@codyswann/lisa 4.71.7 → 4.71.8

package/all/copy-overwrite/scripts/lib/npm-update-hook-installation.mjs

@@ -2,7 +2,7 @@
 // Do not edit directly — durable changes belong upstream in Lisa.
 
 /** Original manager readback preserves installed bytes; dispatch qualification is a separate obligation. */
-import { lstatSync, realpathSync } from "node:fs";
+import { existsSync, lstatSync, realpathSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { keys, required } from "./npm-update-contract.mjs";
 import { readBytes } from "./npm-update-process.mjs";
@@ -114,3 +114,70 @@ export async function originalHookInstallation(cwd, command, authority) {
 export async function originalPrePush(cwd, command, authority) {
   return (await originalHookInstallation(cwd, command, authority)).path;
 }
+
+/** Husky 8 declares its real installer in package metadata; dependency install remains script-disabled. */
+function huskyInstaller(cwd) {
+  const root = join(cwd, "node_modules/husky");
+  const metadata = JSON.parse(
+    readBytes(join(root, "package.json"), 65_536, false)
+  );
+  const bin =
+    typeof metadata.bin === "string" ? metadata.bin : metadata.bin?.husky;
+  required(
+    metadata.name === "husky" &&
+      /^8\.\d+\.\d+$/.test(metadata.version) &&
+      typeof bin === "string" &&
+      /^(?:[A-Za-z0-9_-]+\/)*[A-Za-z0-9_-]+\.js$/.test(bin),
+    "original Husky 8 installer declaration is unsupported"
+  );
+  const path = join(root, bin);
+  required(
+    realpathSync(root) === root &&
+      realpathSync(path) === path &&
+      lstatSync(path).isFile(),
+    "original Husky installer is unavailable or aliased"
+  );
+  return path;
+}
+
+/** The original supported manager installs its own wrappers; no synthetic replacement hook is written. */
+export async function installOriginalManager(context, env, nativeStep) {
+  const lefthook = existsSync(join(context.cwd, "lefthook.yml"));
+  if (lefthook)
+    await nativeStep(context, env, "bundle", ["exec", "lefthook", "install"]);
+  else {
+    required(
+      existsSync(join(context.cwd, ".husky/pre-push")),
+      "original hook manager installation is unavailable"
+    );
+    await nativeStep(context, env, process.execPath, [
+      huskyInstaller(context.cwd),
+      "install",
+    ]);
+  }
+  const git = args => nativeStep(context, env, "/usr/bin/git", args);
+  const result = await git(["rev-parse", "--git-path", "hooks"]);
+  const text = result.stdout.toString();
+  required(
+    text.endsWith("\n") && !/[\n\r\0]/.test(text.slice(0, -1)),
+    "original hook path is unsupported"
+  );
+  const directory = resolve(context.cwd, text.slice(0, -1));
+  const wrappers = {};
+  for (const name of [
+    "pre-commit",
+    "prepare-commit-msg",
+    "commit-msg",
+    "pre-push",
+  ]) {
+    const path = join(directory, name);
+    required(
+      lstatSync(path).isFile() && !lstatSync(path).isSymbolicLink(),
+      "original hook wrapper is missing or aliased"
+    );
+    wrappers[name] = sha256(readFileSync(path));
+  }
+  const installation = { manager: lefthook ? "lefthook" : "husky", wrappers };
+  await originalHookInstallation(context.cwd, git, installation);
+  return installation;
+}

package/all/copy-overwrite/scripts/lib/npm-update-hosted-gate.mjs

@@ -2,28 +2,21 @@
 // Do not edit directly — durable changes belong upstream in Lisa.
 
