@unson/brainbase-mcp 0.7.0 → 0.9.0

package/dist/philosophy-revision-reader.js

@@ -0,0 +1,241 @@
+import { createHash } from 'node:crypto';
+import { isActiveAt } from './canonical-graph.js';
+import { canonicalPortableJson } from './portable-graph.js';
+/** The host owns the canonical philosophy source; this package owns only the read port. */
+export const PHILOSOPHY_REVISION_READ_CONTRACT_VERSION = 'philosophy-revision-read.v1';
+const REVISION_PATTERN = /^[1-9]\d*$/u;
+const DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/u;
+const SCOPE_TYPES = ['personal', 'project', 'organization'];
+const ACL_VISIBILITIES = ['private', 'project', 'organization', 'public'];
+/**
+ * Computes the stable identity of a canonical philosophy revision.
+ * Current ACL and scope are intentionally excluded so authorization changes do
+ * not create a false content revision; they are checked on every read.
+ */
+export function philosophyRevisionDigest(input) {
+    assertPhilosophyRevisionIdentity(input);
+    assertPhilosophyRevisionPayload(input.payload);
+    assertPhilosophyRevisionApplicability(input.applicability);
+    const content = {
+        kind: input.kind,
+        id: input.id,
+        revision: input.revision,
+        payload: input.payload,
+        applicability: canonicalApplicability(input.applicability)
+    };
+    return `sha256:${createHash('sha256').update(canonicalPortableJson(content), 'utf8').digest('hex')}`;
+}
+/** Structural check for callers that need to validate a reference before I/O. */
+export function isPhilosophyRevisionReference(value) {
+    if (!isPlainRecord(value) || value.kind !== 'philosophy')
+        return false;
+    if (!isNonEmptyString(value.id) || !isPositiveRevision(value.revision) || !isDigest(value.digest))
+        return false;
+    if (!isPhilosophyRevisionScope(value.scope) || !isRfc3339(value.valid_from))
+        return false;
+    if (value.valid_to === undefined || value.valid_to === null)
+        return true;
+    return typeof value.valid_to === 'string' && isValidInterval(value.valid_from, value.valid_to);
+}
+/**
+ * Adapt canonical philosophy reads to `JudgmentProblemReferenceProvider.resolveOther`.
+ * Unknown reference kinds remain unresolved so the caller can compose other
+ * providers explicitly.
+ */
+export function createJudgmentProblemPhilosophyReferenceResolver(options) {
+    if (!options || !options.reader || typeof options.reader.read !== 'function') {
+        throw new TypeError('A PhilosophyRevisionReader is required');
+    }
+    return async (input) => {
+        if (input.reference.kind !== 'philosophy') {
+            return { status: 'unresolved', message: `Philosophy revision resolver does not handle ${input.reference.kind}` };
+        }
+        if (!isNonEmptyString(input.context.principal)) {
+            return { status: 'unauthorized', message: 'A trusted principal is required for philosophy revision reads' };
+        }
+        const reference = {
+            kind: 'philosophy',
+            id: input.reference.id,
+            revision: input.reference.revision,
+            digest: input.reference.digest,
+            scope: cloneScope(input.reference.scope),
+            valid_from: input.reference.valid_from,
+            ...(input.reference.valid_to == null ? {} : { valid_to: input.reference.valid_to })
+        };
+        if (!isPhilosophyRevisionReference(reference)) {
+            return { status: 'unresolved', message: 'Philosophy revision reference is invalid' };
+        }
+        let result;
+        try {
+            result = await options.reader.read({
+                reference,
+                phase: input.phase,
+                // Snapshot access has no caller-supplied mutable scope. The reference
+                // scope is the requested boundary; the host must bind it to its trusted
+                // current tenant/project context before returning a record.
