@unson/brainbase-mcp 0.45.0 → 0.46.1

package/README.md

@@ -247,8 +247,8 @@ Publication is serialized by the GitHub workflow. Direct local `release:publish`
 Dispatch the reviewed ref once when automatic publication needs recovery:
 
 ```bash
-RELEASE_REF="<reviewed-develop-commit>"
-gh workflow run npm-publish.yml --ref develop -f release_ref="$RELEASE_REF"
+RELEASE_REF="<reviewed-main-commit>"
+gh workflow run npm-publish.yml --ref main -f release_ref="$RELEASE_REF"
 ```
 
 After the workflow succeeds, verify npm `gitHead`, `dist.integrity`, and dist-tag, and verify that the GitHub Release targets the reviewed release commit. If npm already contains the version, treat that version as immutable; fix the source, increment the version, and run the reviewed workflow again.

package/contracts/judgment-dag/digest.json

@@ -25,8 +25,8 @@
     },
     {
       "path": "README.md",
-      "sha256": "26eacd2a057380b4fd386b2176bd6e790a41c0bb8d684857c53bb5cd947e2d28"
+      "sha256": "38f2f0f783bba47f83950cdc286dc03a3e0ee6190b0fbb67d72002e0402c5805"
     }
   ],
-  "digest": "38bf5aff53993b1ee737071ca7952d44e36ac2e5ed3a7adcac65fdd86e8954af"
+  "digest": "fa45bdca9bc397be78314d8f24c5a383637e6c016c61d7635f85fc50e3c04800"
 }

package/dist/canonical-task-postgres.d.ts

@@ -127,7 +127,13 @@ export declare class CanonicalTaskPostgresRepository {
         limit?: number;
     }): Promise<(JsonRecord | null)[]>;
     findByIdempotencyKey(key: string, storageScope?: string): Promise<JsonRecord | null>;
+    private buildInsert;
     create(input: JsonRecord, storageScope?: string): Promise<JsonRecord>;
+    /**
+     * Create the Task and run its audit writer in one transaction. A throwing
+     * writer rolls back the Task insert; the caller maps the audit error.
+     */
+    createWithAudit(input: JsonRecord, runAudit: (created: JsonRecord, client: CanonicalTaskPgClient) => Promise<void>, storageScope?: string): Promise<JsonRecord>;
     update(taskId: string, patch: JsonRecord, storageScope?: string): Promise<JsonRecord>;
     listPurposeLabels({ projectCode, assigneePersonId, limit }: {
         projectCode: string;

package/dist/canonical-task-postgres.js

@@ -418,8 +418,7 @@ export class CanonicalTaskPostgresRepository {
         const result = await this.query('SELECT * FROM canonical_tasks WHERE idempotency_key = $1 LIMIT 1', [key]);
         return this.normalize(result.rows[0] || null);
     }
-    async create(input, storageScope) {
-        this.rejectStorageScope(storageScope);
+    buildInsert(input) {
         const columns = [
             ['id', randomUUID()],
             ['title', input.title],
@@ -447,14 +446,55 @@ export class CanonicalTaskPostgresRepository {
             ['last_operation_key', input.last_operation_key ?? null],
             ['last_operation_fingerprint', input.last_operation_fingerprint ?? null],
         ];
-        const result = await this.query(`INSERT INTO canonical_tasks (${columns.map(([column]) => column).join(', ')})
+        return {
+            sql: `INSERT INTO canonical_tasks (${columns.map(([column]) => column).join(', ')})
        VALUES (${columns.map(([, , cast = ''], index) => `$${index + 1}${cast}`).join(', ')})
        ON CONFLICT (idempotency_key) DO NOTHING
-       RETURNING *`, columns.map(([, value]) => value));
+       RETURNING *`,
+            values: columns.map(([, value]) => value),
+        };
+    }
+    async create(input, storageScope) {
+        this.rejectStorageScope(storageScope);
+        const { sql, values } = this.buildInsert(input);
+        const result = await this.query(sql, values);
         if (result.rows[0])
             return this.normalize(result.rows[0]);
         return (await this.findByIdempotencyKey(String(input.idempotency_key)));
     }
+    /**
+     * Create the Task and run its audit writer in one transaction. A throwing
+     * writer rolls back the Task insert; the caller maps the audit error.
+     */
+    async createWithAudit(input, runAudit, storageScope) {
+        this.rejectStorageScope(storageScope);
+        if (typeof this.pool.connect !== 'function') {
+            throw this.unavailable(new Error('PostgreSQL transaction client is unavailable'));
+        }
+        const { sql, values } = this.buildInsert(input);
+        const client = await this.pool.connect();
+        try {
+            await client.query('BEGIN');
+            const result = await client.query(sql, values);
+            const row = result.rows[0] ?? (await client.query('SELECT * FROM canonical_tasks WHERE idempotency_key = $1 LIMIT 1', [input.idempotency_key])).rows[0];
+            if (!row)
+                throw storeError('task_store_unavailable', 'PostgreSQL Task store is unavailable', 503);
+            const created = this.normalize(row);
+            await runAudit(created, client);
+            await client.query('COMMIT');
+            return created;
+        }
+        catch (error) {
+            try {
+                await client.query('ROLLBACK');
+            }
+            catch { /* preserve transaction error */ }
+            throw error;
+        }
+        finally {
+            client.release?.();
+        }
+    }
     async update(taskId, patch, storageScope) {
         this.rejectStorageScope(storageScope);
         // The public kernel marks an applied mutation with `_last_operation_key`