 /** Supported disposable Actions Linux gates use original native tools; publisher authority stays in another job. */
-import {
-  existsSync,
-  lstatSync,
-  realpathSync,
-  readFileSync,
-  mkdirSync,
-  writeFileSync,
-} from "node:fs";
+import { existsSync, readFileSync, mkdirSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { required } from "./npm-update-contract.mjs";
-import { readBytes, runProcess, writeJson } from "./npm-update-process.mjs";
+import { required, proposalFileNames } from "./npm-update-contract.mjs";
+import { qualifiedBun, frozenBun } from "./npm-update-bun.mjs";
+import { runProcess, writeJson } from "./npm-update-process.mjs";
 import { qualifiedControllerGraph } from "./npm-update-helper.mjs";
 import {
   controllerTools,
   controllerSubject,
 } from "./npm-update-controller-factory.mjs";
 import { startHookReadBroker } from "./npm-update-hook-provider.mjs";
-import { originalHookInstallation } from "./npm-update-hook-installation.mjs";
+import { installOriginalManager } from "./npm-update-hook-installation.mjs";
 import { withStage } from "./npm-update-invariants.mjs";
 import {
-  sha256,
   PROPOSAL_PREDICATE,
   RECOVERY_PREDICATE,
 } from "./github-attestation-verifier.mjs";
@@ -86,6 +79,7 @@ async function installHostedDependencies(context, root, env) {
   const before = [
     "package.json",
     "package-lock.json",
+    ...(context.proposal.bunLockSha256 === undefined ? [] : ["bun.lock"]),
     ...(ruby ? ["Gemfile", "Gemfile.lock"] : []),
   ].map(name => [name, readFileSync(join(context.cwd, name))]);
   await nativeStep(context, installed, "npm", [
@@ -94,6 +88,12 @@ async function installHostedDependencies(context, root, env) {
     "--no-audit",
     "--no-fund",
   ]);
+  if (context.proposal.bunLockSha256 !== undefined) {
+    const bun = await qualifiedBun(installed, { deadline: context.deadline });
+    await frozenBun(bun, context.cwd, proposalFileNames(context.proposal), {
+      timeout: remainingGateTime(context.deadline),
+    });
+  }
   if (ruby)
     await nativeStep(context, installed, "bundle", [
       "install",
@@ -111,73 +111,6 @@ async function installHostedDependencies(context, root, env) {
   return installed;
 }
 
-/** Husky 8 declares its real installer in package metadata; dependency install remains script-disabled. */
-function huskyInstaller(cwd) {
-  const root = join(cwd, "node_modules/husky");
-  const metadata = JSON.parse(
-    readBytes(join(root, "package.json"), 65_536, false)
-  );
-  const bin =
-    typeof metadata.bin === "string" ? metadata.bin : metadata.bin?.husky;
-  required(
-    metadata.name === "husky" &&
-      /^8\.\d+\.\d+$/.test(metadata.version) &&
-      typeof bin === "string" &&
-      /^(?:[A-Za-z0-9_-]+\/)*[A-Za-z0-9_-]+\.js$/.test(bin),
-    "original Husky 8 installer declaration is unsupported"
-  );
-  const path = join(root, bin);
-  required(
-    realpathSync(root) === root &&
-      realpathSync(path) === path &&
-      lstatSync(path).isFile(),
-    "original Husky installer is unavailable or aliased"
-  );
-  return path;
-}
-
-/** The original supported manager installs its own wrappers; no synthetic replacement hook is written. */
-async function installOriginalManager(context, env) {
-  const lefthook = existsSync(join(context.cwd, "lefthook.yml"));
-  if (lefthook)
-    await nativeStep(context, env, "bundle", ["exec", "lefthook", "install"]);
-  else {
-    required(
-      existsSync(join(context.cwd, ".husky/pre-push")),
-      "original hook manager installation is unavailable"
-    );
-    await nativeStep(context, env, process.execPath, [
-      huskyInstaller(context.cwd),
-      "install",
-    ]);
-  }
-  const git = args => nativeStep(context, env, "/usr/bin/git", args);
-  const result = await git(["rev-parse", "--git-path", "hooks"]);
-  const text = result.stdout.toString();
-  required(
-    text.endsWith("\n") && !/[\n\r\0]/.test(text.slice(0, -1)),
-    "original hook path is unsupported"
-  );
-  const directory = resolve(context.cwd, text.slice(0, -1));
-  const wrappers = {};
-  for (const name of [
-    "pre-commit",
-    "prepare-commit-msg",
-    "commit-msg",
-    "pre-push",
-  ]) {
-    const path = join(directory, name);
-    required(
-      lstatSync(path).isFile() && !lstatSync(path).isSymbolicLink(),
-      "original hook wrapper is missing or aliased"
-    );
-    wrappers[name] = sha256(readFileSync(path));
-  }
-  const installation = { manager: lefthook ? "lefthook" : "husky", wrappers };
-  await originalHookInstallation(context.cwd, git, installation);
-  return installation;
-}
-
 /** Proof paths are the actual fixed slots installed for the unchanged canonical verifier. */
 async function proofScope(context, env) {
   const result = await nativeStep(context, env, "/usr/bin/git", [
@@ -276,7 +209,7 @@ export async function createHostedGate(context, root, env) {
     installHostedDependencies(context, root, env)
   );
   const installation = await withStage("gate-hooks", () =>
-    installOriginalManager(context, installed)
+    installOriginalManager(context, installed, nativeStep)
   );
   const scope = await withStage("gate-scope", () =>
     proofScope(context, installed)

