mason-context 0.20.2 → 0.21.0

package/dist/mason-runtime.js

@@ -2,17 +2,18 @@
 if (!import.meta.url.endsWith("/mason-runtime.js")) await import("./mason-runtime.js").then(m => m.registerRuntime());
 
 // src/distribution/runtime.ts
-import fs7 from "fs/promises";
+import fs8 from "fs/promises";
 import { unlinkSync } from "fs";
 import os4 from "os";
-import path7 from "path";
+import path8 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
-import { z as z7 } from "zod";
+import { z as z10 } from "zod";
 
 // src/automation/store.ts
-import { z as z3 } from "zod";
+import { z as z6 } from "zod";
 
 // src/utils/store-lock.ts
+import { z } from "zod";
 import fs3 from "fs/promises";
 import os from "os";
 
@@ -25,11 +26,22 @@ import { randomUUID } from "crypto";
 import path from "path";
 function normalizeRepoPath(value) {
   const slash = value.replace(/\\/g, "/");
-  if (!slash || slash.includes("\0") || path.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash)) return null;
+  if (!slash || slash.includes("\0") || path.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash))
+    return null;
   if (slash.split("/").includes("..")) return null;
   const normalized = path.posix.normalize(slash).replace(/\/$/, "");
   return normalized === "." ? null : normalized;
 }
+function anchorMatches(anchor, file) {
+  const a = normalizeRepoPath(anchor);
+  const f = normalizeRepoPath(file);
+  return a !== null && f !== null && (a === f || f.startsWith(`${a}/`));
+}
+function matchingPaths(anchors, files) {
+  return [...new Set(files)].filter(
+    (file) => anchors.some((anchor) => anchorMatches(anchor, file))
+  );
+}
 
 // src/utils/git-read.ts
 import { execFile } from "child_process";
@@ -47,11 +59,40 @@ import fs from "fs/promises";
 import { constants } from "fs";
 import path2 from "path";
 import fg from "fast-glob";
-var SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
+var SOURCE_EXTENSIONS = [
+  "ts",
+  "tsx",
+  "js",
+  "jsx",
+  "mts",
+  "cts",
+  "mjs",
+  "cjs",
+  "vue",
+  "svelte",
+  "kt",
+  "kts",
+  "java",
+  "py",
+  "go",
+  "rs",
+  "swift",
+  "rb",
+  "cs",
+  "cpp",
+  "c",
+  "h",
+  "hpp",
+  "dart",
+  "php"
+];
 var SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
 var MAX_SOURCE_BYTES = 1024 * 1024;
 async function readBoundedFile(file, maxBytes) {
-  const handle = await fs.open(file, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
+  const handle = await fs.open(
+    file,
+    constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW
+  );
   try {
     const stat = await handle.stat();
     if (!stat.isFile() || stat.size > maxBytes) return null;
@@ -104,7 +145,10 @@ async function readStoreJson(root, relative) {
     return parsed;
   } catch (error) {
     if (error.code === "ENOENT") return null;
-    throw new Error(`Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    throw new Error(
+      `Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error }
+    );
   }
 }
 async function writeStoreJson(root, relative, value) {
@@ -129,26 +173,30 @@ async function writeStoreJson(root, relative, value) {
 }
 
