@remnic/core 9.54.4 → 9.54.5

package/src/support-passport/contracts.test.ts

@@ -0,0 +1,143 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import {
+  SupportPassportCardListSchema,
+  SupportPassportCardSchema,
+  SupportPassportManualDraftInputSchema,
+  SupportPassportNamespaceSchema,
+  SupportPassportReplaceCardInputSchema,
+  computeSupportPassportCardRevision,
+} from "./contracts.js";
+
+function makeCard(cardId: string) {
+  const fields = {
+    cardId,
+    title: "Quiet space",
+    statement: "Offer me a quiet place and time.",
+    category: "environment" as const,
+    status: "active" as const,
+    updatedAt: "2026-08-11T12:00:00.000Z",
+    reviewBy: "2027-02-07T12:00:00.000Z",
+  };
+  return { ...fields, revision: computeSupportPassportCardRevision(fields) };
+}
+
+test("the public support card contract rejects unknown fields", () => {
+  assert.equal(SupportPassportCardSchema.safeParse({ ...makeCard("card-1"), note: "private" }).success, false);
+});
+
+test("the support card list contract rejects duplicate card IDs", () => {
+  const card = makeCard("card-1");
+  assert.equal(SupportPassportCardListSchema.safeParse([card, card]).success, false);
+});
+
+test("manual and replacement drafts require the owner's review date", () => {
+  const draft = {
+    principal: "owner:alice",
+    title: "Quiet space",
+    statement: "Offer me a quiet place and time.",
+    category: "environment",
+  };
+  assert.equal(SupportPassportManualDraftInputSchema.safeParse(draft).success, false);
+  assert.equal(
+    SupportPassportReplaceCardInputSchema.safeParse({
+      ...draft,
+      cardId: "card-1",
+      expectedRevision: "a".repeat(64),
+    }).success,
+    false
+  );
+});
+
+test("support card dates reject invalid calendar values and timezone offsets", () => {
+  for (const reviewBy of ["2027-02-31T12:00:00Z", "2027-01-01T00:00:00+25:00"]) {
+    const draft = {
+      principal: "owner:alice",
+      title: "Quiet space",
+      statement: "Offer me a quiet place and time.",
+      category: "environment",
+      reviewBy,
+    };
+    assert.equal(SupportPassportManualDraftInputSchema.safeParse(draft).success, false);
+    assert.equal(
+      SupportPassportReplaceCardInputSchema.safeParse({
+        ...draft,
+        cardId: "card-1",
+        expectedRevision: "a".repeat(64),
+      }).success,
+      false
+    );
+    assert.equal(SupportPassportCardSchema.safeParse({ ...makeCard("card-1"), reviewBy }).success, false);
+  }
+});
+
+test("support card titles reject attribute delimiters and line breaks", () => {
+  for (const title of ["Quiet ] space", "Quiet\nspace", "Quiet\rspace"]) {
+    const manualDraft = {
+      principal: "owner:alice",
+      title,
+      statement: "Offer me a quiet place and time.",
+      category: "environment",
+      reviewBy: "2027-02-07T12:00:00.000Z",
+    };
+    assert.equal(SupportPassportManualDraftInputSchema.safeParse(manualDraft).success, false);
+    assert.equal(
+      SupportPassportReplaceCardInputSchema.safeParse({
+        ...manualDraft,
+        cardId: "card-1",
+        expectedRevision: "a".repeat(64),
+      }).success,
+      false
+    );
+    assert.equal(SupportPassportCardSchema.safeParse({ ...makeCard("card-1"), title }).success, false);
+  }
+});
+
+test("support passport namespaces use the shared canonical identity grammar", () => {
+  for (const namespace of ["", " alice", "alice "]) {
+    assert.equal(SupportPassportNamespaceSchema.safeParse(namespace).success, false);
+  }
+  for (const namespace of [
+    "team.alpha-1",
+    "team support:primary",
+    "tenant/default",
+    "alice\\bob",
+    "alice]bob",
+    "alice..bob",
+    "alice\nbob",
+    "alice\0bob",
+    "n".repeat(4096),
+  ]) {
+    assert.equal(SupportPassportNamespaceSchema.safeParse(namespace).success, true);
+  }
+});
+
+test("support card revisions change when any public field changes", () => {
+  const initial = makeCard("card-1");
+  const changed = computeSupportPassportCardRevision({
+    cardId: initial.cardId,
+    title: initial.title,
+    statement: "Offer me a quiet room and time.",
+    category: initial.category,
+    status: initial.status,
+    updatedAt: initial.updatedAt,
+    reviewBy: initial.reviewBy,
+  });
+  assert.notEqual(changed, initial.revision);
+});
+
+test("support card revisions ignore object key insertion order", () => {
+  const initial = makeCard("card-1");
+  const reordered = {
+    reviewBy: initial.reviewBy,
+    updatedAt: initial.updatedAt,
+    status: initial.status,
+    category: initial.category,
+    statement: initial.statement,
+    title: initial.title,
+    cardId: initial.cardId,
+  };
+
+  assert.equal(computeSupportPassportCardRevision(reordered), initial.revision);
+});

