@cerefox/memory 1.0.0 → 1.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (15) hide show
  1. package/dist/bin/cerefox.js +768 -294
  2. package/dist/frontend/assets/index-D9FTvsV4.js +125 -0
  3. package/dist/frontend/assets/index-D9FTvsV4.js.map +1 -0
  4. package/dist/frontend/index.html +1 -1
  5. package/dist/server-assets/_shared/ef-meta/index.ts +1 -1
  6. package/dist/server-assets/db/migrations/0013_explicit_grants.sql +32 -0
  7. package/dist/server-assets/db/rpcs.sql +1 -1
  8. package/dist/server-assets/db/schema.sql +31 -1
  9. package/docs/guides/cli.md +7 -0
  10. package/docs/guides/configuration.md +2 -0
  11. package/docs/guides/setup-supabase.md +9 -0
  12. package/docs/guides/upgrading.md +3 -1
  13. package/package.json +1 -1
  14. package/dist/frontend/assets/index-6DS5ujj2.js +0 -125
  15. package/dist/frontend/assets/index-6DS5ujj2.js.map +0 -1
package/dist/frontend/index.html CHANGED
@@ -15,7 +15,7 @@
15
15
  href="https://fonts.googleapis.com/css2?family=Geist:wght@300;400;500;600;700&display=swap"
16
16
  />
17
17
  <title>Cerefox</title>
18
- <script type="module" crossorigin src="/app/assets/index-6DS5ujj2.js"></script>
18
+ <script type="module" crossorigin src="/app/assets/index-D9FTvsV4.js"></script>
19
19
  <link rel="stylesheet" crossorigin href="/app/assets/index-Asx5wD7g.css">
20
20
  </head>
21
21
  <body>
package/dist/server-assets/_shared/ef-meta/index.ts CHANGED
@@ -18,7 +18,7 @@
18
18
  * doesn't touch `supabase/functions/` leaves it alone).
19
19
  */
20
20
 
21
- export const EF_VERSION = "1.0.0-rc.4";
21
+ export const EF_VERSION = "1.0.1";
22
22
 
23
23
  /**
24
24
  * The 8 peer EFs the cerefox-mcp aggregator probes (excludes cerefox-mcp
package/dist/server-assets/db/migrations/0013_explicit_grants.sql ADDED
@@ -0,0 +1,32 @@
1
+ -- 0013_explicit_grants.sql — issue #26: explicit Data API grants for service_role
2
+ -- (Supabase implicit-grant removal). Idempotent; safe on existing deployments.
3
+
4
+ -- ── Explicit Data API grants (issue #26; schema 0.8.2) ─────────────────────────
5
+ -- Supabase is removing the implicit privileges the Data API roles get on
6
+ -- `public` tables (default for projects created after 2026-05-30; enforced on
7
+ -- existing projects 2026-10-30). Without explicit GRANTs a table is invisible
8
+ -- to PostgREST even for service_role (42501). Cerefox grants ONLY service_role
9
+ -- (the CLI / MCP / web all use service-role-equivalent keys; anon/authenticated
10
+ -- deliberately get nothing, matching the RPC EXECUTE posture from iter-28B).
11
+ -- Guarded: on the local (World B) stack this file deploys BEFORE roles.sql
12
+ -- creates service_role, so missing-role must be a no-op (roles.sql re-runs the
13
+ -- grants implicitly via its own PostgREST wiring; the next deploy picks them up).
14
+ DO $$
15
+ DECLARE t TEXT;
16
+ BEGIN
17
+ IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'service_role') THEN
18
+ GRANT USAGE ON SCHEMA public TO service_role;
19
+ FOREACH t IN ARRAY ARRAY[
20
+ 'cerefox_projects', 'cerefox_documents', 'cerefox_document_versions',
21
+ 'cerefox_audit_log', 'cerefox_document_projects', 'cerefox_chunks',
22
+ 'cerefox_migrations', 'cerefox_config', 'cerefox_usage_log'
23
+ ] LOOP
24
+ IF to_regclass('public.' || t) IS NOT NULL THEN
25
+ EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.%I TO service_role', t);
26
+ END IF;
27
+ END LOOP;
28
+ -- Future cerefox_* tables created by the deploying role keep working.
29
+ ALTER DEFAULT PRIVILEGES IN SCHEMA public
30
+ GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO service_role;
31
+ END IF;
32
+ END $$;
package/dist/server-assets/db/rpcs.sql CHANGED
@@ -1776,7 +1776,7 @@ SET search_path = public, pg_catalog
1776
1776
  AS $$
1777
1777
  -- Keep in lockstep with the `@version:` marker in schema.sql (cut_release.ts
1778
1778
  -- enforces it). Bump whenever schema.sql OR rpcs.sql changes.
1779
- SELECT '0.8.1'::TEXT;
1779
+ SELECT '0.8.2'::TEXT;
1780
1780
  $$;
1781
1781
 