 // src/utils/store-lock.ts
+var lockOwnerSchema = z.object({ host: z.string(), pid: z.number().int().positive() });
 async function lockDiagnostic(file) {
   let reason;
   try {
-    const owner = JSON.parse(await fs3.readFile(file, "utf8"));
-    if (!owner || typeof owner.host !== "string" || !Number.isInteger(owner.pid) || owner.pid <= 0) {
+    const owner = lockOwnerSchema.safeParse(JSON.parse(await fs3.readFile(file, "utf8")));
+    if (!owner.success) {
       reason = "Lock owner data is incomplete or malformed.";
-    } else if (owner.host !== os.hostname()) {
+    } else if (owner.data.host !== os.hostname()) {
       reason = "The lock belongs to another host; its process cannot be checked locally.";
     } else {
       try {
-        process.kill(owner.pid, 0);
-        reason = `Local owner PID ${owner.pid} is still running.`;
+        process.kill(owner.data.pid, 0);
+        reason = `Local owner PID ${owner.data.pid} is still running.`;
       } catch (error) {
-        reason = error.code === "ESRCH" ? `Local owner PID ${owner.pid} has exited, but lock recovery has not completed.` : `Local owner PID ${owner.pid} could not be checked.`;
+        reason = error.code === "ESRCH" ? `Local owner PID ${owner.data.pid} has exited, but lock recovery has not completed.` : `Local owner PID ${owner.data.pid} could not be checked.`;
       }
     }
   } catch (error) {
     reason = error instanceof SyntaxError ? "Lock owner data is incomplete or malformed." : "Lock owner data could not be read; the lock may have changed.";
   }
-  if (await fs3.lstat(file + ".reclaim").then(() => true, () => false)) {
+  if (await fs3.lstat(file + ".reclaim").then(
+    () => true,
+    () => false
+  )) {
     reason += " A recovery guard also needs inspection: " + file + ".reclaim.";
   }
   return reason + " Retry if a writer is active. For manual recovery, stop all Mason writers for this checkout, confirm they have exited (including other hosts), then remove only confirmed abandoned lock and lock.reclaim files. See docs/reference.md#snapshot-repairs-and-verification.";
@@ -168,7 +216,7 @@ async function withStoreLock(root, directory, run, waitMs = 5e3, label = "Mason
       }
       if (error.code !== "EEXIST") throw error;
       try {
-        const owner = JSON.parse(await fs3.readFile(file, "utf8"));
+        const owner = lockOwnerSchema.parse(JSON.parse(await fs3.readFile(file, "utf8")));
         if (owner.host === os.hostname() && Number.isInteger(owner.pid) && owner.pid > 0) {
           try {
             process.kill(owner.pid, 0);
@@ -178,7 +226,7 @@ async function withStoreLock(root, directory, run, waitMs = 5e3, label = "Mason
               let guard;
               try {
                 guard = await fs3.open(reclaim, "wx", 384);
-                const current = JSON.parse(await fs3.readFile(file, "utf8"));
+                const current = lockOwnerSchema.parse(JSON.parse(await fs3.readFile(file, "utf8")));
                 if (current.pid === owner.pid && current.host === owner.host) await fs3.unlink(file);
               } finally {
                 if (guard) {
@@ -191,7 +239,11 @@ async function withStoreLock(root, directory, run, waitMs = 5e3, label = "Mason
         }
       } catch {
       }
-      if (Date.now() >= deadline) throw new Error(label + " is busy or its lock needs inspection: " + file + ". " + await lockDiagnostic(file));
+      if (Date.now() >= deadline)
+        throw new Error(
+          label + " is busy or its lock needs inspection: " + file + ". " + await lockDiagnostic(file),
+          { cause: error }
+        );
       await new Promise((resolve) => setTimeout(resolve, 40));
     }
     if (handle) {
@@ -214,121 +266,192 @@ async function withStoreLock(root, directory, run, waitMs = 5e3, label = "Mason
   }
 }
 
-// src/automation/notifications.ts
+// src/automation/stop-review.ts
+import { z as z4 } from "zod";
+
+// src/decisions/anchors.ts
+import { createHash } from "crypto";
+import fs4 from "fs/promises";
+import { constants as constants2 } from "fs";
 import { z as z2 } from "zod";
+import fg3 from "fast-glob";
+
+// src/audit/inspection.ts
+import fg2 from "fast-glob";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+import path4 from "path";
+var inspections = new AsyncLocalStorage2();
+var sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
+var sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
+
+// src/decisions/anchors.ts
+var repoPath = z2.string().refine((p) => normalizeRepoPath(p) === p);
+var anchorCaptureSchema = z2.object({
+  anchors: z2.array(repoPath),
+  files: z2.record(repoPath, z2.string().regex(/^[a-f0-9]{64}$/)),
+  complete: z2.boolean()
+}).refine(
+  (capture) => JSON.stringify(capture.anchors) === JSON.stringify([...new Set(capture.anchors)].sort()) && matchingPaths(capture.anchors, Object.keys(capture.files)).length === Object.keys(capture.files).length,
+  "Capture paths must belong to its normalized, sorted anchor scope"
+);
 
