feat: optimize server performance, SDK usability, and monorepo CI/CD

[Olympusxvn]

Overview

This Pull Request introduces significant optimizations across the entire MemWal stack, focusing on database performance, SDK developer experience, and monorepo stability.

Key Changes

🚀 Rust Server & Database

• IVFFlat Index: Added an IVFFlat index on vector embeddings (migration 004) to optimize write-heavy workloads.
• Batch Processing: Implemented a new POST /api/remember/batch endpoint for atomic insertion of up to 100 items.
• Caching: Added Redis-backed vector search caching with a 60s TTL to reduce pgvector overhead.
• Sidecar Improvements: Added /embed-batch to the TypeScript sidecar for parallelized embeddings.

📦 TypeScript SDK

• rememberBatch method: Added support for the new batch endpoint.
• Resilience: Implemented exponential backoff retry logic (up to 3 retries) for transient network errors and 429 rate limits.
• Connection Reuse: Added a custom HttpClient to support keep-alive and connection pooling.

🛠 Monorepo & CI/CD

• Turborepo Integration: Configured turbo.json with a dependency-aware pipeline to speed up builds.
• GitHub Actions: Added a robust CI workflow that builds the SDK and checks Rust code (clippy/fmt) on every push.
• Dependency Fixes: Upgraded @types/react to v19 to resolve build errors in the chatbot app.

Documentation

Detailed changes and lessons learned are documented in the newly added CHANGELOG.md and lessons.md files within the PR.
update:
2026-04-29_memwal-code-review
2026-04-29_memwal-fix-plan
2026-04-29_memwal-lessons
OlympusXVN

[Olympusxvn]

section with 16 numbered items covering all CRITICAL/HIGH/MEDIUM fixes across the Rust server and sidecar, cross-referencing the specific files and what changed.

1. Private keys must never leave the owning process
2. Silent dev fallbacks are production bugs in disguise
3. Check-then-act isn't atomic — use a single round-trip (Lua/CAS)
4. Trust boundaries need explicit auth even on localhost
5. Truncated hashes cause silent correctness (and privacy) bugs
6. Unbounded external scans need a hard cap
7. Input validation belongs at the outermost boundary
8. CORS "permissive" should be an explicit, warned-on decision
9. The "it's the server's own key" distinction — when cross-process key transfer is unavoidable
10. Every endpoint needs a rate limit weight assigned at creation, not retrofitted later.

[Olympusxvn]

The pull request [PR #123] introduces performance optimizations and a major security overhaul regarding how SEAL credentials and Sui keys are handled.

Here is a concise summary of the changes across the key files:

1. SDK & Frontend Logic
   packages/sdk/src/memwal.ts: Updates the client to support the new x-seal-session authentication. It implements better error sanitization and adds an AbortController with a 15s timeout for recall requests.

services/server/scripts/sidecar-server.ts: Enables CORS for frontend sponsorship, tightens batch decryption limits (from 100 to 25 items) to prevent OOM errors, and enforces strict validation on Sui object IDs and epochs.

2. Core Server Authentication & DB
   services/server/src/auth.rs: Transitions from raw private keys to a dual-path authentication system. It now prioritizes x-seal-session (modern) but maintains x-delegate-key (legacy) for backward compatibility.

services/server/src/db.rs: Adds a new database migration (005) to handle expiration logic for the delegate key cache.

3. Performance & Concurrency
   services/server/src/types.rs: Introduces a KeyPool structure. This uses a round-robin (AtomicUsize) mechanism to select Sui keys, allowing the server to sign and pay for gas on parallel uploads without bottlenecking.

services/server/src/routes.rs: The "brain" of the update. It implements Concurrent Decryption (using join_all) for memories, caps DB search results to 100 (security fix MED-3), and integrates the KeyPool into the upload flow.

4. Infrastructure & Security Updates
   services/server/src/seal.rs: Updates encryption/decryption signatures to treat the sidecar secret as optional (Option<&str>), allowing for more flexible environment configurations.

services/server/src/walrus.rs: Modifies the Walrus upload request to include a key_index, ensuring the sidecar uses the specific key assigned by the server’s round-robin pool.

Error Handling: Updates AppError to generate a unique trace_id (UUID) for internal errors, masking sensitive system details from the end-user while allowing developers to track issues in logs.