@moonsjs/mcp 0.1.4 → 0.1.6

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 RamonymousDev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env bun
 import {
   createMcpServer2
-} from "./index-vh7a3f8x.js";
+} from "./index-1dvwmjam.js";
 
 // src/cli.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

package/dist/{index-vh7a3f8x.js → index-1dvwmjam.js}

@@ -3,12 +3,14 @@ import { MOONS_ERROR_CODES, findErrorEntry } from "@moonsjs/core";
 import {
   collectFns,
   collectRoutes,
-  executeCheck
+  executeAudit,
+  executeCheck,
+  runTypegen
 } from "@moonsjs/cli";
 import { existsSync, readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
-var CONTEXT_URL2 = "https://raw.githubusercontent.com/moonsjs/docs/main/docs/ai/CONTEXT.md";
+var CONTEXT_URL2 = "https://raw.githubusercontent.com/moonsjs/docs/main/ai/CONTEXT.md";
 var CONTEXT_URLS2 = [
   "https://docs.devmoon.net/raw/ai/CONTEXT.md",
   "https://moonsjs-docs.pages.dev/raw/ai/CONTEXT.md",
@@ -95,6 +97,11 @@ function createTools2(options) {
         ...entry === undefined ? {} : { entry },
         validCodes: [...MOONS_ERROR_CODES]
       };
+    },
+    audit: () => executeAudit(options.cwd, { env: process.env }),
+    runTypegen: async () => {
+      await runTypegen(options.cwd);
+      return { ok: true, outDir: ".moons" };
     }
   };
 }
@@ -132,6 +139,12 @@ function createMcpServer2(options) {
     description: "Search the Moons agent context pack (docs/ai/CONTEXT.md) by substring; returns matching lines with their sections.",
     inputSchema: { query: z.string().describe("substring to search (case-insensitive)") }
   }, ({ query }) => guard(() => tools.searchDocs(query)));
+  server.registerTool("audit", {
+    description: "Security audit: serverFn inventory, env() access map, cookie flags, CSP, and a dist/client scan for env-like secrets (Addendum H)."
+  }, () => guard(() => tools.audit()));
+  server.registerTool("run_typegen", {
+    description: "Run typegen: writes .moons/routes.d.ts + .moons/context.d.ts for the app in cwd."
+  }, () => guard(() => tools.runTypegen()));
   server.registerTool("explain_error", {
     description: "Explain a Moons error code (format [moons] E_...): trigger, details, and fix suggestions. Returns found=false + validCodes for unknown codes.",
     inputSchema: { code: z.string().describe("error code, e.g. E_SERVER_IMPORT_IN_CLIENT") }
@@ -141,4 +154,4 @@ function createMcpServer2(options) {
 
 export { CONTEXT_URL2, CONTEXT_URLS2, localContextPath2, searchMarkdown2, createTools2, createMcpServer2 };
 
-//# debugId=4DC9435A96ACE45F64756E2164756E21
+//# debugId=BB6FE56753A6356A64756E2164756E21

