Arnas Donauskas 020dc2ae11 fix(ai-kb): address code-review findings ... - Security: REVOKE ALL FROM PUBLIC + GRANT EXECUTE (authenticated, service_role) on the match RPCs so anon can't read a KB by supplying an account_id (mirrors migrations 018/025). - Ingest: store chunks even when embedding fails (insert first, rethrow after) so a doc stays lexically searchable; the "lexical still works" warning is now truthful. - Retrieval: short-circuit on an empty KB (cheap COUNT) to avoid a paid query embedding + 2 RPCs on every draft/auto-reply. - Migration: HNSW instead of IVFFlat (robust on small/growing tables); language-neutral 'simple' FTS config (was 'english'); semantic RPC takes text and casts ::vector(1536) to remove PostgREST bind ambiguity. - Embeddings key: distinguish corrupt-from-absent (loadEmbeddingsKey returns {key,corrupt}); log on decrypt failure; reindex now reports failure instead of false success; POST/PATCH warn on keyword-only save. - embedTexts: fail loud when the provider omits result indices (was silently misaligning chunks with vectors). Tests: +3 (empty-KB guard, embed-failure-still-indexes, missing-index). 587 pass; typecheck/lint/build green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>		2026-07-02 17:20:38 +03:00
..
migrations	fix(ai-kb): address code-review findings	2026-07-02 17:20:38 +03:00