+                context: { principal: input.context.principal, scope: cloneScope(reference.scope) }
+            });
+        }
+        catch {
+            return { status: 'unresolved', message: 'Philosophy revision reader failed closed' };
+        }
+        if (!isPlainRecord(result) || typeof result.status !== 'string') {
+            return { status: 'unresolved', message: 'Philosophy revision reader returned an invalid result' };
+        }
+        if (result.status === 'missing') {
+            return { status: 'missing', message: result.message ?? 'Philosophy revision was not found' };
+        }
+        if (result.status === 'unauthorized') {
+            return { status: 'unauthorized', message: result.message ?? 'Philosophy revision is not readable' };
+        }
+        if (result.status === 'corrupt') {
+            return { status: 'unresolved', message: result.message ?? 'Philosophy revision failed integrity validation' };
+        }
+        if (result.status !== 'resolved' || !isPlainRecord(result.record)) {
+            return { status: 'unresolved', message: 'Philosophy revision reader returned an invalid resolved record' };
+        }
+        const integrity = validateResolvedRecord(result.record, reference, input.context.principal, input.phase);
+        if (integrity.status !== 'resolved')
+            return integrity;
+        return { status: 'resolved', digest: reference.digest };
+    };
+}
+function validateResolvedRecord(record, reference, principal, phase) {
+    if (record.kind !== 'philosophy' || record.id !== reference.id || record.revision !== reference.revision) {
+        return { status: 'unresolved', message: 'Philosophy revision identity does not match the requested reference' };
+    }
+    if (!isDigest(record.digest) || record.digest !== reference.digest) {
+        return { status: 'unresolved', message: 'Philosophy revision digest does not match the requested reference' };
+    }
+    try {
+        assertPhilosophyRevisionPayload(record.payload);
+        assertPhilosophyRevisionApplicability(record.applicability);
+        if (philosophyRevisionDigest(record) !== record.digest) {
+            return { status: 'unresolved', message: 'Philosophy revision payload digest is corrupt' };
+        }
+    }
+    catch {
+        return { status: 'unresolved', message: 'Philosophy revision payload or applicability is corrupt' };
+    }
+    if (!isPhilosophyRevisionAcl(record.currentAcl) || !isPhilosophyRevisionScope(record.currentScope)) {
+        return { status: 'unresolved', message: 'Philosophy revision authorization metadata is corrupt' };
+    }
+    if (!sameScope(record.currentScope, reference.scope)) {
+        return { status: 'unauthorized', message: 'Philosophy revision is outside the requested tenant/project scope' };
+    }
+    // A current save/read must prove that the revision applies to this
+    // judgment.  Historical reads preserve the original reference and only
+    // re-check immutable content plus the current ACL/scope, matching the
+    // snapshot provider contract; applicability is not re-evaluated against a
+    // later policy boundary.
+    if (phase !== 'historical_read') {
+        if (!sameScope(record.applicability.scope, reference.scope)) {
+            return { status: 'not_applicable', message: 'Philosophy revision is outside the requested applicability scope' };
+        }
+        const referenceApplicability = referenceApplicabilityFrom(reference);
+        if (!periodContains(record.applicability, referenceApplicability)) {
+            return { status: 'not_applicable', message: 'Philosophy revision does not cover the requested applicability period' };
+        }
+    }
+    if (!canReadPhilosophyRevision(record.currentAcl, principal)) {
+        return { status: 'unauthorized', message: 'Philosophy revision is not readable by the current principal' };
+    }
+    return { status: 'resolved', digest: reference.digest };
+}
+function assertPhilosophyRevisionIdentity(value) {
+    if (value.kind !== 'philosophy' || !isNonEmptyString(value.id) || !isPositiveRevision(value.revision)) {
+        throw new TypeError('Philosophy revision identity requires kind, id, and a positive revision');
+    }
+}
+function assertPhilosophyRevisionPayload(value) {
+    try {
+        // canonicalPortableJson rejects undefined, non-JSON objects, non-finite
+        // numbers, and cyclic values while preserving opaque philosophy shape.
