@fgv/ts-agent-memory 5.1.0-37 → 5.1.0-39

package/lib/packlets/types/writePolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"writePolicy.js","sourceRoot":"","sources":["../../../src/packlets/types/writePolicy.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,4CAAsD;AAEtD,0CAA8D;AAoB9D;;;;;GAKG;AACU,QAAA,mBAAmB,GAAe,QAAQ,CAAC;AAuExD;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAgC;IACvD,KAAK,EAAE;QACL,YAAY,EAAE,IAAI;QAClB,kBAAkB,EAAE,SAAS;KAC9B;CACF,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAa,kBAAkB;IA0B7B,YAAoB,WAAuB,EAAE,WAAuB;QAzBpE;;;WAGG;QACa,kBAAa,GAA0B;YACrD,MAAM;YACN,MAAM;YACN,OAAO;YACP,YAAY;YACZ,cAAc;SACf,CAAC;QAEF;;;;;WAKG;QACa,eAAU,GAAe,SAAS,CAAC;QAQjD,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,MAAM;QAClB,OAAO,oBAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CACzD,oBAAU,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CACnE,IAAA,kBAAO,EAAC,IAAI,kBAAkB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAC1D,CACF,CAAC;IACJ,CAAC;IAED,uCAAuC;IAChC,KAAK,CACV,UAAkC,EAClC,UAAiD;QAEjD,mDAAmD;QACnD,OAAO,IAAA,kBAAO,EAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,6CAA6C;IACtC,WAAW,CAChB,QAAgC,EAChC,KAA8B;QAE9B,2EAA2E;QAC3E,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,IAAI,GAA4B;YACpC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;YAC5B,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK;YAC9B,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;SACzC,CAAC;QACF,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACjD,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QACrD,CAAC;QAED,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;gBACnB,WAAW,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,oEAAoE;QACpE,OAAO,IAAI,CAAC,YAAY;aACrB,kBAAkB,CAAC,EAAE,EAAE,IAAkB,CAAC;aAC1C,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,KAAK,EAAE,WAAyB,CAAC,CAAC;aAC5F,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;OASG;IACK,QAAQ,CAAC,QAAgC,EAAE,MAAkB;QACnE,MAAM,QAAQ,GAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAChF,MAAM,OAAO,GAA0B,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC;QACtF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,IAAA,eAAI,EAAC,gEAAgE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,6DAA6D;QAC7D,MAAM,QAAQ,mCACT,QAAQ,CAAC,QAAQ,KACpB,IAAI,EAAE,MAAM,CAAC,IAAqC,EAClD,KAAK,EAAE,MAAM,CAAC,KAAwC,EACtD,UAAU,EAAE,MAAM,CAAC,UAAoC,EACvD,YAAY,EAAE,cAAc,IAAI,MAAM,CAAC,CAAC,CAAE,MAAM,CAAC,YAA8B,CAAC,CAAC,CAAC,SAAS,GAC5F,CAAC;QACF,OAAO,IAAA,kBAAO,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;CACF;AAtHD,gDAsHC;AAqBD;;;;;GAKG;AACH,MAAM,sBAAsB,GAAqE,IAAI,GAAG,CAGtG;IACA,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvB,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAChC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IAClC,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5C,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;CACjD,CAAC,CAAC;AAEH,kFAAkF;AAClF,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAS;IACpE,MAAM;IACN,MAAM;IACN,OAAO;IACP,YAAY;CACb,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAa,mBAAmB;IAc9B,YAAoB,MAAkC,EAAE,WAAuB,EAAE,WAAuB;QAVxG,iEAAiE;QACjD,eAAU,GAAe,QAAQ,CAAC;QAUhD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,MAAM,CAAC,MAAkC;QACrD,OAAO,oBAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CACzD,oBAAU,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CACnE,IAAA,kBAAO,EAAC,IAAI,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CACnE,CACF,CAAC;IACJ,CAAC;IAED,uCAAuC;IAChC,KAAK,CACV,UAAkC,EAClC,QAA+C;QAE/C,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACzE,OAAO,IAAA,kBAAO,EAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,yEAAyE;QACzE,4EAA4E;QAC5E,MAAM,KAAK,GAA4B,CAAC,GAAG,QAAQ,CAAC;aACjD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;aACvD,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;aAChD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvC,OAAO,IAAA,kBAAO,EAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,6CAA6C;IACtC,WAAW,CAChB,QAAgC,EAChC,KAA8B;QAE9B,4EAA4E;QAC5E,mEAAmE;QACnE,2EAA2E;QAC3E,oBAAoB;QACpB,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,MAAM,MAAM,GACV,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAY,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;QAED,8DAA8D;QAC9D,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;gBACnB,WAAW,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,oEAAoE;QACpE,OAAO,IAAI,CAAC,YAAY;aACrB,kBAAkB,CAAC,EAAE,EAAE,IAAkB,CAAC;aAC1C,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,KAAK,EAAE,WAAyB,CAAC,CAAC;aAC5F,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;OASG;IACK,QAAQ,CAAC,QAAgC,EAAE,MAAkB;QACnE,MAAM,OAAO,GAA0B,IAAI,CAAC,aAAa,CAAC,MAAM,CAC9D,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,CACrE,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,IAAA,eAAI,EAAC,kEAAkE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,qEAAqE;QACrE,gCAAgC;QAChC,MAAM,mBAAmB,GAAY,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACjF,MAAM,QAAQ,mCACT,QAAQ,CAAC,QAAQ,KACpB,IAAI,EAAE,MAAM,IAAI,MAAM,CAAC,CAAC,CAAE,MAAM,CAAC,IAAsC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAChG,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAE,MAAM,CAAC,KAAyC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EACtG,UAAU,EACR,YAAY,IAAI,MAAM,CAAC,CAAC,CAAE,MAAM,CAAC,UAAqC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,EACvG,YAAY,EAAE,mBAAmB;gBAC/B,CAAC,CAAC,cAAc,IAAI,MAAM;oBACxB,CAAC,CAAE,MAAM,CAAC,YAA8B;oBACxC,CAAC,CAAC,SAAS;gBACb,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,GACnC,CAAC;QACF,OAAO,IAAA,kBAAO,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACrF,CAAC;CACF;AA/HD,kDA+HC","sourcesContent":["/*\n * Copyright (c) 2026 Erik Fortune\n * SPDX-License-Identifier: MIT\n */\n\nimport { Result, fail, succeed } from '@fgv/ts-utils';\nimport { JsonObject } from '@fgv/ts-json-base';\nimport { IJsonEditorOptions, JsonEditor } from '@fgv/ts-json';\nimport { IEdge, IMemoryEnvelope, IMemoryRecord, IProvenance } from './envelope';\nimport { MemoryId, Tag } from './ids';\n\n/**\n * The granularity at which the store deduplicates an incoming write against the\n * existing vault, declared per kind via {@link IWritePolicy.dedupScope}.\n *\n * - `'content'`: scope-wide cross-id content dedup. An identical\n *   `{ kind, body, links }` triple ANYWHERE in the scope — even under a\n *   different id — is a no-op that returns the existing record. The knowledge\n *   kind family uses this.\n * - `'entity'`: same-id content dedup only. An identical re-put of the SAME\n *   entity is a no-op, but two DISTINCT entities with identical content never\n *   collapse. The experience (memory) kind families use this so that, e.g.,\n *   two turns whose summaries happen to be byte-identical both persist.\n * @public\n */\nexport type DedupScope = 'content' | 'entity';\n\n/**\n * The default {@link DedupScope} applied when a policy does not declare one.\n * Entity-scoped dedup is the safe default — it never silently collapses two\n * distinct entities with coincidentally-identical content.\n * @public\n */\nexport const DEFAULT_DEDUP_SCOPE: DedupScope = 'entity';\n\n/**\n * The admission decision returned by {@link IWritePolicy.admit}.\n * @public\n */\nexport type AdmissionDecision =\n  | { readonly decision: 'accept' }\n  | { readonly decision: 'reject'; readonly reason: string }\n  | {\n      readonly decision: 'cull-oldest';\n      /** {@link MemoryId}s to evict before writing the incoming record. */\n      readonly evict: ReadonlyArray<MemoryId>;\n    };\n\n/**\n * A per-kind write policy, injected at store construction. Invoked AFTER\n * content-hash dedup (dedup is always pre-policy). The policy decides\n * admission and, on update, applies a JSON Merge Patch (RFC-7386) restricted\n * to the declared mutable fields.\n * @public\n */\nexport interface IWritePolicy {\n  /**\n   * Names of the fields a merge-patch update may touch. Fields outside this\n   * list are immutable; a change to one constitutes a new entity (its\n   * `contentHash` differs). Used by {@link IWritePolicy.applyUpdate} to\n   * restrict which fields the patch applies.\n   */\n  readonly mutableFields: ReadonlyArray<string>;\n\n  /**\n   * The granularity at which the store deduplicates an incoming write for this\n   * kind. Optional; when absent the store applies {@link DEFAULT_DEDUP_SCOPE}\n   * (`'entity'`). See {@link DedupScope}.\n   */\n  readonly dedupScope?: DedupScope;\n\n  /**\n   * Determine whether the incoming record is admitted.\n   * @param incoming - The record about to be written.\n   * @param existing - The admission cohort the kind's cap applies to: the\n   * records in the same scope of the same kind, EXCLUDING the record at\n   * `incoming`'s target id. Empty on a first write into an empty cohort.\n   * Excluding the target id makes the post-write count uniform\n   * (`existing.length + 1`) across first-writes and same-id updates. A\n   * last-write-wins policy that has no cap ignores this argument.\n   * @returns A {@link AdmissionDecision}.\n   */\n  admit(\n    incoming: IMemoryRecord<unknown>,\n    existing: ReadonlyArray<IMemoryRecord<unknown>>\n  ): Result<AdmissionDecision>;\n\n  /**\n   * Apply a JSON Merge Patch (RFC-7386) to the mutable fields of an existing\n   * record. Called when admission is `accept` AND a record with the same\n   * `entityId` already exists (an update, not a first write).\n   *\n   * @param existing - The current persisted record.\n   * @param patch - A partial JSON object in Merge Patch format. `null`\n   * deletes the corresponding key; arrays replace wholesale; nested objects\n   * deep-merge. Only keys in {@link IWritePolicy.mutableFields} are applied.\n   * @returns The updated record (envelope + body).\n   */\n  applyUpdate(\n    existing: IMemoryRecord<unknown>,\n    patch: Record<string, unknown>\n  ): Result<IMemoryRecord<unknown>>;\n}\n\n/**\n * RFC-7386-compliant merge options for {@link IWritePolicy.applyUpdate}.\n *\n * @remarks\n * Phase-A verification (design-lock §5.1) confirmed `@fgv/ts-json`'s\n * `JsonEditor` diverges from RFC-7386 under its defaults on two axes —\n * `nullAsDelete` defaults `false` and `arrayMergeBehavior` defaults\n * `'append'`. Both are corrected here via the existing option surface, so the\n * primitive is composed (not extended, not hand-rolled).