@obov/mext 0.4.0 → 0.6.0

package/dist/cli/dev-lock.js

@@ -1,5 +1,7 @@
 import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
+/** 잠금 파일 권한: 소유자만 (auditToken 이 들어 있다) */
+const LOCK_MODE = 0o600;
 /** <cwd>/.mext/dev/lock */
 export function devLockPath(cwd) {
     return join(resolve(cwd), ".mext", "dev", "lock");
@@ -13,13 +15,13 @@ export function readDevLock(cwd) {
  * 잠금 획득 (O_EXCL 생성). 이미 살아 있는 다른 프로세스의 잠금 = { running }.
  * 죽은 pid · 깨진 파일 = 오래된 잠금으로 보고 교체
  */
-export function acquireDevLock(cwd, url = null) {
+export function acquireDevLock(cwd, url = null, auditToken) {
     const path = devLockPath(cwd);
     mkdirSync(dirname(path), { recursive: true });
-    const lock = { pid: process.pid, url, startedAt: new Date().toISOString() };
+    const lock = { pid: process.pid, url, startedAt: new Date().toISOString(), ...(auditToken !== undefined ? { auditToken } : {}) };
     for (let attempt = 0;; attempt++) {
         try {
-            writeFileSync(path, `${JSON.stringify(lock)}\n`, { flag: "wx" });
+            writeFileSync(path, `${JSON.stringify(lock)}\n`, { flag: "wx", mode: LOCK_MODE });
             return { acquired: lock };
         }
         catch (error) {
@@ -36,7 +38,7 @@ export function acquireDevLock(cwd, url = null) {
 export function updateDevLock(cwd, lock) {
     const path = devLockPath(cwd);
     const tmp = `${path}.${process.pid}.tmp`;
-    writeFileSync(tmp, `${JSON.stringify(lock)}\n`);
+    writeFileSync(tmp, `${JSON.stringify(lock)}\n`, { mode: LOCK_MODE });
     renameSync(tmp, path);
 }
 /** 이 프로세스의 잠금이면 삭제 (동기. process exit 처리기에서도 호출) */
@@ -50,7 +52,12 @@ function parseLock(path) {
         const value = JSON.parse(readFileSync(path, "utf8"));
         if (typeof value.pid !== "number")
             return undefined;
-        return { pid: value.pid, url: typeof value.url === "string" ? value.url : null, startedAt: String(value.startedAt ?? "") };
+        return {
+            pid: value.pid,
+            url: typeof value.url === "string" ? value.url : null,
+            startedAt: String(value.startedAt ?? ""),
+            ...(typeof value.auditToken === "string" && value.auditToken !== "" ? { auditToken: value.auditToken } : {}),
+        };
     }
     catch {
         return undefined;