1782
1782
  -- ── cerefox_content_format_stats ─────────────────────────────────────────────
package/dist/server-assets/db/schema.sql CHANGED
@@ -5,7 +5,7 @@
5
5
  -- Requires extensions: vector (pgvector), uuid-ossp
6
6
  -- These are enabled at the top of db_deploy.py before this file is applied.
7
7
  --
8
- -- @version: 0.8.1
8
+ -- @version: 0.8.2
9
9
  -- The `@version` marker above is read by the schema-version-mismatch banner
10
10
  -- (see /api/v1/schema-version). Bump it whenever schema.sql OR rpcs.sql
11
11
  -- changes in a way that requires `cerefox server deploy` to be re-run —
@@ -386,3 +386,33 @@ ALTER TABLE cerefox_audit_log ENABLE ROW LEVEL SECURITY;
386
386
  ALTER TABLE cerefox_migrations ENABLE ROW LEVEL SECURITY;
387
387
  ALTER TABLE cerefox_config ENABLE ROW LEVEL SECURITY;
388
388
  ALTER TABLE cerefox_usage_log ENABLE ROW LEVEL SECURITY;
389
+
390
+ -- ── Explicit Data API grants (issue #26; schema 0.8.2) ─────────────────────────
391
+ -- Supabase is removing the implicit privileges the Data API roles get on
392
+ -- `public` tables (default for projects created after 2026-05-30; enforced on
393
+ -- existing projects 2026-10-30). Without explicit GRANTs a table is invisible
394
+ -- to PostgREST even for service_role (42501). Cerefox grants ONLY service_role
395
+ -- (the CLI / MCP / web all use service-role-equivalent keys; anon/authenticated
396
+ -- deliberately get nothing, matching the RPC EXECUTE posture from iter-28B).
397
+ -- Guarded: on the local (World B) stack this file deploys BEFORE roles.sql
398
+ -- creates service_role, so missing-role must be a no-op (roles.sql re-runs the
399
+ -- grants implicitly via its own PostgREST wiring; the next deploy picks them up).
400
+ DO $$
401
+ DECLARE t TEXT;
402
+ BEGIN
403
+ IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'service_role') THEN
404
+ GRANT USAGE ON SCHEMA public TO service_role;
405
+ FOREACH t IN ARRAY ARRAY[
406
+ 'cerefox_projects', 'cerefox_documents', 'cerefox_document_versions',
407
+ 'cerefox_audit_log', 'cerefox_document_projects', 'cerefox_chunks',
408
+ 'cerefox_migrations', 'cerefox_config', 'cerefox_usage_log'
409
+ ] LOOP
410
+ IF to_regclass('public.' || t) IS NOT NULL THEN
411
+ EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.%I TO service_role', t);
412
+ END IF;
413
+ END LOOP;
414
+ -- Future cerefox_* tables created by the deploying role keep working.
415
+ ALTER DEFAULT PRIVILEGES IN SCHEMA public
416
+ GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO service_role;
417
+ END IF;
418
+ END $$;
package/docs/guides/cli.md CHANGED
@@ -518,6 +518,13 @@ The success message echoes the resolved author / author_type back so you can sur
518
518
  | `--schema-only` | flag | off | Deploy only schema + RPCs (skip Edge Functions). |
519
519
  | `--functions-only` | flag | off | Deploy only the 9 Edge Functions (skip schema). |
520
520
  | `--dry-run` | flag | off | Preview what would happen; make no changes. |
521
+ | `--project-ref <ref>` | string | derived from `CEREFOX_SUPABASE_URL` | Supabase project ref for the Edge Function deploys (needed only for custom domains, where the ref can't be derived). |
522
+ | `--yes` | flag | off | Skip the deployment confirmation (for scripted/non-interactive runs). |
523
+
524
+ > **macOS**: the Edge Function step shells out to the Supabase CLI, which reads its
525
+ > login token from the Keychain — expect a password dialog per function (click
526
+ > "Always Allow"). To skip the dialogs, set `SUPABASE_ACCESS_TOKEN` in
527
+ > `~/.cerefox/.env` — see [`configuration.md`](configuration.md#supabase--database).
521
528
 
522
529
  Detects fresh vs. existing databases: a fresh DB gets schema + RPCs + migration stamps; an existing DB gets pending migrations applied and `rpcs.sql` re-applied in place. There is deliberately **no `--reset`** here — the destructive wipe lives only in the contributor script `bun scripts/db_deploy.ts --reset`. See [`setup-supabase.md`](setup-supabase.md).
523
530
 
