@frockbot/plugin-memory 0.0.0 → 0.1.0

package/src/store.ts

@@ -0,0 +1,568 @@
+// The Memory Package's single writer, and the reader that merges shards.
+//
+// "The Memory Package is the single writer of Memory roots, and within a
+// shared root each Bot's shard is written only on that Bot's behalf: it writes
+// object storage, every write produces a generation recorded in the owning
+// Durable Object, and the Workspace presents Memory roots read-only through
+// the durable-root sync."
+//
+// Every byte in and out of this module goes through `WorkspaceFilesV1`. There
+// is no second store, no cache that outlives a call, and — the point of the
+// whole design — no Computer type anywhere on the path.
+//
+// HIBERNATION SEAM. "The Agent loop, Memory, Skills, Package composition, and
+// Routines function correctly while the Computer is hibernated and do not wake
+// it." Whoever supplies `WorkspaceFilesV1` owns that promise; in production it
+// is the object-storage store of ADR 0013, so a read here is an object-storage
+// read whether or not a Computer host is running.
+import {
+  writerOwnsMemoryPathV1,
+  type WorkspaceEntryV1,
+  type WorkspaceFilesV1,
+  type WorkspaceGenerationV1,
+  type WorkspaceMemoryRootV1,
+  type WorkspacePathV1,
+  type WorkspaceReadsV1,
+  type WorkspaceWriterV1,
+} from "@frockbot/kernel-contracts";
+import {
+  memoryDayV1,
+  memoryFactBodyV1,
+  memoryFactKeyV1,
+  memoryRetractionTextV1,
+  parseMemoryFileV1,
+  renderMemoryFileV1,
+  resolveMemoryFactsV1,
+  sortMemoryFactsV1,
+  type MemoryFactV1,
+  type SourcedMemoryFactV1,
+} from "./facts.js";
+import {
+  memoryFileKindV1,
+  memoryFilePathV1,
+  memoryShardOfV1,
+  type MemoryOwnerV1,
+  type MemoryTierV1,
+} from "./roots.js";
+import { refuseMemorySecretV1 } from "./secrets.js";
+
+/** Most `list` pages walked before enumeration stops. */
+export const MEMORY_MAX_LIST_PAGES = 8;
+/** Most Memory files read to render one tier. */
+export const MEMORY_MAX_FILES_PER_TIER = 64;
+/** The longest fact this Package will record. */
+export const MEMORY_MAX_FACT_LENGTH = 2_000;
+/** The largest Memory file this Package will rewrite. */
+export const MEMORY_MAX_FILE_BYTES = 256 * 1024;
+
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+
+/** One Memory file the reader consumed, named by its exact generation. */
+export interface MemorySourceV1 {
+  path: string;
+  kind: "profile" | "log";
+  botId: string;
+  generationId: string;
+  contentHash: string;
+}
+
+/** One tier, merged across every shard, newest first, retractions applied. */
+export interface MemoryTierReadV1 {
+  root: WorkspaceMemoryRootV1;
+  profile: SourcedMemoryFactV1[];
+  recent: SourcedMemoryFactV1[];
+  sources: MemorySourceV1[];
+  /** Log facts held on disk beyond what `recent` carries, before any cap. */
+  logTotal: number;
+  /** Set when the tier could not be read in full; rendered as an omission. */
+  unavailable?: string;
+  /**
+   * Set when the read completed but a declared bound cut it short, so some
+   * Memory on disk never reached this result.
+   *
+   * Distinct from `unavailable`: the tier *was* read, and the facts here are
+   * sound, so a write or a forget against it is still meaningful. What is not
+   * sound is treating this read as the whole tier — "an injection gap is
+   * visible in durable state rather than silently changing the Bot's
+   * behavior", so the renderer turns this into an omission on the tier's scope.
+   */
+  omitted?: string;
+}
+
+export type MemoryWriteOutcomeV1 =
+  | {
+      status: "ok";
+      path: string;
+      generationId: string;
+      contentHash: string;
+      /** True when the fact was already recorded and nothing was written. */
+      duplicate: boolean;
+    }
+  | { status: "refused"; reason: string }
+  | { status: "conflict"; reason: string }
+  | { status: "unavailable"; reason: string };
+
+/** One file a multi-file change actually rewrote, and the generation it made. */
+export interface MemoryFileChangeV1 {
+  path: string;
+  generationId: string;
+  contentHash: string;
+}
+
+/**
+ * A forget, which may touch more than one file.
