@fgv/ts-agent-memory 5.1.0-36

package/lib/packlets/types/writePolicy.d.ts

@@ -0,0 +1,213 @@
+import { Result } from '@fgv/ts-utils';
+import { IMemoryRecord } from './envelope';
+import { MemoryId } from './ids';
+/**
+ * The granularity at which the store deduplicates an incoming write against the
+ * existing vault, declared per kind via {@link IWritePolicy.dedupScope}.
+ *
+ * - `'content'`: scope-wide cross-id content dedup. An identical
+ *   `{ kind, body, links }` triple ANYWHERE in the scope — even under a
+ *   different id — is a no-op that returns the existing record. The knowledge
+ *   kind family uses this.
+ * - `'entity'`: same-id content dedup only. An identical re-put of the SAME
+ *   entity is a no-op, but two DISTINCT entities with identical content never
+ *   collapse. The experience (memory) kind families use this so that, e.g.,
+ *   two turns whose summaries happen to be byte-identical both persist.
+ * @public
+ */
+export type DedupScope = 'content' | 'entity';
+/**
+ * The default {@link DedupScope} applied when a policy does not declare one.
+ * Entity-scoped dedup is the safe default — it never silently collapses two
+ * distinct entities with coincidentally-identical content.
+ * @public
+ */
+export declare const DEFAULT_DEDUP_SCOPE: DedupScope;
+/**
+ * The admission decision returned by {@link IWritePolicy.admit}.
+ * @public
+ */
+export type AdmissionDecision = {
+    readonly decision: 'accept';
+} | {
+    readonly decision: 'reject';
+    readonly reason: string;
+} | {
+    readonly decision: 'cull-oldest';
+    /** {@link MemoryId}s to evict before writing the incoming record. */
+    readonly evict: ReadonlyArray<MemoryId>;
+};
+/**
+ * A per-kind write policy, injected at store construction. Invoked AFTER
+ * content-hash dedup (dedup is always pre-policy). The policy decides
+ * admission and, on update, applies a JSON Merge Patch (RFC-7386) restricted
+ * to the declared mutable fields.
+ * @public
+ */
+export interface IWritePolicy {
+    /**
+     * Names of the fields a merge-patch update may touch. Fields outside this
+     * list are immutable; a change to one constitutes a new entity (its
+     * `contentHash` differs). Used by {@link IWritePolicy.applyUpdate} to
+     * restrict which fields the patch applies.
+     */
+    readonly mutableFields: ReadonlyArray<string>;
+    /**
+     * The granularity at which the store deduplicates an incoming write for this
+     * kind. Optional; when absent the store applies {@link DEFAULT_DEDUP_SCOPE}
+     * (`'entity'`). See {@link DedupScope}.
+     */
+    readonly dedupScope?: DedupScope;
+    /**
+     * Determine whether the incoming record is admitted.
+     * @param incoming - The record about to be written.
+     * @param existing - The admission cohort the kind's cap applies to: the
+     * records in the same scope of the same kind, EXCLUDING the record at
+     * `incoming`'s target id. Empty on a first write into an empty cohort.
+     * Excluding the target id makes the post-write count uniform
+     * (`existing.length + 1`) across first-writes and same-id updates. A
+     * last-write-wins policy that has no cap ignores this argument.
+     * @returns A {@link AdmissionDecision}.
+     */
+    admit(incoming: IMemoryRecord<unknown>, existing: ReadonlyArray<IMemoryRecord<unknown>>): Result<AdmissionDecision>;
+    /**
+     * Apply a JSON Merge Patch (RFC-7386) to the mutable fields of an existing
+     * record. Called when admission is `accept` AND a record with the same
+     * `entityId` already exists (an update, not a first write).
+     *
+     * @param existing - The current persisted record.
+     * @param patch - A partial JSON object in Merge Patch format. `null`
+     * deletes the corresponding key; arrays replace wholesale; nested objects
+     * deep-merge. Only keys in {@link IWritePolicy.mutableFields} are applied.
+     * @returns The updated record (envelope + body).
+     */
+    applyUpdate(existing: IMemoryRecord<unknown>, patch: Record<string, unknown>): Result<IMemoryRecord<unknown>>;
+}
+/**
+ * Last-write-wins write policy for the knowledge kind family. Admission
+ * always accepts (no cap, no cull); updates apply an RFC-7386 merge patch
+ * restricted to the knowledge mutable surface.
+ *
+ * @remarks
+ * **Merge-surface pin (resolves design-lock §5.3's body-vs-envelope muddle).**
+ * The declared `mutableFields` span both axes of a record: `body` is the
+ * per-kind body, while `tags` / `links` / `provenance` / `embeddingRef` live
+ * on the {@link IMemoryEnvelope}. `applyUpdate` projects exactly those fields
+ * — each read from its canonical location — into a single record-level JSON
+ * view, runs the merge over that view, then rebuilds a coherent record. The
+ * identity and transaction-time envelope fields (`id`, `entityId`, `kind`,
+ * `created`, `updated`, `seq`, `contentHash`) are NOT mutable and are
+ * preserved verbatim; the store stamps `updated` / `seq` on write.
+ * @public
+ */
+export declare class KnowledgeLwwPolicy implements IWritePolicy {
+    /**
+     * The knowledge mutable surface: the body plus the envelope metadata a
+     * consumer may revise without minting a new entity.
+     */
+    readonly mutableFields: ReadonlyArray<string>;
+    /**
+     * Knowledge dedups scope-wide: an identical `{ kind, body, links }` triple
+     * anywhere in the `knowledge` scope — even under a different `docId` — is a
+     * no-op. Declared explicitly so the B1 content-dedup behavior (and its tests)
+     * are unchanged by the {@link DedupScope} amendment.
+     */
+    readonly dedupScope: DedupScope;
+    /** Deep-clones the mutable view without RFC-7386 null-deletion semantics. */
+    private readonly _cloneEditor;
+    /** Applies the RFC-7386 merge patch. */
+    private readonly _mergeEditor;
+    private constructor();
+    /**
+     * Family-convention factory. Constructs the shared `JsonEditor` instances
+     * (one for cloning, one for the RFC-7386 merge), both with the template /
+     * conditional / multivalue / reference rules disabled (empty rules array).
+     */
+    static create(): Result<KnowledgeLwwPolicy>;
+    /** {@inheritDoc IWritePolicy.admit} */
+    admit(__incoming: IMemoryRecord<unknown>, __existing: ReadonlyArray<IMemoryRecord<unknown>>): Result<AdmissionDecision>;
+    /** {@inheritDoc IWritePolicy.applyUpdate} */
+    applyUpdate(existing: IMemoryRecord<unknown>, patch: Record<string, unknown>): Result<IMemoryRecord<unknown>>;
+    /**
+     * Reassemble a record from the merged mutable view. `body` / `tags` /
+     * `links` / `provenance` are required and may not be deleted by a patch.
+     * `embeddingRef` is optional: when it is absent from the merged view —
+     * because the existing record never carried it OR a `null` patch deleted it
+     * (RFC-7386) — it is restored as `undefined` (absent), NOT `null`. This keeps
+     * an originally-absent `embeddingRef` from silently flipping to `null` on an
+     * unrelated update, so the field round-trips hash-stably through the store's
+     * content-hash recomputation.
+     */
+    private _rebuild;
+}
+/**
+ * Parameters for {@link MemoryCapCullPolicy.create}.
