ast-mcp-server 0.7.2 → 0.8.1

package/dist/services/skill-installer.js

@@ -1,127 +1,188 @@
-import { randomUUID } from "node:crypto";
-import { link, mkdir, readFile, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
+import { readFile, realpath, stat } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import { z } from "zod";
+import { applyManagedFilePlan, canonicalizeFuturePath, captureManagedFileSnapshot, createManagedFileApplyContext, hashBytes, verifyManagedFilePostimage, } from "./managed-file.js";
 const SKILL_NAME = "structural-code-editing";
+const SHA256_PATTERN = /^[0-9a-f]{64}$/;
+const ReleaseRecordSchema = z
+    .object({
+    version: z.string().min(1),
+    sha256: z.string().regex(SHA256_PATTERN),
+    npm_versions: z.array(z.string().min(1)).min(1),
+})
+    .strict();
+const SkillReleaseManifestSchema = z
+    .object({
+    schema_version: z.literal(1),
+    algorithm: z.literal("sha256"),
+    current: z
+        .object({
+        version: z.string().min(1),
+        sha256: z.string().regex(SHA256_PATTERN),
+    })
+        .strict(),
+    predecessors: z.array(ReleaseRecordSchema),
+})
+    .strict();
 export class SkillConflictError extends Error {
     destination;
     constructor(destination) {
         super(`Skill already exists with different content at ${destination}; pass --force to replace it.`);
-        this.name = "SkillConflictError";
         this.destination = destination;
+        this.name = "SkillConflictError";
     }
 }
+export async function resolveBundledSkillAssets(executablePath) {
+    const root = path.resolve(path.dirname(await realpath(executablePath)), "..", "skills", SKILL_NAME);
+    const assets = {
+        skillPath: path.join(root, "SKILL.md"),
+        guidancePath: path.join(root, "guidance.md"),
+        releasesPath: path.join(root, "releases.json"),
+    };
+    for (const [label, filePath] of Object.entries(assets)) {
+        const info = await stat(filePath).catch(() => undefined);
+        if (!info?.isFile())
+            throw new Error(`Bundled ${label} is missing or not a regular file: ${filePath}`);
+    }
+    return assets;
+}
 export async function resolveBundledSkillPath(executablePath) {
-    const resolvedExecutable = await realpath(executablePath);
-    return path.resolve(path.dirname(resolvedExecutable), "..", "skills", SKILL_NAME, "SKILL.md");
+    return (await resolveBundledSkillAssets(executablePath)).skillPath;
 }
-function resolveConfiguredDirectory(configured, fallback, workingDirectory) {
-    return path.resolve(workingDirectory, configured ?? fallback);
+function configured(value, fallback, cwd) {
+    return path.resolve(cwd, value ?? fallback);
 }
-async function resolveDestinationPlans(options) {
-    if (options.scope === "project" && options.target !== "claude") {
+async function destinations(options) {
+    const targets = options.target === "all"
+        ? ["claude", "hermes"]
+        : Array.isArray(options.target)
+            ? [...options.target]
+            : [options.target];
+    if (options.scope === "project" && targets.some((target) => target !== "claude"))
         throw new Error("Project scope is supported only for Claude Code skills.");
-    }
-    const homeDirectory = options.homeDirectory ?? os.homedir();
-    const workingDirectory = options.workingDirectory ?? process.cwd();
-    const environment = options.environment ?? process.env;
-    const targets = options.target === "all" ? ["claude", "hermes"] : [options.target];
+    const home = options.homeDirectory ?? os.homedir();
+    const cwd = options.workingDirectory ?? process.cwd();
+    const env = options.environment ?? process.env;
     let projectRoot;
     if (options.scope === "project") {
-        projectRoot = path.resolve(workingDirectory, options.projectRoot ?? workingDirectory);
-        const projectStats = await stat(projectRoot).catch((error) => {
-            if (error.code === "ENOENT") {
-                throw new Error(`Project root does not exist: ${projectRoot}`);
-            }