\n */\nconst MERGE_PATCH_OPTIONS: Partial<IJsonEditorOptions> = {\n  merge: {\n    nullAsDelete: true,\n    arrayMergeBehavior: 'replace'\n  }\n};\n\n/**\n * Last-write-wins write policy for the knowledge kind family. Admission\n * always accepts (no cap, no cull); updates apply an RFC-7386 merge patch\n * restricted to the knowledge mutable surface.\n *\n * @remarks\n * **Merge-surface pin (resolves design-lock §5.3's body-vs-envelope muddle).**\n * The declared `mutableFields` span both axes of a record: `body` is the\n * per-kind body, while `tags` / `links` / `provenance` / `embeddingRef` live\n * on the {@link IMemoryEnvelope}. `applyUpdate` projects exactly those fields\n * — each read from its canonical location — into a single record-level JSON\n * view, runs the merge over that view, then rebuilds a coherent record. The\n * identity and transaction-time envelope fields (`id`, `entityId`, `kind`,\n * `created`, `updated`, `seq`, `contentHash`) are NOT mutable and are\n * preserved verbatim; the store stamps `updated` / `seq` on write.\n * @public\n */\nexport class KnowledgeLwwPolicy implements IWritePolicy {\n  /**\n   * The knowledge mutable surface: the body plus the envelope metadata a\n   * consumer may revise without minting a new entity.\n   */\n  public readonly mutableFields: ReadonlyArray<string> = [\n    'body',\n    'tags',\n    'links',\n    'provenance',\n    'embeddingRef'\n  ];\n\n  /**\n   * Knowledge dedups scope-wide: an identical `{ kind, body, links }` triple\n   * anywhere in the `knowledge` scope — even under a different `docId` — is a\n   * no-op. Declared explicitly so the B1 content-dedup behavior (and its tests)\n   * are unchanged by the {@link DedupScope} amendment.\n   */\n  public readonly dedupScope: DedupScope = 'content';\n\n  /** Deep-clones the mutable view without RFC-7386 null-deletion semantics. */\n  private readonly _cloneEditor: JsonEditor;\n  /** Applies the RFC-7386 merge patch. */\n  private readonly _mergeEditor: JsonEditor;\n\n  private constructor(cloneEditor: JsonEditor, mergeEditor: JsonEditor) {\n    this._cloneEditor = cloneEditor;\n    this._mergeEditor = mergeEditor;\n  }\n\n  /**\n   * Family-convention factory. Constructs the shared `JsonEditor` instances\n   * (one for cloning, one for the RFC-7386 merge), both with the template /\n   * conditional / multivalue / reference rules disabled (empty rules array).\n   */\n  public static create(): Result<KnowledgeLwwPolicy> {\n    return JsonEditor.create({}, []).onSuccess((cloneEditor) =>\n      JsonEditor.create(MERGE_PATCH_OPTIONS, []).onSuccess((mergeEditor) =>\n        succeed(new KnowledgeLwwPolicy(cloneEditor, mergeEditor))\n      )\n    );\n  }\n\n  /** {@inheritDoc IWritePolicy.admit} */\n  public admit(\n    __incoming: IMemoryRecord<unknown>,\n    __existing: ReadonlyArray<IMemoryRecord<unknown>>\n  ): Result<AdmissionDecision> {\n    // Last-write-wins: always accept. No cap, no cull.\n    return succeed({ decision: 'accept' });\n  }\n\n  /** {@inheritDoc IWritePolicy.applyUpdate} */\n  public applyUpdate(\n    existing: IMemoryRecord<unknown>,\n    patch: Record<string, unknown>\n  ): Result<IMemoryRecord<unknown>> {\n    // Project the mutable fields into a single record-level view, each sourced\n    // from its canonical location. `embeddingRef` is omitted when `undefined`\n    // (the editor rejects undefined property values).\n    const view: Record<string, unknown> = {\n      body: existing.body,\n      tags: existing.envelope.tags,\n      links: existing.envelope.links,\n      provenance: existing.envelope.provenance\n    };\n    if (existing.envelope.embeddingRef !== undefined) {\n      view.embeddingRef = existing.envelope.embeddingRef;\n    }\n\n    // Restrict the incoming patch to the declared mutable fields; out-of-scope\n    // keys are never applied (the store enforces the same constraint).\n    const scopedPatch: Record<string, unknown> = {};\n    for (const field of this.mutableFields) {\n      if (field in patch) {\n        scopedPatch[field] = patch[field];\n      }\n    }\n\n    // Clone the view (no null-deletion), then apply the RFC-7386 merge patch\n    // onto the clone so the persisted record is never mutated in place.\n    return this._cloneEditor\n      .mergeObjectInPlace({}, view as JsonObject)\n      .onSuccess((clone) => this._mergeEditor.mergeObjectInPlace(clone, scopedPatch as JsonObject))\n      .onSuccess((merged) => this._rebuild(existing, merged));\n  }\n\n  /**\n   * Reassemble a record from the merged mutable view. `body` / `tags` /\n   * `links` / `provenance` are required and may not be deleted by a patch.\n   * `embeddingRef` is optional: when it is absent from the merged view —\n   * because the existing record never carried it OR a `null` patch deleted it\n   * (RFC-7386) — it is restored as `undefined` (absent), NOT `null`. This keeps\n   * an originally-absent `embeddingRef` from silently flipping to `null` on an\n   * unrelated update, so the field round-trips hash-stably through the store's\n   * content-hash recomputation.\n   */\n  private _rebuild(existing: IMemoryRecord<unknown>, merged: JsonObject): Result<IMemoryRecord<unknown>> {\n    const required: ReadonlyArray<string> = ['body', 'tags', 'links', 'provenance'];\n    const missing: ReadonlyArray<string> = required.filter((field) => !(field in merged));\n    if (missing.length > 0) {\n      return fail(`knowledge LWW: merge patch may not delete required field(s): ${missing.join(', ')}`);\n    }\n\n    // The merged values are JSON projections of the already-validated typed\n    // record; restore the domain types. (The types packlet cannot import the\n    // converters packlet without a cycle, so these are structural restorations\n    // of fields the merge preserved, not fresh untrusted input.)\n    const envelope: IMemoryEnvelope = {\n      ...existing.envelope,\n      tags: merged.tags as unknown as ReadonlyArray<Tag>,\n      links: merged.links as unknown as ReadonlyArray<IEdge>,\n      provenance: merged.provenance as unknown as IProvenance,\n      embeddingRef: 'embeddingRef' in merged ? (merged.embeddingRef as string | null) : undefined\n    };\n    return succeed({ envelope, body: merged.body });\n  }\n}\n\n/**\n * Parameters for {@link MemoryCapCullPolicy.create}.\n * @public\n */\nexport interface IMemoryCapCullPolicyParams {\n  /**\n   * Maximum number of records the policy admits before culling the oldest.\n   * Counted over the `existing` cohort passed to {@link IWritePolicy.admit}.\n   * Absent = no cap (admission always accepts).\n   */\n  readonly maxRecords?: number;\n  /**\n   * The fields a merge-patch update may touch (drawn from the record-level\n   * mutable vocabulary: `body` / `tags` / `links` / `provenance` /\n   * `embeddingRef`). Fields outside this list are immutable.\n   */\n  readonly mutableFields: ReadonlyArray<string>;\n}\n\n/**\n * The record-level fields a {@link MemoryCapCullPolicy} merge-patch may project,\n * mapped to their canonical location on a record. Mirrors the store's\n * mutable-field accessor vocabulary; a declared mutable field outside this set\n * is inert (the store cannot project it either).\n */\nconst CAP_CULL_FIELD_READERS: ReadonlyMap<string, (record: IMemoryRecord<unknown>) => unknown> = new Map<\n  string,\n  (record: IMemoryRecord<unknown>) => unknown\n>([\n  ['body', (r) => r.body],\n  ['tags', (r) => r.envelope.tags],\n  ['links', (r) => r.envelope.links],\n  ['provenance', (r) => r.envelope.provenance],\n  ['embeddingRef', (r) => r.envelope.embeddingRef]\n]);\n\n/** The record-level mutable fields that may never be deleted by a merge patch. */\nconst CAP_CULL_REQUIRED_FIELDS: ReadonlySet<string> = new Set<string>([\n  'body',\n  'tags',\n  'links',\n  'provenance'\n]);\n\n/**\n * Bounded-ring write policy for the experience (memory) kind families.\n * Admission accepts until `maxRecords` is reached, then evicts the oldest\n * record(s) by `created` ascending (design-lock §5.3); updates apply the same\n * RFC-7386 merge patch as {@link KnowledgeLwwPolicy}, restricted to the declared\n * {@link IMemoryCapCullPolicyParams.mutableFields | mutableFields}.\n *\n * @remarks\n * - **Dedup scope.** Declares `dedupScope: 'entity'` — two distinct memory\n *   entities (e.g. `turn-5` / `turn-9`) with identical `{ kind, body, links }`\n *   never collapse; only an identical re-put of the SAME entity is a no-op.\n * - **Eviction boundary.** `admit` only DECIDES (returns the `MemoryId`s to\n *   evict); the store executes the file deletions and index patches. The\n *   `existing` cohort the cap counts against is whatever the store supplies to\n *   `admit`.\n * @public\n */\nexport class MemoryCapCullPolicy implements IWritePolicy {\n  /** {@inheritDoc IWritePolicy.mutableFields} */\n  public readonly mutableFields: ReadonlyArray<string>;\n\n  /** Experience kinds dedup per-entity (see the class remarks). */\n  public readonly dedupScope: DedupScope = 'entity';\n\n  /** The admission cap; `undefined` = no cap. */\n  private readonly _maxRecords: number | undefined;\n  /** Deep-clones the mutable view without RFC-7386 null-deletion semantics. */\n  private readonly _cloneEditor: JsonEditor;\n  /** Applies the RFC-7386 merge patch. */\n  private readonly _mergeEditor: JsonEditor;\n\n  private constructor(params: IMemoryCapCullPolicyParams, cloneEditor: JsonEditor, mergeEditor: JsonEditor) {\n    this.mutableFields = params.mutableFields;\n    this._maxRecords = params.maxRecords;\n    this._cloneEditor = cloneEditor;\n    this._mergeEditor = mergeEditor;\n  }\n\n  /**\n   * Family-convention factory. Constructs the shared `JsonEditor` instances\n   * (one for cloning, one for the RFC-7386 merge) with the same merge config as\n   * {@link KnowledgeLwwPolicy} (`nullAsDelete` true, `arrayMergeBehavior`\n   * `'replace'`, rules disabled).