@unson/brainbase-mcp 0.45.0 → 0.46.0

package/README.md

@@ -247,8 +247,8 @@ Publication is serialized by the GitHub workflow. Direct local `release:publish`
 Dispatch the reviewed ref once when automatic publication needs recovery:
 
 ```bash
-RELEASE_REF="<reviewed-develop-commit>"
-gh workflow run npm-publish.yml --ref develop -f release_ref="$RELEASE_REF"
+RELEASE_REF="<reviewed-main-commit>"
+gh workflow run npm-publish.yml --ref main -f release_ref="$RELEASE_REF"
 ```
 
 After the workflow succeeds, verify npm `gitHead`, `dist.integrity`, and dist-tag, and verify that the GitHub Release targets the reviewed release commit. If npm already contains the version, treat that version as immutable; fix the source, increment the version, and run the reviewed workflow again.

package/contracts/judgment-dag/digest.json

@@ -25,8 +25,8 @@
     },
     {
       "path": "README.md",
-      "sha256": "26eacd2a057380b4fd386b2176bd6e790a41c0bb8d684857c53bb5cd947e2d28"
+      "sha256": "38f2f0f783bba47f83950cdc286dc03a3e0ee6190b0fbb67d72002e0402c5805"
     }
   ],
-  "digest": "38bf5aff53993b1ee737071ca7952d44e36ac2e5ed3a7adcac65fdd86e8954af"
+  "digest": "fa45bdca9bc397be78314d8f24c5a383637e6c016c61d7635f85fc50e3c04800"
 }

package/dist/canonical-task-postgres.d.ts

@@ -127,7 +127,13 @@ export declare class CanonicalTaskPostgresRepository {
         limit?: number;
     }): Promise<(JsonRecord | null)[]>;
     findByIdempotencyKey(key: string, storageScope?: string): Promise<JsonRecord | null>;
+    private buildInsert;
     create(input: JsonRecord, storageScope?: string): Promise<JsonRecord>;
+    /**
+     * Create the Task and run its audit writer in one transaction. A throwing
+     * writer rolls back the Task insert; the caller maps the audit error.
+     */
+    createWithAudit(input: JsonRecord, runAudit: (created: JsonRecord, client: CanonicalTaskPgClient) => Promise<void>, storageScope?: string): Promise<JsonRecord>;
     update(taskId: string, patch: JsonRecord, storageScope?: string): Promise<JsonRecord>;
     listPurposeLabels({ projectCode, assigneePersonId, limit }: {
         projectCode: string;

package/dist/canonical-task-postgres.js

@@ -418,8 +418,7 @@ export class CanonicalTaskPostgresRepository {
         const result = await this.query('SELECT * FROM canonical_tasks WHERE idempotency_key = $1 LIMIT 1', [key]);
         return this.normalize(result.rows[0] || null);
     }
-    async create(input, storageScope) {
-        this.rejectStorageScope(storageScope);
+    buildInsert(input) {
         const columns = [
             ['id', randomUUID()],
             ['title', input.title],
@@ -447,14 +446,55 @@ export class CanonicalTaskPostgresRepository {
             ['last_operation_key', input.last_operation_key ?? null],
             ['last_operation_fingerprint', input.last_operation_fingerprint ?? null],
         ];
-        const result = await this.query(`INSERT INTO canonical_tasks (${columns.map(([column]) => column).join(', ')})
+        return {
+            sql: `INSERT INTO canonical_tasks (${columns.map(([column]) => column).join(', ')})
        VALUES (${columns.map(([, , cast = ''], index) => `$${index + 1}${cast}`).join(', ')})
        ON CONFLICT (idempotency_key) DO NOTHING
-       RETURNING *`, columns.map(([, value]) => value));
+       RETURNING *`,
+            values: columns.map(([, value]) => value),
+        };
+    }
+    async create(input, storageScope) {
+        this.rejectStorageScope(storageScope);
+        const { sql, values } = this.buildInsert(input);
+        const result = await this.query(sql, values);
         if (result.rows[0])
             return this.normalize(result.rows[0]);
         return (await this.findByIdempotencyKey(String(input.idempotency_key)));
     }
+    /**
+     * Create the Task and run its audit writer in one transaction. A throwing
+     * writer rolls back the Task insert; the caller maps the audit error.
+     */
+    async createWithAudit(input, runAudit, storageScope) {
+        this.rejectStorageScope(storageScope);
+        if (typeof this.pool.connect !== 'function') {
+            throw this.unavailable(new Error('PostgreSQL transaction client is unavailable'));
+        }
+        const { sql, values } = this.buildInsert(input);
+        const client = await this.pool.connect();
+        try {
+            await client.query('BEGIN');
+            const result = await client.query(sql, values);
+            const row = result.rows[0] ?? (await client.query('SELECT * FROM canonical_tasks WHERE idempotency_key = $1 LIMIT 1', [input.idempotency_key])).rows[0];
+            if (!row)
+                throw storeError('task_store_unavailable', 'PostgreSQL Task store is unavailable', 503);
+            const created = this.normalize(row);
+            await runAudit(created, client);
+            await client.query('COMMIT');
+            return created;
+        }
+        catch (error) {
+            try {
+                await client.query('ROLLBACK');
+            }
+            catch { /* preserve transaction error */ }
+            throw error;
+        }
+        finally {
+            client.release?.();
+        }
+    }
     async update(taskId, patch, storageScope) {
         this.rejectStorageScope(storageScope);
         // The public kernel marks an applied mutation with `_last_operation_key`

