@unson/brainbase-mcp 0.43.0 → 0.44.1

package/dist/canonical-task-service.js

@@ -391,6 +391,7 @@ export class CanonicalTaskService {
     auditRepository;
     policy;
     operationRepository;
+    readiness;
     clock;
     baseUrl;
     constructor(options) {
@@ -400,6 +401,14 @@ export class CanonicalTaskService {
         this.auditRepository = options.auditRepository;
         this.policy = options.policy ?? { authorize: () => undefined };
         this.operationRepository = options.operationRepository;
+        if (options.readiness != null && typeof options.readiness.assertMutationReady !== 'function') {
+            throw new Error('Canonical Task readiness must provide assertMutationReady()');
+        }
+        this.readiness = options.readiness ?? undefined;
+        if ((this.repository.requiresReadiness === true || this.operationRepository?.requiresReadiness === true)
+            && !this.readiness) {
+            throw new Error('Canonical Task readiness is required for durable persistence or operation coordination');
+        }
         this.clock = options.clock ?? (() => new Date());
         this.baseUrl = options.baseUrl;
         if (typeof options.baseUrl === 'string' && options.baseUrl && !validHttpUrl(options.baseUrl)) {
@@ -447,10 +456,12 @@ export class CanonicalTaskService {
         const normalizedContext = await this.normalizeContext(context);
         const clientKey = this.requireIdempotencyKey(normalizedContext);
         const payload = this.normalizeCreateInput(input);
+        await this.assertMutationReady();
         await this.authorize('create', normalizedContext, undefined, payload);
         const operation = operationKey(normalizedContext, clientKey, 'api:');
         const inputFingerprint = fingerprint(payload);
         const recover = async () => {
+            await this.assertMutationReady();
             const existing = await this.read(() => this.repository.findByIdempotencyKey(operation, ...this.scopeArgs(normalizedContext)));
             if (!existing)
                 return { recovered: false };
@@ -469,6 +480,7 @@ export class CanonicalTaskService {
             const recovered = await recover();
             if (recovered.recovered && recovered.result)
                 return recovered.result;
+            await this.assertMutationReady();
             const created = await this.read(() => this.repository.create({
                 ...payload,
                 status: 'pending',
@@ -554,15 +566,24 @@ export class CanonicalTaskService {
             ? expectedVersionOrInput
             : expectedVersionOrInput.expected_version);
         const clientKey = this.requireIdempotencyKey(normalizedContext);
+        await this.assertMutationReady();
         // A prepared-delete coordinator owns the durable operation lookup. Do not
         // require the row to remain visible before entering it: a completed
         // operation may legitimately recover after the delete removed the row.
         // The fallback path still performs the ordinary read and authorization
         // checks before invoking the local operation runner.
-        if (normalizedContext.storageScope !== undefined)
-            await this.authorize('delete', normalizedContext);
         let task = null;
-        if (!this.operationRepository?.executePreparedDelete) {
+        if (this.operationRepository?.executePreparedDelete) {
+            // Read and authorize a visible task before entering the coordinator. A
+            // completed replay can legitimately have no row, so absence is left to
+            // the durable snapshot reauthorization below.
