sonobat 0.5.1 → 0.5.2

package/dist/index.js

@@ -3539,6 +3539,1989 @@ function registerKbTools(server2, db2) {
   );
 }
 
+// src/mcp/tools/ops.ts
+import { z as z7 } from "zod";
+
+// src/db/repository/engagement-repository.ts
+import crypto6 from "crypto";
+function rowToEngagement(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    environment: row.environment,
+    scopeJson: row.scope_json,
+    policyJson: row.policy_json,
+    ...row.schedule_cron !== null ? { scheduleCron: row.schedule_cron } : {},
+    status: row.status,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+var FIELD_TO_COLUMN = {
+  name: "name",
+  environment: "environment",
+  scopeJson: "scope_json",
+  policyJson: "policy_json",
+  scheduleCron: "schedule_cron",
+  status: "status"
+};
+var EngagementRepository = class {
+  db;
+  insertStmt;
+  selectByIdStmt;
+  selectByStatusStmt;
+  selectAllStmt;
+  deleteStmt;
+  constructor(db2) {
+    this.db = db2;
+    this.insertStmt = this.db.prepare(
+      `INSERT INTO engagements (id, name, environment, scope_json, policy_json, schedule_cron, status, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    );
+    this.selectByIdStmt = this.db.prepare(
+      `SELECT id, name, environment, scope_json, policy_json, schedule_cron, status, created_at, updated_at
+       FROM engagements WHERE id = ?`
+    );
+    this.selectByStatusStmt = this.db.prepare(
+      `SELECT id, name, environment, scope_json, policy_json, schedule_cron, status, created_at, updated_at
+       FROM engagements WHERE status = ?`
+    );
+    this.selectAllStmt = this.db.prepare(
+      `SELECT id, name, environment, scope_json, policy_json, schedule_cron, status, created_at, updated_at
+       FROM engagements`
+    );
+    this.deleteStmt = this.db.prepare(`DELETE FROM engagements WHERE id = ?`);
+  }
+  /**
+   * Engagement を新規作成して返す。
+   *
+   * デフォルト値:
+   * - environment: 'stg'
+   * - scopeJson: '{}'
+   * - policyJson: '{}'
+   * - status: 'active'
+   */
+  create(input) {
+    const id = crypto6.randomUUID();
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    const environment = input.environment ?? "stg";
+    const scopeJson = input.scopeJson ?? "{}";
+    const policyJson = input.policyJson ?? "{}";
+    const scheduleCron = input.scheduleCron ?? null;
+    const status = input.status ?? "active";
+    this.insertStmt.run(
+      id,
+      input.name,
+      environment,
+      scopeJson,
+      policyJson,
+      scheduleCron,
+      status,
+      timestamp,
+      timestamp
+    );
+    return {
+      id,
+      name: input.name,
+      environment,
+      scopeJson,
+      policyJson,
+      ...scheduleCron !== null ? { scheduleCron } : {},
+      status,
+      createdAt: timestamp,
+      updatedAt: timestamp
+    };
+  }
+  /**
+   * ID で Engagement を取得する。存在しなければ undefined。
+   */
+  findById(id) {
+    const row = this.selectByIdStmt.get(id);
+    if (row === void 0) {
+      return void 0;
+    }
+    return rowToEngagement(row);
+  }
+  /**
+   * status で Engagement 一覧を取得する。
+   */
+  findByStatus(status) {
+    const rows = this.selectByStatusStmt.all(status);
+    return rows.map(rowToEngagement);
+  }
+  /**
+   * 全 Engagement を取得する。
+   */
+  list() {
+    const rows = this.selectAllStmt.all();
+    return rows.map(rowToEngagement);
+  }
+  /**
+   * Engagement の指定フィールドを更新する。
+   *
+   * 提供されたフィールドのみ SET し、updated_at を自動更新する。
+   * 存在しない ID の場合 undefined を返す。
+   */
+  update(id, fields) {
+    const setClauses = [];
+    const params = [];
+    for (const [key, value] of Object.entries(fields)) {
+      const column = FIELD_TO_COLUMN[key];
+      if (column !== void 0) {
+        setClauses.push(`${column} = ?`);
+        params.push(value ?? null);
+      }
+    }
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    setClauses.push("updated_at = ?");
+    params.push(timestamp);
+    params.push(id);
+    const sql = `UPDATE engagements SET ${setClauses.join(", ")} WHERE id = ?`;
+    const result = this.db.prepare(sql).run(...params);
+    if (result.changes === 0) {
+      return void 0;
+    }
+    return this.findById(id);
+  }
+  /**
+   * Engagement を削除する。
+   *
+   * CASCADE により関連する runs なども同時に削除される。
+   *
+   * @returns 削除成功時 true、id が存在しない場合 false。
+   */
+  delete(id) {
+    const result = this.deleteStmt.run(id);
+    return result.changes > 0;
+  }
+};
+
+// src/db/repository/run-repository.ts
+import crypto7 from "crypto";
+function rowToRun(row) {
+  return {
+    id: row.id,
+    engagementId: row.engagement_id,
+    triggerKind: row.trigger_kind,
+    ...row.trigger_ref !== null ? { triggerRef: row.trigger_ref } : {},
+    status: row.status,
+    ...row.started_at !== null ? { startedAt: row.started_at } : {},
+    ...row.finished_at !== null ? { finishedAt: row.finished_at } : {},
+    summaryJson: row.summary_json,
+    createdAt: row.created_at
+  };
+}
+var RunRepository = class {
+  db;
+  insertStmt;
+  selectByIdStmt;
+  selectByEngagementStmt;
+  selectByStatusStmt;
+  deleteStmt;
+  constructor(db2) {
+    this.db = db2;
+    this.insertStmt = this.db.prepare(
+      `INSERT INTO runs (id, engagement_id, trigger_kind, trigger_ref, status, started_at, finished_at, summary_json, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    );
+    this.selectByIdStmt = this.db.prepare(
+      `SELECT id, engagement_id, trigger_kind, trigger_ref, status, started_at, finished_at, summary_json, created_at
+       FROM runs WHERE id = ?`
+    );
+    this.selectByEngagementStmt = this.db.prepare(
+      `SELECT id, engagement_id, trigger_kind, trigger_ref, status, started_at, finished_at, summary_json, created_at
+       FROM runs WHERE engagement_id = ? ORDER BY created_at DESC LIMIT ?`
+    );
+    this.selectByStatusStmt = this.db.prepare(
+      `SELECT id, engagement_id, trigger_kind, trigger_ref, status, started_at, finished_at, summary_json, created_at
+       FROM runs WHERE status = ?`
+    );
+    this.deleteStmt = this.db.prepare(`DELETE FROM runs WHERE id = ?`);
+  }
+  /**
+   * Run を新規作成して返す。
+   *
+   * - created_at は現在時刻に設定
+   * - status が 'running' の場合、started_at も現在時刻に設定
+   * - summaryJson はデフォルト '{}'
+   */
+  create(input) {