package/dist/cli/dev-lock.js.map

@@ -1 +1 @@
-{"version":3,"file":"dev-lock.js","sourceRoot":"","sources":["../../src/cli/dev-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AASlD,2BAA2B;AAC3B,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;AACnD,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,GAAG,GAAkB,IAAI;IACnE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC7B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,MAAM,IAAI,GAAY,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;IACpF,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YAChE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC;gBAAE,MAAM,KAAK,CAAA;QACrF,CAAC;QACD,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;QAChC,IAAI,QAAQ,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;QACpG,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/B,CAAC;AACH,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,IAAa;IACtD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAA;IACxC,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/C,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AACvB,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG;QAAE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACzE,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAqB,CAAA;QACxE,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QACnD,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAA;IAC5H,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAA;IAC1D,CAAC;AACH,CAAC","sourcesContent":["import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from \"node:fs\"\nimport { dirname, join, resolve } from \"node:path\"\n\n/** .mext/dev/lock 내용. url = listen 전에는 null */\nexport interface DevLock {\n  pid: number\n  url: string | null\n  startedAt: string\n}\n\n/** <cwd>/.mext/dev/lock */\nexport function devLockPath(cwd: string): string {\n  return join(resolve(cwd), \".mext\", \"dev\", \"lock\")\n}\n\n/** 살아 있는 mext dev 의 잠금. 없음 · 죽은 pid · 읽을 수 없음 = undefined */\nexport function readDevLock(cwd: string): DevLock | undefined {\n  const lock = parseLock(devLockPath(cwd))\n  return lock && pidAlive(lock.pid) ? lock : undefined\n}\n\n/**\n * 잠금 획득 (O_EXCL 생성). 이미 살아 있는 다른 프로세스의 잠금 = { running }.\n * 죽은 pid · 깨진 파일 = 오래된 잠금으로 보고 교체\n */\nexport function acquireDevLock(cwd: string, url: string | null = null): { acquired: DevLock } | { running: DevLock } {\n  const path = devLockPath(cwd)\n  mkdirSync(dirname(path), { recursive: true })\n  const lock: DevLock = { pid: process.pid, url, startedAt: new Date().toISOString() }\n  for (let attempt = 0; ; attempt++) {\n    try {\n      writeFileSync(path, `${JSON.stringify(lock)}\\n`, { flag: \"wx\" })\n      return { acquired: lock }\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code !== \"EEXIST\" || attempt >= 3) throw error\n    }\n    const existing = parseLock(path)\n    if (existing && existing.pid !== process.pid && pidAlive(existing.pid)) return { running: existing }\n    rmSync(path, { force: true })\n  }\n}\n\n/** 획득한 잠금의 url 갱신 (임시 파일 rename) */\nexport function updateDevLock(cwd: string, lock: DevLock): void {\n  const path = devLockPath(cwd)\n  const tmp = `${path}.${process.pid}.tmp`\n  writeFileSync(tmp, `${JSON.stringify(lock)}\\n`)\n  renameSync(tmp, path)\n}\n\n/** 이 프로세스의 잠금이면 삭제 (동기. process exit 처리기에서도 호출) */\nexport function releaseDevLock(cwd: string): void {\n  const path = devLockPath(cwd)\n  if (parseLock(path)?.pid === process.pid) rmSync(path, { force: true })\n}\n\nfunction parseLock(path: string): DevLock | undefined {\n  try {\n    const value = JSON.parse(readFileSync(path, \"utf8\")) as Partial<DevLock>\n    if (typeof value.pid !== \"number\") return undefined\n    return { pid: value.pid, url: typeof value.url === \"string\" ? value.url : null, startedAt: String(value.startedAt ?? \"\") }\n  } catch {\n    return undefined\n  }\n}\n\nfunction pidAlive(pid: number): boolean {\n  try {\n    process.kill(pid, 0)\n    return true\n  } catch (error) {\n    return (error as NodeJS.ErrnoException).code === \"EPERM\"\n  }\n}\n"]}
+{"version":3,"file":"dev-lock.js","sourceRoot":"","sources":["../../src/cli/dev-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAWlD,0CAA0C;AAC1C,MAAM,SAAS,GAAG,KAAK,CAAA;AAEvB,2BAA2B;AAC3B,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;AACnD,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,GAAG,GAAkB,IAAI,EAAE,UAAmB;IACxF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC7B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,MAAM,IAAI,GAAY,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;IACzI,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;YACjF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC;gBAAE,MAAM,KAAK,CAAA;QACrF,CAAC;QACD,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;QAChC,IAAI,QAAQ,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;QACpG,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/B,CAAC;AACH,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,IAAa;IACtD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAA;IACxC,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;IACpE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AACvB,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG;QAAE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACzE,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAqB,CAAA;QACxE,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QACnD,OAAO;YACL,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YACrD,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;YACxC,GAAG,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7G,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAA;IAC1D,CAAC;AACH,CAAC","sourcesContent":["import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from \"node:fs\"\nimport { dirname, join, resolve } from \"node:path\"\n\n/** .mext/dev/lock 내용. url = listen 전에는 null */\nexport interface DevLock {\n  pid: number\n  url: string | null\n  startedAt: string\n  /** 감사 tap endpoint 의 토큰 (spec §10). 이전 버전의 잠금 = 없음. 로그 · 오류 메시지에 출력하지 않는다 */\n  auditToken?: string\n}\n\n/** 잠금 파일 권한: 소유자만 (auditToken 이 들어 있다) */\nconst LOCK_MODE = 0o600\n\n/** <cwd>/.mext/dev/lock */\nexport function devLockPath(cwd: string): string {\n  return join(resolve(cwd), \".mext\", \"dev\", \"lock\")\n}\n\n/** 살아 있는 mext dev 의 잠금. 없음 · 죽은 pid · 읽을 수 없음 = undefined */\nexport function readDevLock(cwd: string): DevLock | undefined {\n  const lock = parseLock(devLockPath(cwd))\n  return lock && pidAlive(lock.pid) ? lock : undefined\n}\n\n/**\n * 잠금 획득 (O_EXCL 생성). 이미 살아 있는 다른 프로세스의 잠금 = { running }.\n * 죽은 pid · 깨진 파일 = 오래된 잠금으로 보고 교체\n */\nexport function acquireDevLock(cwd: string, url: string | null = null, auditToken?: string): { acquired: DevLock } | { running: DevLock } {\n  const path = devLockPath(cwd)\n  mkdirSync(dirname(path), { recursive: true })\n  const lock: DevLock = { pid: process.pid, url, startedAt: new Date().toISOString(), ...(auditToken !== undefined ? { auditToken } : {}) }\n  for (let attempt = 0; ; attempt++) {\n    try {\n      writeFileSync(path, `${JSON.stringify(lock)}\\n`, { flag: \"wx\", mode: LOCK_MODE })\n      return { acquired: lock }\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code !== \"EEXIST\" || attempt >= 3) throw error\n    }\n    const existing = parseLock(path)\n    if (existing && existing.pid !== process.pid && pidAlive(existing.pid)) return { running: existing }\n    rmSync(path, { force: true })\n  }\n}\n\n/** 획득한 잠금의 url 갱신 (임시 파일 rename) */\nexport function updateDevLock(cwd: string, lock: DevLock): void {\n  const path = devLockPath(cwd)\n  const tmp = `${path}.${process.pid}.tmp`\n  writeFileSync(tmp, `${JSON.stringify(lock)}\\n`, { mode: LOCK_MODE })\n  renameSync(tmp, path)\n}\n\n/** 이 프로세스의 잠금이면 삭제 (동기. process exit 처리기에서도 호출) */\nexport function releaseDevLock(cwd: string): void {\n  const path = devLockPath(cwd)\n  if (parseLock(path)?.pid === process.pid) rmSync(path, { force: true })\n}\n\nfunction parseLock(path: string): DevLock | undefined {\n  try {\n    const value = JSON.parse(readFileSync(path, \"utf8\")) as Partial<DevLock>\n    if (typeof value.pid !== \"number\") return undefined\n    return {\n      pid: value.pid,\n      url: typeof value.url === \"string\" ? value.url : null,\n      startedAt: String(value.startedAt ?? \"\"),\n      ...(typeof value.auditToken === \"string\" && value.auditToken !== \"\" ? { auditToken: value.auditToken } : {}),\n    }\n  } catch {\n    return undefined\n  }\n}\n\nfunction pidAlive(pid: number): boolean {\n  try {\n    process.kill(pid, 0)\n    return true\n  } catch (error) {\n    return (error as NodeJS.ErrnoException).code === \"EPERM\"\n  }\n}\n"]}

package/dist/cli/dev-server.d.ts

@@ -1,5 +1,14 @@
+import type { AuditEvent } from "../audit.ts";
 /** 자식 → 부모 */
 export type DevChildMessage = {
+    type: "error";
+    message: string;
+}
+/** 감사 tap (spec §10): 호출 1건의 감사 이벤트 */
+ | {
+    type: "audit";
+    event: AuditEvent;
+} | {
     type: "config";
     commandsDir: string;
     routesDir: string;