+        canonicalPortableJson(value);
+    }
+    catch {
+        throw new TypeError('Philosophy revision payload must be a JSON value');
+    }
+}
+function assertPhilosophyRevisionApplicability(value) {
+    if (!isPlainRecord(value) || !isPhilosophyRevisionScope(value.scope) || !isRfc3339(value.validFrom) ||
+        (value.validUntil !== undefined && !isRfc3339(value.validUntil)) ||
+        (typeof value.validUntil === 'string' && Date.parse(value.validFrom) > Date.parse(value.validUntil))) {
+        throw new TypeError('Philosophy revision applicability is invalid');
+    }
+}
+function referenceApplicabilityFrom(reference) {
+    return {
+        scope: cloneScope(reference.scope),
+        validFrom: reference.valid_from,
+        ...(reference.valid_to == null ? {} : { validUntil: reference.valid_to })
+    };
+}
+function canonicalApplicability(value) {
+    return {
+        scope: cloneScope(value.scope),
+        validFrom: value.validFrom,
+        ...(value.validUntil === undefined ? {} : { validUntil: value.validUntil })
+    };
+}
+function periodContains(source, requested) {
+    const sourceFrom = Date.parse(source.validFrom);
+    const sourceUntil = source.validUntil === undefined ? Number.POSITIVE_INFINITY : Date.parse(source.validUntil);
+    const requestedFrom = Date.parse(requested.validFrom);
+    const requestedUntil = requested.validUntil === undefined ? Number.POSITIVE_INFINITY : Date.parse(requested.validUntil);
+    return sourceFrom <= requestedFrom && sourceUntil >= requestedUntil;
+}
+function isValidInterval(from, to) {
+    return isRfc3339(from) && isRfc3339(to) && Date.parse(from) <= Date.parse(to);
+}
+function isPhilosophyRevisionAcl(value) {
+    if (!isPlainRecord(value) || !isNonEmptyString(value.ownerId) ||
+        !ACL_VISIBILITIES.includes(value.visibility) ||
+        !isStringArray(value.readerIds) || !isStringArray(value.writerIds))
+        return false;
+    return new Set(value.readerIds).size === value.readerIds.length && new Set(value.writerIds).size === value.writerIds.length;
+}
+function canReadPhilosophyRevision(acl, principal) {
+    return acl.visibility === 'public' || acl.ownerId === principal ||
+        acl.readerIds.includes(principal) || acl.writerIds.includes(principal);
+}
+function isPhilosophyRevisionScope(value) {
+    return isPlainRecord(value) && SCOPE_TYPES.includes(value.type) && isNonEmptyString(value.id);
+}
+function sameScope(left, right) {
+    return left.type === right.type && left.id === right.id;
+}
+function cloneScope(scope) {
+    return { type: scope.type, id: scope.id };
+}
+function isDigest(value) {
+    return typeof value === 'string' && DIGEST_PATTERN.test(value);
+}
+function isPositiveRevision(value) {
+    return typeof value === 'string' && REVISION_PATTERN.test(value);
+}
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.trim().length > 0 && !value.includes('\0');
+}
+function isPlainRecord(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((item) => isNonEmptyString(item));
+}
+function isRfc3339(value) {
+    if (typeof value !== 'string')
+        return false;
+    try {
+        // Reuse the canonical Graph calendar validation so philosophy revision
+        // periods reject the same malformed timestamps as Graph records.
+        isActiveAt({ validFrom: value }, value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/portable-graph.d.ts

@@ -29,6 +29,30 @@ export declare function createPortableGraph(os: PersonalOs): PortableGraphBundle
 export declare function validatePortableGraph(value: unknown): asserts value is PortableGraphBundle;
 /** Rehydrate a validated bundle into the shared retrieval input shape. */
 export declare function hydratePortableGraph(bundle: PortableGraphBundle): PersonalOs;
+/** The ID an OSS Personal OS gives its owner; a host replaces it with the owner's own ID when reading a bundle. */
+export declare const PORTABLE_GRAPH_OWNER_PLACEHOLDER = "self";
+export interface PortableGraphOwner {
+    /** The owner's person ID in the host that stores the bundle (never `self`). */
+    personId: string;
+    /** The owner's name in that host, shown in place of the bundle's name for `self`. */
+    name?: string | null;
+}
+/**
+ * Read a bundle as its owner: every `self` becomes the owner's person ID in
+ * the host, and the owner's record carries the host's name for them (the
+ * bundle's own name stays as an alias).  Replaced: `graph.owner.id`, the
+ * entity `self`, relation endpoints, and in the foundation definitions
+ * `acl.ownerId` / `readerIds` / `writerIds`, `beneficiaryIds`,
+ * `accountableId` and the `subjectIds` of every scope (`scope`,
+ * `applicability`, constraint exception scopes).