package/docs/guides/configuration.md CHANGED
@@ -43,11 +43,13 @@ Full rule documented in [`docs/specs/polish-and-distribution-design.md` §7](../
43
43
  | `CEREFOX_ACCESS_TOKENS` | `""` | Server-side (Function secret) | The **server-side accepted set** — a comma-separated list of Cerefox tokens, set as a Supabase **Function secret** (not local `.env`). A request is accepted if its Bearer matches any token in the set, enabling zero-downtime rotation. Managed by `cerefox token generate` / `rotate`. |
44
44
  | `CEREFOX_SUPABASE_ANON_KEY` | `""` | *(deprecated / unused)* | Formerly the legacy anon JWT Bearer for Edge Function calls. **Retired in iter-28E** — Edge Functions now authenticate the Cerefox access token in-function. Retained only so an old `.env` still parses; no longer read. |
45
45
  | `CEREFOX_DATABASE_URL` | `""` | For scripts | Direct Postgres URL for deployment scripts. **Use the Session Pooler** (port `5432`) — Transaction Pooler (`6543`) does not support DDL. Username must include the project-ref suffix (`postgres.<project-ref>`). Append `?sslmode=require`. See [`setup-supabase.md` → Connection pooling (2026)](setup-supabase.md#connection-pooling-2026). |
46
+ | `SUPABASE_ACCESS_TOKEN` | *(unset)* | For EF deploys (optional) | Supabase **personal access token** (`sbp_…`, from [supabase.com/dashboard/account/tokens](https://supabase.com/dashboard/account/tokens)), read by the **Supabase CLI** that `cerefox server deploy` shells out to for Edge Function deploys. Optional — without it the CLI falls back to its `supabase login` credential, which on **macOS lives in the Keychain and triggers a password dialog per function deploy** (9 per full deploy; a denied dialog fails that function with `LegacyPlatformAuthRequiredError`). Setting it in `~/.cerefox/.env` avoids the dialogs entirely: Cerefox exports every key from its `.env` to the environment, so the child CLI inherits it. Not a `CEREFOX_` variable — the name is the Supabase CLI's own. **Keep secret** (it grants management access to your Supabase account). |
46
47
 
47
48
  **When each is needed:**
48
49
  - `CEREFOX_SUPABASE_URL` + `CEREFOX_SUPABASE_KEY` — used by the CLI, web UI, and local MCP server (ingestion, search) via the Supabase Data API
49
50
  - `CEREFOX_ACCESS_TOKEN` — used to call the Edge Functions (remote MCP, GPT Actions, direct HTTP) and by `cerefox doctor` / the live e2e tests; `CEREFOX_ACCESS_TOKENS` is its server-side counterpart (the accepted set). Generate both with `cerefox token generate`.
50
51
  - `CEREFOX_DATABASE_URL` — used only for schema deploys (`cerefox server deploy`, or the contributor scripts `bun scripts/db_*.ts`) via a direct Postgres connection
52
+ - `SUPABASE_ACCESS_TOKEN` — optional; only consumed by the Supabase CLI during `cerefox server deploy` Edge Function deploys (recommended on macOS to avoid per-function Keychain dialogs)
51
53
 
52
54
  ---
53
55
 
package/docs/guides/setup-supabase.md CHANGED
@@ -128,6 +128,15 @@ npx supabase link # prompts for your project ref (the ID in your Supabas
128
128
  Your project ref is in the Supabase dashboard URL:
129
129
  `https://supabase.com/dashboard/project/<project-ref>`
130
130
 
131
+ > **macOS Keychain dialogs**: the Supabase CLI stores the `login` token in the
132
+ > Keychain and reads it back **once per function deploy** — expect up to 9
133
+ > password dialogs per full deploy (click **"Always Allow"**; denying one fails
134
+ > that function with `LegacyPlatformAuthRequiredError`). To skip the Keychain
135
+ > entirely, create a personal access token at
136
+ > [supabase.com/dashboard/account/tokens](https://supabase.com/dashboard/account/tokens)
137
+ > and set it in `~/.cerefox/.env` as `SUPABASE_ACCESS_TOKEN=sbp_…` — see
138
+ > [`configuration.md`](configuration.md#supabase--database).
139
+
131
140
  After it finishes, verify in the Supabase Dashboard → **Edge Functions** — all 9
132
141
  functions should appear with a green "Active" status.
133
142
 
package/docs/guides/upgrading.md CHANGED
@@ -30,7 +30,9 @@ cerefox doctor # verify
30
30
  database it applies **every** pending migration (regardless of which version
31
31
  you're coming from — so there are no per-version steps to follow), re-applies
32
32
  `rpcs.sql`, and redeploys all nine Edge Functions from npm-bundled assets. No
33
- repo clone required.
33
+ repo clone required. On **macOS**, set `SUPABASE_ACCESS_TOKEN` in
34
+ `~/.cerefox/.env` first to avoid a Keychain password dialog per function deploy
35
+ (see [`configuration.md`](configuration.md#supabase--database)).
34
36
 
35
37
  **Re-embed only when a release says so.** If a release changes the embedding
36
38
  model or FTS / title weighting, also run `cerefox server reindex --all` — that's
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@cerefox/memory",
3
- "version": "1.0.0",
3
+ "version": "1.0.1",
4
4
  "description": "Cerefox — user-owned shared memory for AI agents. CLI + stdio MCP server + web UI + ingestion for a knowledge base on your own Supabase project (or fully self-hosted with Cerefox Local).",
5
5
  "license": "Apache-2.0",
6
6
  "homepage": "https://github.com/fstamatelopoulos/cerefox",