+    const id = crypto7.randomUUID();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const startedAt = input.status === "running" ? now : null;
+    this.insertStmt.run(
+      id,
+      input.engagementId,
+      input.triggerKind,
+      input.triggerRef ?? null,
+      input.status,
+      startedAt,
+      null,
+      // finished_at
+      "{}",
+      // summary_json
+      now
+      // created_at
+    );
+    return {
+      id,
+      engagementId: input.engagementId,
+      triggerKind: input.triggerKind,
+      ...input.triggerRef !== void 0 ? { triggerRef: input.triggerRef } : {},
+      status: input.status,
+      ...startedAt !== null ? { startedAt } : {},
+      summaryJson: "{}",
+      createdAt: now
+    };
+  }
+  /**
+   * ID で Run を取得する。存在しなければ undefined。
+   */
+  findById(id) {
+    const row = this.selectByIdStmt.get(id);
+    if (row === void 0) {
+      return void 0;
+    }
+    return rowToRun(row);
+  }
+  /**
+   * engagement_id で Run 一覧を取得する。
+   * ORDER BY created_at DESC、LIMIT デフォルト 100。
+   */
+  findByEngagement(engagementId, limit) {
+    const rows = this.selectByEngagementStmt.all(engagementId, limit ?? 100);
+    return rows.map(rowToRun);
+  }
+  /**
+   * status で Run 一覧を取得する。
+   */
+  findByStatus(status) {
+    const rows = this.selectByStatusStmt.all(status);
+    return rows.map(rowToRun);
+  }
+  /**
+   * Run のステータスを更新する。
+   *
+   * - 'succeeded' または 'failed' の場合、finished_at を現在時刻に設定
+   * - 'running' の場合、started_at が未設定なら現在時刻に設定
+   * - summaryJson が指定された場合、summary_json も更新
+   *
+   * @returns 更新後の Run。id が存在しなければ undefined。
+   */
+  updateStatus(id, status, summaryJson) {
+    const existing = this.findById(id);
+    if (existing === void 0) {
+      return void 0;
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const setClauses = ["status = ?"];
+    const params = [status];
+    if (status === "succeeded" || status === "failed") {
+      setClauses.push("finished_at = ?");
+      params.push(now);
+    }
+    if (status === "running" && existing.startedAt === void 0) {
+      setClauses.push("started_at = ?");
+      params.push(now);
+    }
+    if (summaryJson !== void 0) {
+      setClauses.push("summary_json = ?");
+      params.push(summaryJson);
+    }
+    params.push(id);
+    const sql = `UPDATE runs SET ${setClauses.join(", ")} WHERE id = ?`;
+    this.db.prepare(sql).run(...params);
+    return this.findById(id);
+  }
+  /**
+   * Run を削除する。
+   *
+   * @returns 削除成功時 true、id が存在しない場合 false。
+   */
+  delete(id) {
+    const result = this.deleteStmt.run(id);
+    return result.changes > 0;
+  }
+};
+
+// src/db/repository/action-queue-repository.ts
+import crypto8 from "crypto";
+function rowToActionQueueItem(row) {
+  return {
+    id: row.id,
+    engagementId: row.engagement_id,
+    ...row.run_id !== null ? { runId: row.run_id } : {},
+    ...row.parent_action_id !== null ? { parentActionId: row.parent_action_id } : {},
+    kind: row.kind,
+    priority: row.priority,
+    dedupeKey: row.dedupe_key,
+    paramsJson: row.params_json,
+    state: row.state,
+    attemptCount: row.attempt_count,
+    maxAttempts: row.max_attempts,
+    availableAt: row.available_at,
+    ...row.lease_owner !== null ? { leaseOwner: row.lease_owner } : {},
+    ...row.lease_expires_at !== null ? { leaseExpiresAt: row.lease_expires_at } : {},
+    ...row.last_error !== null ? { lastError: row.last_error } : {},
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+var ActionQueueRepository = class {
+  db;
+  insertStmt;
+  selectByIdStmt;
+  pollStmt;
+  completeStmt;
+  requeueStmt;
+  deadLetterStmt;
+  selectByEngagementStmt;
+  selectByEngagementStateStmt;
+  cancelStmt;
+  failTx;
+  constructor(db2) {
+    this.db = db2;
+    this.insertStmt = this.db.prepare(
+      `INSERT INTO action_queue
+         (id, engagement_id, run_id, parent_action_id, kind, priority,
+          dedupe_key, params_json, state, attempt_count, max_attempts,
+          available_at, lease_owner, lease_expires_at, last_error,
+          created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    );
+    this.selectByIdStmt = this.db.prepare(
+      `SELECT id, engagement_id, run_id, parent_action_id, kind, priority,
+              dedupe_key, params_json, state, attempt_count, max_attempts,
+              available_at, lease_owner, lease_expires_at, last_error,
+              created_at, updated_at
+       FROM action_queue WHERE id = ?`
+    );
+    this.pollStmt = this.db.prepare(
+      `UPDATE action_queue
+       SET state = 'running',
+           lease_owner = ?,
+           lease_expires_at = ?,
+           attempt_count = attempt_count + 1,
+           updated_at = ?
+       WHERE id = (
+         SELECT id FROM action_queue
+         WHERE state = 'queued' AND available_at <= ?
+         ORDER BY priority ASC, created_at ASC
+         LIMIT 1
+       )
+       RETURNING *`
+    );
+    this.completeStmt = this.db.prepare(
+      `UPDATE action_queue
+       SET state = 'succeeded', updated_at = ?
+       WHERE id = ? AND state = 'running'`
+    );
+    this.requeueStmt = this.db.prepare(
+      `UPDATE action_queue
+       SET state = 'queued',
+           available_at = ?,
+           last_error = ?,
+           lease_owner = NULL,
+           lease_expires_at = NULL,
+           updated_at = ?
+       WHERE id = ?`
+    );
+    this.deadLetterStmt = this.db.prepare(
+      `UPDATE action_queue
+       SET state = 'failed',
+           last_error = ?,
+           updated_at = ?
+       WHERE id = ?`
+    );
+    this.selectByEngagementStmt = this.db.prepare(
+      `SELECT id, engagement_id, run_id, parent_action_id, kind, priority,
+              dedupe_key, params_json, state, attempt_count, max_attempts,
+              available_at, lease_owner, lease_expires_at, last_error,
+              created_at, updated_at
+       FROM action_queue
+       WHERE engagement_id = ?
+       ORDER BY created_at DESC`
+    );
+    this.selectByEngagementStateStmt = this.db.prepare(
+      `SELECT id, engagement_id, run_id, parent_action_id, kind, priority,
+              dedupe_key, params_json, state, attempt_count, max_attempts,
+              available_at, lease_owner, lease_expires_at, last_error,
+              created_at, updated_at
+       FROM action_queue
+       WHERE engagement_id = ? AND state = ?