+ * @public
+ */
+export interface IMemoryCapCullPolicyParams {
+    /**
+     * Maximum number of records the policy admits before culling the oldest.
+     * Counted over the `existing` cohort passed to {@link IWritePolicy.admit}.
+     * Absent = no cap (admission always accepts).
+     */
+    readonly maxRecords?: number;
+    /**
+     * The fields a merge-patch update may touch (drawn from the record-level
+     * mutable vocabulary: `body` / `tags` / `links` / `provenance` /
+     * `embeddingRef`). Fields outside this list are immutable.
+     */
+    readonly mutableFields: ReadonlyArray<string>;
+}
+/**
+ * Bounded-ring write policy for the experience (memory) kind families.
+ * Admission accepts until `maxRecords` is reached, then evicts the oldest
+ * record(s) by `created` ascending (design-lock §5.3); updates apply the same
+ * RFC-7386 merge patch as {@link KnowledgeLwwPolicy}, restricted to the declared
+ * {@link IMemoryCapCullPolicyParams.mutableFields | mutableFields}.
+ *
+ * @remarks
+ * - **Dedup scope.** Declares `dedupScope: 'entity'` — two distinct memory
+ *   entities (e.g. `turn-5` / `turn-9`) with identical `{ kind, body, links }`
+ *   never collapse; only an identical re-put of the SAME entity is a no-op.
+ * - **Eviction boundary.** `admit` only DECIDES (returns the `MemoryId`s to
+ *   evict); the store executes the file deletions and index patches. The
+ *   `existing` cohort the cap counts against is whatever the store supplies to
+ *   `admit`.
+ * @public
+ */
+export declare class MemoryCapCullPolicy implements IWritePolicy {
+    /** {@inheritDoc IWritePolicy.mutableFields} */
+    readonly mutableFields: ReadonlyArray<string>;
+    /** Experience kinds dedup per-entity (see the class remarks). */
+    readonly dedupScope: DedupScope;
+    /** The admission cap; `undefined` = no cap. */
+    private readonly _maxRecords;
+    /** Deep-clones the mutable view without RFC-7386 null-deletion semantics. */
+    private readonly _cloneEditor;
+    /** Applies the RFC-7386 merge patch. */
+    private readonly _mergeEditor;
+    private constructor();
+    /**
+     * Family-convention factory. Constructs the shared `JsonEditor` instances
+     * (one for cloning, one for the RFC-7386 merge) with the same merge config as
+     * {@link KnowledgeLwwPolicy} (`nullAsDelete` true, `arrayMergeBehavior`
+     * `'replace'`, rules disabled).
+     */
+    static create(params: IMemoryCapCullPolicyParams): Result<MemoryCapCullPolicy>;
+    /** {@inheritDoc IWritePolicy.admit} */
+    admit(__incoming: IMemoryRecord<unknown>, existing: ReadonlyArray<IMemoryRecord<unknown>>): Result<AdmissionDecision>;
+    /** {@inheritDoc IWritePolicy.applyUpdate} */
+    applyUpdate(existing: IMemoryRecord<unknown>, patch: Record<string, unknown>): Result<IMemoryRecord<unknown>>;
+    /**
+     * Reassemble a record from the merged mutable view. Only the declared mutable
+     * fields are taken from the merge; undeclared fields are preserved verbatim
+     * from `existing`. A `null` patch that deletes a *declared mutable* required
+     * field (`body` / `tags` / `links` / `provenance`) is an error — a required
+     * field that is NOT declared mutable simply falls through to its `existing.*`
+     * value and is never at risk. `embeddingRef`, when mutable, is restored as
+     * `undefined` (absent) if the merge dropped it — same hash-stable semantics as
+     * {@link KnowledgeLwwPolicy}.
+     */
+    private _rebuild;
+}
+//# sourceMappingURL=writePolicy.d.ts.map

package/lib/packlets/types/writePolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writePolicy.d.ts","sourceRoot":"","sources":["../../../src/packlets/types/writePolicy.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAiB,MAAM,eAAe,CAAC;AAGtD,OAAO,EAA0B,aAAa,EAAe,MAAM,YAAY,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAO,MAAM,OAAO,CAAC;AAEtC;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE9C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,UAAqB,CAAC;AAExD;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxD;IACE,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;CACzC,CAAC;AAEN;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAE9C;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IAEjC;;;;;;;;;;OAUG;IACH,KAAK,CACH,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,EAChC,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,GAC9C,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAE7B;;;;;;;;;;OAUG;IACH,WAAW,CACT,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,EAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;CACnC;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,kBAAmB,YAAW,YAAY;IACrD;;;OAGG;IACH,SAAgB,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAMlD;IAEF;;;;;OAKG;IACH,SAAgB,UAAU,EAAE,UAAU,CAAa;IAEnD,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAa;IAC1C,wCAAwC;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAa;IAE1C,OAAO;IAKP;;;;OAIG;WACW,MAAM,IAAI,MAAM,CAAC,kBAAkB,CAAC;IAQlD,uCAAuC;IAChC,KAAK,CACV,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,EAClC,UAAU,EAAE,aAAa,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,GAChD,MAAM,CAAC,iBAAiB,CAAC;IAK5B,6CAA6C;IACtC,WAAW,CAChB,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,EAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IA+BjC;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ;CAoBjB;AAED;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/C;AA2BD;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,mBAAoB,YAAW,YAAY;IACtD,+CAA+C;IAC/C,SAAgB,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAErD,iEAAiE;IACjE,SAAgB,UAAU,EAAE,UAAU,CAAY;IAElD,+CAA+C;IAC/C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAa;IAC1C,wCAAwC;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAa;IAE1C,OAAO;IAOP;;;;;OAKG;WACW,MAAM,CAAC,MAAM,EAAE,0BAA0B,GAAG,MAAM,CAAC,mBAAmB,CAAC;IAQrF,uCAAuC;IAChC,KAAK,CACV,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,EAClC,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,GAC9C,MAAM,CAAC,iBAAiB,CAAC;IAa5B,6CAA6C;IACtC,WAAW,CAChB,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,EAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAiCjC;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ;CA4BjB"}

package/lib/packlets/types/writePolicy.js

@@ -0,0 +1,268 @@
+"use strict";
+/*
+ * Copyright (c) 2026 Erik Fortune
+ * SPDX-License-Identifier: MIT
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemoryCapCullPolicy = exports.KnowledgeLwwPolicy = exports.DEFAULT_DEDUP_SCOPE = void 0;
+const ts_utils_1 = require("@fgv/ts-utils");
+const ts_json_1 = require("@fgv/ts-json");
+/**
+ * The default {@link DedupScope} applied when a policy does not declare one.
+ * Entity-scoped dedup is the safe default — it never silently collapses two
+ * distinct entities with coincidentally-identical content.
+ * @public
+ */
+exports.DEFAULT_DEDUP_SCOPE = 'entity';
+/**
+ * RFC-7386-compliant merge options for {@link IWritePolicy.applyUpdate}.
+ *
+ * @remarks
+ * Phase-A verification (design-lock §5.1) confirmed `@fgv/ts-json`'s
+ * `JsonEditor` diverges from RFC-7386 under its defaults on two axes —
+ * `nullAsDelete` defaults `false` and `arrayMergeBehavior` defaults
+ * `'append'`. Both are corrected here via the existing option surface, so the
+ * primitive is composed (not extended, not hand-rolled).
