@pome-sh/cli 0.18.0 → 0.20.0

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
   "package": "pome-sh",
-  "version": "0.18.0",
-  "git_sha": "285d48dcd654088387b40e8d36a7a2bf8ffbb599",
-  "build_time": "2026-08-03T13:39:43.286Z"
+  "version": "0.20.0",
+  "git_sha": "4f64f517734b8b43ebd4bb8968a388e6b089dc62",
+  "build_time": "2026-08-04T21:23:39.046Z"
 }

package/dist/src/capture-server/index.js

@@ -127,7 +127,7 @@ function handleConnect({ req, clientSocket, head, writer, egressWriter, allowHos
         const row = {
             ts: new Date().toISOString(),
             event_id: randomUUID(),
-            parent_id: null,
+            parent_event_id: null,
             kind: "LlmCallEvent",
             host,
             port,

package/dist/src/runner/mergeAdapterSignals.d.ts

@@ -1,3 +1,26 @@
+import { type Event } from "../types/shared.js";
+/**
+ * F-1200 — give every twin HTTP row the tool call that caused it.
+ *
+ * The twin writes `parent_event_id: null` because it runs in its own process
+ * and cannot know the agent-side `event_id`; the adapter knows the `event_id`
+ * but never sees the twin's tape. This merge is the one place both halves are
+ * in hand, so the join belongs here — and it is a pure data operation over two
+ * finished files, with no dependency on the order the two writers ran in.
+ *
+ * The join key is the SDK's `tool_use_id`, which since F-1200 is what the
+ * adapter stamps on `x-pome-correlation-id`. The twin persists that header as
+ * `correlation_id` ALWAYS and as `tool_call_id` only when it pins
+ * `stampToolCallId` (github's frozen tape shape) — so `correlation_id` is the
+ * key that works for every twin, with `tool_call_id` preferred when present
+ * because it is unambiguously the header rather than the request-id fallback.
+ *
+ * A row keeps its null parent when the id names no tool call: a pre-F-1200
+ * `tlc_…`, a `req_…` from the no-header fallback, or a direct REST call made
+ * outside any tool handler. An unresolvable parent is the honest answer there —
+ * inventing one would put twin calls under tools that did not make them.
+ */
+export declare function resolveTwinHttpParents(rows: Event[]): Event[];
 export declare function mergeAdapterSignalsIntoEvents(signalsPath: string, eventsJsonlPath: string): Promise<{
     appended: number;
     dropped: number;

package/dist/src/runner/mergeAdapterSignals.js

@@ -24,6 +24,48 @@ import { redactEvent } from "../recorder/redaction.js";
 // lines are dropped and counted; the caller can log the drop count. Existing
 // events.jsonl rows that fail to parse are passed through unsorted at the
 // head of the file so a corrupted in-flight write is never silently dropped.
+/**
+ * F-1200 — give every twin HTTP row the tool call that caused it.
+ *
+ * The twin writes `parent_event_id: null` because it runs in its own process
+ * and cannot know the agent-side `event_id`; the adapter knows the `event_id`
+ * but never sees the twin's tape. This merge is the one place both halves are
+ * in hand, so the join belongs here — and it is a pure data operation over two
+ * finished files, with no dependency on the order the two writers ran in.
+ *
+ * The join key is the SDK's `tool_use_id`, which since F-1200 is what the
+ * adapter stamps on `x-pome-correlation-id`. The twin persists that header as
+ * `correlation_id` ALWAYS and as `tool_call_id` only when it pins
+ * `stampToolCallId` (github's frozen tape shape) — so `correlation_id` is the
+ * key that works for every twin, with `tool_call_id` preferred when present
+ * because it is unambiguously the header rather than the request-id fallback.
+ *
+ * A row keeps its null parent when the id names no tool call: a pre-F-1200
+ * `tlc_…`, a `req_…` from the no-header fallback, or a direct REST call made
+ * outside any tool handler. An unresolvable parent is the honest answer there —
+ * inventing one would put twin calls under tools that did not make them.
+ */
+export function resolveTwinHttpParents(rows) {
+    const eventIdByToolUseId = new Map();
+    for (const row of rows) {
+        if (row.kind === "ToolUseEvent")
+            eventIdByToolUseId.set(row.tool_use_id, row.event_id);
+    }
+    if (eventIdByToolUseId.size === 0)
+        return rows;
+    return rows.map((row) => {
+        if (row.kind !== "TwinHttpEvent")
+            return row;
+        // Never overwrite a parent the writer already established.
+        if (row.parent_event_id != null)
+            return row;
+        const causingToolUseId = row.tool_call_id ?? row.correlation_id ?? null;
+        if (causingToolUseId === null)
+            return row;
+        const parentEventId = eventIdByToolUseId.get(causingToolUseId);
+        return parentEventId === undefined ? row : { ...row, parent_event_id: parentEventId };
+    });
+}
 export async function mergeAdapterSignalsIntoEvents(signalsPath, eventsJsonlPath) {
     let rawSignals;
     try {
@@ -84,9 +126,9 @@ export async function mergeAdapterSignalsIntoEvents(signalsPath, eventsJsonlPath
             unparseablePassthrough.push(line);
         }
     }
-    // Concat + stable sort by ts. ISO-8601 with `Z` sorts chronologically under
-    // lexicographic compare.
-    const merged = eventRows.concat(signalRows);
+    // Concat, resolve twin-HTTP parentage, then stable sort by ts. ISO-8601 with
+    // `Z` sorts chronologically under lexicographic compare.
+    const merged = resolveTwinHttpParents(eventRows.concat(signalRows));
     merged.sort((a, b) => (a.ts < b.ts ? -1 : a.ts > b.ts ? 1 : 0));
     const sortedJsonl = merged.map((r) => JSON.stringify(r)).join("\n");
     const head = unparseablePassthrough.length > 0 ? unparseablePassthrough.join("\n") + "\n" : "";

