This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+5 more
Affected surfaces
Summary
AI summarySchema break requires deleting v0.0.3 SQLite stores before upgrading to v0.0.4.
Full changelog
Highlights
- BIP-39 24-word recovery phrase —
Mneme.initialize({ passphrase })returns the phrase exactly once. Either the passphrase or the recovery phrase unlocks the SAME store. Forgotten passphrase no longer = lost data. - Ed25519 signed writes — every encrypted write carries a cryptographic signature derived deterministically from the master key (HKDF-SHA256). Every read verifies it.
mneme.publicKeyis a stable identifier any third party can use to verify provenance. - Lexical recall under encryption now throws instead of silently returning
[]. Clear pointer at the embedder option in the error message. - API split:
Mneme.initialize()for fresh encrypted stores,Mneme.open()for existing ones. Sync constructor stays plaintext-only. - ADR 0006 captures the dual-wrapping master-key model, the Ed25519/HKDF choice, and the deliberate v0.0.3 schema break.
Breaking change
The v0.0.3 crypto_metadata keyring is not auto-migrated. v0.0.4 uses a new mneme_keyring table with a different shape (random master key + dual wrapping). If you have a v0.0.3 SQLite file (only dev-preview test stores should), delete it and re-initialise. ADR 0006 §"Schema break" explains the reasoning (zero production users; auto-migration is a v0.0.5 helper if anyone asks).
What's in the repo today
packages/protocolv0.0.1 — open spec typespackages/sdkv0.0.4 — encryption + recovery + signingpackages/embedder-localv0.0.1 — on-device embeddingstests/conformancev0.0.1 — cross-implementation suitedocs/protocol/v0.1.md— public wire specdecisions/— 6 ADRs
Try it
git clone https://github.com/ppserapiao/mneme
cd mneme
bun install
bun test # 70 pass, 2 skip
import { Mneme } from '@mneme/sdk'
import { LocalEmbedder } from '@mneme/embedder-local'
// First time
const { mneme, recoveryPhrase } = await Mneme.initialize({
passphrase: 'correct horse battery staple',
embedder: new LocalEmbedder(),
})
console.log('SAVE THIS:', recoveryPhrase)
console.log('Public key:', mneme.publicKey)
await mneme.remember({ kind: 'fact', body: 'london resident' })
const matches = await mneme.recall('where they live')
// Later — passphrase or recovery, same store
// const mneme = await Mneme.open({ passphrase: '...' })
// const mneme = await Mneme.open({ recoveryPhrase: '...' })
Breaking Changes
- v0.0.3 `crypto_metadata` keyring is not auto-migrated; new stores use a different `mneme_keyring` table shape requiring manual deletion of v0.0.3 SQLite files.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Mneme
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]