package/src/support-passport/contracts.ts

@@ -0,0 +1,136 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+
+import { normalizeNamespaceIdentity } from "../namespaces/identity.js";
+import { parseIsoOffsetTimestamp } from "../utils/iso-timestamp.js";
+
+export const SUPPORT_PASSPORT_CARD_CATEGORIES = [
+  "communication",
+  "environment",
+  "transitions",
+  "sensory",
+  "regulation",
+  "interests",
+  "other",
+] as const;
+
+export const SUPPORT_PASSPORT_CARD_STATUSES = [
+  "pending_review",
+  "active",
+  "rejected",
+  "superseded",
+  "archived",
+] as const;
+
+export const SupportPassportCardCategorySchema = z.enum(SUPPORT_PASSPORT_CARD_CATEGORIES);
+export const SupportPassportCardStatusSchema = z.enum(SUPPORT_PASSPORT_CARD_STATUSES);
+export const SupportPassportCardTitleSchema = z
+  .string()
+  .trim()
+  .min(1)
+  .max(80)
+  .refine((title) => !title.includes("]") && !title.includes("\n") && !title.includes("\r"), {
+    message: "card titles cannot contain closing brackets or line breaks",
+  });
+
+const IsoTimestampSchema = z
+  .string()
+  .datetime({ offset: true })
+  .refine((value) => parseIsoOffsetTimestamp(value) !== null, {
+    message: "timestamps must be valid ISO 8601 values",
+  });
+export const SupportPassportNamespaceSchema = z
+  .string()
+  .min(1)
+  .refine((namespace) => namespace === normalizeNamespaceIdentity(namespace), {
+    message: "namespaces must be canonical",
+  });
+export const SupportPassportMemoryIdSchema = z
+  .string()
+  .trim()
+  .min(1)
+  .max(128)
+  .regex(/^[A-Za-z0-9._:-]+$/);
+
+export const SupportPassportCardSchema = z
+  .object({
+    cardId: SupportPassportMemoryIdSchema,
+    title: SupportPassportCardTitleSchema,
+    statement: z.string().trim().min(1).max(500),
+    category: SupportPassportCardCategorySchema,
+    status: SupportPassportCardStatusSchema,
+    updatedAt: IsoTimestampSchema,
+    reviewBy: IsoTimestampSchema,
+    revision: z.string().regex(/^[a-f0-9]{64}$/),
+  })
+  .strict();
+
+export const SupportPassportCardListSchema = z
+  .array(SupportPassportCardSchema)
+  .max(100)
+  .superRefine((cards, ctx) => {
+    const seen = new Set<string>();
+    for (const [index, card] of cards.entries()) {
+      if (seen.has(card.cardId)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: "card IDs must be unique",
+          path: [index, "cardId"],
+        });
+      }
+      seen.add(card.cardId);
+    }
+  });
+
+export const SupportPassportListCardsInputSchema = z
+  .object({
+    principal: z.string().trim().min(1).max(512),
+  })
+  .strict();
+
+export const SupportPassportManualDraftInputSchema = z
+  .object({
+    principal: z.string().trim().min(1).max(512),
+    title: SupportPassportCardTitleSchema,
+    statement: z.string().trim().min(1).max(500),
+    category: SupportPassportCardCategorySchema,
+    reviewBy: IsoTimestampSchema,
+  })
+  .strict();
+
+export const SupportPassportCardMutationInputSchema = z
+  .object({
+    principal: z.string().trim().min(1).max(512),
+    cardId: SupportPassportMemoryIdSchema,
+    expectedRevision: z.string().regex(/^[a-f0-9]{64}$/),
+  })
+  .strict();
+
+export const SupportPassportReplaceCardInputSchema = SupportPassportCardMutationInputSchema.extend({
+  title: SupportPassportCardTitleSchema,
+  statement: z.string().trim().min(1).max(500),
+  category: SupportPassportCardCategorySchema,
+  reviewBy: IsoTimestampSchema,
+}).strict();
+
+export type SupportPassportCard = z.infer<typeof SupportPassportCardSchema>;
+export type SupportPassportCardCategory = z.infer<typeof SupportPassportCardCategorySchema>;
+export type SupportPassportCardStatus = z.infer<typeof SupportPassportCardStatusSchema>;
+export type SupportPassportManualDraftInput = z.input<typeof SupportPassportManualDraftInputSchema>;
+export type SupportPassportCardMutationInput = z.input<typeof SupportPassportCardMutationInputSchema>;
+export type SupportPassportReplaceCardInput = z.input<typeof SupportPassportReplaceCardInputSchema>;
+
+type RevisionFields = Omit<SupportPassportCard, "revision">;
+
+export function computeSupportPassportCardRevision(fields: RevisionFields): string {
+  const canonicalFields = {
+    cardId: fields.cardId,
+    category: fields.category,
+    reviewBy: fields.reviewBy,
+    statement: fields.statement,
+    status: fields.status,
+    title: fields.title,
+    updatedAt: fields.updatedAt,
+  };
+  return createHash("sha256").update(JSON.stringify(canonicalFields)).digest("hex");
+}

