@pyxmate/memory 0.1.0-beta → 0.1.2-beta

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -0,0 +1,223 @@
1
+ # Embedded Integration Patterns
2
+
3
+ For projects using pyx-memory directly in-process with full feature access.
4
+
5
+ ## Contents
6
+ - [Pattern 1: Testing / Development](#pattern-1-testing--development)
7
+ - [Pattern 2: Production](#pattern-2-production)
8
+ - [Pattern 3: Production with Store Targets](#pattern-3-production-with-store-targets)
9
+ - [Pattern 4: With Knowledge Graph](#pattern-4-with-knowledge-graph)
10
+ - [Pattern 5: With LLM Lifecycle](#pattern-5-with-llm-lifecycle)
11
+ - [Pattern 6: File Ingestion](#pattern-6-file-ingestion)
12
+ - [Pattern 7: Factory with Auto-Mode Switching](#pattern-7-factory-with-auto-mode-switching)
13
+ - [Adding as Git Submodule](#adding-as-git-submodule-recommended-for-embedded-mode)
14
+ - [MemoryOptions Quick Reference](#memoryoptions-quick-reference)
15
+
16
+ ---
17
+
18
+ ## Pattern 1: Testing / Development
19
+
20
+ ```typescript
21
+ import { Memory } from '@pyx-memory/core';
22
+
23
+ const memory = new Memory({ dataDir: ':memory:' });
24
+ await memory.initialize();
25
+ // Memory internally creates a LocalEmbeddingProvider (BGE-M3, 1024d)
26
+ // No embedder needed — embedding is fully managed
27
+ ```
28
+
29
+ ## Pattern 2: Production
30
+
31
+ ```typescript
32
+ import { Memory } from '@pyx-memory/core';
33
+
34
+ const memory = new Memory({ dataDir: './data' });
35
+ await memory.initialize();
36
+ // Embedding is handled internally by LocalEmbeddingProvider (BGE-M3 via @huggingface/transformers, 1024d)
37
+ // No external embedding provider needed
38
+ ```
39
+
40
+ ## Pattern 3: Production with Store Targets
41
+
42
+ ```typescript
43
+ import { Memory } from '@pyx-memory/core';
44
+
45
+ const memory = new Memory({ dataDir: './data' });
46
+ await memory.initialize();
47
+
48
+ // Default: stores to sqlite + vector
49
+ await memory.store({
50
+ content: 'User prefers dark mode',
51
+ type: 'long-term',
52
+ metadata: { source: 'settings' },
53
+ });
54
+
55
+ // Explicit targets: sqlite only (skip vector indexing)
56
+ await memory.store({
57
+ content: 'Temporary note',
58
+ type: 'working',
59
+ metadata: {},
60
+ targets: ['sqlite'],
61
+ });
62
+ ```
63
+
64
+ ## Pattern 4: With Knowledge Graph
65
+
66
+ ```typescript
67
+ import { Memory, createGraphStore } from '@pyx-memory/core';
68
+ import type { StoreTarget, IngestEntity, IngestRelationship } from '@pyx-memory/shared';
69
+
70
+ // 1. Create and initialize graph store BEFORE Memory
71
+ const graphStore = createGraphStore({}); // returns SQLiteGraphStore (default)
72
+ await graphStore.initialize({}); // REQUIRED — Memory does NOT init this for you
73
+
74
+ // For Neo4j instead: createGraphStore({ neo4jUrl: 'bolt://localhost:7687' })
75
+
76
+ const memory = new Memory({
77
+ dataDir: './data',
78
+ graphStore, // enables graph RAG search
79
+ });
80
+ await memory.initialize();
81
+
82
+ // Graph storage is agent-driven — YOU provide entities and relationships explicitly
83
+ await memory.store({
84
+ content: 'Alice works at Acme Corp as a senior engineer',
85
+ type: 'long-term',
86
+ metadata: {},
87
+ targets: ['sqlite', 'vector', 'graph'],
88
+ entities: [
89
+ { name: 'Alice', type: 'PERSON', properties: { role: 'senior engineer' } },
90
+ { name: 'Acme Corp', type: 'ORGANIZATION' },
91
+ ],
92
+ relationships: [
93
+ { source: 'Alice', target: 'Acme Corp', type: 'WORKS_AT' },
94
+ ],
95
+ });
96
+
97
+ // Graph-aware search
98