+ *
+ * The result is a read projection, not a bundle to store or send: the input
+ * is not changed, relation IDs stay those of the stored bundle (they name the
+ * relation there) and foundation digests are not recomputed.  A bundle that
+ * already has another record with the owner's person ID is refused rather
+ * than merged.
+ */
+export declare function bindPortableGraphOwner(bundle: PortableGraphBundle, owner: PortableGraphOwner): PortableGraphBundle;
 /** Use exactly the OSS retrieval implementation against a portable bundle. */
 export declare function retrievePortableGraph(bundle: PortableGraphBundle, input: GraphRetrievalInput, provider?: EmbeddingProvider): Promise<GraphRetrievalResponse>;
 /** Canonical JSON with recursively sorted object keys and preserved array order. */

package/dist/portable-graph.js

@@ -102,6 +102,83 @@ export function hydratePortableGraph(bundle) {
         sourceCount: 0
     };
 }
+/** The ID an OSS Personal OS gives its owner; a host replaces it with the owner's own ID when reading a bundle. */
+export const PORTABLE_GRAPH_OWNER_PLACEHOLDER = 'self';
+/**
+ * Read a bundle as its owner: every `self` becomes the owner's person ID in
+ * the host, and the owner's record carries the host's name for them (the
+ * bundle's own name stays as an alias).  Replaced: `graph.owner.id`, the
+ * entity `self`, relation endpoints, and in the foundation definitions
+ * `acl.ownerId` / `readerIds` / `writerIds`, `beneficiaryIds`,
+ * `accountableId` and the `subjectIds` of every scope (`scope`,
+ * `applicability`, constraint exception scopes).
+ *
+ * The result is a read projection, not a bundle to store or send: the input
+ * is not changed, relation IDs stay those of the stored bundle (they name the
+ * relation there) and foundation digests are not recomputed.  A bundle that
+ * already has another record with the owner's person ID is refused rather
+ * than merged.
+ */
+export function bindPortableGraphOwner(bundle, owner) {
+    validatePortableGraph(bundle);
+    const personId = typeof owner?.personId === 'string' ? owner.personId.trim() : '';
+    if (!personId || personId === PORTABLE_GRAPH_OWNER_PLACEHOLDER) {
+        throw new Error('PORTABLE-GRAPH-OWNER: the owner person ID is required and cannot be self');
+    }
+    if (bundle.graph.entities.some((entity) => entity.id === personId)) {
+        throw new Error(`PORTABLE-GRAPH-OWNER-CONFLICT: the bundle already has a record ${personId}`);
+    }
+    const name = typeof owner.name === 'string' && owner.name.trim() ? owner.name.trim() : null;
+    const bound = structuredClone(bundle);
+    const swap = (id) => (id === PORTABLE_GRAPH_OWNER_PLACEHOLDER ? personId : id);
+    const swapAll = (ids) => {
+        if (!Array.isArray(ids))
+            return;
+        for (let index = 0; index < ids.length; index += 1)
+            if (typeof ids[index] === 'string')
+                ids[index] = swap(ids[index]);
+    };
+    const graph = bound.graph;
+    if (graph.owner) {
+        if (graph.owner.id === PORTABLE_GRAPH_OWNER_PLACEHOLDER)
+            graph.owner.id = personId;
+        if (name)
+            graph.owner.name = name;
+    }
+    for (const entity of graph.entities) {
+        if (entity.id !== PORTABLE_GRAPH_OWNER_PLACEHOLDER)
+            continue;
+        entity.id = personId;
+        if (name && name !== entity.name) {
+            const aliases = entity.aliases ?? [];
+            if (entity.name.trim() && !aliases.includes(entity.name))
+                aliases.push(entity.name);
