lockfile change report derived

{
  "input": {
    "body": {
      "after": {
        "packages": {
          "": {
            "name": "orders-api",
            "version": "2.2.0"
          },
          "node_modules/cookie": {
            "version": "0.5.0",
            "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
            "integrity": "sha512-TAMPERED"
          },
          "node_modules/router": {
            "version": "2.0.0",
            "resolved": "https://packages.internal.example/router/-/router-2.0.0.tgz",
            "integrity": "sha512-EEEE"
          },
          "node_modules/express": {
            "version": "5.0.0",
            "resolved": "https://registry.npmjs.org/express/-/express-5.0.0.tgz",
            "integrity": "sha512-DDDD"
          }
        },
        "lockfileVersion": 3
      },
      "before": {
        "packages": {
          "": {
            "name": "orders-api",
            "version": "2.1.0"
          },
          "node_modules/cookie": {
            "version": "0.5.0",
            "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
            "integrity": "sha512-BBBB"
          },
          "node_modules/dropped": {
            "version": "1.0.0",
            "resolved": "https://registry.npmjs.org/dropped/-/dropped-1.0.0.tgz",
            "integrity": "sha512-CCCC"
          },
          "node_modules/express": {
            "version": "4.18.2",
            "resolved": "https://registry.npmjs.org/express/-/express-4.18.2.tgz",
            "integrity": "sha512-AAAA"
          }
        },
        "lockfileVersion": 3
      },
      "expected_registry": "https://registry.npmjs.org/"
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxJobs": 200,
        "maxFindings": 500,
        "maxServices": 200,
        "maxResources": 2000,
        "maxVariables": 1000,
        "maxComponents": 5000,
        "maxDependencies": 5000
      },
      "passed": false,
      "changes": [
        {
          "to": null,
          "from": "1.0.0",
          "kind": "removed",
          "name": "dropped"
        },
        {
          "to": "5.0.0",
          "dev": false,
          "from": "4.18.2",
          "kind": "major",
          "name": "express",
          "potentially_breaking": true
        },
        {
          "to": "2.0.0",
          "dev": false,
          "from": null,
          "kind": "added",
          "name": "router"
        }
      ],
      "complete": true,
      "findings": [
        {
          "code": "POTENTIALLY_BREAKING_RESOLUTION",
          "detail": "express resolved from 4.18.2 to 5.0.0, a major change.",
          "dependency": "express"
        },
        {
          "code": "INTEGRITY_CHANGED_WITHOUT_VERSION",
          "detail": "cookie is still 0.5.0 but its integrity hash changed, so the artifact behind an immutable version is not the one that was there before.",
          "dependency": "cookie"
        },
        {
          "code": "PACKAGE_ADDED",
          "detail": "router at 2.0.0 is newly installed.",
          "dependency": "router"
        }
      ],
      "unchanged": false,
      "request_id": "example-request",
      "service_id": "lockfile_change_report",
      "added_count": 1,
      "assumptions": [
        "Packages are keyed by name taken from the install path, so one package appearing at two paths is compared once.",
        "The same version with a different integrity hash means the published artifact changed under a version that was supposed to be immutable, which is reported as the most serious finding available here.",
        "A newly installed transitive package is reported even though no manifest changed, because that is what a lockfile diff exists to show."
      ],
      "limitations": [
        "Lockfile comparison only. No registry is contacted, no integrity hash is verified against an artifact, and no advisory database is consulted, so this is not a vulnerability or supply-chain attestation...",
        "unchanged is true only when both lockfiles were fully read and nothing moved."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [],
      "changed_count": 1,
      "finding_count": 3,
      "removed_count": 1,
      "service_version": "1.0.0",
      "findings_by_code": {
        "PACKAGE_ADDED": 1,
        "POTENTIALLY_BREAKING_RESOLUTION": 1,
        "INTEGRITY_CHANGED_WITHOUT_VERSION": 1
      },
      "after_package_count": 3,
      "before_package_count": 3,
      "registry_change_count": 0,
      "after_lockfile_version": 3,
      "integrity_change_count": 1,
      "before_lockfile_version": 3,
      "potentially_breaking_count": 1
    }
  }
}