+ const results = await memory.search({ query: 'Alice employer', strategy: 'graph' });
99
+
100
+ // Cleanup both
101
+ await memory.shutdown();
102
+ await graphStore.shutdown();
103
+ ```
104
+
105
+ ## Pattern 5: With LLM Lifecycle
106
+
107
+ ```typescript
108
+ import { Memory } from '@pyx-memory/core';
109
+ import type { LLMCallback } from '@pyx-memory/core';
110
+
111
+ // LLMCallback: any function that takes a prompt string and returns a completion string
112
+ const llm: LLMCallback = async (prompt) => {
113
+ const res = await fetch('https://api.anthropic.com/v1/messages', {
114
+ method: 'POST',
115
+ headers: {
116
+ 'x-api-key': process.env.ANTHROPIC_API_KEY!,
117
+ 'content-type': 'application/json',
118
+ 'anthropic-version': '2023-06-01',
119
+ },
120
+ body: JSON.stringify({
121
+ model: 'claude-sonnet-4-20250514',
122
+ max_tokens: 1024,
123
+ messages: [{ role: 'user', content: prompt }],
124
+ }),
125
+ });
126
+ const data = await res.json() as any;
127
+ return data.content[0].text;
128
+ };
129
+
130
+ const memory = new Memory({
131
+ dataDir: './data',
132
+ llm, // enables LLM-powered lifecycle
133
+ });
134
+ await memory.initialize();
135
+
136
+ // Now lifecycle methods use LLM intelligence
137
+ await memory.consolidate(); // LLM scoring + dedup + conflict resolution
138
+ await memory.summarizeSession('session-123'); // LLM summarization
139
+ await memory.runDecay(); // importance-based archival
140
+ ```
141
+
142
+ **Without LLM**: Lifecycle still works using heuristic fallbacks (regex extraction, embedding-distance dedup, formula-based scoring). LLM makes it smarter, not mandatory.
143
+
144
+ ## Pattern 6: File Ingestion
145
+
146
+ ```typescript
147
+ import { IngestionAgent, Memory } from '@pyx-memory/core';
148
+
149
+ const memory = new Memory({ dataDir: './data' });
150
+ await memory.initialize();
151
+
152
+ const agent = new IngestionAgent({
153
+ llm: myLlmCallback, // optional: smart classification + enrichment
154
+ embedder: (texts) => myEmbedder.embed(texts), // optional: semantic chunking (separate from Memory's internal embedder)
155
+ useSemanticChunking: true,
156
+ useStructuralChunking: false,
157
+ enableEnrichment: true,
158
+ enableMetadata: true,
159
+ enableHierarchical: false, // requires LLM
160
+ });
161
+
162
+ // Supported: .txt, .md, .csv, .pdf, .docx, .json, .html
163
+ const buffer = Buffer.from(await Bun.file('report.pdf').arrayBuffer());
164
+ const result = await agent.ingest(buffer, 'report.pdf', memory);
165
+ // result: { filename, fileType, chunks, entryIds, totalCharacters }
166
+ ```
167
+
168
+ **Note**: `IngestionAgent` may accept its own `embedder` for semantic chunking. This is separate from Memory's internal embedding — Memory handles its own embedding automatically.
169
+
170
+ ## Pattern 7: Factory with Auto-Mode Switching
171
+
172
+ ```typescript
173
+ import { createMemory } from '@pyx-memory/core';
174
+
175
+ // Embedded mode (default)
176
+ const memory = createMemory({
177
+ dataDir: './data',
178
+ });
179
+
180
+ // Sidecar mode (when MEMORY_URL is set)
181
+ const remote = createMemory({
182
+ memoryUrl: process.env.MEMORY_URL, // e.g., 'http://localhost:7822'
183
+ apiKey: process.env.MEMORY_API_KEY,
184
+ });
185
+
186
+ await memory.initialize();
187
+
188
+ // WARNING: createMemory() returns MemoryInterface, NOT ExtendedMemoryInterface.
189
+ // If you need lifecycle methods, cast:
190
+ // const extended = memory as ExtendedMemoryInterface;
191
+ // Or prefer `new Memory()` / `new MemoryClient()` directly.
