@saluzi/saluzi-edu 0.7.4 → 0.7.6

package/packages/remote-control-server/src/__tests__/memories.test.ts

@@ -0,0 +1,654 @@
+import { describe, test, expect, beforeEach, mock } from 'bun:test'
+import { mockConfigModule } from './helpers/mock-config'
+
+// Mock config (apiKeys: ['test-api-key'])
+mock.module('../config', () => mockConfigModule({}))
+
+import { Hono } from 'hono'
+import v1Memories from '../routes/v1/memories'
+import webMemories from '../routes/web/memories'
+import { getDb } from '../db/sqlite'
+import { freshDb } from './helpers/db'
+import { createUserDirectly, type TestUser } from './helpers/fixtures'
+import { storeCreateSession, storeBindSession, storeReset } from '../store'
+import { issueSessionToken } from '../auth/session'
+import {
+  MemoryError,
+  archiveMemory,
+  buildMemoryPack,
+  canManageMemory,
+  createMemory,
+  getMemoryRow,
+  isMemoryVisibleToUser,
+  listMemoriesForUser,
+  promoteMemoryToTeam,
+  syncMemories,
+  updateMemory,
+} from '../services/memories'
+
+// Fresh DB per file so schema additions (memories tables) are guaranteed.
+freshDb()
+
+function createApp() {
+  const app = new Hono()
+  app.route('/v1', v1Memories)
+  app.route('/web', webMemories)
+  return app
+}
+
+const AUTH_HEADERS = {
+  Authorization: 'Bearer test-api-key',
+}
+
+function createTeam(name: string, createdBy: string): string {
+  const db = getDb()
+  const id = `team_${name}`
+  const now = new Date().toISOString()
+  db.query(
+    `INSERT INTO teams (id, name, slug, created_by, created_at, updated_at)
+     VALUES ($id, $name, $slug, $createdBy, $now, $now)`,
+  ).run({
+    $id: id,
+    $name: name,
+    $slug: `slug-${name}`,
+    $createdBy: createdBy,
+    $now: now,
+  })
+  // Mirror the production create-team route: creator becomes owner member.
+  db.query(
+    `INSERT INTO team_members (team_id, user_id, role, added_at, added_by)
+     VALUES ($teamId, $userId, 'owner', $now, $addedBy)`,
+  ).run({ $teamId: id, $userId: createdBy, $addedBy: createdBy, $now: now })
+  return id
+}
+
+function addTeamMember(
+  teamId: string,
+  userId: string,
+  role: 'owner' | 'admin' | 'member',
+): void {
+  const db = getDb()
+  db.query(
+    `INSERT INTO team_members (team_id, user_id, role, added_at, added_by)
+     VALUES ($teamId, $userId, $role, $now, $addedBy)`,
+  ).run({
+    $teamId: teamId,
+    $userId: userId,
+    $role: role,
+    $now: new Date().toISOString(),
+    $addedBy: userId,
+  })
+}
+
+function createSessionFor(ownerId: string, teamId?: string): string {
+  const session = storeCreateSession({})
+  storeBindSession(session.id, ownerId, 'user')
+  if (teamId) storeBindSession(session.id, teamId, 'team')
+  return session.id
+}
+
+const MEMORY_FILE = `---
+name: Release process
+description: Ship via bun run precheck then tag
+type: project
+---
+
+Always run bun run precheck before tagging.
+`
+
+describe('memories service', () => {
+  beforeEach(() => {
+    const db = getDb()
+    db.query('DELETE FROM memories').run()
+    db.query('DELETE FROM memories_fts').run()
+    db.query('DELETE FROM team_members').run()
+    db.query('DELETE FROM teams').run()
+    storeReset()
+  })
+
+  test('createMemory personal stores owner and CHECK constraint rejects missing owner', () => {
+    const db = getDb()
+    const user = createUserDirectly(db, { username: 'alice' })
+    const row = createMemory({
+      scopeKind: 'personal',
+      ownerUserId: user.id,
+      name: 'Prefers Chinese',
+      description: 'Answers in Chinese',
+      type: 'user',
+      content: 'User prefers Chinese responses.',
+    })
+    expect(row.scope_kind).toBe('personal')
+    expect(row.owner_user_id).toBe(user.id)
+    expect(row.team_id).toBeNull()
+    expect(row.status).toBe('active')
+
+    // Missing owner on personal violates the CHECK constraint.