package/dist/index-1dvwmjam.js.map

@@ -0,0 +1,11 @@
+{
+  "version": 3,
+  "sources": ["../src/tools.ts", "../src/server.ts"],
+  "sourcesContent": [
+    "import { MOONS_ERROR_CODES, findErrorEntry, type ErrorCatalogEntry } from \"@moonsjs/core\";\nimport {\n  collectFns,\n  collectRoutes,\n  executeAudit,\n  executeCheck,\n  runTypegen,\n  type AuditJson,\n  type CheckJson,\n  type FnsJson,\n  type RoutesJson,\n} from \"@moonsjs/cli\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport { dirname, join } from \"node:path\";\n\n/** Sumber teks konteks framework (default: lokal dulu, lalu GitHub raw). */\nexport type ContextFetcher = () => Promise<string>;\n\n export const CONTEXT_URL =\n  \"https://raw.githubusercontent.com/moonsjs/docs/main/ai/CONTEXT.md\";\n\n/** Rantai fallback remote: situs docs → pages.dev → GitHub raw (repo docs). */\nexport const CONTEXT_URLS: readonly string[] = [\n  \"https://docs.devmoon.net/raw/ai/CONTEXT.md\",\n  \"https://moonsjs-docs.pages.dev/raw/ai/CONTEXT.md\",\n  CONTEXT_URL,\n];\n\n/** Path konteks offline di paket `@moonsjs/cli`, dari entry yang di-resolve. */\nexport function localContextPath(cliEntry: string): string {\n  return join(dirname(cliEntry), \"..\", \"docs\", \"ai\", \"CONTEXT.md\");\n}\n\nfunction readLocalContext(): { source: string; text: string } | null {\n  try {\n    const entry = createRequire(import.meta.url).resolve(\"@moonsjs/cli\");\n    const path = localContextPath(entry);\n    if (existsSync(path)) {\n      return { source: `local:${path}`, text: readFileSync(path, \"utf8\") };\n    }\n  } catch {\n    // fallthrough ke remote\n  }\n  return null;\n}\n\nasync function defaultLoadContext(): Promise<{ source: string; text: string }> {\n  const local = readLocalContext();\n  if (local !== null) {\n    return local;\n  }\n  let lastError: unknown = null;\n  for (const url of CONTEXT_URLS) {\n    try {\n      const response = await fetch(url);\n      if (!response.ok) {\n        throw new Error(`HTTP ${response.status}`);\n      }\n      return { source: url, text: await response.text() };\n    } catch (error) {\n      lastError = error;\n    }\n  }\n  throw new Error(\n    `gagal mengambil konteks dari ${CONTEXT_URLS.join(\" dan \")}: ${String(lastError)}`,\n  );\n}\n\nexport interface DocMatch {\n  /** Judul section terakhir sebelum baris ini. */\n  section: string;\n  /** Nomor baris (1-based) di CONTEXT.md. */\n  line: number;\n  text: string;\n}\n\nexport interface SearchDocsResult {\n  source: string;\n  query: string;\n  matches: DocMatch[];\n}\n\nexport interface ExplainErrorResult {\n  code: string;\n  found: boolean;\n  entry?: ErrorCatalogEntry;\n  validCodes: string[];\n}\n\nexport interface Toolset {\n  listRoutes: () => Promise<RoutesJson>;\n  getFnRegistry: () => Promise<FnsJson>;\n  runCheck: () => Promise<CheckJson>;\n  searchDocs: (query: string) => Promise<SearchDocsResult>;\n  /** Addendum B.6: kode error §15 → pemicu + saran. */\n  explainError: (code: string) => Promise<ExplainErrorResult>;\n  /** Addendum H: audit keamanan (RPC/env/cookie/CSP/dist) machine-readable. */\n  audit: () => Promise<AuditJson>;\n  /** Addendum H: jalankan typegen (`.moons/*.d.ts`). */\n  runTypegen: () => Promise<{ ok: true; outDir: string }>;\n}\n\nexport interface ToolsetOptions {\n  cwd: string;\n  fetchContext?: ContextFetcher;\n}\n\n/** Pencarian substring case-insensitive atas markdown; returns baris + section. */\nexport function searchMarkdown(text: string, query: string, limit = 20): DocMatch[] {\n  const needle = query.trim().toLowerCase();\n  if (needle.length === 0) {\n    return [];\n  }\n\n  const lines = text.split(\"\\n\");\n  const matches: DocMatch[] = [];\n  let section = \"(top)\";\n\n  for (let index = 0; index < lines.length; index += 1) {\n    const line = lines[index] as string;\n    const heading = /^#{1,6}\\s+(.*)$/.exec(line);\n    if (heading !