package/dist/cli/dev-server.js

@@ -4,6 +4,7 @@
  * 요청은 감독 프로세스 (부모) 가 받아 이 포트로 중계한다. 부모 IPC 가 끊기면 종료.
  */
 import { createServer } from "node:http";
+import { relative } from "node:path";
 import { loadConfig, mcpDeclarations, resolveCommandsDir, resolvePromptsDir, resolveResourcesDir, resolveRoutesDir } from "../config.js";
 import { loadProjectInstrumentation } from "../instrumentation.js";
 import { createMcpHttpHandler } from "../mcp/http.js";
@@ -11,6 +12,8 @@ import { loadPromptSet, withPrompts } from "../prompt.js";
 import { loadResourceSet, withResources } from "../resource.js";
 import { loadRoutes } from "../route.js";
 import { loadRegistry } from "../scan.js";
+import { resolveTypesPath, writeTypes } from "../typegen.js";
+import { tapAudit } from "./dev-tap.js";
 const send = (message) => new Promise((resolve) => {
     if (!process.connected)
         return resolve();
@@ -41,8 +44,14 @@ async function main() {
     });
     const registry = withPrompts(withResources(await loadRegistry(commandsDir), await loadResourceSet(resourcesDir)), await loadPromptSet(promptsDir));
     const routes = await loadRoutes(routesDir);
+    generateTypes(cwd, config.types, commandsDir);
+    // 감사 tap: 모든 호출의 이벤트를 감독 프로세스로 (전달을 기다리지 않는다). 프로젝트 audit 설정의 동작은 그대로
+    const tapped = tapAudit(registry, config.audit, (event) => {
+        if (process.connected)
+            process.send({ type: "audit", event }, undefined, {}, () => { });
+    });
     const listener = createMcpHttpHandler({
-        registry,
+        registry: tapped.registry,
         instrumentation,
         ...(config.app ? { app: config.app } : {}),
         ...(config.auth ? { auth: config.auth } : {}),
@@ -50,6 +59,7 @@ async function main() {
         ...(config.oauth ? { oauth: config.oauth } : {}),
         ...(routes.length > 0 ? { routes } : {}),
         ...mcpDeclarations(config),
+        audit: tapped.audit,
         server: config.server?.allowedOrigins ? { allowedOrigins: config.server.allowedOrigins } : {},
         onerror: (error) => process.stderr.write(`mcp: ${error.message}\n`),
     });
@@ -77,6 +87,19 @@ main().catch(async (error) => {
     await send({ type: "error", message: describeLoadError(error) });
     process.exit(1);
 });
+/** 명령어 타입 생성 (config.types, specs/client.md §4). 실패 = stderr 1줄 (서버는 계속) */
+function generateTypes(cwd, types, commandsDir) {
+    const out = resolveTypesPath(cwd, types);
+    if (out === undefined)
+        return;
+    try {
+        if (writeTypes(commandsDir, out).changed)
+            process.stderr.write(`mext dev: wrote ${relative(cwd, out) || out}\n`);
+    }
+    catch (error) {
+        process.stderr.write(`mext dev: cannot write command types (${error instanceof Error ? error.message : String(error)})\n`);
+    }
+}
 /** SyntaxError 는 stack 첫 줄들에 파일 위치가 있다 (ESM 파싱 오류). 그 외는 message (MextBuildError = issue 목록) */
 function describeLoadError(error) {
     if (error instanceof SyntaxError && error.stack) {

