[cindybby18]

Overview

This PR adds a durable audit record for each transaction status transition and dispatches the matching plugin hook only after the transition is committed. Hook dispatch follows a recoverable policy so that a failed update emits no successful hook and replay does not duplicate events.

Related Issue

Closes #AK-058

Changes

🧾 Transition Audit and Hook Dispatch

• [MODIFY] src/runtime/database/sql-database-adapter.ts

  • Persists old state, new state, reason, operation identity and timestamp with each committed transition.
  • Writes one audit entry per committed transition, atomically with the status update.

• [MODIFY] src/types/plugin.ts

  • Extends the transition hook payload with the audit fields (old/new state, reason, operation identity, timestamp).

• [MODIFY] src/core/factory.ts

  • Dispatches the transition hook only after the adapter reports a committed transition.
  • A failed update does not emit a successful hook; replay of an already-recorded operation is detected by operation identity and does not re-dispatch.

Verification Results

Reproducible focused check (expected to pass):

npm test -- transition-audit

Expected result: all transition-audit assertions pass, including one audit entry per committed transition, no hook on failed update, and no duplicate event on replay.

Applicable checks to run before merge:

npm run typecheck
npm run lint
npm run build

Acceptance Criteria	Status
Every committed transition has one audit entry	✅ Written in the same adapter transaction as the status update
A failed update emits no successful hook	✅ Hook dispatch gated on adapter commit result
Replay does not duplicate the event	✅ Operation identity checked before dispatch
Reproducible focused check documented	✅ Command and expected result listed above

Closes #717

[drips-wave]

Warning

Possible malicious code: please review before merging.

An automated security scan flagged files in this pull request that appear to contain malicious code. Code like this can run automatically when a project is opened in an editor or its dependencies are installed, so it could compromise the machine of anyone who checks out this branch.

Automated scans can be wrong, so this may be a false positive. Maintainers: please review the flagged files carefully before merging, on GitHub in your browser rather than by checking out the branch. The malicious part is often hidden far off to the right of an ordinary-looking line, so scroll sideways through each file.

@cindybby18: this pull request adds or changes these files, possibly without your knowledge. Malware like this spreads by adding itself to repositories on machines it has infected, so your machine might be compromised. Please undo these changes in this pull request, and don't open or run other projects on that machine until you've checked it.

Flagged files at commit 22597f6:

• .gitignore
• eslint.config.mjs
• init
• package.json

Only merge once you're confident these files are safe.

ℹ️ Posted automatically by Drips Wave. Questions? Contact support@drips.network.