== null) {\n      section = (heading[1] ?? \"\").trim();\n    }\n    if (line.toLowerCase().includes(needle)) {\n      matches.push({ section, line: index + 1, text: line.trim() });\n      if (matches.length >= limit) {\n        break;\n      }\n    }\n  }\n\n  return matches;\n}\n\n/** Toolset MCP (Addendum A.7) — deterministik, tanpa panggilan LLM. */\nexport function createTools(options: ToolsetOptions): Toolset {\n  const loadContext =\n    options.fetchContext === undefined\n      ? defaultLoadContext\n      : async (): Promise<{ source: string; text: string }> => ({\n          source: CONTEXT_URL,\n          text: await (options.fetchContext as ContextFetcher)(),\n        });\n  let cached: { source: string; text: string } | null = null;\n\n  return {\n    listRoutes: () => collectRoutes(options.cwd),\n    getFnRegistry: () => Promise.resolve(collectFns(options.cwd)),\n    runCheck: () => executeCheck(options.cwd, { quiet: true }),\n    searchDocs: async (query: string): Promise<SearchDocsResult> => {\n      if (cached === null) {\n        cached = await loadContext();\n      }\n      return { source: cached.source, query, matches: searchMarkdown(cached.text, query) };\n    },\n    explainError: async (code: string): Promise<ExplainErrorResult> => {\n      const normalized = code.trim().toUpperCase();\n      const entry = findErrorEntry(normalized);\n      return {\n        code: normalized,\n        found: entry !== undefined,\n        ...(entry === undefined ? {} : { entry }),\n        validCodes: [...MOONS_ERROR_CODES],\n      };\n    },\n    audit: () => executeAudit(options.cwd, { env: process.env }),\n    runTypegen: async () => {\n      await runTypegen(options.cwd);\n      return { ok: true as const, outDir: \".moons\" };\n    },\n  };\n}\n",
+    "import { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport { z } from \"zod\";\nimport { createTools, type ToolsetOptions } from \"./tools\";\n\nfunction jsonContent(value: unknown, isError = false): {\n  content: Array<{ type: \"text\"; text: string }>;\n  isError?: boolean;\n} {\n  return {\n    content: [{ type: \"text\", text: JSON.stringify(value, null, 2) }],\n    ...(isError ? { isError: true } : {}),\n  };\n}\n\nasync function guard(\n  run: () => Promise<unknown>,\n): Promise<{ content: Array<{ type: \"text\"; text: string }>; isError?: boolean }> {\n  try {\n    return jsonContent(await run());\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    return jsonContent({ ok: false, error: message }, true);\n  }\n}\n\n/** Bangun MCP server `moons` (stdio) untuk satu project (Addendum A.7). */\nexport function createMcpServer(options: ToolsetOptions): McpServer {\n  const tools = createTools(options);\n  const server = new McpServer({ name: \"moons\", version: \"0.1.0\" });\n\n  server.registerTool(\n    \"list_routes\",\n    {\n      description:\n        \"Route table of the Moons app (path, file, key, kind, params, layouts) — scanned, no build needed.\",\n    },\n    () => guard(() => tools.listRoutes()),\n  );\n\n  server.registerTool(\n    \"get_fn_registry\",\n    {\n      description:\n        \"serverFn registry of the Moons app (file#export → hash, line) plus the registry map written to .moons/fn-registry.json.\",\n    },\n    () => guard(() => tools.getFnRegistry()),\n  );\n\n  server.registerTool(\n    \"run_check\",\n    {\n      description:\n        \"Definition of done: typegen → tsc --noEmit → build client → build server. Returns { ok, steps }.\",\n    },\n    () => guard(() => tools.runCheck()),\n  );\n\n  server.registerTool(\n    \"search_docs\",\n    {\n      description:\n        \"Search the Moons agent context pack (docs/ai/CONTEXT.md) by substring; returns matching lines with their sections.\",\n      inputSchema: { query: z.string().describe(\"substring to search (case-insensitive)\") },\n    },\n    ({ query }) => guard(() => tools.searchDocs(query)),\n  );\n\n  server.registerTool(\n    \"audit\",\n    {\n      description:\n        \"Security audit: serverFn inventory, env() access map, cookie flags, CSP, and a dist/client scan for env-like secrets (Addendum H).\",\n    },\n    () => guard(() => tools.audit()),\n  );\n\n  server.registerTool(\n    \"run_typegen\",\n    {\n      description:\n        \"Run typegen: writes .moons/routes.d.ts + .moons/context.d.ts for the app in cwd.\",\n    },\n    () => guard(() => tools.runTypegen()),\n  );\n\n  server.registerTool(\n    \"explain_error\",\n    {\n      description:\n        \"Explain a Moons error code (format [moons] E_...): trigger, details, and fix suggestions. Returns found=false + validCodes for unknown codes.\",\n      inputSchema: { code: z.string().describe(\"error code, e.g. E_SERVER_IMPORT_IN_CLIENT\") },\n    },\n    ({ code }) => guard(() => tools.explainError(code)),\n  );\n\n  return server;\n}\n"