+ *
+ * `written` names every file this call actually rewrote, and it is present on
+ * a failure too: a forget that mutates the first of two files and then fails
+ * on the second has changed durable state, and "Failures are observable
+ * through durable state" means the caller has to be able to record what did
+ * change rather than reporting a clean failure the files contradict.
+ */
+export type MemoryForgetOutcomeV1 = MemoryWriteOutcomeV1 & {
+  retracted?: boolean;
+  written?: MemoryFileChangeV1[];
+};
+
+export interface MemoryStoreOptionsV1 {
+  files: WorkspaceFilesV1;
+  owner: MemoryOwnerV1;
+  /** Display names per Bot id, for the `[via …]` tag. Missing ids show the id. */
+  botNames?: Readonly<Record<string, string>>;
+  clock?: () => Date;
+}
+
+/**
+ * The deep module this Package is built on: three public operations over a
+ * Workspace file surface, and every rule about shards, dedupe, retraction, and
+ * secrets decided inside.
+ */
+export class MemoryStore {
+  readonly owner: MemoryOwnerV1;
+  #files: WorkspaceFilesV1;
+  #names: Readonly<Record<string, string>>;
+  #clock: () => Date;
+
+  constructor(options: MemoryStoreOptionsV1) {
+    this.#files = options.files;
+    this.owner = options.owner;
+    this.#names = options.botNames ?? {};
+    this.#clock = options.clock ?? (() => new Date());
+  }
+
+  /** The read-only projection the reader half needs, for callers that want it. */
+  get reads(): WorkspaceReadsV1 {
+    return this.#files;
+  }
+
+  private via(botId: string): string {
+    return this.#names[botId] ?? botId;
+  }
+
+  /**
+   * Reads one whole tier: every shard, merged, newest fact winning, with a
+   * retraction in any shard suppressing the fact it names.
+   */
+  async read(root: WorkspaceMemoryRootV1): Promise<MemoryTierReadV1> {
+    const result: MemoryTierReadV1 = {
+      root,
+      profile: [],
+      recent: [],
+      sources: [],
+      logTotal: 0,
+    };
+    const entries: WorkspaceEntryV1[] = [];
+    let cursor: string | undefined;
+    for (let page = 0; page < MEMORY_MAX_LIST_PAGES; page += 1) {
+      const outcome = await this.#files.list(
+        cursor === undefined ? { root } : { root, cursor },
+      );
+      if (outcome.status !== "ok") {
+        // "unavailable" is an ordinary answer: a tier that cannot be read
+        // contributes no facts and says so, rather than failing the Turn.
+        result.unavailable = outcome.reason;
+        return result;
+      }
+      entries.push(...outcome.entries);
+      if (!outcome.cursor) {
+        cursor = undefined;
+        break;
+      }
+      cursor = outcome.cursor;
+    }
+    // Every omission this read makes is kept, not the last one: two bounds can
+    // both bite, and a caller that refuses on an incomplete read needs to be
+    // told everything that was left out rather than whichever omission was
+    // written most recently.
+    const omissions: string[] = [];
+    if (cursor !== undefined) {
+      // The listing was still going when the page bound ran out. Some shards
+      // were never seen, so this read is not the whole tier and must say so.
+      omissions.push(
+        `the tier did not finish listing within ${MEMORY_MAX_LIST_PAGES} pages, so some shards were not read`,
+      );
+    }
+
+    const profile: SourcedMemoryFactV1[] = [];
+    const log: SourcedMemoryFactV1[] = [];
+    const classifiedFiles = entries
+      .flatMap((entry) => {
+        const classified = memoryFileKindV1(root, entry.path.path);
+        return classified ? [{ entry, classified }] : [];
+      })
+      // Newest month last, so a merge that ties on day still has an order.
+      .sort((left, right) =>
+        left.entry.path.path.localeCompare(right.entry.path.path),
+      );
+    // The bound keeps the *newest* files, by recorded generation: what Memory
+    // is for is injecting recent facts, so a tier past the bound loses its
+    // oldest months rather than its newest. `writtenAt` orders them and the
+    // generation id breaks a tie, because both are recorded by the write that
+    // produced the file. The kept files are then restored to path order, which
+    // is the order the merge below relies on.
