
   "description": "Contract compatibility testing for APIs — catch breaking OpenAPI changes before they reach your consumers, with can-i-deploy deploy gating and GitHub PR checks. (a.k.a. bidirectional contract testing.)",
   "main": "src/cli.js",
   "homepage": "https://specshield.io",

package/src/commands/bdct.js

@@ -6,6 +6,7 @@ const ora = require('ora');
 const path = require('path');
 const fsExtra = require('fs-extra');
 const logger = require('../utils/logger');
+const exitAfterFlush = require('../utils/exitAfterFlush');
 const { getStoredApiKey } = require('../config/localConfig');
 const { applyBdctDefaults } = require('../core/projectConfig');
 const {
@@ -300,7 +301,8 @@ const verifyCommand = new Command('verify')
 
       if (opts.json) {
         process.stdout.write(JSON.stringify(result, null, 2) + '\n');
-        process.exit(success ? 0 : 1);
+        exitAfterFlush(success ? 0 : 1);
+        return;
       }
 
       process.stdout.write('\n');
@@ -352,7 +354,7 @@ const verifyCommand = new Command('verify')
       }
 
       process.stdout.write('\n');
-      process.exit(success ? 0 : 1);
+      exitAfterFlush(success ? 0 : 1);
     } catch (err) {
       if (spinner) spinner.fail('Verification failed');
       logger.error(err.message);
@@ -399,7 +401,8 @@ const canIDeployCommand = new Command('can-i-deploy')
 
       if (opts.json) {
         process.stdout.write(JSON.stringify(result, null, 2) + '\n');
-        process.exit(deployable ? 0 : 1);
+        exitAfterFlush(deployable ? 0 : 1);
+        return;
       }
 
       // Idempotent `v` prefix on display — don't double it when the stored
@@ -433,10 +436,10 @@ const canIDeployCommand = new Command('can-i-deploy')
         process.stdout.write(chalk.gray(`  ➜  Run: specshield bdct verify --consumer <NAME> --provider ${opts.service}\n`));
         process.stdout.write(chalk.gray(`  ➜  to identify and resolve incompatibilities\n`));
         process.stdout.write('\n');
-        process.exit(1);
+        exitAfterFlush(1);
       } else {
         process.stdout.write('\n');
-        process.exit(0);
+        exitAfterFlush(0);
       }
     } catch (err) {
       if (spinner) spinner.fail('Check failed');
@@ -817,7 +820,8 @@ const verifyProviderCommand = new Command('verify-provider')
 
     if (opts.json) {
       process.stdout.write(JSON.stringify(report, null, 2) + '\n');
-      process.exit(report.summary.fail + report.summary.error > 0 ? 1 : 0);
+      exitAfterFlush(report.summary.fail + report.summary.error > 0 ? 1 : 0);
+      return;
     }
 
     // Human report.
@@ -850,7 +854,7 @@ const verifyProviderCommand = new Command('verify-provider')
     const s = report.summary;
     process.stdout.write('  ' + '─'.repeat(60) + '\n');
     process.stdout.write(`  ${s.pass} pass · ${s.fail} fail · ${s.error} error · ${s.skipped} skip   (${s.total} probes)\n\n`);
-    process.exit(s.fail + s.error > 0 ? 1 : 0);
+    exitAfterFlush(s.fail + s.error > 0 ? 1 : 0);
   });
 
 // Repeatable --header parser: collects into a map.

package/src/commands/compare.js

@@ -14,6 +14,7 @@ const { loadConfig } = require('../core/configLoader');
 const { resolveExitCode } = require('../core/exitCode');
 const { recordCompareAndMaybeRender } = require('../core/conversionPrompt');
 const logger = require('../utils/logger');
+const exitAfterFlush = require('../utils/exitAfterFlush');
 const fsExtra = require('fs-extra');
 const { getStoredApiKey } = require('../config/localConfig');
 
@@ -129,7 +130,7 @@ compare
 
       // Exit code
       const code = resolveExitCode(result, options);
-      process.exit(code);
+      exitAfterFlush(code);
 
     } catch (err) {
       logger.error(`Error: ${err.message}`);

package/src/commands/govern.js

@@ -5,6 +5,7 @@ const chalk = require('chalk');
 const ora = require('ora');
 const fsExtra = require('fs-extra');
 const logger = require('../utils/logger');
+const exitAfterFlush = require('../utils/exitAfterFlush');
 const { loadSpec } = require('../core/loadSpec');
 const { getStoredApiKey } = require('../config/localConfig');
 const { governanceGate } = require('../api/bdctClient');
@@ -80,8 +81,8 @@ const govern = new Command('govern')
         if (opts.output) await fsExtra.outputFile(opts.output, JSON.stringify(resp, null, 2));
       }
 