+            task = await this.read(() => this.repository.get(normalizedId, ...this.scopeArgs(normalizedContext)));
+            if (task) {
+                await this.authorize('delete', normalizedContext, task);
+                this.assertVersion(task, version);
+            }
+        }
+        else {
             task = await this.read(() => this.repository.get(normalizedId, ...this.scopeArgs(normalizedContext)));
             if (!task)
                 throw new CanonicalTaskError('task_not_found', 'Task was not found', 404, { task_id: normalizedId });
@@ -595,6 +616,7 @@ export class CanonicalTaskService {
             version: version + 1,
         };
         const prepare = async () => {
+            await this.assertMutationReady();
             const current = await this.read(() => this.repository.get(normalizedId, ...this.scopeArgs(normalizedContext)));
             if (!current)
                 throw new CanonicalTaskError('task_not_found', 'Task was not found', 404, { task_id: normalizedId });
@@ -614,6 +636,7 @@ export class CanonicalTaskService {
                     ...(normalizedContext.storageScope === undefined ? {} : { storage_scope: normalizedContext.storageScope }),
                     actor: normalizedContext.principal,
                     auth_source: normalizedContext.authSource ?? null,
+                    task: current,
                 },
             };
         };
@@ -623,6 +646,7 @@ export class CanonicalTaskService {
             return current;
         });
         const removeTask = async (current) => {
+            await this.assertMutationReady();
             const taskToRemove = current ?? await this.read(() => this.repository.get(normalizedId, ...this.scopeArgs(normalizedContext)));
             if (!taskToRemove)
                 throw new CanonicalTaskError('task_not_found', 'Task was not found', 404, { task_id: normalizedId });
@@ -634,6 +658,26 @@ export class CanonicalTaskService {
             this.assertVersion(taskToRemove, version);
             await this.read(() => this.repository.delete(normalizedId, version, ...this.scopeArgs(normalizedContext)));
         };
+        const authorizeReplay = async (authorizationSnapshot) => {
+            await this.assertMutationReady();
+            const snapshotTask = authorizationSnapshot?.task;
+            if (!snapshotTask || typeof snapshotTask !== 'object' || Array.isArray(snapshotTask)) {
+                throw new CanonicalTaskError('canonical_task_authorization_snapshot_unavailable', 'Completed Canonical Task delete operation has no authorization snapshot', 503);
+            }
+            const taskSnapshot = snapshotTask;
+            if (authorizationSnapshot.task_id !== normalizedId
+                || authorizationSnapshot.task_version !== version
+                || taskSnapshot.id !== normalizedId
+                || taskSnapshot.version !== version) {
+                throw new CanonicalTaskError('canonical_task_authorization_snapshot_unavailable', 'Completed Canonical Task delete operation has an invalid authorization snapshot', 503);
+            }
+            const snapshotScope = authorizationSnapshot.storage_scope;
+            if (snapshotScope !== normalizedContext.storageScope
+                && (snapshotScope !== undefined || normalizedContext.storageScope !== undefined)) {
+                throw new CanonicalTaskError('task_not_found', 'Task was not found', 404);
+            }
+            await this.authorize('delete', normalizedContext, taskSnapshot);
+        };
         let deleted;
         if (this.operationRepository?.executePreparedDelete) {
             deleted = await this.operationRepository.executePreparedDelete({
@@ -647,6 +691,7 @@ export class CanonicalTaskService {
                 prepare,
                 findTask,
                 removeTask,
+                authorizeReplay,
                 projectResult: projectTaskResult,
             });
         }
@@ -697,6 +742,7 @@ export class CanonicalTaskService {
     async versionedMutation(input) {
         const taskId = normalizeString(input.taskId, 'task_id', { required: true, max: 200 });
         const expectedVersion = this.requireExpectedVersion(input.expectedVersion);
+        await this.assertMutationReady();
         const current = await this.read(() => this.repository.get(taskId, ...this.scopeArgs(input.context)));
         if (!current)
             throw new CanonicalTaskError('task_not_found', 'Task was not found', 404, { task_id: taskId });
@@ -740,6 +786,7 @@ export class CanonicalTaskService {
             }
         }
         const recover = async () => {
+            await this.assertMutationReady();
             const latest = await this.read(() => this.repository.get(taskId, ...this.scopeArgs(input.context)));
             if (!latest)
                 throw new CanonicalTaskError('task_not_found', 'Task was not found', 404, { task_id: taskId });
@@ -756,6 +803,7 @@ export class CanonicalTaskService {
             return { recovered: false };
         };
         const run = async () => {
+            await this.assertMutationReady();
             const latest = await this.read(() => this.repository.get(taskId, ...this.scopeArgs(input.context)));
             if (!latest)
                 throw new CanonicalTaskError('task_not_found', 'Task was not found', 404, { task_id: taskId });
@@ -970,6 +1018,10 @@ export class CanonicalTaskService {
     async authorize(action, context, task, input) {
         await this.policy.authorize({ action, context, task, input });
     }
+    async assertMutationReady() {
+        if (this.readiness)
+            await this.readiness.assertMutationReady();
+    }
     async scopeFilters(operation, context, filters) {
         if (!this.policy.scopeFilters)
             return filters;

package/dist/canonical-task-store-config.d.ts

@@ -0,0 +1,31 @@
+type Manifest = Record<string, string>;
+export interface CanonicalTaskStoreConfig {
+    schemaVersion: string;
+    /** The committed manifest, frozen. Tenant-specific keys stay as the tenant named them. */
+    manifest: Readonly<Manifest>;
+    identityHash: string;
+    manifestPath: string;
+}
+export interface CanonicalTaskStoreConfigOptions {
+    /** The tenant's committed store manifest (JSON object of non-empty strings). */
+    manifestPath: string;
+    /** Keys the tenant requires. `schema_version` is always required. */
+    requiredKeys?: string[];
+    /** Values the manifest must keep. A tenant pins its store identity here. */
+    expectedIdentity?: Record<string, string>;
+    /** Environment variables that must not be set, so the identity cannot be overridden at runtime. */
+    forbiddenEnvOverrides?: string[];
+    env?: Record<string, string | undefined>;
+}
+export declare function canonicalTaskStoreManifestJson(manifest: Record<string, unknown>): string;
+/**
+ * Loads the store manifest that names one Canonical Task store. Its hash
+ * binds persisted readiness to this exact store identity.