+            entity.aliases = aliases;
+            entity.name = name;
+        }
+    }
+    for (const edge of graph.edges) {
+        edge.fromId = swap(edge.fromId);
+        edge.toId = swap(edge.toId);
+    }
+    for (const record of graph.foundation?.records ?? []) {
+        const definition = record.definition;
+        if (isPlainRecord(definition.acl)) {
+            if (typeof definition.acl.ownerId === 'string')
+                definition.acl.ownerId = swap(definition.acl.ownerId);
+            swapAll(definition.acl.readerIds);
+            swapAll(definition.acl.writerIds);
+        }
+        swapAll(definition.beneficiaryIds);
+        if (typeof definition.accountableId === 'string')
+            definition.accountableId = swap(definition.accountableId);
+        for (const scope of [definition.scope, definition.applicability, ...(Array.isArray(definition.exceptions) ? definition.exceptions.map((item) => item?.scope) : [])]) {
+            if (isPlainRecord(scope))
+                swapAll(scope.subjectIds);
+        }
+    }
+    return bound;
+}
 /** Use exactly the OSS retrieval implementation against a portable bundle. */
 export function retrievePortableGraph(bundle, input, provider) {
     return retrieveGraph(hydratePortableGraph(bundle), input, provider);

package/dist/server.d.ts

@@ -1,3 +1,4 @@
+import { type FoundationPublicConnection } from './foundation-public-provider.js';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 export declare const toolDefinitions: readonly [{
     readonly name: "get_context";
@@ -634,6 +635,10 @@ export declare const toolDefinitions: readonly [{
         };
     };
 }];
-export declare function callBrainbaseTool(name: string, rawArgs?: unknown): Promise<unknown>;
-export declare function createServer(): Server;
+export declare function callBrainbaseTool(name: string, rawArgs?: unknown, options?: {
+    foundation?: FoundationPublicConnection;
+}): Promise<unknown>;
+export declare function createServer(options?: {
+    foundation?: FoundationPublicConnection;
+}): Server;
 export declare function runMcpServer(): Promise<void>;

package/dist/server.js

@@ -1,3 +1,4 @@
+import { callFoundationPublicTool, foundationPublicToolDefinitions } from './foundation-public-provider.js';
 import { createOrganizationGraphConfig, createOrganizationGraphClient } from './organization-graph.js';
 import { createHash } from 'node:crypto';
 import { retrieveGraph } from './graph-retrieval.js';
@@ -447,11 +448,11 @@ function configuredPersonalKnowledgeMode() {
     }
     throw new Error(`Unsupported Personal Knowledge mode: ${configuredMode}.`);
 }
-function configuredToolDefinitions() {
+function configuredToolDefinitions(foundation) {
     if (configuredPersonalKnowledgeMode() === 'managed_cloud') {
         return toolDefinitions.filter((tool) => isPersonalKnowledgeTool(tool.name));
     }
-    return [...toolDefinitions];
+    return [...toolDefinitions, ...(foundation ? foundationPublicToolDefinitions : [])];
 }
 let embeddingProvider;
 let embeddingProviderInitialized = false;
@@ -532,11 +533,13 @@ async function callPersonalKnowledgeTool(name, rawArgs) {
     }
     throw new Error(`Unknown Personal Knowledge tool: ${name}`);
 }
-export async function callBrainbaseTool(name, rawArgs = {}) {
+export async function callBrainbaseTool(name, rawArgs = {}, options = {}) {
     const mode = configuredPersonalKnowledgeMode();
     if (mode === 'managed_cloud' && !isPersonalKnowledgeTool(name)) {
