@clude/sdk 3.2.0 → 3.3.0

package/supabase-schema.sql

@@ -89,14 +89,47 @@ CREATE TABLE IF NOT EXISTS memories (
   compacted_into TEXT,                    -- hash_id of the memory this was compacted into
   encrypted BOOLEAN DEFAULT FALSE,        -- whether content is client-side encrypted
   encryption_pubkey TEXT,                 -- Solana pubkey that encrypted this memory
+  provider_delegated BOOLEAN DEFAULT TRUE, -- envelope: provider may read while delegated; revoke flips to FALSE (encryption §7)
+  summary_ciphertext TEXT,                 -- secretbox(summary) — populated on revoke (§9)
+  embedding_ciphertext TEXT,               -- secretbox(embedding) — populated on revoke (§9)
   owner_wallet TEXT,                      -- Solana pubkey of the memory owner
   event_date TIMESTAMPTZ DEFAULT NULL,    -- explicit event date extracted from content (temporal indexing)
   event_date_precision TEXT DEFAULT NULL CHECK (event_date_precision IN ('day', 'week', 'month', 'year')),
   ts_summary tsvector GENERATED ALWAYS AS (
-    setweight(to_tsvector('english', COALESCE(summary, '')), 'A') ||
-    setweight(to_tsvector('english', COALESCE(LEFT(content, 2000), '')), 'B')
-  ) STORED                                -- auto-generated tsvector for BM25-like full-text search
+    setweight(to_tsvector('english', COALESCE(summary, '')), 'A')
+  ) STORED,                               -- summary-only lexemes; content lexemes live in content_tokens (encryption §9)
+  content_tokens tsvector,                -- content lexemes, app-maintained via set_memory_content_tokens; cleared on revoke
+  -- Memory 3.0 Phase 1 (migration 044): bi-temporal validity + provenance (all nullable, inert until MEMORY_RECONCILE)
+  valid_from TIMESTAMPTZ,                  -- fact lifetime start (defaults to created_at at reconcile time)
+  invalid_at TIMESTAMPTZ,                  -- NULL = currently valid; set = superseded/retired (never DELETE)
+  superseded_by TEXT,                     -- hash_id of the memory that replaced this one
+  fact_key TEXT,                          -- (entity, attribute) reconciliation key
+  extractor_version TEXT,                 -- provenance: which extractor produced this
+  extraction_confidence REAL,             -- 0..1 extractor confidence
+  source_turn_ref JSONB,                  -- pointer back to the source conversation turn
+  hash_id_v2 TEXT                         -- 16-byte server-minted id (dual identity; legacy hash_id untouched)
 );
+-- Phase 1 hot-path indexes: recall filters to currently-valid rows; reconciliation groups by fact_key.
+CREATE INDEX IF NOT EXISTS idx_memories_valid ON memories(id) WHERE invalid_at IS NULL;
+CREATE INDEX IF NOT EXISTS idx_memories_fact_key ON memories(fact_key) WHERE fact_key IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_memories_hash_id_v2 ON memories(hash_id_v2) WHERE hash_id_v2 IS NOT NULL;
+
+-- Memory 3.0 Phase 1 (migration 044): the C2 durable write outbox — replaces the
+-- fire-and-forget embed/link/extract triad (errors were silently swallowed).
+CREATE TABLE IF NOT EXISTS memory_write_jobs (
+  id BIGSERIAL PRIMARY KEY,
+  memory_id BIGINT NOT NULL REFERENCES memories(id) ON DELETE CASCADE,
+  job_type TEXT NOT NULL CHECK (job_type IN ('embed', 'link', 'extract', 'reconcile', 'backfill_v2')),
+  status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'running', 'done', 'failed')),
+  attempts INT NOT NULL DEFAULT 0,
+  next_retry_at TIMESTAMPTZ DEFAULT NOW(),
+  last_error TEXT,
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+CREATE INDEX IF NOT EXISTS idx_write_jobs_claim ON memory_write_jobs(status, next_retry_at)
+  WHERE status IN ('pending', 'failed');
+CREATE INDEX IF NOT EXISTS idx_write_jobs_memory ON memory_write_jobs(memory_id);
 
 -- Memory fragments: granular vector decomposition for precision retrieval
 -- Each memory is split into semantic fragments (summary, content chunks, tag context)
@@ -110,6 +143,37 @@ CREATE TABLE IF NOT EXISTS memory_fragments (
   created_at TIMESTAMPTZ DEFAULT NOW()
 );
 
+-- ============================================================
+-- ENCRYPTION (PMP memory encryption-at-rest — see migration 021,
+-- docs/pmp/memory-encryption-design.md §9). Owner-held envelope encryption.