\n   */\n  public static create(params: IMemoryCapCullPolicyParams): Result<MemoryCapCullPolicy> {\n    return JsonEditor.create({}, []).onSuccess((cloneEditor) =>\n      JsonEditor.create(MERGE_PATCH_OPTIONS, []).onSuccess((mergeEditor) =>\n        succeed(new MemoryCapCullPolicy(params, cloneEditor, mergeEditor))\n      )\n    );\n  }\n\n  /** {@inheritDoc IWritePolicy.admit} */\n  public admit(\n    __incoming: IMemoryRecord<unknown>,\n    existing: ReadonlyArray<IMemoryRecord<unknown>>\n  ): Result<AdmissionDecision> {\n    if (this._maxRecords === undefined || existing.length < this._maxRecords) {\n      return succeed({ decision: 'accept' });\n    }\n    // Cap reached: evict the oldest by `created` ascending so the post-write\n    // count is exactly `maxRecords` (existing.length - maxRecords + 1 victims).\n    const evict: ReadonlyArray<MemoryId> = [...existing]\n      .sort((a, b) => a.envelope.created - b.envelope.created)\n      .slice(0, existing.length - this._maxRecords + 1)\n      .map((record) => record.envelope.id);\n    return succeed({ decision: 'cull-oldest', evict });\n  }\n\n  /** {@inheritDoc IWritePolicy.applyUpdate} */\n  public applyUpdate(\n    existing: IMemoryRecord<unknown>,\n    patch: Record<string, unknown>\n  ): Result<IMemoryRecord<unknown>> {\n    // Project the declared mutable fields (restricted to the known record-level\n    // vocabulary) into a single record-level view from their canonical\n    // locations. An `undefined` value is omitted (the editor rejects undefined\n    // property values).\n    const view: Record<string, unknown> = {};\n    for (const field of this.mutableFields) {\n      const reader: ((record: IMemoryRecord<unknown>) => unknown) | undefined =\n        CAP_CULL_FIELD_READERS.get(field);\n      if (reader !== undefined) {\n        const value: unknown = reader(existing);\n        if (value !== undefined) {\n          view[field] = value;\n        }\n      }\n    }\n\n    // Restrict the incoming patch to the declared mutable fields.\n    const scopedPatch: Record<string, unknown> = {};\n    for (const field of this.mutableFields) {\n      if (field in patch) {\n        scopedPatch[field] = patch[field];\n      }\n    }\n\n    // Clone the view (no null-deletion), then apply the RFC-7386 merge patch\n    // onto the clone so the persisted record is never mutated in place.\n    return this._cloneEditor\n      .mergeObjectInPlace({}, view as JsonObject)\n      .onSuccess((clone) => this._mergeEditor.mergeObjectInPlace(clone, scopedPatch as JsonObject))\n      .onSuccess((merged) => this._rebuild(existing, merged));\n  }\n\n  /**\n   * Reassemble a record from the merged mutable view. Only the declared mutable\n   * fields are taken from the merge; undeclared fields are preserved verbatim\n   * from `existing`. A `null` patch that deletes a *declared mutable* required\n   * field (`body` / `tags` / `links` / `provenance`) is an error — a required\n   * field that is NOT declared mutable simply falls through to its `existing.*`\n   * value and is never at risk. `embeddingRef`, when mutable, is restored as\n   * `undefined` (absent) if the merge dropped it — same hash-stable semantics as\n   * {@link KnowledgeLwwPolicy}.\n   */\n  private _rebuild(existing: IMemoryRecord<unknown>, merged: JsonObject): Result<IMemoryRecord<unknown>> {\n    const deleted: ReadonlyArray<string> = this.mutableFields.filter(\n      (field) => CAP_CULL_REQUIRED_FIELDS.has(field) && !(field in merged)\n    );\n    if (deleted.length > 0) {\n      return fail(`memory cap-cull: merge patch may not delete required field(s): ${deleted.join(', ')}`);\n    }\n\n    // The merged values are JSON projections of the already-validated typed\n    // record; restore the domain types. (The types packlet cannot import the\n    // converters packlet without a cycle, so these are structural restorations\n    // of fields the merge preserved, not fresh untrusted input — mirrors\n    // KnowledgeLwwPolicy._rebuild.)\n    const embeddingRefMutable: boolean = this.mutableFields.includes('embeddingRef');\n    const envelope: IMemoryEnvelope = {\n      ...existing.envelope,\n      tags: 'tags' in merged ? (merged.tags as unknown as ReadonlyArray<Tag>) : existing.envelope.tags,\n      links: 'links' in merged ? (merged.links as unknown as ReadonlyArray<IEdge>) : existing.envelope.links,\n      provenance:\n        'provenance' in merged ? (merged.provenance as unknown as IProvenance) : existing.envelope.provenance,\n      embeddingRef: embeddingRefMutable\n        ? 'embeddingRef' in merged\n          ? (merged.embeddingRef as string | null)\n          : undefined\n        : existing.envelope.embeddingRef\n    };\n    return succeed({ envelope, body: 'body' in merged ? merged.body : existing.body });\n  }\n}\n"]}
+{"version":3,"file":"writePolicy.js","sourceRoot":"","sources":["../../../src/packlets/types/writePolicy.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,4CAAsD;AAEtD,0CAA8D;AAoB9D;;;;;GAKG;AACU,QAAA,mBAAmB,GAAe,QAAQ,CAAC;AAuExD;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAgC;IACvD,KAAK,EAAE;QACL,YAAY,EAAE,IAAI;QAClB,kBAAkB,EAAE,SAAS;KAC9B;CACF,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAa,kBAAkB;IA0B7B,YAAoB,WAAuB,EAAE,WAAuB;QAzBpE;;;WAGG;QACa,kBAAa,GAA0B;YACrD,MAAM;YACN,MAAM;YACN,OAAO;YACP,YAAY;YACZ,cAAc;SACf,CAAC;QAEF;;;;;WAKG;QACa,eAAU,GAAe,SAAS,CAAC;QAQjD,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,MAAM;QAClB,OAAO,oBAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CACzD,oBAAU,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CACnE,IAAA,kBAAO,EAAC,IAAI,kBAAkB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAC1D,CACF,CAAC;IACJ,CAAC;IAED,uCAAuC;IAChC,KAAK,CACV,UAAkC,EAClC,UAAiD;QAEjD,mDAAmD;QACnD,OAAO,IAAA,kBAAO,EAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,6CAA6C;IACtC,WAAW,CAChB,QAAgC,EAChC,KAA8B;QAE9B,2EAA2E;QAC3E,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,IAAI,GAA4B;YACpC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;YAC5B,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK;YAC9B,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;SACzC,CAAC;QACF,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACjD,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QACrD,CAAC;QAED,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;gBACnB,WAAW,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,oEAAoE;QACpE,OAAO,IAAI,CAAC,YAAY;aACrB,kBAAkB,CAAC,EAAE,EAAE,IAAkB,CAAC;aAC1C,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,KAAK,EAAE,WAAyB,CAAC,CAAC;aAC5F,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;OASG;IACK,QAAQ,CAAC,QAAgC,EAAE,MAAkB;QACnE,MAAM,QAAQ,GAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAChF,MAAM,OAAO,GAA0B,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC;QACtF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,IAAA,eAAI,EAAC,gEAAgE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,6DAA6D;QAC7D,MAAM,QAAQ,mCACT,QAAQ,CAAC,QAAQ,KACpB,IAAI,EAAE,MAAM,CAAC,IAAqC,EAClD,KAAK,EAAE,MAAM,CAAC,KAAwC,EACtD,UAAU,EAAE,MAAM,CAAC,UAAoC,EACvD,YAAY,EAAE,cAAc,IAAI,MAAM,CAAC,CAAC,CAAE,MAAM,CAAC,YAA8B,CAAC,CAAC,CAAC,SAAS,GAC5F,CAAC;QACF,OAAO,IAAA,kBAAO,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;CACF;AAtHD,gDAsHC;AAqBD;;;;;GAKG;AACH,MAAM,sBAAsB,GAAqE,IAAI,GAAG,CAGtG;IACA,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvB,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAChC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IAClC,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5C,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;CACjD,CAAC,CAAC;AAEH,kFAAkF;AAClF,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAS;IACpE,MAAM;IACN,MAAM;IACN,OAAO;IACP,YAAY;CACb,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAa,mBAAmB;IAc9B,YAAoB,MAAkC,EAAE,WAAuB,EAAE,WAAuB;QAVxG,iEAAiE;QACjD,eAAU,GAAe,QAAQ,CAAC;QAUhD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,MAAM,CAAC,MAAkC;QACrD,OAAO,oBAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CACzD,oBAAU,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CACnE,IAAA,kBAAO,EAAC,IAAI,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CACnE,CACF,CAAC;IACJ,CAAC;IAED,uCAAuC;IAChC,KAAK,CACV,UAAkC,EAClC,QAA+C;QAE/C,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACzE,OAAO,IAAA,kBAAO,EAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,yEAAyE;QACzE,4EAA4E;QAC5E,MAAM,KAAK,GAA4B,CAAC,GAAG,QAAQ,CAAC;aACjD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;aACvD,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;aAChD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvC,OAAO,IAAA,kBAAO,EAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,6CAA6C;IACtC,WAAW,CAChB,QAAgC,EAChC,KAA8B;QAE9B,4EAA4E;QAC5E,mEAAmE;QACnE,2EAA2E;QAC3E,oBAAoB;QACpB,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,MAAM,MAAM,GACV,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAY,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;QAED,8DAA8D;QAC9D,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;gBACnB,WAAW,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,oEAAoE;QACpE,OAAO,IAAI,CAAC,YAAY;aACrB,kBAAkB,CAAC,EAAE,EAAE,IAAkB,CAAC;aAC1C,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,KAAK,EAAE,WAAyB,CAAC,CAAC;aAC5F,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;OASG;IACK,QAAQ,CAAC,QAAgC,EAAE,MAAkB;QACnE,MAAM,OAAO,GAA0B,IAAI,CAAC,aAAa,CAAC,MAAM,CAC9D,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,CACrE,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,IAAA,eAAI,EAAC,kEAAkE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,qEAAqE;QACrE,gCAAgC;QAChC,MAAM,mBAAmB,GAAY,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACjF,MAAM,QAAQ,mCACT,QAAQ,CAAC,QAAQ,KACpB,IAAI,EAAE,MAAM,IAAI,MAAM,CAAC,CAAC,CAAE,MAAM,CAAC,IAAsC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAChG,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAE,MAAM,CAAC,KAAyC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EACtG,UAAU,EACR,YAAY,IAAI,MAAM,CAAC,CAAC,CAAE,MAAM,CAAC,UAAqC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,EACvG,YAAY,EAAE,mBAAmB;gBAC/B,CAAC,CAAC,cAAc,IAAI,MAAM;oBACxB,CAAC,CAAE,MAAM,CAAC,YAA8B;oBACxC,CAAC,CAAC,SAAS;gBACb,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,GACnC,CAAC;QACF,OAAO,IAAA,kBAAO,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACrF,CAAC;CACF;AA/HD,kDA+HC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAa,uBAAuB;IAkBlC,YAAoB,WAAuB,EAAE,WAAuB;QAjBpE,yEAAyE;QACzD,kBAAa,GAA0B;YACrD,MAAM;YACN,MAAM;YACN,OAAO;YACP,YAAY;YACZ,cAAc;SACf,CAAC;QAEF,4FAA4F;QAC5E,eAAU,GAAe,QAAQ,CAAC;QAQhD,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,MAAM;QAClB,OAAO,oBAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