+ */
+const MERGE_PATCH_OPTIONS = {
+    merge: {
+        nullAsDelete: true,
+        arrayMergeBehavior: 'replace'
+    }
+};
+/**
+ * Last-write-wins write policy for the knowledge kind family. Admission
+ * always accepts (no cap, no cull); updates apply an RFC-7386 merge patch
+ * restricted to the knowledge mutable surface.
+ *
+ * @remarks
+ * **Merge-surface pin (resolves design-lock §5.3's body-vs-envelope muddle).**
+ * The declared `mutableFields` span both axes of a record: `body` is the
+ * per-kind body, while `tags` / `links` / `provenance` / `embeddingRef` live
+ * on the {@link IMemoryEnvelope}. `applyUpdate` projects exactly those fields
+ * — each read from its canonical location — into a single record-level JSON
+ * view, runs the merge over that view, then rebuilds a coherent record. The
+ * identity and transaction-time envelope fields (`id`, `entityId`, `kind`,
+ * `created`, `updated`, `seq`, `contentHash`) are NOT mutable and are
+ * preserved verbatim; the store stamps `updated` / `seq` on write.
+ * @public
+ */
+class KnowledgeLwwPolicy {
+    constructor(cloneEditor, mergeEditor) {
+        /**
+         * The knowledge mutable surface: the body plus the envelope metadata a
+         * consumer may revise without minting a new entity.
+         */
+        this.mutableFields = [
+            'body',
+            'tags',
+            'links',
+            'provenance',
+            'embeddingRef'
+        ];
+        /**
+         * Knowledge dedups scope-wide: an identical `{ kind, body, links }` triple
+         * anywhere in the `knowledge` scope — even under a different `docId` — is a
+         * no-op. Declared explicitly so the B1 content-dedup behavior (and its tests)
+         * are unchanged by the {@link DedupScope} amendment.
+         */
+        this.dedupScope = 'content';
+        this._cloneEditor = cloneEditor;
+        this._mergeEditor = mergeEditor;
+    }
+    /**
+     * Family-convention factory. Constructs the shared `JsonEditor` instances
+     * (one for cloning, one for the RFC-7386 merge), both with the template /
+     * conditional / multivalue / reference rules disabled (empty rules array).
+     */
+    static create() {
+        return ts_json_1.JsonEditor.create({}, []).onSuccess((cloneEditor) => ts_json_1.JsonEditor.create(MERGE_PATCH_OPTIONS, []).onSuccess((mergeEditor) => (0, ts_utils_1.succeed)(new KnowledgeLwwPolicy(cloneEditor, mergeEditor))));
+    }
+    /** {@inheritDoc IWritePolicy.admit} */
+    admit(__incoming, __existing) {
+        // Last-write-wins: always accept. No cap, no cull.
+        return (0, ts_utils_1.succeed)({ decision: 'accept' });
+    }
+    /** {@inheritDoc IWritePolicy.applyUpdate} */
+    applyUpdate(existing, patch) {
+        // Project the mutable fields into a single record-level view, each sourced
+        // from its canonical location. `embeddingRef` is omitted when `undefined`
+        // (the editor rejects undefined property values).
+        const view = {
+            body: existing.body,
+            tags: existing.envelope.tags,
+            links: existing.envelope.links,
+            provenance: existing.envelope.provenance
+        };
+        if (existing.envelope.embeddingRef !== undefined) {
+            view.embeddingRef = existing.envelope.embeddingRef;
+        }
+        // Restrict the incoming patch to the declared mutable fields; out-of-scope
+        // keys are never applied (the store enforces the same constraint).
+        const scopedPatch = {};
+        for (const field of this.mutableFields) {
+            if (field in patch) {
+                scopedPatch[field] = patch[field];
+            }
+        }
+        // Clone the view (no null-deletion), then apply the RFC-7386 merge patch
+        // onto the clone so the persisted record is never mutated in place.
+        return this._cloneEditor
+            .mergeObjectInPlace({}, view)
+            .onSuccess((clone) => this._mergeEditor.mergeObjectInPlace(clone, scopedPatch))
+            .onSuccess((merged) => this._rebuild(existing, merged));
+    }
+    /**
+     * Reassemble a record from the merged mutable view. `body` / `tags` /
+     * `links` / `provenance` are required and may not be deleted by a patch.
+     * `embeddingRef` is optional: when it is absent from the merged view —
+     * because the existing record never carried it OR a `null` patch deleted it
+     * (RFC-7386) — it is restored as `undefined` (absent), NOT `null`. This keeps
+     * an originally-absent `embeddingRef` from silently flipping to `null` on an
+     * unrelated update, so the field round-trips hash-stably through the store's
+     * content-hash recomputation.
+     */
+    _rebuild(existing, merged) {
+        const required = ['body', 'tags', 'links', 'provenance'];
+        const missing = required.filter((field) => !(field in merged));
+        if (missing.length > 0) {
+            return (0, ts_utils_1.fail)(`knowledge LWW: merge patch may not delete required field(s): ${missing.join(', ')}`);
+        }
+        // The merged values are JSON projections of the already-validated typed
+        // record; restore the domain types. (The types packlet cannot import the
+        // converters packlet without a cycle, so these are structural restorations
+        // of fields the merge preserved, not fresh untrusted input.)
+        const envelope = Object.assign(Object.assign({}, existing.envelope), { tags: merged.tags, links: merged.links, provenance: merged.provenance, embeddingRef: 'embeddingRef' in merged ? merged.embeddingRef : undefined });
+        return (0, ts_utils_1.succeed)({ envelope, body: merged.body });
+    }
+}
+exports.KnowledgeLwwPolicy = KnowledgeLwwPolicy;
+/**
+ * The record-level fields a {@link MemoryCapCullPolicy} merge-patch may project,
+ * mapped to their canonical location on a record. Mirrors the store's
+ * mutable-field accessor vocabulary; a declared mutable field outside this set
+ * is inert (the store cannot project it either).
+ */
+const CAP_CULL_FIELD_READERS = new Map([
+    ['body', (r) => r.body],
+    ['tags', (r) => r.envelope.tags],
+    ['links', (r) => r.envelope.links],
+    ['provenance', (r) => r.envelope.provenance],
+    ['embeddingRef', (r) => r.envelope.embeddingRef]
+]);
+/** The record-level mutable fields that may never be deleted by a merge patch. */
+const CAP_CULL_REQUIRED_FIELDS = new Set([
+    'body',
+    'tags',
+    'links',
+    'provenance'
+]);
+/**
+ * Bounded-ring write policy for the experience (memory) kind families.
+ * Admission accepts until `maxRecords` is reached, then evicts the oldest
+ * record(s) by `created` ascending (design-lock §5.3); updates apply the same
+ * RFC-7386 merge patch as {@link KnowledgeLwwPolicy}, restricted to the declared
+ * {@link IMemoryCapCullPolicyParams.mutableFields | mutableFields}.
+ *
+ * @remarks
+ * - **Dedup scope.** Declares `dedupScope: 'entity'` — two distinct memory
+ *   entities (e.g. `turn-5` / `turn-9`) with identical `{ kind, body, links }`
+ *   never collapse; only an identical re-put of the SAME entity is a no-op.
