fix: normalize checksums to platform-keyed { asset, sha256 } format

Author: jdalton

packages/build-infra/lib/external-tools-schema.json

@@ -25,12 +25,24 @@
           "tag": { "type": "string" },
           "checksums": {
             "type": "object",
-            "additionalProperties": { "type": "string" }
+            "additionalProperties": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "asset": { "type": "string" },
+                    "sha256": { "type": "string" }
+                  },
+                  "required": ["asset", "sha256"]
+                },
+                { "type": "string" }
+              ]
+            }
           }
         },
         "additionalProperties": true
       }
     }
   },
-  "required": ["tools"]
+  "additionalProperties": true
 }

packages/build-infra/lib/external-tools-schema.mjs

@@ -44,9 +44,20 @@ const toolSchema = z
       .optional()
       .describe('Release tag (when different from version)'),
     checksums: z
-      .record(z.string(), z.string())
+      .record(
+        z.string(),
+        z.union([
+          // Platform-keyed: { "darwin-arm64": { "asset": "file.tar.gz", "sha256": "abc..." } }
+          z.object({
+            asset: z.string(),
+            sha256: z.string(),
+          }),
+          // Flat: { "file.tar.gz": "abc..." } (legacy/simple)
+          z.string(),
+        ]),
+      )
       .optional()
-      .describe('SHA-256 checksums keyed by asset filename'),
+      .describe('Checksums keyed by platform or asset filename'),
 
     // npm package fields (socket-cli bundle-tools).
     integrity: z
@@ -76,9 +87,10 @@ export const externalToolsSchema = z
       .describe('Path to a base external-tools.json to inherit tools from'),
     tools: z
       .record(z.string(), toolSchema)
+      .optional()
       .describe('Map of tool name to tool configuration'),
   })
-  .strict()
+  .passthrough()
 
 /**
  * Validate an external-tools.json object against the schema.