@cerefox/memory 1.0.0 → 1.0.1-beta.1

package/dist/server-assets/db/migrations/0013_explicit_grants.sql

@@ -0,0 +1,32 @@
+-- 0013_explicit_grants.sql — issue #26: explicit Data API grants for service_role
+-- (Supabase implicit-grant removal). Idempotent; safe on existing deployments.
+
+-- ── Explicit Data API grants (issue #26; schema 0.8.2) ─────────────────────────
+-- Supabase is removing the implicit privileges the Data API roles get on
+-- `public` tables (default for projects created after 2026-05-30; enforced on
+-- existing projects 2026-10-30). Without explicit GRANTs a table is invisible
+-- to PostgREST even for service_role (42501). Cerefox grants ONLY service_role
+-- (the CLI / MCP / web all use service-role-equivalent keys; anon/authenticated
+-- deliberately get nothing, matching the RPC EXECUTE posture from iter-28B).
+-- Guarded: on the local (World B) stack this file deploys BEFORE roles.sql
+-- creates service_role, so missing-role must be a no-op (roles.sql re-runs the
+-- grants implicitly via its own PostgREST wiring; the next deploy picks them up).
+DO $$
+DECLARE t TEXT;
+BEGIN
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'service_role') THEN
+        GRANT USAGE ON SCHEMA public TO service_role;
+        FOREACH t IN ARRAY ARRAY[
+            'cerefox_projects', 'cerefox_documents', 'cerefox_document_versions',
+            'cerefox_audit_log', 'cerefox_document_projects', 'cerefox_chunks',
+            'cerefox_migrations', 'cerefox_config', 'cerefox_usage_log'
+        ] LOOP
+            IF to_regclass('public.' || t) IS NOT NULL THEN
+                EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.%I TO service_role', t);
+            END IF;
+        END LOOP;
+        -- Future cerefox_* tables created by the deploying role keep working.
+        ALTER DEFAULT PRIVILEGES IN SCHEMA public
+            GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO service_role;
+    END IF;
+END $$;

package/dist/server-assets/db/rpcs.sql

@@ -1776,7 +1776,7 @@ SET search_path = public, pg_catalog
 AS $$
     -- Keep in lockstep with the `@version:` marker in schema.sql (cut_release.ts
     -- enforces it). Bump whenever schema.sql OR rpcs.sql changes.
-    SELECT '0.8.1'::TEXT;
+    SELECT '0.8.2'::TEXT;
 $$;
 
 -- ── cerefox_content_format_stats ─────────────────────────────────────────────

package/dist/server-assets/db/schema.sql

@@ -5,7 +5,7 @@
 -- Requires extensions: vector (pgvector), uuid-ossp
 -- These are enabled at the top of db_deploy.py before this file is applied.
 --
--- @version: 0.8.1
+-- @version: 0.8.2
 -- The `@version` marker above is read by the schema-version-mismatch banner
 -- (see /api/v1/schema-version). Bump it whenever schema.sql OR rpcs.sql
 -- changes in a way that requires `cerefox server deploy` to be re-run —
@@ -386,3 +386,33 @@ ALTER TABLE cerefox_audit_log              ENABLE ROW LEVEL SECURITY;
 ALTER TABLE cerefox_migrations            ENABLE ROW LEVEL SECURITY;
 ALTER TABLE cerefox_config                ENABLE ROW LEVEL SECURITY;
 ALTER TABLE cerefox_usage_log             ENABLE ROW LEVEL SECURITY;
+
+-- ── Explicit Data API grants (issue #26; schema 0.8.2) ─────────────────────────
+-- Supabase is removing the implicit privileges the Data API roles get on
+-- `public` tables (default for projects created after 2026-05-30; enforced on
+-- existing projects 2026-10-30). Without explicit GRANTs a table is invisible
+-- to PostgREST even for service_role (42501). Cerefox grants ONLY service_role
+-- (the CLI / MCP / web all use service-role-equivalent keys; anon/authenticated
+-- deliberately get nothing, matching the RPC EXECUTE posture from iter-28B).
+-- Guarded: on the local (World B) stack this file deploys BEFORE roles.sql
+-- creates service_role, so missing-role must be a no-op (roles.sql re-runs the
+-- grants implicitly via its own PostgREST wiring; the next deploy picks them up).
+DO $$
+DECLARE t TEXT;
+BEGIN
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'service_role') THEN
+        GRANT USAGE ON SCHEMA public TO service_role;
+        FOREACH t IN ARRAY ARRAY[
+            'cerefox_projects', 'cerefox_documents', 'cerefox_document_versions',
+            'cerefox_audit_log', 'cerefox_document_projects', 'cerefox_chunks',
+            'cerefox_migrations', 'cerefox_config', 'cerefox_usage_log'
+        ] LOOP
+            IF to_regclass('public.' || t) IS NOT NULL THEN
+                EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.%I TO service_role', t);
+            END IF;
+        END LOOP;
+        -- Future cerefox_* tables created by the deploying role keep working.
+        ALTER DEFAULT PRIVILEGES IN SCHEMA public
+            GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO service_role;
+    END IF;
+END $$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cerefox/memory",
-  "version": "1.0.0",
+  "version": "1.0.1-beta.1",
   "description": "Cerefox — user-owned shared memory for AI agents. CLI + stdio MCP server + web UI + ingestion for a knowledge base on your own Supabase project (or fully self-hosted with Cerefox Local).",
   "license": "Apache-2.0",
   "homepage": "https://github.com/fstamatelopoulos/cerefox",