+ * - **Eviction boundary.** `admit` only DECIDES (returns the `MemoryId`s to
+ *   evict); the store executes the file deletions and index patches. The
+ *   `existing` cohort the cap counts against is whatever the store supplies to
+ *   `admit`.
+ * @public
+ */
+class MemoryCapCullPolicy {
+    constructor(params, cloneEditor, mergeEditor) {
+        /** Experience kinds dedup per-entity (see the class remarks). */
+        this.dedupScope = 'entity';
+        this.mutableFields = params.mutableFields;
+        this._maxRecords = params.maxRecords;
+        this._cloneEditor = cloneEditor;
+        this._mergeEditor = mergeEditor;
+    }
+    /**
+     * Family-convention factory. Constructs the shared `JsonEditor` instances
+     * (one for cloning, one for the RFC-7386 merge) with the same merge config as
+     * {@link KnowledgeLwwPolicy} (`nullAsDelete` true, `arrayMergeBehavior`
+     * `'replace'`, rules disabled).
+     */
+    static create(params) {
+        return ts_json_1.JsonEditor.create({}, []).onSuccess((cloneEditor) => ts_json_1.JsonEditor.create(MERGE_PATCH_OPTIONS, []).onSuccess((mergeEditor) => (0, ts_utils_1.succeed)(new MemoryCapCullPolicy(params, cloneEditor, mergeEditor))));
+    }
+    /** {@inheritDoc IWritePolicy.admit} */
+    admit(__incoming, existing) {
+        if (this._maxRecords === undefined || existing.length < this._maxRecords) {
+            return (0, ts_utils_1.succeed)({ decision: 'accept' });
+        }
+        // Cap reached: evict the oldest by `created` ascending so the post-write
+        // count is exactly `maxRecords` (existing.length - maxRecords + 1 victims).
+        const evict = [...existing]
+            .sort((a, b) => a.envelope.created - b.envelope.created)
+            .slice(0, existing.length - this._maxRecords + 1)
+            .map((record) => record.envelope.id);
+        return (0, ts_utils_1.succeed)({ decision: 'cull-oldest', evict });
+    }
+    /** {@inheritDoc IWritePolicy.applyUpdate} */
+    applyUpdate(existing, patch) {
+        // Project the declared mutable fields (restricted to the known record-level
+        // vocabulary) into a single record-level view from their canonical
+        // locations. An `undefined` value is omitted (the editor rejects undefined
+        // property values).
+        const view = {};
+        for (const field of this.mutableFields) {
+            const reader = CAP_CULL_FIELD_READERS.get(field);
+            if (reader !== undefined) {
+                const value = reader(existing);
+                if (value !== undefined) {
+                    view[field] = value;
+                }
+            }
+        }
+        // Restrict the incoming patch to the declared mutable fields.
+        const scopedPatch = {};
+        for (const field of this.mutableFields) {
+            if (field in patch) {
+                scopedPatch[field] = patch[field];
+            }
+        }
+        // Clone the view (no null-deletion), then apply the RFC-7386 merge patch
+        // onto the clone so the persisted record is never mutated in place.
+        return this._cloneEditor
+            .mergeObjectInPlace({}, view)
+            .onSuccess((clone) => this._mergeEditor.mergeObjectInPlace(clone, scopedPatch))
+            .onSuccess((merged) => this._rebuild(existing, merged));
+    }
+    /**
+     * Reassemble a record from the merged mutable view. Only the declared mutable
+     * fields are taken from the merge; undeclared fields are preserved verbatim
+     * from `existing`. A `null` patch that deletes a *declared mutable* required
+     * field (`body` / `tags` / `links` / `provenance`) is an error — a required
+     * field that is NOT declared mutable simply falls through to its `existing.*`
+     * value and is never at risk. `embeddingRef`, when mutable, is restored as
+     * `undefined` (absent) if the merge dropped it — same hash-stable semantics as
+     * {@link KnowledgeLwwPolicy}.
+     */
+    _rebuild(existing, merged) {
+        const deleted = this.mutableFields.filter((field) => CAP_CULL_REQUIRED_FIELDS.has(field) && !(field in merged));
+        if (deleted.length > 0) {
+            return (0, ts_utils_1.fail)(`memory cap-cull: merge patch may not delete required field(s): ${deleted.join(', ')}`);
+        }
+        // The merged values are JSON projections of the already-validated typed
+        // record; restore the domain types. (The types packlet cannot import the
+        // converters packlet without a cycle, so these are structural restorations
+        // of fields the merge preserved, not fresh untrusted input — mirrors
+        // KnowledgeLwwPolicy._rebuild.)
+        const embeddingRefMutable = this.mutableFields.includes('embeddingRef');
+        const envelope = Object.assign(Object.assign({}, existing.envelope), { tags: 'tags' in merged ? merged.tags : existing.envelope.tags, links: 'links' in merged ? merged.links : existing.envelope.links, provenance: 'provenance' in merged ? merged.provenance : existing.envelope.provenance, embeddingRef: embeddingRefMutable
+                ? 'embeddingRef' in merged
+                    ? merged.embeddingRef
+                    : undefined
+                : existing.envelope.embeddingRef });
+        return (0, ts_utils_1.succeed)({ envelope, body: 'body' in merged ? merged.body : existing.body });
+    }
+}
+exports.MemoryCapCullPolicy = MemoryCapCullPolicy;
+//# sourceMappingURL=writePolicy.js.map

package/lib/packlets/types/writePolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writePolicy.js","sourceRoot":"","sources":["../../../src/packlets/types/writePolicy.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,4CAAsD;AAEtD,0CAA8D;AAoB9D;;;;;GAKG;AACU,QAAA,mBAAmB,GAAe,QAAQ,CAAC;AAuExD;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAgC;IACvD,KAAK,EAAE;QACL,YAAY,EAAE,IAAI;QAClB,kBAAkB,EAAE,SAAS;KAC9B;CACF,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAa,kBAAkB;IA0B7B,YAAoB,WAAuB,EAAE,WAAuB;QAzBpE;;;WAGG;QACa,kBAAa,GAA0B;YACrD,MAAM;YACN,MAAM;YACN,OAAO;YACP,YAAY;YACZ,cAAc;SACf,CAAC;QAEF;;;;;WAKG;QACa,eAAU,GAAe,SAAS,CAAC;QAQjD,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,MAAM;QAClB,OAAO,oBAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CACzD,oBAAU,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CACnE,IAAA,kBAAO,EAAC,IAAI,kBAAkB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAC1D,CACF,CAAC;IACJ,CAAC;IAED,uCAAuC;IAChC,KAAK,CACV,UAAkC,EAClC,UAAiD;QAEjD,mDAAmD;QACnD,OAAO,IAAA,kBAAO,EAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,6CAA6C;IACtC,WAAW,CAChB,QAAgC,EAChC,KAA8B;QAE9B,2EAA2E;QAC3E,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,IAAI,GAA4B;YACpC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;YAC5B,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK;YAC9B,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;SACzC,CAAC;QACF,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACjD,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QACrD,CAAC;QAED,