+       ORDER BY created_at DESC`
+    );
+    this.cancelStmt = this.db.prepare(
+      `UPDATE action_queue SET state = 'cancelled', updated_at = ? WHERE id = ?`
+    );
+    this.failTx = this.db.transaction((id, error) => {
+      const item = this.findById(id);
+      if (!item || item.state !== "running") return false;
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      if (item.attemptCount < item.maxAttempts) {
+        const backoffSec = item.attemptCount * 30;
+        const availableAt = new Date(Date.now() + backoffSec * 1e3).toISOString();
+        this.requeueStmt.run(availableAt, error, now, id);
+      } else {
+        this.deadLetterStmt.run(error, now, id);
+      }
+      return true;
+    });
+  }
+  /**
+   * アクションをキューに追加して返す。
+   *
+   * デフォルト値:
+   * - priority: 100
+   * - state: 'queued'
+   * - paramsJson: '{}'
+   * - maxAttempts: 3
+   * - availableAt: 現在時刻
+   */
+  enqueue(input) {
+    const id = crypto8.randomUUID();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const priority = input.priority ?? 100;
+    const state = input.state ?? "queued";
+    const paramsJson = input.paramsJson ?? "{}";
+    const maxAttempts = input.maxAttempts ?? 3;
+    const availableAt = input.availableAt ?? now;
+    this.insertStmt.run(
+      id,
+      input.engagementId,
+      input.runId ?? null,
+      input.parentActionId ?? null,
+      input.kind,
+      priority,
+      input.dedupeKey,
+      paramsJson,
+      state,
+      0,
+      // attempt_count
+      maxAttempts,
+      availableAt,
+      null,
+      // lease_owner
+      null,
+      // lease_expires_at
+      null,
+      // last_error
+      now,
+      // created_at
+      now
+      // updated_at
+    );
+    return {
+      id,
+      engagementId: input.engagementId,
+      ...input.runId !== void 0 ? { runId: input.runId } : {},
+      ...input.parentActionId !== void 0 ? { parentActionId: input.parentActionId } : {},
+      kind: input.kind,
+      priority,
+      dedupeKey: input.dedupeKey,
+      paramsJson,
+      state,
+      attemptCount: 0,
+      maxAttempts,
+      availableAt,
+      createdAt: now,
+      updatedAt: now
+    };
+  }
+  /**
+   * ID でアクションを取得する。存在しなければ undefined。
+   */
+  findById(id) {
+    const row = this.selectByIdStmt.get(id);
+    if (row === void 0) {
+      return void 0;
+    }
+    return rowToActionQueueItem(row);
+  }
+  /**
+   * キューから次のアクションをポーリングする。
+   *
+   * アトミックに state='running' に遷移し、リースを設定する。
+   * available_at が現在時刻以前のもののうち、priority ASC → created_at ASC で最初の1件を取得。
+   *
+   * @param leaseOwner       リースオーナーの識別子（例: 'worker-1'）
+   * @param leaseDurationSec リース期間（秒）。デフォルト 300秒。
+   * @returns ポーリングしたアクション。キューが空なら undefined。
+   */
+  poll(leaseOwner, leaseDurationSec) {
+    const duration = leaseDurationSec ?? 300;
+    const now = /* @__PURE__ */ new Date();
+    const nowIso = now.toISOString();
+    const leaseExpiresAt = new Date(now.getTime() + duration * 1e3).toISOString();
+    const row = this.pollStmt.get(
+      leaseOwner,
+      leaseExpiresAt,
+      nowIso,
+      nowIso
+    );
+    if (row === void 0) {
+      return void 0;
+    }
+    return rowToActionQueueItem(row);
+  }
+  /**
+   * アクションを正常完了にする。
+   *
+   * state を 'succeeded' に遷移する。running 状態でない場合は更新されない。
+   *
+   * @returns 更新成功時 true、id が存在しないか running でない場合 false。
+   */
+  complete(id) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const result = this.completeStmt.run(now, id);
+    return result.changes > 0;
+  }
+  /**
+   * アクションを失敗にする。
+   *
+   * attempt_count < max_attempts の場合: state='queued' に戻し、バックオフ付きで再スケジュール。
+   * attempt_count >= max_attempts の場合: state='failed'（dead letter）。
+   *
+   * @param id    アクション ID
+   * @param error エラーメッセージ
+   * @returns 更新成功時 true、id が存在しないか running でない場合 false。
+   */
+  fail(id, error) {
+    return this.failTx(id, error);
+  }
+  /**
+   * エンゲージメントに紐づくアクション一覧を取得する。
+   *
+   * @param engagementId エンゲージメント ID
+   * @param state        フィルタする状態（省略時は全状態）
+   * @returns アクション一覧（created_at DESC 順）
+   */
+  findByEngagement(engagementId, state) {
+    if (state !== void 0) {
+      const rows2 = this.selectByEngagementStateStmt.all(engagementId, state);
+      return rows2.map(rowToActionQueueItem);
+    }
+    const rows = this.selectByEngagementStmt.all(engagementId);
+    return rows.map(rowToActionQueueItem);
+  }
+  /**
+   * アクションをキャンセルする。
+   *
+   * @returns キャンセル成功時 true、id が存在しない場合 false。
+   */
+  cancel(id) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const result = this.cancelStmt.run(now, id);
+    return result.changes > 0;
+  }
+};
+
+// src/db/repository/action-execution-repository.ts
+import crypto9 from "crypto";
+function rowToExecution(row) {
+  return {
+    id: row.id,
+    actionId: row.action_id,
+    ...row.run_id !== null ? { runId: row.run_id } : {},
+    executor: row.executor,
+    ...row.command !== null ? { command: row.command } : {},
+    inputJson: row.input_json,
+    outputJson: row.output_json,
+    ...row.stdout_artifact_id !== null ? { stdoutArtifactId: row.stdout_artifact_id } : {},
+    ...row.stderr_artifact_id !== null ? { stderrArtifactId: row.stderr_artifact_id } : {},
+    ...row.exit_code !== null ? { exitCode: row.exit_code } : {},
+    ...row.error_type !== null ? { errorType: row.error_type } : {},
+    ...row.error_message !== null ? { errorMessage: row.error_message } : {},
+    startedAt: row.started_at,
+    ...row.finished_at !== null ? { finishedAt: row.finished_at } : {},
+    ...row.duration_ms !== null ? { durationMs: row.duration_ms } : {}
+  };
+}
+var ActionExecutionRepository = class {
+  db;
+  insertStmt;
+  selectByIdStmt;
+  selectByActionStmt;
+  selectByRunStmt;
+  constructor(db2) {
+    this.db = db2;
+    this.insertStmt = this.db.prepare(
+      `INSERT INTO action_executions (id, action_id, run_id, executor, command, input_json, output_json, started_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+    );
+    this.selectByIdStmt = this.db.prepare(
+      `SELECT id, action_id, run_id, executor, command, input_json, output_json,
+              stdout_artifact_id, stderr_artifact_id, exit_code, error_type, error_message,
+              started_at, finished_at, duration_ms
+       FROM action_executions WHERE id = ?`
+    );
+    this.selectByActionStmt = this.db.prepare(
+      `SELECT id, action_id, run_id, executor, command, input_json, output_json,
+              stdout_artifact_id, stderr_artifact_id, exit_code, error_type, error_message,
+              started_at, finished_at, duration_ms
+       FROM action_executions WHERE action_id = ? ORDER BY started_at DESC`
+    );
+    this.selectByRunStmt = this.db.prepare(
+      `SELECT id, action_id, run_id, executor, command, input_json, output_json,
+              stdout_artifact_id, stderr_artifact_id, exit_code, error_type, error_message,
+              started_at, finished_at, duration_ms
+       FROM action_executions WHERE run_id = ? ORDER BY started_at DESC`
+    );
+  }
+  /**
+   * ActionExecution を新規作成して返す。
+   *
+   * - started_at は現在時刻に自動設定
+   * - inputJson デフォルト '{}'
+   * - outputJson デフォルト '{}'
+   */
+  create(input) {
+    const id = crypto9.randomUUID();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const inputJson = input.inputJson ?? "{}";
+    this.insertStmt.run(
+      id,
+      input.actionId,
+      input.runId ?? null,
+      input.executor,
+      input.command ?? null,
+      inputJson,
+      "{}",
+      // output_json default
+      now
+      // started_at
+    );
+    return {
+      id,
+      actionId: input.actionId,
+      ...input.runId !== void 0 ? { runId: input.runId } : {},
+      executor: input.executor,
+      ...input.command !== void 0 ? { command: input.command } : {},
+      inputJson,
+      outputJson: "{}",
+      startedAt: now
+    };
+  }
+  /**
+   * ID で ActionExecution を取得する。存在しなければ undefined。
+   */
+  findById(id) {
+    const row = this.selectByIdStmt.get(id);
+    if (row === void 0) {
+      return void 0;
+    }
+    return rowToExecution(row);
+  }
+  /**
+   * action_id で ActionExecution 一覧を取得する。
+   * ORDER BY started_at DESC。
+   */
+  findByAction(actionId) {
+    const rows = this.selectByActionStmt.all(actionId);
+    return rows.map(rowToExecution);
+  }
+  /**
+   * run_id で ActionExecution 一覧を取得する。
+   * ORDER BY started_at DESC。
+   */
+  findByRun(runId) {
+    const rows = this.selectByRunStmt.all(runId);
+    return rows.map(rowToExecution);
+  }
+  /**