+ */
+export declare function createCanonicalTaskStoreConfig({ manifestPath, requiredKeys, expectedIdentity, forbiddenEnvOverrides, env, }: CanonicalTaskStoreConfigOptions): CanonicalTaskStoreConfig;
+export type CanonicalTaskBackend = 'disabled' | 'postgres';
+export declare function resolveCanonicalTaskBackend(value?: unknown): CanonicalTaskBackend;
+export declare function canonicalTaskBackendIdentityHash(storeConfig: {
+    identityHash: string;
+}, backend?: unknown): string;
+export {};

package/dist/canonical-task-store-config.js

@@ -0,0 +1,53 @@
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+export function canonicalTaskStoreManifestJson(manifest) {
+    return JSON.stringify(Object.fromEntries(Object.keys(manifest).sort().map((key) => [key, manifest[key]])));
+}
+/**
+ * Loads the store manifest that names one Canonical Task store. Its hash
+ * binds persisted readiness to this exact store identity.
+ */
+export function createCanonicalTaskStoreConfig({ manifestPath, requiredKeys = [], expectedIdentity = {}, forbiddenEnvOverrides = [], env = process.env, }) {
+    if (typeof manifestPath !== 'string' || !manifestPath)
+        throw new Error('Canonical Task store manifest path is required');
+    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+    if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)) {
+        throw new Error('Canonical Task store manifest must be a JSON object');
+    }
+    for (const [key, value] of Object.entries(manifest)) {
+        if (typeof value !== 'string' || !value.trim()) {
+            throw new Error(`Canonical Task store manifest value ${key} must be a non-empty string`);
+        }
+    }
+    for (const key of new Set(['schema_version', ...requiredKeys])) {
+        if (typeof manifest[key] !== 'string' || !manifest[key].trim()) {
+            throw new Error(`Canonical Task store manifest requires ${key}`);
+        }
+    }
+    for (const [key, expected] of Object.entries(expectedIdentity)) {
+        if (manifest[key] !== expected) {
+            throw new Error(`Canonical Task manifest ${key} does not match the fixed canonical identity`);
+        }
+    }
+    if (forbiddenEnvOverrides.some((key) => env[key] !== undefined)) {
+        throw new Error('Canonical Task identity overrides are forbidden; use the committed manifest');
+    }
+    return Object.freeze({
+        schemaVersion: manifest.schema_version,
+        manifest: Object.freeze({ ...manifest }),
+        identityHash: createHash('sha256').update(canonicalTaskStoreManifestJson(manifest)).digest('hex'),
+        manifestPath: resolve(manifestPath),
+    });
+}
+export function resolveCanonicalTaskBackend(value = process.env.CANONICAL_TASK_BACKEND) {
+    const backend = typeof value === 'string' && value.trim() ? value.trim() : 'disabled';
+    if (backend !== 'disabled' && backend !== 'postgres') {
+        throw new Error('CANONICAL_TASK_BACKEND must be disabled or postgres');
+    }
+    return backend;
+}
+export function canonicalTaskBackendIdentityHash(storeConfig, backend = resolveCanonicalTaskBackend()) {
+    const resolved = resolveCanonicalTaskBackend(backend);
+    return createHash('sha256').update(`${storeConfig.identityHash}:backend:${resolved}`).digest('hex');
+}

package/dist/config-parser.d.ts

@@ -0,0 +1,298 @@
+/**
+ * Config Parser - brainbaseの設定ファイル（YAML）を読み取り、統合ビューを提供
+ */
+export type CatalogMode = 'required' | 'disabled';
+export interface ConfigParserLogger {
+    debug(message: string, data?: Record<string, unknown>): void;
+    error(message: string, data?: Error | (Record<string, unknown> & {
+        error?: unknown;
+    })): void;
+}
+export interface ConfigParserOptions {
+    configPath: string;
+    slackDir: string;
+    brainbaseRoot: string;
+    projectsRoot: string;
+    catalogMode?: CatalogMode;
+    logger?: ConfigParserLogger;
+}
+export interface ProjectLocalConfig {
+    path?: string;
+    glob_include?: string[];
+    [key: string]: unknown;
+}
+export interface ProjectGitHubConfig {
+    owner?: string;
+    repo?: string;
+    branch?: string;
+    [key: string]: unknown;
+}