192
+ ```
193
+
194
+ ---
195
+
196
+ ## Adding as Git Submodule (Recommended for Embedded Mode)
197
+
198
+ ```bash
199
+ git submodule add https://github.com/fysoul17/pyx-memory-v1.git vendor/pyx-memory
200
+ ```
201
+
202
+ Add to your `package.json` workspaces:
203
+
204
+ ```json
205
+ {
206
+ "workspaces": [
207
+ "packages/*",
208
+ "vendor/pyx-memory/packages/shared",
209
+ "vendor/pyx-memory/packages/client",
210
+ "vendor/pyx-memory/packages/core"
211
+ ]
212
+ }
213
+ ```
214
+
215
+ Then: `bun install`
216
+
217
+ ---
218
+
219
+ ## MemoryOptions Quick Reference
220
+
221
+ `embedder` has been removed from MemoryOptions. Memory internally creates a `LocalEmbeddingProvider` using BGE-M3 (1024 dimensions) via `@huggingface/transformers`. You never need to provide an embedding function.
222
+
223
+ See [reference/types.md](../reference/types.md#memoryoptions-reference) for the full MemoryOptions table.
@@ -0,0 +1,139 @@
1
+ # Advanced Features
2
+
3
+ ## RAG Strategies
4
+
5
+ | Strategy | How It Works | Requirements |
6
+ |----------|-------------|--------------|
7
+ | `'naive'` | Embed query → vector similarity → top-K | (default, always available) |
8
+ | `'graph'` | Extract entities → graph traversal → context expansion | `graphStore` in MemoryOptions |
9
+ | `'hybrid'` | BM25 + vector + graph + community summaries → RRF fusion (k=60) → reranking | `graphStore` in MemoryOptions |
10
+ | `'agentic'` | LLM decides strategy → iterative refinement (3 rounds) | `reasoningProvider` in MemoryOptions |
11
+
12
+ ```typescript
13
+ // Naive (default)
14
+ await memory.search({ query: 'user preferences', limit: 10 });
15
+
16
+ // Graph
17
+ await memory.search({ query: 'who works at Acme', strategy: 'graph', limit: 10 });
18
+
19
+ // Hybrid (recommended for best quality)
20
+ await memory.search({ query: 'deployment config', strategy: 'hybrid', limit: 10 });
21
+
22
+ // With query transformation (HyDE generates hypothetical answer, embeds that instead)
23
+ // EMBEDDED ONLY — enableHyDE not forwarded by HTTP API
24
+ await memory.search({ query: 'deployment config', strategy: 'hybrid', enableHyDE: true });
25
+
26
+ // With reranking (cross-encoder scores each result for precision)
27
+ // EMBEDDED ONLY — enableRerank not forwarded by HTTP API
28
+ await memory.search({ query: 'deployment config', strategy: 'hybrid', enableRerank: true });
29
+ ```
30
+
31
+ ### Retrieval Pipeline (Hybrid Strategy)
32
+
33
+ ```
34
+ Query → Stage 0: Transform (decompose, HyDE, multi-query)
35
+ → Stage 1: Parallel retrieval (BM25/FTS5 + dense vector + graph traverse + community summaries)
36
+ → Stage 2: RRF fusion (k=60) + dedup
37
+ → Stage 3: Cross-encoder reranking → top-N
38
+ ```
39
+
40
+ ---
41
+
42
+ ## Bi-Temporal Model
43
+
44
+ Every entry tracks two timestamps for temporal reasoning:
45
+
46
+ - **`eventTime`**: When the fact/event actually occurred
47
+ - **`ingestTime`**: When it was stored in memory (auto-set)
48
+
49
+ **Sidecar note**: All `StoreInput` fields (including `eventTime`, `id`, `parentId`, `ingestTime`) are forwarded by `MemoryClient.store()`. Temporal search filters (`eventTimeRange`, `asOf`) are forwarded by `MemoryClient.search()`. However, `filters` (source, importanceMin, parentId, contentType), `enableHyDE`, and `enableRerank` are still not forwarded by the search endpoint.