package/dist/src/scaffolds/mcp-loop/loop.js

@@ -116,7 +116,7 @@ function emitToolUse(signalsPath, row) {
         appendFileSync(signalsPath, JSON.stringify({
             ts: new Date().toISOString(),
             event_id: randomUUID(),
-            parent_id: null,
+            parent_event_id: null,
             kind: "ToolUseEvent",
             tool_use_id: row.tool_use_id,
             tool_name: row.tool_name,
@@ -134,7 +134,7 @@ function emitToolResult(signalsPath, row) {
         appendFileSync(signalsPath, JSON.stringify({
             ts: new Date().toISOString(),
             event_id: randomUUID(),
-            parent_id: null,
+            parent_event_id: null,
             kind: "ToolResultEvent",
             tool_use_id: row.tool_use_id,
             output: row.output,
@@ -163,7 +163,7 @@ function emitLlmCall(signalsPath, row) {
         appendFileSync(signalsPath, JSON.stringify({
             ts: new Date().toISOString(),
             event_id: randomUUID(),
-            parent_id: null,
+            parent_event_id: null,
             kind: "LlmCallEvent",
             host: row.host,
             port: 443,

package/node_modules/@hono/node-server/README.md

@@ -86,7 +86,7 @@ app.get(
   }))
 )
 