 // src/audit/findings.ts
-import { createHash } from "crypto";
-import { z } from "zod";
-var checkSchema = z.enum(["deleted-reference", "new-module", "stale-count", "dead-command", "deps-changed", "decision-anchor-drift"]);
-var commitSchema = z.object({ hash: z.string().regex(/^[a-f0-9]{40,64}$/), date: z.string(), subject: z.string() });
-var anchorSchema = z.object({ doc: z.string(), line: z.number().int().positive().nullable(), excerpt: z.string().nullable() });
-var count = z.number().int().nonnegative();
-var scopeSchema = z.object({
-  basis: z.enum(["repository", "document", "document-link", "explicit"]),
-  directory: z.string(),
-  candidates: z.array(z.string())
+import { createHash as createHash2 } from "crypto";
+import { z as z3 } from "zod";
+var checkSchema = z3.enum([
+  "deleted-reference",
+  "new-module",
+  "stale-count",
+  "dead-command",
+  "deps-changed",
+  "decision-anchor-drift"
+]);
+var commitSchema = z3.object({
+  hash: z3.string().regex(/^[a-f0-9]{40,64}$/),
+  date: z3.string(),
+  subject: z3.string()
+});
+var anchorSchema = z3.object({
+  doc: z3.string(),
+  line: z3.number().int().positive().nullable(),
+  excerpt: z3.string().nullable()
+});
+var count = z3.number().int().nonnegative();
+var scopeSchema = z3.object({
+  basis: z3.enum(["repository", "document", "document-link", "explicit"]),
+  directory: z3.string(),
+  candidates: z3.array(z3.string())
 });
-var evidenceSchema = z.discriminatedUnion("kind", [
-  z.object({
-    kind: z.literal("missing-path"),
-    claimed: z.string(),
-    renamedTo: z.string().nullable(),
+var evidenceSchema = z3.discriminatedUnion("kind", [
+  z3.object({
+    kind: z3.literal("missing-path"),
+    claimed: z3.string(),
+    renamedTo: z3.string().nullable(),
     deletedInCommit: commitSchema.nullable(),
-    everTracked: z.boolean(),
-    parentDirExists: z.boolean(),
-    resolvedPath: z.string().optional(),
+    everTracked: z3.boolean(),
+    parentDirExists: z3.boolean(),
+    resolvedPath: z3.string().optional(),
     scope: scopeSchema.optional()
   }),
-  z.object({
-    kind: z.literal("unmentioned-dir"),
-    dir: z.string(),
+  z3.object({
+    kind: z3.literal("unmentioned-dir"),
+    dir: z3.string(),
     sourceFileCount: count,
     firstCommit: commitSchema.nullable(),
-    checkedDocs: z.array(z.string())
+    checkedDocs: z3.array(z3.string())
   }),
-  z.object({
-    kind: z.literal("count-mismatch"),
+  z3.object({
+    kind: z3.literal("count-mismatch"),
     claimed: count,
     actual: count,
-    unit: z.string(),
-    countedFrom: z.string(),
-    members: z.array(z.string())
+    unit: z3.string(),
+    countedFrom: z3.string(),
+    members: z3.array(z3.string())
   }),
-  z.object({
-    kind: z.literal("missing-script"),
-    scriptName: z.string(),
-    invocation: z.string(),
-    manifestsChecked: z.array(z.string()),
-    availableScripts: z.array(z.string()),
+  z3.object({
+    kind: z3.literal("missing-script"),
+    scriptName: z3.string(),
+    invocation: z3.string(),
+    manifestsChecked: z3.array(z3.string()),
+    availableScripts: z3.array(z3.string()),
     scope: scopeSchema.optional()
   }),
-  z.object({
-    kind: z.literal("doc-behind-manifests"),
+  z3.object({
+    kind: z3.literal("doc-behind-manifests"),
     docLastCommit: commitSchema,
-    manifestCommits: z.array(commitSchema.extend({ files: z.array(z.string()) })),
+    manifestCommits: z3.array(commitSchema.extend({ files: z3.array(z3.string()) })),
     totalCommits: count,
-    matches: z.array(z.object({ dependency: z.string(), manifest: z.string(), before: z.string().nullable(), after: z.string().nullable(), line: z.number().int().positive(), excerpt: z.string() })).optional(),
-    matchingIncomplete: z.boolean().optional()
+    matches: z3.array(
+      z3.object({
+        dependency: z3.string(),
+        manifest: z3.string(),
+        before: z3.string().nullable(),
+        after: z3.string().nullable(),
+        line: z3.number().int().positive(),
+        excerpt: z3.string()
+      })
+    ).optional(),
+    matchingIncomplete: z3.boolean().optional()
   }),
-  z.object({
-    kind: z.literal("decision-anchor"),
-    decisionId: z.string(),
-    title: z.string(),
-    changedFiles: z.array(z.string()),
-    refreshedHash: z.string(),
-    provenance: z.object({}).passthrough().optional()
+  z3.object({
+    kind: z3.literal("decision-anchor"),
+    decisionId: z3.string(),
+    title: z3.string(),
+    changedFiles: z3.array(z3.string()),
+    refreshedHash: z3.string(),
+    provenance: z3.object({}).passthrough().optional()
   })
 ]);
-var findingSchema = z.object({ message: z.string(), anchor: anchorSchema, evidence: evidenceSchema });
+var findingSchema = z3.object({
+  message: z3.string(),
+  anchor: anchorSchema,
+  evidence: evidenceSchema
+});
 var issueSchema = findingSchema.extend({
-  type: z.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
-  confidence: z.enum(["certain", "likely"])
+  type: z3.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
+  confidence: z3.enum(["certain", "likely"])
+});
+var advisorySchema = findingSchema.extend({
+  type: checkSchema,
+  resolution: z3.enum(["recheck", "informational"]).optional()
+});
+var checkResultSchema = z3.object({
+  issues: z3.array(issueSchema),
+  advisories: z3.array(advisorySchema),
+  suppressedAdvisories: z3.array(advisorySchema).optional(),
+  skipped: z3.array(z3.object({ check: z3.string(), reason: z3.string(), doc: z3.string().optional() }))
 });
-var advisorySchema = findingSchema.extend({ type: checkSchema, resolution: z.enum(["recheck", "informational"]).optional() });
-var checkResultSchema = z.object({
-  issues: z.array(issueSchema),
-  advisories: z.array(advisorySchema),
-  suppressedAdvisories: z.array(advisorySchema).optional(),
-  skipped: z.array(z.object({ check: z.string(), reason: z.string(), doc: z.string().optional() }))
+
+// src/automation/stop-review.ts
+var evidenceSchema2 = z4.record(z4.object({ digest: z4.string(), capture: anchorCaptureSchema }));
+var stopReviewSchema = z4.object({
+  pending: z4.record(z4.object({ head: z4.string(), evidence: evidenceSchema2 })),
+  edited: z4.record(z4.record(z4.string().nullable())),
+  delivered: z4.record(z4.object({ digest: z4.string(), files: z4.record(z4.string().nullable()) }))
 });
 