CACzD,oBAAU,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CACnE,IAAA,kBAAO,EAAC,IAAI,uBAAuB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAC/D,CACF,CAAC;IACJ,CAAC;IAED,uCAAuC;IAChC,KAAK,CACV,UAAkC,EAClC,UAAiD;QAEjD,2EAA2E;QAC3E,+BAA+B;QAC/B,OAAO,IAAA,kBAAO,EAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,6CAA6C;IACtC,WAAW,CAChB,QAAgC,EAChC,KAA8B;QAE9B,2EAA2E;QAC3E,2EAA2E;QAC3E,MAAM,IAAI,GAA4B;YACpC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;YAC5B,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK;YAC9B,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;SACzC,CAAC;QACF,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACjD,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QACrD,CAAC;QAED,8DAA8D;QAC9D,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;gBACnB,WAAW,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAED,8EAA8E;QAC9E,8DAA8D;QAC9D,OAAO,IAAI,CAAC,YAAY;aACrB,kBAAkB,CAAC,EAAE,EAAE,IAAkB,CAAC;aAC1C,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,KAAK,EAAE,WAAyB,CAAC,CAAC;aAC5F,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;OAKG;IACK,QAAQ,CAAC,QAAgC,EAAE,MAAkB;QACnE,MAAM,QAAQ,GAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAChF,MAAM,OAAO,GAA0B,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC;QACtF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,IAAA,eAAI,EAAC,qEAAqE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzG,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,0DAA0D;QAC1D,MAAM,QAAQ,mCACT,QAAQ,CAAC,QAAQ,KACpB,IAAI,EAAE,MAAM,CAAC,IAAqC,EAClD,KAAK,EAAE,MAAM,CAAC,KAAwC,EACtD,UAAU,EAAE,MAAM,CAAC,UAAoC,EACvD,YAAY,EAAE,cAAc,IAAI,MAAM,CAAC,CAAC,CAAE,MAAM,CAAC,YAA8B,CAAC,CAAC,CAAC,SAAS,GAC5F,CAAC;QACF,OAAO,IAAA,kBAAO,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;CACF;AAxGD,0DAwGC","sourcesContent":["/*\n * Copyright (c) 2026 Erik Fortune\n * SPDX-License-Identifier: MIT\n */\n\nimport { Result, fail, succeed } from '@fgv/ts-utils';\nimport { JsonObject } from '@fgv/ts-json-base';\nimport { IJsonEditorOptions, JsonEditor } from '@fgv/ts-json';\nimport { IEdge, IMemoryEnvelope, IMemoryRecord, IProvenance } from './envelope';\nimport { MemoryId, Tag } from './ids';\n\n/**\n * The granularity at which the store deduplicates an incoming write against the\n * existing vault, declared per kind via {@link IWritePolicy.dedupScope}.\n *\n * - `'content'`: scope-wide cross-id content dedup. An identical\n *   `{ kind, body, links }` triple ANYWHERE in the scope — even under a\n *   different id — is a no-op that returns the existing record. The knowledge\n *   kind family uses this.\n * - `'entity'`: same-id content dedup only. An identical re-put of the SAME\n *   entity is a no-op, but two DISTINCT entities with identical content never\n *   collapse. The experience (memory) kind families use this so that, e.g.,\n *   two turns whose summaries happen to be byte-identical both persist.\n * @public\n */\nexport type DedupScope = 'content' | 'entity';\n\n/**\n * The default {@link DedupScope} applied when a policy does not declare one.\n * Entity-scoped dedup is the safe default — it never silently collapses two\n * distinct entities with coincidentally-identical content.\n * @public\n */\nexport const DEFAULT_DEDUP_SCOPE: DedupScope = 'entity';\n\n/**\n * The admission decision returned by {@link IWritePolicy.admit}.\n * @public\n */\nexport type AdmissionDecision =\n  | { readonly decision: 'accept' }\n  | { readonly decision: 'reject'; readonly reason: string }\n  | {\n      readonly decision: 'cull-oldest';\n      /** {@link MemoryId}s to evict before writing the incoming record. */\n      readonly evict: ReadonlyArray<MemoryId>;\n    };\n\n/**\n * A per-kind write policy, injected at store construction. Invoked AFTER\n * content-hash dedup (dedup is always pre-policy). The policy decides\n * admission and, on update, applies a JSON Merge Patch (RFC-7386) restricted\n * to the declared mutable fields.\n * @public\n */\nexport interface IWritePolicy {\n  /**\n   * Names of the fields a merge-patch update may touch. Fields outside this\n   * list are immutable; a change to one constitutes a new entity (its\n   * `contentHash` differs). Used by {@link IWritePolicy.applyUpdate} to\n   * restrict which fields the patch applies.\n   */\n  readonly mutableFields: ReadonlyArray<string>;\n\n  /**\n   * The granularity at which the store deduplicates an incoming write for this\n   * kind. Optional; when absent the store applies {@link DEFAULT_DEDUP_SCOPE}\n   * (`'entity'`). See {@link DedupScope}.\n   */\n  readonly dedupScope?: DedupScope;\n\n  /**\n   * Determine whether the incoming record is admitted.\n   * @param incoming - The record about to be written.\n   * @param existing - The admission cohort the kind's cap applies to: the\n   * records in the same scope of the same kind, EXCLUDING the record at\n   * `incoming`'s target id. Empty on a first write into an empty cohort.\n   * Excluding the target id makes the post-write count uniform\n   * (`existing.length + 1`) across first-writes and same-id updates. A\n   * last-write-wins policy that has no cap ignores this argument.\n   * @returns A {@link AdmissionDecision}.\n   */\n  admit(\n    incoming: IMemoryRecord<unknown>,\n    existing: ReadonlyArray<IMemoryRecord<unknown>>\n  ): Result<AdmissionDecision>;\n\n  /**\n   * Apply a JSON Merge Patch (RFC-7386) to the mutable fields of an existing\n   * record. Called when admission is `accept` AND a record with the same\n   * `entityId` already exists (an update, not a first write).\n   *\n   * @param existing - The current persisted record.\n   * @param patch - A partial JSON object in Merge Patch format. `null`\n   * deletes the corresponding key; arrays replace wholesale; nested objects\n   * deep-merge. Only keys in {@link IWritePolicy.mutableFields} are applied.\n   * @returns The updated record (envelope + body).\n   */\n  applyUpdate(\n    existing: IMemoryRecord<unknown>,\n    patch: Record<string, unknown>\n  ): Result<IMemoryRecord<unknown>>;\n}\n\n/**\n * RFC-7386-compliant merge options for {@link IWritePolicy.applyUpdate}.\n *\n * @remarks\n * Phase-A verification (design-lock §5.1) confirmed `@fgv/ts-json`'s\n * `JsonEditor` diverges from RFC-7386 under its defaults on two axes —\n * `nullAsDelete` defaults `false` and `arrayMergeBehavior` defaults\n * `'append'`. Both are corrected here via the existing option surface, so the\n * primitive is composed (not extended, not hand-rolled).\n */\nconst MERGE_PATCH_OPTIONS: Partial<IJsonEditorOptions> = {\n  merge: {\n    nullAsDelete: true,\n    arrayMergeBehavior: 'replace'\n  }\n};\n\n/**\n * Last-write-wins write policy for the knowledge kind family. Admission\n * always accepts (no cap, no cull); updates apply an RFC-7386 merge patch\n * restricted to the knowledge mutable surface.\n *\n * @remarks\n * **Merge-surface pin (resolves design-lock §5.3's body-vs-envelope muddle).**\n * The declared `mutableFields` span both axes of a record: `body` is the\n * per-kind body, while `tags` / `links` / `provenance` / `embeddingRef` live\n * on the {@link IMemoryEnvelope}. `applyUpdate` projects exactly those fields\n * — each read from its canonical location — into a single record-level JSON\n * view, runs the merge over that view, then rebuilds a coherent record. The\n * identity and transaction-time envelope fields (`id`, `entityId`, `kind`,\n * `created`, `updated`, `seq`, `contentHash`) are NOT mutable and are\n * preserved verbatim; the store stamps `updated` / `seq` on write.\n * @public\n */\nexport class KnowledgeLwwPolicy implements IWritePolicy {\n  /**\n   * The knowledge mutable surface: the body plus the envelope metadata a\n   * consumer may revise without minting a new entity.\n   */\n  public readonly mutableFields: ReadonlyArray<string> = [\n    'body',\n    'tags',\n    'links',\n    'provenance',\n    'embeddingRef'\n  ];\n\n  /**\n   * Knowledge dedups scope-wide: an identical `{ kind, body, links }` triple\n   * anywhere in the `knowledge` scope — even under a different `docId` — is a\n   * no-op. Declared explicitly so the B1 content-dedup behavior (and its tests)\n   * are unchanged by the {@link DedupScope} amendment.\n   */\n  public readonly dedupScope: DedupScope = 'content';\n\n  /** Deep-clones the mutable view without RFC-7386 null-deletion semantics. */\n  private readonly _cloneEditor: JsonEditor;\n  /** Applies the RFC-7386 merge patch. */\n  private readonly _mergeEditor: JsonEditor;\n\n  private constructor(cloneEditor: JsonEditor, mergeEditor: JsonEditor) {\n    this._cloneEditor = cloneEditor;\n    this._mergeEditor = mergeEditor;\n  }\n\n  /**\n   * Family-convention factory. Constructs the shared `JsonEditor` instances\n   * (one for cloning, one for the RFC-7386 merge), both with the template /\n   * conditional / multivalue / reference rules disabled (empty rules array).\n   */\n  public static create(): Result<KnowledgeLwwPolicy> {\n    return JsonEditor.create({}, []).onSuccess((cloneEditor) =>\n      JsonEditor.create(MERGE_PATCH_OPTIONS, []).onSuccess((mergeEditor) =>\n        succeed(new KnowledgeLwwPolicy(cloneEditor, mergeEditor))\n      )\n    );\n  }\n\n  /** {@inheritDoc IWritePolicy.admit} */\n  public admit(\n    __incoming: IMemoryRecord<unknown>,\n    __existing: ReadonlyArray<IMemoryRecord<unknown>>\n  ): Result<AdmissionDecision> {\n    // Last-write-wins: always accept. No cap, no cull.\n    return succeed({ decision: 'accept' });\n  }\n\n  /** {@inheritDoc IWritePolicy.applyUpdate} */\n  public applyUpdate(\n    existing: IMemoryRecord<unknown>,\n    patch: Record<string, unknown>\n  ): Result<IMemoryRecord<unknown>> {\n    // Project the mutable fields into a single record-level view, each sourced\n    // from its canonical location. `embeddingRef` is omitted when `undefined`\n    // (the editor rejects undefined property values).\n    const view: Record<string, unknown> = {\n      body: existing.body,\n      tags: existing.envelope.tags,\n      links: existing.envelope.links,\n      provenance: existing.envelope.provenance\n    };\n    if (existing.envelope.embeddingRef !== undefined) {\n      view.embeddingRef = existing.envelope.embeddingRef;\n    }\n\n    // Restrict the incoming patch to the declared mutable fields; out-of-scope\n    // keys are never applied (the store enforces the same constraint).