package/all/copy-overwrite/scripts/lib/npm-update-leaf-contract.mjs

@@ -78,6 +78,7 @@ export function buildDraft(proposal, policy, config, evidence) {
   const versions = proposal.updates
     .map(update => `${update.name}: ${update.from} -> ${update.to}`)
     .join("\n");
+  const bun = Object.hasOwn(proposal, "bunLockSha256");
   const body = `## Context / Business Value
 
 Keep the selected dependencies current while preserving ordinary review, required checks and runtime verification. This Task owns one exact dependency proposal; its implementation ticket is never reused for another update.
@@ -87,7 +88,7 @@ Keep the selected dependencies current while preserving ordinary review, require
 Base parent: ${proposal.parent}
 Proposal key: ${proposal.key}
 Selection key: ${proposal.selectionKey}
-Update exactly package.json and package-lock.json:
+Update exactly package.json and package-lock.json${bun ? " and bun.lock" : ""}:
 ${versions}
 Use the trusted four-job npm updater. Preparation performs an installed-tree npm outdated check and npm ci with lifecycle scripts disabled. Allocation precedes the first attributed commit. Ordinary commit and original pre-push gates remain mandatory. Publish only the exact gated unsigned raw Git object with unchanged parent, tree, identities, times and message. Preserve every unrelated dependency, script and existing assignee. Stop on stale base, unavailable authorization, hold, failed gate or mismatching bytes. Lisa is excluded only with verified local full-apply ownership.
 
@@ -97,8 +98,8 @@ Use the trusted four-job npm updater. Preparation performs an installed-tree npm
 Scenario: publish one coherent dependency proposal
   Given parent ${proposal.parent} and the selected versions above
   When the trusted updater claims this leaf and completes ordinary gates
-  Then the manifest and lock agree and npm ci preserves both file hashes
-  And the pull request into main contains exactly the gated commit and two files
+  Then the manifest and lock agree and npm ci preserves both file hashes${bun ? " and frozen Bun preserves all three hashes" : ""}
+  And the pull request into main contains exactly the gated commit and ${bun ? "three" : "two"} files
 Scenario: refuse unauthorized or stale publication
   Given a hold, changed parent, failed gate or mismatching proposal
   When publication is attempted
@@ -147,7 +148,7 @@ Matches are read completely before allocating this deterministic proposal. No pa
 ## Validation Journey
 