+export interface ProjectAirtableConfig {
+    base_id?: string;
+    base_name?: string;
+    [key: string]: unknown;
+}
+export interface ProjectConfig {
+    id?: string;
+    name?: string;
+    catalog_version?: number;
+    emoji?: string;
+    archived?: boolean;
+    local?: ProjectLocalConfig;
+    github?: ProjectGitHubConfig;
+    airtable?: ProjectAirtableConfig;
+    capabilities?: unknown;
+    people?: unknown;
+    organization?: unknown;
+    created_by?: unknown;
+    success_criteria?: unknown;
+    project_code?: unknown;
+    [key: string]: unknown;
+}
+export interface SlackWorkspace {
+    name?: string;
+    id?: string;
+    projects?: string[];
+    [key: string]: unknown;
+}
+export type SlackWorkspaces = Record<string, SlackWorkspace>;
+export interface SlackChannel {
+    project_id?: string;
+    channel_id?: string;
+    channel_name?: string;
+    type?: string;
+    workspace?: string;
+    [key: string]: unknown;
+}
+export interface SlackMember {
+    slack_id?: string;
+    brainbase_name?: string;
+    [key: string]: unknown;
+}
+export interface ProjectCatalog {
+    root: string;
+    projects: ProjectConfig[];
+}
+export interface GitHubMapping {
+    project_id?: string;
+    owner?: string;
+    repo?: string;
+    branch: string;
+    url: string;
+}
+export interface AirtableMapping {
+    project_id?: string;
+    base_id?: string;
+    base_name?: string;
+    url: string;
+}
+export interface PluginSettings {
+    enabled: string[];
+    disabled: string[];
+}
+export interface OrganizationConfig {
+    [key: string]: unknown;
+}
+export interface DependencyConfig {
+    [key: string]: unknown;
+}
+export interface NotificationsConfig {
+    channels?: Record<string, unknown>;
+    dnd?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+export interface ConfigSnapshot {
+    slack: {
+        workspaces: SlackWorkspaces;
+        channels: SlackChannel[];
+        members: SlackMember[];
+    };
+    projects: ProjectCatalog;
+    github: GitHubMapping[];
+    airtable: AirtableMapping[];
+    plugins: PluginSettings;
+}
+export interface UnifiedChannel {
+    id?: string;
+    name?: string;
+    type: string;
+    workspace?: string;
+}
+export interface UnifiedGitHubMapping {
+    owner?: string;
+    repo?: string;
+    branch: string;
+    url: string;
+    paths: string[] | null;
+}
+export interface UnifiedProject {
+    id: string;
+    emoji: string | null;
+    archived: boolean;
+    channels: UnifiedChannel[];
+    github: UnifiedGitHubMapping | null;
+}
+export interface UnifiedWorkspace {
+    key: string;
+    name?: string;
+    id?: string;
+    projects: UnifiedProject[];
+}
+export interface UnifiedView {
+    workspaces: UnifiedWorkspace[];
+    orphanedChannels: Array<{
+        id?: string;
+        name?: string;
+        workspace?: string;
+        project_id?: string;
+    }>;
+    orphanedProjects: Array<{
+        id?: string;
+        hasGithub: boolean;
+        channelCount: number;
+    }>;
+}
+export type ConfigSourceStatus = 'not_applicable' | 'not_loaded' | 'loaded' | 'missing' | 'invalid';
+export interface IntegrityIssue {
+    type: string;
+    severity: 'error' | 'warning' | 'info';
+    message: string;
+    source: string;
+}
+export interface IntegrityReport {
+    applicability: 'applicable' | 'not_applicable';
+    source: {
+        status: ConfigSourceStatus;
+        path: string;
+        mode: CatalogMode;
+    };
+    issues: IntegrityIssue[];
+    summary: {
+        total: number;
+        errors: number;
+        warnings: number;
+        info: number;
+    };
+    stats: {
+        workspaces: number;
+        channels: number;
+        members: number;
+        projects: number;
+        github: number;
+        airtable: number;
+    };
+}
+interface RootConfig {
+    projects?: ProjectConfig[];
+    plugins?: Partial<PluginSettings>;
+    organizations?: OrganizationConfig[];
+    dependencies?: DependencyConfig;
+    notifications?: NotificationsConfig;
+}
+export declare class ConfigParser {
+    /**
+     * Construct a parser with every filesystem boundary supplied by the host.