+    const newest = [...classifiedFiles]
+      .sort((left, right) => {
+        const a = left.entry.generation;
+        const b = right.entry.generation;
+        return (
+          a.writtenAt.localeCompare(b.writtenAt) ||
+          a.generationId.localeCompare(b.generationId)
+        );
+      })
+      .slice(-MEMORY_MAX_FILES_PER_TIER);
+    const kept = new Set(newest.map(({ entry }) => entry.path.path));
+    const files = classifiedFiles.filter(({ entry }) =>
+      kept.has(entry.path.path),
+    );
+    if (classifiedFiles.length > files.length) {
+      const dropped = classifiedFiles.length - files.length;
+      omissions.push(
+        `${dropped} Memory file(s) beyond the ${MEMORY_MAX_FILES_PER_TIER}-file read bound were not read; the newest ${MEMORY_MAX_FILES_PER_TIER} were kept`,
+      );
+    }
+    if (omissions.length > 0) result.omitted = omissions.join("; ");
+
+    for (const { entry, classified } of files) {
+      if (entry.generation.size > MEMORY_MAX_FILE_BYTES) {
+        result.unavailable = `a Memory file exceeds ${MEMORY_MAX_FILE_BYTES} bytes`;
+        continue;
+      }
+      const read = await this.#files.read(entry.path);
+      if (read.status !== "ok") {
+        result.unavailable = read.reason;
+        continue;
+      }
+      result.sources.push({
+        path: entry.path.path,
+        kind: classified.kind,
+        botId: classified.shard,
+        generationId: read.file.generation.generationId,
+        contentHash: read.file.generation.contentHash,
+      });
+      const parsed = parseMemoryFileV1(decoder.decode(read.file.bytes));
+      const sourced = parsed.map((fact) => ({
+        ...fact,
+        botId: classified.shard,
+        via: this.via(classified.shard),
+        kind: classified.kind,
+        generationId: read.file.generation.generationId,
+      }));
+      if (classified.kind === "profile") profile.push(...sourced);
+      else log.push(...sourced);
+    }
+
+    // Retractions cross files inside a tier: a `[forgotten]` line in the log
+    // suppresses the profile fact it names, which is what "newest wins" means
+    // once forgetting exists at all.
+    const resolved = resolveMemoryFactsV1([...profile, ...log]);
+    result.profile = sortMemoryFactsV1(
+      resolved.filter((fact) => fact.kind === "profile"),
+    );
+    result.recent = sortMemoryFactsV1(
+      resolved.filter((fact) => fact.kind === "log"),
+    );
+    result.logTotal = result.recent.length;
+    return result;
+  }
+
+  /**
+   * Records one fact in this Bot's own shard of a root.
+   *
+   * Refusals come first and are values, not throws: a secret-shaped fact, a
+   * fact this writer may not place at this path, an oversized fact. A fact
+   * already recorded is answered as a duplicate with no write at all, which is
+   * both GrokBot's dedupe and what makes a resumed Turn free.
+   */
+  async write(request: {
+    root: WorkspaceMemoryRootV1;
+    tier: MemoryTierV1;
+    fact: string;
+    writer: WorkspaceWriterV1;
+    at?: Date;
+  }): Promise<MemoryWriteOutcomeV1> {
+    const text = request.fact.trim();
+    if (!text || text.length > MEMORY_MAX_FACT_LENGTH) {
+      return {
+        status: "refused",
+        reason: `a fact must be between 1 and ${MEMORY_MAX_FACT_LENGTH} characters`,
+      };
+    }
+    const secret = refuseMemorySecretV1(text);
+    if (secret) return { status: "refused", reason: secret.reason };
+    const at = request.at ?? this.#clock();
+    const path = memoryFilePathV1(
+      request.root,
+      this.owner.botId,
+      request.tier,
+      at,
+    );
+    const refusal = this.refuseForeignShard(path, request.writer);
+    if (refusal) return refusal;
+    const line: MemoryFactV1 = { date: memoryDayV1(at), text };
+    return this.rewrite(path, request.writer, (facts) => {
+      const key = memoryFactKeyV1(text);
+      if (facts.some((fact) => memoryFactKeyV1(fact.text) === key)) {
+        return "unchanged";
+      }
+      return [...facts, line];
+    });
+  }
+
+  /**
+   * Forgets one fact by its recorded text, ignoring any marker on it.