 1. Prepare the selected update from the exact parent with installed npm outdated; record actual exit and versions. [EVIDENCE: cli-output: npm-outdated]
-2. Run script-disabled npm ci against the proposed files and record unchanged hashes. [EVIDENCE: cli-output: npm-ci]
+2. Run script-disabled npm ci${bun ? " and Bun1.3.8 frozen installation" : ""} against the proposed files and record unchanged hashes. [EVIDENCE: cli-output: npm-ci]
 3. Record normal commit/pre-push hook exits, all-ref stdin/ranges and the exact raw commit identity. [EVIDENCE: test-run-log: ordinary-gates]
 4. Read the current-head pull request, required checks and genuine human approval. [EVIDENCE: state-dump: current-head-review]
 5. Verify ordinary application behavior in ${env}; record actual environment and deployed identity. [EVIDENCE: test-run-log: runtime-verification]
@@ -156,7 +157,7 @@ Matches are read completely before allocating this deterministic proposal. No pa
 ## Proposal Bytes
 
 package.json SHA256: ${proposal.hashes["package.json"]}
-package-lock.json SHA256: ${proposal.hashes["package-lock.json"]}
+package-lock.json SHA256: ${proposal.hashes["package-lock.json"]}${bun ? `\nbun.lock SHA256: ${proposal.hashes["bun.lock"]}\nOriginal bun.lock SHA256: ${proposal.bunLockSha256}` : ""}
 
 <!-- [lisa-npm-filing] ${Buffer.from(canonicalJson(evidence)).toString("base64")} -->
 <!-- [lisa-npm-proposal] ${proposal.key} -->

package/all/copy-overwrite/scripts/lib/npm-update-prepare.mjs

@@ -22,6 +22,7 @@ import {
   validateHost,
   validateLock,
   proposalFrom,
+  proposalFileNames,
 } from "./npm-update-contract.mjs";
 import {
   runProcess,
@@ -33,6 +34,7 @@ import { canonicalJson } from "../lisa-automation-provenance.mjs";
 import { qualifyLisaOwner } from "./npm-update-owner.mjs";
 export { qualifyLisaOwner } from "./npm-update-owner.mjs";
 import { sha256 } from "./github-attestation-verifier.mjs";
+import { committedBun, qualifiedBun, frozenBun } from "./npm-update-bun.mjs";
 
 const NPM_FLAGS = ["--ignore-scripts", "--no-audit", "--no-fund"];
 
@@ -71,6 +73,8 @@ export async function baseline(cwd, env, proposal) {
       "utf8"
     );
   }
+  const bun = await committedBun(cwd, command, proposal);
+  if (bun !== undefined) files["bun.lock"] = bun;
   if (proposal)
     required(
       parent === proposal.parent &&
@@ -146,7 +150,7 @@ async function installUpdates(updates, npm, npmFlags) {
   }
 }
 