         throw new Error('managed_cloud Personal Knowledge MCP only permits personal_knowledge_context, personal_knowledge_register, and personal_knowledge_search.');
     }
+    if (name.startsWith('foundation_'))
+        return callFoundationPublicTool(name, rawArgs, options.foundation);
     if (isPersonalKnowledgeTool(name)) {
         return callPersonalKnowledgeTool(name, rawArgs);
     }
@@ -857,7 +860,7 @@ function onboardingGuide(state) {
     };
     return guides[state];
 }
-export function createServer() {
+export function createServer(options = {}) {
     const server = new Server({
         name: 'brainbase-mcp',
         version: '0.1.0'
@@ -867,10 +870,10 @@ export function createServer() {
         }
     });
     server.setRequestHandler(ListToolsRequestSchema, async () => ({
-        tools: configuredToolDefinitions()
+        tools: configuredToolDefinitions(options.foundation)
     }));
     server.setRequestHandler(CallToolRequestSchema, async (request) => {
-        const result = await callBrainbaseTool(request.params.name, request.params.arguments);
+        const result = await callBrainbaseTool(request.params.name, request.params.arguments, options);
         return {
             content: [
                 {

package/dist/value-proof-review-http.d.ts

@@ -0,0 +1,25 @@
+import { type IncomingMessage, type Server, type ServerResponse } from 'node:http';
+export declare const VALUE_PROOF_REVIEW_HTTP_VERSION: "value-proof-review-http.v1";
+export declare const VALUE_PROOF_REVIEW_TOKEN_HEADER = "x-brainbase-review-token";
+export interface ValueProofReviewHttpOptions {
+    /** Judgment journal root. Defaults to `~/.brainbase/personal-os/judgment-journal`. */
+    readonly journalRoot?: string;
+    /** Personal OS data directory that stores owner feedback. */
+    readonly dataDir?: string;
+    /** Required on mutating requests. */
+    readonly token: string;
+    readonly basePath?: string;
+    readonly now?: () => Date;
+}
+export type ValueProofReviewHttpHandler = (request: IncomingMessage, response: ServerResponse) => Promise<boolean>;
+export declare function createValueProofReviewHttpHandler(options: ValueProofReviewHttpOptions): ValueProofReviewHttpHandler;
+export interface ValueProofReviewHostOptions extends Omit<ValueProofReviewHttpOptions, 'token'> {
+    readonly token?: string;
+    /** Directory containing the packaged `ui/` files. */
+    readonly uiDir?: string;
+}
+/** Local single-owner host. The caller owns `listen()` and must bind to a loopback address. */
+export declare function createValueProofReviewHost(options?: ValueProofReviewHostOptions): {
+    readonly server: Server;
+    readonly token: string;
+};

package/dist/value-proof-review-http.js

@@ -0,0 +1,185 @@
+import { randomBytes } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import { join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { buildJudgmentValueProofReviewHome, readJudgmentValueProofFeedback, readJudgmentValueProofJournal, recordJudgmentValueProofFeedback } from './judgment-value-proof-review.js';
+import { assertSameOrigin, isLoopbackHost, LOCAL_WEB_CONTENT_SECURITY_POLICY, LocalWebHttpError as HttpError, readJsonObjectBody, requestUrl, tokenMatches, writeHttpError as writeError, writeJson } from './local-web-security.js';
+export const VALUE_PROOF_REVIEW_HTTP_VERSION = 'value-proof-review-http.v1';
+export const VALUE_PROOF_REVIEW_TOKEN_HEADER = 'x-brainbase-review-token';
+const DEFAULT_BASE_PATH = '/api/value-proofs';
+const MAX_BODY_BYTES = 16 * 1024;
+// The review part imports the shared screen pattern (workspace-kit), which reads the shared tokens.