package/dist/cli/dev-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"dev-server.js","sourceRoot":"","sources":["../../src/cli/dev-server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAExC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACxI,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAmBzC,MAAM,IAAI,GAAG,CAAC,OAAwB,EAAiB,EAAE,CACvD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,OAAO,OAAO,EAAE,CAAA;IACxC,OAAO,CAAC,IAAK,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;AACxD,CAAC,CAAC,CAAA;AAEJ,+DAA+D;AAC/D,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;AAC9B,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;AAE/C,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACzB,qCAAqC;IACrC,MAAM,eAAe,GAAG,MAAM,0BAA0B,CAAC,GAAG,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;IACpC,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACnD,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC/C,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACrD,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACjD,MAAM,IAAI,CAAC;QACT,IAAI,EAAE,QAAQ;QACd,WAAW;QACX,SAAS;QACT,YAAY;QACZ,UAAU;QACV,MAAM,EAAE;YACN,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E;KACF,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,aAAa,CAAC,MAAM,YAAY,CAAC,WAAW,CAAC,EAAE,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC,EACnF,MAAM,aAAa,CAAC,UAAU,CAAC,CAChC,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAA;IAC1C,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,QAAQ;QACR,eAAe;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,eAAe,CAAC,MAAM,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE;QAC7F,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,CAAC,OAAO,IAAI,CAAC;KACpE,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IACrC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC3B,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAyB,EAAE,EAAE;QAClD,IAAI,OAAO,EAAE,IAAI,KAAK,QAAQ;YAAE,KAAK,QAAQ,CAAC,kBAAkB,EAAE,CAAA;QAClE,IAAI,OAAO,EAAE,IAAI,KAAK,UAAU;YAAE,OAAM;QACxC,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACjC,MAAM,CAAC,mBAAmB,EAAE,CAAA;YAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAG,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;AAC/G,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;IACpC,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA;AAEF,gGAAgG;AAChG,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,WAAW,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChD,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC3C,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACjE,CAAC;IACD,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC/D,CAAC","sourcesContent":["/**\n * mext dev 의 서버 자식 프로세스 엔트리 (cli/dev.ts 가 fork). 직접 실행하지 않는다.\n * cwd 의 mext.config.ts · commands/ 를 로드해 127.0.0.1 임의 포트에서 MCP HTTP 처리기를 띄우고 IPC 로 보고한다.\n * 요청은 감독 프로세스 (부모) 가 받아 이 포트로 중계한다. 부모 IPC 가 끊기면 종료.\n */\nimport { createServer } from \"node:http\"\nimport type { AddressInfo } from \"node:net\"\nimport { loadConfig, mcpDeclarations, resolveCommandsDir, resolvePromptsDir, resolveResourcesDir, resolveRoutesDir } from \"../config.ts\"\nimport { loadProjectInstrumentation } from \"../instrumentation.ts\"\nimport { createMcpHttpHandler } from \"../mcp/http.ts\"\nimport { loadPromptSet, withPrompts } from \"../prompt.ts\"\nimport { loadResourceSet, withResources } from \"../resource.ts\"\nimport { loadRoutes } from \"../route.ts\"\nimport { loadRegistry } from \"../scan.ts\"\n\n/** 자식 → 부모 */\nexport type DevChildMessage =\n  | {\n      type: \"config\"\n      commandsDir: string\n      routesDir: string\n      /** 감시 대상 (§10). resources/ · prompts/ */\n      resourcesDir: string\n      promptsDir: string\n      server: { host?: string; port?: number }\n    }\n  | { type: \"ready\"; port: number; commands: number }\n  | { type: \"error\"; message: string }\n\n/** 부모 → 자식. retire = 새 자식으로 교체됨 (listen 스트림을 닫고 진행 중 요청은 끝까지), shutdown = 종료 */\nexport type DevParentMessage = { type: \"shutdown\" } | { type: \"retire\" }\n\nconst send = (message: DevChildMessage): Promise<void> =>\n  new Promise((resolve) => {\n    if (!process.connected) return resolve()\n    process.send!(message, undefined, {}, () => resolve())\n  })\n\n// 터미널 Ctrl-C 는 프로세스 그룹 전체에 간다. 종료는 부모가 정한다 (shutdown · IPC 끊김)\nprocess.on(\"SIGINT\", () => {})\nprocess.on(\"disconnect\", () => process.exit(0))\n\nasync function main(): Promise<void> {\n  const cwd = process.cwd()\n  // register() = 명령어 · config import 전\n  const instrumentation = await loadProjectInstrumentation(cwd)\n  const config = await loadConfig(cwd)\n  const commandsDir = resolveCommandsDir(cwd, config)\n  const routesDir = resolveRoutesDir(cwd, config)\n  const resourcesDir = resolveResourcesDir(cwd, config)\n  const promptsDir = resolvePromptsDir(cwd, config)\n  await send({\n    type: \"config\",\n    commandsDir,\n    routesDir,\n    resourcesDir,\n    promptsDir,\n    server: {\n      ...(config.server?.host !== undefined ? { host: config.server.host } : {}),\n      ...(config.server?.port !== undefined ? { port: config.server.port } : {}),\n    },\n  })\n  const registry = withPrompts(\n    withResources(await loadRegistry(commandsDir), await loadResourceSet(resourcesDir)),\n    await loadPromptSet(promptsDir),\n  )\n  const routes = await loadRoutes(routesDir)\n  const listener = createMcpHttpHandler({\n    registry,\n    instrumentation,\n    ...(config.app ? { app: config.app } : {}),\n    ...(config.auth ? { auth: config.auth } : {}),\n    ...(config.tools ? { tools: config.tools } : {}),\n    ...(config.oauth ? { oauth: config.oauth } : {}),\n    ...(routes.length > 0 ? { routes } : {}),\n    ...mcpDeclarations(config),\n    server: config.server?.allowedOrigins ? { allowedOrigins: config.server.allowedOrigins } : {},\n    onerror: (error) => process.stderr.write(`mcp: ${error.message}\\n`),\n  })\n  const server = createServer(listener)\n  await new Promise<void>((resolve, reject) => {\n    server.once(\"error\", reject)\n    server.listen(0, \"127.0.0.1\", () => {\n      server.off(\"error\", reject)\n      resolve()\n    })\n  })\n  process.on(\"message\", (message: DevParentMessage) => {\n    if (message?.type === \"retire\") void listener.closeSubscriptions()\n    if (message?.type !== \"shutdown\") return\n    void listener.close().finally(() => {\n      server.closeAllConnections()\n      server.close(() => process.exit(0))\n    })\n  })\n  await send({ type: \"ready\", port: (server.address() as AddressInfo).port, commands: registry.commands.size })\n}\n\nmain().catch(async (error: unknown) => {\n  await send({ type: \"error\", message: describeLoadError(error) })\n  process.exit(1)\n})\n\n/** SyntaxError 는 stack 첫 줄들에 파일 위치가 있다 (ESM 파싱 오류). 그 외는 message (MextBuildError = issue 목록) */\nfunction describeLoadError(error: unknown): string {\n  if (error instanceof SyntaxError && error.stack) {\n    const at = error.stack.indexOf(\"\\n    at \")\n    return (at < 0 ? error.stack : error.stack.slice(0, at)).trim()\n  }\n  return error instanceof Error ? error.message : String(error)\n}\n"]}