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;gBACnB,WAAW,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,oEAAoE;QACpE,OAAO,IAAI,CAAC,YAAY;aACrB,kBAAkB,CAAC,EAAE,EAAE,IAAkB,CAAC;aAC1C,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,KAAK,EAAE,WAAyB,CAAC,CAAC;aAC5F,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;OASG;IACK,QAAQ,CAAC,QAAgC,EAAE,MAAkB;QACnE,MAAM,QAAQ,GAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAChF,MAAM,OAAO,GAA0B,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC;QACtF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,IAAA,eAAI,EAAC,gEAAgE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,6DAA6D;QAC7D,MAAM,QAAQ,mCACT,QAAQ,CAAC,QAAQ,KACpB,IAAI,EAAE,MAAM,CAAC,IAAqC,EAClD,KAAK,EAAE,MAAM,CAAC,KAAwC,EACtD,UAAU,EAAE,MAAM,CAAC,UAAoC,EACvD,YAAY,EAAE,cAAc,IAAI,MAAM,CAAC,CAAC,CAAE,MAAM,CAAC,YAA8B,CAAC,CAAC,CAAC,SAAS,GAC5F,CAAC;QACF,OAAO,IAAA,kBAAO,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;CACF;AAtHD,gDAsHC;AAqBD;;;;;GAKG;AACH,MAAM,sBAAsB,GAAqE,IAAI,GAAG,CAGtG;IACA,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvB,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAChC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IAClC,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5C,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;CACjD,CAAC,CAAC;AAEH,kFAAkF;AAClF,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAS;IACpE,MAAM;IACN,MAAM;IACN,OAAO;IACP,YAAY;CACb,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAa,mBAAmB;IAc9B,YAAoB,MAAkC,EAAE,WAAuB,EAAE,WAAuB;QAVxG,iEAAiE;QACjD,eAAU,GAAe,QAAQ,CAAC;QAUhD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,MAAM,CAAC,MAAkC;QACrD,OAAO,oBAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CACzD,oBAAU,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CACnE,IAAA,kBAAO,EAAC,IAAI,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CACnE,CACF,CAAC;IACJ,CAAC;IAED,uCAAuC;IAChC,KAAK,CACV,UAAkC,EAClC,QAA+C;QAE/C,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACzE,OAAO,IAAA,kBAAO,EAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,yEAAyE;QACzE,4EAA4E;QAC5E,MAAM,KAAK,GAA4B,CAAC,GAAG,QAAQ,CAAC;aACjD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;aACvD,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;aAChD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvC,OAAO,IAAA,kBAAO,EAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,6CAA6C;IACtC,WAAW,CAChB,QAAgC,EAChC,KAA8B;QAE9B,4EAA4E;QAC5E,mEAAmE;QACnE,2EAA2E;QAC3E,oBAAoB;QACpB,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,MAAM,MAAM,GACV,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAY,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;QAED,8DAA8D;QAC9D,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;gBACnB,WAAW,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,oEAAoE;QACpE,OAAO,IAAI,CAAC,YAAY;aACrB,kBAAkB,CAAC,EAAE,EAAE,IAAkB,CAAC;aAC1C,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,KAAK,EAAE,WAAyB,CAAC,CAAC;aAC5F,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;OASG;IACK,QAAQ,CAAC,QAAgC,EAAE,MAAkB;QACnE,MAAM,OAAO,GAA0B,IAAI,CAAC,aAAa,CAAC,MAAM,CAC9D,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,CACrE,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,IAAA,eAAI,EAAC,kEAAkE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,qEAAqE;QACrE,gCAAgC;QAChC,MAAM,mBAAmB,GAAY,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACjF,MAAM,QAAQ,mCACT,QAAQ,CAAC,QAAQ,KACpB,IAAI,EAAE,MAAM,IAAI,MAAM,CAAC,CAAC,CAAE,MAAM,CAAC,IAAsC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAChG,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAE,MAAM,CAAC,KAAyC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EACtG,UAAU,EACR,YAAY,IAAI,MAAM,CAAC,CAAC,CAAE,MAAM,CAAC,UAAqC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,EACvG,YAAY,EAAE,mBAAmB;gBAC/B,CAAC,CAAC,cAAc,IAAI,MAAM;oBACxB,CAAC,CAAE,MAAM,CAAC,YAA8B;oBACxC,CAAC,CAAC,SAAS;gBACb,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,GACnC,CAAC;QACF,OAAO,IAAA,kBAAO,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACrF,CAAC;CACF;AA/HD,kDA+HC","sourcesContent":["/*\n * Copyright (c) 2026 Erik Fortune\n * SPDX-License-Identifier: MIT\n */\n\nimport { Result, fail, succeed } from '@fgv/ts-utils';\nimport { JsonObject } from '@fgv/ts-json-base';\nimport { IJsonEditorOptions, JsonEditor } from '@fgv/ts-json';\nimport { IEdge, IMemoryEnvelope, IMemoryRecord, IProvenance } from './envelope';\nimport { MemoryId, Tag } from './ids';\n\n/**\n * The granularity at which the store deduplicates an incoming write against the\n * existing vault, declared per kind via {@link IWritePolicy.dedupScope}.\n *\n * - `'content'`: scope-wide cross-id content dedup. An identical\n *   `{ kind, body, links }` triple ANYWHERE in the scope — even under a\n *   different id — is a no-op that returns the existing record. The knowledge\n *   kind family uses this.\n * - `'entity'`: same-id content dedup only. An identical re-put of the SAME\n *   entity is a no-op, but two DISTINCT entities with identical content never\n *   collapse. The experience (memory) kind families use this so that, e.g.,\n *   two turns whose summaries happen to be byte-identical both persist.\n * @public\n */\nexport type DedupScope = 'content' | 'entity';\n\n/**\n * The default {@link DedupScope} applied when a policy does not declare one.\n * Entity-scoped dedup is the safe default — it never silently collapses two\n * distinct entities with coincidentally-identical content.\n * @public\n */\nexport const DEFAULT_DEDUP_SCOPE: DedupScope = 'entity';\n\n/**\n * The admission decision returned by {@link IWritePolicy.admit}.\n * @public\n */\nexport type AdmissionDecision =\n  | { readonly decision: 'accept' }\n  | { readonly decision: 'reject'; readonly reason: string }\n  | {\n      readonly decision: 'cull-oldest';\n      /** {@link MemoryId}s to evict before writing the incoming record. */\n      readonly evict: ReadonlyArray<MemoryId>;\n    };\n\n/**\n * A per-kind write policy, injected at store construction. Invoked AFTER\n * content-hash dedup (dedup is always pre-policy). The policy decides\n * admission and, on update, applies a JSON Merge Patch (RFC-7386) restricted\n * to the declared mutable fields.\n * @public\n */\nexport interface IWritePolicy {\n  /**\n   * Names of the fields a merge-patch update may touch. Fields outside this\n   * list are immutable; a change to one constitutes a new entity (its\n   * `contentHash` differs). Used by {@link IWritePolicy.applyUpdate} to\n   * restrict which fields the patch applies.\n   */\n  readonly mutableFields: ReadonlyArray<string>;\n\n  /**\n   * The granularity at which the store deduplicates an incoming write for this\n   * kind. Optional; when absent the store applies {@link DEFAULT_DEDUP_SCOPE}\n   * (`'entity'`). See {@link DedupScope}.\n   */\n  readonly dedupScope?: DedupScope;\n\n  /**\n   * Determine whether the incoming record is admitted.\n   * @param incoming - The record about to be written.