+   *
+   * In this Bot's own shard the line is removed. In a shared tier a fact
+   * another Bot recorded is *not* edited — "Never edit another assistant's
+   * shard" — so the forget is recorded as a retraction in this Bot's own log,
+   * and newest-wins does the rest. That is the same correction mechanism
+   * GrokBot documents for shared facts, applied to removal.
+   *
+   * MARKERS. The match is on the marker-stripped body, so `forget("x")`
+   * removes `x`, `[note] x` and `[episode] x` alike, and a caller who does
+   * pass `[note] x` still matches because the input is stripped too. GrokBot's
+   * rule is "forget matches the exact recorded text" (§2.2), and a literal
+   * reading of it would make a User unable to forget a note whose `[note] `
+   * prefix they were never shown — the marker is a tier the *host* wrote, not
+   * a word the User said. The asymmetry with `write`, which still dedupes on
+   * the full text, is deliberate and in the safe direction: writing twice
+   * keeps both records, forgetting once removes both.
+   *
+   * A shared fact is retracted once per *recorded* text, because a retraction
+   * suppresses the exact text it names: forgetting `x` when another Bot holds
+   * `[note] x` writes `[forgotten] [note] x`.
+   */
+  async forget(request: {
+    root: WorkspaceMemoryRootV1;
+    fact: string;
+    writer: WorkspaceWriterV1;
+    at?: Date;
+  }): Promise<MemoryForgetOutcomeV1> {
+    const text = request.fact.trim();
+    if (!text) return { status: "refused", reason: "a fact text is required" };
+    const at = request.at ?? this.#clock();
+    const key = memoryFactKeyV1(memoryFactBodyV1(text));
+    const matches = (candidate: string): boolean =>
+      memoryFactKeyV1(memoryFactBodyV1(candidate)) === key;
+    const tier = await this.read(request.root);
+    if (tier.unavailable) {
+      return { status: "unavailable", reason: tier.unavailable };
+    }
+    if (tier.omitted) {
+      // A forget decided on part of a tier is a lie: the fact may sit in a
+      // file the read bound cut, and answering "ok" would leave it on disk,
+      // injected on the next Turn, with the User told it was forgotten. An
+      // incomplete read is therefore an incomplete answer.
+      return {
+        status: "unavailable",
+        reason: `the tier could not be read in full, so a forget cannot be complete: ${tier.omitted}`,
+      };
+    }
+
+    const mine = [...tier.profile, ...tier.recent].filter(
+      (fact) => fact.botId === this.owner.botId && matches(fact.text),
+    );
+    if (mine.length > 0) {
+      // The Bot owns every file the fact sits in, so removing the line is both
+      // permitted and the honest record: nothing else recorded it.
+      let last: MemoryWriteOutcomeV1 | undefined;
+      // Each rewritten file is recorded as it lands, so a failure part-way
+      // through still answers with the generations that already exist on disk.
+      const written: MemoryFileChangeV1[] = [];
+      for (const source of tier.sources) {
+        if (source.botId !== this.owner.botId) continue;
+        const path: WorkspacePathV1 = { root: request.root, path: source.path };
+        const refusal = this.refuseForeignShard(path, request.writer);
+        if (refusal) return { ...refusal, written };
+        const outcome = await this.rewrite(path, request.writer, (facts) => {
+          const kept = facts.filter((fact) => !matches(fact.text));
+          return kept.length === facts.length ? "unchanged" : kept;
+        });
+        if (outcome.status !== "ok") return { ...outcome, written };
+        if (!outcome.duplicate) {
+          last = outcome;
+          written.push({
+            path: outcome.path,
+            generationId: outcome.generationId,
+            contentHash: outcome.contentHash,
+          });
+        }
+      }
+      if (last) return { ...last, written };
+    }
+
+    const elsewhere = [
+      ...new Set(
+        [...tier.profile, ...tier.recent]
+          .filter((fact) => fact.botId !== this.owner.botId)
+          .filter((fact) => matches(fact.text))
+          .map((fact) => fact.text),
+      ),
+    ];
+    if (elsewhere.length === 0) {
+      return {
+        status: "refused",
+        reason: `no fact matching "${text}" is recorded in this tier`,
+      };
+    }
+    const written: MemoryFileChangeV1[] = [];
+    let last: MemoryWriteOutcomeV1 | undefined;
+    for (const recorded of elsewhere) {
+      const retraction = await this.write({
+        root: request.root,
+        tier: "log",
+        fact: memoryRetractionTextV1(recorded),
+        writer: request.writer,
+        at,
+      });
+      if (retraction.status !== "ok") return { ...retraction, written };
+      last = retraction;
+      if (!retraction.duplicate) {
+        written.push({
+          path: retraction.path,
+          generationId: retraction.generationId,
+          contentHash: retraction.contentHash,
+        });
+      }
+    }
+    if (!last) {
+      return {
+        status: "refused",
+        reason: `no fact matching "${text}" is recorded in this tier`,
+      };
+    }
+    return { ...last, retracted: true, written };
+  }
+
+  /**
+   * Writes one arbitrary Memory file this Bot owns — the Project descriptor,
+   * and nothing else today. It goes through the same shard guard and the same
+   * conditional write as a fact, because the constitution's rule is about the
+   * root, not about what the bytes mean.