+const UI_FILES = Object.freeze({
+    '/ui/brainbase-tokens.css': { file: 'brainbase-tokens.css', type: 'text/css; charset=utf-8' },
+    '/ui/workspace-kit.js': { file: 'workspace-kit.js', type: 'text/javascript; charset=utf-8' },
+    '/ui/workspace-kit.css': { file: 'workspace-kit.css', type: 'text/css; charset=utf-8' },
+    '/ui/value-proof-review.js': { file: 'value-proof-review.js', type: 'text/javascript; charset=utf-8' },
+    '/ui/value-proof-review.css': { file: 'value-proof-review.css', type: 'text/css; charset=utf-8' }
+});
+function publicHome(home) {
+    if (home.status === 'unavailable')
+        return home;
+    const strip = (items) => Object.fromEntries(Object.entries(items).map(([section, list]) => [
+        section,
+        list.map(({ section: itemSection, proof, feedback_history }) => ({ section: itemSection, proof, feedback_history }))
+    ]));
+    return {
+        status: home.status,
+        root: home.root,
+        coverage: home.coverage,
+        sections: strip(home.sections),
+        // Holds only decision IDs, counts and states; no local paths.
+        delegation_map: home.delegation_map,
+        rejected: home.rejected.map((entry) => ({ file: relative(home.root, entry.file), reason: entry.reason }))
+    };
+}
+export function createValueProofReviewHttpHandler(options) {
+    if (typeof options.token !== 'string' || options.token.length < 16) {
+        throw new TypeError('token must be at least 16 characters');
+    }
+    const basePath = (options.basePath ?? DEFAULT_BASE_PATH).replace(/\/+$/u, '');
+    const now = options.now ?? (() => new Date());
+    async function readHome() {
+        const journal = await readJudgmentValueProofJournal({ root: options.journalRoot });
+        const feedback = journal.status === 'available'
+            ? await readJudgmentValueProofFeedback({ dataDir: options.dataDir })
+            : [];
+        return buildJudgmentValueProofReviewHome(journal, feedback, { now: now() });
+    }
+    async function recordFeedback(request) {
+        assertSameOrigin(request);
+        if (!tokenMatches(options.token, request.headers[VALUE_PROOF_REVIEW_TOKEN_HEADER])) {
+            throw new HttpError(403, 'review_token_required', 'A valid review token is required');
+        }
+        const body = await readJsonObjectBody(request, MAX_BODY_BYTES);
+        const intentId = typeof body.intent_id === 'string' ? body.intent_id : '';
+        const attemptId = typeof body.decision_attempt_id === 'string' ? body.decision_attempt_id : '';
+        const journal = await readJudgmentValueProofJournal({ root: options.journalRoot });
+        if (journal.status === 'unavailable') {
+            throw new HttpError(503, 'judgment_journal_unavailable', journal.reason);
+        }
+        const known = journal.entries.some((entry) => entry.proof.intent_id === intentId
+            && entry.proof.decision_attempt_id === attemptId);
+        if (!known)
+            throw new HttpError(404, 'value_proof_not_found', 'No saved value proof matches this decision');
+        try {
+            const result = await recordJudgmentValueProofFeedback({
+                dataDir: options.dataDir,
+                intent_id: intentId,
+                decision_attempt_id: attemptId,
+                status: body.status,
+                summary: typeof body.summary === 'string' ? body.summary : null,
+                target_layer: typeof body.target_layer === 'string' ? body.target_layer : null,
+                now: now()
+            });
+            return { statusCode: result.created ? 201 : 200, body: result };
+        }
+        catch (error) {
+            if (error instanceof TypeError)
+                throw new HttpError(400, 'invalid_feedback', error.message);
+            throw error;
+        }
+    }
+    return async (request, response) => {
+        const path = requestUrl(request).pathname;
+        if (path !== `${basePath}/home` && path !== `${basePath}/feedback`)
+            return false;
+        try {
+            if (path === `${basePath}/home`) {
+                if (request.method !== 'GET')
+                    throw new HttpError(405, 'method_not_allowed', 'Use GET');