+   * ActionExecution を完了状態にする。
+   *
+   * - finished_at を現在時刻に設定
+   * - duration_ms を started_at からの差分で自動計算
+   * - outputJson, exitCode, errorType, errorMessage を更新
+   *
+   * @returns 更新後の ActionExecution。id が存在しなければ undefined。
+   */
+  complete(id, output) {
+    const existing = this.findById(id);
+    if (existing === void 0) {
+      return void 0;
+    }
+    const now = /* @__PURE__ */ new Date();
+    const finishedAt = now.toISOString();
+    const durationMs = now.getTime() - new Date(existing.startedAt).getTime();
+    const setClauses = ["finished_at = ?", "duration_ms = ?"];
+    const params = [finishedAt, durationMs];
+    if (output.outputJson !== void 0) {
+      setClauses.push("output_json = ?");
+      params.push(output.outputJson);
+    }
+    if (output.exitCode !== void 0) {
+      setClauses.push("exit_code = ?");
+      params.push(output.exitCode);
+    }
+    if (output.errorType !== void 0) {
+      setClauses.push("error_type = ?");
+      params.push(output.errorType);
+    }
+    if (output.errorMessage !== void 0) {
+      setClauses.push("error_message = ?");
+      params.push(output.errorMessage);
+    }
+    if (output.stdoutArtifactId !== void 0) {
+      setClauses.push("stdout_artifact_id = ?");
+      params.push(output.stdoutArtifactId);
+    }
+    if (output.stderrArtifactId !== void 0) {
+      setClauses.push("stderr_artifact_id = ?");
+      params.push(output.stderrArtifactId);
+    }
+    params.push(id);
+    const sql = `UPDATE action_executions SET ${setClauses.join(", ")} WHERE id = ?`;
+    this.db.prepare(sql).run(...params);
+    return this.findById(id);
+  }
+};
+
+// src/mcp/tools/ops.ts
+function registerOpsTools(server2, db2) {
+  const engagementRepo = new EngagementRepository(db2);
+  const runRepo = new RunRepository(db2);
+  const actionQueueRepo = new ActionQueueRepository(db2);
+  const actionExecRepo = new ActionExecutionRepository(db2);
+  server2.tool(
+    "ops",
+    "Manage operational entities. Actions: create_engagement, list_engagements, get_engagement, update_engagement, delete_engagement, create_run, list_runs, get_run, update_run_status, enqueue_action, poll_action, complete_action, fail_action, cancel_action, list_actions, get_execution, list_executions",
+    {
+      action: z7.enum([
+        "create_engagement",
+        "list_engagements",
+        "get_engagement",
+        "update_engagement",
+        "delete_engagement",
+        "create_run",
+        "list_runs",
+        "get_run",
+        "update_run_status",
+        "enqueue_action",
+        "poll_action",
+        "complete_action",
+        "fail_action",
+        "cancel_action",
+        "list_actions",
+        "get_execution",
+        "list_executions"
+      ]),
+      id: z7.string().optional().describe("Entity ID"),
+      engagementId: z7.string().optional().describe("Engagement ID"),
+      runId: z7.string().optional().describe("Run ID"),
+      actionId: z7.string().optional().describe("Action queue item ID"),
+      name: z7.string().optional().describe("Engagement name"),
+      environment: z7.string().optional().describe("Environment (e.g. stg, prod)"),
+      status: z7.string().optional().describe("Status value"),
+      triggerKind: z7.string().optional().describe("Run trigger kind"),
+      triggerRef: z7.string().optional().describe("Run trigger reference"),
+      kind: z7.string().optional().describe("Action kind"),
+      dedupeKey: z7.string().optional().describe("Action deduplication key"),
+      leaseOwner: z7.string().optional().describe("Lease owner for poll"),
+      executor: z7.string().optional().describe("Executor name"),
+      errorMessage: z7.string().optional().describe("Error message for fail"),
+      scopeJson: z7.string().optional().describe("Scope as JSON"),
+      policyJson: z7.string().optional().describe("Policy as JSON"),
+      scheduleCron: z7.string().optional().describe("Schedule cron expression"),
+      paramsJson: z7.string().optional().describe("Action parameters as JSON"),
+      summaryJson: z7.string().optional().describe("Run summary as JSON"),
+      inputJson: z7.string().optional().describe("Execution input as JSON"),
+      priority: z7.number().optional().describe("Action priority (lower = higher)"),
+      maxAttempts: z7.number().optional().describe("Max retry attempts"),
+      leaseDurationSec: z7.number().optional().describe("Lease duration in seconds"),
+      limit: z7.number().optional().describe("Result limit"),
+      state: z7.string().optional().describe("Action state filter"),
+      parentActionId: z7.string().optional().describe("Parent action ID"),
+      availableAt: z7.string().optional().describe("Available at timestamp")
+    },
+    async ({
+      action,
+      id,
+      engagementId,
+      runId,
+      actionId,
+      name,
+      environment,
+      status,
+      triggerKind,
+      triggerRef,
+      kind,
+      dedupeKey,
+      leaseOwner,
+      errorMessage,
+      scopeJson,
+      policyJson,
+      scheduleCron,
+      paramsJson,
+      summaryJson,
+      priority,
+      maxAttempts,
+      leaseDurationSec,
+      limit,
+      state,
+      parentActionId,
+      availableAt
+    }) => {
+      switch (action) {
+        // ----------------------------------------------------------------
+        // Engagement actions
+        // ----------------------------------------------------------------
+        case "create_engagement": {
+          if (!name) {
+            return {
+              content: [
+                { type: "text", text: "name parameter is required for create_engagement" }
+              ],
+              isError: true
+            };
+          }
+          const engagement = engagementRepo.create({
+            name,
+            environment,
+            scopeJson,
+            policyJson,
+            scheduleCron,
+            status
+          });
+          return { content: [{ type: "text", text: JSON.stringify(engagement, null, 2) }] };
+        }
+        case "list_engagements": {
+          const engagements = status ? engagementRepo.findByStatus(status) : engagementRepo.list();
+          return { content: [{ type: "text", text: JSON.stringify(engagements, null, 2) }] };
+        }
+        case "get_engagement": {
+          if (!id) {
+            return {
+              content: [
+                { type: "text", text: "id parameter is required for get_engagement" }
+              ],
+              isError: true
+            };
+          }
+          const engagement = engagementRepo.findById(id);
+          if (!engagement) {
+            return {
+              content: [{ type: "text", text: `Engagement not found: ${id}` }],
+              isError: true
+            };
+          }
+          return { content: [{ type: "text", text: JSON.stringify(engagement, null, 2) }] };
+        }
+        case "update_engagement": {
+          if (!id) {
+            return {
+              content: [
+                { type: "text", text: "id parameter is required for update_engagement" }
+              ],
+              isError: true
+            };
+          }
+          const fields = {};
+          if (name !== void 0) fields.name = name;
+          if (environment !== void 0) fields.environment = environment;
+          if (scopeJson !== void 0) fields.scopeJson = scopeJson;
+          if (policyJson !== void 0) fields.policyJson = policyJson;
+          if (scheduleCron !== void 0) fields.scheduleCron = scheduleCron;
+          if (status !== void 0) fields.status = status;
+          const updated = engagementRepo.update(id, fields);
+          if (!updated) {
+            return {
+              content: [{ type: "text", text: `Engagement not found: ${id}` }],
+              isError: true
+            };
+          }
+          return { content: [{ type: "text", text: JSON.stringify(updated, null, 2) }] };
+        }
+        case "delete_engagement": {
+          if (!id) {
+            return {
+              content: [
+                { type: "text", text: "id parameter is required for delete_engagement" }
+              ],
+              isError: true
+            };
+          }
+          const deleted = engagementRepo.delete(id);
+          if (!deleted) {
+            return {
+              content: [{ type: "text", text: `Engagement not found: ${id}` }],
+              isError: true
+            };
+          }
+          return {