-const wss = new WebSocketServer({ noServer: true }) // important to create with `noServer: true`
+const wss = new WebSocketServer({ noServer: true })
 serve({
   fetch: app.fetch,
   websocket: { server: wss },
@@ -332,6 +332,52 @@ type Http2Bindings = {
 }
 ```
 
+## Early Hints Middleware
+
+You can send HTTP 103 Early Hints to instruct browsers to preload or preconnect resources before the final response is prepared. The middleware is supported under Node.js bindings (HTTP/1.1 and HTTP/2).
+
+### Usage
+
+Import `earlyHints` from `@hono/node-server/early-hints`:
+
+#### Static links
+
+```ts
+import { serve } from '@hono/node-server'
+import { earlyHints } from '@hono/node-server/early-hints'
+import { Hono } from 'hono'
+
+const app = new Hono()
+
+app.use(
+  earlyHints({
+    link: '</styles.css>; rel=preload; as=style',
+  })
+)
+
+app.get('/', (c) => {
+  return c.html('<!DOCTYPE html><html><body><h1>Hello Hono!</h1></body></html>')
+})
+
+serve(app)
+```
+
+#### Dynamic links
+
+```ts
+app.use(
+  earlyHints({
+    link: (c) =>
+      c.req.query('theme') === 'dark'
+        ? '</dark.css>; rel=preload; as=style'
+        : '</light.css>; rel=preload; as=style',
+  })
+)
+```
+
+> [!NOTE]
+> Early Hints are sent only for requests that look like document navigations. If `Sec-Fetch-Mode` or `Sec-Fetch-Dest` is present with a value other than `navigate` or `document`, for example a `fetch()` or XHR call from a browser, a subresource request, or an iframe navigation, the middleware skips the hints and continues to the handler. Requests without these headers, such as `curl` or `fetch()` from a JavaScript runtime, are treated as navigations and do receive Early Hints.
+
 ## Direct response from Node.js API
 
 You can directly respond to the client from the Node.js API.

package/node_modules/@hono/node-server/dist/early-hints.cjs

@@ -0,0 +1,35 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+//#region src/early-hints.ts
+/**
+* Early Hints middleware for Node.js
+* Automatically sends a 103 Early Hints informational response with the specified Link header(s).
+*
+* @param options EarlyHintsOptions
+* @returns MiddlewareHandler
+*/
+const earlyHints = (options) => {
+	let warned = false;
+	return async (c, next) => {
+		const mode = c.req.header("Sec-Fetch-Mode");
+		const dest = c.req.header("Sec-Fetch-Dest");
+		if (mode && mode !== "navigate" || dest && dest !== "document") return next();
+		const env = c.env || {};
+		const outgoing = (env.server ? env.server : env)?.outgoing;
+		if (typeof outgoing?.writeEarlyHints !== "function") {
+			if (!warned) {
+				console.warn("Early Hints Middleware is not supported because writeEarlyHints is not defined.");
+				warned = true;
+			}
+			return await next();
+		}
+		if (!outgoing.headersSent) {
+			const link = typeof options.link === "function" ? options.link(c) : options.link;
+			if (link !== void 0 && (Array.isArray(link) ? link.length > 0 : Boolean(link))) outgoing.writeEarlyHints({ link });
+		}
+		await next();
+	};
+};
+
+//#endregion
+exports.earlyHints = earlyHints;

package/node_modules/@hono/node-server/dist/early-hints.d.cts

@@ -0,0 +1,16 @@
+import { Context, Env, MiddlewareHandler } from "hono";
+
+//#region src/early-hints.d.ts
+type EarlyHintsOptions<E extends Env = Env> = {
+  link: string | string[] | ((c: Context<E>) => string | string[] | undefined);
+};
+/**
+ * Early Hints middleware for Node.js
+ * Automatically sends a 103 Early Hints informational response with the specified Link header(s).
+ *
+ * @param options EarlyHintsOptions
+ * @returns MiddlewareHandler
+ */
+declare const earlyHints: <E extends Env = any>(options: EarlyHintsOptions<E>) => MiddlewareHandler<E>;
+//#endregion
+export { EarlyHintsOptions, earlyHints };

package/node_modules/@hono/node-server/dist/early-hints.d.mts

@@ -0,0 +1,16 @@
+import { Context, Env, MiddlewareHandler } from "hono";
+
+//#region src/early-hints.d.ts
+type EarlyHintsOptions<E extends Env = Env> = {
+  link: string | string[] | ((c: Context<E>) => string | string[] | undefined);
+};
+/**
+ * Early Hints middleware for Node.js
+ * Automatically sends a 103 Early Hints informational response with the specified Link header(s).
+ *
+ * @param options EarlyHintsOptions
+ * @returns MiddlewareHandler
+ */
+declare const earlyHints: <E extends Env = any>(options: EarlyHintsOptions<E>) => MiddlewareHandler<E>;
+//#endregion
+export { EarlyHintsOptions, earlyHints };

package/node_modules/@hono/node-server/dist/early-hints.mjs