+{"version":3,"file":"dev-server.js","sourceRoot":"","sources":["../../src/cli/dev-server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAExC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAEpC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACxI,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAsBvC,MAAM,IAAI,GAAG,CAAC,OAAwB,EAAiB,EAAE,CACvD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,OAAO,OAAO,EAAE,CAAA;IACxC,OAAO,CAAC,IAAK,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;AACxD,CAAC,CAAC,CAAA;AAEJ,+DAA+D;AAC/D,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;AAC9B,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;AAE/C,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACzB,qCAAqC;IACrC,MAAM,eAAe,GAAG,MAAM,0BAA0B,CAAC,GAAG,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;IACpC,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACnD,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC/C,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACrD,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACjD,MAAM,IAAI,CAAC;QACT,IAAI,EAAE,QAAQ;QACd,WAAW;QACX,SAAS;QACT,YAAY;QACZ,UAAU;QACV,MAAM,EAAE;YACN,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E;KACF,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,aAAa,CAAC,MAAM,YAAY,CAAC,WAAW,CAAC,EAAE,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC,EACnF,MAAM,aAAa,CAAC,UAAU,CAAC,CAChC,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAA;IAC1C,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA;IAC7C,sEAAsE;IACtE,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;QACxD,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,CAAC,IAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAA4B,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACnH,CAAC,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,eAAe;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,eAAe,CAAC,MAAM,CAAC;QAC1B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE;QAC7F,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,CAAC,OAAO,IAAI,CAAC;KACpE,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IACrC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC3B,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAyB,EAAE,EAAE;QAClD,IAAI,OAAO,EAAE,IAAI,KAAK,QAAQ;YAAE,KAAK,QAAQ,CAAC,kBAAkB,EAAE,CAAA;QAClE,IAAI,OAAO,EAAE,IAAI,KAAK,UAAU;YAAE,OAAM;QACxC,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACjC,MAAM,CAAC,mBAAmB,EAAE,CAAA;YAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAG,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;AAC/G,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;IACpC,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA;AAEF,4EAA4E;AAC5E,SAAS,aAAa,CAAC,GAAW,EAAE,KAAmC,EAAE,WAAmB;IAC1F,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACxC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAM;IAC7B,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IAClH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC5H,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,WAAW,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChD,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC3C,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACjE,CAAC;IACD,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC/D,CAAC","sourcesContent":["/**\n * mext dev 의 서버 자식 프로세스 엔트리 (cli/dev.ts 가 fork). 직접 실행하지 않는다.\n * cwd 의 mext.config.ts · commands/ 를 로드해 127.0.0.1 임의 포트에서 MCP HTTP 처리기를 띄우고 IPC 로 보고한다.\n * 요청은 감독 프로세스 (부모) 가 받아 이 포트로 중계한다. 부모 IPC 가 끊기면 종료.\n */\nimport { createServer } from \"node:http\"\nimport type { AddressInfo } from \"node:net\"\nimport { relative } from \"node:path\"\nimport type { AuditEvent } from \"../audit.ts\"\nimport { loadConfig, mcpDeclarations, resolveCommandsDir, resolvePromptsDir, resolveResourcesDir, resolveRoutesDir } from \"../config.ts\"\nimport { loadProjectInstrumentation } from \"../instrumentation.ts\"\nimport { createMcpHttpHandler } from \"../mcp/http.ts\"\nimport { loadPromptSet, withPrompts } from \"../prompt.ts\"\nimport { loadResourceSet, withResources } from \"../resource.ts\"\nimport { loadRoutes } from \"../route.ts\"\nimport { loadRegistry } from \"../scan.ts\"\nimport { resolveTypesPath, writeTypes } from \"../typegen.ts\"\nimport { tapAudit } from \"./dev-tap.ts\"\n\n/** 자식 → 부모 */\nexport type DevChildMessage =\n  | { type: \"error\"; message: string }\n  /** 감사 tap (spec §10): 호출 1건의 감사 이벤트 */\n  | { type: \"audit\"; event: AuditEvent }\n| {\n      type: \"config\"\n      commandsDir: string\n      routesDir: string\n      /** 감시 대상 (§10). resources/ · prompts/ */\n      resourcesDir: string\n      promptsDir: string\n      server: { host?: string; port?: number }\n    }\n  | { type: \"ready\"; port: number; commands: number }\n  | { type: \"error\"; message: string }\n\n/** 부모 → 자식. retire = 새 자식으로 교체됨 (listen 스트림을 닫고 진행 중 요청은 끝까지), shutdown = 종료 */\nexport type DevParentMessage = { type: \"shutdown\" } | { type: \"retire\" }\n\nconst send = (message: DevChildMessage): Promise<void> =>\n  new Promise((resolve) => {\n    if (!process.connected) return resolve()\n    process.send!(message, undefined, {}, () => resolve())\n  })\n\n// 터미널 Ctrl-C 는 프로세스 그룹 전체에 간다. 종료는 부모가 정한다 (shutdown · IPC 끊김)\nprocess.on(\"SIGINT\", () => {})\nprocess.on(\"disconnect\", () => process.exit(0))\n\nasync function main(): Promise<void> {\n  const cwd = process.cwd()\n  // register() = 명령어 · config import 전\n  const instrumentation = await loadProjectInstrumentation(cwd)\n  const config = await loadConfig(cwd)\n  const commandsDir = resolveCommandsDir(cwd, config)\n  const routesDir = resolveRoutesDir(cwd, config)\n  const resourcesDir = resolveResourcesDir(cwd, config)\n  const promptsDir = resolvePromptsDir(cwd, config)\n  await send({\n    type: \"config\",\n    commandsDir,\n    routesDir,\n    resourcesDir,\n    promptsDir,\n    server: {\n      ...(config.server?.host !== undefined ? { host: config.server.host } : {}),\n      ...(config.server?.port !== undefined ? { port: config.server.port } : {}),\n    },\n  })\n  const registry = withPrompts(\n    withResources(await loadRegistry(commandsDir), await loadResourceSet(resourcesDir)),\n    await loadPromptSet(promptsDir),\n  )\n  const routes = await loadRoutes(routesDir)\n  generateTypes(cwd, config.types, commandsDir)\n  // 감사 tap: 모든 호출의 이벤트를 감독 프로세스로 (전달을 기다리지 않는다). 프로젝트 audit 설정의 동작은 그대로\n  const tapped = tapAudit(registry, config.audit, (event) => {\n    if (process.connected) process.send!({ type: \"audit\", event } satisfies DevChildMessage, undefined, {}, () => {})\n  })\n  const listener = createMcpHttpHandler({\n    registry: tapped.registry,\n    instrumentation,\n    ...(config.app ? { app: config.app } : {}),\n    ...(config.auth ? { auth: config.auth } : {}),\n    ...(config.tools ? { tools: config.tools } : {}),\n    ...(config.oauth ? { oauth: config.oauth } : {}),\n    ...(routes.length > 0 ? { routes } : {}),\n    ...mcpDeclarations(config),\n    audit: tapped.audit,\n    server: config.server?.allowedOrigins ? { allowedOrigins: config.server.allowedOrigins } : {},\n    onerror: (error) => process.stderr.write(`mcp: ${error.message}\\n`),\n  })\n  const server = createServer(listener)\n  await new Promise<void>((resolve, reject) => {\n    server.once(\"error\", reject)\n    server.listen(0, \"127.0.0.1\", () => {\n      server.off(\"error\", reject)\n      resolve()\n    })\n  })\n  process.on(\"message\", (message: DevParentMessage) => {\n    if (message?.type === \"retire\") void listener.closeSubscriptions()\n    if (message?.type !== \"shutdown\") return\n    void listener.close().finally(() => {\n      server.closeAllConnections()\n      server.close(() => process.exit(0))\n    })\n  })\n  await send({ type: \"ready\", port: (server.address() as AddressInfo).port, commands: registry.commands.size })\n}\n\nmain().catch(async (error: unknown) => {\n  await send({ type: \"error\", message: describeLoadError(error) })\n  process.exit(1)\n})\n\n/** 명령어 타입 생성 (config.types, specs/client.md §4). 실패 = stderr 1줄 (서버는 계속) */\nfunction generateTypes(cwd: string, types: boolean | string | undefined, commandsDir: string): void {\n  const out = resolveTypesPath(cwd, types)\n  if (out === undefined) return\n  try {\n    if (writeTypes(commandsDir, out).changed) process.stderr.write(`mext dev: wrote ${relative(cwd, out) || out}\\n`)\n  } catch (error) {\n    process.stderr.write(`mext dev: cannot write command types (${error instanceof Error ? error.message : String(error)})\\n`)\n  }\n}\n\n/** SyntaxError 는 stack 첫 줄들에 파일 위치가 있다 (ESM 파싱 오류). 그 외는 message (MextBuildError = issue 목록) */\nfunction describeLoadError(error: unknown): string {\n  if (error instanceof SyntaxError && error.stack) {\n    const at = error.stack.indexOf(\"\\n    at \")\n    return (at < 0 ? error.stack : error.stack.slice(0, at)).trim()\n  }\n  return error instanceof Error ? error.message : String(error)\n}\n"]}