\n    const scopedPatch: Record<string, unknown> = {};\n    for (const field of this.mutableFields) {\n      if (field in patch) {\n        scopedPatch[field] = patch[field];\n      }\n    }\n\n    // Clone the view (no null-deletion), then apply the RFC-7386 merge patch\n    // onto the clone so the persisted record is never mutated in place.\n    return this._cloneEditor\n      .mergeObjectInPlace({}, view as JsonObject)\n      .onSuccess((clone) => this._mergeEditor.mergeObjectInPlace(clone, scopedPatch as JsonObject))\n      .onSuccess((merged) => this._rebuild(existing, merged));\n  }\n\n  /**\n   * Reassemble a record from the merged mutable view. `body` / `tags` /\n   * `links` / `provenance` are required and may not be deleted by a patch.\n   * `embeddingRef` is optional: when it is absent from the merged view —\n   * because the existing record never carried it OR a `null` patch deleted it\n   * (RFC-7386) — it is restored as `undefined` (absent), NOT `null`. This keeps\n   * an originally-absent `embeddingRef` from silently flipping to `null` on an\n   * unrelated update, so the field round-trips hash-stably through the store's\n   * content-hash recomputation.\n   */\n  private _rebuild(existing: IMemoryRecord<unknown>, merged: JsonObject): Result<IMemoryRecord<unknown>> {\n    const required: ReadonlyArray<string> = ['body', 'tags', 'links', 'provenance'];\n    const missing: ReadonlyArray<string> = required.filter((field) => !(field in merged));\n    if (missing.length > 0) {\n      return fail(`knowledge LWW: merge patch may not delete required field(s): ${missing.join(', ')}`);\n    }\n\n    // The merged values are JSON projections of the already-validated typed\n    // record; restore the domain types. (The types packlet cannot import the\n    // converters packlet without a cycle, so these are structural restorations\n    // of fields the merge preserved, not fresh untrusted input.)\n    const envelope: IMemoryEnvelope = {\n      ...existing.envelope,\n      tags: merged.tags as unknown as ReadonlyArray<Tag>,\n      links: merged.links as unknown as ReadonlyArray<IEdge>,\n      provenance: merged.provenance as unknown as IProvenance,\n      embeddingRef: 'embeddingRef' in merged ? (merged.embeddingRef as string | null) : undefined\n    };\n    return succeed({ envelope, body: merged.body });\n  }\n}\n\n/**\n * Parameters for {@link MemoryCapCullPolicy.create}.\n * @public\n */\nexport interface IMemoryCapCullPolicyParams {\n  /**\n   * Maximum number of records the policy admits before culling the oldest.\n   * Counted over the `existing` cohort passed to {@link IWritePolicy.admit}.\n   * Absent = no cap (admission always accepts).\n   */\n  readonly maxRecords?: number;\n  /**\n   * The fields a merge-patch update may touch (drawn from the record-level\n   * mutable vocabulary: `body` / `tags` / `links` / `provenance` /\n   * `embeddingRef`). Fields outside this list are immutable.\n   */\n  readonly mutableFields: ReadonlyArray<string>;\n}\n\n/**\n * The record-level fields a {@link MemoryCapCullPolicy} merge-patch may project,\n * mapped to their canonical location on a record. Mirrors the store's\n * mutable-field accessor vocabulary; a declared mutable field outside this set\n * is inert (the store cannot project it either).\n */\nconst CAP_CULL_FIELD_READERS: ReadonlyMap<string, (record: IMemoryRecord<unknown>) => unknown> = new Map<\n  string,\n  (record: IMemoryRecord<unknown>) => unknown\n>([\n  ['body', (r) => r.body],\n  ['tags', (r) => r.envelope.tags],\n  ['links', (r) => r.envelope.links],\n  ['provenance', (r) => r.envelope.provenance],\n  ['embeddingRef', (r) => r.envelope.embeddingRef]\n]);\n\n/** The record-level mutable fields that may never be deleted by a merge patch. */\nconst CAP_CULL_REQUIRED_FIELDS: ReadonlySet<string> = new Set<string>([\n  'body',\n  'tags',\n  'links',\n  'provenance'\n]);\n\n/**\n * Bounded-ring write policy for the experience (memory) kind families.\n * Admission accepts until `maxRecords` is reached, then evicts the oldest\n * record(s) by `created` ascending (design-lock §5.3); updates apply the same\n * RFC-7386 merge patch as {@link KnowledgeLwwPolicy}, restricted to the declared\n * {@link IMemoryCapCullPolicyParams.mutableFields | mutableFields}.\n *\n * @remarks\n * - **Dedup scope.** Declares `dedupScope: 'entity'` — two distinct memory\n *   entities (e.g. `turn-5` / `turn-9`) with identical `{ kind, body, links }`\n *   never collapse; only an identical re-put of the SAME entity is a no-op.\n * - **Eviction boundary.** `admit` only DECIDES (returns the `MemoryId`s to\n *   evict); the store executes the file deletions and index patches. The\n *   `existing` cohort the cap counts against is whatever the store supplies to\n *   `admit`.\n * @public\n */\nexport class MemoryCapCullPolicy implements IWritePolicy {\n  /** {@inheritDoc IWritePolicy.mutableFields} */\n  public readonly mutableFields: ReadonlyArray<string>;\n\n  /** Experience kinds dedup per-entity (see the class remarks). */\n  public readonly dedupScope: DedupScope = 'entity';\n\n  /** The admission cap; `undefined` = no cap. */\n  private readonly _maxRecords: number | undefined;\n  /** Deep-clones the mutable view without RFC-7386 null-deletion semantics. */\n  private readonly _cloneEditor: JsonEditor;\n  /** Applies the RFC-7386 merge patch. */\n  private readonly _mergeEditor: JsonEditor;\n\n  private constructor(params: IMemoryCapCullPolicyParams, cloneEditor: JsonEditor, mergeEditor: JsonEditor) {\n    this.mutableFields = params.mutableFields;\n    this._maxRecords = params.maxRecords;\n    this._cloneEditor = cloneEditor;\n    this._mergeEditor = mergeEditor;\n  }\n\n  /**\n   * Family-convention factory. Constructs the shared `JsonEditor` instances\n   * (one for cloning, one for the RFC-7386 merge) with the same merge config as\n   * {@link KnowledgeLwwPolicy} (`nullAsDelete` true, `arrayMergeBehavior`\n   * `'replace'`, rules disabled).\n   */\n  public static create(params: IMemoryCapCullPolicyParams): Result<MemoryCapCullPolicy> {\n    return JsonEditor.create({}, []).onSuccess((cloneEditor) =>\n      JsonEditor.create(MERGE_PATCH_OPTIONS, []).onSuccess((mergeEditor) =>\n        succeed(new MemoryCapCullPolicy(params, cloneEditor, mergeEditor))\n      )\n    );\n  }\n\n  /** {@inheritDoc IWritePolicy.admit} */\n  public admit(\n    __incoming: IMemoryRecord<unknown>,\n    existing: ReadonlyArray<IMemoryRecord<unknown>>\n  ): Result<AdmissionDecision> {\n    if (this._maxRecords === undefined || existing.length < this._maxRecords) {\n      return succeed({ decision: 'accept' });\n    }\n    // Cap reached: evict the oldest by `created` ascending so the post-write\n    // count is exactly `maxRecords` (existing.length - maxRecords + 1 victims).\n    const evict: ReadonlyArray<MemoryId> = [...existing]\n      .sort((a, b) => a.envelope.created - b.envelope.created)\n      .slice(0, existing.length - this._maxRecords + 1)\n      .map((record) => record.envelope.id);\n    return succeed({ decision: 'cull-oldest', evict });\n  }\n\n  /** {@inheritDoc IWritePolicy.applyUpdate} */\n  public applyUpdate(\n    existing: IMemoryRecord<unknown>,\n    patch: Record<string, unknown>\n  ): Result<IMemoryRecord<unknown>> {\n    // Project the declared mutable fields (restricted to the known record-level\n    // vocabulary) into a single record-level view from their canonical\n    // locations. An `undefined` value is omitted (the editor rejects undefined\n    // property values).\n    const view: Record<string, unknown> = {};\n    for (const field of this.mutableFields) {\n      const reader: ((record: IMemoryRecord<unknown>) => unknown) | undefined =\n        CAP_CULL_FIELD_READERS.get(field);\n      if (reader !== undefined) {\n        const value: unknown = reader(existing);\n        if (value !== undefined) {\n          view[field] = value;\n        }\n      }\n    }\n\n    // Restrict the incoming patch to the declared mutable fields.\n    const scopedPatch: Record<string, unknown> = {};\n    for (const field of this.mutableFields) {\n      if (field in patch) {\n        scopedPatch[field] = patch[field];\n      }\n    }\n\n    // Clone the view (no null-deletion), then apply the RFC-7386 merge patch\n    // onto the clone so the persisted record is never mutated in place.\n    return this._cloneEditor\n      .mergeObjectInPlace({}, view as JsonObject)\n      .onSuccess((clone) => this._mergeEditor.mergeObjectInPlace(clone, scopedPatch as JsonObject))\n      .onSuccess((merged) => this._rebuild(existing, merged));\n  }\n\n  /**\n   * Reassemble a record from the merged mutable view. Only the declared mutable\n   * fields are taken from the merge; undeclared fields are preserved verbatim\n   * from `existing`. A `null` patch that deletes a *declared mutable* required\n   * field (`body` / `tags` / `links` / `provenance`) is an error — a required\n   * field that is NOT declared mutable simply falls through to its `existing.*`\n   * value and is never at risk. `embeddingRef`, when mutable, is restored as\n   * `undefined` (absent) if the merge dropped it — same hash-stable semantics as\n   * {@link KnowledgeLwwPolicy}.\n   */\n  private _rebuild(existing: IMemoryRecord<unknown>, merged: JsonObject): Result<IMemoryRecord<unknown>> {\n    const deleted: ReadonlyArray<string> = this.mutableFields.filter(\n      (field) => CAP_CULL_REQUIRED_FIELDS.has(field) && !(field in merged)\n    );\n    if (deleted.length > 0) {\n      return fail(`memory cap-cull: merge patch may not delete required field(s): ${deleted.join(', ')}`);\n    }\n\n    // The merged values are JSON projections of the already-validated typed\n    // record; restore the domain types. (The types packlet cannot import the\n    // converters packlet without a cycle, so these are structural restorations\n    // of fields the merge preserved, not fresh untrusted input — mirrors\n    // KnowledgeLwwPolicy._rebuild.)