-            throw error;
-        });
-        if (!projectStats.isDirectory()) {
-            throw new Error(`Project root is not a directory: ${projectRoot}`);
-        }
+        projectRoot = path.resolve(cwd, options.projectRoot ?? cwd);
+        const info = await stat(projectRoot).catch(() => undefined);
+        if (!info?.isDirectory())
+            throw new Error(`Project root does not exist or is not a directory: ${projectRoot}`);
     }
-    return targets.map((target) => {
+    const result = targets.map((target) => {
+        let destination;
         if (target === "claude") {
             const root = options.scope === "project"
                 ? path.join(projectRoot, ".claude")
-                : resolveConfiguredDirectory(environment.CLAUDE_CONFIG_DIR, path.join(homeDirectory, ".claude"), workingDirectory);
-            return {
-                target,
-                scope: options.scope,
-                path: path.join(root, "skills", SKILL_NAME, "SKILL.md"),
-            };
+                : configured(env.CLAUDE_CONFIG_DIR, path.join(home, ".claude"), cwd);
+            destination = path.join(root, "skills", SKILL_NAME, "SKILL.md");
+        }
+        else if (target === "hermes") {
+            destination = path.join(configured(env.HERMES_HOME, path.join(home, ".hermes"), cwd), "skills", "software-development", SKILL_NAME, "SKILL.md");
+        }
+        else {
+            destination = path.join(home, ".agents", "skills", SKILL_NAME, "SKILL.md");
         }
-        const hermesHome = resolveConfiguredDirectory(environment.HERMES_HOME, path.join(homeDirectory, ".hermes"), workingDirectory);
         return {
             target,
-            scope: "user",
-            path: path.join(hermesHome, "skills", "software-development", SKILL_NAME, "SKILL.md"),
+            scope: target === "claude" ? options.scope : "user",
+            path: destination,
         };
     });
+    return Promise.all(result.map(async (item) => ({ ...item, path: await canonicalizeFuturePath(item.path) })));
 }
-async function classifyDestination(destination, sourceContent, force) {
+async function readReleaseManifest(manifestPath) {
+    let parsed;
     try {
-        const existingContent = await readFile(destination, "utf8");
-        if (existingContent === sourceContent)
-            return "unchanged";
-        if (!force) {
-            throw new SkillConflictError(destination);
-        }
-        return "updated";
+        parsed = JSON.parse(await readFile(manifestPath, "utf8"));
     }
     catch (error) {
-        if (error.code === "ENOENT")
-            return "installed";
-        throw error;
+        throw new Error(`Skill release manifest is unreadable or invalid JSON: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+    const result = SkillReleaseManifestSchema.safeParse(parsed);
+    if (!result.success) {
+        throw new Error(`Skill release manifest is invalid: ${result.error.issues[0]?.message ?? "unknown error"}`);
+    }
+    const digests = [
+        result.data.current.sha256,
+        ...result.data.predecessors.map((item) => item.sha256),
+    ];
+    if (new Set(digests).size !== digests.length) {
+        throw new Error("Skill release manifest contains a duplicate digest.");
     }
+    const predecessorVersions = result.data.predecessors.flatMap((item) => item.npm_versions);
+    if (new Set(predecessorVersions).size !== predecessorVersions.length) {
+        throw new Error("Skill release manifest contains a duplicate npm version provenance entry.");
+    }
+    return result.data;
 }
-async function writeSkill(destination, sourceContent, status) {
-    if (status === "unchanged")
-        return;
-    const directory = path.dirname(destination);
-    await mkdir(directory, { recursive: true });
-    const temporaryPath = path.join(directory, `.${path.basename(destination)}.${process.pid}.${randomUUID()}.tmp`);
-    await writeFile(temporaryPath, sourceContent, {
-        encoding: "utf8",
-        flag: "wx",
-        mode: 0o644,