-/** Build only a two-file proposal in a private HOME, never executing repository scripts. */
+/** Preserve the exact original lock cohort in a private HOME without repository scripts. */
 async function preparedProposal({
   app,
   npm,
@@ -158,29 +162,47 @@ async function preparedProposal({
   version,
   outdated,
   installedBefore,
+  bun,
 }) {
   await installUpdates(updates, npm, npmFlags);
+  const names = Object.keys(original.files).sort();
+  if (bun)
+    await bun(
+      [
+        "install",
+        "--lockfile-only",
+        "--ignore-scripts",
+        "--registry",
+        "https://registry.npmjs.org/",
+      ],
+      { cwd: app }
+    );
   const files = Object.fromEntries(
-    FILES.map(file => [file, readFileSync(join(app, file), "utf8")])
+    names.map(file => [file, readFileSync(join(app, file), "utf8")])
   );
   const proposal = proposalFrom(
     policy,
     original.parent,
     before,
     files,
-    updates
+    updates,
+    bun ? sha256(original.files["bun.lock"]) : undefined
   );
   const hashes = Object.fromEntries(
-    FILES.map(file => [file, sha256(readFileSync(join(app, file)))])
+    proposalFileNames(proposal).map(file => [
+      file,
+      sha256(readFileSync(join(app, file))),
+    ])
   );
   await npm(["ci", ...npmFlags]);
+  if (bun) await frozenBun(bun, app, names);
   required(
-    FILES.every(file => hashes[file] === sha256(readFileSync(join(app, file)))),
+    names.every(file => hashes[file] === sha256(readFileSync(join(app, file)))),
     "npm ci rewrote manifest or lock"
   );
   required(
     readdirSync(app).sort().join("\n") ===
-      ["node_modules", ...FILES].sort().join("\n"),
+      ["node_modules", ...names].sort().join("\n"),
     "unexpected npm output path or lifecycle effect"
   );
   return {
@@ -224,11 +246,16 @@ export async function prepareUpdate({ cwd, policy: input, config }) {
     );
     await qualifyLisaOwner(cwd, before, policy, config, engineStrict);
     validateLock(JSON.parse(original.files["package-lock.json"]), before, []);
-    for (const file of FILES)
+    for (const file of Object.keys(original.files))
       writeFileSync(join(app, file), original.files[file], { mode: 0o600 });
+    const bun =
+      original.files["bun.lock"] === undefined
+        ? undefined
+        : await qualifiedBun(env);
     const npm = (args, allowed = [0]) =>
       runNpm(args, { cwd: app, env, timeout: 120_000, allowed });
     await npm(["ci", ...npmFlags]);
+    if (bun) await frozenBun(bun, app, Object.keys(original.files));
     const installedBefore = installedVersions(app, policy.packages);
     const outdated = await npm(["outdated", "--json", "--long"], [0, 1]);
     const detected = JSON.parse(outdated.stdout.toString() || "{}");
@@ -256,6 +283,7 @@ export async function prepareUpdate({ cwd, policy: input, config }) {
       version,
       outdated,
       installedBefore,
+      bun,
     });
   });
   required(!existsSync(privatePath), "private npm resources remain");

package/all/copy-overwrite/scripts/lib/npm-update-publish.mjs

@@ -127,7 +127,7 @@ export async function publishDestination({
   };
 }
 
-/** The publisher consumes signed/gated data and writes only an identical two-file commit. */
+/** The publisher consumes signed/gated data and writes only the identical original lock cohort. */
 export async function publishProposal({
   api,
   proposal,