+  ],
+  "mappings": ";AAAA;AACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWA;AACA;AACA;AAKQ,IAAM,eACZ;AAGK,IAAM,gBAAkC;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AACF;AAGO,SAAS,iBAAgB,CAAC,UAA0B;AAAA,EACzD,OAAO,KAAK,QAAQ,QAAQ,GAAG,MAAM,QAAQ,MAAM,YAAY;AAAA;AAGjE,SAAS,gBAAgB,GAA4C;AAAA,EACnE,IAAI;AAAA,IACF,MAAM,QAAQ,cAAc,YAAY,GAAG,EAAE,QAAQ,cAAc;AAAA,IACnE,MAAM,OAAO,kBAAiB,KAAK;AAAA,IACnC,IAAI,WAAW,IAAI,GAAG;AAAA,MACpB,OAAO,EAAE,QAAQ,SAAS,QAAQ,MAAM,aAAa,MAAM,MAAM,EAAE;AAAA,IACrE;AAAA,IACA,MAAM;AAAA,EAGR,OAAO;AAAA;AAGT,eAAe,kBAAkB,GAA8C;AAAA,EAC7E,MAAM,QAAQ,iBAAiB;AAAA,EAC/B,IAAI,UAAU,MAAM;AAAA,IAClB,OAAO;AAAA,EACT;AAAA,EACA,IAAI,YAAqB;AAAA,EACzB,WAAW,OAAO,eAAc;AAAA,IAC9B,IAAI;AAAA,MACF,MAAM,WAAW,MAAM,MAAM,GAAG;AAAA,MAChC,IAAI,CAAC,SAAS,IAAI;AAAA,QAChB,MAAM,IAAI,MAAM,QAAQ,SAAS,QAAQ;AAAA,MAC3C;AAAA,MACA,OAAO,EAAE,QAAQ,KAAK,MAAM,MAAM,SAAS,KAAK,EAAE;AAAA,MAClD,OAAO,OAAO;AAAA,MACd,YAAY;AAAA;AAAA,EAEhB;AAAA,EACA,MAAM,IAAI,MACR,gCAAgC,cAAa,KAAK,OAAO,MAAM,OAAO,SAAS,GACjF;AAAA;AA2CK,SAAS,eAAc,CAAC,MAAc,OAAe,QAAQ,IAAgB;AAAA,EAClF,MAAM,SAAS,MAAM,KAAK,EAAE,YAAY;AAAA,EACxC,IAAI,OAAO,WAAW,GAAG;AAAA,IACvB,OAAO,CAAC;AAAA,EACV;AAAA,EAEA,MAAM,QAAQ,KAAK,MAAM;AAAA,CAAI;AAAA,EAC7B,MAAM,UAAsB,CAAC;AAAA,EAC7B,IAAI,UAAU;AAAA,EAEd,SAAS,QAAQ,EAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AAAA,IACpD,MAAM,OAAO,MAAM;AAAA,IACnB,MAAM,UAAU,kBAAkB,KAAK,IAAI;AAAA,IAC3C,IAAI,YAAY,MAAM;AAAA,MACpB,WAAW,QAAQ,MAAM,IAAI,KAAK;AAAA,IACpC;AAAA,IACA,IAAI,KAAK,YAAY,EAAE,SAAS,MAAM,GAAG;AAAA,MACvC,QAAQ,KAAK,EAAE,SAAS,MAAM,QAAQ,GAAG,MAAM,KAAK,KAAK,EAAE,CAAC;AAAA,MAC5D,IAAI,QAAQ,UAAU,OAAO;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA;AAIF,SAAS,YAAW,CAAC,SAAkC;AAAA,EAC5D,MAAM,cACJ,QAAQ,iBAAiB,YACrB,qBACA,aAAwD;AAAA,IACtD,QAAQ;AAAA,IACR,MAAM,MAAO,QAAQ,aAAgC;AAAA,EACvD;AAAA,EACN,IAAI,SAAkD;AAAA,EAEtD,OAAO;AAAA,IACL,YAAY,MAAM,cAAc,QAAQ,GAAG;AAAA,IAC3C,eAAe,MAAM,QAAQ,QAAQ,WAAW,QAAQ,GAAG,CAAC;AAAA,IAC5D,UAAU,MAAM,aAAa,QAAQ,KAAK,EAAE,OAAO,KAAK,CAAC;AAAA,IACzD,YAAY,OAAO,UAA6C;AAAA,MAC9D,IAAI,WAAW,MAAM;AAAA,QACnB,SAAS,MAAM,YAAY;AAAA,MAC7B;AAAA,MACA,OAAO,EAAE,QAAQ,OAAO,QAAQ,OAAO,SAAS,gBAAe,OAAO,MAAM,KAAK,EAAE;AAAA;AAAA,IAErF,cAAc,OAAO,SAA8C;AAAA,MACjE,MAAM,aAAa,KAAK,KAAK,EAAE,YAAY;AAAA,MAC3C,MAAM,QAAQ,eAAe,UAAU;AAAA,MACvC,OAAO;AAAA,QACL,MAAM;AAAA,QACN,OAAO,UAAU;AAAA,WACb,UAAU,YAAY,CAAC,IAAI,EAAE,MAAM;AAAA,QACvC,YAAY,CAAC,GAAG,iBAAiB;AAAA,MACnC;AAAA;AAAA,IAEF,OAAO,MAAM,aAAa,QAAQ,KAAK,EAAE,KAAK,QAAQ,IAAI,CAAC;AAAA,IAC3D,YAAY,YAAY;AAAA,MACtB,MAAM,WAAW,QAAQ,GAAG;AAAA,MAC5B,OAAO,EAAE,IAAI,MAAe,QAAQ,SAAS;AAAA;AAAA,EAEjD;AAAA;;;AC5KF;AACA;AAGA,SAAS,WAAW,CAAC,OAAgB,UAAU,OAG7C;AAAA,EACA,OAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,CAAC;AAAA,OAC5D,UAAU,EAAE,SAAS,KAAK,IAAI,CAAC;AAAA,EACrC;AAAA;AAGF,eAAe,KAAK,CAClB,KACgF;AAAA,EAChF,IAAI;AAAA,IACF,OAAO,YAAY,MAAM,IAAI,CAAC;AAAA,IAC9B,OAAO,OAAO;AAAA,IACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACrE,OAAO,YAAY,EAAE,IAAI,OAAO,OAAO,QAAQ,GAAG,IAAI;AAAA;AAAA;AAKnD,SAAS,gBAAe,CAAC,SAAoC;AAAA,EAClE,MAAM,QAAQ,aAAY,OAAO;AAAA,EACjC,MAAM,SAAS,IAAI,UAAU,EAAE,MAAM,SAAS,SAAS,QAAQ,CAAC;AAAA,EAEhE,OAAO,aACL,eACA;AAAA,IACE,aACE;AAAA,EACJ,GACA,MAAM,MAAM,MAAM,MAAM,WAAW,CAAC,CACtC;AAAA,EAEA,OAAO,aACL,mBACA;AAAA,IACE,aACE;AAAA,EACJ,GACA,MAAM,MAAM,MAAM,MAAM,cAAc,CAAC,CACzC;AAAA,EAEA,OAAO,aACL,aACA;AAAA,IACE,aACE;AAAA,EACJ,GACA,MAAM,MAAM,MAAM,MAAM,SAAS,CAAC,CACpC;AAAA,EAEA,OAAO,aACL,eACA;AAAA,IACE,aACE;AAAA,IACF,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,wCAAwC,EAAE;AAAA,EACtF,GACA,GAAG,YAAY,MAAM,MAAM,MAAM,WAAW,KAAK,CAAC,CACpD;AAAA,EAEA,OAAO,aACL,SACA;AAAA,IACE,aACE;AAAA,EACJ,GACA,MAAM,MAAM,MAAM,MAAM,MAAM,CAAC,CACjC;AAAA,EAEA,OAAO,aACL,eACA;AAAA,IACE,aACE;AAAA,EACJ,GACA,MAAM,MAAM,MAAM,MAAM,WAAW,CAAC,CACtC;AAAA,EAEA,OAAO,aACL,iBACA;AAAA,IACE,aACE;AAAA,IACF,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,4CAA4C,EAAE;AAAA,EACzF,GACA,GAAG,WAAW,MAAM,MAAM,MAAM,aAAa,IAAI,CAAC,CACpD;AAAA,EAEA,OAAO;AAAA;",
+  "debugId": "BB6FE56753A6356A64756E2164756E21",
+  "names": []
+}