@@ -0,0 +1,33 @@
+//#region src/early-hints.ts
+/**
+* Early Hints middleware for Node.js
+* Automatically sends a 103 Early Hints informational response with the specified Link header(s).
+*
+* @param options EarlyHintsOptions
+* @returns MiddlewareHandler
+*/
+const earlyHints = (options) => {
+	let warned = false;
+	return async (c, next) => {
+		const mode = c.req.header("Sec-Fetch-Mode");
+		const dest = c.req.header("Sec-Fetch-Dest");
+		if (mode && mode !== "navigate" || dest && dest !== "document") return next();
+		const env = c.env || {};
+		const outgoing = (env.server ? env.server : env)?.outgoing;
+		if (typeof outgoing?.writeEarlyHints !== "function") {
+			if (!warned) {
+				console.warn("Early Hints Middleware is not supported because writeEarlyHints is not defined.");
+				warned = true;
+			}
+			return await next();
+		}
+		if (!outgoing.headersSent) {
+			const link = typeof options.link === "function" ? options.link(c) : options.link;
+			if (link !== void 0 && (Array.isArray(link) ? link.length > 0 : Boolean(link))) outgoing.writeEarlyHints({ link });
+		}
+		await next();
+	};
+};
+
+//#endregion
+export { earlyHints };

package/node_modules/@hono/node-server/dist/index.cjs

@@ -193,8 +193,10 @@ const normalizeIncomingMethod = (method) => {
 		case "GET":
 		case "HEAD":
 		case "OPTIONS":
+		case "PATCH":
 		case "POST":
-		case "PUT": return method;
+		case "PUT":
+		case "QUERY": return method;
 	}
 	const upper = method.toUpperCase();
 	switch (upper) {
@@ -492,16 +494,15 @@ var Response$1 = class Response$1 {
 	constructor(body, init) {
 		let headers;
 		this.#body = body;
-		if (init instanceof Response$1) {
+		if (init instanceof GlobalResponse) {
 			const cachedGlobalResponse = init[responseCache];
 			if (cachedGlobalResponse) {
 				this.#init = cachedGlobalResponse;
 				this[getResponseCache]();
 				return;
-			} else {
-				this.#init = init.#init;
-				headers = new Headers(init.headers);
 			}
+			this.#init = init instanceof Response$1 ? init.#init : init;
+			headers = new Headers(init.headers);
 		} else this.#init = init;
 		if (body == null || typeof body === "string" || typeof body?.getReader !== "undefined" || body instanceof Blob || body instanceof Uint8Array) this[cacheKey] = [
 			init?.status || 200,
@@ -683,7 +684,10 @@ const drainIncoming = (incoming) => {
 	const forceClose = () => {
 		cleanup();
 		const socket = incoming.socket;
-		if (socket && !socket.destroyed) socket.destroySoon();
+		if (socket && !socket.destroyed) {
+			if (typeof socket.destroySoon === "function") socket.destroySoon();
+			else if (typeof socket.destroy === "function") socket.destroy();
+		}
 	};
 	const timer = setTimeout(forceClose, DRAIN_TIMEOUT_MS);
 	timer.unref?.();

package/node_modules/@hono/node-server/dist/index.mjs

@@ -192,8 +192,10 @@ const normalizeIncomingMethod = (method) => {
 		case "GET":
 		case "HEAD":
 		case "OPTIONS":
+		case "PATCH":
 		case "POST":
-		case "PUT": return method;
+		case "PUT":
+		case "QUERY": return method;
 	}
 	const upper = method.toUpperCase();
 	switch (upper) {
@@ -491,16 +493,15 @@ var Response$1 = class Response$1 {
 	constructor(body, init) {
 		let headers;
 		this.#body = body;
-		if (init instanceof Response$1) {
+		if (init instanceof GlobalResponse) {
 			const cachedGlobalResponse = init[responseCache];
 			if (cachedGlobalResponse) {
 				this.#init = cachedGlobalResponse;
 				this[getResponseCache]();
 				return;
-			} else {
-				this.#init = init.#init;
-				headers = new Headers(init.headers);
 			}
+			this.#init = init instanceof Response$1 ? init.#init : init;
+			headers = new Headers(init.headers);
 		} else this.#init = init;
 		if (body == null || typeof body === "string" || typeof body?.getReader !== "undefined" || body instanceof Blob || body instanceof Uint8Array) this[cacheKey] = [
 			init?.status || 200,
@@ -682,7 +683,10 @@ const drainIncoming = (incoming) => {
 	const forceClose = () => {
 		cleanup();
 		const socket = incoming.socket;
-		if (socket && !socket.destroyed) socket.destroySoon();
+		if (socket && !socket.destroyed) {
+			if (typeof socket.destroySoon === "function") socket.destroySoon();
+			else if (typeof socket.destroy === "function") socket.destroy();
+		}
 	};
 	const timer = setTimeout(forceClose, DRAIN_TIMEOUT_MS);
 	timer.unref?.();

package/node_modules/@hono/node-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hono/node-server",
-  "version": "2.0.10",
+  "version": "2.1.0",
   "description": "Node.js Adapter for Hono",
