Kanban

Add local task boards with cards, columns, history, and linked evidence.

Availability and installation

This guide covers @wf/kanban version 0.1.0-alpha.5, a preview. Configure the BrightOps registry in your project’s .npmrc; keep the license key in your local or CI secret store:

@wf:registry=https://store.brightops.io/npm/
//store.brightops.io/npm/:_authToken=${WF_SDK_LICENSE_KEY}

Set WF_SDK_LICENSE_KEY in that environment to your license key, then install with npm install --save-exact @wf/kanban@0.1.0-alpha.5. Node.js 22.19 or newer is required. Core installs automatically under the same Kanban license. React and React DOM are optional peers, needed for @wf/kanban/react and @wf/kanban/browser; the self-contained kanban.browser.js script bundles its own copy. A paid download preserves access to those exact versions for later rebuilds after cancellation; revocation blocks access. Installed applications do not contact this registry at runtime. This remains a preview API.

Python applications use wf-kanban 0.1.0a7, which bundles this version and its own Node runtime; it needs Windows x64 and Python 3.11 or newer. Install it from the BrightOps Python index with the same license key, kept in your netrc file rather than the index URL:

machine store.brightops.io
login license
password <your license key>

Then run pip install --index-url https://store.brightops.io/pypi/simple/ wf-kanban==0.1.0a7, with this index as your only index: it sends public dependencies such as PyYAML to PyPI and never resolves a BrightOps name there. With uv, make it the default index (default = true) so the pinned runtime comes from it too.

The supported runtime, exported entry points, and compatibility commitments are listed in Compatibility. Check Release notes before upgrading: this release changes which policy answers allow an operation.

Configure and use

Keep SDK settings in a YAML file and pass its path to the package’s public client. Keep credentials in application-owned secret storage; configuration examples contain references, not secret values.

• kanban.yaml — configuration example for this preview.

import { createKanban } from '@wf/kanban'

const kanban = createKanban('./kanban.yaml', {
  // Return true synchronously to allow. Any other answer, including a promise, refuses with DENIED.
  authorize: request => request.actor === signedInUserId,
})
const scope = { accountId: 'my-account', boardId: 'work' }
const access = { actor: signedInUserId }
await kanban.createBoard(scope, 'Work', { ...access, idempotencyKey: 'board-1' })
const card = await kanban.createCard(scope, { title: 'Review the change' }, { ...access, idempotencyKey: 'review-1' })
await kanban.moveCard(scope, card.id, card.revision, 'in_progress', { ...access, idempotencyKey: 'move-1' })
await kanban.dispose()

Updates, moves and deletes need the card’s current revision. Repeating a write with the same idempotency key returns the original result instead of writing twice. The package also exports a React view, a browser script and an MCP server for agents; use the entry points listed in Compatibility.

Integration responsibilities

The application owns user authentication, authorization, credential storage, and permission to make external calls. authorize and admit decide who reads or changes a board and which data passes; they must answer synchronously, so resolve permission lookups before calling the client. Pass the signed-in identity as actor; never take it from an untrusted request body. Preserve the package’s cancellation and disposal behavior where those APIs are exposed.

Preview compatibility is limited to the combinations actually recorded in Compatibility. An empty verified-combinations list is not a promise that every platform or client has been tested.