package/dist/canonical-task-service.d.ts

@@ -123,6 +123,11 @@ export interface CanonicalTaskAuditEntry extends JsonRecord {
     changes: JsonRecord;
     source_refs: unknown[];
 }
+export interface CanonicalTaskTransactionClient {
+    query(text: string, values?: unknown[]): Promise<{
+        rows: Array<Record<string, unknown>>;
+    }>;
+}
 export interface CanonicalTaskRepository {
     /** Durable PostgreSQL repositories require a release readiness binding. */
     requiresReadiness?: boolean;
@@ -131,11 +136,20 @@ export interface CanonicalTaskRepository {
     get(taskId: string, storageScope?: string): Promise<CanonicalTaskRecord | null>;
     findByIdempotencyKey(key: string, storageScope?: string): Promise<CanonicalTaskRecord | null>;
     create(input: JsonRecord, storageScope?: string): Promise<CanonicalTaskRecord>;
+    /**
+     * Create a Task and run the audit writer inside one database transaction.
+     * A throwing writer must roll back the Task insert.
+     */
+    createWithAudit?(input: JsonRecord, runAudit: (created: CanonicalTaskRecord, client: CanonicalTaskTransactionClient) => Promise<void>, storageScope?: string): Promise<CanonicalTaskRecord>;
     update(taskId: string, patch: JsonRecord, storageScope?: string): Promise<CanonicalTaskRecord>;
     delete(taskId: string, expectedVersion: number, storageScope?: string): Promise<void>;
 }
 export interface CanonicalTaskAuditRepository {
-    upsertAuditLog(entry: CanonicalTaskAuditEntry): Promise<void>;
+    /** Declare support before offering the same-transaction audit contract. */
+    supportsTransactionClient?: boolean;
+    upsertAuditLog(entry: CanonicalTaskAuditEntry, options?: {
+        client?: CanonicalTaskTransactionClient;
+    }): Promise<void>;
 }
 export interface CanonicalTaskAuthorizationRequest {
     action: CanonicalTaskAction;
@@ -283,6 +297,7 @@ export declare class CanonicalTaskService {
     private requireExpectedVersion;
     private assertVersion;
     private executeOperation;
+    private buildAuditEntry;
     private audit;
     private read;
     private normalizeResponse;