+    let caught: unknown = null
+    try {
+      createMemory({
+        scopeKind: 'personal',
+        name: 'x',
+        type: 'user',
+        content: 'x',
+      })
+    } catch (err) {
+      caught = err
+    }
+    expect(caught).toBeInstanceOf(MemoryError)
+  })
+
+  test('updateMemory bumps version and archiveMemory soft-deletes', () => {
+    const db = getDb()
+    const user = createUserDirectly(db, { username: 'bob' })
+    const row = createMemory({
+      scopeKind: 'personal',
+      ownerUserId: user.id,
+      name: 'v1',
+      type: 'user',
+      content: 'first',
+    })
+    const updated = updateMemory(row.id, { content: 'second' })
+    expect(updated?.version).toBe(2)
+    expect(updated?.content).toBe('second')
+
+    expect(archiveMemory(row.id)).toBe(true)
+    expect(getMemoryRow(row.id)).toBeNull()
+    expect(archiveMemory(row.id)).toBe(false)
+  })
+
+  test('visibility: personal is owner-only (admin listings excluded), team needs membership', () => {
+    const db = getDb()
+    const owner = createUserDirectly(db, { username: 'owner' })
+    const stranger = createUserDirectly(db, { username: 'stranger' })
+    const admin = createUserDirectly(db, { username: 'root', role: 'admin' })
+    const member = createUserDirectly(db, { username: 'mate' })
+
+    const personal = createMemory({
+      scopeKind: 'personal',
+      ownerUserId: owner.id,
+      name: 'secret',
+      type: 'user',
+      content: 'private note',
+    })
+    expect(isMemoryVisibleToUser(personal.id, owner.id)).toBe(true)
+    expect(isMemoryVisibleToUser(personal.id, stranger.id)).toBe(false)
+    // Strict private: even a system admin cannot browse another user's
+    // personal memory.
+    expect(isMemoryVisibleToUser(personal.id, admin.id, true)).toBe(false)
+
+    const teamId = createTeam('alpha', owner.id)
+    addTeamMember(teamId, member.id, 'member')
+    const team = createMemory({
+      scopeKind: 'team',
+      teamId,
+      name: 'shared',
+      type: 'project',
+      content: 'team convention',
+    })
+    expect(isMemoryVisibleToUser(team.id, member.id)).toBe(true)
+    expect(isMemoryVisibleToUser(team.id, stranger.id)).toBe(false)
+    expect(isMemoryVisibleToUser(team.id, admin.id, true)).toBe(true)
+  })
+
+  test('manage: creator + team owner/admin + system admin', () => {
+    const db = getDb()
+    const owner = createUserDirectly(db, { username: 't-owner' })
+    const creator = createUserDirectly(db, { username: 't-creator' })
+    const plainMember = createUserDirectly(db, { username: 't-member' })
+    const teamAdmin = createUserDirectly(db, { username: 't-admin' })
+    const sysAdmin = createUserDirectly(db, { username: 'sys', role: 'admin' })
+
+    const teamId = createTeam('beta', owner.id)
+    for (const [u, r] of [
+      [creator, 'member'],
+      [plainMember, 'member'],
+      [teamAdmin, 'admin'],
+    ] as const) {
+      addTeamMember(teamId, u.id, r)
+    }
+    const row = createMemory({
+      scopeKind: 'team',
+      teamId,
+      name: 'convention',
+      type: 'project',
+      content: 'x',
+      createdBy: creator.id,
+    })
+    expect(canManageMemory(row.id, creator.id)).toBe(true)
+    expect(canManageMemory(row.id, plainMember.id)).toBe(false)
+    expect(canManageMemory(row.id, teamAdmin.id)).toBe(true)
+    expect(canManageMemory(row.id, owner.id)).toBe(true)
+    expect(canManageMemory(row.id, sysAdmin.id, true)).toBe(true)
+  })
+
+  test('listMemoriesForUser: personal scope, team scope, session filter; admin never sees others personal', () => {
+    const db = getDb()
+    const alice = createUserDirectly(db, { username: 'alice2' })
+    const bob = createUserDirectly(db, { username: 'bob2' })
+    const admin = createUserDirectly(db, { username: 'root2', role: 'admin' })
+    const teamId = createTeam('gamma', alice.id)
+    addTeamMember(teamId, bob.id, 'member')
+
+    const p1 = createMemory({
+      scopeKind: 'personal',
+      ownerUserId: alice.id,
+      name: 'alice note',
+      type: 'user',
+      content: 'x',
+    })
+    createMemory({
+      scopeKind: 'personal',
+      ownerUserId: bob.id,
+      name: 'bob note',
+      type: 'user',
+      content: 'x',
+    })
+    const t1 = createMemory({
+      scopeKind: 'team',
+      teamId,
+      name: 'team note',
+      type: 'project',
+      content: 'x',
+    })
+
+    const alicePersonal = listMemoriesForUser(alice.id, { personalScope: true })
+    expect(alicePersonal.map(r => r.id)).toEqual([p1.id])
+
+    const aliceTeam = listMemoriesForUser(alice.id, { teamId })
+    expect(aliceTeam.map(r => r.id)).toEqual([t1.id])
+
+    // Admin across-team listing sees team rows but never others' personal.