package/dist/index.js

@@ -5,7 +5,7 @@ import {
   searchMarkdown2,
   createTools2,
   createMcpServer2
-} from "./index-vh7a3f8x.js";
+} from "./index-1dvwmjam.js";
 export {
   CONTEXT_URL2 as CONTEXT_URL,
   CONTEXT_URLS2 as CONTEXT_URLS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moonsjs/mcp",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "type": "module",
   "license": "MIT",
   "sideEffects": false,
@@ -28,7 +28,8 @@
   },
   "scripts": {
     "prepack": "bun run build",
-    "build": "rm -rf dist && tsc -p tsconfig.json --emitDeclarationOnly && bun build src/index.ts src/cli.ts --outdir dist --target node --format esm --splitting --sourcemap=external --external @moonsjs/cli --external '@moonsjs/cli/*' --external @moonsjs/core --external '@moonsjs/core/*' --external @modelcontextprotocol/sdk --external '@modelcontextprotocol/sdk/*' --external zod"
+    "build": "rm -rf dist && tsc -p tsconfig.json --emitDeclarationOnly && bun build src/index.ts src/cli.ts --outdir dist --target node --format esm --splitting --sourcemap=external --external @moonsjs/cli --external '@moonsjs/cli/*' --external @moonsjs/core --external '@moonsjs/core/*' --external @modelcontextprotocol/sdk --external '@modelcontextprotocol/sdk/*' --external zod",
+    "test": "bun test"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.26.0",

package/src/server.ts

@@ -65,6 +65,24 @@ export function createMcpServer(options: ToolsetOptions): McpServer {
     ({ query }) => guard(() => tools.searchDocs(query)),
   );
 
+  server.registerTool(
+    "audit",
+    {
+      description:
+        "Security audit: serverFn inventory, env() access map, cookie flags, CSP, and a dist/client scan for env-like secrets (Addendum H).",
+    },
+    () => guard(() => tools.audit()),
+  );
+
+  server.registerTool(
+    "run_typegen",
+    {
+      description:
+        "Run typegen: writes .moons/routes.d.ts + .moons/context.d.ts for the app in cwd.",
+    },
+    () => guard(() => tools.runTypegen()),
+  );
+
   server.registerTool(
     "explain_error",
     {

package/src/tools.ts

@@ -2,7 +2,10 @@ import { MOONS_ERROR_CODES, findErrorEntry, type ErrorCatalogEntry } from "@moon
 import {
   collectFns,
   collectRoutes,
+  executeAudit,
   executeCheck,
+  runTypegen,
+  type AuditJson,
   type CheckJson,
   type FnsJson,
   type RoutesJson,
@@ -14,10 +17,10 @@ import { dirname, join } from "node:path";
 /** Sumber teks konteks framework (default: lokal dulu, lalu GitHub raw). */
 export type ContextFetcher = () => Promise<string>;
 
-export const CONTEXT_URL =
-  "https://raw.githubusercontent.com/moonsjs/docs/main/docs/ai/CONTEXT.md";
+ export const CONTEXT_URL =
+  "https://raw.githubusercontent.com/moonsjs/docs/main/ai/CONTEXT.md";
 
-/** Rantai fallback remote: situs docs → pages.dev → GitHub raw (mirror). */
+/** Rantai fallback remote: situs docs → pages.dev → GitHub raw (repo docs). */
 export const CONTEXT_URLS: readonly string[] = [
   "https://docs.devmoon.net/raw/ai/CONTEXT.md",
   "https://moonsjs-docs.pages.dev/raw/ai/CONTEXT.md",
@@ -92,6 +95,10 @@ export interface Toolset {
   searchDocs: (query: string) => Promise<SearchDocsResult>;
   /** Addendum B.6: kode error §15 → pemicu + saran. */
   explainError: (code: string) => Promise<ExplainErrorResult>;
+  /** Addendum H: audit keamanan (RPC/env/cookie/CSP/dist) machine-readable. */
+  audit: () => Promise<AuditJson>;
+  /** Addendum H: jalankan typegen (`.moons/*.d.ts`). */
+  runTypegen: () => Promise<{ ok: true; outDir: string }>;
 }
 
 export interface ToolsetOptions {
@@ -158,5 +165,10 @@ export function createTools(options: ToolsetOptions): Toolset {
         validCodes: [...MOONS_ERROR_CODES],
       };
     },
+    audit: () => executeAudit(options.cwd, { env: process.env }),
+    runTypegen: async () => {
+      await runTypegen(options.cwd);
+      return { ok: true as const, outDir: ".moons" };
+    },
   };
 }