-    });
-    try {
-        if (status === "installed") {
-            await link(temporaryPath, destination).catch((error) => {
-                if (error.code === "EEXIST") {
-                    throw new Error(`Skill appeared concurrently at ${destination}; no files were replaced.`);
-                }
-                throw error;
-            });
-            await rm(temporaryPath);
-            return;
-        }
-        await rename(temporaryPath, destination);
+export async function planBundledSkillInstallation(options) {
+    const sourcePath = path.resolve(options.sourceSkillPath);
+    const source = await readFile(sourcePath);
+    const sourceDigest = hashBytes(source);
+    const manifestPath = path.resolve(options.releaseManifestPath ?? path.join(path.dirname(sourcePath), "releases.json"));
+    const manifest = await readReleaseManifest(manifestPath);
+    if (sourceDigest !== manifest.current.sha256) {
+        throw new Error(`Skill release manifest current digest does not match source skill bytes: ${sourcePath}`);
     }
-    finally {
-        await rm(temporaryPath, { force: true });
+    const admittedPredecessors = new Set(manifest.predecessors.map((item) => item.sha256));
+    const logical = await destinations(options);
+    const filesByPath = new Map();
+    for (const item of logical) {
+        if (filesByPath.has(item.path))
+            continue;
+        const snapshot = await captureManagedFileSnapshot(item.path);
+        let status;
+        if (!snapshot.exists)
+            status = "installed";
+        else if (snapshot.sha256 === sourceDigest)
+            status = "unchanged";
+        else if (admittedPredecessors.has(snapshot.sha256) || options.force === true)
+            status = "updated";
+        else
+            throw new SkillConflictError(item.path);
+        filesByPath.set(item.path, {
+            path: item.path,
+            snapshot,
+            postimage: source,
+            postimageSha256: sourceDigest,
+            status,
+        });
     }
+    return {
+        installations: logical.map((item) => ({
+            ...item,
+            status: filesByPath.get(item.path).status,
+        })),
+        files: [...filesByPath.values()],
+    };
 }
-export async function installBundledSkill(options) {
-    const sourceContent = await readFile(path.resolve(options.sourceSkillPath), "utf8");
-    const destinations = await resolveDestinationPlans(options);
-    const force = options.force ?? false;
-    const statusByPath = new Map();
-    for (const destination of destinations) {
-        if (!statusByPath.has(destination.path)) {
-            statusByPath.set(destination.path, await classifyDestination(destination.path, sourceContent, force));
+export async function applySkillInstallationPlan(plan, onApplied, context = createManagedFileApplyContext()) {
+    const authenticated = [];
+    for (const file of plan.files) {
+        for (const current of authenticated) {
+            await verifyManagedFilePostimage(current, context);
         }
+        await applyManagedFilePlan(file, context);
+        authenticated.push(file);
+        await onApplied?.(file);
     }
-    for (const [destination, status] of statusByPath) {
-        await writeSkill(destination, sourceContent, status);
+    for (const current of authenticated) {
+        await verifyManagedFilePostimage(current, context);
     }
+}
+export async function installBundledSkill(options) {
+    const plan = await planBundledSkillInstallation(options);
+    await applySkillInstallationPlan(plan);
     return {
         version: 1,
         status: "ok",
         skill: SKILL_NAME,
-        installations: destinations.map((destination) => ({
-            ...destination,
-            status: statusByPath.get(destination.path),
-        })),
+        installations: plan.installations,
+        physicalWrites: plan.files
+            .filter((file) => file.status !== "unchanged")
+            .map((file) => ({ path: file.path, status: file.status })),
     };
 }