package/dist/canonical-task-service.js

@@ -476,18 +476,29 @@ export class CanonicalTaskService {
             await this.authorize('read', normalizedContext, existing);
             return { recovered: true, result: this.normalizeResponse(existing) };
         };
+        const transactionalAudit = typeof this.repository.createWithAudit === 'function'
+            && this.auditRepository?.supportsTransactionClient === true;
+        let auditedInTransaction = false;
         const run = async () => {
             const recovered = await recover();
             if (recovered.recovered && recovered.result)
                 return recovered.result;
             await this.assertMutationReady();
-            const created = await this.read(() => this.repository.create({
+            const input = {
                 ...payload,
                 status: 'pending',
                 version: 1,
                 idempotency_key: operation,
                 payload_fingerprint: inputFingerprint,
-            }, ...this.scopeArgs(normalizedContext)));
+            };
+            if (transactionalAudit) {
+                return this.read(() => this.repository.createWithAudit(input, async (created, client) => {
+                    const normalizedCreated = this.normalizeResponse(created);
+                    await this.audit(normalizedContext, 'canonical_task.created', normalizedCreated, { before: null, after: normalizedCreated }, operation, inputFingerprint, client);
+                    auditedInTransaction = true;
+                }, ...this.scopeArgs(normalizedContext)));
+            }
+            const created = await this.read(() => this.repository.create(input, ...this.scopeArgs(normalizedContext)));
             return this.normalizeResponse(created);
         };
         const result = await this.executeOperation({
@@ -501,10 +512,12 @@ export class CanonicalTaskService {
         if (normalizedContext.storageScope !== undefined)
             await this.authorize('read', normalizedContext, result);
         const normalized = this.normalizeResponse(result);
-        // Audit each invocation, including a replay/recovery. The deterministic
-        // entry id lets an upsert sink collapse retries without losing evidence
-        // that the audit write was attempted again.
-        await this.audit(normalizedContext, 'canonical_task.created', normalized, { before: null, after: normalized }, operation, inputFingerprint);
+        if (!auditedInTransaction) {
+            // Audit each invocation, including a replay/recovery. The deterministic
+            // entry id lets an upsert sink collapse retries without losing evidence
+            // that the audit write was attempted again.
+            await this.audit(normalizedContext, 'canonical_task.created', normalized, { before: null, after: normalized }, operation, inputFingerprint);
+        }
         return normalized;
     }
     async updateTask(taskId, input, expectedVersionOrContext, maybeContext) {
@@ -1054,9 +1067,9 @@ export class CanonicalTaskService {
             ? this.operationRepository.execute(request)
             : request.run();
     }
-    async audit(context, action, task, changes, operationKey, operationFingerprint) {
+    buildAuditEntry(context, action, task, changes, operationKey, operationFingerprint) {
         if (!this.auditRepository)
-            return;
+            return null;
         const actor = context.auditPrincipal
             ? normalizeCanonicalTaskPrincipal(context.auditPrincipal)
             : context.principal;
@@ -1078,8 +1091,14 @@ export class CanonicalTaskService {
             changes,
             source_refs: Array.isArray(task.source_refs) ? task.source_refs : [],
         };
+        return entry;
+    }
+    async audit(context, action, task, changes, operationKey, operationFingerprint, client) {
+        const entry = this.buildAuditEntry(context, action, task, changes, operationKey, operationFingerprint);
+        if (!entry)
+            return;
         try {
-            await this.auditRepository.upsertAuditLog(entry);
+            await this.auditRepository.upsertAuditLog(entry, client ? { client } : undefined);
         }
         catch {
             throw new CanonicalTaskError('task_audit_unavailable', 'Task audit is unavailable', 503);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unson/brainbase-mcp",
-  "version": "0.45.0",
+  "version": "0.46.0",
   "description": "Local-first Brainbase judgment OS that lets supported AI agents reuse a user's approved goals, priorities, decisions, and judgment criteria.",
   "type": "module",
   "license": "MIT",
@@ -620,5 +620,5 @@
     "url": "https://github.com/Unson-LLC/brainbase/issues"
   },
   "homepage": "https://github.com/Unson-LLC/brainbase#readme",
-  "gitHead": "10ff1144069d177b6a1c3857a69182513ff55372"
+  "gitHead": "955bf4ef5249f607c4983f86c05ecae10ce7a67c"
 }