+   */
+  async writeFile(request: {
+    path: WorkspacePathV1;
+    text: string;
+    writer: WorkspaceWriterV1;
+  }): Promise<MemoryWriteOutcomeV1> {
+    const bytes = encoder.encode(request.text);
+    if (bytes.byteLength > MEMORY_MAX_FILE_BYTES) {
+      return { status: "refused", reason: "the Memory file is too large" };
+    }
+    const secret = refuseMemorySecretV1(request.text);
+    if (secret) return { status: "refused", reason: secret.reason };
+    if (!writerOwnsMemoryPathV1(request.path, request.writer)) {
+      return {
+        status: "refused",
+        reason: `this writer may not write "${request.path.path}" in this Memory root`,
+      };
+    }
+    const existing = await this.#files.stat(request.path);
+    if (existing.status !== "ok" && existing.status !== "not-found") {
+      return { status: existing.status, reason: existing.reason };
+    }
+    return this.commit(
+      request.path,
+      bytes,
+      request.writer,
+      existing.status === "ok" ? existing.entry.generation : undefined,
+    );
+  }
+
+  private refuseForeignShard(
+    path: WorkspacePathV1,
+    writer: WorkspaceWriterV1,
+  ): MemoryWriteOutcomeV1 | undefined {
+    // The contract decides ownership; this Package never re-decides it. The
+    // store refuses the same write again, so this is an early, legible answer
+    // rather than the boundary itself.
+    if (writerOwnsMemoryPathV1(path, writer)) return undefined;
+    return {
+      status: "refused",
+      reason: `only the Bot that owns this Memory shard may write "${path.path}"`,
+    };
+  }
+
+  private async rewrite(
+    path: WorkspacePathV1,
+    writer: WorkspaceWriterV1,
+    change: (facts: MemoryFactV1[]) => MemoryFactV1[] | "unchanged",
+  ): Promise<MemoryWriteOutcomeV1> {
+    const existing = await this.#files.read(path);
+    if (existing.status !== "ok" && existing.status !== "not-found") {
+      return { status: existing.status, reason: existing.reason };
+    }
+    const current: WorkspaceGenerationV1 | undefined =
+      existing.status === "ok" ? existing.file.generation : undefined;
+    const facts =
+      existing.status === "ok"
+        ? parseMemoryFileV1(decoder.decode(existing.file.bytes))
+        : [];
+    const next = change(facts);
+    if (next === "unchanged") {
+      return {
+        status: "ok",
+        path: path.path,
+        generationId: current?.generationId ?? "",
+        contentHash: current?.contentHash ?? "",
+        duplicate: true,
+      };
+    }
+    return this.commit(
+      path,
+      encoder.encode(renderMemoryFileV1(next)),
+      writer,
+      current,
+    );
+  }
+
+  private async commit(
+    path: WorkspacePathV1,
+    bytes: Uint8Array,
+    writer: WorkspaceWriterV1,
+    current: WorkspaceGenerationV1 | undefined,
+  ): Promise<MemoryWriteOutcomeV1> {
+    const outcome = await this.#files.write({
+      path,
+      bytes,
+      writer,
+      expectedGenerationId: current?.generationId ?? null,
+      mediaType: "text/markdown; charset=utf-8",
+    });
+    if (outcome.status === "ok") {
+      return {
+        status: "ok",
+        path: path.path,
+        generationId: outcome.generation.generationId,
+        contentHash: outcome.generation.contentHash,
+        duplicate: false,
+      };
+    }
+    if (outcome.status === "conflict") {
+      return { status: "conflict", reason: outcome.reason };
+    }
+    return {
+      status: outcome.status === "refused" ? "refused" : "unavailable",
+      reason: outcome.reason,
+    };
+  }
+}

package/src/testing.ts

@@ -0,0 +1,98 @@
+// Fixtures for the Memory Package's tests, and for anything that needs a
+// Memory host without a Durable Object.