+-- ============================================================
+
+-- Owner public-key registry. No private keys, ever.
+CREATE TABLE IF NOT EXISTS encryption_keys (
+  owner_wallet  TEXT PRIMARY KEY,
+  x25519_pubkey TEXT NOT NULL,
+  verifier_ct   TEXT NOT NULL,                 -- secretbox("clude-key-verifier-v1") under derived key (H2)
+  created_at    TIMESTAMPTZ DEFAULT NOW(),
+  updated_at    TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Per-memory wrapped DEKs. Wrap = sealed box; wrap_pubkey is the ephemeral sender pubkey.
+CREATE TABLE IF NOT EXISTS memory_dek_wraps (
+  memory_id     BIGINT NOT NULL REFERENCES memories(id) ON DELETE CASCADE,
+  recipient     TEXT   NOT NULL,                 -- 'owner' | 'provider' | 'title_holder'
+  wrapped_dek   TEXT   NOT NULL,                 -- base64(nonce || box(DEK))
+  wrap_pubkey   TEXT   NOT NULL,                 -- base64 ephemeral sender X25519 pubkey
+  holder_wallet TEXT,                            -- (034) names the title_holder; NULL for owner/provider
+  created_at    TIMESTAMPTZ DEFAULT NOW(),
+  CONSTRAINT memory_dek_wraps_recipient_chk CHECK (recipient IN ('owner', 'provider', 'title_holder')),
+  CONSTRAINT memory_dek_wraps_holder_chk CHECK ((recipient = 'title_holder') = (holder_wallet IS NOT NULL))
+);
+-- (036) holder-aware uniqueness: one owner + one provider per memory (NULLS NOT DISTINCT), and one
+-- title_holder per (memory, holder) so a title sale's seller + buyer wraps coexist (RT7 additive).
+CREATE UNIQUE INDEX IF NOT EXISTS uq_dek_wraps_identity
+  ON memory_dek_wraps (memory_id, recipient, holder_wallet) NULLS NOT DISTINCT;
+CREATE INDEX IF NOT EXISTS idx_dek_wraps_memory ON memory_dek_wraps(memory_id);
+
 -- Dream logs: consolidation, reflection, emergence sessions
 CREATE TABLE IF NOT EXISTS dream_logs (
   id BIGSERIAL PRIMARY KEY,
@@ -133,6 +197,8 @@ CREATE INDEX IF NOT EXISTS idx_memories_evidence ON memories USING GIN(evidence_
 CREATE INDEX IF NOT EXISTS idx_memories_owner ON memories(owner_wallet);
 CREATE INDEX IF NOT EXISTS idx_memories_event_date ON memories(event_date) WHERE event_date IS NOT NULL;
 CREATE INDEX IF NOT EXISTS idx_memories_ts_summary ON memories USING GIN (ts_summary);
+CREATE INDEX IF NOT EXISTS idx_memories_content_tokens ON memories USING GIN (content_tokens);
+CREATE INDEX IF NOT EXISTS idx_memories_delegated ON memories(provider_delegated) WHERE encrypted = TRUE;
 
 -- Vector similarity indexes (HNSW for fast approximate nearest neighbor)
 CREATE INDEX IF NOT EXISTS idx_memories_embedding ON memories USING hnsw (embedding vector_cosine_ops);
@@ -168,7 +234,11 @@ BEGIN
     AND m.decay_factor >= min_decay
     AND (filter_types IS NULL OR m.memory_type = ANY(filter_types))
     AND (filter_user IS NULL OR m.related_user = filter_user)
-    AND (filter_owner IS NULL OR m.owner_wallet = filter_owner)
+    AND (
+      filter_owner IS NULL
+      OR (filter_owner = '__BOT_OWN__' AND m.owner_wallet IS NULL)
+      OR m.owner_wallet = filter_owner
+    )
     AND (filter_tags IS NULL OR m.tags && filter_tags)
     AND (1 - (m.embedding <=> query_embedding)) > match_threshold
   ORDER BY m.embedding <=> query_embedding
@@ -201,7 +271,11 @@ BEGIN
     AND m.decay_factor >= min_decay
     AND (filter_types IS NULL OR m.memory_type = ANY(filter_types))
     AND (filter_user IS NULL OR m.related_user = filter_user)
-    AND (filter_owner IS NULL OR m.owner_wallet = filter_owner)
+    AND (
+      filter_owner IS NULL
+      OR (filter_owner = '__BOT_OWN__' AND m.owner_wallet IS NULL)
+      OR m.owner_wallet = filter_owner
+    )
     AND (filter_tags IS NULL OR m.tags && filter_tags)
     AND (1 - (m.embedding <=> query_embedding)) > match_threshold
     AND (start_date IS NULL OR COALESCE(m.event_date, m.created_at) >= start_date)
@@ -213,6 +287,66 @@ $$;
 
 -- BM25-ranked full-text search using tsvector/tsquery (Exp 8)
 -- Replaces ilike-based keyword search with stemming and TF-IDF ranking.
