@atomicmemory/core 1.0.0

package/CHANGELOG.md

@@ -0,0 +1,27 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+## [Unreleased]
+
+### Changed
+- **BREAKING**: All API endpoints are now mounted under `/v1/` (e.g. `POST /v1/memories/ingest`, `PUT /v1/agents/trust`). Update clients to prefix requests with `/v1`. The unversioned `/health` liveness probe is unchanged.
+
+## [1.0.0] - 2026-04-15
+
+### Added
+- Initial extraction from atomicmemory-research prototype
+- Express API server with memory ingest, search, and consolidation endpoints
+- Postgres + pgvector storage backend
+- Pluggable embedding providers: openai, openai-compatible, ollama, transformers (WASM)
+- AUDN mutation engine (Add, Update, Delete, No-op) with fail-closed semantics
+- Contradiction-safe claim versioning
+- Hybrid retrieval (vector + BM25/FTS)
+- Tiered context packaging
+- Entity graph with spreading activation
+- Docker and Railway deployment support
+- 869 tests across 79 test files
+- CI with GitHub Actions (typecheck, fallow, tests)
+- Contributor docs (CONTRIBUTING.md, issue/PR templates)

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 AtomicMemory
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,314 @@
+# Atomicmemory Core
+
+[![CI](https://github.com/atomicstrata/atomicmemory-core/actions/workflows/ci.yml/badge.svg)](https://github.com/atomicstrata/atomicmemory-core/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/%40atomicmemory%2Fcore?label=npm)](https://www.npmjs.com/package/@atomicmemory/core)
+[![Docker](https://img.shields.io/badge/docker-GHCR-2496ED?logo=docker&logoColor=white)](Dockerfile)
+[![Docs](https://img.shields.io/badge/docs-docs.atomicstrata.ai-blue)](https://docs.atomicstrata.ai)
+[![License: Apache 2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
+
+Open-source memory engine for AI applications and agents.
+
+Docker-deployable memory backend with durable context, semantic retrieval, and memory mutation (AUDN: Add, Update, Delete, No-op).
+
+**Docs:** [docs.atomicstrata.ai](https://docs.atomicstrata.ai)
+
+## Features
+
+- **Semantic ingest** — extract structured facts from conversations with contradiction detection
+- **Hybrid retrieval** — vector similarity + BM25/FTS with RRF fusion
+- **AUDN mutation** — Add, Update, Delete, No-op decisions with fail-closed integrity
+- **Claim versioning** — temporal lineage tracking with supersession and invalidation
+- **Tiered context packaging** — L0/L1/L2 compression for token-efficient retrieval
+- **Entity graph** — spreading activation over extracted entities
+- **Pluggable embeddings** — openai, openai-compatible, ollama, transformers (local WASM)
+- **Docker-deployable** — one-command deployment with Postgres + pgvector
+
+## Headline Results
+
+AtomicMemory v66 is cost-Pareto SOTA on BEAM-100K, BEAM-1M, and LoCoMo10 under matched methodology against published competitors. On BEAM-10M it matches the strongest published Mem0-new result while leaving Hindsight-scale temporal retrieval as the known open frontier.
+
+| Benchmark | AtomicMemory v66 | Position | Cost/Q | Sample |
+|---|---:|---|---:|---:|
+| **BEAM-100K lenient** | **0.7375** | Parity with Hindsight at 0.75 | $1.26 | n=80 |
+| **BEAM-1M lenient** | **0.6625** | Cost-Pareto SOTA; +0.022 vs Mem0 paper | $0.083 | n=80 |
+| **BEAM-10M lenient** | **0.4875** | Parity with Mem0-new at 0.486 | $0.081 | n=80 |