-      if (opts.advisory) process.exit(0);
-      process.exit(resp.passed ? 0 : 1);
+      if (opts.advisory) exitAfterFlush(0);
+      else exitAfterFlush(resp.passed ? 0 : 1);
     } catch (err) {
       if (err.status === 402) {
         logger.error('API governance requires a paid plan (Team or above). See https://specshield.io/pricing');

package/src/core/classifyChanges.js

@@ -25,11 +25,6 @@ const BREAKING_TYPES = new Set([
   // that relied on the removed shape / the old discriminator.
   'SCHEMA_VARIANT_REMOVED',
   'SCHEMA_DISCRIMINATOR_CHANGED',
-  // Constraint tightening: previously-valid values become invalid → breaking.
-  'CONSTRAINT_TIGHTENED',
-  // Pattern changes are treated as breaking (semantic safety: we can't
-  // tell whether the new pattern accepts a superset of the old).
-  'CONSTRAINT_PATTERN_CHANGED',
 ]);
 
 const ADDITION_TYPES = new Set([
@@ -51,8 +46,29 @@ const MODIFICATION_TYPES = new Set([
   'CONSTRAINT_RELAXED',
 ]);
 
+/**
+ * Reported, but never fail the build (see resolveExitCode — only
+ * breakingChanges affect the exit code).
+ *
+ * Constraint changes live here because whether they break depends on WHICH SIDE
+ * of the contract they sit on, and this engine does not track that. Tightening
+ * `maxLength` on a *request* rejects payloads that used to be accepted; the same
+ * change on a *response* is harmless. The hosted engine makes that distinction
+ * (REQUEST_CONSTRAINT_TIGHTENED vs RESPONSE_CONSTRAINT_TIGHTENED) and is the
+ * authority on the verdict.
+ *
+ * Classifying them as breaking here — which this engine used to do — meant the
+ * CLI could fail a build that the hosted gate passes. Two gates that disagree
+ * is precisely the failure mode this product exists to prevent, so the CLI
+ * reports the change and declines to rule on it.
+ *
+ * The governing rule for this file: the CLI may detect FEWER change types than
+ * the backend, but it must never classify a shared type DIFFERENTLY.
+ * Subset, not variant. See engineParity.test.js.
+ */
 const WARNING_TYPES = new Set([
-  // future use
+  'CONSTRAINT_TIGHTENED',
+  'CONSTRAINT_PATTERN_CHANGED',
 ]);
 
 // Numeric order: higher = more severe

package/src/core/outputFormatter.js

@@ -64,6 +64,18 @@ function formatHuman(result) {
     for (const c of warnings) {
       lines.push(`  ${chalk.gray('!')} ${c.description}`);
     }
+    // Whether a constraint change actually breaks depends on which side of the
+    // contract it sits on, which this engine does not track. Say so rather than
+    // let the reader assume these were judged and found safe.
+    lines.push(chalk.gray('    These depend on request/response direction — the hosted gate rules on them.'));
+    lines.push('');
+  }
+
+  // "0 breaking" from a deliberately smaller local engine is not the same claim
+  // as "0 breaking" from the full one. Don't let the two look identical.
+  if (breakingChanges.length === 0) {
+    lines.push(chalk.gray('  No breaking changes found by the local engine.'));
+    lines.push(chalk.gray('  Nullability, constraint and enum-addition checks run on the hosted gate.'));
     lines.push('');
   }
 

package/src/utils/exitAfterFlush.js

@@ -0,0 +1,15 @@
+'use strict';
+
+// process.exit() discards whatever is still buffered in stdout. Writes to a
+// pipe are asynchronous, so `specshield <cmd> --json | jq` truncated large
+// output mid-JSON and still exited 0. Queue an empty chunk and exit from its
+// callback: stream callbacks run in order, so ours fires once every earlier
+// chunk has reached the OS.
+//
+// Use this instead of process.exit() anywhere the command has already written
+// to stdout. See tests/compareStdoutFlush.test.js.
+function exitAfterFlush(code) {
+  process.stdout.write('', () => process.exit(code));
+}
+
+module.exports = exitAfterFlush;