package/docs/support.md

@@ -1,21 +1,21 @@
 # Support policy
 
-This document defines the supported platform, runtime, persistence, and operational boundary for `ast-mcp-server` v0.7.2.
+This document defines the supported platform, runtime, persistence, and operational boundary for `ast-mcp-server` v0.8.1 and the current `Unreleased` development line.
 
 ## Supported release target
 
-| Environment                                                         | Status      | Contract                                                                                                                                        |
-| ------------------------------------------------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
-| Linux x64 with required GNU coreutils, Node.js 22.5.0               | Supported   | Full repository, MCP/CLI/package, lifecycle, mutation, and production-readiness gates. Persistence canary runs require `--experimental-sqlite`. |
-| Linux x64 with required GNU coreutils, current Node.js 24 line      | Supported   | Full repository, MCP/CLI/package, lifecycle, mutation, and production-readiness gates.                                                          |
-| Other Linux architectures or systems without required GNU coreutils | Unverified  | Not supported until equivalent architecture and filesystem-publication gates pass.                                                              |
-| macOS                                                               | Unverified  | Not supported until equivalent filesystem, process, package, mutation, and canary gates pass.                                                   |
-| Windows                                                             | Unverified  | Not supported until equivalent filesystem, process, package, mutation, and canary gates pass.                                                   |
-| Remote, untrusted, or multi-tenant service use                      | Unsupported | No network authentication, sandbox, or tenant-isolation boundary is provided.                                                                   |
+| Environment                                                                   | Status      | Contract                                                                                      |
+| ----------------------------------------------------------------------------- | ----------- | --------------------------------------------------------------------------------------------- |
+| Linux x64 with required GNU coreutils and procfs, Node.js 22.5.0              | Supported   | v0.8.1 exact release matrix for MCP/CLI/package, lifecycle, mutation, and managed setup.      |
+| Linux x64 with required GNU coreutils and procfs, current Node.js 24 line     | Supported   | v0.8.1 exact release matrix for MCP/CLI/package, lifecycle, mutation, and managed setup.      |
+| Other Linux architectures or systems without the required filesystem features | Unverified  | Not supported until equivalent architecture, mutation, and filesystem-publication gates pass. |
+| macOS                                                                         | Unverified  | Not supported until equivalent filesystem, process, package, mutation, and canary gates pass. |
+| Windows                                                                       | Unverified  | Not supported until equivalent filesystem, process, package, mutation, and canary gates pass. |
+| Remote, untrusted, or multi-tenant service use                                | Unsupported | No network authentication, sandbox, or tenant-isolation boundary is provided.                 |
 
-The package engine floor is Node.js `>=22.5.0`, but release evidence is deliberately narrower: exact Node.js 22.5.0 and the current Node.js 24 line on Linux. A newer version satisfying the engine range is not automatically a verified release target.
+The package engine floor is Node.js `>=22.5.0`. The v0.8.1 release matrix exercises exact Node.js 22.5.0 and the current Node.js 24 line on Linux, including managed setup-file publication; a future version satisfying the engine range is not automatically a verified release target.
 
-The checked-evidence freezer requires GNU coreutils `mv` with `--update=none-fail`, `--no-copy`, and `--no-target-directory`. Equivalent publication semantics have not been verified on other operating systems or architectures.
+The checked-evidence freezer requires GNU coreutils 9.7 `mv` with `--update=none-fail`, `--no-copy`, and `--no-target-directory`. Managed setup-file mutation additionally requires that same `mv` with `--exchange`, GNU coreutils `ln -L -T`, procfs descriptor paths at `/proc/self/fd`, `O_DIRECTORY`, and `O_NOFOLLOW`. It fails closed when any verified Linux primitive is unavailable. Equivalent publication, exchange, descriptor-link, and descriptor-relative mutation semantics have not been verified on other operating systems or architectures.
 
 ## Local stdio trust boundary
 
@@ -35,7 +35,7 @@ Operation locks coordinate cooperating same-user processes. They do not stop edi
 
 The supported default is memory-only indexing. When `AST_SYMBOL_INDEX_PERSISTENCE` is absent, persistence remains disabled and no persistent cache is created.
 