+    const adminAll = listMemoriesForUser(admin.id, {}, true)
+    expect(adminAll.map(r => r.id)).toEqual([t1.id])
+
+    // Session provenance filter.
+    const sessionId = createSessionFor(alice.id)
+    createMemory({
+      scopeKind: 'personal',
+      ownerUserId: alice.id,
+      name: 'from session',
+      type: 'project',
+      content: 'x',
+      sourceSessionId: sessionId,
+    })
+    const fromSession = listMemoriesForUser(alice.id, { sessionId })
+    expect(fromSession).toHaveLength(1)
+    expect(fromSession[0].name).toBe('from session')
+  })
+
+  test('promoteMemoryToTeam: owner-only, membership-checked, migrates scope', () => {
+    const db = getDb()
+    const owner = createUserDirectly(db, { username: 'promo' })
+    const stranger = createUserDirectly(db, { username: 'promo2' })
+    const teamId = createTeam('delta', owner.id)
+    const otherTeam = createTeam('epsilon', stranger.id)
+
+    const row = createMemory({
+      scopeKind: 'personal',
+      ownerUserId: owner.id,
+      name: 'worth sharing',
+      type: 'project',
+      content: 'x',
+    })
+
+    // Stranger cannot promote someone else's memory.
+    expect(() => promoteMemoryToTeam(row.id, stranger.id, teamId)).toThrow(
+      MemoryError,
+    )
+    // Owner cannot promote into a team they don't belong to.
+    expect(() => promoteMemoryToTeam(row.id, owner.id, otherTeam)).toThrow(
+      MemoryError,
+    )
+
+    const promoted = promoteMemoryToTeam(row.id, owner.id, teamId)
+    expect(promoted.scope_kind).toBe('team')
+    expect(promoted.team_id).toBe(teamId)
+    expect(promoted.owner_user_id).toBeNull()
+    expect(promoted.version).toBe(2)
+    // Second promote is rejected — already team scope.
+    expect(() => promoteMemoryToTeam(row.id, owner.id, teamId)).toThrow(
+      MemoryError,
+    )
+  })
+
+  test('buildMemoryPack: personal + team layout with MEMORY.md index', () => {
+    const db = getDb()
+    const alice = createUserDirectly(db, { username: 'pack' })
+    const teamId = createTeam('zeta', alice.id)
+    const sessionId = createSessionFor(alice.id, teamId)
+
+    createMemory({
+      scopeKind: 'personal',
+      ownerUserId: alice.id,
+      name: 'My style',
+      description: 'Concise answers',
+      type: 'user',
+      content: 'Prefer concise answers.',
+    })
+    createMemory({
+      scopeKind: 'team',
+      teamId,
+      name: 'Team convention',
+      description: 'Ship on Fridays',
+      type: 'project',
+      content: 'Ship on Fridays.',
+    })
+
+    const pack = buildMemoryPack(sessionId)
+    const paths = Object.keys(pack.files)
+    expect(paths).toContain('MEMORY.md')
+    expect(paths.some(p => p.startsWith('team/') && p.endsWith('.md'))).toBe(
+      true,
+    )
+    expect(paths.some(p => !p.includes('/') && p.endsWith('.md'))).toBe(true)
+
+    const index = pack.files['MEMORY.md'] ?? ''
+    expect(index).toContain('[My style]')
+    expect(index).toContain('[Team convention]')
+    expect(index).toContain('(team/')
+
+    // Personal memory file carries the memdir frontmatter shape.
+    const personalFile = paths.find(p => !p.includes('/') && p !== 'MEMORY.md')
+    expect(pack.files[personalFile!]).toContain('type: user')
+  })
+
+  test('buildMemoryPack: no user owner → empty pack; no team owner → no team files', () => {
+    const db = getDb()
+    const alice = createUserDirectly(db, { username: 'pack2' })
+    const sessionId = createSessionFor(alice.id)
+    createMemory({
+      scopeKind: 'team',
+      teamId: createTeam('eta', alice.id),
+      name: 'orphan team memory',
+      type: 'project',
+      content: 'x',
+    })
+    // Session has a user owner but no team owner → personal memories only.