+| **LoCoMo10 GPT-4o-mini binary** | **0.8396** | Cost-Pareto SOTA; +0.171 vs Mem0 paper | $0.066 | n=1540 |
+
+These results put AtomicMemory at or near the published ceiling in each reported category while preserving the lower-cost operating profile that matters for real applications. Reproducibility artifacts and harness details will be published with the benchmark materials.
+
+## What This Is Not
+
+- Not a benchmark suite — eval harnesses live in a separate research repo
+- Not an SDK or client library — this is the server/backend. For a TypeScript
+  client, see [atomicmemory-sdk](https://github.com/atomicstrata/atomicmemory-sdk)
+
+## Quick Start
+
+For the full walkthrough, see the [Core Quickstart](https://docs.atomicstrata.ai/quickstart).
+
+### Docker image (recommended)
+
+After the first tagged release, you can run Core from the published GHCR image
+without cloning the repository. By default, the image starts an embedded
+Postgres/pgvector database and persists it to the mounted host directory:
+
+```bash
+export OPENAI_API_KEY=sk-...
+
+docker run --rm -it --pull always \
+  -p 127.0.0.1:3050:3050 \
+  -e OPENAI_API_KEY=$OPENAI_API_KEY \
+  -v $HOME/.atomicstrata/atomicmemory-docker:/var/lib/atomicmemory/postgres \
+  ghcr.io/atomicstrata/atomicmemory-core:latest
+```
+
+The image is published as `ghcr.io/atomicstrata/atomicmemory-core` with
+`latest`, semver, and commit-SHA tags.
+
+Local Docker defaults use `Authorization: Bearer local-dev-key`, OpenAI
+embeddings at 1536 dimensions, and `RAW_STORAGE_DEPLOYMENT_ENV=local`. The
+quickstart binds to `127.0.0.1` so that default key is only exposed locally.
+
+For production deployments, set real secrets and `DATABASE_URL` to your managed
+Postgres/pgvector connection string. When `DATABASE_URL` is unset or set to
+`embedded`, the container starts the bundled local Postgres instance.
+
+```bash
+export CORE_API_KEY=$(openssl rand -hex 32)
+export STORAGE_KEY_HMAC_SECRET=$(openssl rand -hex 32)
+
+docker run --rm -it --pull always \
+  -p 3050:3050 \
+  -e DATABASE_URL=postgresql://user:pass@postgres.example.com:5432/atomicmemory \
+  -e OPENAI_API_KEY=$OPENAI_API_KEY \
+  -e CORE_API_KEY=$CORE_API_KEY \
+  -e STORAGE_KEY_HMAC_SECRET=$STORAGE_KEY_HMAC_SECRET \
+  -e EMBEDDING_DIMENSIONS=1536 \
+  -e RAW_STORAGE_DEPLOYMENT_ENV=production \
+  ghcr.io/atomicstrata/atomicmemory-core:latest
+```
+
+If you prefer a two-container local stack, you can also run the app image with
+the bundled compose file:
+
+```bash
+curl -fsSLO https://raw.githubusercontent.com/atomicstrata/atomicmemory-core/main/docker-compose.image.yml
+cat > .env <<'EOF'
+OPENAI_API_KEY=sk-...
+CORE_API_KEY=replace-with-a-strong-random-secret
+STORAGE_KEY_HMAC_SECRET=000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
+EMBEDDING_DIMENSIONS=1536
+RAW_STORAGE_DEPLOYMENT_ENV=local
+EOF
+docker compose -f docker-compose.image.yml up
+```
+
+### Docker from source
+
+```bash
+git clone https://github.com/atomicstrata/atomicmemory-core.git
+cd atomicmemory-core
+cp .env.example .env
+# Edit .env with your OPENAI_API_KEY and DATABASE_URL
+docker compose up --build
+```
+
+### Local development
+
+```bash
+npm install
+cp .env.example .env
+# Edit .env — requires a running Postgres instance with pgvector
+npm run migrate
+npm run dev
+```
+
+Health check: `curl http://localhost:3050/v1/memories/health`
+
+### npm CLI
+