-The only candidate-authorized opt-in persistence policy is `canary`; it is not enabled by default in v0.7.2:
+The only candidate-authorized opt-in persistence policy is `canary`; it is not enabled by default in v0.8.1:
 
 ```bash
 AST_SYMBOL_INDEX_PERSISTENCE=canary \
@@ -49,7 +49,7 @@ The cache root must be explicit and absolute. Use a dedicated local directory wi
 
 ## Production-readiness acceptance
 
-The checked Linux x64 matrix covers `ast-mcp-server` and `x-scraper` under Node.js 22.5.0 and Node.js 24. MCP-PROD-404 is normative; its complete release gate requires all four reports to pass the following contract:
+The four retained Linux x64 production-readiness reports cover `ast-mcp-server` and `x-scraper` under Node.js 22.5.0 and Node.js 24 for package version 0.6.0, commit `2d0b21bbb80fae1acfca6a85d5891d87e68b59c1`, and tree `af931d49769fabdf06f623965a6cfe1f9afb8a81`. They are historical integration evidence only: they are not reattributed to v0.8.1 and do not establish managed setup-file publication for that release. The separate exact v0.8.1 release matrix validates the current repository under both supported runtime lines, including managed setup, but does not rebind those historical reports. MCP-PROD-404 remains normative for admission:
 
 - zero semantic mismatches across disabled, cold, warm, restart, and rollback reads;
 - byte-identical real-repository status and worktree trees;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ast-mcp-server",
-  "version": "0.7.2",
+  "version": "0.8.1",
   "description": "Structural code MCP server and batch CLI for compact TypeScript/JavaScript reads and hash-bound AST edits.",
   "keywords": [
     "mcp",
@@ -44,7 +44,7 @@
   },
   "resolutions": {
     "hono": "4.12.34",
-    "nanoid": "3.3.17"
+    "nanoid": "3.3.18"
   },
   "scripts": {
     "build": "tsc",
@@ -56,6 +56,8 @@
     "test:cli": "yarn build && node scripts/cli-smoke.mjs",
     "test:errors": "yarn build && node scripts/public-error-smoke.mjs",
     "test:package": "node scripts/package-smoke.mjs",
+    "test:installed-agents": "yarn build && node scripts/installed-agent-guidance-smoke.mjs",
+    "test:agent-fixtures": "node scripts/admit-agent-fixtures.mjs --check",
     "test:release-candidate": "node scripts/release-candidate-matrix.mjs",
     "benchmark": "yarn build && node scripts/benchmark.mjs",
     "benchmark:corpus": "yarn build && node scripts/benchmark-corpus.mjs",
@@ -80,6 +82,7 @@
     "@modelcontextprotocol/sdk": "^1.12.0",
     "@toon-format/toon": "4.1.0",
     "diff": "^9.0.0",
+    "jsonc-parser": "^3.3.1",
     "ts-morph": "24.0.0",
     "zod": "^3.23.8"
   },
@@ -93,5 +96,5 @@
     "typescript-eslint": "^8.65.0",
     "vitest": "^4.1.10"
   },
-  "gitHead": "d27f8f80cf81bf81b1d1e5e76db7b8875344d91e"
+  "gitHead": "bc8026fa534262c293384b50a8dff0eaa2ca22da"
 }

package/skills/structural-code-editing/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: structural-code-editing
 description: Leer, navegar y editar proyectos TypeScript/JavaScript mediante el resolver real del compilador y operaciones AST preparadas, revisadas y vinculadas por hash.
-version: "4.1.0"
+version: "4.2.0"
 author: "yail"
 license: "ISC"
 metadata:
@@ -12,6 +12,12 @@ metadata:
 
 # Edición estructural con el servidor MCP `ast`
 
+## Contrato de activación
+
+Cargar `structural-code-editing` antes de navegar semánticamente, analizar impacto o referencias, consultar diagnostics o preparar una mutación estructural en un proyecto TypeScript/JavaScript gobernado por el compilador. Preferir las tools compiler-backed del servidor `ast` para esas operaciones y revisar cualquier plan antes de aplicarlo.
+
+No forzar un roundtrip AST para Markdown, configuración, comentarios ni una edición textual trivial en un archivo ya conocido. Si las tools `ast_*` no están disponibles, declarar el fallback y no presentar búsquedas textuales como evidencia compiler-backed.
+
 ## Cuándo usarlo
 
 Usar las tools del servidor MCP `ast` en proyectos TypeScript/JavaScript con `tsconfig.json` cuando haya que:
@@ -40,13 +46,13 @@ El setup falla cerrado ante un registro `ast` conflictivo. No eliminar ni reempl
 