+//
+// The Workspace half is deliberately *not* faked here: the tests build a real
+// `createObjectWorkspaceFilesV1` over the in-memory bucket and generation
+// ledger from `@frockbot/workspace-store/testing`, so what they prove is the
+// production store's behaviour and not a double's. What this module supplies
+// is the two seams that genuinely have no implementation in this Package: the
+// durable Project authority, and a deterministic clock.
+import { createObjectWorkspaceFilesV1 } from "@frockbot/workspace-store";
+import {
+  createInMemoryObjectBucketV1,
+  createInMemoryWorkspaceGenerationsV1,
+} from "@frockbot/workspace-store/testing";
+import type { WorkspaceFilesV1 } from "@frockbot/kernel-contracts";
+import type { MemoryProjectsOutcomeV1, MemoryProjectsV1 } from "./projects.js";
+import type { MemoryProjectV1 } from "./render.js";
+import { MemoryStore } from "./store.js";
+import type { MemoryOwnerV1 } from "./roots.js";
+
+/** The Memory surface, over the same store production uses. */
+export function createTestMemoryFilesV1(options: {
+  userId: string;
+  clock?: () => Date;
+}): WorkspaceFilesV1 {
+  return createObjectWorkspaceFilesV1({
+    bucket: createInMemoryObjectBucketV1(options.clock),
+    generations: createInMemoryWorkspaceGenerationsV1(options.clock),
+    owner: { userId: options.userId },
+    surface: "memory",
+    ...(options.clock ? { clock: options.clock } : {}),
+  });
+}
+
+/**
+ * A Project authority in memory. Production's lives in the User Durable
+ * Object; this one models the same contract, including create-is-join.
+ */
+export function createInMemoryMemoryProjectsV1(
+  seed: MemoryProjectV1[] = [],
+): MemoryProjectsV1 & { known(): MemoryProjectV1[] } {
+  const known = new Map<string, MemoryProjectV1>(
+    seed.map((project) => [project.projectId, project]),
+  );
+  const joined = new Set<string>(seed.map((project) => project.projectId));
+  const list = (): MemoryProjectV1[] =>
+    [...joined]
+      .flatMap((projectId) => {
+        const project = known.get(projectId);
+        return project ? [project] : [];
+      })
+      .sort((left, right) => left.projectId.localeCompare(right.projectId));
+  const ok = (): MemoryProjectsOutcomeV1 => ({ status: "ok", joined: list() });
+  return {
+    known: () => [...known.values()],
+    joined: () => Promise.resolve(list()),
+    create: (project) => {
+      if (!known.has(project.projectId)) known.set(project.projectId, project);
+      joined.add(project.projectId);
+      return Promise.resolve(ok());
+    },
+    join: (projectId) => {
+      if (!known.has(projectId)) {
+        return Promise.resolve({
+          status: "refused",
+          reason: `no Project "${projectId}" exists`,
+        } satisfies MemoryProjectsOutcomeV1);
+      }
+      joined.add(projectId);
+      return Promise.resolve(ok());
+    },
+    leave: (projectId) => {
+      joined.delete(projectId);
+      return Promise.resolve(ok());
+    },
+  };
+}
+
+/** A `MemoryStore` over the test Workspace surface, with a frozen clock. */
+export function createTestMemoryStoreV1(options: {
+  owner: MemoryOwnerV1;
+  botNames?: Record<string, string>;
+  at?: Date;
+  files?: WorkspaceFilesV1;
+}): MemoryStore {
+  const clock = options.at ? () => options.at as Date : undefined;
+  return new MemoryStore({
+    files:
+      options.files ??
+      createTestMemoryFilesV1({
+        userId: options.owner.userId,
+        ...(clock ? { clock } : {}),
+      }),
+    owner: options.owner,
+    ...(options.botNames ? { botNames: options.botNames } : {}),
+    ...(clock ? { clock } : {}),
+  });
+}