+The npm package also ships a thin CLI for environments where you already have
+a Postgres database with pgvector:
+
+```bash
+export DATABASE_URL=postgresql://user:pass@localhost:5432/atomicmemory
+
+npx -y @atomicmemory/core migrate --profile local
+npx -y @atomicmemory/core start --profile local
+```
+
+The `local` profile fills local-only defaults for the port, bearer key,
+storage policy, local transformers embeddings, and Claude Code as the LLM
+provider. It does not create or manage Postgres; use the Docker image above
+when you want the database bundled with Core.
+
+## API Overview
+
+### Core endpoints
+
+| Method | Path | Description |
+|--------|------|-------------|
+| `GET` | `/health` | Health check |
+| `POST` | `/v1/memories/ingest` | Full ingest with extraction and AUDN |
+| `POST` | `/v1/memories/ingest/quick` | Fast ingest (embedding dedup only) |
+| `POST` | `/v1/memories/search` | Semantic search with hybrid retrieval |
+| `POST` | `/v1/memories/search/fast` | Fast vector-only search |
+| `GET` | `/v1/memories/list` | List memories with optional filters |
+| `GET` | `/v1/memories/:id` | Get a single memory |
+| `DELETE` | `/v1/memories/:id` | Soft-delete a memory |
+| `POST` | `/v1/memories/consolidate` | Consolidate and compress memories |
+
+See the [HTTP API reference](https://docs.atomicstrata.ai/api-reference/http/conventions) for full endpoint documentation.
+
+### Per-request config override
+
+Search and ingest routes accept an optional `config_override` body field that
+overlays the startup `RuntimeConfig` for that single request. Useful for
+A/B tests, experiments, or dial-turning without restarting the server.
+
+```bash
+curl -X POST http://localhost:3050/v1/memories/search \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "user_id": "alice",
+    "query": "what stack does alice use?",
+    "config_override": { "hybridSearchEnabled": true, "maxSearchResults": 20 }
+  }'
+```
+
+Responses from requests carrying an override emit four observability headers:
+
+| Header | Emitted when | Value |
+|--------|--------------|-------|
+| `X-Atomicmem-Config-Override-Applied` | Override present | `true` |
+| `X-Atomicmem-Effective-Config-Hash` | Override present | `sha256:<hex>` of the merged config |
+| `X-Atomicmem-Config-Override-Keys` | Override present | Comma-joined sorted override keys |
+| `X-Atomicmem-Unknown-Override-Keys` | One or more keys don't match a current `RuntimeConfig` field | Comma-joined sorted unknown keys |
+
+The schema is permissive — unknown keys don't 400. They ride through on the
+effective config and surface via the fourth header plus a server-side warning
+log, so callers catch typos without gating new runtime fields behind a schema
+release.
+
+## Environment Variables
+
+### Required
+
+| Variable | Description |
+|----------|-------------|
+| `DATABASE_URL` | Postgres connection string (must have pgvector extension) |
+| `OPENAI_API_KEY` | OpenAI API key (when using `openai` embedding/LLM provider) |
+| `PORT` | Server port (default: 3050) |
+
+### Embedding Provider
+
+Set `EMBEDDING_PROVIDER` to choose your embedding backend:
+
+| Value | Description |
+|-------|-------------|
+| `openai` | OpenAI Embeddings API (default) |
+| `openai-compatible` | Any OpenAI-compatible API (recommended for self-hosters) |
+| `ollama` | Local Ollama instance |
+| `transformers` | Local WASM/ONNX inference via @huggingface/transformers |