 // src/automation/notifications.ts
-var conditionSchema = z2.object({
-  level: z2.number(),
-  facts: z2.array(z2.string()),
-  magnitude: z2.number().optional()
+import { z as z5 } from "zod";
+var conditionSchema = z5.object({
+  level: z5.number(),
+  facts: z5.array(z5.string()),
+  magnitude: z5.number().optional()
 });
-var notificationStateSchema = z2.object({
-  version: z2.literal(1),
-  baselineHead: z2.string(),
-  baseline: z2.record(conditionSchema),
-  delivered: z2.record(conditionSchema),
-  cleared: z2.array(z2.string())
+var notificationStateSchema = z5.object({
+  version: z5.literal(1),
+  baselineHead: z5.string(),
+  baseline: z5.record(conditionSchema),
+  delivered: z5.record(conditionSchema),
+  cleared: z5.array(z5.string())
 });
 
 // src/automation/store.ts
-var hostSchema = z3.enum(["claude", "codex"]);
-var stateSchema = z3.object({
-  version: z3.literal(1),
-  root: z3.string(),
-  gitDir: z3.string(),
-  branch: z3.string(),
-  baselines: z3.array(z3.object({ path: z3.string(), at: z3.string(), event: z3.string(), fingerprint: z3.string() })).max(128),
-  sessions: z3.record(z3.object({
-    host: hostSchema,
-    lastUsed: z3.string(),
-    notifiedDiagnostics: z3.array(z3.string()).default([]),
-    pending: z3.record(z3.string()),
-    coverageGaps: z3.array(z3.string()),
-    events: z3.record(z3.object({ at: z3.string(), count: z3.number().int().positive() }))
-  })),
-  updatedAt: z3.string(),
-  fingerprint: z3.string().nullable(),
-  latest: z3.string().nullable(),
+var hostSchema = z6.enum(["claude", "codex"]);
+var stateSchema = z6.object({
+  version: z6.literal(1),
+  root: z6.string(),
+  gitDir: z6.string(),
+  branch: z6.string(),
+  baselines: z6.array(
+    z6.object({ path: z6.string(), at: z6.string(), event: z6.string(), fingerprint: z6.string() })
+  ).max(128),
+  sessions: z6.record(
+    z6.object({
+      host: hostSchema,
+      lastUsed: z6.string(),
+      notifiedDiagnostics: z6.array(z6.string()).default([]),
+      pending: z6.record(z6.string()),
+      stopReview: stopReviewSchema.optional(),
+      coverageGaps: z6.array(z6.string()),
+      events: z6.record(z6.object({ at: z6.string(), count: z6.number().int().positive() }))
+    })
+  ),
+  updatedAt: z6.string(),
+  fingerprint: z6.string().nullable(),
+  latest: z6.string().nullable(),
   notifications: notificationStateSchema.optional(),
   agentNotifications: notificationStateSchema.optional(),
-  analysis: z3.object({ id: z3.string(), fingerprint: z3.string(), completedAt: z3.number(), path: z3.string() }).optional()
+  analysis: z6.object({ id: z6.string(), fingerprint: z6.string(), completedAt: z6.number(), path: z6.string() }).optional()
 });
 function withLock(root, directory, run, waitMs = 5e3) {
   return withStoreLock(root, directory, run, waitMs, "Automation");
@@ -336,83 +459,100 @@ function withLock(root, directory, run, waitMs = 5e3) {
 
 // src/distribution/state.ts
 import os3 from "os";
-import path5 from "path";
+import path6 from "path";
 import { fileURLToPath } from "url";
-import fs5 from "fs/promises";
-import { z as z5 } from "zod";
+import fs6 from "fs/promises";
+import { z as z8 } from "zod";
 
 // src/distribution/path.ts
-import fs4 from "fs/promises";
+import fs5 from "fs/promises";
 import os2 from "os";
-import path4 from "path";
+import path5 from "path";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
-import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
