Migrate lite to standard

Both deployment profiles run on the same PostgreSQL tables. lite is the single-user profile with the auth/organization stack left unwired; standard (the default) adds the multi-tenant stack — authentication, per-agent API keys, organizations, and rate limits — on top of the identical storage.

Because the data already lives in the same Postgres schema, promoting lite to standard requires no data migration, backfill, or dual-write. You switch DEPLOYMENT_PROFILE and supply auth configuration; the memories, short-term rows, and reindex job rows are already where standard expects them.

If pnpm is not on your PATH, replace the leading pnpm in any command with npm exec --yes pnpm@11.5.0 --.

Profile names

standard is the current name; enterprise is accepted as a deprecated alias and coerces to standard. The old memory profile was removed — every profile now runs on Postgres.

Step 1 — Prepare auth configuration

standard served over MCP_TRANSPORT=streamable-http will refuse to boot without authentication configured — the fail-safe would otherwise serve every tenant unauthenticated with a client-controlled userId. Set the auth variables before switching the profile:

# .env on the server host
AUTH_REQUIRED=true
JWT_SECRET=<at least 32 chars — openssl rand -base64 48>

See Enable authentication for the JWT secret requirements, the boot fail-safe, and the ALLOW_UNAUTHENTICATED_HTTP escape hatch for a deliberately open, trusted-network deployment.

Step 2 — Switch the profile

# .env on the server host
DEPLOYMENT_PROFILE=standard

standard is the default, so removing DEPLOYMENT_PROFILE=lite entirely has the same effect. Restart the server. No schema change and no db:migrate step is needed — the tables are unchanged.

Step 3 — Mint per-agent API keys

With standard active and AUTH_REQUIRED=true, every /mcp call must present a credential. Mint one least-privilege API key per agent:

pnpm --filter mcp-server provision-agent-keys -- \
  --agents claude-code,copilot,cursor --user qp \
  --scopes memories:read,memories:write

Each key prints once in plaintext (eng_…); wire it into each client as a Bearer credential. Full workflow: Provision agent API keys.

Verify

curl http://localhost:3000/health/ready

# A protected tools/call without an Authorization header must now return 401.
curl -i -X POST http://localhost:3000/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"list_memories","arguments":{"userId":"qp"}},"id":1}'

The same call with a valid eng_… key must succeed. The scripted checks in Enable authentication cover the rest.

Rollback

Set DEPLOYMENT_PROFILE=lite (and drop the auth requirement if you want the single-user posture back) and restart. The data was never moved, so the lite server reads the same tables unchanged.