+            content: [{ type: "text", text: `Engagement ${id} deleted successfully.` }]
+          };
+        }
+        // ----------------------------------------------------------------
+        // Run actions
+        // ----------------------------------------------------------------
+        case "create_run": {
+          if (!engagementId) {
+            return {
+              content: [
+                { type: "text", text: "engagementId parameter is required for create_run" }
+              ],
+              isError: true
+            };
+          }
+          if (!triggerKind) {
+            return {
+              content: [
+                { type: "text", text: "triggerKind parameter is required for create_run" }
+              ],
+              isError: true
+            };
+          }
+          if (!status) {
+            return {
+              content: [
+                { type: "text", text: "status parameter is required for create_run" }
+              ],
+              isError: true
+            };
+          }
+          const run = runRepo.create({
+            engagementId,
+            triggerKind,
+            triggerRef,
+            status
+          });
+          return { content: [{ type: "text", text: JSON.stringify(run, null, 2) }] };
+        }
+        case "list_runs": {
+          if (!engagementId) {
+            return {
+              content: [
+                { type: "text", text: "engagementId parameter is required for list_runs" }
+              ],
+              isError: true
+            };
+          }
+          const runs = runRepo.findByEngagement(engagementId, limit);
+          return { content: [{ type: "text", text: JSON.stringify(runs, null, 2) }] };
+        }
+        case "get_run": {
+          if (!id) {
+            return {
+              content: [{ type: "text", text: "id parameter is required for get_run" }],
+              isError: true
+            };
+          }
+          const run = runRepo.findById(id);
+          if (!run) {
+            return {
+              content: [{ type: "text", text: `Run not found: ${id}` }],
+              isError: true
+            };
+          }
+          return { content: [{ type: "text", text: JSON.stringify(run, null, 2) }] };
+        }
+        case "update_run_status": {
+          if (!id) {
+            return {
+              content: [
+                { type: "text", text: "id parameter is required for update_run_status" }
+              ],
+              isError: true
+            };
+          }
+          if (!status) {
+            return {
+              content: [
+                { type: "text", text: "status parameter is required for update_run_status" }
+              ],
+              isError: true
+            };
+          }
+          const updatedRun = runRepo.updateStatus(id, status, summaryJson);
+          if (!updatedRun) {
+            return {
+              content: [{ type: "text", text: `Run not found: ${id}` }],
+              isError: true
+            };
+          }
+          return { content: [{ type: "text", text: JSON.stringify(updatedRun, null, 2) }] };
+        }
+        // ----------------------------------------------------------------
+        // ActionQueue actions
+        // ----------------------------------------------------------------
+        case "enqueue_action": {
+          if (!engagementId) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: "engagementId parameter is required for enqueue_action"
+                }
+              ],
+              isError: true
+            };
+          }
+          if (!kind) {
+            return {
+              content: [
+                { type: "text", text: "kind parameter is required for enqueue_action" }
+              ],
+              isError: true
+            };
+          }
+          if (!dedupeKey) {
+            return {
+              content: [
+                { type: "text", text: "dedupeKey parameter is required for enqueue_action" }
+              ],
+              isError: true
+            };
+          }
+          const item = actionQueueRepo.enqueue({
+            engagementId,
+            runId,
+            parentActionId,
+            kind,
+            priority,
+            dedupeKey,
+            paramsJson,
+            state,
+            maxAttempts,
+            availableAt
+          });
+          return { content: [{ type: "text", text: JSON.stringify(item, null, 2) }] };
+        }
+        case "poll_action": {
+          if (!leaseOwner) {
+            return {
+              content: [
+                { type: "text", text: "leaseOwner parameter is required for poll_action" }
+              ],
+              isError: true
+            };
+          }
+          const polled = actionQueueRepo.poll(leaseOwner, leaseDurationSec);
+          if (!polled) {
+            return {
+              content: [{ type: "text", text: "No action available to poll" }]
+            };
+          }
+          return { content: [{ type: "text", text: JSON.stringify(polled, null, 2) }] };
+        }
+        case "complete_action": {
+          if (!id) {
+            return {
+              content: [
+                { type: "text", text: "id parameter is required for complete_action" }
+              ],
+              isError: true
+            };
+          }
+          const completed = actionQueueRepo.complete(id);
+          if (!completed) {
+            return {
+              content: [
+                { type: "text", text: `Action not found or not in running state: ${id}` }
+              ],
+              isError: true
+            };
+          }
+          return {
+            content: [{ type: "text", text: `Action ${id} completed successfully.` }]
+          };
+        }
+        case "fail_action": {
+          if (!id) {
+            return {
+              content: [
+                { type: "text", text: "id parameter is required for fail_action" }
+              ],
+              isError: true
+            };
+          }
+          if (!errorMessage) {
+            return {
+              content: [
+                { type: "text", text: "errorMessage parameter is required for fail_action" }
+              ],
+              isError: true
+            };
+          }
+          const failed = actionQueueRepo.fail(id, errorMessage);
+          if (!failed) {
+            return {
+              content: [
+                { type: "text", text: `Action not found or not in running state: ${id}` }
+              ],
+              isError: true
+            };
+          }
+          const afterFail = actionQueueRepo.findById(id);
+          return {
+            content: [{ type: "text", text: JSON.stringify(afterFail, null, 2) }]
+          };
+        }
+        case "cancel_action": {
+          if (!id) {
+            return {
+              content: [
+                { type: "text", text: "id parameter is required for cancel_action" }
+              ],
+              isError: true
+            };
+          }
+          const cancelled = actionQueueRepo.cancel(id);
+          if (!cancelled) {
+            return {
+              content: [{ type: "text", text: `Action not found: ${id}` }],
+              isError: true
+            };
+          }
+          return {
+            content: [{ type: "text", text: `Action ${id} cancelled successfully.` }]
+          };
+        }
+        case "list_actions": {
+          if (!engagementId) {
+            return {
+              content: [
+                { type: "text", text: "engagementId parameter is required for list_actions" }
+              ],
+              isError: true
+            };
+          }
+          const actions = actionQueueRepo.findByEngagement(engagementId, state);
+          return { content: [{ type: "text", text: JSON.stringify(actions, null, 2) }] };
+        }
+        // ----------------------------------------------------------------
+        // ActionExecution actions
+        // ----------------------------------------------------------------
+        case "get_execution": {
+          if (!id) {
+            return {
+              content: [
+                { type: "text", text: "id parameter is required for get_execution" }
+              ],
+              isError: true
+            };
+          }
+          const execution = actionExecRepo.findById(id);
+          if (!execution) {
+            return {
+              content: [{ type: "text", text: `Execution not found: ${id}` }],