50
+
51
+ ```typescript
52
+ // Store with explicit event time (works in both embedded and sidecar)
53
+ await memory.store({
54
+ content: 'User changed address to 123 Main St',
55
+ type: 'long-term',
56
+ metadata: {},
57
+ eventTime: '2026-01-15T00:00:00Z', // when it happened
58
+ });
59
+
60
+ // Query as-of (available via MemoryClient.queryAsOf() or HTTP endpoint)
61
+ const snapshot = await memory.queryAsOf('2026-01-20T00:00:00Z', { type: 'long-term' });
62
+
63
+ // Query by event time range (available via MemoryClient.queryByEventTime() or HTTP endpoint)
64
+ const events = await memory.queryByEventTime('2026-01-01T00:00:00Z', '2026-02-01T00:00:00Z');
65
+
66
+ // Filter by event time range in search (EMBEDDED ONLY via filters param)
67
+ await memory.search({
68
+ query: 'address',
69
+ filters: { eventTimeRange: ['2026-01-01', '2026-02-01'] },
70
+ });
71
+ ```
72
+
73
+ ---
74
+
75
+ ## Consolidation Pipeline
76
+
77
+ When `consolidate()` runs, it executes a 7-step pipeline:
78
+
79
+ 1. **Extract facts** — LLM or regex extraction of factual statements
80
+ 2. **Deduplicate** — Content hash + vector similarity (>0.90) → LLM classifies ADD/UPDATE/DELETE/NOOP
81
+ 3. **Resolve conflicts** — Detect contradictions, resolve by recency and source trust
82
+ 4. **Score importance** — LLM rates 1-10 (or heuristic: recency + access count + entity density)
83
+ 5. **Enrich graph** — Extract entities and relationships, merge with existing graph
84
+ 6. **Summarize** — Rolling session summaries, memory compaction
85
+ 7. **Decay** — Archive entries below importance threshold: `importance * 0.995^hours * (1 + 0.02 * min(accessCount, 20)) * eventAgeFactor`
86
+
87
+ All steps have **non-LLM fallbacks** — consolidation works without an LLM, just less intelligently.
88
+
89
+ ---
90
+
91
+ ## Community Detection
92
+
93
+ When a `graphStore` is configured, the system can detect communities of related entities using the Louvain algorithm:
94
+
95
+ ```typescript
96
+ import { CommunityDetector } from '@pyx-memory/core';
97
+
98
+ const detector = new CommunityDetector(graphStore, llm);
99
+ const communities = await detector.detect();
100
+ // Each community: { id, nodeIds, summary? }
101
+ // Summaries are used by hybrid RAG for corpus-level queries
102
+ ```
103
+
104
+ Communities are leveraged by the hybrid RAG strategy to answer broad "what are the themes" queries.
105
+
106
+ ---
107
+
108
+ ## Automatic Behaviors
109
+
110
+ These happen automatically — no configuration needed:
111
+
112
+ - **PII detection**: Every `store()` scans content and sets `metadata.piiDetected` + `metadata.piiTypes` if found
113
+ - **Content hashing**: Every `store()` computes SHA-256 `contentHash`
114
+ - **Access tracking**: Every `search()` increments `accessCount` and updates `lastAccessed` on returned entries
115
+ - **FTS5 sync**: SQLite triggers keep full-text search index in sync with memory_entries
116
+ - **Graph storage**: When `targets` includes `'graph'`, agent-provided `entities` are stored to the graph (best-effort — failures don't block store)
117
+ - **Auto-registration on import**: Importing `@pyx-memory/core` registers StubEmbeddingProvider, LanceDBProvider, and NaiveRAGEngine
118
+ - **Graph/Agentic RAG registration**: Memory constructor auto-registers GraphRAGEngine and AgenticRAGEngine when you pass `graphStore` or `reasoningProvider`
119
+ - **Agent scoping**: If `agentId` is set in MemoryOptions, all operations auto-filter by that agent
120
+
121
+ ---
122
+
123
+ ## Initialization Sequence
124
+
125
+ ```
126
+ 1. (Optional) Create and await graphStore.initialize()
127
+ 2. Construct: new Memory({ graphStore?, llm?, ... }) ← embedding is internal (BGE-M3)
128
+ 3. Await: memory.initialize() ← creates SQLite DB + LanceDB vector store
129
+ 4. Use: store(), search(), etc.
130
+ 5. Cleanup: await memory.shutdown()
131
+ 6. (Optional) await graphStore.shutdown()
132
+ ```
133
+
134
+ **Memory.initialize()** creates:
135
+ - SQLite database at `{dataDir}/memory/memory.db` (with FTS5 + migrations)
136
+ - LanceDB vector store at `{dataDir}/vectors/`
137
+ - Both directories are created automatically (mkdirSync recursive)
138
+
139
+ **Memory does NOT** call `graphStore.initialize()` — you must do this yourself before or after constructing Memory, but before calling `memory.initialize()`.
@@ -0,0 +1,82 @@
1
+ # pyx-memory HTTP API Reference
2
+
3
+ ## Authentication
4
+
5
+ When the server has `API_KEY` configured, all requests (except `/health`) require one of:
6
+
7
+ ```
8
+ Authorization: Bearer <your-api-key>
9
+ X-API-Key: <your-api-key>
10
+ ```
11
+
12
+ Destructive operations (DELETE, forget, decay, consolidate, reindex) require `ADMIN_API_KEY` when configured (falls back to `API_KEY`).