\n    const embeddingRefMutable: boolean = this.mutableFields.includes('embeddingRef');\n    const envelope: IMemoryEnvelope = {\n      ...existing.envelope,\n      tags: 'tags' in merged ? (merged.tags as unknown as ReadonlyArray<Tag>) : existing.envelope.tags,\n      links: 'links' in merged ? (merged.links as unknown as ReadonlyArray<IEdge>) : existing.envelope.links,\n      provenance:\n        'provenance' in merged ? (merged.provenance as unknown as IProvenance) : existing.envelope.provenance,\n      embeddingRef: embeddingRefMutable\n        ? 'embeddingRef' in merged\n          ? (merged.embeddingRef as string | null)\n          : undefined\n        : existing.envelope.embeddingRef\n    };\n    return succeed({ envelope, body: 'body' in merged ? merged.body : existing.body });\n  }\n}\n\n/**\n * Write policy for a versioned (temporal) kind family, implementing\n * invalidate-don't-delete. Admission always accepts — history is retained, never\n * culled — and updates apply the same RFC-7386 merge patch as\n * {@link KnowledgeLwwPolicy}, restricted to the temporal mutable surface.\n *\n * @remarks\n * The policy does NOT perform the version file writes or set `invalid_at` — that\n * is the store's versioned write branch, driven by the kind's\n * {@link ITemporalIdentityCodec}. The policy's role is limited to admission and\n * the merge that forms the **new version's** content from the **current**\n * version plus the incoming patch (the merge-patch-under-versioning contract).\n *\n * - **Dedup scope.** `'entity'` — an identical re-put of the current content is a\n *   no-op (the store compares the incoming content hash against the current\n *   version), so identical writes do not spawn redundant versions.\n * - **Mutable surface.** `body` + the envelope metadata a consumer may revise\n *   (`tags` / `links` / `provenance` / `embeddingRef`). `temporal` is NOT mutable\n *   here — `valid_at` / `invalid_at` are set by the store's versioned branch.\n * @public\n */\nexport class TemporalVersionedPolicy implements IWritePolicy {\n  /** The temporal mutable surface (mirrors {@link KnowledgeLwwPolicy}). */\n  public readonly mutableFields: ReadonlyArray<string> = [\n    'body',\n    'tags',\n    'links',\n    'provenance',\n    'embeddingRef'\n  ];\n\n  /** Versioned kinds dedup per-entity against the current version (see the class remarks). */\n  public readonly dedupScope: DedupScope = 'entity';\n\n  /** Deep-clones the mutable view without RFC-7386 null-deletion semantics. */\n  private readonly _cloneEditor: JsonEditor;\n  /** Applies the RFC-7386 merge patch. */\n  private readonly _mergeEditor: JsonEditor;\n\n  private constructor(cloneEditor: JsonEditor, mergeEditor: JsonEditor) {\n    this._cloneEditor = cloneEditor;\n    this._mergeEditor = mergeEditor;\n  }\n\n  /**\n   * Family-convention factory. Constructs the shared `JsonEditor` instances (one\n   * for cloning, one for the RFC-7386 merge), rules disabled — the same merge\n   * config as the shipped policies.\n   */\n  public static create(): Result<TemporalVersionedPolicy> {\n    return JsonEditor.create({}, []).onSuccess((cloneEditor) =>\n      JsonEditor.create(MERGE_PATCH_OPTIONS, []).onSuccess((mergeEditor) =>\n        succeed(new TemporalVersionedPolicy(cloneEditor, mergeEditor))\n      )\n    );\n  }\n\n  /** {@inheritDoc IWritePolicy.admit} */\n  public admit(\n    __incoming: IMemoryRecord<unknown>,\n    __existing: ReadonlyArray<IMemoryRecord<unknown>>\n  ): Result<AdmissionDecision> {\n    // Invalidate-don't-delete: always accept. Superseded versions are retained\n    // (invalidated), never culled.\n    return succeed({ decision: 'accept' });\n  }\n\n  /** {@inheritDoc IWritePolicy.applyUpdate} */\n  public applyUpdate(\n    existing: IMemoryRecord<unknown>,\n    patch: Record<string, unknown>\n  ): Result<IMemoryRecord<unknown>> {\n    // Project the mutable fields into a single record-level view, each sourced\n    // from its canonical location. `embeddingRef` is omitted when `undefined`.\n    const view: Record<string, unknown> = {\n      body: existing.body,\n      tags: existing.envelope.tags,\n      links: existing.envelope.links,\n      provenance: existing.envelope.provenance\n    };\n    if (existing.envelope.embeddingRef !== undefined) {\n      view.embeddingRef = existing.envelope.embeddingRef;\n    }\n\n    // Restrict the incoming patch to the declared mutable fields.\n    const scopedPatch: Record<string, unknown> = {};\n    for (const field of this.mutableFields) {\n      if (field in patch) {\n        scopedPatch[field] = patch[field];\n      }\n    }\n\n    // Clone the view (no null-deletion), then apply the RFC-7386 merge patch onto\n    // the clone so the current version is never mutated in place.\n    return this._cloneEditor\n      .mergeObjectInPlace({}, view as JsonObject)\n      .onSuccess((clone) => this._mergeEditor.mergeObjectInPlace(clone, scopedPatch as JsonObject))\n      .onSuccess((merged) => this._rebuild(existing, merged));\n  }\n\n  /**\n   * Reassemble a record from the merged mutable view. `body` / `tags` / `links` /\n   * `provenance` are required and may not be deleted by a patch; `embeddingRef`,\n   * when dropped by the merge, is restored as `undefined` (absent) — the same\n   * hash-stable semantics as {@link KnowledgeLwwPolicy}.\n   */\n  private _rebuild(existing: IMemoryRecord<unknown>, merged: JsonObject): Result<IMemoryRecord<unknown>> {\n    const required: ReadonlyArray<string> = ['body', 'tags', 'links', 'provenance'];\n    const missing: ReadonlyArray<string> = required.filter((field) => !(field in merged));\n    if (missing.length > 0) {\n      return fail(`temporal versioned: merge patch may not delete required field(s): ${missing.join(', ')}`);\n    }\n\n    // The merged values are JSON projections of the already-validated typed\n    // record; restore the domain types (structural restorations, not fresh\n    // untrusted input — mirrors KnowledgeLwwPolicy._rebuild).\n    const envelope: IMemoryEnvelope = {\n      ...existing.envelope,\n      tags: merged.tags as unknown as ReadonlyArray<Tag>,\n      links: merged.links as unknown as ReadonlyArray<IEdge>,\n      provenance: merged.provenance as unknown as IProvenance,\n      embeddingRef: 'embeddingRef' in merged ? (merged.embeddingRef as string | null) : undefined\n    };\n    return succeed({ envelope, body: merged.body });\n  }\n}\n"]}

package/lib/test/unit/converters/antagonistRoundTrip.test.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Antagonist torture test — convert/validate round-trip symmetry (target class
+ * 7): every OPTIONAL field the envelope/edge/provenance shapes carry must
+ * survive a full on-disk round-trip (serialize → YAML text → parse), not just a
+ * single `Converter.convert` pass in memory. This exercises the exact path a
+ * corrupted or field-dropping serializer/parser pair would break, mirroring the
+ * `aiClientToolConfig`/`annotations` field-drop class named in the brief.
+ */
+import '@fgv/ts-utils-jest';
+//# sourceMappingURL=antagonistRoundTrip.test.d.ts.map

package/lib/test/unit/converters/antagonistRoundTrip.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"antagonistRoundTrip.test.d.ts","sourceRoot":"","sources":["../../../../src/test/unit/converters/antagonistRoundTrip.test.ts"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AAEH,OAAO,oBAAoB,CAAC"}

package/lib/test/unit/converters/antagonistRoundTrip.test.js

@@ -0,0 +1,97 @@
+"use strict";
+/*
+ * Copyright (c) 2026 Erik Fortune
+ * SPDX-License-Identifier: MIT
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Antagonist torture test — convert/validate round-trip symmetry (target class
+ * 7): every OPTIONAL field the envelope/edge/provenance shapes carry must
+ * survive a full on-disk round-trip (serialize → YAML text → parse), not just a
+ * single `Converter.convert` pass in memory. This exercises the exact path a
+ * corrupted or field-dropping serializer/parser pair would break, mirroring the
+ * `aiClientToolConfig`/`annotations` field-drop class named in the brief.
+ */
+require("@fgv/ts-utils-jest");
+const ts_utils_1 = require("@fgv/ts-utils");
+const index_1 = require("../../../index");
+const kind = 'note';
+function registry() {
+    const reg = index_1.BodyConverterRegistry.create().orThrow();
+    reg.register(kind, ts_utils_1.Converters.string);
+    return reg;
+}
+describe('antagonist — full on-disk round-trip preserves every optional field', () => {
+    // Wrong impl this catches: a serializer/parser pair where one side silently
+    // drops an optional field (the exact class of bug the brief calls out for
+    // `aiClientToolConfig`/`annotations`-shaped converters) — e.g. omitting
+    // `temporal.invalid_at: null`, an edge's `valid_at`/`invalid_at`/`provenance`,
+    // a `null` `embeddingRef`, or a provenance extension key, because the author
+    // forgot to thread it through both the YAML emit AND the envelope Converter.
+    test('every optional envelope/edge/provenance field set simultaneously survives a full YAML round-trip', () => {
+        const envelope = {
+            id: 'doc-1',
+            entityId: 'doc-1',
+            kind,
+            tags: ['t1', 't2'],
+            links: [
+                {
+                    type: 'rel',
+                    target: 'doc-2',
+                    confidence: 0.42,
+                    provenance: { source: 'agent', by: 'curator', extra: { nested: true } },
+                    valid_at: 111,
+                    invalid_at: null
+                }
+            ],
+            created: 1000,
+            updated: 2000,
+            seq: 7,
+            contentHash: 'abc123',
+            provenance: {
+                source: 'host-ingest',
+                by: 'erik',
+                model: 'gpt-5',
+                confidence: 0.87,
+                derivedFrom: 'turn-3',
+                // Opaque extension keys (per IProvenance's `[key: string]: unknown` arm).
+                sentiment: { score: 0.5 },
+                epistemic: 'belief'
+            },
+            temporal: { valid_at: 500, invalid_at: null },
+            embeddingRef: null
+        };
+        const raw = (0, index_1.serializeMemoryFile)(envelope, 'the body text').orThrow();
+        expect((0, index_1.parseMemoryFile)(raw, registry())).toSucceedAndSatisfy((record) => {
+            // Deep-equal the ENTIRE envelope, not field-by-field — a partial assertion
+            // list is exactly how a single dropped field slips through review.