+              isError: true
+            };
+          }
+          return { content: [{ type: "text", text: JSON.stringify(execution, null, 2) }] };
+        }
+        case "list_executions": {
+          if (actionId) {
+            const executions = actionExecRepo.findByAction(actionId);
+            return {
+              content: [{ type: "text", text: JSON.stringify(executions, null, 2) }]
+            };
+          }
+          if (runId) {
+            const executions = actionExecRepo.findByRun(runId);
+            return {
+              content: [{ type: "text", text: JSON.stringify(executions, null, 2) }]
+            };
+          }
+          return {
+            content: [
+              {
+                type: "text",
+                text: "actionId or runId parameter is required for list_executions"
+              }
+            ],
+            isError: true
+          };
+        }
+      }
+    }
+  );
+}
+
+// src/mcp/tools/findings.ts
+import { z as z8 } from "zod";
+
+// src/db/repository/finding-repository.ts
+import crypto10 from "crypto";
+function rowToFinding(row) {
+  return {
+    id: row.id,
+    engagementId: row.engagement_id,
+    canonicalKey: row.canonical_key,
+    ...row.node_id !== null ? { nodeId: row.node_id } : {},
+    title: row.title,
+    severity: row.severity,
+    confidence: row.confidence,
+    state: row.state,
+    ...row.state_reason !== null ? { stateReason: row.state_reason } : {},
+    ...row.owner !== null ? { owner: row.owner } : {},
+    ...row.ticket_ref !== null ? { ticketRef: row.ticket_ref } : {},
+    ...row.first_seen_run_id !== null ? { firstSeenRunId: row.first_seen_run_id } : {},
+    ...row.last_seen_run_id !== null ? { lastSeenRunId: row.last_seen_run_id } : {},
+    firstSeenAt: row.first_seen_at,
+    lastSeenAt: row.last_seen_at,
+    ...row.sla_due_at !== null ? { slaDueAt: row.sla_due_at } : {},
+    attrsJson: row.attrs_json
+  };
+}
+function rowToFindingEvent(row) {
+  return {
+    id: row.id,
+    findingId: row.finding_id,
+    ...row.run_id !== null ? { runId: row.run_id } : {},
+    eventType: row.event_type,
+    beforeJson: row.before_json,
+    afterJson: row.after_json,
+    ...row.artifact_id !== null ? { artifactId: row.artifact_id } : {},
+    createdAt: row.created_at
+  };
+}
+var FindingRepository = class {
+  db;
+  insertFindingStmt;
+  selectFindingByIdStmt;
+  deleteFindingStmt;
+  updateLastSeenStmt;
+  updateStateStmt;
+  insertEventStmt;
+  selectEventsByFindingStmt;
+  constructor(db2) {
+    this.db = db2;
+    this.insertFindingStmt = this.db.prepare(
+      `INSERT INTO findings
+         (id, engagement_id, canonical_key, node_id, title, severity, confidence,
+          state, state_reason, owner, ticket_ref,
+          first_seen_run_id, last_seen_run_id, first_seen_at, last_seen_at,
+          sla_due_at, attrs_json)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    );
+    this.selectFindingByIdStmt = this.db.prepare(
+      `SELECT id, engagement_id, canonical_key, node_id, title, severity, confidence,
+              state, state_reason, owner, ticket_ref,
+              first_seen_run_id, last_seen_run_id, first_seen_at, last_seen_at,
+              sla_due_at, attrs_json
+       FROM findings WHERE id = ?`
+    );
+    this.deleteFindingStmt = this.db.prepare(`DELETE FROM findings WHERE id = ?`);
+    this.updateLastSeenStmt = this.db.prepare(
+      `UPDATE findings
+       SET last_seen_at = ?, last_seen_run_id = ?,
+           title = ?, severity = ?, confidence = ?, attrs_json = ?
+       WHERE id = ?`
+    );
+    this.updateStateStmt = this.db.prepare(
+      `UPDATE findings SET state = ?, state_reason = ? WHERE id = ?`
+    );
+    this.insertEventStmt = this.db.prepare(
+      `INSERT INTO finding_events
+         (id, finding_id, run_id, event_type, before_json, after_json, artifact_id, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+    );
+    this.selectEventsByFindingStmt = this.db.prepare(
+      `SELECT id, finding_id, run_id, event_type, before_json, after_json, artifact_id, created_at
+       FROM finding_events
+       WHERE finding_id = ?
+       ORDER BY created_at DESC`
+    );
+  }
+  /**
+   * Finding を upsert する。
+   *
+   * engagement_id + canonical_key が一致する既存レコードがあれば更新（re_observed）、
+   * なければ新規作成（discovered）。いずれの場合も finding_events にイベントを追加する。
+   *
+   * @returns { finding, created } — created は新規作成時 true、既存更新時 false
+   */
+  upsert(input) {
+    const upsertTx = this.db.transaction((inp) => {
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const existing = this.db.prepare("SELECT * FROM findings WHERE engagement_id = ? AND canonical_key = ?").get(inp.engagementId, inp.canonicalKey);
+      if (existing) {
+        this.updateLastSeenStmt.run(
+          now,
+          inp.runId ?? null,
+          inp.title,
+          inp.severity,
+          inp.confidence,
+          inp.attrsJson ?? existing.attrs_json,
+          existing.id
+        );
+        this.insertEventStmt.run(
+          crypto10.randomUUID(),
+          existing.id,
+          inp.runId ?? null,
+          "re_observed",
+          "{}",
+          "{}",
+          null,
+          now
+        );
+        return { finding: this.findById(existing.id), created: false };
+      } else {
+        const id = crypto10.randomUUID();
+        this.insertFindingStmt.run(
+          id,
+          inp.engagementId,
+          inp.canonicalKey,
+          inp.nodeId ?? null,
+          inp.title,
+          inp.severity,
+          inp.confidence,
+          inp.state ?? "open",
+          null,
+          // state_reason
+          null,
+          // owner
+          null,
+          // ticket_ref
+          inp.runId ?? null,
+          // first_seen_run_id
+          inp.runId ?? null,
+          // last_seen_run_id
+          now,
+          // first_seen_at
+          now,
+          // last_seen_at
+          null,
+          // sla_due_at
+          inp.attrsJson ?? "{}"
+        );
+        this.insertEventStmt.run(
+          crypto10.randomUUID(),
+          id,
+          inp.runId ?? null,
+          "discovered",
+          "{}",
+          "{}",
+          null,
+          now
+        );
+        return { finding: this.findById(id), created: true };
+      }
+    });
+    return upsertTx(input);
+  }
+  /**
+   * ID で Finding を取得する。存在しなければ undefined。
+   */
+  findById(id) {
+    const row = this.selectFindingByIdStmt.get(id);
+    if (row === void 0) {
+      return void 0;
+    }
+    return rowToFinding(row);
+  }
+  /**
+   * エンゲージメント ID で Finding 一覧を取得する。
+   *
+   * opts で state, severity を指定して絞り込み可能。
+   * ORDER BY last_seen_at DESC。
+   */
+  findByEngagement(engagementId, opts) {
+    const whereClauses = ["engagement_id = ?"];
+    const params = [engagementId];
+    if (opts?.state !== void 0) {
+      whereClauses.push("state = ?");
+      params.push(opts.state);
+    }
+    if (opts?.severity !== void 0) {
+      whereClauses.push("severity = ?");
+      params.push(opts.severity);
+    }
+    const sql = `SELECT id, engagement_id, canonical_key, node_id, title, severity, confidence,
+                        state, state_reason, owner, ticket_ref,
+                        first_seen_run_id, last_seen_run_id, first_seen_at, last_seen_at,
+                        sla_due_at, attrs_json
+                 FROM findings
+                 WHERE ${whereClauses.join(" AND ")}
+                 ORDER BY last_seen_at DESC`;
+    const rows = this.db.prepare(sql).all(...params);
+    return rows.map(rowToFinding);
+  }
+  /**
+   * Finding の状態を更新する。
+   *
+   * state と state_reason を更新し、'state_change' イベントを自動追加する。
+   * 存在しない ID の場合 undefined を返す。
+   */
+  updateState(id, state, reason) {
+    const updateStateTx = this.db.transaction(
+      (findingId, newState, stateReason) => {
+        const existing = this.findById(findingId);
+        if (existing === void 0) {
+          return void 0;
+        }
+        const oldState = existing.state;
+        this.updateStateStmt.run(newState, stateReason ?? null, findingId);
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        this.insertEventStmt.run(
+          crypto10.randomUUID(),
+          findingId,
+          null,
+          // run_id
+          "state_change",
+          JSON.stringify({ state: oldState }),
+          JSON.stringify({ state: newState }),
+          null,
+          // artifact_id
+          now
+        );
