Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 9 additions & 16 deletions .github/workflows/docs.yml
Original file line number Diff line number Diff line change
Expand Up @@ -30,28 +30,21 @@ jobs:
with:
ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || github.ref }}

- uses: actions/setup-python@v5
# Pin to the same Bun version used by the repo's ./bun wrapper
# (kept in sync with the `version=...` line in /bun).
- uses: oven-sh/setup-bun@v2
with:
python-version: "3.x"
bun-version: "1.3.13"

- run: pip install mkdocs-material 'mkdocs<2'
- name: Install dependencies
run: bun install --frozen-lockfile

- run: mkdocs build --strict

# Copy raw Markdown source into the build output so both HTML and .md
# are served. HTML lives at /getting-started/ while the raw Markdown
# is available at /getting-started.md.
- name: Copy raw Markdown source
run: |
find docs -name '*.md' | while read src; do
dest="site/${src#docs/}"
mkdir -p "$(dirname "$dest")"
cp "$src" "$dest"
done
- name: Build docs site
run: bun run docs:build

- uses: actions/upload-pages-artifact@v4
with:
path: site
path: packages/docs-site/out

- id: deploy
uses: actions/deploy-pages@v5
1 change: 1 addition & 0 deletions CLAUDE.md
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ packages/
engine/ # Core engine (database operations, search, embedding)
protocol/ # Shared types and Zod schemas (JSON-RPC methods)
hosted/ # Hosted/multi-tenant provisioning
docs-site/ # Next.js static site that renders `docs/` for docs.memory.build
packs/ # Memory packs (pre-built knowledge collections)
docs/
cli/ # CLI command reference (one file per command group)
Expand Down
22 changes: 21 additions & 1 deletion biome.json
Original file line number Diff line number Diff line change
Expand Up @@ -24,11 +24,26 @@
},
"overrides": [
{
"includes": ["docs/stylesheets/**"],
"includes": ["packages/docs-site/.next/**", "packages/docs-site/out/**"],
"linter": {
"enabled": false
}
},
{
"includes": ["packages/docs-site/**/*.css"],
"css": {
"parser": {
"cssModules": false
}
},
"linter": {
"rules": {
"complexity": {
"noImportantStyles": "off"
}
}
}
},
{
"includes": ["**/*.test.ts"],
"linter": {
Expand All @@ -43,6 +58,11 @@
}
}
],
"css": {
"parser": {
"tailwindDirectives": true
}
},
"javascript": {
"formatter": {
"quoteStyle": "double"
Expand Down
242 changes: 237 additions & 5 deletions bun.lock

Large diffs are not rendered by default.

15 changes: 8 additions & 7 deletions docs/access-control.md
Original file line number Diff line number Diff line change
Expand Up @@ -107,15 +107,16 @@ Access control is enforced by PostgreSQL Row-Level Security (RLS) policies on th

This means access control cannot be bypassed by application bugs -- it's enforced by the database itself.

!!! warning "The invisible wall"
When RLS denies access, you get **empty results, not errors**. A search returns fewer results silently. A `memory.get` returns "not found" even if the memory exists. This is by design (PostgreSQL RLS behavior), but it can be confusing when debugging.
:::warning[The invisible wall]
When RLS denies access, you get **empty results, not errors**. A search returns fewer results silently. A `memory.get` returns "not found" even if the memory exists. This is by design (PostgreSQL RLS behavior), but it can be confusing when debugging.

If you're seeing missing results:
If you're seeing missing results:

1. Check the user's access with `me grant check <user> <path> read`
2. Verify the memory exists by checking as a superuser
3. Check that the user has grants covering the memory's tree path
4. Remember that grants are hierarchical -- a grant on `work` covers `work.projects.*`
1. Check the user's access with `me grant check <user> <path> read`
2. Verify the memory exists by checking as a superuser
3. Check that the user has grants covering the memory's tree path
4. Remember that grants are hierarchical -- a grant on `work` covers `work.projects.*`
:::

## Example: team setup

Expand Down
Loading