# Lockfile Change Report

> Lockfile Change Report is a paid API for AI agents from api.zfinia.com, paid per call via x402, $0.18/call, status unknown (last checked 2026-10-10).

Compare two lockfiles (before/after) to detect transitive dependency changes, version moves, registry changes, and integrity hash mismatches that a manifest diff would miss.

## Facts

- Endpoint: POST https://api.zfinia.com/x402/v1/lockfile-change-report?utm_source=zero.xyz
- Price: $0.18/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/lockfile-change-report-e69f54bf
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_3eWtuhyWfXtpuTq_0hHs5

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability lockfile-change-report-e69f54bf -d '<json body>'
```

Example prompt: Compare these two lockfiles and tell me if any package integrity hashes changed, new transitive dependencies were silently added, or the registry shifted — I want to catch anything a plain manifest diff would miss, and the expected registry is https://registry.npmjs.org.

## When to prefer this

Use this endpoint when you need supply-chain-level lockfile auditing that goes beyond a simple manifest or package.json diff — specifically when you need to catch integrity hash swaps (same version, different artifact), detect silently added transitive packages, identify version resolution changes with breaking potential, or verify registry provenance. Prefer it over generic diff tools when security or compliance requires verifying artifact immutability between lockfile snapshots.

## Known failure modes

- Malformed or unparseable lockfile objects cause validation errors
- Missing 'before' or 'after' fields result in a 400-level error
- Large lockfiles may exceed size or processing limits
- If expected_registry is omitted, registry change detection may be incomplete
- Payment of $0.18 USDC not completed results in x402 payment-required rejection

## How this service works

Compare two lockfiles and report what a manifest diff cannot see. Reports newly installed transitive packages, resolved version moves with breaking risk, a registry that changed, and the most serious finding available here: the same version with a different integrity hash, meaning the artifact behind a version that was supposed to be immutable is not the one that was there before.

## Output

A structured report listing: newly installed transitive packages not visible in the manifest diff, resolved version moves flagged by breaking risk level, any registry that changed relative to the expected registry, and the most critical finding type — same-version packages whose integrity hash differs from before (indicating a potentially swapped artifact behind an immutable version).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "after": {
   "type": "object"
  },
  "before": {
   "type": "object"
  },
  "expected_registry": {
   "type": "string",
   "maxLength": 256
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/lockfile-change-report-e69f54bf/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.zfinia.com](https://www.zero.xyz/host/api.zfinia.com/llms.txt)