{"uid":"cap_3eWtuhyWfXtpuTq_0hHs5","slug":"lockfile-change-report-e69f54bf","name":"Lockfile Change Report","description":"Compare two lockfiles and report what a manifest diff cannot see. Reports newly installed transitive packages, resolved version moves with breaking risk, a registry that changed, and the most serious finding available here: the same version with a different integrity hash, meaning the artifact behind a version that was supposed to be immutable is not the one that was there before.","url":"https://api.zfinia.com/x402/v1/lockfile-change-report?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"after":{"type":"object"},"before":{"type":"object"},"expected_registry":{"type":"string","maxLength":256}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.18","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.18/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.18","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.18","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_yH4e8JyXqgjLirHe2ko8Y","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.18","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Compare two lockfiles (before/after) to detect transitive dependency changes, version moves, registry changes, and integrity hash mismatches that a manifest diff would miss.","exampleAgentPrompt":"Compare these two lockfiles and tell me if any package integrity hashes changed, new transitive dependencies were silently added, or the registry shifted — I want to catch anything a plain manifest diff would miss, and the expected registry is https://registry.npmjs.org.","exampleUseCases":[{"title":"Supply chain tamper detection in CI","prompt":"Before we merge this PR, compare the before and after lockfiles and flag any packages where the integrity hash changed for the same version — I need to know if an artifact was swapped without a version bump."},{"title":"Auditing silent transitive dependency additions","prompt":"Run a lockfile change report on these two lockfiles and list every new transitive package that got pulled in — I only changed one direct dependency but I want to see everything that sneaked in underneath it."},{"title":"Registry drift detection for compliance","prompt":"Check these before and after lockfiles and tell me if the resolved registry changed away from https://registry.npmjs.org — we have a policy that all packages must come from our approved registry and I need to verify nothing drifted."}],"resultDescription":"A structured report listing: newly installed transitive packages not visible in the manifest diff, resolved version moves flagged by breaking risk level, any registry that changed relative to the expected registry, and the most critical finding type — same-version packages whose integrity hash differs from before (indicating a potentially swapped artifact behind an immutable version).","failureModes":["Malformed or unparseable lockfile objects cause validation errors","Missing 'before' or 'after' fields result in a 400-level error","Large lockfiles may exceed size or processing limits","If expected_registry is omitted, registry change detection may be incomplete","Payment of $0.18 USDC not completed results in x402 payment-required rejection"],"whenToPreferThis":"Use this endpoint when you need supply-chain-level lockfile auditing that goes beyond a simple manifest or package.json diff — specifically when you need to catch integrity hash swaps (same version, different artifact), detect silently added transitive packages, identify version resolution changes with breaking potential, or verify registry provenance. Prefer it over generic diff tools when security or compliance requires verifying artifact immutability between lockfile snapshots.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-10T18:44:36.456Z","isFirstParty":false,"canonicalSlug":"lockfile-change-report-e69f54bf"}