+        return this.findById(findingId);
+      }
+    );
+    return updateStateTx(id, state, reason);
+  }
+  /**
+   * Finding にイベントを手動追加する。
+   */
+  addEvent(findingId, event) {
+    const id = crypto10.randomUUID();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.insertEventStmt.run(
+      id,
+      findingId,
+      event.runId ?? null,
+      event.eventType,
+      event.beforeJson ?? "{}",
+      event.afterJson ?? "{}",
+      event.artifactId ?? null,
+      now
+    );
+    return {
+      id,
+      findingId,
+      ...event.runId !== void 0 ? { runId: event.runId } : {},
+      eventType: event.eventType,
+      beforeJson: event.beforeJson ?? "{}",
+      afterJson: event.afterJson ?? "{}",
+      ...event.artifactId !== void 0 ? { artifactId: event.artifactId } : {},
+      createdAt: now
+    };
+  }
+  /**
+   * Finding のイベント一覧を取得する。
+   *
+   * ORDER BY created_at DESC（最新が先頭）。
+   */
+  getEvents(findingId) {
+    const rows = this.selectEventsByFindingStmt.all(findingId);
+    return rows.map(rowToFindingEvent);
+  }
+  /**
+   * Finding を削除する。
+   *
+   * CASCADE により関連する finding_events も同時に削除される。
+   *
+   * @returns 削除成功時 true、id が存在しない場合 false。
+   */
+  delete(id) {
+    const result = this.deleteFindingStmt.run(id);
+    return result.changes > 0;
+  }
+};
+
+// src/db/repository/risk-snapshot-repository.ts
+import crypto11 from "crypto";
+function rowToRiskSnapshot(row) {
+  return {
+    id: row.id,
+    engagementId: row.engagement_id,
+    ...row.run_id !== null ? { runId: row.run_id } : {},
+    score: row.score,
+    openCritical: row.open_critical,
+    openHigh: row.open_high,
+    openMedium: row.open_medium,
+    openLow: row.open_low,
+    openInfo: row.open_info,
+    openTotal: row.open_total,
+    attackPathCount: row.attack_path_count,
+    exposedCredCount: row.exposed_cred_count,
+    ...row.model_version !== null ? { modelVersion: row.model_version } : {},
+    attrsJson: row.attrs_json,
+    createdAt: row.created_at
+  };
+}
+var RiskSnapshotRepository = class {
+  db;
+  insertStmt;
+  selectByIdStmt;
+  selectByEngagementStmt;
+  latestStmt;
+  constructor(db2) {
+    this.db = db2;
+    this.insertStmt = this.db.prepare(
+      `INSERT INTO risk_snapshots
+         (id, engagement_id, run_id, score,
+          open_critical, open_high, open_medium, open_low, open_info, open_total,
+          attack_path_count, exposed_cred_count, model_version,
+          attrs_json, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    );
+    this.selectByIdStmt = this.db.prepare(
+      `SELECT id, engagement_id, run_id, score,
+              open_critical, open_high, open_medium, open_low, open_info, open_total,
+              attack_path_count, exposed_cred_count, model_version,
+              attrs_json, created_at
+       FROM risk_snapshots WHERE id = ?`
+    );
+    this.selectByEngagementStmt = this.db.prepare(
+      `SELECT id, engagement_id, run_id, score,
+              open_critical, open_high, open_medium, open_low, open_info, open_total,
+              attack_path_count, exposed_cred_count, model_version,
+              attrs_json, created_at
+       FROM risk_snapshots
+       WHERE engagement_id = ?
+       ORDER BY created_at DESC
+       LIMIT ?`
+    );
+    this.latestStmt = this.db.prepare(
+      `SELECT id, engagement_id, run_id, score,
+              open_critical, open_high, open_medium, open_low, open_info, open_total,
+              attack_path_count, exposed_cred_count, model_version,
+              attrs_json, created_at
+       FROM risk_snapshots
+       WHERE engagement_id = ?
+       ORDER BY created_at DESC
+       LIMIT 1`
+    );
+  }
+  /**
+   * RiskSnapshot を新規作成して返す。
+   *
+   * デフォルト値:
+   * - openCritical, openHigh, openMedium, openLow, openInfo, openTotal: 0
+   * - attackPathCount: 0
+   * - exposedCredCount: 0
+   * - attrsJson: '{}'
+   * - createdAt: 現在時刻（ISO 8601）
+   */
+  create(input) {
+    const id = crypto11.randomUUID();
+    const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+    const runId = input.runId ?? null;
+    const openCritical = input.openCritical ?? 0;
+    const openHigh = input.openHigh ?? 0;
+    const openMedium = input.openMedium ?? 0;
+    const openLow = input.openLow ?? 0;
+    const openInfo = input.openInfo ?? 0;
+    const openTotal = input.openTotal ?? 0;
+    const attackPathCount = input.attackPathCount ?? 0;
+    const exposedCredCount = input.exposedCredCount ?? 0;
+    const modelVersion = input.modelVersion ?? null;
+    const attrsJson = input.attrsJson ?? "{}";
+    this.insertStmt.run(
+      id,
+      input.engagementId,
+      runId,
+      input.score,
+      openCritical,
+      openHigh,
+      openMedium,
+      openLow,
+      openInfo,
+      openTotal,
+      attackPathCount,
+      exposedCredCount,
+      modelVersion,
+      attrsJson,
+      createdAt
+    );
+    return {
+      id,
+      engagementId: input.engagementId,
+      ...runId !== null ? { runId } : {},
+      score: input.score,
+      openCritical,
+      openHigh,
+      openMedium,
+      openLow,
+      openInfo,
+      openTotal,
+      attackPathCount,
+      exposedCredCount,
+      ...modelVersion !== null ? { modelVersion } : {},
+      attrsJson,
+      createdAt
+    };
+  }
+  /**
+   * ID で RiskSnapshot を取得する。存在しなければ undefined。
+   */
+  findById(id) {
+    const row = this.selectByIdStmt.get(id);
+    if (row === void 0) {
+      return void 0;
+    }
+    return rowToRiskSnapshot(row);
+  }
+  /**
+   * エンゲージメントに紐づく RiskSnapshot 一覧を取得する。
+   *
+   * created_at DESC でソートし、limit で件数を制限する（デフォルト 100）。
+   *
+   * @param engagementId エンゲージメント ID
+   * @param limit        最大取得件数（デフォルト 100）
+   * @returns RiskSnapshot 一覧（created_at DESC 順）
+   */
+  findByEngagement(engagementId, limit) {
+    const effectiveLimit = limit ?? 100;
+    const rows = this.selectByEngagementStmt.all(engagementId, effectiveLimit);
+    return rows.map(rowToRiskSnapshot);
+  }
+  /**
+   * エンゲージメントの最新 RiskSnapshot を取得する。
+   *
+   * スナップショットが存在しない場合は undefined を返す。
+   *
+   * @param engagementId エンゲージメント ID
+   * @returns 最新の RiskSnapshot、または undefined
+   */
+  latest(engagementId) {
+    const row = this.latestStmt.get(engagementId);
+    if (row === void 0) {
+      return void 0;
+    }
+    return rowToRiskSnapshot(row);
+  }
+};
+
+// src/mcp/tools/findings.ts
+function registerFindingsTools(server2, db2) {
+  const findingRepo = new FindingRepository(db2);
+  const riskSnapshotRepo = new RiskSnapshotRepository(db2);
+  server2.tool(
+    "findings",
+    "Manage findings and risk snapshots. Actions: upsert_finding, get_finding, list_findings, update_finding_state, list_finding_events, create_risk_snapshot, get_risk_snapshot, list_risk_snapshots, latest_risk_snapshot",
+    {
+      action: z8.enum([
+        "upsert_finding",
+        "get_finding",
+        "list_findings",
+        "update_finding_state",
+        "list_finding_events",
+        "create_risk_snapshot",
+        "get_risk_snapshot",
+        "list_risk_snapshots",
+        "latest_risk_snapshot"
+      ]),
+      id: z8.string().optional().describe("Entity ID"),
+      engagementId: z8.string().optional().describe("Engagement ID"),
+      canonicalKey: z8.string().optional().describe("Finding canonical key"),
+      nodeId: z8.string().optional().describe("Associated node ID"),
+      title: z8.string().optional().describe("Finding title"),
+      severity: z8.string().optional().describe("Finding severity"),
+      confidence: z8.string().optional().describe("Finding confidence"),
+      state: z8.string().optional().describe("Finding state"),
+      stateReason: z8.string().optional().describe("Reason for state change"),
+      runId: z8.string().optional().describe("Run ID"),
+      findingId: z8.string().optional().describe("Finding ID for events"),
+      attrsJson: z8.string().optional().describe("Attributes as JSON"),
+      score: z8.number().optional().describe("Risk score"),
+      openCritical: z8.number().optional().describe("Open critical count"),
+      openHigh: z8.number().optional().describe("Open high count"),
+      openMedium: z8.number().optional().describe("Open medium count"),
+      openLow: z8.number().optional().describe("Open low count"),
+      openInfo: z8.number().optional().describe("Open info count"),
+      openTotal: z8.number().optional().describe("Open total count"),
+      attackPathCount: z8.number().optional().describe("Attack path count"),