13
+
14
+ `MemoryClient` handles this automatically when `apiKey` is passed to the constructor:
15
+ ```typescript
16
+ const client = new MemoryClient('http://localhost:7822', process.env.MEMORY_API_KEY);
17
+ ```
18
+
19
+ ## Core (10 endpoints)
20
+
21
+ | Method | Endpoint | Description |
22
+ |--------|----------|-------------|
23
+ | GET | `/health` | Public health check (status only — no internals exposed) |
24
+ | GET | `/admin/health` | Admin health check (version, uptime, embedding provider, memory stats) |
25
+ | POST | `/api/memory/ingest` | Store a memory (JSON: `{ content, type, metadata, agentId?, sessionId?, targets?, entities?, relationships?, importance?, source?, eventTime?, id?, parentId?, ingestTime? }`) |
26
+ | POST | `/api/memory/ingest/file` | Upload file (multipart, 50MB limit) |
27
+ | GET | `/api/memory/search?query=...&strategy=...&limit=...` | Search memories — **does NOT support** filters, enableHyDE, enableRerank |
28
+ | GET | `/api/memory/stats` | Memory statistics |
29
+ | GET | `/api/memory/entries?page=...&limit=...` | List entries (paginated) |
30
+ | GET | `/api/memory/entries/:id` | Get entry by ID |
31
+ | DELETE | `/api/memory/entries/:id` | Delete entry |
32
+ | DELETE | `/api/memory/sessions/:sessionId` | Clear session |
33
+
34
+ ## Graph (4 endpoints)
35
+
36
+ | Method | Endpoint | Description |
37
+ |--------|----------|-------------|
38
+ | GET | `/api/memory/graph/nodes?name=...&type=...` | Find graph nodes |
39
+ | GET | `/api/memory/graph/edges` | Graph stats |
40
+ | GET | `/api/memory/graph/relationships` | List relationships |
41
+ | POST | `/api/memory/graph/query` | Traverse (JSON: `{ nodeId, depth? }`) |
42
+
43
+ ## Lifecycle (9 endpoints)
44
+
45
+ | Method | Endpoint | Description |
46
+ |--------|----------|-------------|
47
+ | POST | `/api/memory/consolidate` | Run consolidation pipeline |
48
+ | POST | `/api/memory/forget/:id` | Soft-delete (JSON: `{ reason? }`) |
49
+ | POST | `/api/memory/sessions/:sid/summarize` | Summarize session |
50
+ | POST | `/api/memory/decay` | Run decay pass |
51
+ | POST | `/api/memory/reindex` | Rebuild FTS5 + vector indices |
52
+ | DELETE | `/api/memory/source/:source` | Delete by source |
53
+ | GET | `/api/memory/consolidation-log` | Audit trail |
54
+ | GET | `/api/memory/query-as-of?asOf=...` | Bi-temporal point-in-time query (asOf, type, agentId, source, limit) |
55
+ | GET | `/api/memory/query-by-event-time?startTime=...&endTime=...` | Bi-temporal event time range query (startTime, endTime, type, agentId, source, limit) |
56
+
57
+ ## Response Format
58
+
59
+ All responses follow: `{ success: boolean, data?: T, error?: string }`
60
+
61
+ ---
62
+
63
+ ## Server Environment Variables
64
+
65
+ | Variable | Default | Description |
66
+ |----------|---------|-------------|
67
+ | `MEMORY_SERVER_PORT` | `7822` | HTTP server port |
68
+ | `DATA_DIR` | `./data` | Storage directory |
69
+ | ~~`EMBEDDING_PROVIDER`~~ | — | **Removed** — embedding is now internal (BGE-M3 via LocalEmbeddingProvider) |
70
+ | ~~`EMBEDDING_API_KEY`~~ | — | **Removed** — no external embedding provider needed |
71
+ | ~~`EMBEDDING_MODEL`~~ | — | **Removed** — model is always BGE-M3 (ONNX int8 quantized) |
72
+ | `EMBEDDING_DIMENSIONS` | `1024` | Dimension override for the internal LocalEmbeddingProvider (default: 1024) |
73
+ | `NEO4J_URL` | — | Neo4j bolt URL (enables Neo4j graph store) |
74
+ | `NEO4J_USERNAME` | `neo4j` | Neo4j username |
75
+ | `NEO4J_PASSWORD` | — | Neo4j password (never logged) |
76
+ | `API_KEY` | — | API key for authenticating requests. Unset = open access |
77
+ | `ADMIN_API_KEY` | — | Separate admin key for destructive ops (DELETE, forget, decay, consolidate, reindex). Falls back to `API_KEY` |
78
+ | `CORS_ORIGIN` | `*` | CORS allowed origin. Set to specific domain in production |
79
+ | `MAX_REQUEST_BODY_MB` | `10` | Maximum request body size in MB |
80
+ | `NODE_ENV` | `development` | Set to `production` to mask 5xx error details and enable HSTS |
81
+ | `PII_POLICY` | `flag` | PII handling: `flag` (detect + tag), `redact` (replace with [REDACTED]), `block` (reject 400) |
82
+ | `RATE_LIMIT_RPM` | `0` | Requests per minute per IP. 0 = disabled |
@@ -0,0 +1,63 @@
1
+ # Feature Parity: Embedded vs Sidecar
2
+
3
+ **Most features are available in both modes.** The HTTP API and MemoryClient forward all core `StoreInput` fields. A few advanced search parameters remain embedded-only.