-import { z as z4 } from "zod";
+import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto";
+import { z as z7 } from "zod";
 var execute2 = promisify2(execFile2);
-var pathChangeSchema = z4.discriminatedUnion("kind", [
-  z4.object({ kind: z4.literal("profile"), file: z4.string(), block: z4.string(), created: z4.boolean() }),
-  z4.object({ kind: z4.literal("windows"), entry: z4.string(), created: z4.boolean() })
+var pathChangeSchema = z7.discriminatedUnion("kind", [
+  z7.object({
+    kind: z7.literal("profile"),
+    file: z7.string(),
+    block: z7.string(),
+    created: z7.boolean()
+  }),
+  z7.object({ kind: z7.literal("windows"), entry: z7.string(), created: z7.boolean() })
 ]);
 
 // src/distribution/state.ts
-var releaseVersion = z5.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/);
-var bundleId = z5.string().regex(/^[a-f0-9]{24}$/);
-var updatePolicySchema = z5.object({
-  enabled: z5.boolean(),
-  revision: z5.string(),
+var releaseVersion = z8.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/);
+var bundleId = z8.string().regex(/^[a-f0-9]{24}$/);
+var updatePolicySchema = z8.object({
+  enabled: z8.boolean(),
+  revision: z8.string(),
   pinnedVersion: releaseVersion.optional(),
-  mirror: z5.string().optional()
+  mirror: z8.string().optional()
 });
-var recordSchema = z5.object({
-  format: z5.literal(1),
-  home: z5.string(),
-  bin: z5.string(),
+var recordSchema = z8.object({
+  format: z8.literal(1),
+  home: z8.string(),
+  bin: z8.string(),
   current: bundleId,
   version: releaseVersion,
-  launchers: z5.record(z5.string()),
-  previousLaunchers: z5.record(z5.string()).optional(),
-  pathChanges: z5.array(pathChangeSchema).optional(),
+  launchers: z8.record(z8.string()),
+  previousLaunchers: z8.record(z8.string()).optional(),
+  pathChanges: z8.array(pathChangeSchema).optional(),
   updates: updatePolicySchema.optional(),
-  previous: z5.object({ id: bundleId, version: releaseVersion }).optional(),
-  pending: z5.object({ id: bundleId, version: releaseVersion, policyRevision: z5.string() }).optional()
+  previous: z8.object({ id: bundleId, version: releaseVersion }).optional(),
+  pending: z8.object({ id: bundleId, version: releaseVersion, policyRevision: z8.string() }).optional()
 });
 async function readInstallation(home) {
   const raw = await readStoreJson(home, "install.json");
-  if (!raw) throw new Error("Run this command from a standalone installation. npm users can upgrade with npm.");
+  if (!raw)
+    throw new Error(
+      "Run this command from a standalone installation. npm users can upgrade with npm."
+    );
   const record = recordSchema.parse(raw);
-  if (record.home !== await fs5.realpath(home)) throw new Error("Invalid standalone installation receipt.");
+  if (record.home !== await fs6.realpath(home))
+    throw new Error("Invalid standalone installation receipt.");
   return record;
 }
 function standaloneLocation() {
-  const bundle = path5.resolve(path5.dirname(fileURLToPath(import.meta.url)), "../..");
-  const home = path5.dirname(path5.dirname(bundle));
-  if (path5.dirname(bundle) !== path5.join(home, "versions") || !/^[a-f0-9]{24}$/.test(path5.basename(bundle))) {
+  const bundle = path6.resolve(path6.dirname(fileURLToPath(import.meta.url)), "../..");
+  const home = path6.dirname(path6.dirname(bundle));
+  if (path6.dirname(bundle) !== path6.join(home, "versions") || !/^[a-f0-9]{24}$/.test(path6.basename(bundle))) {
     return null;
   }
   return { home, bundle };
 }
 