+-- Populate content_tokens from a transient plaintext arg (PostgREST can't express to_tsvector inline).
+-- setweight 'B' mirrors the old combined ts_summary weighting (summary 'A' > content 'B').
+CREATE OR REPLACE FUNCTION set_memory_content_tokens(p_memory_id bigint, p_text text)
+RETURNS void LANGUAGE sql AS $$
+  UPDATE memories
+  SET content_tokens = CASE
+        WHEN p_text IS NULL OR p_text = '' THEN NULL
+        ELSE setweight(to_tsvector('english', p_text), 'B')
+      END
+  WHERE id = p_memory_id;
+$$;
+
+-- Atomic revoke: clear plaintext + drop the provider wrap in one transaction (encryption §7).
+CREATE OR REPLACE FUNCTION revoke_memory(p_memory_id bigint, p_summary_ct text, p_embedding_ct text)
+RETURNS void LANGUAGE plpgsql AS $$
+BEGIN
+  UPDATE memories SET
+    summary = '',
+    summary_ciphertext = p_summary_ct,
+    embedding = NULL,
+    embedding_ciphertext = NULLIF(p_embedding_ct, ''),
+    content_tokens = NULL,
+    provider_delegated = false
+  WHERE id = p_memory_id;
+  DELETE FROM memory_dek_wraps WHERE memory_id = p_memory_id AND recipient = 'provider';
+  -- Fragment parity (migration 043): fragments hold plaintext + live embeddings,
+  -- which kept revoked memories findable through the fragment lane.
+  DELETE FROM memory_fragments WHERE memory_id = p_memory_id;
+END;
+$$;
+
+-- Atomic re-delegate (encryption §7) — inverse of revoke_memory. Restores plaintext
+-- summary/embedding, rebuilds content_tokens via the canonical builder, clears ciphertext
+-- cols, sets provider_delegated=true, (re-)inserts the provider wrap. Caller passes decrypted
+-- plaintext (it holds the validated DEK); plaintext is transient, not stored beyond columns.