\n   * @param existing - The admission cohort the kind's cap applies to: the\n   * records in the same scope of the same kind, EXCLUDING the record at\n   * `incoming`'s target id. Empty on a first write into an empty cohort.\n   * Excluding the target id makes the post-write count uniform\n   * (`existing.length + 1`) across first-writes and same-id updates. A\n   * last-write-wins policy that has no cap ignores this argument.\n   * @returns A {@link AdmissionDecision}.\n   */\n  admit(\n    incoming: IMemoryRecord<unknown>,\n    existing: ReadonlyArray<IMemoryRecord<unknown>>\n  ): Result<AdmissionDecision>;\n\n  /**\n   * Apply a JSON Merge Patch (RFC-7386) to the mutable fields of an existing\n   * record. Called when admission is `accept` AND a record with the same\n   * `entityId` already exists (an update, not a first write).\n   *\n   * @param existing - The current persisted record.\n   * @param patch - A partial JSON object in Merge Patch format. `null`\n   * deletes the corresponding key; arrays replace wholesale; nested objects\n   * deep-merge. Only keys in {@link IWritePolicy.mutableFields} are applied.\n   * @returns The updated record (envelope + body).\n   */\n  applyUpdate(\n    existing: IMemoryRecord<unknown>,\n    patch: Record<string, unknown>\n  ): Result<IMemoryRecord<unknown>>;\n}\n\n/**\n * RFC-7386-compliant merge options for {@link IWritePolicy.applyUpdate}.\n *\n * @remarks\n * Phase-A verification (design-lock §5.1) confirmed `@fgv/ts-json`'s\n * `JsonEditor` diverges from RFC-7386 under its defaults on two axes —\n * `nullAsDelete` defaults `false` and `arrayMergeBehavior` defaults\n * `'append'`. Both are corrected here via the existing option surface, so the\n * primitive is composed (not extended, not hand-rolled).\n */\nconst MERGE_PATCH_OPTIONS: Partial<IJsonEditorOptions> = {\n  merge: {\n    nullAsDelete: true,\n    arrayMergeBehavior: 'replace'\n  }\n};\n\n/**\n * Last-write-wins write policy for the knowledge kind family. Admission\n * always accepts (no cap, no cull); updates apply an RFC-7386 merge patch\n * restricted to the knowledge mutable surface.\n *\n * @remarks\n * **Merge-surface pin (resolves design-lock §5.3's body-vs-envelope muddle).**\n * The declared `mutableFields` span both axes of a record: `body` is the\n * per-kind body, while `tags` / `links` / `provenance` / `embeddingRef` live\n * on the {@link IMemoryEnvelope}. `applyUpdate` projects exactly those fields\n * — each read from its canonical location — into a single record-level JSON\n * view, runs the merge over that view, then rebuilds a coherent record. The\n * identity and transaction-time envelope fields (`id`, `entityId`, `kind`,\n * `created`, `updated`, `seq`, `contentHash`) are NOT mutable and are\n * preserved verbatim; the store stamps `updated` / `seq` on write.\n * @public\n */\nexport class KnowledgeLwwPolicy implements IWritePolicy {\n  /**\n   * The knowledge mutable surface: the body plus the envelope metadata a\n   * consumer may revise without minting a new entity.\n   */\n  public readonly mutableFields: ReadonlyArray<string> = [\n    'body',\n    'tags',\n    'links',\n    'provenance',\n    'embeddingRef'\n  ];\n\n  /**\n   * Knowledge dedups scope-wide: an identical `{ kind, body, links }` triple\n   * anywhere in the `knowledge` scope — even under a different `docId` — is a\n   * no-op. Declared explicitly so the B1 content-dedup behavior (and its tests)\n   * are unchanged by the {@link DedupScope} amendment.\n   */\n  public readonly dedupScope: DedupScope = 'content';\n\n  /** Deep-clones the mutable view without RFC-7386 null-deletion semantics. */\n  private readonly _cloneEditor: JsonEditor;\n  /** Applies the RFC-7386 merge patch. */\n  private readonly _mergeEditor: JsonEditor;\n\n  private constructor(cloneEditor: JsonEditor, mergeEditor: JsonEditor) {\n    this._cloneEditor = cloneEditor;\n    this._mergeEditor = mergeEditor;\n  }\n\n  /**\n   * Family-convention factory. Constructs the shared `JsonEditor` instances\n   * (one for cloning, one for the RFC-7386 merge), both with the template /\n   * conditional / multivalue / reference rules disabled (empty rules array).\n   */\n  public static create(): Result<KnowledgeLwwPolicy> {\n    return JsonEditor.create({}, []).onSuccess((cloneEditor) =>\n      JsonEditor.create(MERGE_PATCH_OPTIONS, []).onSuccess((mergeEditor) =>\n        succeed(new KnowledgeLwwPolicy(cloneEditor, mergeEditor))\n      )\n    );\n  }\n\n  /** {@inheritDoc IWritePolicy.admit} */\n  public admit(\n    __incoming: IMemoryRecord<unknown>,\n    __existing: ReadonlyArray<IMemoryRecord<unknown>>\n  ): Result<AdmissionDecision> {\n    // Last-write-wins: always accept. No cap, no cull.\n    return succeed({ decision: 'accept' });\n  }\n\n  /** {@inheritDoc IWritePolicy.applyUpdate} */\n  public applyUpdate(\n    existing: IMemoryRecord<unknown>,\n    patch: Record<string, unknown>\n  ): Result<IMemoryRecord<unknown>> {\n    // Project the mutable fields into a single record-level view, each sourced\n    // from its canonical location. `embeddingRef` is omitted when `undefined`\n    // (the editor rejects undefined property values).\n    const view: Record<string, unknown> = {\n      body: existing.body,\n      tags: existing.envelope.tags,\n      links: existing.envelope.links,\n      provenance: existing.envelope.provenance\n    };\n    if (existing.envelope.embeddingRef !== undefined) {\n      view.embeddingRef = existing.envelope.embeddingRef;\n    }\n\n    // Restrict the incoming patch to the declared mutable fields; out-of-scope\n    // keys are never applied (the store enforces the same constraint).\n    const scopedPatch: Record<string, unknown> = {};\n    for (const field of this.mutableFields) {\n      if (field in patch) {\n        scopedPatch[field] = patch[field];\n      }\n    }\n\n    // Clone the view (no null-deletion), then apply the RFC-7386 merge patch\n    // onto the clone so the persisted record is never mutated in place.\n    return this._cloneEditor\n      .mergeObjectInPlace({}, view as JsonObject)\n      .onSuccess((clone) => this._mergeEditor.mergeObjectInPlace(clone, scopedPatch as JsonObject))\n      .onSuccess((merged) => this._rebuild(existing, merged));\n  }\n\n  /**\n   * Reassemble a record from the merged mutable view. `body` / `tags` /\n   * `links` / `provenance` are required and may not be deleted by a patch.\n   * `embeddingRef` is optional: when it is absent from the merged view —\n   * because the existing record never carried it OR a `null` patch deleted it\n   * (RFC-7386) — it is restored as `undefined` (absent), NOT `null`. This keeps\n   * an originally-absent `embeddingRef` from silently flipping to `null` on an\n   * unrelated update, so the field round-trips hash-stably through the store's\n   * content-hash recomputation.\n   */\n  private _rebuild(existing: IMemoryRecord<unknown>, merged: JsonObject): Result<IMemoryRecord<unknown>> {\n    const required: ReadonlyArray<string> = ['body', 'tags', 'links', 'provenance'];\n    const missing: ReadonlyArray<string> = required.filter((field) => !