   "main": "dist/index.mjs",
   "type": "module",
@@ -48,6 +48,16 @@
         "types": "./dist/conninfo.d.cts",
         "default": "./dist/conninfo.cjs"
       }
+    },
+    "./early-hints": {
+      "import": {
+        "types": "./dist/early-hints.d.mts",
+        "default": "./dist/early-hints.mjs"
+      },
+      "require": {
+        "types": "./dist/early-hints.d.cts",
+        "default": "./dist/early-hints.cjs"
+      }
     }
   },
   "typesVersions": {
@@ -63,6 +73,9 @@
       ],
       "conninfo": [
         "./dist/conninfo.d.mts"
+      ],
+      "early-hints": [
+        "./dist/early-hints.d.mts"
       ]
     }
   },
@@ -84,7 +97,6 @@
   "devDependencies": {
     "@hono/eslint-config": "^1.0.1",
     "@types/node": "^20.10.0",
-    "@types/supertest": "^2.0.12",
     "@types/ws": "^8.18.1",
     "@whatwg-node/fetch": "^0.9.14",
     "eslint": "^9.10.0",
@@ -92,7 +104,6 @@
     "np": "^11.2.1",
     "prettier": "^3.2.4",
     "publint": "^0.3.18",
-    "supertest": "^7.2.2",
     "tsdown": "^0.20.3",
     "typescript": "^5.3.2",
     "vitest": "^4.0.18",

package/node_modules/@pome-sh/sdk/dist/check-state-path.d.ts

@@ -0,0 +1,71 @@
+import type { CheckDefinition } from "./checks.js";
+/**
+ * A pointer from the ROOT of the exported tree.
+ *
+ * Numbers are array indices and strings are object keys, but this function does
+ * not enforce that — the tree decides, at resolution time. Passing no segments
+ * returns `""`, which RFC 6901 defines as the whole document; a check with
+ * nothing narrower to name must OMIT `evidenceStatePaths` rather than cite the
+ * root, for the same reason it must omit rather than send `[]`.
+ */
+export declare function statePath(...segments: readonly (string | number)[]): string;
+/**
+ * A pointer relative to one a resolver already built.
+ *
+ * The twins' `resolve*` helpers walk the tree to find an entity and now hand
+ * back the pointer they walked; a check appends the field it went on to read.
+ * Written as its own function rather than string concatenation at 37 call sites
+ * because the escaping has to happen on the appended segments and NOT on the
+ * base, which already contains real `/` separators — concatenating by hand is
+ * how a `~1` ends up double-encoded.
+ */
+export declare function childStatePath(base: string, ...segments: readonly (string | number)[]): string;
+/**
+ * What a pointer addresses in a tree, or `null` when it addresses nothing.
+ *
+ * `null` is a NORMAL answer and every caller must handle it: the state blob a
+ * report renders can be a different export from the one the check read (a
+ * re-run, a truncated upload, a snapshot predating a field). A consumer turns
+ * `null` into "no affordance", exactly as `findEventIndexForEvidence` turns an
+ * unresolvable event id into one.
+ *
+ * Wrapped in `{ value }` rather than returned bare because `undefined` and
+ * `null` are both legal JSON-ish values a tree can hold at a pointer, and a bare
+ * return could not tell "the path is absent" from "the path holds null" — the
+ * difference between no evidence and evidence that the field is empty.
+ */
+export declare function resolveStatePath(tree: unknown, pointer: string): {
+    value: unknown;
+} | null;
+export type StateCitationArm = "passing" | "failing";
+export type StateCitationVerdict = {
+    kind: "cites";
+} | {
+    kind: "declined";
+} | {
+    kind: "uncited";
+    arm: StateCitationArm;
+} | {
+    kind: "unresolvable";
+    arm: StateCitationArm;
+    pointer: string;
+} | {
+    kind: "malformed";
+    arm: StateCitationArm;
+    detail: string;
+};
+/**
+ * Does this state-reading check say WHERE it looked, in a form that resolves?
+ *
+ * Probes BOTH arms, and that is deliberate. A citation present on the passing
+ * world and absent on the failing one is worse than no citation at all: its
+ * absence starts reading as a verdict class — "no evidence" would come to mean
+ * "this one failed" — and the reader has no way to know that is an accident of
+ * how the predicate was written. So a check must be able to say where it looked
+ * whether or not it liked what it found there.
+ *
+ * Only meaningful for `final` / `seed+final` checks. A `tape` check cites
+ * `evidenceEventIds` instead and is not this gate's business; callers filter on
+ * `substrate` before probing.
+ */
+export declare function probeStateCitation<TState, TArgs extends Record<string, string>>(def: CheckDefinition<TState, TArgs>, args: TArgs): StateCitationVerdict;