 ## Runtime, soporte y errores
 
-El paquete requiere Node.js `>=22.5.0`. El target verificado para v0.7.2 es Linux x64 con Node.js 22.5.0 o la línea actual de Node.js 24 y el `mv` de GNU coreutils requerido por la publicación atómica de evidencia. Otras arquitecturas Linux, sistemas sin ese primitivo, macOS y Windows están sin verificar.
+El paquete requiere Node.js `>=22.5.0`. La matriz de release de v0.8.1 cubre Linux x64 con Node.js 22.5.0 y la línea actual de Node.js 24, incluida la publicación de archivos gestionados por setup. Esa mutación requiere además GNU coreutils 9.7 `mv` con `--update=none-fail`, `--exchange`, `--no-copy` y `--no-target-directory`, GNU coreutils `ln -L -T`, y procfs en `/proc/self/fd` con `O_DIRECTORY`/`O_NOFOLLOW`. Otras arquitecturas Linux, sistemas sin esos primitivos, macOS y Windows están sin verificar.
 
 El transporte soportado es stdio local bajo los permisos filesystem del usuario que invoca el proceso. No asumir autenticación HTTP, sandbox, aislamiento entre tenants ni una frontera segura para clientes remotos o no confiables.
 
 La persistencia del índice está deshabilitada por default. El modo `canary` requiere `AST_SYMBOL_INDEX_PERSISTENCE=canary` y un `AST_SYMBOL_INDEX_CACHE_ROOT` absoluto y aislado; `enabled` sigue sin publicarse y falla cerrado a memoria con `enabled_not_released`.
 
-Los errores públicos usan un vocabulario cerrado dentro de `{ "error": { "code", "message", "correlation_id" } }`, con `isError: true`. Conservar el `correlation_id` al reportar un fallo; no pedir ni exponer stacks, paths absolutos, source, cache, argumentos crudos, environment ni credenciales para diagnosticarlo.
+Los errores públicos de las tools MCP usan un vocabulario cerrado dentro de `{ "error": { "code", "message", "correlation_id" } }`, con `isError: true`. Conservar el `correlation_id` al reportar un fallo; no pedir ni exponer stacks, paths absolutos, source, cache, argumentos crudos, environment ni credenciales para diagnosticarlo. Los errores del comando local `setup` pueden incluir un path destino acotado para permitir inspeccionar una escritura incierta o pendiente, pero no argumentos, environment, credenciales ni output crudo del proveedor.
 
 ## Flujo compacto de lectura
 

package/skills/structural-code-editing/guidance.md

@@ -0,0 +1,3 @@
+Load the `structural-code-editing` skill before semantic TypeScript/JavaScript navigation, reference or impact analysis, compiler diagnostics, or structural mutation in a compiler-governed project. Prefer the compiler-backed `ast` MCP tools for symbols, references, impact, diagnostics, and reviewed structural mutations.
+
+Use ordinary file tools for Markdown, configuration, comments, and trivial text edits in already known files. If the `ast` tools are unavailable, disclose the fallback and never describe textual search as compiler-backed evidence.

package/skills/structural-code-editing/releases.json

@@ -0,0 +1,50 @@
+{
+  "schema_version": 1,
+  "algorithm": "sha256",
+  "current": {
+    "version": "4.2.0",
+    "sha256": "43a07546fcc8417b5e937881e20d4bb87e57bba0bce1ae0c5bb58d75a6f75870"
+  },
+  "predecessors": [
+    {
+      "version": "3.3.0",
+      "sha256": "61251830f0a247d63873fbe6a912187a36ff99489241c24c5b2558563f79ab7f",
+      "npm_versions": ["0.3.0"]
+    },
+    {
+      "version": "3.4.0",
+      "sha256": "b9f75a8cb4900f5c6ad652c106d373ea1e951c8757870b4424a59469dd3b0868",
+      "npm_versions": ["0.4.0"]
+    },
+    {
+      "version": "4.0.0",
+      "sha256": "fbc6a9eeb11d3e4ecb5a585283a49b0e4df102b413e7fd82316c2f6e44b2cd56",
+      "npm_versions": ["0.5.0", "0.5.1"]
+    },
+    {
+      "version": "4.0.0",
+      "sha256": "622ab59511396f4acf289bad39fb2a03114352f6dc8556f12b37bde98d67a6b3",
+      "npm_versions": ["0.6.0"]
+    },
+    {
+      "version": "4.1.0",
+      "sha256": "e10f89e8834c97fdb68157b7c5d97ebe59311fb8bbcca0f5f26fb47d684cbf52",
+      "npm_versions": ["0.7.0"]
+    },
+    {
+      "version": "4.1.0",
+      "sha256": "672307b01a93a16e395d40b0b58e06cfca34b54ffd05b697ef471633bc476ad1",
+      "npm_versions": ["0.7.1"]
+    },
+    {
+      "version": "4.1.0",
+      "sha256": "6284fbeaf054947d20693d317604ceabf5a53d32e3c836855a321e5e26766e29",
+      "npm_versions": ["0.7.2"]
+    },
+    {
+      "version": "4.2.0",
+      "sha256": "b072ccf68ebd50a825dc9fdbdaaf35cdbf7045ae5fb9a9d7a412dc7b702ee7a0",
+      "npm_versions": ["0.8.0"]
+    }
+  ]
+}