(field in merged));\n    if (missing.length > 0) {\n      return fail(`knowledge LWW: merge patch may not delete required field(s): ${missing.join(', ')}`);\n    }\n\n    // The merged values are JSON projections of the already-validated typed\n    // record; restore the domain types. (The types packlet cannot import the\n    // converters packlet without a cycle, so these are structural restorations\n    // of fields the merge preserved, not fresh untrusted input.)\n    const envelope: IMemoryEnvelope = {\n      ...existing.envelope,\n      tags: merged.tags as unknown as ReadonlyArray<Tag>,\n      links: merged.links as unknown as ReadonlyArray<IEdge>,\n      provenance: merged.provenance as unknown as IProvenance,\n      embeddingRef: 'embeddingRef' in merged ? (merged.embeddingRef as string | null) : undefined\n    };\n    return succeed({ envelope, body: merged.body });\n  }\n}\n\n/**\n * Parameters for {@link MemoryCapCullPolicy.create}.\n * @public\n */\nexport interface IMemoryCapCullPolicyParams {\n  /**\n   * Maximum number of records the policy admits before culling the oldest.\n   * Counted over the `existing` cohort passed to {@link IWritePolicy.admit}.\n   * Absent = no cap (admission always accepts).\n   */\n  readonly maxRecords?: number;\n  /**\n   * The fields a merge-patch update may touch (drawn from the record-level\n   * mutable vocabulary: `body` / `tags` / `links` / `provenance` /\n   * `embeddingRef`). Fields outside this list are immutable.\n   */\n  readonly mutableFields: ReadonlyArray<string>;\n}\n\n/**\n * The record-level fields a {@link MemoryCapCullPolicy} merge-patch may project,\n * mapped to their canonical location on a record. Mirrors the store's\n * mutable-field accessor vocabulary; a declared mutable field outside this set\n * is inert (the store cannot project it either).\n */\nconst CAP_CULL_FIELD_READERS: ReadonlyMap<string, (record: IMemoryRecord<unknown>) => unknown> = new Map<\n  string,\n  (record: IMemoryRecord<unknown>) => unknown\n>([\n  ['body', (r) => r.body],\n  ['tags', (r) => r.envelope.tags],\n  ['links', (r) => r.envelope.links],\n  ['provenance', (r) => r.envelope.provenance],\n  ['embeddingRef', (r) => r.envelope.embeddingRef]\n]);\n\n/** The record-level mutable fields that may never be deleted by a merge patch. */\nconst CAP_CULL_REQUIRED_FIELDS: ReadonlySet<string> = new Set<string>([\n  'body',\n  'tags',\n  'links',\n  'provenance'\n]);\n\n/**\n * Bounded-ring write policy for the experience (memory) kind families.\n * Admission accepts until `maxRecords` is reached, then evicts the oldest\n * record(s) by `created` ascending (design-lock §5.3); updates apply the same\n * RFC-7386 merge patch as {@link KnowledgeLwwPolicy}, restricted to the declared\n * {@link IMemoryCapCullPolicyParams.mutableFields | mutableFields}.\n *\n * @remarks\n * - **Dedup scope.** Declares `dedupScope: 'entity'` — two distinct memory\n *   entities (e.g. `turn-5` / `turn-9`) with identical `{ kind, body, links }`\n *   never collapse; only an identical re-put of the SAME entity is a no-op.\n * - **Eviction boundary.** `admit` only DECIDES (returns the `MemoryId`s to\n *   evict); the store executes the file deletions and index patches. The\n *   `existing` cohort the cap counts against is whatever the store supplies to\n *   `admit`.\n * @public\n */\nexport class MemoryCapCullPolicy implements IWritePolicy {\n  /** {@inheritDoc IWritePolicy.mutableFields} */\n  public readonly mutableFields: ReadonlyArray<string>;\n\n  /** Experience kinds dedup per-entity (see the class remarks). */\n  public readonly dedupScope: DedupScope = 'entity';\n\n  /** The admission cap; `undefined` = no cap. */\n  private readonly _maxRecords: number | undefined;\n  /** Deep-clones the mutable view without RFC-7386 null-deletion semantics. */\n  private readonly _cloneEditor: JsonEditor;\n  /** Applies the RFC-7386 merge patch. */\n  private readonly _mergeEditor: JsonEditor;\n\n  private constructor(params: IMemoryCapCullPolicyParams, cloneEditor: JsonEditor, mergeEditor: JsonEditor) {\n    this.mutableFields = params.mutableFields;\n    this._maxRecords = params.maxRecords;\n    this._cloneEditor = cloneEditor;\n    this._mergeEditor = mergeEditor;\n  }\n\n  /**\n   * Family-convention factory. Constructs the shared `JsonEditor` instances\n   * (one for cloning, one for the RFC-7386 merge) with the same merge config as\n   * {@link KnowledgeLwwPolicy} (`nullAsDelete` true, `arrayMergeBehavior`\n   * `'replace'`, rules disabled).\n   */\n  public static create(params: IMemoryCapCullPolicyParams): Result<MemoryCapCullPolicy> {\n    return JsonEditor.create({}, []).onSuccess((cloneEditor) =>\n      JsonEditor.create(MERGE_PATCH_OPTIONS, []).onSuccess((mergeEditor) =>\n        succeed(new MemoryCapCullPolicy(params, cloneEditor, mergeEditor))\n      )\n    );\n  }\n\n  /** {@inheritDoc IWritePolicy.admit} */\n  public admit(\n    __incoming: IMemoryRecord<unknown>,\n    existing: ReadonlyArray<IMemoryRecord<unknown>>\n  ): Result<AdmissionDecision> {\n    if (this._maxRecords === undefined || existing.length < this._maxRecords) {\n      return succeed({ decision: 'accept' });\n    }\n    // Cap reached: evict the oldest by `created` ascending so the post-write\n    // count is exactly `maxRecords` (existing.length - maxRecords + 1 victims).\n    const evict: ReadonlyArray<MemoryId> = [...existing]\n      .sort((a, b) => a.envelope.created - b.envelope.created)\n      .slice(0, existing.length - this._maxRecords + 1)\n      .map((record) => record.envelope.id);\n    return succeed({ decision: 'cull-oldest', evict });\n  }\n\n  /** {@inheritDoc IWritePolicy.applyUpdate} */\n  public applyUpdate(\n    existing: IMemoryRecord<unknown>,\n    patch: Record<string, unknown>\n  ): Result<IMemoryRecord<unknown>> {\n    // Project the declared mutable fields (restricted to the known record-level\n    // vocabulary) into a single record-level view from their canonical\n    // locations. An `undefined` value is omitted (the editor rejects undefined\n    // property values).\n    const view: Record<string, unknown> = {};\n    for (const field of this.mutableFields) {\n      const reader: ((record: IMemoryRecord<unknown>) => unknown) | undefined =\n        CAP_CULL_FIELD_READERS.get(field);\n      if (reader !== undefined) {\n        const value: unknown = reader(existing);\n        if (value !== undefined) {\n          view[field] = value;\n        }\n      }\n    }\n\n    // Restrict the incoming patch to the declared mutable fields.\n    const scopedPatch: Record<string, unknown> = {};\n    for (const field of this.mutableFields) {\n      if (field in patch) {\n        scopedPatch[field] = patch[field];\n      }\n    }\n\n    // Clone the view (no null-deletion), then apply the RFC-7386 merge patch\n    // onto the clone so the persisted record is never mutated in place.