+      exposedCredCount: z8.number().optional().describe("Exposed credential count"),
+      modelVersion: z8.string().optional().describe("Risk model version"),
+      limit: z8.number().optional().describe("Result limit")
+    },
+    async ({
+      action,
+      id,
+      engagementId,
+      canonicalKey,
+      nodeId,
+      title,
+      severity,
+      confidence,
+      state,
+      stateReason,
+      runId,
+      findingId,
+      attrsJson,
+      score,
+      openCritical,
+      openHigh,
+      openMedium,
+      openLow,
+      openInfo,
+      openTotal,
+      attackPathCount,
+      exposedCredCount,
+      modelVersion,
+      limit
+    }) => {
+      switch (action) {
+        // ----------------------------------------------------------------
+        // Finding actions
+        // ----------------------------------------------------------------
+        case "upsert_finding": {
+          if (!engagementId) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: "engagementId parameter is required for upsert_finding"
+                }
+              ],
+              isError: true
+            };
+          }
+          if (!canonicalKey) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: "canonicalKey parameter is required for upsert_finding"
+                }
+              ],
+              isError: true
+            };
+          }
+          if (!title) {
+            return {
+              content: [
+                { type: "text", text: "title parameter is required for upsert_finding" }
+              ],
+              isError: true
+            };
+          }
+          if (!severity) {
+            return {
+              content: [
+                { type: "text", text: "severity parameter is required for upsert_finding" }
+              ],
+              isError: true
+            };
+          }
+          if (!confidence) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: "confidence parameter is required for upsert_finding"
+                }
+              ],
+              isError: true
+            };
+          }
+          const result = findingRepo.upsert({
+            engagementId,
+            canonicalKey,
+            title,
+            severity,
+            confidence,
+            nodeId,
+            state,
+            runId,
+            attrsJson
+          });
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify({ ...result.finding, created: result.created }, null, 2)
+              }
+            ]
+          };
+        }
+        case "get_finding": {
+          if (!id) {
+            return {
+              content: [
+                { type: "text", text: "id parameter is required for get_finding" }
+              ],
+              isError: true
+            };
+          }
+          const finding = findingRepo.findById(id);
+          if (!finding) {
+            return {
+              content: [{ type: "text", text: `Finding not found: ${id}` }],
+              isError: true
+            };
+          }
+          return { content: [{ type: "text", text: JSON.stringify(finding, null, 2) }] };
+        }
+        case "list_findings": {
+          if (!engagementId) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: "engagementId parameter is required for list_findings"
+                }
+              ],
+              isError: true
+            };
+          }
+          const opts = {};
+          if (state) opts.state = state;
+          if (severity) opts.severity = severity;
+          const findings = findingRepo.findByEngagement(engagementId, opts);
+          return {
+            content: [{ type: "text", text: JSON.stringify(findings, null, 2) }]
+          };
+        }
+        case "update_finding_state": {
+          if (!id) {
+            return {
+              content: [
+                { type: "text", text: "id parameter is required for update_finding_state" }
+              ],
+              isError: true
+            };
+          }
+          if (!state) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: "state parameter is required for update_finding_state"
+                }
+              ],
+              isError: true
+            };
+          }
+          const updated = findingRepo.updateState(id, state, stateReason);
+          if (!updated) {
+            return {
+              content: [{ type: "text", text: `Finding not found: ${id}` }],
+              isError: true
+            };
+          }
+          return { content: [{ type: "text", text: JSON.stringify(updated, null, 2) }] };
+        }
+        case "list_finding_events": {
+          if (!findingId) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: "findingId parameter is required for list_finding_events"
+                }
+              ],
+              isError: true
+            };
+          }
+          const events = findingRepo.getEvents(findingId);
+          return { content: [{ type: "text", text: JSON.stringify(events, null, 2) }] };
+        }
+        // ----------------------------------------------------------------
+        // RiskSnapshot actions
+        // ----------------------------------------------------------------
+        case "create_risk_snapshot": {
+          if (!engagementId) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: "engagementId parameter is required for create_risk_snapshot"
+                }
+              ],
+              isError: true
+            };
+          }
+          if (score === void 0 || score === null) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: "score parameter is required for create_risk_snapshot"
+                }
+              ],
+              isError: true
+            };
+          }
+          const snapshot = riskSnapshotRepo.create({
+            engagementId,
+            score,
+            runId,
+            openCritical,
+            openHigh,
+            openMedium,
+            openLow,
+            openInfo,
+            openTotal,
+            attackPathCount,
+            exposedCredCount,
+            modelVersion,
+            attrsJson
+          });
+          return {
+            content: [{ type: "text", text: JSON.stringify(snapshot, null, 2) }]
+          };
+        }
+        case "get_risk_snapshot": {
+          if (!id) {
+            return {
+              content: [
+                { type: "text", text: "id parameter is required for get_risk_snapshot" }
+              ],
+              isError: true
+            };
+          }
+          const snapshot = riskSnapshotRepo.findById(id);
+          if (!snapshot) {
+            return {
+              content: [{ type: "text", text: `Risk snapshot not found: ${id}` }],
+              isError: true
+            };
+          }
+          return { content: [{ type: "text", text: JSON.stringify(snapshot, null, 2) }] };
+        }
+        case "list_risk_snapshots": {
+          if (!engagementId) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: "engagementId parameter is required for list_risk_snapshots"
+                }
+              ],
+              isError: true
+            };
+          }
+          const snapshots = riskSnapshotRepo.findByEngagement(engagementId, limit);
+          return {
+            content: [{ type: "text", text: JSON.stringify(snapshots, null, 2) }]
+          };
+        }
+        case "latest_risk_snapshot": {
+          if (!engagementId) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: "engagementId parameter is required for latest_risk_snapshot"
+                }
+              ],
+              isError: true
+            };
+          }
+          const latest = riskSnapshotRepo.latest(engagementId);
+          if (!latest) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: `No risk snapshot found for engagement: ${engagementId}`
+                }
+              ],
+              isError: true
+            };
+          }
+          return { content: [{ type: "text", text: JSON.stringify(latest, null, 2) }] };
+        }
+      }
+    }
+  );
+}
+
 // src/mcp/resources.ts
 function registerResources(server2, db2) {
   const nodeRepo = new NodeRepository(db2);
@@ -3669,6 +5652,8 @@ function createMcpServer(db2, version) {
   registerIngestTool(server2, db2);
   registerProposeTool(server2, db2);
   registerKbTools(server2, db2);
+  registerOpsTools(server2, db2);
+  registerFindingsTools(server2, db2);
   registerResources(server2, db2);
   return server2;
 }