package/dist/cli/dev-tap.d.ts

@@ -0,0 +1,20 @@
+import type { AuditConfig, AuditEvent } from "../audit.ts";
+import type { Registry } from "../registry.ts";
+/**
+ * mext dev 의 감사 tap, 서버 자식 쪽 (spec §10 감사 tap). cli/dev-server.ts 만 import 한다:
+ * mext start · handler.js · 로컬 bin · 고객 CLI · mext dev --stdio 에는 이 코드 경로가 없다.
+ *
+ * 프로젝트 audit 설정을 감싸 모든 호출의 이벤트를 emit 으로 넘긴다 (readOnly · 숨긴 명령어 호출 시도 포함).
+ * 프로젝트가 관찰하는 동작은 tap 이 없을 때와 같다: 프로젝트 sink 는 자기 설정 (includeReadOnly · includeHidden) 이
+ * 기록했을 이벤트만 같은 인자로 받고, onerror 는 그 이벤트에서 난 예외만 받는다
+ */
+export interface TappedAudit<R extends Registry> {
+    registry: R;
+    audit: AuditConfig;
+}
+/**
+ * emit = 이벤트 사본 (JSON 값) 전달. 예외는 삼키고 반환값을 기다리지 않는다.
+ * registry = 프로젝트가 기록하지 않는 호출 (설정 없음 · readOnly 인데 includeReadOnly 아님) 의 명령어만
+ * audit 함수 (target · summary · input) 를 예외를 삼키는 래퍼로 바꾼 사본: 그 예외가 프로젝트 onerror 로 가지 않게
+ */
+export declare function tapAudit<R extends Registry>(registry: R, project: AuditConfig | undefined, emit: (event: AuditEvent) => void): TappedAudit<R>;

package/dist/cli/dev-tap.js

@@ -0,0 +1,70 @@
+/**
+ * emit = 이벤트 사본 (JSON 값) 전달. 예외는 삼키고 반환값을 기다리지 않는다.
+ * registry = 프로젝트가 기록하지 않는 호출 (설정 없음 · readOnly 인데 includeReadOnly 아님) 의 명령어만
+ * audit 함수 (target · summary · input) 를 예외를 삼키는 래퍼로 바꾼 사본: 그 예외가 프로젝트 onerror 로 가지 않게
+ */
+export function tapAudit(registry, project, emit) {
+    /** 프로젝트 설정이 이 이벤트를 기록했을지 (audit.ts startAudit · auditHidden 과 같은 조건) */
+    const recorded = (event) => {
+        if (!project)
+            return false;
+        if (event.outcome === "hidden")
+            return project.includeHidden === true;
+        return !event.readOnly || project.includeReadOnly === true;
+    };
+    const audit = {
+        includeReadOnly: true,
+        includeHidden: true,
+        ...(project?.input !== undefined ? { input: project.input } : {}),
+        ...(project?.onerror ? { onerror: project.onerror } : {}),
+        sink(event) {
+            try {
+                // 프로젝트 sink 가 이벤트를 바꾸기 전의 값. 직렬화할 수 없는 입력 (순환 · bigint) = 입력 없이
+                emit(copy(event));
+            }
+            catch {
+                // tap 의 예외는 응답 · 프로젝트 sink 에 영향을 주지 않는다
+            }
+            // 프로젝트 sink 의 반환 (Promise) · 예외는 그대로: 응답 전 await · onerror 보고 (§11.1)
+            return recorded(event) ? project.sink(event) : undefined;
+        },
+    };
+    const quiet = (entry) => !project || (entry.command.readOnly && project.includeReadOnly !== true);
+    const commands = new Map();
+    for (const [id, entry] of registry.commands) {
+        commands.set(id, entry.command.audit && quiet(entry) ? { ...entry, command: quietAudit(entry.command) } : entry);
+    }
+    return { registry: { ...registry, commands }, audit };
+}
+function copy(event) {
+    try {
+        return JSON.parse(JSON.stringify(event));
+    }
+    catch {
+        const { input: _input, target: _target, ...rest } = event;
+        return JSON.parse(JSON.stringify(rest));
+    }
+}
+/** audit 함수의 예외 = 그 필드 없음 (audit.ts guarded 가 보고 없이 계속했을 때와 같은 이벤트) */
+function quietAudit(command) {
+    const a = command.audit;
+    const audit = {
+        ...a,
+        ...(typeof a.target === "function" ? { target: quiet(a.target) } : {}),
+        ...(typeof a.summary === "function" ? { summary: quiet(a.summary) } : {}),
+        // 가림 함수 예외 = 입력 없이 (가리지 않은 값으로 대체하지 않는다)
+        ...(typeof a.input === "function" ? { input: quiet(a.input) } : {}),
+    };
+    return { ...command, audit };
+}
+function quiet(fn) {
+    return (...args) => {
+        try {
+            return fn(...args);
+        }
+        catch {
+            return undefined;
+        }
+    };
+}
+//# sourceMappingURL=dev-tap.js.map