+     *
+     * The OSS package deliberately has no workspace or repository defaults. A
+     * host that needs compatibility defaults must provide them in its adapter.
+     *
+     * @param paths filesystem boundaries and optional catalog mode supplied by the host
+     */
+    configPath: string;
+    slackDir: string;
+    brainbaseRoot: string;
+    projectsRoot: string;
+    workspaceRoot: string;
+    catalogMode: CatalogMode;
+    logger: ConfigParserLogger;
+    private _configSourceStatus;
+    private _configCache;
+    private _configPromise;
+    constructor(paths: ConfigParserOptions);
+    /**
+     * @template T
+     * @param {string} filePath
+     * @param {T} defaultValue
+     * @param {string} [label]
+     * @returns {Promise<T>}
+     */
+    _loadYamlFile<T>(filePath: string, defaultValue: T, label?: string): Promise<T>;
+    /**
+     * @template T
+     * @param {string} filename
+     * @param {T} defaultValue
+     * @returns {Promise<T>}
+     */
+    _loadSlackYaml<T>(filename: string, defaultValue: T): Promise<T>;
+    _loadConfig(): Promise<RootConfig>;
+    /**
+     * SPEC-settings-phase0-guards INV-4: ConfigService.write 後に呼ぶことで stale cache を回避
+     */
+    invalidateCache(): void;
+    /**
+     * @param {ProjectConfig[]} [projects]
+     * @returns {ProjectConfig[]}
+     */
+    _expandProjectPaths(projects?: ProjectConfig[]): ProjectConfig[];
+    /**
+     * Slackワークスペース一覧を取得
+     */
+    getWorkspaces(): Promise<SlackWorkspaces>;
+    /**
+     * Slackチャンネル一覧を取得
+     */
+    getChannels(): Promise<SlackChannel[]>;
+    /**
+     * Slackメンバー一覧を取得
+     */
+    getMembers(): Promise<SlackMember[]>;
+    /**
+     * プロジェクト設定（config.yml）を取得
+     */
+    getProjects(): Promise<ProjectCatalog>;
+    /**
+     * GitHubマッピングを取得（config.ymlから抽出）
+     */
+    getGitHubMappings(): Promise<GitHubMapping[]>;
+    /**
+     * Airtableマッピングを取得（config.ymlから抽出）
+     */
+    getAirtableMappings(): Promise<AirtableMapping[]>;
+    /**
+     * UI Plugins設定を取得（config.ymlから抽出）
+     * @returns {Promise<any>} { enabled: string[] } - 有効なプラグインID一覧
+     */
+    getPlugins(): Promise<PluginSettings>;
+    /**
+     * 統合ビュー: Workspace → Project → Slack/GitHub/Airtable の関係を一覧
+     */
+    getUnifiedView(): Promise<UnifiedView>;
+    /**
+     * Organizations（法人）設定を取得
+     * @returns {Promise<any[]>} 法人一覧
+     */
+    getOrganizations(): Promise<OrganizationConfig[]>;
+    /**
+     * Dependencies（依存関係）設定を取得
+     * @returns {Promise<any>} 依存関係マッピング
+     */
+    getDependencies(): Promise<DependencyConfig>;
+    /**
+     * Notifications（通知）設定を取得
+     * @returns {Promise<any>} 通知設定
+     */
+    getNotifications(): Promise<NotificationsConfig>;
+    /**
+     * 全設定を統合して取得
+     */
+    getAll(): Promise<ConfigSnapshot>;
+    /**
+     * 整合性チェック
+     * - チャンネルに定義されているが、プロジェクトに存在しないproject_id
+     * - ワークスペースに定義されているが、チャンネルがないワークスペース
+     * - 重複したSlack ID
+     * - GitHubマッピングの検証
+     */
+    checkIntegrity(): Promise<IntegrityReport>;
+}
+export {};