package/dist/index-vh7a3f8x.js.map

@@ -1,11 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/tools.ts", "../src/server.ts"],
-  "sourcesContent": [
-    "import { MOONS_ERROR_CODES, findErrorEntry, type ErrorCatalogEntry } from \"@moonsjs/core\";\nimport {\n  collectFns,\n  collectRoutes,\n  executeCheck,\n  type CheckJson,\n  type FnsJson,\n  type RoutesJson,\n} from \"@moonsjs/cli\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport { dirname, join } from \"node:path\";\n\n/** Sumber teks konteks framework (default: lokal dulu, lalu GitHub raw). */\nexport type ContextFetcher = () => Promise<string>;\n\nexport const CONTEXT_URL =\n  \"https://raw.githubusercontent.com/moonsjs/docs/main/docs/ai/CONTEXT.md\";\n\n/** Rantai fallback remote: situs docs → pages.dev → GitHub raw (mirror). */\nexport const CONTEXT_URLS: readonly string[] = [\n  \"https://docs.devmoon.net/raw/ai/CONTEXT.md\",\n  \"https://moonsjs-docs.pages.dev/raw/ai/CONTEXT.md\",\n  CONTEXT_URL,\n];\n\n/** Path konteks offline di paket `@moonsjs/cli`, dari entry yang di-resolve. */\nexport function localContextPath(cliEntry: string): string {\n  return join(dirname(cliEntry), \"..\", \"docs\", \"ai\", \"CONTEXT.md\");\n}\n\nfunction readLocalContext(): { source: string; text: string } | null {\n  try {\n    const entry = createRequire(import.meta.url).resolve(\"@moonsjs/cli\");\n    const path = localContextPath(entry);\n    if (existsSync(path)) {\n      return { source: `local:${path}`, text: readFileSync(path, \"utf8\") };\n    }\n  } catch {\n    // fallthrough ke remote\n  }\n  return null;\n}\n\nasync function defaultLoadContext(): Promise<{ source: string; text: string }> {\n  const local = readLocalContext();\n  if (local !== null) {\n    return local;\n  }\n  let lastError: unknown = null;\n  for (const url of CONTEXT_URLS) {\n    try {\n      const response = await fetch(url);\n      if (!response.ok) {\n        throw new Error(`HTTP ${response.status}`);\n      }\n      return { source: url, text: await response.text() };\n    } catch (error) {\n      lastError = error;\n    }\n  }\n  throw new Error(\n    `gagal mengambil konteks dari ${CONTEXT_URLS.join(\" dan \")}: ${String(lastError)}`,\n  );\n}\n\nexport interface DocMatch {\n  /** Judul section terakhir sebelum baris ini. */\n  section: string;\n  /** Nomor baris (1-based) di CONTEXT.md. */\n  line: number;\n  text: string;\n}\n\nexport interface SearchDocsResult {\n  source: string;\n  query: string;\n  matches: DocMatch[];\n}\n\nexport interface ExplainErrorResult {\n  code: string;\n  found: boolean;\n  entry?: ErrorCatalogEntry;\n  validCodes: string[];\n}\n\nexport interface Toolset {\n  listRoutes: () => Promise<RoutesJson>;\n  getFnRegistry: () => Promise<FnsJson>;\n  runCheck: () => Promise<CheckJson>;\n  searchDocs: (query: string) => Promise<SearchDocsResult>;\n  /** Addendum B.6: kode error §15 → pemicu + saran. */\n  explainError: (code: string) => Promise<ExplainErrorResult>;\n}\n\nexport interface ToolsetOptions {\n  cwd: string;\n  fetchContext?: ContextFetcher;\n}\n\n/** Pencarian substring case-insensitive atas markdown; returns baris + section. */\nexport function searchMarkdown(text: string, query: string, limit = 20): DocMatch[] {\n  const needle = query.trim().toLowerCase();\n  if (needle.length === 0) {\n    return [];\n  }\n\n  const lines = text.split(\"\\n\");\n  const matches: DocMatch[] = [];\n  let section = \"(top)\";\n\n  for (let index = 0; index < lines.length; index += 1) {\n    const line = lines[index] as string;\n    const heading = /^#{1,6}\\s+(.*)$/.exec(line);\n    if (heading !