package/dist/canonical-task-service.d.ts

@@ -123,6 +123,11 @@ export interface CanonicalTaskAuditEntry extends JsonRecord {
     changes: JsonRecord;
     source_refs: unknown[];
 }
+export interface CanonicalTaskTransactionClient {
+    query(text: string, values?: unknown[]): Promise<{
+        rows: Array<Record<string, unknown>>;
+    }>;
+}
 export interface CanonicalTaskRepository {
     /** Durable PostgreSQL repositories require a release readiness binding. */
     requiresReadiness?: boolean;
@@ -131,11 +136,20 @@ export interface CanonicalTaskRepository {
     get(taskId: string, storageScope?: string): Promise<CanonicalTaskRecord | null>;
     findByIdempotencyKey(key: string, storageScope?: string): Promise<CanonicalTaskRecord | null>;
     create(input: JsonRecord, storageScope?: string): Promise<CanonicalTaskRecord>;
+    /**
+     * Create a Task and run the audit writer inside one database transaction.
+     * A throwing writer must roll back the Task insert.
+     */
+    createWithAudit?(input: JsonRecord, runAudit: (created: CanonicalTaskRecord, client: CanonicalTaskTransactionClient) => Promise<void>, storageScope?: string): Promise<CanonicalTaskRecord>;
     update(taskId: string, patch: JsonRecord, storageScope?: string): Promise<CanonicalTaskRecord>;
     delete(taskId: string, expectedVersion: number, storageScope?: string): Promise<void>;
 }
 export interface CanonicalTaskAuditRepository {
-    upsertAuditLog(entry: CanonicalTaskAuditEntry): Promise<void>;
+    /** Declare support before offering the same-transaction audit contract. */
+    supportsTransactionClient?: boolean;
+    upsertAuditLog(entry: CanonicalTaskAuditEntry, options?: {
+        client?: CanonicalTaskTransactionClient;
+    }): Promise<void>;
 }
 export interface CanonicalTaskAuthorizationRequest {
     action: CanonicalTaskAction;
@@ -283,6 +297,7 @@ export declare class CanonicalTaskService {
     private requireExpectedVersion;
     private assertVersion;
     private executeOperation;
+    private buildAuditEntry;
     private audit;
     private read;
     private normalizeResponse;