+    createMemory({
+      scopeKind: 'personal',
+      ownerUserId: alice.id,
+      name: 'mine',
+      type: 'user',
+      content: 'x',
+    })
+    const pack = buildMemoryPack(sessionId)
+    expect(Object.keys(pack.files).some(p => p.startsWith('team/'))).toBe(false)
+
+    // Session with no user owner at all → empty pack.
+    const teamOnly = storeCreateSession({})
+    storeBindSession(teamOnly.id, 'team_nope', 'team')
+    expect(buildMemoryPack(teamOnly.id)).toEqual({ files: {} })
+  })
+
+  test('syncMemories: identity from session, working layer skipped, dedup by name', () => {
+    const db = getDb()
+    const alice = createUserDirectly(db, { username: 'sync' })
+    const sessionId = createSessionFor(alice.id)
+
+    const result = syncMemories(sessionId, [
+      // Valid entry — new memory.
+      { rel_path: 'project_release-process.md', content: MEMORY_FILE },
+      // Working-layer scratch — skipped.
+      {
+        rel_path: '.working/turn_summary/x.md',
+        content: MEMORY_FILE,
+      },
+      // Index file — skipped.
+      { rel_path: 'MEMORY.md', content: '# index' },
+      // Bad frontmatter (missing type) — skipped.
+      { rel_path: 'junk.md', content: 'no frontmatter at all' },
+    ])
+    expect(result.created).toBe(1)
+    expect(result.skipped).toBe(3)
+
+    const rows = listMemoriesForUser(alice.id, { sessionId })
+    expect(rows).toHaveLength(1)
+    expect(rows[0].name).toBe('Release process')
+    expect(rows[0].scope_kind).toBe('personal')
+    expect(rows[0].owner_user_id).toBe(alice.id)
+
+    // Same name again → dedup update, not a second row.
+    const second = syncMemories(sessionId, [
+      { rel_path: 'project_release-process.md', content: MEMORY_FILE },
+    ])
+    expect(second.created).toBe(0)
+    expect(second.updated).toBe(1)
+    const rowsAfter = listMemoriesForUser(alice.id, { sessionId })
+    expect(rowsAfter).toHaveLength(1)
+    expect(rowsAfter[0].version).toBe(2)
+  })
+
+  test('syncMemories: injected team/ files are skipped, not forked as personal copies', () => {
+    const db = getDb()
+    const alice = createUserDirectly(db, { username: 'sync-team' })
+    const teamId = createTeam('sync-team', alice.id)
+    const sessionId = createSessionFor(alice.id, teamId)
+    // Team memory that was materialized into the pack's team/ subtree.
+    const teamRow = createMemory({
+      scopeKind: 'team',
+      teamId,
+      name: 'Team convention',
+      type: 'project',
+      content: 'v1',
+      createdBy: alice.id,
+    })
+
+    const result = syncMemories(sessionId, [
+      {
+        rel_path: 'team/project_team-convention.md',
+        content: `---\nname: Team convention\ntype: project\n---\nv2 edited by child\n`,
+      },
+    ])
+    expect(result.created).toBe(0)
+    expect(result.updated).toBe(0)
+    expect(result.skipped).toBe(1)
+
+    // The team row is untouched — no silent personal fork either.
+    const row = getMemoryRow(teamRow.id)
+    expect(row?.content).toBe('v1')
+    expect(row?.version).toBe(1)
+    expect(listMemoriesForUser(alice.id, { sessionId })).toHaveLength(0)
+  })
+
+  test('syncMemories: session without user owner throws no_owner', () => {
+    const db = getDb()
+    const teamOnly = storeCreateSession({})
+    storeBindSession(teamOnly.id, 'team_x', 'team')
+    let caught: unknown = null
+    try {
+      syncMemories(teamOnly.id, [{ rel_path: 'a.md', content: MEMORY_FILE }])
+    } catch (err) {
+      caught = err
+    }
+    expect(caught).toBeInstanceOf(MemoryError)
+    expect((caught as MemoryError).code).toBe('no_owner')
+  })
+})
+
+describe('memories web routes', () => {
+  beforeEach(() => {
+    const db = getDb()
+    db.query('DELETE FROM memories').run()
+    db.query('DELETE FROM memories_fts').run()
+    db.query('DELETE FROM team_members').run()
+    db.query('DELETE FROM teams').run()
+    storeReset()
+  })
+
+  test('CRUD round-trip with permission checks', async () => {
+    const db = getDb()
+    const app = createApp()
+    const alice = createUserDirectly(db, { username: 'web-alice' })
+    const bob = createUserDirectly(db, { username: 'web-bob' })
+    const token = `Bearer ${issueToken(alice.id)}`
+
+    // Create personal.