== null) {\n      section = (heading[1] ?? \"\").trim();\n    }\n    if (line.toLowerCase().includes(needle)) {\n      matches.push({ section, line: index + 1, text: line.trim() });\n      if (matches.length >= limit) {\n        break;\n      }\n    }\n  }\n\n  return matches;\n}\n\n/** Toolset MCP (Addendum A.7) — deterministik, tanpa panggilan LLM. */\nexport function createTools(options: ToolsetOptions): Toolset {\n  const loadContext =\n    options.fetchContext === undefined\n      ? defaultLoadContext\n      : async (): Promise<{ source: string; text: string }> => ({\n          source: CONTEXT_URL,\n          text: await (options.fetchContext as ContextFetcher)(),\n        });\n  let cached: { source: string; text: string } | null = null;\n\n  return {\n    listRoutes: () => collectRoutes(options.cwd),\n    getFnRegistry: () => Promise.resolve(collectFns(options.cwd)),\n    runCheck: () => executeCheck(options.cwd, { quiet: true }),\n    searchDocs: async (query: string): Promise<SearchDocsResult> => {\n      if (cached === null) {\n        cached = await loadContext();\n      }\n      return { source: cached.source, query, matches: searchMarkdown(cached.text, query) };\n    },\n    explainError: async (code: string): Promise<ExplainErrorResult> => {\n      const normalized = code.trim().toUpperCase();\n      const entry = findErrorEntry(normalized);\n      return {\n        code: normalized,\n        found: entry !== undefined,\n        ...(entry === undefined ? {} : { entry }),\n        validCodes: [...MOONS_ERROR_CODES],\n      };\n    },\n  };\n}\n",
-    "import { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport { z } from \"zod\";\nimport { createTools, type ToolsetOptions } from \"./tools\";\n\nfunction jsonContent(value: unknown, isError = false): {\n  content: Array<{ type: \"text\"; text: string }>;\n  isError?: boolean;\n} {\n  return {\n    content: [{ type: \"text\", text: JSON.stringify(value, null, 2) }],\n    ...(isError ? { isError: true } : {}),\n  };\n}\n\nasync function guard(\n  run: () => Promise<unknown>,\n): Promise<{ content: Array<{ type: \"text\"; text: string }>; isError?: boolean }> {\n  try {\n    return jsonContent(await run());\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    return jsonContent({ ok: false, error: message }, true);\n  }\n}\n\n/** Bangun MCP server `moons` (stdio) untuk satu project (Addendum A.7). */\nexport function createMcpServer(options: ToolsetOptions): McpServer {\n  const tools = createTools(options);\n  const server = new McpServer({ name: \"moons\", version: \"0.1.0\" });\n\n  server.registerTool(\n    \"list_routes\",\n    {\n      description:\n        \"Route table of the Moons app (path, file, key, kind, params, layouts) — scanned, no build needed.\",\n    },\n    () => guard(() => tools.listRoutes()),\n  );\n\n  server.registerTool(\n    \"get_fn_registry\",\n    {\n      description:\n        \"serverFn registry of the Moons app (file#export → hash, line) plus the registry map written to .moons/fn-registry.json.\",\n    },\n    () => guard(() => tools.getFnRegistry()),\n  );\n\n  server.registerTool(\n    \"run_check\",\n    {\n      description:\n        \"Definition of done: typegen → tsc --noEmit → build client → build server. Returns { ok, steps }.\",\n    },\n    () => guard(() => tools.runCheck()),\n  );\n\n  server.registerTool(\n    \"search_docs\",\n    {\n      description:\n        \"Search the Moons agent context pack (docs/ai/CONTEXT.md) by substring; returns matching lines with their sections.\",\n      inputSchema: { query: z.string().describe(\"substring to search (case-insensitive)\") },\n    },\n    ({ query }) => guard(() => tools.searchDocs(query)),\n  );\n\n  server.registerTool(\n    \"explain_error\",\n    {\n      description:\n        \"Explain a Moons error code (format [moons] E_...): trigger, details, and fix suggestions. Returns found=false + validCodes for unknown codes.\",\n      inputSchema: { code: z.string().describe(\"error code, e.g. E_SERVER_IMPORT_IN_CLIENT\") },\n    },\n    ({ code }) => guard(() => tools.explainError(code)),\n  );\n\n  return server;\n}\n"