+| `voyage` | Voyage AI embeddings with separate document/query models |
+
+For self-hosted deployments, `openai-compatible` is recommended as it works with any OpenAI-compatible embedding service.
+
+### LLM Provider
+
+Set `LLM_PROVIDER` to choose the extraction backend:
+
+| Value | Description |
+|-------|-------------|
+| `openai` | OpenAI Chat Completions API (default) |
+| `openai-compatible` | Any OpenAI-compatible chat API |
+| `ollama` | Local Ollama instance |
+| `groq` | Groq OpenAI-compatible API |
+| `anthropic` | Anthropic Messages API |
+| `google-genai` | Google Gemini OpenAI-compatible endpoint |
+| `claude-code` | Local Claude Code Agent SDK session for personal development |
+
+For personal local use, `LLM_PROVIDER=claude-code` uses the logged-in
+`claude` CLI session instead of requiring `ANTHROPIC_API_KEY`. It still consumes
+the user's Claude Code / Claude subscription limits and is not intended for
+hosted or team deployments. Pair it with a non-OpenAI embedding provider, such
+as `EMBEDDING_PROVIDER=transformers`, if you want to run without an OpenAI API
+key as well.
+
+In-process benchmark harnesses can avoid editing env files by passing a
+composition-time config to the runtime:
+
+```ts
+import { config, createCoreRuntime } from '@atomicmemory/core';
+
+const runtime = createCoreRuntime({
+  pool,
+  config: {
+    ...config,
+    embeddingProvider: 'voyage',
+    embeddingDimensions: 1024,
+    voyageApiKey,
+    voyageDocumentModel: 'voyage-4-large',
+    voyageQueryModel: 'voyage-4-lite',
+  },
+});
+```
+
+Provider/model fields are still startup-only for a given runtime. Use a new
+isolated runtime or process for each embedding configuration.
+
+See `.env.example` for the full list of configuration options.
+
+## Deployment
+
+### Platform-specific deployment
+
+See `deploy/` for platform-specific configs (Railway, etc.). Copy the relevant config to your project root before deploying.
+
+### Docker
+
+```bash
+docker compose up --build
+```
+
+The compose file includes Postgres with pgvector. The app container runs migrations on startup, then starts the server.
+
+## Architecture
+
+```
+src/
+  routes/       # Express route handlers
+  services/     # Business logic (extraction, retrieval, packaging)
+  db/           # Repository layer, schema, migrations
+  adapters/     # Type contracts for external integrations
+  config.ts     # Environment-driven configuration
+  server.ts     # Express app bootstrap
+```
+
+Storage: Postgres + pgvector. Retrieval: hybrid (vector + BM25/FTS). Mutation: contradiction-safe AUDN with claim versioning.
+
+## Development
+
+```bash
+npm test                    # Run unit tests
+npm run test:deployment     # Deployment config tests
+npm run test:docker-smoke   # Docker smoke test
+npm run test:schema         # Schema regression fuzzing (Schemathesis)
+npm run migrate:test        # Run migrations against test DB
+```
+
+### Schema regression tests
+
+Property-based fuzzing of `openapi.yaml` via Schemathesis runs on every
+PR (`schema-fuzz` job in `.github/workflows/ci.yml`). Catches wire-shape
+regressions where a route's response drifts from its declared schema.
+See [`tests/schema/`](tests/schema/) for how to run locally and how to
+read the report.
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for setup, workflow, and code style expectations.
+
+## License
+
+[Apache-2.0](LICENSE)