+    let res = await app.request('/web/memories', {
+      method: 'POST',
+      headers: { Authorization: token, 'content-type': 'application/json' },
+      body: JSON.stringify({
+        name: 'Web note',
+        description: 'from web',
+        type: 'project',
+        content: 'created from web UI',
+      }),
+    })
+    expect(res.status).toBe(201)
+    const created = (await res.json()) as { id: string; can_manage: boolean }
+    expect(created.can_manage).toBe(true)
+
+    // Another user cannot see it (404, existence-hiding).
+    res = await app.request(`/web/memories/${created.id}`, {
+      headers: { Authorization: `Bearer ${issueToken(bob.id)}` },
+    })
+    expect(res.status).toBe(404)
+
+    // Owner edits it.
+    res = await app.request(`/web/memories/${created.id}`, {
+      method: 'PATCH',
+      headers: { Authorization: token, 'content-type': 'application/json' },
+      body: JSON.stringify({ content: 'edited' }),
+    })
+    expect(res.status).toBe(200)
+
+    // Owner deletes it.
+    res = await app.request(`/web/memories/${created.id}`, {
+      method: 'DELETE',
+      headers: { Authorization: token },
+    })
+    expect(res.status).toBe(200)
+
+    // Now missing.
+    res = await app.request(`/web/memories/${created.id}`, {
+      headers: { Authorization: token },
+    })
+    expect(res.status).toBe(404)
+  })
+
+  test('team memory creation requires membership; promote route migrates scope', async () => {
+    const db = getDb()
+    const app = createApp()
+    const alice = createUserDirectly(db, { username: 'web-t-alice' })
+    const mallory = createUserDirectly(db, { username: 'web-mallory' })
+    const teamId = createTeam('web-team', alice.id)
+    const aliceToken = `Bearer ${issueToken(alice.id)}`
+
+    // Non-member cannot create team memory.
+    let res = await app.request('/web/memories', {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${issueToken(mallory.id)}`,
+        'content-type': 'application/json',
+      },
+      body: JSON.stringify({
+        name: 'sneaky',
+        type: 'project',
+        content: 'x',
+        team_id: teamId,
+      }),
+    })
+    expect(res.status).toBe(403)
+
+    // Alice creates personal, then promotes via the route.
+    res = await app.request('/web/memories', {
+      method: 'POST',
+      headers: {
+        Authorization: aliceToken,
+        'content-type': 'application/json',
+      },
+      body: JSON.stringify({
+        name: 'promote me',
+        type: 'project',
+        content: 'x',
+      }),
+    })
+    const created = (await res.json()) as { id: string }
+
+    res = await app.request(`/web/memories/${created.id}/promote`, {
+      method: 'POST',
+      headers: {
+        Authorization: aliceToken,
+        'content-type': 'application/json',
+      },
+      body: JSON.stringify({ team_id: teamId }),
+    })
+    expect(res.status).toBe(200)
+    const promoted = (await res.json()) as {
+      scope_kind: string
+      team_id: string
+    }
+    expect(promoted.scope_kind).toBe('team')
+    expect(promoted.team_id).toBe(teamId)
+  })
+})
+
+describe('memories v1 routes', () => {
+  beforeEach(() => {
+    const db = getDb()
+    db.query('DELETE FROM memories').run()
+    db.query('DELETE FROM memories_fts').run()
+    db.query('DELETE FROM team_members').run()
+    db.query('DELETE FROM teams').run()
+    storeReset()
+  })
+
+  test('pack requires worker auth and returns files for owned session', async () => {
+    const db = getDb()
+    const app = createApp()
+    const alice = createUserDirectly(db, { username: 'v1-alice' })
+    const sessionId = createSessionFor(alice.id)
+    createMemory({
+      scopeKind: 'personal',
+      ownerUserId: alice.id,
+      name: 'injected',
+      type: 'user',
+      content: 'should appear in pack',
+    })
+
+    // No auth → 401.