-  ],
-  "mappings": ";AAAA;AACA;AAAA;AAAA;AAAA;AAAA;AAQA;AACA;AACA;AAKO,IAAM,eACX;AAGK,IAAM,gBAAkC;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AACF;AAGO,SAAS,iBAAgB,CAAC,UAA0B;AAAA,EACzD,OAAO,KAAK,QAAQ,QAAQ,GAAG,MAAM,QAAQ,MAAM,YAAY;AAAA;AAGjE,SAAS,gBAAgB,GAA4C;AAAA,EACnE,IAAI;AAAA,IACF,MAAM,QAAQ,cAAc,YAAY,GAAG,EAAE,QAAQ,cAAc;AAAA,IACnE,MAAM,OAAO,kBAAiB,KAAK;AAAA,IACnC,IAAI,WAAW,IAAI,GAAG;AAAA,MACpB,OAAO,EAAE,QAAQ,SAAS,QAAQ,MAAM,aAAa,MAAM,MAAM,EAAE;AAAA,IACrE;AAAA,IACA,MAAM;AAAA,EAGR,OAAO;AAAA;AAGT,eAAe,kBAAkB,GAA8C;AAAA,EAC7E,MAAM,QAAQ,iBAAiB;AAAA,EAC/B,IAAI,UAAU,MAAM;AAAA,IAClB,OAAO;AAAA,EACT;AAAA,EACA,IAAI,YAAqB;AAAA,EACzB,WAAW,OAAO,eAAc;AAAA,IAC9B,IAAI;AAAA,MACF,MAAM,WAAW,MAAM,MAAM,GAAG;AAAA,MAChC,IAAI,CAAC,SAAS,IAAI;AAAA,QAChB,MAAM,IAAI,MAAM,QAAQ,SAAS,QAAQ;AAAA,MAC3C;AAAA,MACA,OAAO,EAAE,QAAQ,KAAK,MAAM,MAAM,SAAS,KAAK,EAAE;AAAA,MAClD,OAAO,OAAO;AAAA,MACd,YAAY;AAAA;AAAA,EAEhB;AAAA,EACA,MAAM,IAAI,MACR,gCAAgC,cAAa,KAAK,OAAO,MAAM,OAAO,SAAS,GACjF;AAAA;AAuCK,SAAS,eAAc,CAAC,MAAc,OAAe,QAAQ,IAAgB;AAAA,EAClF,MAAM,SAAS,MAAM,KAAK,EAAE,YAAY;AAAA,EACxC,IAAI,OAAO,WAAW,GAAG;AAAA,IACvB,OAAO,CAAC;AAAA,EACV;AAAA,EAEA,MAAM,QAAQ,KAAK,MAAM;AAAA,CAAI;AAAA,EAC7B,MAAM,UAAsB,CAAC;AAAA,EAC7B,IAAI,UAAU;AAAA,EAEd,SAAS,QAAQ,EAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AAAA,IACpD,MAAM,OAAO,MAAM;AAAA,IACnB,MAAM,UAAU,kBAAkB,KAAK,IAAI;AAAA,IAC3C,IAAI,YAAY,MAAM;AAAA,MACpB,WAAW,QAAQ,MAAM,IAAI,KAAK;AAAA,IACpC;AAAA,IACA,IAAI,KAAK,YAAY,EAAE,SAAS,MAAM,GAAG;AAAA,MACvC,QAAQ,KAAK,EAAE,SAAS,MAAM,QAAQ,GAAG,MAAM,KAAK,KAAK,EAAE,CAAC;AAAA,MAC5D,IAAI,QAAQ,UAAU,OAAO;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA;AAIF,SAAS,YAAW,CAAC,SAAkC;AAAA,EAC5D,MAAM,cACJ,QAAQ,iBAAiB,YACrB,qBACA,aAAwD;AAAA,IACtD,QAAQ;AAAA,IACR,MAAM,MAAO,QAAQ,aAAgC;AAAA,EACvD;AAAA,EACN,IAAI,SAAkD;AAAA,EAEtD,OAAO;AAAA,IACL,YAAY,MAAM,cAAc,QAAQ,GAAG;AAAA,IAC3C,eAAe,MAAM,QAAQ,QAAQ,WAAW,QAAQ,GAAG,CAAC;AAAA,IAC5D,UAAU,MAAM,aAAa,QAAQ,KAAK,EAAE,OAAO,KAAK,CAAC;AAAA,IACzD,YAAY,OAAO,UAA6C;AAAA,MAC9D,IAAI,WAAW,MAAM;AAAA,QACnB,SAAS,MAAM,YAAY;AAAA,MAC7B;AAAA,MACA,OAAO,EAAE,QAAQ,OAAO,QAAQ,OAAO,SAAS,gBAAe,OAAO,MAAM,KAAK,EAAE;AAAA;AAAA,IAErF,cAAc,OAAO,SAA8C;AAAA,MACjE,MAAM,aAAa,KAAK,KAAK,EAAE,YAAY;AAAA,MAC3C,MAAM,QAAQ,eAAe,UAAU;AAAA,MACvC,OAAO;AAAA,QACL,MAAM;AAAA,QACN,OAAO,UAAU;AAAA,WACb,UAAU,YAAY,CAAC,IAAI,EAAE,MAAM;AAAA,QACvC,YAAY,CAAC,GAAG,iBAAiB;AAAA,MACnC;AAAA;AAAA,EAEJ;AAAA;;;AChKF;AACA;AAGA,SAAS,WAAW,CAAC,OAAgB,UAAU,OAG7C;AAAA,EACA,OAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,CAAC;AAAA,OAC5D,UAAU,EAAE,SAAS,KAAK,IAAI,CAAC;AAAA,EACrC;AAAA;AAGF,eAAe,KAAK,CAClB,KACgF;AAAA,EAChF,IAAI;AAAA,IACF,OAAO,YAAY,MAAM,IAAI,CAAC;AAAA,IAC9B,OAAO,OAAO;AAAA,IACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACrE,OAAO,YAAY,EAAE,IAAI,OAAO,OAAO,QAAQ,GAAG,IAAI;AAAA;AAAA;AAKnD,SAAS,gBAAe,CAAC,SAAoC;AAAA,EAClE,MAAM,QAAQ,aAAY,OAAO;AAAA,EACjC,MAAM,SAAS,IAAI,UAAU,EAAE,MAAM,SAAS,SAAS,QAAQ,CAAC;AAAA,EAEhE,OAAO,aACL,eACA;AAAA,IACE,aACE;AAAA,EACJ,GACA,MAAM,MAAM,MAAM,MAAM,WAAW,CAAC,CACtC;AAAA,EAEA,OAAO,aACL,mBACA;AAAA,IACE,aACE;AAAA,EACJ,GACA,MAAM,MAAM,MAAM,MAAM,cAAc,CAAC,CACzC;AAAA,EAEA,OAAO,aACL,aACA;AAAA,IACE,aACE;AAAA,EACJ,GACA,MAAM,MAAM,MAAM,MAAM,SAAS,CAAC,CACpC;AAAA,EAEA,OAAO,aACL,eACA;AAAA,IACE,aACE;AAAA,IACF,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,wCAAwC,EAAE;AAAA,EACtF,GACA,GAAG,YAAY,MAAM,MAAM,MAAM,WAAW,KAAK,CAAC,CACpD;AAAA,EAEA,OAAO,aACL,iBACA;AAAA,IACE,aACE;AAAA,IACF,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,4CAA4C,EAAE;AAAA,EACzF,GACA,GAAG,WAAW,MAAM,MAAM,MAAM,aAAa,IAAI,CAAC,CACpD;AAAA,EAEA,OAAO;AAAA;",
-  "debugId": "4DC9435A96ACE45F64756E2164756E21",
-  "names": []
-}