+            expect(record.envelope).toEqual(envelope);
+            expect(record.body).toBe('the body text');
+        });
+    });
+    test('an absent temporal/embeddingRef/edge-optionals round-trips to fully absent (no null-vs-undefined drift)', () => {
+        const envelope = {
+            id: 'doc-2',
+            entityId: 'doc-2',
+            kind,
+            tags: [],
+            links: [{ type: 'rel', target: 'doc-3' }],
+            created: 0,
+            updated: 0,
+            seq: 0,
+            contentHash: '',
+            provenance: { source: 'agent' }
+        };
+        const raw = (0, index_1.serializeMemoryFile)(envelope, 'body').orThrow();
+        expect((0, index_1.parseMemoryFile)(raw, registry())).toSucceedAndSatisfy((record) => {
+            expect(record.envelope.temporal).toBeUndefined();
+            expect(record.envelope.embeddingRef).toBeUndefined();
+            expect(record.envelope.links[0].confidence).toBeUndefined();
+            expect(record.envelope.links[0].provenance).toBeUndefined();
+            expect(record.envelope.links[0].valid_at).toBeUndefined();
+            expect(record.envelope.links[0].invalid_at).toBeUndefined();
+            expect(record.envelope).toEqual(envelope);
+        });
+    });
+});
+//# sourceMappingURL=antagonistRoundTrip.test.js.map

package/lib/test/unit/converters/antagonistRoundTrip.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"antagonistRoundTrip.test.js","sourceRoot":"","sources":["../../../../src/test/unit/converters/antagonistRoundTrip.test.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAEH;;;;;;;GAOG;AAEH,8BAA4B;AAC5B,4CAA2C;AAC3C,0CAMwB;AAExB,MAAM,IAAI,GAAG,MAAiC,CAAC;AAE/C,SAAS,QAAQ;IACf,MAAM,GAAG,GAAG,6BAAqB,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACrD,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,qBAAU,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,QAAQ,CAAC,qEAAqE,EAAE,GAAG,EAAE;IACnF,4EAA4E;IAC5E,0EAA0E;IAC1E,wEAAwE;IACxE,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,CAAC,kGAAkG,EAAE,GAAG,EAAE;QAC5G,MAAM,QAAQ,GAAoB;YAChC,EAAE,EAAE,OAAgC;YACpC,QAAQ,EAAE,OAAsC;YAChD,IAAI;YACJ,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,CAAuC;YACxD,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,KAAc;oBACpB,MAAM,EAAE,OAAgB;oBACxB,UAAU,EAAE,IAAI;oBAChB,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;oBACvE,QAAQ,EAAE,GAAG;oBAEb,UAAU,EAAE,IAAI;iBACjB;aACF;YACD,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI;YACb,GAAG,EAAE,CAAC;YACN,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE;gBACV,MAAM,EAAE,aAAa;gBACrB,EAAE,EAAE,MAAM;gBACV,KAAK,EAAE,OAAO;gBACd,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,QAAiB;gBAC9B,0EAA0E;gBAC1E,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;gBACzB,SAAS,EAAE,QAAQ;aACpB;YAED,QAAQ,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE;YAE7C,YAAY,EAAE,IAAI;SACnB,CAAC;QAEF,MAAM,GAAG,GAAG,IAAA,2BAAmB,EAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC;QACrE,MAAM,CAAC,IAAA,uBAAe,EAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,MAAM,EAAE,EAAE;YACtE,2EAA2E;YAC3E,mEAAmE;YACnE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC1C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yGAAyG,EAAE,GAAG,EAAE;QACnH,MAAM,QAAQ,GAAoB;YAChC,EAAE,EAAE,OAAgC;YACpC,QAAQ,EAAE,OAAsC;YAChD,IAAI;YACJ,IAAI,EAAE,EAAE;YACR,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAc,EAAE,MAAM,EAAE,OAAgB,EAAE,CAAC;YAC3D,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;YACV,GAAG,EAAE,CAAC;YACN,WAAW,EAAE,EAAE;YACf,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;SAChC,CAAC;QACF,MAAM,GAAG,GAAG,IAAA,2BAAmB,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5D,MAAM,CAAC,IAAA,uBAAe,EAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,MAAM,EAAE,EAAE;YACtE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;YACjD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,aAAa,EAAE,CAAC;YACrD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;YAC5D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;YAC5D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;YAC1D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;YAC5D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["/*\n * Copyright (c) 2026 Erik Fortune\n * SPDX-License-Identifier: MIT\n */\n\n/**\n * Antagonist torture test — convert/validate round-trip symmetry (target class\n * 7): every OPTIONAL field the envelope/edge/provenance shapes carry must\n * survive a full on-disk round-trip (serialize → YAML text → parse), not just a\n * single `Converter.convert` pass in memory. This exercises the exact path a\n * corrupted or field-dropping serializer/parser pair would break, mirroring the\n * `aiClientToolConfig`/`annotations` field-drop class named in the brief.\n */\n\nimport '@fgv/ts-utils-jest';\nimport { Converters } from '@fgv/ts-utils';\nimport {\n  BodyConverterRegistry,\n  IBodyConverterRegistry,\n  IMemoryEnvelope,\n  parseMemoryFile,\n  serializeMemoryFile\n} from '../../../index';\n\nconst kind = 'note' as IMemoryEnvelope['kind'];\n\nfunction registry(): IBodyConverterRegistry {\n  const reg = BodyConverterRegistry.create().orThrow();\n  reg.register(kind, Converters.string);\n  return reg;\n}\n\ndescribe('antagonist — full on-disk round-trip preserves every optional field', () => {\n  // Wrong impl this catches: a serializer/parser pair where one side silently\n  // drops an optional field (the exact class of bug the brief calls out for\n  // `aiClientToolConfig`/`annotations`-shaped converters) — e.g. omitting\n  // `temporal.invalid_at: null`, an edge's `valid_at`/`invalid_at`/`provenance`,\n  // a `null` `embeddingRef`, or a provenance extension key, because the author\n  // forgot to thread it through both the YAML emit AND the envelope Converter.\n  test('every optional envelope/edge/provenance field set simultaneously survives a full YAML round-trip', () => {\n    const envelope: IMemoryEnvelope = {\n      id: 'doc-1' as IMemoryEnvelope['id'],\n      entityId: 'doc-1' as IMemoryEnvelope['entityId'],\n      kind,\n      tags: ['t1', 't2'] as unknown as IMemoryEnvelope['tags'],\n      links: [\n        {\n          type: 'rel' as never,\n          target: 'doc-2' as never,\n          confidence: 0.42,\n          provenance: { source: 'agent', by: 'curator', extra: { nested: true } },\n          valid_at: 111,\n\n          invalid_at: null\n        }\n      ],\n      created: 1000,\n      updated: 2000,\n      seq: 7,\n      contentHash: 'abc123',\n      provenance: {\n        source: 'host-ingest',\n        by: 'erik',\n        model: 'gpt-5',\n        confidence: 0.87,\n        derivedFrom: 'turn-3' as never,\n        // Opaque extension keys (per IProvenance's `[key: string]: unknown` arm).\n        sentiment: { score: 0.5 },\n        epistemic: 'belief'\n      },\n\n      temporal: { valid_at: 500, invalid_at: null },\n\n      embeddingRef: null\n    };\n\n    const raw = serializeMemoryFile(envelope, 'the body text').orThrow();\n    expect(parseMemoryFile(raw, registry())).toSucceedAndSatisfy((record) => {\n      // Deep-equal the ENTIRE envelope, not field-by-field — a partial assertion\n      // list is exactly how a single dropped field slips through review.\n      expect(record.envelope).toEqual(envelope);\n      expect(record.body).toBe('the body text');\n    });\n  });\n\n  test('an absent temporal/embeddingRef/edge-optionals round-trips to fully absent (no null-vs-undefined drift)', () => {\n    const envelope: IMemoryEnvelope = {\n      id: 'doc-2' as IMemoryEnvelope['id'],\n      entityId: 'doc-2' as IMemoryEnvelope['entityId'],\n      kind,\n      tags: [],\n      links: [{ type: 'rel' as never, target: 'doc-3' as never }],\n      created: 0,\n      updated: 0,\n      seq: 0,\n      contentHash: '',\n      provenance: { source: 'agent' }\n    };\n    const raw = serializeMemoryFile(envelope, 'body').orThrow();\n    expect(parseMemoryFile(raw, registry())).toSucceedAndSatisfy((record) => {\n      expect(record.envelope.temporal).toBeUndefined();\n      expect(record.envelope.embeddingRef).toBeUndefined();\n      expect(record.envelope.links[0].confidence).toBeUndefined();\n      expect(record.envelope.links[0].provenance).toBeUndefined();\n      expect(record.envelope.links[0].valid_at).toBeUndefined();\n      expect(record.envelope.links[0].invalid_at).toBeUndefined();\n      expect(record.envelope).toEqual(envelope);\n    });\n  });\n});\n"]}

package/lib/test/unit/ingest/antagonistCycleAndParity.test.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Antagonist torture tests — cycle guard adversarial graphs (target class 6) and
+ * enum-branch parity (target class 7), exercised at the ORCHESTRATOR/integration
+ * level over a real {@link FileTreeMemoryStore}, complementing the pure-function
+ * unit tests in `cycleGuard.test.ts` and the per-verdict tests in
+ * `orchestrator.test.ts`.
+ */
+import '@fgv/ts-utils-jest';
+//# sourceMappingURL=antagonistCycleAndParity.test.d.ts.map

package/lib/test/unit/ingest/antagonistCycleAndParity.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"antagonistCycleAndParity.test.d.ts","sourceRoot":"","sources":["../../../../src/test/unit/ingest/antagonistCycleAndParity.test.ts"],"names":[],"mappings":"AAKA;;;;;;GAMG;AAEH,OAAO,oBAAoB,CAAC"}

package/lib/test/unit/ingest/antagonistCycleAndParity.test.js

@@ -0,0 +1,275 @@
+"use strict";
+/*
+ * Copyright (c) 2026 Erik Fortune
+ * SPDX-License-Identifier: MIT
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Antagonist torture tests — cycle guard adversarial graphs (target class 6) and
+ * enum-branch parity (target class 7), exercised at the ORCHESTRATOR/integration
+ * level over a real {@link FileTreeMemoryStore}, complementing the pure-function
+ * unit tests in `cycleGuard.test.ts` and the per-verdict tests in
+ * `orchestrator.test.ts`.
+ */
+require("@fgv/ts-utils-jest");
+const ts_utils_1 = require("@fgv/ts-utils");
+const ts_json_base_1 = require("@fgv/ts-json-base");
+const index_1 = require("../../../index");
+const noteKind = 'note';
+function mutableRoot() {
+    const tree = ts_json_base_1.FileTree.inMemory([], { mutable: true }).orThrow();
+    const root = tree.getDirectory('/').orThrow();
+    if (!ts_json_base_1.FileTree.isMutableDirectoryItem(root)) {
+        throw new Error('expected a mutable root directory');
+    }
+    return root;
+}
+function registry() {
+    const reg = index_1.BodyConverterRegistry.create().orThrow();
+    reg.register(noteKind, ts_utils_1.Converters.string);
+    return reg;
+}
+const codecs = new Map([
+    [noteKind, new index_1.KnowledgeIdentityCodec()]
+]);
+function buildStore() {
+    return index_1.FileTreeMemoryStore.create({ root: mutableRoot(), registry: registry(), codecs }).orThrow();
+}
+async function putFull(store, entityId, body, links = []) {
+    const rec = {
+        envelope: {
+            id: entityId,
+            entityId: entityId,
+            kind: noteKind,
+            tags: [],
+            links,
+            created: 0,
+            updated: 0,
+            seq: 0,
+            contentHash: '',
+            provenance: { source: 'agent' }
+        },
+        body
+    };
+    (await store.put(rec)).orThrow();
+}
+function classifier(fn) {
+    return { classify: (item) => Promise.resolve(fn(item)) };
+}
+function extractor(fn) {
+    return { extract: (item, c) => Promise.resolve(fn(item, c)) };
+}
+function relater(fn) {
+    return { relate: (ctx) => Promise.resolve(fn(ctx)) };
+}
+function resolver(fn) {
+    return { resolve: (candidate, similar) => Promise.resolve(fn(candidate, similar)) };
+}
+const classifyNote = classifier(() => (0, ts_utils_1.succeed)({ kind: noteKind }));
+function candidate(entityId, body, links = []) {
+    return {
+        envelope: {
+            entityId: entityId,
+            kind: noteKind,
+            tags: [],
+            links,
+            provenance: { source: 'agent' }
+        },
+        body
+    };
+}
+function candEdge(source, type, target) {
+    return { source: source, edge: { type: type, target: target } };
+}
+function buildOrchestrator(params) {
+    return index_1.MemoryIngestOrchestrator.create({
+        store: params.store,
+        registry: registry(),
+        codecs,
+        classifier: classifyNote,
+        extractor: params.extractor,
+        relationExtractor: params.relationExtractor,
+        entityResolver: params.entityResolver
+    }).orThrow();
+}
+describe('antagonist — cycle guard through EXISTING store edges (integration)', () => {
+    // Wrong impl this catches: an orchestrator that only feeds the cycle guard the
+    // proposed-edge batch (as its own pure-function unit tests do) and forgets to
+    // fold in the store snapshot's existing edges, so a cycle that closes THROUGH
+    // an already-persisted edge is silently admitted.