+CREATE OR REPLACE FUNCTION redelegate_memory(
+  p_memory_id   bigint,
+  p_summary     text,
+  p_embedding   text,
+  p_content     text,
+  p_wrapped_dek text,
+  p_wrap_pubkey text
+)
+RETURNS void LANGUAGE plpgsql AS $$
+BEGIN
+  UPDATE memories SET
+    summary = p_summary,
+    summary_ciphertext = NULL,
+    embedding = NULLIF(p_embedding, '')::vector,
+    embedding_ciphertext = NULL,
+    provider_delegated = true
+  WHERE id = p_memory_id;
+  PERFORM set_memory_content_tokens(p_memory_id, p_content);
+  INSERT INTO memory_dek_wraps (memory_id, recipient, wrapped_dek, wrap_pubkey)
+  VALUES (p_memory_id, 'provider', p_wrapped_dek, p_wrap_pubkey)
+  ON CONFLICT (memory_id, recipient) DO UPDATE
+    SET wrapped_dek = EXCLUDED.wrapped_dek, wrap_pubkey = EXCLUDED.wrap_pubkey;
+END;
+$$;
+
 CREATE OR REPLACE FUNCTION bm25_search_memories(
   search_query text,
   match_count int DEFAULT 20,
@@ -231,11 +365,17 @@ BEGIN
     RETURN;
   END IF;
   RETURN QUERY
-  SELECT m.id, ts_rank_cd(m.ts_summary, tsquery_val, 32)::float AS rank
+  SELECT m.id,
+    (ts_rank_cd(COALESCE(m.ts_summary, ''::tsvector), tsquery_val, 32)
+     + ts_rank_cd(COALESCE(m.content_tokens, ''::tsvector), tsquery_val, 32))::float AS rank
   FROM memories m
-  WHERE m.ts_summary @@ tsquery_val
+  WHERE (m.ts_summary @@ tsquery_val OR m.content_tokens @@ tsquery_val)
     AND m.decay_factor >= min_decay
-    AND (filter_owner IS NULL OR m.owner_wallet = filter_owner)
+    AND (
+      filter_owner IS NULL
+      OR (filter_owner = '__BOT_OWN__' AND m.owner_wallet IS NULL)
+      OR m.owner_wallet = filter_owner
+    )
     AND (filter_types IS NULL OR m.memory_type = ANY(filter_types))
     AND (filter_tags IS NULL OR m.tags && filter_tags)
   ORDER BY rank DESC
@@ -262,6 +402,7 @@ CREATE TABLE IF NOT EXISTS memory_links (
     'follows',         -- temporal sequence
     'relates',         -- general semantic association
     'resolves',        -- contradiction resolution outcome
+    'supersedes',      -- decisive replacement: new fact overrides an older one (Memory 3.0 C1, migration 044)
     'happens_before',  -- temporal ordering
     'happens_after',   -- temporal ordering
     'concurrent_with'  -- temporal co-occurrence
@@ -300,7 +441,11 @@ LANGUAGE sql AS $$
   WHERE ml.source_id = ANY(seed_ids)
     AND ml.target_id != ALL(seed_ids)
     AND ml.strength >= min_strength
-    AND (filter_owner IS NULL OR m.owner_wallet = filter_owner)
+    AND (
+      filter_owner IS NULL
+      OR (filter_owner = '__BOT_OWN__' AND m.owner_wallet IS NULL)
+      OR m.owner_wallet = filter_owner
+    )
   UNION
   SELECT DISTINCT ON (ml.source_id, ml.link_type)
     ml.source_id AS memory_id,
@@ -312,7 +457,11 @@ LANGUAGE sql AS $$
   WHERE ml.target_id = ANY(seed_ids)
     AND ml.source_id != ALL(seed_ids)
     AND ml.strength >= min_strength
-    AND (filter_owner IS NULL OR m.owner_wallet = filter_owner)
+    AND (
+      filter_owner IS NULL
+      OR (filter_owner = '__BOT_OWN__' AND m.owner_wallet IS NULL)
+      OR m.owner_wallet = filter_owner
+    )
   ORDER BY strength DESC
   LIMIT max_results;
 $$;
@@ -411,7 +560,9 @@ CREATE OR REPLACE FUNCTION match_memory_fragments(
   query_embedding vector(1024),
   match_threshold float DEFAULT 0.3,
   match_count int DEFAULT 10,
-  filter_owner text DEFAULT NULL
+  filter_owner text DEFAULT NULL,
+  min_decay float DEFAULT 0.0,
+  filter_types text[] DEFAULT NULL
 )
 RETURNS TABLE (memory_id bigint, max_similarity float)
 LANGUAGE plpgsql AS $$
@@ -422,7 +573,13 @@ BEGIN
   JOIN memories m ON m.id = f.memory_id
   WHERE f.embedding IS NOT NULL
     AND (1 - (f.embedding <=> query_embedding)) > match_threshold
-    AND (filter_owner IS NULL OR m.owner_wallet = filter_owner)
+    AND m.decay_factor >= min_decay
+    AND (filter_types IS NULL OR m.memory_type = ANY(filter_types))
+    AND (
+      filter_owner IS NULL
+      OR (filter_owner = '__BOT_OWN__' AND m.owner_wallet IS NULL)
+      OR m.owner_wallet = filter_owner
+    )
   GROUP BY f.memory_id
   ORDER BY max_similarity DESC
   LIMIT match_count;