package/all/copy-overwrite/scripts/npm-updater-helper-graph.json

@@ -20,7 +20,7 @@
   },
   "members": {
     "check-threshold-ratchet.mjs": {
-      "sha256": "5806cdc3c80757100f0cd24a8cbd3c581f9a381a925f9ebdd1f4d79881e5de2a",
+      "sha256": "d4afc90ba8faf10925fff5fb0d6cd0ace22df2eaa0ec609ee969d0ec84092299",
       "staticImports": [
         "node:child_process",
         "node:fs",
@@ -33,17 +33,27 @@
       "children": []
     },
     "lib/automation-provenance-contract.mjs": {
-      "sha256": "69dba85e2a57e1b89f6dfb9dc98a253d2e5317c9d000eeafc6bbd1649e740bd3",
+      "sha256": "b12e64711bf05c357d0cfebfda90540dcac413d34de9c6f2405fe0ad37d137dc",
       "staticImports": [
         "lib/github-attestation-verifier.mjs"
       ],
       "dynamicImports": [],
       "children": []
     },
+    "lib/automation-provenance-files.mjs": {
+      "sha256": "5c3b2a88669e3e187c123850798e3dfafb3c078b6b25aa00da0ba93db03424c9",
+      "staticImports": [
+        "lib/github-attestation-verifier.mjs",
+        "node:fs"
+      ],
+      "dynamicImports": [],
+      "children": []
+    },
     "lib/automation-provenance-local.mjs": {
-      "sha256": "78f660ae1567b8254536323e547f1b8d806837fa554d580db84c5d69603cab0a",
+      "sha256": "e36147aef8b725147a26322b689e0fcef3c7cb5ae36f32e483a3da59667e3592",
       "staticImports": [
         "lib/automation-provenance-contract.mjs",
+        "lib/automation-provenance-files.mjs",
         "lib/bounded-spawn.mjs",
         "lib/github-attestation-verifier.mjs",
         "lisa-work-item.mjs",
@@ -176,7 +186,7 @@
       "children": []
     },
     "lib/npm-update-allocate.mjs": {
-      "sha256": "c35a8c44bf67e4afb2849f2ea41948e190f1b108b35db25b38418478a3227e36",
+      "sha256": "85de2576d1c5e954b57f1c9274dbc34d0d24689fbc0964d8f86ec4f91f52b7bc",
       "staticImports": [
         "lib/github-attestation-verifier.mjs",
         "lib/npm-update-contract.mjs",
@@ -221,8 +231,22 @@
       "dynamicImports": [],
       "children": []
     },
+    "lib/npm-update-bun.mjs": {
+      "sha256": "898cdafe2e119b9c3004ea55ae222d2f33d8b668020cda09e90184474055a676",
+      "staticImports": [
+        "lib/automation-provenance-contract.mjs",
+        "lib/github-attestation-verifier.mjs",
+        "lib/npm-update-invariants.mjs",
+        "lib/npm-update-process-core.mjs",
+        "lib/npm-update-worker-lifecycle.mjs",
+        "node:fs",
+        "node:path"
+      ],
+      "dynamicImports": [],
+      "children": []
+    },
     "lib/npm-update-cancel-origin.mjs": {
-      "sha256": "331554c8d2201fb6fe6934d158f5f60d7da11bbb1d4aa938ef9437afe724b5ff",
+      "sha256": "635dd82d23042337d68e441b43cec26c171fef9ac57c7e9c5de14af0587d7e43",
       "staticImports": [
         "lib/automation-provenance-contract.mjs",
         "lib/github-attestation-provider.mjs",
@@ -240,7 +264,7 @@
       "children": []
     },
     "lib/npm-update-cancellation-proof.mjs": {
-      "sha256": "56365dbe20ef540b8a3d59a3ce9e0fa33c9c4efdfb27c2b69e27cbe60b2ba204",
+      "sha256": "9262c81836683572d1135112b8cfd0f43abcb050c9f8d84ef7dfb77b8caac59c",
       "staticImports": [
         "lib/github-attestation-verifier.mjs",
         "lib/npm-update-contract.mjs",
@@ -289,8 +313,9 @@
       "children": []
     },
     "lib/npm-update-contract.mjs": {
-      "sha256": "6905dd9d5747702ab502b66bcb38b6d4dcb30127f02466d29b3905f53c27981d",
+      "sha256": "d8e7e94d7b33d0088ea01d32d659f00408487465f7d857a64daa1b09b16fcd8c",
       "staticImports": [
+        "lib/automation-provenance-contract.mjs",
         "lib/github-attestation-verifier.mjs",