package/dist/canonical-task-service.js

@@ -476,18 +476,29 @@ export class CanonicalTaskService {
             await this.authorize('read', normalizedContext, existing);
             return { recovered: true, result: this.normalizeResponse(existing) };
         };
+        const transactionalAudit = typeof this.repository.createWithAudit === 'function'
+            && this.auditRepository?.supportsTransactionClient === true;
+        let auditedInTransaction = false;
         const run = async () => {
             const recovered = await recover();
             if (recovered.recovered && recovered.result)
                 return recovered.result;
             await this.assertMutationReady();
-            const created = await this.read(() => this.repository.create({
+            const input = {
                 ...payload,
                 status: 'pending',
                 version: 1,
                 idempotency_key: operation,
                 payload_fingerprint: inputFingerprint,
-            }, ...this.scopeArgs(normalizedContext)));
+            };
+            if (transactionalAudit) {
+                return this.read(() => this.repository.createWithAudit(input, async (created, client) => {
+                    const normalizedCreated = this.normalizeResponse(created);
+                    await this.audit(normalizedContext, 'canonical_task.created', normalizedCreated, { before: null, after: normalizedCreated }, operation, inputFingerprint, client);
+                    auditedInTransaction = true;
+                }, ...this.scopeArgs(normalizedContext)));
+            }
+            const created = await this.read(() => this.repository.create(input, ...this.scopeArgs(normalizedContext)));
             return this.normalizeResponse(created);
         };
         const result = await this.executeOperation({
@@ -501,10 +512,12 @@ export class CanonicalTaskService {
         if (normalizedContext.storageScope !== undefined)
             await this.authorize('read', normalizedContext, result);
         const normalized = this.normalizeResponse(result);
-        // Audit each invocation, including a replay/recovery. The deterministic
-        // entry id lets an upsert sink collapse retries without losing evidence
-        // that the audit write was attempted again.
-        await this.audit(normalizedContext, 'canonical_task.created', normalized, { before: null, after: normalized }, operation, inputFingerprint);
+        if (!auditedInTransaction) {
+            // Audit each invocation, including a replay/recovery. The deterministic
+            // entry id lets an upsert sink collapse retries without losing evidence
+            // that the audit write was attempted again.
+            await this.audit(normalizedContext, 'canonical_task.created', normalized, { before: null, after: normalized }, operation, inputFingerprint);
+        }
         return normalized;
     }
     async updateTask(taskId, input, expectedVersionOrContext, maybeContext) {
@@ -1054,9 +1067,9 @@ export class CanonicalTaskService {
             ? this.operationRepository.execute(request)
             : request.run();
     }
-    async audit(context, action, task, changes, operationKey, operationFingerprint) {
+    buildAuditEntry(context, action, task, changes, operationKey, operationFingerprint) {
         if (!this.auditRepository)
-            return;
+            return null;
         const actor = context.auditPrincipal
             ? normalizeCanonicalTaskPrincipal(context.auditPrincipal)
             : context.principal;
@@ -1078,8 +1091,14 @@ export class CanonicalTaskService {
             changes,
             source_refs: Array.isArray(task.source_refs) ? task.source_refs : [],
         };
+        return entry;
+    }
+    async audit(context, action, task, changes, operationKey, operationFingerprint, client) {
+        const entry = this.buildAuditEntry(context, action, task, changes, operationKey, operationFingerprint);
+        if (!entry)
+            return;
         try {
-            await this.auditRepository.upsertAuditLog(entry);
+            await this.auditRepository.upsertAuditLog(entry, client ? { client } : undefined);
         }
         catch {
             throw new CanonicalTaskError('task_audit_unavailable', 'Task audit is unavailable', 503);

package/dist/meeting-source-connection.d.ts

@@ -3,6 +3,8 @@ import type { AuthorizationServerMetadata, OAuthClientInformationMixed, OAuthTok
 import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
 import { type MeetingSourceAccessDetail, type MeetingSourceCallTool, type MeetingSourceFailure, type MeetingSourceFailureReason, type MeetingSourceMeeting, type MeetingSourceProvider, type MeetingSourceSegment, type TactiqTranscriptBudget, type TactiqTranscriptRead } from './meeting-source-reader.js';
 import type { OrganizationConnectionBinding, OrganizationConnectionProviderAdapter } from './organization-connection.js';
+export declare const MEETING_SOURCE_LIST_REVISION = 2;
+export declare const MEETING_SOURCE_RELIST_LOOKBACK_MS: number;
 export type MeetingSourceCapability = 'meetings:list' | 'transcript:read';
 export type MeetingSourceConnectionStatus = 'pending' | 'connected' | 'reauth_required' | 'disabled' | 'revoked';
 export interface MeetingSourceConnectionRecord {
@@ -156,6 +158,8 @@ export interface MeetingSourceSyncState {
     provider: MeetingSourceProvider;
     syncEnabled: boolean;
     listedThrough: string | null;
+    /** List-reader revision that produced listedThrough; older cursors are re-listed once. */
+    listRevision?: number;
     pending: MeetingSourcePendingMeeting[];
     unobtainable: Array<{
         meetingId: string;