\n    return this._cloneEditor\n      .mergeObjectInPlace({}, view as JsonObject)\n      .onSuccess((clone) => this._mergeEditor.mergeObjectInPlace(clone, scopedPatch as JsonObject))\n      .onSuccess((merged) => this._rebuild(existing, merged));\n  }\n\n  /**\n   * Reassemble a record from the merged mutable view. Only the declared mutable\n   * fields are taken from the merge; undeclared fields are preserved verbatim\n   * from `existing`. A `null` patch that deletes a *declared mutable* required\n   * field (`body` / `tags` / `links` / `provenance`) is an error — a required\n   * field that is NOT declared mutable simply falls through to its `existing.*`\n   * value and is never at risk. `embeddingRef`, when mutable, is restored as\n   * `undefined` (absent) if the merge dropped it — same hash-stable semantics as\n   * {@link KnowledgeLwwPolicy}.\n   */\n  private _rebuild(existing: IMemoryRecord<unknown>, merged: JsonObject): Result<IMemoryRecord<unknown>> {\n    const deleted: ReadonlyArray<string> = this.mutableFields.filter(\n      (field) => CAP_CULL_REQUIRED_FIELDS.has(field) && !(field in merged)\n    );\n    if (deleted.length > 0) {\n      return fail(`memory cap-cull: merge patch may not delete required field(s): ${deleted.join(', ')}`);\n    }\n\n    // The merged values are JSON projections of the already-validated typed\n    // record; restore the domain types. (The types packlet cannot import the\n    // converters packlet without a cycle, so these are structural restorations\n    // of fields the merge preserved, not fresh untrusted input — mirrors\n    // KnowledgeLwwPolicy._rebuild.)\n    const embeddingRefMutable: boolean = this.mutableFields.includes('embeddingRef');\n    const envelope: IMemoryEnvelope = {\n      ...existing.envelope,\n      tags: 'tags' in merged ? (merged.tags as unknown as ReadonlyArray<Tag>) : existing.envelope.tags,\n      links: 'links' in merged ? (merged.links as unknown as ReadonlyArray<IEdge>) : existing.envelope.links,\n      provenance:\n        'provenance' in merged ? (merged.provenance as unknown as IProvenance) : existing.envelope.provenance,\n      embeddingRef: embeddingRefMutable\n        ? 'embeddingRef' in merged\n          ? (merged.embeddingRef as string | null)\n          : undefined\n        : existing.envelope.embeddingRef\n    };\n    return succeed({ envelope, body: 'body' in merged ? merged.body : existing.body });\n  }\n}\n"]}

package/lib/packlets/vector/inMemoryCosineIndex.d.ts

@@ -0,0 +1,69 @@
+import { Result } from '@fgv/ts-utils';
+import { MemoryId } from '../types';
+import { IMemoryRecordSource, IVectorIndex, IVectorQueryHit, MemoryEmbedder } from './vectorIndex';
+/**
+ * The brute-force, in-memory cosine {@link IVectorIndex}. Stores one
+ * `Float32Array` per record and answers a query by computing cosine similarity
+ * against every stored vector, returning the top-k by descending score.
+ *
+ * @remarks
+ * This is the **complete** vector implementation for the fgv regime — large-N is
+ * explicitly out of scope (the seam stays open for a consumer to swap an external
+ * ANN backend once N grows beyond "thousands of records"). No external dependency
+ * and no ANN structure: a linear scan over a few thousand vectors is well within
+ * an interactive budget.
+ *
+ * The index has a single dimension established by the first vector added; every
+ * subsequent `add` and every `query` vector must match that dimension or fail
+ * loudly — a mismatched dimension is an embedder-wiring bug, never a silent
+ * zero-similarity result. {@link InMemoryCosineIndex.rebuild | rebuild} clears
+ * the index, so a re-embed with a different model (hence dimension) is supported.
+ *
+ * Persistence (a JSON sidecar) is deliberately out of scope for this layer — the
+ * index is in-memory and rebuilt from the store via `rebuild`; a sidecar is a
+ * future nicety.
+ * @public
+ */
+export declare class InMemoryCosineIndex implements IVectorIndex {
+    private readonly _vectors;
+    /** The dimension of every stored vector; `undefined` until the first `add`. */
+    private _dimension;
+    private constructor();
+    /** The number of vectors currently held. */
+    get size(): number;
+    /** Family-convention factory. */
+    static create(): Result<InMemoryCosineIndex>;
+    /** {@inheritDoc IVectorIndex.add} */
+    add(id: MemoryId, vector: Float32Array): Promise<Result<string>>;
+    /** {@inheritDoc IVectorIndex.remove} */
+    remove(id: MemoryId): Promise<Result<MemoryId>>;
+    /** {@inheritDoc IVectorIndex.query} */
+    query(vector: Float32Array, topK: number): Promise<Result<ReadonlyArray<IVectorQueryHit>>>;
+    /**
+     * Re-embed every record from `source` and rebuild the index from scratch.
+     * Clears the current contents (and the established dimension) first, so a
+     * re-embed with a different model is supported. Returns the number of vectors
+     * indexed.
+     *
+     * On any failure (list, embed, or add) the index is rolled back to empty
+     * rather than left in a partially-rebuilt state — a caller that retries a query
+     * after a failed rebuild sees a clean empty index, never a half-populated one.
+     *
+     * @param source - The record source to re-embed (an {@link IMemoryStore}
+     * satisfies this structurally).
+     * @param embed - The embedder applied to each record.
+     */
+    rebuild(source: IMemoryRecordSource, embed: MemoryEmbedder): Promise<Result<number>>;
+    /** Empty the index and forget the established dimension. */
+    private _reset;
+    /** The Euclidean magnitude (L2 norm) of a vector. */
+    private static _magnitude;
+    /**
+     * Cosine similarity between the query (whose magnitude is precomputed once and
+     * reused across the scan) and a stored vector. A zero-magnitude vector on
+     * either side yields `0` rather than `NaN` — a degenerate vector is simply
+     * maximally dissimilar, not an error.
+     */
+    private static _cosine;
+}
+//# sourceMappingURL=inMemoryCosineIndex.d.ts.map

package/lib/packlets/vector/inMemoryCosineIndex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inMemoryCosineIndex.d.ts","sourceRoot":"","sources":["../../../src/packlets/vector/inMemoryCosineIndex.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAiB,MAAM,eAAe,CAAC;AACtD,OAAO,EAAiB,QAAQ,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,mBAAoB,YAAW,YAAY;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8B;IACvD,+EAA+E;IAC/E,OAAO,CAAC,UAAU,CAAqB;IAEvC,OAAO;IAKP,4CAA4C;IAC5C,IAAW,IAAI,IAAI,MAAM,CAExB;IAED,iCAAiC;WACnB,MAAM,IAAI,MAAM,CAAC,mBAAmB,CAAC;IAInD,qCAAqC;IAC9B,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAoBvE,wCAAwC;IACjC,MAAM,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAKtD,uCAAuC;IAChC,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;IAsBjG;;;;;;;;;;;;;OAaG;IACU,OAAO,CAAC,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAwBjG,4DAA4D;IAC5D,OAAO,CAAC,MAAM;IAKd,qDAAqD;IACrD,OAAO,CAAC,MAAM,CAAC,UAAU;IAQzB;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,OAAO;CAWvB"}