capdrift 0.1.0

Show what a Dart package can do, what changed between versions, and whether that change violates your policy.

example/README.md

Example

capdrift.yaml in this directory is a complete, commented policy file. Copy it to your repository root and edit it.

Try the commands

dart pub global activate capdrift

# The reason this package exists: what changed between two versions.
capdrift diff http 1.5.0 1.6.0

# What one version can do.
capdrift inspect dio

# Is this package real, or did an assistant invent the name?
capdrift verify some_package_an_ai_suggested

# Machine-readable, for CI.
capdrift --format json inspect http

Reading the output

Findings are grouped by execution surface, highest risk first. A capability in hook/ runs during your build without anything calling it, so it appears above everything else. A capability in test/ runs only if someone runs that package's own tests, so it is reported but does not fail your build.

Each finding shows its fingerprint, for example:

CF1:PROCESS:HOOK:Process.run:cmake

That reads as: format version 1, process execution family, on the hook surface, via Process.run, with the literal argument cmake. The fingerprint has no file or line in it, which is why moving the code does not show up as a change and swapping cmake for curl does.