+                writeJson(response, 200, publicHome(await readHome()));
+                return true;
+            }
+            if (request.method !== 'POST')
+                throw new HttpError(405, 'method_not_allowed', 'Use POST');
+            const result = await recordFeedback(request);
+            writeJson(response, result.statusCode, result.body);
+        }
+        catch (error) {
+            if (error instanceof HttpError)
+                writeError(response, error);
+            else
+                writeJson(response, 500, { error: { code: 'internal_error', message: 'Unexpected error' } });
+        }
+        return true;
+    };
+}
+function escapeAttribute(value) {
+    return value.replace(/[&"<>]/gu, (character) => ({ '&': '&amp;', '"': '&quot;', '<': '&lt;', '>': '&gt;' }[character] ?? character));
+}
+function shellHtml(token, basePath) {
+    return `<!doctype html>
+<html lang="ja">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="brainbase-review-token" content="${escapeAttribute(token)}">
+<meta name="brainbase-review-base-path" content="${escapeAttribute(basePath)}">
+<title>Brainbase 判断の見返し</title>
+<link rel="stylesheet" href="/ui/brainbase-tokens.css">
+<link rel="stylesheet" href="/ui/workspace-kit.css">
+<link rel="stylesheet" href="/ui/value-proof-review.css">
+</head>
+<body>
+<main id="brainbase-value-proof-review"></main>
+<script type="module" src="/app.js"></script>
+</body>
+</html>
+`;
+}
+const BOOTSTRAP_JS = `import { createValueProofReviewUI } from '/ui/value-proof-review.js';
+const meta = (name) => document.querySelector(\`meta[name="\${name}"]\`)?.getAttribute('content') ?? '';
+createValueProofReviewUI({
+  root: document.getElementById('brainbase-value-proof-review'),
+  basePath: meta('brainbase-review-base-path'),
+  token: meta('brainbase-review-token')
+});
+`;
+/** Local single-owner host. The caller owns `listen()` and must bind to a loopback address. */
+export function createValueProofReviewHost(options = {}) {
+    const token = options.token ?? randomBytes(24).toString('base64url');
+    const basePath = (options.basePath ?? DEFAULT_BASE_PATH).replace(/\/+$/u, '');
+    const uiDir = options.uiDir ?? fileURLToPath(new URL('../ui/', import.meta.url));
+    const handler = createValueProofReviewHttpHandler({ ...options, token, basePath });
+    const server = createServer((request, response) => {
+        void (async () => {
+            if (!isLoopbackHost(request)) {
+                writeJson(response, 403, { error: { code: 'host_rejected', message: 'Host must be a loopback address for this server' } });
+                return;
+            }
+            if (await handler(request, response))
+                return;
+            const path = requestUrl(request).pathname;
+            if (request.method !== 'GET') {
+                writeJson(response, 405, { error: { code: 'method_not_allowed', message: 'Use GET' } });
+                return;
+            }
+            response.setHeader('Cache-Control', 'no-store');
+            response.setHeader('X-Content-Type-Options', 'nosniff');
+            if (path === '/') {
+                response.setHeader('Content-Type', 'text/html; charset=utf-8');
+                response.setHeader('Content-Security-Policy', LOCAL_WEB_CONTENT_SECURITY_POLICY);
+                response.setHeader('Referrer-Policy', 'no-referrer');
+                response.end(shellHtml(token, basePath));
+                return;
+            }
+            if (path === '/app.js') {
+                response.setHeader('Content-Type', 'text/javascript; charset=utf-8');
+                response.end(BOOTSTRAP_JS);
+                return;
+            }
+            const asset = UI_FILES[path];
+            if (!asset) {
+                writeJson(response, 404, { error: { code: 'not_found', message: 'Not found' } });
+                return;
+            }
+            response.setHeader('Content-Type', asset.type);
+            response.end(await readFile(join(uiDir, asset.file)));
+        })().catch(() => {
+            writeJson(response, 500, { error: { code: 'internal_error', message: 'Unexpected error' } });
+        });
+    });
+    return { server, token };
+}