 // src/distribution/bundle.ts
-import fs6 from "fs/promises";
-import path6 from "path";
-import { createHash as createHash3 } from "crypto";
-import { z as z6 } from "zod";
-var targets = ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-arm64", "win32-x64"];
-var digest2 = z6.string().regex(/^[a-f0-9]{64}$/);
-var bundleSchema = z6.object({
-  format: z6.literal(1),
-  version: z6.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
-  target: z6.enum(targets),
-  nodeVersion: z6.string(),
-  files: z6.record(digest2)
+import fs7 from "fs/promises";
+import path7 from "path";
+import { createHash as createHash4 } from "crypto";
+import { z as z9 } from "zod";
+var targets = [
+  "darwin-arm64",
+  "darwin-x64",
+  "linux-arm64",
+  "linux-x64",
+  "win32-arm64",
+  "win32-x64"
+];
+var digest2 = z9.string().regex(/^[a-f0-9]{64}$/);
+var bundleSchema = z9.object({
+  format: z9.literal(1),
+  version: z9.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
+  target: z9.enum(targets),
+  nodeVersion: z9.string(),
+  files: z9.record(digest2)
 }).strict();
 
 // src/distribution/trust.ts
 import tls from "tls";
 function configureSystemTrust() {
   if (process.env.NODE_USE_SYSTEM_CA === "0") return;
-  if (typeof tls.getCACertificates !== "function" || typeof tls.setDefaultCACertificates !== "function") return;
+  if (typeof tls.getCACertificates !== "function" || typeof tls.setDefaultCACertificates !== "function")
+    return;
   tls.setDefaultCACertificates([
     ...tls.getCACertificates("default"),
     ...tls.getCACertificates("system")
@@ -420,7 +560,11 @@ function configureSystemTrust() {
 }
 
 // src/distribution/runtime.ts
-var leaseSchema = z7.object({ pid: z7.number().int().positive(), host: z7.string(), bundle: z7.string().regex(/^[a-f0-9]{24}$/) });
+var leaseSchema = z10.object({
+  pid: z10.number().int().positive(),
+  host: z10.string(),
+  bundle: z10.string().regex(/^[a-f0-9]{24}$/)
+});
 async function registerRuntime() {
   const location = standaloneLocation();
   if (!location) return;
@@ -429,8 +573,12 @@ async function registerRuntime() {
   const name = `runtimes/${randomUUID3()}.json`;
   await withLock(home, ".install-lock", async () => {
     await readInstallation(home);
-    await fs7.access(bundle);
-    await writeStoreJson(home, name, { pid: process.pid, host: os4.hostname(), bundle: path7.basename(bundle) });
+    await fs8.access(bundle);
+    await writeStoreJson(home, name, {
+      pid: process.pid,
+      host: os4.hostname(),
+      bundle: path8.basename(bundle)
+    });
   });
   const file = await storePath(home, name);
   process.once("exit", () => {