         "lib/npm-update-invariants.mjs",
         "lib/npm-update-object.mjs",
@@ -411,7 +436,7 @@
       "children": []
     },
     "lib/npm-update-gate.mjs": {
-      "sha256": "bb6b6b8ea1e3620ee0b1b620e50331788bc99b44f431057e12a60cd138e56bc4",
+      "sha256": "3d53ff811b0cce52fb4b33dbfb48c54e928b58fffa5b8ca67569f1bcd35aea45",
       "staticImports": [
         "lib/github-attestation-verifier.mjs",
         "lib/npm-update-contract.mjs",
@@ -467,7 +492,7 @@
       "children": []
     },
     "lib/npm-update-github.mjs": {
-      "sha256": "5026c943e0ce87318a713806c1d609022d9818cd51a04b444b95285aa5aeadf8",
+      "sha256": "2be34eca5ceb38cc535fac6ca0a655e14993231cd37b1a3e26ea09756042c488",
       "staticImports": [
         "lib/github-attestation-verifier.mjs",
         "lib/npm-update-contract.mjs",
@@ -480,7 +505,7 @@
       "children": []
     },
     "lib/npm-update-helper-inventory.mjs": {
-      "sha256": "3561c20458d74eff34650d6b4366f4f03ed4e7825ae886ea78394f63f98a18bb",
+      "sha256": "647c83dc72c21c4d68e27679e9f3b35b4b541bd8957c779495f78392d099cdd9",
       "staticImports": [],
       "dynamicImports": [],
       "children": []
@@ -506,7 +531,7 @@
       "children": []
     },
     "lib/npm-update-hook-installation.mjs": {
-      "sha256": "83c4503b12ae53cb894f0d03d31d9cce8c23efec56d27f7a8252120fc5ea6c47",
+      "sha256": "af3cf29c76f583a7e18b974d2862f5fc273ac0f13c36bd28c284bcd0d480d045",
       "staticImports": [
         "lib/github-attestation-verifier.mjs",
         "lib/npm-update-contract.mjs",
@@ -559,9 +584,10 @@
       "children": []
     },
     "lib/npm-update-hosted-gate.mjs": {
-      "sha256": "b6adf8af72067f883c83e11b7465a3f4c219a6e78d98b029b1af489967ccbaa8",
+      "sha256": "4d6635ec26435e642dc08de27d21eff033962f1508307e12c78a9c7c4cc12425",
       "staticImports": [
         "lib/github-attestation-verifier.mjs",
+        "lib/npm-update-bun.mjs",
         "lib/npm-update-contract.mjs",
         "lib/npm-update-controller-factory.mjs",
         "lib/npm-update-helper.mjs",
@@ -611,7 +637,7 @@
       "children": []
     },
     "lib/npm-update-leaf-contract.mjs": {
-      "sha256": "1686c41dd54accb8e52595cbe66b0780878c2dc9eba3436b574d869bcfe93110",
+      "sha256": "9a68e50c354cac20fec847e02668c153f0f3c5783faaa29f51f2b4adf93ba99a",
       "staticImports": [
         "lib/npm-update-contract.mjs",
         "lisa-automation-provenance.mjs",
@@ -703,9 +729,10 @@
       "children": []
     },
     "lib/npm-update-prepare.mjs": {
-      "sha256": "dcd25565c5139c788f91f695bacf3af5e95a564be66382b9d42af418e19d8aca",
+      "sha256": "66520d441ba6413cf189016f35f3babdc3b5d29f962b01cede0846aa924edf26",
       "staticImports": [
         "lib/github-attestation-verifier.mjs",
+        "lib/npm-update-bun.mjs",
         "lib/npm-update-contract.mjs",
         "lib/npm-update-owner.mjs",
         "lib/npm-update-process.mjs",
@@ -755,7 +782,7 @@
       "children": []
     },
     "lib/npm-update-publish.mjs": {
-      "sha256": "6dd2cc1e6fcb09c8237798bf08a392035e5a85f0de74fc4ca8777164fa5ce69a",
+      "sha256": "781d1abe61cc0ec991f0ca299e8fbbc84cf9b5bf4b541de8954904218b83b007",
       "staticImports": [
         "lib/npm-update-authorization.mjs",
         "lib/npm-update-contract.mjs",
@@ -1147,7 +1174,7 @@
       "children": []
     },
     "threshold-ratchet-compare.mjs": {
-      "sha256": "99a97f830b1ee3388e8714602a4a3f188387c0389ac9d2a7b4b898f20f39a7a7",
+      "sha256": "761a0f32ab4bc138b3ed216f0edc9ad28c36783ccd3b62fbd57ef1b7fdc32681",
       "staticImports": [
         "threshold-ratchet-families.mjs"
       ],