package/dist/cli/dev-tap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-tap.js","sourceRoot":"","sources":["../../src/cli/dev-tap.ts"],"names":[],"mappings":"AAkBA;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAqB,QAAW,EAAE,OAAgC,EAAE,IAAiC;IAC3H,wEAAwE;IACxE,MAAM,QAAQ,GAAG,CAAC,KAAiB,EAAW,EAAE;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;QAC1B,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC,aAAa,KAAK,IAAI,CAAA;QACrE,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,CAAA;IAC5D,CAAC,CAAA;IACD,MAAM,KAAK,GAAgB;QACzB,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,IAAI;QACnB,GAAG,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,KAAK;YACR,IAAI,CAAC;gBACH,gEAAgE;gBAChE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,wCAAwC;YAC1C,CAAC;YACD,sEAAsE;YACtE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC3D,CAAC;KACF,CAAA;IACD,MAAM,KAAK,GAAG,CAAC,KAAwB,EAAW,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC,CAAA;IAC7H,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAA;IACrD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IAClH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAA;AACvD,CAAC;AAED,SAAS,IAAI,CAAC,KAAiB;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAe,CAAA;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAA;QACzD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAe,CAAA;IACvD,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,SAAS,UAAU,CAAC,OAAgB;IAClC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAM,CAAA;IACxB,MAAM,KAAK,GAAiB;QAC1B,GAAG,CAAC;QACJ,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,yCAAyC;QACzC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAA;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAA;AAC9B,CAAC;AAED,SAAS,KAAK,CAAyB,EAAqB;IAC1D,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE;QACjB,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAA;AACH,CAAC","sourcesContent":["import type { AuditConfig, AuditEvent } from \"../audit.ts\"\nimport type { Command, CommandAudit } from \"../command.ts\"\nimport type { RegisteredCommand, Registry } from \"../registry.ts\"\n\n/**\n * mext dev 의 감사 tap, 서버 자식 쪽 (spec §10 감사 tap). cli/dev-server.ts 만 import 한다:\n * mext start · handler.js · 로컬 bin · 고객 CLI · mext dev --stdio 에는 이 코드 경로가 없다.\n *\n * 프로젝트 audit 설정을 감싸 모든 호출의 이벤트를 emit 으로 넘긴다 (readOnly · 숨긴 명령어 호출 시도 포함).\n * 프로젝트가 관찰하는 동작은 tap 이 없을 때와 같다: 프로젝트 sink 는 자기 설정 (includeReadOnly · includeHidden) 이\n * 기록했을 이벤트만 같은 인자로 받고, onerror 는 그 이벤트에서 난 예외만 받는다\n */\n\nexport interface TappedAudit<R extends Registry> {\n  registry: R\n  audit: AuditConfig\n}\n\n/**\n * emit = 이벤트 사본 (JSON 값) 전달. 예외는 삼키고 반환값을 기다리지 않는다.\n * registry = 프로젝트가 기록하지 않는 호출 (설정 없음 · readOnly 인데 includeReadOnly 아님) 의 명령어만\n * audit 함수 (target · summary · input) 를 예외를 삼키는 래퍼로 바꾼 사본: 그 예외가 프로젝트 onerror 로 가지 않게\n */\nexport function tapAudit<R extends Registry>(registry: R, project: AuditConfig | undefined, emit: (event: AuditEvent) => void): TappedAudit<R> {\n  /** 프로젝트 설정이 이 이벤트를 기록했을지 (audit.ts startAudit · auditHidden 과 같은 조건) */\n  const recorded = (event: AuditEvent): boolean => {\n    if (!project) return false\n    if (event.outcome === \"hidden\") return project.includeHidden === true\n    return !event.readOnly || project.includeReadOnly === true\n  }\n  const audit: AuditConfig = {\n    includeReadOnly: true,\n    includeHidden: true,\n    ...(project?.input !== undefined ? { input: project.input } : {}),\n    ...(project?.onerror ? { onerror: project.onerror } : {}),\n    sink(event) {\n      try {\n        // 프로젝트 sink 가 이벤트를 바꾸기 전의 값. 직렬화할 수 없는 입력 (순환 · bigint) = 입력 없이\n        emit(copy(event))\n      } catch {\n        // tap 의 예외는 응답 · 프로젝트 sink 에 영향을 주지 않는다\n      }\n      // 프로젝트 sink 의 반환 (Promise) · 예외는 그대로: 응답 전 await · onerror 보고 (§11.1)\n      return recorded(event) ? project!.sink(event) : undefined\n    },\n  }\n  const quiet = (entry: RegisteredCommand): boolean => !project || (entry.command.readOnly && project.includeReadOnly !== true)\n  const commands = new Map<string, RegisteredCommand>()\n  for (const [id, entry] of registry.commands) {\n    commands.set(id, entry.command.audit && quiet(entry) ? { ...entry, command: quietAudit(entry.command) } : entry)\n  }\n  return { registry: { ...registry, commands }, audit }\n}\n\nfunction copy(event: AuditEvent): AuditEvent {\n  try {\n    return JSON.parse(JSON.stringify(event)) as AuditEvent\n  } catch {\n    const { input: _input, target: _target, ...rest } = event\n    return JSON.parse(JSON.stringify(rest)) as AuditEvent\n  }\n}\n\n/** audit 함수의 예외 = 그 필드 없음 (audit.ts guarded 가 보고 없이 계속했을 때와 같은 이벤트) */\nfunction quietAudit(command: Command): Command {\n  const a = command.audit!\n  const audit: CommandAudit = {\n    ...a,\n    ...(typeof a.target === \"function\" ? { target: quiet(a.target) } : {}),\n    ...(typeof a.summary === \"function\" ? { summary: quiet(a.summary) } : {}),\n    // 가림 함수 예외 = 입력 없이 (가리지 않은 값으로 대체하지 않는다)\n    ...(typeof a.input === \"function\" ? { input: quiet(a.input) } : {}),\n  }\n  return { ...command, audit }\n}\n\nfunction quiet<A extends unknown[], T>(fn: (...args: A) => T): (...args: A) => T | undefined {\n  return (...args) => {\n    try {\n      return fn(...args)\n    } catch {\n      return undefined\n    }\n  }\n}\n"]}