+    let res = await app.request(`/v1/memories/pack?session_id=${sessionId}`)
+    expect(res.status).toBe(401)
+
+    // Worker auth → pack with the memory file.
+    res = await app.request(`/v1/memories/pack?session_id=${sessionId}`, {
+      headers: AUTH_HEADERS,
+    })
+    expect(res.status).toBe(200)
+    const pack = (await res.json()) as { files: Record<string, string> }
+    expect(Object.keys(pack.files)).toContain('MEMORY.md')
+
+    // Unknown session → empty pack (spawn proceeds without injection).
+    res = await app.request('/v1/memories/pack?session_id=session_missing', {
+      headers: AUTH_HEADERS,
+    })
+    expect(res.status).toBe(200)
+    expect((await res.json()).files).toEqual({})
+  })
+
+  test('sync ingests entries attributed to the session owner', async () => {
+    const db = getDb()
+    const app = createApp()
+    const alice = createUserDirectly(db, { username: 'v1-sync' })
+    const sessionId = createSessionFor(alice.id)
+
+    const res = await app.request('/v1/memories/sync', {
+      method: 'POST',
+      headers: { ...AUTH_HEADERS, 'content-type': 'application/json' },
+      body: JSON.stringify({
+        session_id: sessionId,
+        files: [{ rel_path: 'project_x.md', content: MEMORY_FILE }],
+      }),
+    })
+    expect(res.status).toBe(200)
+    const result = (await res.json()) as { created: number }
+    expect(result.created).toBe(1)
+
+    const rows = listMemoriesForUser(alice.id, { sessionId })
+    expect(rows).toHaveLength(1)
+  })
+})
+
+function issueToken(userId: string): string {
+  // SQLite-backed token, same shape as the artifacts tests.
+  return issueSessionToken(userId, getDb()).accessToken
+}

package/packages/remote-control-server/src/db/rcs-schema.sql

@@ -165,6 +165,48 @@ CREATE VIRTUAL TABLE IF NOT EXISTS session_events_fts USING fts5(
   session_id UNINDEXED,
   event_id UNINDEXED
 );
+-- Memories — durable team/personal memory entries (agent memory system).
+-- `scope_kind` discriminates the two first-class scopes; the CHECK forces
+-- exactly one owner column: personal rows carry owner_user_id, team rows
+-- carry team_id. `source_session_id` keeps the provenance link back to the
+-- session that produced the memory (agent write-back). `archived` is a
+-- soft-delete terminal state that readers treat as missing.
+CREATE TABLE IF NOT EXISTS memories (
+  id TEXT PRIMARY KEY,
+  scope_kind TEXT NOT NULL CHECK (scope_kind IN ('personal', 'team')),
+  owner_user_id TEXT,
+  team_id TEXT,
+  name TEXT NOT NULL,
+  description TEXT,
+  type TEXT NOT NULL CHECK (type IN ('user', 'feedback', 'project', 'reference')),
+  layer TEXT NOT NULL DEFAULT 'semantic' CHECK (layer IN ('episodic', 'semantic', 'procedural')),
+  content TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'superseded', 'archived')),
+  source_session_id TEXT,
+  version INTEGER NOT NULL DEFAULT 1,
+  created_by TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  CHECK (
+    (scope_kind = 'personal' AND owner_user_id IS NOT NULL AND team_id IS NULL)
+    OR (scope_kind = 'team' AND team_id IS NOT NULL AND owner_user_id IS NULL)
+  )
+);
+
+CREATE INDEX IF NOT EXISTS idx_memories_personal ON memories(owner_user_id, status, updated_at);
+CREATE INDEX IF NOT EXISTS idx_memories_team ON memories(team_id, status, updated_at);
+CREATE INDEX IF NOT EXISTS idx_memories_session ON memories(source_session_id);
+
+-- Full-text search over memories (name/description/content), synced on
+-- write in services/memories.ts — same contentless-free pattern as
+-- session_events_fts (regular fts5 with an UNINDEXED join key).
+CREATE VIRTUAL TABLE IF NOT EXISTS memories_fts USING fts5(
+  name,
+  description,
+  content,
+  memory_id UNINDEXED
+);
+
 CREATE INDEX IF NOT EXISTS idx_artifacts_session ON artifacts(session_id);
 CREATE INDEX IF NOT EXISTS idx_artifacts_team ON artifacts(team_id);
 CREATE INDEX IF NOT EXISTS idx_artifacts_expires ON artifacts(expires_at);