package/dist/meeting-source-connection.js

@@ -12,6 +12,8 @@ import { createTactiqTranscriptBudget, listMeetings, probeTranscript, readTransc
  */
 const HOUR_MS = 60 * 60 * 1000;
 const DAY_MS = 24 * HOUR_MS;
+export const MEETING_SOURCE_LIST_REVISION = 2;
+export const MEETING_SOURCE_RELIST_LOOKBACK_MS = 30 * DAY_MS;
 const PROVIDERS = ['plaud', 'tactiq'];
 const CAPABILITIES = ['meetings:list', 'transcript:read'];
 const STATUSES = ['pending', 'connected', 'reauth_required', 'disabled', 'revoked'];
@@ -405,11 +407,15 @@ export async function syncMeetingSourceConnection(input) {
     state.lastAttemptAt = started.toISOString();
     const callTool = (name, args) => input.runtime.callTool(connection, name, args);
     const until = input.window ? input.window.until : started.toISOString();
-    const since = input.window
-        ? input.window.since
-        : state.listedThrough
-            ? new Date(Date.parse(state.listedThrough) - (input.overlapMs ?? DAY_MS)).toISOString()
-            : new Date(started.getTime() - (input.initialLookbackMs ?? 7 * DAY_MS)).toISOString();
+    const normalSince = state.listedThrough
+        ? Date.parse(state.listedThrough) - (input.overlapMs ?? DAY_MS)
+        : started.getTime() - (input.initialLookbackMs ?? 7 * DAY_MS);
+    const sinceMs = !input.window
+        && state.listedThrough
+        && (state.listRevision ?? 1) < MEETING_SOURCE_LIST_REVISION
+        ? Math.min(normalSince, started.getTime() - MEETING_SOURCE_RELIST_LOOKBACK_MS)
+        : normalSince;
+    const since = input.window ? input.window.since : new Date(sinceMs).toISOString();
     const finish = async (failure, delivered) => {
         if (failure) {
             state.lastError = { ...failure, at: now().toISOString() };
@@ -529,8 +535,11 @@ export async function syncMeetingSourceConnection(input) {
     if (!listed.complete) {
         failure ??= { reason: 'incomplete', message: 'The meeting list could not be read completely for the period' };
     }
-    else if (!input.window && (!state.listedThrough || Date.parse(until) > Date.parse(state.listedThrough))) {
-        state.listedThrough = until;
+    else if (!input.window) {
+        if (!state.listedThrough || Date.parse(until) > Date.parse(state.listedThrough)) {
+            state.listedThrough = until;
+        }
+        state.listRevision = MEETING_SOURCE_LIST_REVISION;
     }
     return finish(failure, delivered);
 }

package/dist/meeting-source-reader.js

@@ -153,7 +153,7 @@ async function listPlaud(callTool, since, until, utcOffsetMinutes, pageSize) {
     const meetings = [];
     let complete = false;
     for (let page = 1; page <= MAX_PAGES; page += 1) {
-        const items = extractList(await invoke(callTool, 'list_files', { date_from: dateFrom, date_to: dateTo, page, page_size: pageSize }));
+        const items = plaudListItems(await invoke(callTool, 'list_files', { date_from: dateFrom, date_to: dateTo, page, page_size: pageSize }));
         for (const item of items) {
             const meeting = plaudMeeting(item, utcOffsetMinutes);
             if (!meeting)
@@ -401,10 +401,25 @@ function payloadOf(result) {
         return record.structuredContent;
     if (Array.isArray(record.content)) {
         const text = contentText(record);
-        return parseJson(text) ?? text;
+        const parsed = parseJson(text);
+        if (parsed !== null)
+            return parsed;
+        const wrapped = unwrapUntrustedUserData(text);
+        return wrapped.found ? wrapped.value : text;
     }
     return result;
 }
+function unwrapUntrustedUserData(text) {
+    const opening = /<(untrusted-user-data-[0-9a-f]+)\s+source="[^"]*">/.exec(text);
+    if (!opening)
+        return { found: false };
+    const start = opening.index + opening[0].length;
+    const end = text.lastIndexOf(`</${opening[1]}>`);
+    if (end < start)
+        return { found: false };
+    const inner = text.slice(start, end).trim();
+    return { found: true, value: parseJson(inner) ?? inner };
+}
 function contentText(record) {
     if (!Array.isArray(record.content))
         return '';
@@ -414,6 +429,18 @@ function contentText(record) {
         .map((item) => item.text)
         .join('\n');
 }
+function plaudListItems(payload) {
+    if (Array.isArray(payload))
+        return payload;
+    const record = asRecord(payload);
+    if (record) {
+        for (const key of ['data', 'files', 'items', 'results', 'records', 'recordings']) {
+            if (Array.isArray(record[key]))
+                return record[key];
+        }
+    }
+    throw new UnexpectedShapeError('Plaud list_files returned a response in an unknown shape');
+}
 function extractList(payload) {
     if (Array.isArray(payload))
         return payload;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unson/brainbase-mcp",
-  "version": "0.45.0",
+  "version": "0.46.1",
   "description": "Local-first Brainbase judgment OS that lets supported AI agents reuse a user's approved goals, priorities, decisions, and judgment criteria.",
   "type": "module",
   "license": "MIT",
@@ -586,7 +586,7 @@
     "build:world": "node scripts/build-world-vendor.mjs"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.31.0",
+    "@modelcontextprotocol/sdk": "^1.32.0",
     "graphology": "0.26.0",
     "js-yaml": "^4.1.1",
     "sigma": "3.0.3",
@@ -620,5 +620,5 @@
     "url": "https://github.com/Unson-LLC/brainbase/issues"
   },
   "homepage": "https://github.com/Unson-LLC/brainbase#readme",
-  "gitHead": "10ff1144069d177b6a1c3857a69182513ff55372"
+  "gitHead": "514e31c00aeb6906c01cb5df51cf9bea0f62eee2"
 }