package/dist/app/bind-ephemeral.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Canonical HTTP-boot helper for tests and research harnesses.
+ *
+ * Binds a composed Express app (`createApp(createCoreRuntime({ pool }))`)
+ * to an ephemeral port and returns the base URL plus a close handle.
+ * This is the stable seam for any in-repo test or external research
+ * harness that wants to exercise the HTTP contract against a live core
+ * server without hard-coding port allocation.
+ *
+ * See https://docs.atomicmemory.ai/platform/consuming-core.
+ */
+import type express from 'express';
+export interface BootedApp {
+    baseUrl: string;
+    close: () => Promise<void>;
+}
+/** Bind an Express app to an ephemeral port and return its base URL + close handle. */
+export declare function bindEphemeral(app: ReturnType<typeof express>): Promise<BootedApp>;

package/dist/app/bind-ephemeral.js

@@ -0,0 +1,22 @@
+/**
+ * Canonical HTTP-boot helper for tests and research harnesses.
+ *
+ * Binds a composed Express app (`createApp(createCoreRuntime({ pool }))`)
+ * to an ephemeral port and returns the base URL plus a close handle.
+ * This is the stable seam for any in-repo test or external research
+ * harness that wants to exercise the HTTP contract against a live core
+ * server without hard-coding port allocation.
+ *
+ * See https://docs.atomicmemory.ai/platform/consuming-core.
+ */
+/** Bind an Express app to an ephemeral port and return its base URL + close handle. */
+export async function bindEphemeral(app) {
+    const server = app.listen(0);
+    await new Promise((resolve) => server.once('listening', () => resolve()));
+    const addr = server.address();
+    const port = typeof addr === 'object' && addr ? addr.port : 0;
+    return {
+        baseUrl: `http://localhost:${port}`,
+        close: () => new Promise((resolve) => server.close(() => resolve())),
+    };
+}

package/dist/app/cors-headers.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @file Canonical CORS `Access-Control-Allow-Headers` list shared by
+ * the global CORS middleware (`createApp`) and any router-scoped
+ * CORS shims (`routes/memories.ts`). Keeping the list in one place
+ * stops a router-level overwrite from silently regressing the
+ * preflight contract for the headers the SDK / webapp-sdk send.
+ *
+ * `Content-Length` is CORS-safelisted by the browser; it does not
+ * need to appear here.
+ */
+/** Single comma-joined string for `Access-Control-Allow-Headers`. */
+export declare const CORS_ALLOWED_HEADERS_VALUE: string;

package/dist/app/cors-headers.js

@@ -0,0 +1,18 @@
+/**
+ * @file Canonical CORS `Access-Control-Allow-Headers` list shared by
+ * the global CORS middleware (`createApp`) and any router-scoped
+ * CORS shims (`routes/memories.ts`). Keeping the list in one place
+ * stops a router-level overwrite from silently regressing the
+ * preflight contract for the headers the SDK / webapp-sdk send.
+ *
+ * `Content-Length` is CORS-safelisted by the browser; it does not
+ * need to appear here.
+ */
+/** Single comma-joined string for `Access-Control-Allow-Headers`. */
+export const CORS_ALLOWED_HEADERS_VALUE = [
+    'Content-Type',
+    'Authorization',
+    'X-AtomicMemory-User-Id',
+    'X-AtomicMemory-Metadata',
+    'X-AtomicMemory-Content-Encoding',
+].join(', ');

package/dist/app/create-app.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Express application factory — wires routers onto a runtime container.
+ *
+ * Separates composition (done in `runtime-container.ts`) from HTTP
+ * transport concerns. Tests and harnesses can create an Express app from
+ * any runtime container without touching the server bootstrap.
+ */
+import express from 'express';
+import type { CoreRuntime } from './runtime-container.js';
+/**
+ * Build an Express application from a composed runtime container. The
+ * runtime owns all deps; this module only wires HTTP concerns (CORS, body
+ * parsing, routes, health).
+ *
+ * Body parsing is **route-scoped per router**, not global. Each
+ * `app.use('/v1/<area>', ..., createXRouter())` call declares the cap
+ * its router needs at the mount point — no router relies on inheriting
+ * a parser from above. The documents router additionally owns its own
+ * per-route parsing internally (the `/:id/index` body uses a 25 MiB cap
+ * sourced from `MAX_INDEX_TEXT_BYTES`; everything else falls through to
+ * the documents router's own 1 MiB JSON parser). Mounting a global
+ * `express.json` on the app would silently override that ordering, so
+ * we deliberately do NOT.
+ */
+export declare function createApp(runtime: CoreRuntime): ReturnType<typeof express>;