4
+
5
+ ## store() Field Parity
6
+
7
+ | Field | Embedded `Memory.store()` | Sidecar `MemoryClient.store()` |
8
+ |-------|--------------------------|-------------------------------|
9
+ | content | yes | yes |
10
+ | type | yes | yes |
11
+ | metadata | yes | yes |
12
+ | agentId | yes | yes |
13
+ | sessionId | yes | yes |
14
+ | targets | yes | yes |
15
+ | entities | yes | yes |
16
+ | relationships | yes | yes |
17
+ | importance | yes | yes |
18
+ | source | yes | yes |
19
+ | eventTime | yes | yes |
20
+ | id (custom) | yes | yes |
21
+ | parentId | yes | yes |
22
+ | ingestTime | yes | yes |
23
+
24
+ **All StoreInput fields are forwarded.** Full parity.
25
+
26
+ ## search() Param Parity
27
+
28
+ | Param | Embedded `Memory.search()` | Sidecar `MemoryClient.search()` |
29
+ |-------|---------------------------|--------------------------------|
30
+ | query, limit, type, agentId, strategy | yes | yes |
31
+ | eventTimeRange (bi-temporal search) | yes | yes |
32
+ | asOf (point-in-time search) | yes | yes |
33
+ | **filters** (source, importanceMin, parentId, contentType) | yes | **NO** — not forwarded |
34
+ | **enableHyDE** | yes | **NO** — not forwarded |
35
+ | **enableRerank** | yes | **NO** — not forwarded |
36
+
37
+ **Impact**: Sidecar consumers cannot use advanced search filters, HyDE query expansion, or reranking. Temporal search filters (eventTimeRange, asOf) ARE supported.
38
+
39
+ ## Endpoint Coverage by Client
40
+
41
+ | Server Endpoint | MemoryClient | DashboardClient |
42
+ |----------------|-------------|-----------------|
43
+ | All core (9) | yes | yes (inherited) |
44
+ | Graph nodes/edges/query (3) | yes (concrete methods) | yes (inherited) |
45
+ | **Graph relationships** | **NO** | yes (`graphRelationships()`) |
46
+ | All lifecycle (7) | yes | yes (inherited) |
47
+ | **Consolidation log** | **NO** | yes (`consolidationLog()`) |
48
+ | Query as-of (bi-temporal) | yes (`queryAsOf()`) | yes (inherited) |
49
+ | Query by event time | yes (`queryByEventTime()`) | yes (inherited) |
50
+
51
+ ## Security Features (Server-side)
52
+
53
+ | Feature | Configuration |
54
+ |---------|--------------|
55
+ | API key auth | `API_KEY` env var (unset = open access) |
56
+ | Admin key for destructive ops | `ADMIN_API_KEY` env var |
57
+ | Rate limiting | `RATE_LIMIT_RPM` env var (0 = disabled) |
58
+ | CORS | `CORS_ORIGIN` env var (default: `*`) |
59
+ | Security headers | Always on (CSP, X-Frame-Options, nosniff) |
60
+ | HSTS | Auto-enabled when `NODE_ENV=production` |
61
+ | PII policy | `PII_POLICY` env var (`flag` / `redact` / `block`) |
62
+ | Body size limit | `MAX_REQUEST_BODY_MB` env var (default: 10) |
63
+ | Error masking | 5xx details hidden when `NODE_ENV=production` |