package/dist/cli/dev.js

@@ -11,6 +11,7 @@ import { redirectStdout, serveMcpStdio } from "../mcp/stdio.js";
 import { loadPromptSet, withPrompts } from "../prompt.js";
 import { loadResourceSet, withResources } from "../resource.js";
 import { loadRegistry } from "../scan.js";
+import { createDevAuditHub, newAuditToken } from "./dev-audit.js";
 import { acquireDevLock, releaseDevLock, updateDevLock } from "./dev-lock.js";
 import { table } from "./help.js";
 import { EXIT, exitCodeOf, formatError } from "./output.js";
@@ -85,7 +86,7 @@ async function stdio(io) {
         const instrumentation = await loadProjectInstrumentation(io.cwd);
         const config = await loadConfig(io.cwd);
         const registry = withPrompts(withResources(await loadRegistry(resolveCommandsDir(io.cwd, config)), await loadResourceSet(resolveResourcesDir(io.cwd, config))), await loadPromptSet(resolvePromptsDir(io.cwd, config)));
-        const principal = await resolveLocalPrincipal(config);
+        const principal = await resolveLocalPrincipal(config, "stdio");
         const server = serveMcpStdio({
             registry,
             instrumentation,
@@ -135,9 +136,11 @@ function writerStream(writer) {
 async function supervise(args, io) {
     const cwd = resolve(io.cwd);
     const log = (line) => void io.stderr.write(`${DEV_PROG}: ${line}\n`);
+    // 감사 tap (spec §10): 실행마다 새 토큰. 잠금 파일에만 적는다 (출력하지 않는다)
+    const auditToken = newAuditToken();
     let lock;
     try {
-        const got = acquireDevLock(cwd);
+        const got = acquireDevLock(cwd, null, auditToken);
         if ("running" in got) {
             const where = got.running.url ? `at ${got.running.url}` : "(starting)";
             io.stderr.write(`error: ${DEV_PROG} is already running ${where} (PID ${got.running.pid}).\n` +
@@ -152,7 +155,7 @@ async function supervise(args, io) {
     }
     const onExit = () => releaseDevLock(cwd);
     process.on("exit", onExit);
-    const supervisor = new DevSupervisor(cwd, log);
+    const supervisor = new DevSupervisor(cwd, log, createDevAuditHub(auditToken));
     try {
         const first = await supervisor.start();
         const host = args.host ?? first?.host ?? DEFAULT_HOST;
@@ -206,9 +209,12 @@ class DevSupervisor {
     debounce;
     changed = new Set();
     firstConfig;
-    constructor(cwd, log) {
+    /** 감사 tap: 자식이 넘긴 이벤트 보관 · endpoint */
+    audit;
+    constructor(cwd, log, audit) {
         this.cwd = cwd;
         this.log = log;
+        this.audit = audit;
         this.commandsDir = resolve(cwd, "commands");
         this.optionalDirs = ["routes", "resources", "prompts"].map((name) => resolve(cwd, name));
     }
@@ -259,6 +265,8 @@ class DevSupervisor {
                 this.onConfig(child, message);
             else if (message.type === "ready")
                 this.onReady(child, message.port, message.commands);
+            else if (message.type === "audit")
+                this.audit.push(message.event);
             else if (message.type === "error") {
                 failed = true;
                 this.onLoadFailed(child, message.message);
@@ -367,6 +375,9 @@ class DevSupervisor {
     }
     /* -------------------------------------------------------------- 요청 중계 */
     dispatch(req, res) {
+        // 감사 tap endpoint = 감독 프로세스가 직접 응답 (자식으로 중계하지 않는다. 재시작 중에도 응답)
+        if (this.audit.handle(req, res))
+            return;
         if (this.pending) {
             this.queue.push(() => this.dispatch(req, res));
             return;
@@ -509,6 +520,7 @@ class DevSupervisor {
         clearTimeout(this.debounce);
         for (const w of this.watchers.values())
             w.close();
+        this.audit.close();
         this.watchers.clear();
         const children = [this.current, this.pending, ...this.retired].filter((c) => c !== undefined);
         const exited = children.map((c) => new Promise((done) => {