+    test('a proposed edge that closes a cycle through a pre-existing on-disk edge is rejected', async () => {
+        const store = buildStore();
+        // Existing on-disk edge: doc-a -> doc-b (persisted before this ingest runs).
+        await putFull(store, 'doc-a', 'anchor-a', [{ type: 'rel', target: 'doc-b' }]);
+        await putFull(store, 'doc-b', 'anchor-b');
+        // This ingest re-writes doc-b (a 'new'-verdict same-id update, since no
+        // resolver is wired) and proposes doc-b -> doc-a, which — unioned with the
+        // EXISTING doc-a -> doc-b edge — closes a 2-cycle that exists ONLY because of
+        // the on-disk edge, not anything proposed in this batch.
+        const orch = buildOrchestrator({
+            store,
+            extractor: extractor(() => (0, ts_utils_1.succeed)([candidate('doc-b', 'anchor-b-v2')])),
+            relationExtractor: relater(() => (0, ts_utils_1.succeed)([candEdge('doc-b', 'rel', 'doc-a')]))
+        });
+        expect(await orch.ingestItem({ id: 'i', content: 'x' })).toFailWith(/would create a cycle/);
+        // Confirm the guard fired BEFORE any write — doc-b's content must be unchanged.
+        expect(await store.get(noteKind, 'doc-b')).toSucceedAndSatisfy((rec) => expect(rec === null || rec === void 0 ? void 0 : rec.body).toBe('anchor-b'));
+    });
+    test('a long existing chain plus one proposed edge closing the loop is rejected', async () => {
+        const store = buildStore();
+        // Existing chain: a -> b -> c -> d (four pre-existing on-disk edges spanning
+        // three hops), persisted before this ingest.
+        await putFull(store, 'chain-a', 'a', [{ type: 'rel', target: 'chain-b' }]);
+        await putFull(store, 'chain-b', 'b', [{ type: 'rel', target: 'chain-c' }]);
+        await putFull(store, 'chain-c', 'c', [{ type: 'rel', target: 'chain-d' }]);
+        await putFull(store, 'chain-d', 'd');
+        // Proposed: chain-d -> chain-a, closing the whole loop through the existing chain.
+        const orch = buildOrchestrator({
+            store,
+            extractor: extractor(() => (0, ts_utils_1.succeed)([candidate('chain-d', 'd-v2')])),
+            relationExtractor: relater(() => (0, ts_utils_1.succeed)([candEdge('chain-d', 'rel', 'chain-a')]))
+        });
+        expect(await orch.ingestItem({ id: 'i', content: 'x' })).toFailWith(/would create a cycle/);
+    });
+    test('cycleGuard "off" admits a cycle that closes through an existing edge', async () => {
+        const store = buildStore();
+        await putFull(store, 'doc-a', 'anchor-a', [{ type: 'rel', target: 'doc-b' }]);
+        await putFull(store, 'doc-b', 'anchor-b');
+        const orch = index_1.MemoryIngestOrchestrator.create({
+            store,
+            registry: registry(),
+            codecs,
+            classifier: classifyNote,
+            extractor: extractor(() => (0, ts_utils_1.succeed)([candidate('doc-b', 'anchor-b-v2')])),
+            relationExtractor: relater(() => (0, ts_utils_1.succeed)([candEdge('doc-b', 'rel', 'doc-a')])),
+            cycleGuard: 'off'
+        }).orThrow();
+        expect(await orch.ingestItem({ id: 'i', content: 'x' })).toSucceedAndSatisfy((r) => {
+            var _a;
+            expect((_a = r.records[0].record) === null || _a === void 0 ? void 0 : _a.envelope.links).toEqual([{ type: 'rel', target: 'doc-a' }]);
+        });
+    });
+});
+describe('antagonist — resolver target need not be a surfaced `similar` candidate (structural-only gate)', () => {
+    // Documents (and locks in) the actual contract: fgv validates a target-bearing
+    // verdict STRUCTURALLY (exists in the store + matching kind), uniformly across
+    // all three target-bearing verdicts, regardless of whether the resolver's
+    // choice was among the `similar` candidates it was shown. Wrong impl this
+    // guards against: fgv silently restricting itself to `similar` membership
+    // (which would incorrectly reject a host resolver with external knowledge), OR
+    // fgv skipping the structural check for one of the three verdicts.
+    test.each(['duplicate-of', 'supersede', 'merge-into'])("verdict '%s' targeting a valid existing record OUTSIDE the surfaced similar set is accepted", async (verdict) => {
+        const store = buildStore();
+        await putFull(store, 'doc-a', 'apple pie'); // will be surfaced as `similar`
+        await putFull(store, 'doc-q', 'unrelated target'); // exists, but never surfaced
+        const vectorIndex = index_1.InMemoryCosineIndex.create().orThrow();
+        const embed = () => Promise.resolve((0, ts_utils_1.succeed)(Float32Array.from([1, 0, 0])));
+        // Only doc-a is embedded/indexed; doc-q is never surfaced by similarity —
+        // it can only be reached by the resolver's own out-of-band choice.
+        (await vectorIndex.add('doc-a', Float32Array.from([1, 0, 0]))).orThrow();
+        const orch = index_1.MemoryIngestOrchestrator.create({
+            store,
+            registry: registry(),
+            codecs,
+            classifier: classifyNote,
+            extractor: extractor(() => (0, ts_utils_1.succeed)([candidate('doc-b', 'apple tart')])),
+            relationExtractor: relater(() => (0, ts_utils_1.succeed)([])),
+            vectorIndex,
+            embed,
+            entityResolver: resolver(() => (0, ts_utils_1.succeed)({ verdict, target: 'doc-q' }))
+        }).orThrow();
+        const result = await orch.ingestItem({ id: 'i', content: 'x' });
+        if (verdict === 'duplicate-of') {
+            expect(result).toSucceedAndSatisfy((r) => {
+                expect(r.records[0].disposition).toBe('deduped');
+                expect(r.records[0].id).toBe('doc-q');
+            });
+        }
+        else if (verdict === 'supersede') {
+            expect(result).toSucceedAndSatisfy((r) => {
+                expect(r.records[0].disposition).toBe('written');
+                expect(r.records[0].resolution).toEqual({ verdict: 'supersede', target: 'doc-q' });
+            });
+        }
+        else {
+            expect(result).toSucceedAndSatisfy((r) => {
+                expect(r.records[0].disposition).toBe('merged');
+                expect(r.records[0].id).toBe('doc-q');
+            });
+        }
+    });
+});
+describe('antagonist — enum-branch parity: uniform structural rejection across target-bearing verdicts', () => {
+    // A single table-driven test locking in that EVERY target-bearing verdict arm
+    // shares the SAME two structural checks (existence, then kind match) in the
+    // SAME order — the exact class of hole ("only merge-into checked") that a
+    // prior review caught. Wrong impl this guards against: a future edit that adds
+    // a fourth verdict or refactors validation per-branch and re-introduces an
+    // asymmetric gap.
+    const verdicts = ['duplicate-of', 'supersede', 'merge-into'];
+    test.each(verdicts)("verdict '%s' rejects a nonexistent target with the SAME message shape", async (verdict) => {
+        const store = buildStore();
+        await putFull(store, 'doc-a', 'apple pie');
+        const vectorIndex = index_1.InMemoryCosineIndex.create().orThrow();
+        const embed = () => Promise.resolve((0, ts_utils_1.succeed)(Float32Array.from([1, 0, 0])));
+        const orch = index_1.MemoryIngestOrchestrator.create({
+            store,
+            registry: registry(),
+            codecs,
+            classifier: classifyNote,
+            extractor: extractor(() => (0, ts_utils_1.succeed)([candidate('doc-b', 'apple tart')])),
+            relationExtractor: relater(() => (0, ts_utils_1.succeed)([])),
+            vectorIndex,
+            embed,
+            entityResolver: resolver(() => (0, ts_utils_1.succeed)({ verdict, target: 'ghost' }))
+        }).orThrow();
+        (await vectorIndex.add('doc-a', Float32Array.from([1, 0, 0]))).orThrow();
+        expect(await orch.ingestItem({ id: 'i', content: 'x' })).toFailWith(`ingest 'i': ${verdict} target 'ghost' does not exist in the store`);
+    });
+    test.each(verdicts)("verdict '%s' rejects a foreign-kind target with the SAME message shape", async (verdict) => {
+        const otherKind = 'other';
+        const reg = registry();
+        reg.register(otherKind, ts_utils_1.Converters.string);
+        const otherCodecs = new Map([
+            ...codecs,
+            [otherKind, new index_1.KnowledgeIdentityCodec()]
+        ]);
+        const store = index_1.FileTreeMemoryStore.create({
+            root: mutableRoot(),
+            registry: reg,
+            codecs: otherCodecs
+        }).orThrow();
+        const foreignRec = {
+            envelope: {
+                id: 'foreign-1',
+                entityId: 'foreign-1',
+                kind: otherKind,
+                tags: [],
+                links: [],
+                created: 0,
+                updated: 0,
+                seq: 0,
+                contentHash: '',
+                provenance: { source: 'agent' }
+            },
+            body: 'apple pie'
+        };
+        (await store.put(foreignRec)).orThrow();
+        const vectorIndex = index_1.InMemoryCosineIndex.create().orThrow();
+        const embed = () => Promise.resolve((0, ts_utils_1.succeed)(Float32Array.from([1, 0, 0])));
+        const orch = index_1.MemoryIngestOrchestrator.create({
+            store,
+            registry: reg,
+            codecs: otherCodecs,
+            classifier: classifyNote,
+            extractor: extractor(() => (0, ts_utils_1.succeed)([candidate('doc-b', 'apple tart')])),
+            relationExtractor: relater(() => (0, ts_utils_1.succeed)([])),
+            vectorIndex,
+            embed,
+            entityResolver: resolver(() => (0, ts_utils_1.succeed)({ verdict, target: 'foreign-1' }))
+        }).orThrow();
+        (await vectorIndex.add('foreign-1', Float32Array.from([1, 0, 0]))).orThrow();
+        expect(await orch.ingestItem({ id: 'i', content: 'x' })).toFailWith(`ingest 'i': ${verdict} target 'foreign-1' is kind 'other' but the candidate is kind 'note'`);
+    });
+});
+//# sourceMappingURL=antagonistCycleAndParity.test.js.map