v0.37.2

Highlights

• Ship real generated root TypeScript declarations, with separate ESM .d.ts and CommonJS .d.cts export branches for the existing plugin API.
• Fix whole **/ directory segments to match zero or more directories anywhere in include/exclude patterns. The original src/**/*.ts selects direct source files without a selector workaround.
• Raise the qualified Hono security floor to 4.13.11 and resolve 4.13.13, addressing GHSA-5r4p-p66f-jhc7 / CVE-2026-111757. The first fixed version and the actual resolved patch are distinct; this is not a claim that 4.13.13 is latest.
• Validate clean packed consumers for BOTH npm identities before publication, retain their exact tarballs, and recheck SHA512 before publishing those same bytes. Existing-version checks preflight both identities and skip only an identical immutable artifact.

Already observed before publication

• The new local build && typecheck && lint && test:run chain after the Hono repair passed: 2,832 tests passed, six existing skips; 143 test files passed, one existing skipped file.
• Fresh normal source npm ci ran applicable lifecycle scripts; both full including-development and production npm audits reported zero vulnerabilities at the recorded 2026-10-21 qualification checkpoint. An install-script coverage warning after successful scripts is preserved, with no policy/approval bypass.
• Both packed identities passed strict TypeScript 5.9.3 ESM/CJS consumers with complete contained type closure and zero diagnostics on genuine Node 22.13.0 and Node 26.9.0; no SDK injection or skipLibCheck waiver.
• All four clean packed consumers actually resolved unoverridden Hono 4.13.13 and passed production audits. This proves those fresh resolutions, not repair of arbitrary pre-existing consumer locks; package-level overrides do not govern downstream consumers.
• Actual packed CLI/MCP/native proof used the original three-direct-file glob fixture on both runtimes. Every actual MCP transport passed initial indexing/lookup/search/graph/ambiguity checks; full update/stale-removal/reopen ran on each identity's primary transport. The preferred package's secondary legacy transport transitions were not attempted locally. cbi/ocbi were exercised only in their supported CLI modes, not misclassified as MCP transports.
• Bounded private loopback hybrid checks exercised real queue/indexing operations without an external embedding provider. Exact executed source/probe/native/tarball bytes and earlier failure history were preserved.

Scope and limits

Consumer Node >=22.13.0, development floors, source-locked SDK/parent versions, unrelated dependency versions/pins, and the existing Windows ARM64 experimental build policy are unchanged. The Hono security guard and leaf lock entry intentionally changed. Fresh unlocked consumer parent resolution is recorded separately from the source lock. Local native execution was macOS ARM64 only, not other-platform runtime verification.

Actual published-package integrity/signature/provenance, independent Node22/Node26 full transitions for every supported MCP transport plus all supported CLI aliases, and normal-profile published-extension OMP verification are separate post-publication requirements; they are not claimed here. No original250MB/OOM reproduction, historical watcher repair, frozen-study regrade, baseline update or performance/SOTA claim. Immutable v0.37.0/v0.37.1 artifacts are not rewritten.

Complete changelog · Changes since v0.37.1