Your TypeScript still compiles. The API assumption underneath it changed.

[bm1016bm-svg]

Your TypeScript still compiles. The dependency contract underneath it no longer says the same thing.

This is the uncomfortable API-drift case: the application file does not change, the existing call remains type-correct, and tsc --noEmit exits 0. But an external assumption used to write or review that code has become false.

Reproduce it

npx --yes evidrift@0.3.1 demo

No account, API key, cloud service, package-code execution, or LLM verdict is involved. The command creates a marked disposable workspace under .evidrift-demo/signature-drift.

The dependency contract before the drift

The local fixture package exposes this declaration:

export interface ParseOptions { strict?: boolean; }
export interface ParseResult { value: string; }

export declare function parseConfig(
  input: string,
  options?: ParseOptions,
): ParseResult;

The consuming application already supplies options:

import { parseConfig } from '@evidrift/demo-contract';

const options = { strict: true } as const;
export const parsed = parseConfig('demo', options);

Because the call passes the second argument, it remains valid whether that parameter is optional or required.

What gets recorded

Evidrift records the concrete installed declaration, package version, resolved declaration path, affected call site, normalized signature, and signature hash. The claim in this fixture is deliberately narrow:

parseConfig accepts the optional options parameter used by this demo.

The first check recomputes the declaration and passes:

PASS sha256:01c766cf…
Expected signature: parseConfig(input:string,options?:ParseOptions):ParseResult
Current signature:  parseConfig(input:string,options?:ParseOptions):ParseResult
Affected code location: app/src/index.ts:3
Summary: 1 pass, 0 warning, 0 fail

The dependency changes, but the consumer does not

The fixture then changes only its declaration:

 export declare function parseConfig(
   input: string,
-  options?: ParseOptions,
+  options: ParseOptions,
 ): ParseResult;

The application still passes options, so the drifted workspace continues to compile. I reran the public evidrift@0.3.1 package against this fixture and then invoked tsc --noEmit --strict; TypeScript exited 0 on 2026-07-17.

That does not mean the external contract is unchanged. The parameter is no longer optional. A future call, generated branch, test fixture, or coding agent that relies on the earlier optionality now has stale evidence.

What CI sees

evidrift check reloads the source and recomputes the signature instead of trusting a stored matched or verified flag:

FAIL contract_mismatch sha256:01c766cf…
Message: Deterministic TypeScript contract mismatch:
Previously recorded TypeScript signature was not found.
Claim: parseConfig accepts the optional options parameter used by this demo.
Expected signature: parseConfig(input:string,options?:ParseOptions):ParseResult
Current signature: parseConfig(input:string,options:ParseOptions):ParseResult
Affected code location: app/src/index.ts:3
Action: Review the dependency change and affected code, then intentionally record new evidence.
Summary: 0 pass, 0 warning, 1 fail

The result is deterministic: the selected normalized signature changed, so the check exits 1. No semantic similarity score and no LLM judge is involved.

Why this matters

• The consumer diff can be empty while an installed dependency declaration changes.
• TypeScript proves that this particular call is currently type-correct; it does not preserve the historical assumption that the parameter was optional.
• Code review and general static analysis usually focus on the code being changed, not the external reason an earlier line was considered safe.
• The Receipt gives CI a specific old contract, current contract, affected file, and content-addressed ID to hand back to a developer or coding agent.

What to do after the failure

Do not blindly regenerate the Receipt.

1. Read the dependency changelog and confirm whether the signature change was intentional.
2. Review the affected call and any paths that may omit options.
3. Update code, tests, and the written claim if the new contract is accepted.
4. Run evidrift record intentionally to create new evidence.

Honest boundary

Evidrift does not prove runtime correctness, compatibility with every call site, or that the dependency change is bad. It proves a smaller, useful fact: the deterministic external contract recorded for this line is no longer the contract currently installed.

Links

• Evidrift v0.3.1 release
• v0.3.1 changelog
• Install from npm: npm install --save-dev evidrift@0.3.1
• Full captured CLI transcript
• Source code