package/src/support-passport/errors.ts

@@ -0,0 +1,24 @@
+export type SupportPassportErrorCode =
+  | "card_data_invalid"
+  | "card_not_found"
+  | "grant_expired"
+  | "grant_gone"
+  | "grant_not_found"
+  | "grant_stale"
+  | "invalid_card_status"
+  | "invalid_input"
+  | "revision_conflict"
+  | "state_conflict"
+  | "storage_conflict";
+
+export class SupportPassportError extends Error {
+  readonly code: SupportPassportErrorCode;
+  readonly status: number;
+
+  constructor(code: SupportPassportErrorCode, message: string, status: number) {
+    super(message);
+    this.name = "SupportPassportError";
+    this.code = code;
+    this.status = status;
+  }
+}

package/src/support-passport/grant-contracts.ts

@@ -0,0 +1,139 @@
+import { z } from "zod";
+
+import { parseIsoOffsetTimestamp } from "../utils/iso-timestamp.js";
+import {
+  SupportPassportCardCategorySchema,
+  SupportPassportMemoryIdSchema,
+  SupportPassportNamespaceSchema,
+} from "./contracts.js";
+
+const IsoTimestampSchema = z
+  .string()
+  .datetime({ offset: true })
+  .refine((value) => parseIsoOffsetTimestamp(value) !== null, "timestamp must be a real date");
+const RevisionSchema = z.string().regex(/^[a-f0-9]{64}$/);
+const GrantIdSchema = z
+  .string()
+  .uuid()
+  .transform((value) => value.toLowerCase());
+
+export const SupportPassportGrantCardRefSchema = z
+  .object({
+    cardId: SupportPassportMemoryIdSchema,
+    revision: RevisionSchema,
+  })
+  .strict();
+
+export const SupportPassportGrantStateSchema = z
+  .object({
+    schemaVersion: z.literal(1),
+    stateVersion: z.number().int().positive(),
+    grantId: GrantIdSchema,
+    namespace: SupportPassportNamespaceSchema,
+    principalHash: RevisionSchema,
+    ownerLockKey: RevisionSchema,
+    secretHash: RevisionSchema,
+    cards: z.array(SupportPassportGrantCardRefSchema).min(1).max(8),
+    createdAt: IsoTimestampSchema,
+    expiresAt: IsoTimestampSchema,
+    revokedAt: IsoTimestampSchema.optional(),
+  })
+  .strict()
+  .superRefine((grant, ctx) => {
+    const ids = new Set<string>();
+    for (const [index, card] of grant.cards.entries()) {
+      if (ids.has(card.cardId)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: "card IDs must be unique",
+          path: ["cards", index, "cardId"],
+        });
+      }
+      ids.add(card.cardId);
+    }
+    if (Date.parse(grant.expiresAt) <= Date.parse(grant.createdAt)) {
+      ctx.addIssue({ code: z.ZodIssueCode.custom, message: "expiresAt must follow createdAt", path: ["expiresAt"] });
+    }
+  });
+
+export const SupportPassportCreateGrantInputSchema = z
+  .object({
+    principal: z.string().trim().min(1).max(512),
+    cards: z.array(SupportPassportGrantCardRefSchema).min(1).max(8),
+    expiresAt: IsoTimestampSchema,
+  })
+  .strict()
+  .superRefine((input, ctx) => {
+    const ids = new Set<string>();
+    for (const [index, card] of input.cards.entries()) {
+      if (ids.has(card.cardId)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: "card IDs must be unique",
+          path: ["cards", index, "cardId"],
+        });
+      }
+      ids.add(card.cardId);
+    }
+  });
+
+export const SupportPassportOwnerGrantSchema = z
+  .object({
+    grantId: GrantIdSchema,
+    stateVersion: z.number().int().positive(),
+    cards: z.array(SupportPassportGrantCardRefSchema).min(1).max(8),
+    createdAt: IsoTimestampSchema,
+    expiresAt: IsoTimestampSchema,
+    revokedAt: IsoTimestampSchema.optional(),
+    status: z.enum(["active", "expired", "revoked"]),
+  })
+  .strict();
+
+export const SupportPassportCreatedGrantSchema = z
+  .object({
+    grant: SupportPassportOwnerGrantSchema,
+    secret: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+  })
+  .strict();
+
+export const SupportPassportPublicCardSchema = z
+  .object({
+    cardId: SupportPassportMemoryIdSchema,
+    title: z.string().trim().min(1).max(80),
+    statement: z.string().trim().min(1).max(500),
+    category: SupportPassportCardCategorySchema,
+    updatedAt: IsoTimestampSchema,
+  })
+  .strict();
+
+export const SupportPassportPublicGuideSchema = z
+  .object({
+    schemaVersion: z.literal(1),
+    grantId: GrantIdSchema,
+    expiresAt: IsoTimestampSchema,
+    updatedAt: IsoTimestampSchema,
+    cards: z.array(SupportPassportPublicCardSchema).min(1).max(8),
+  })
+  .strict();
+
+export const SupportPassportRevokeGrantInputSchema = z
+  .object({
+    principal: z.string().trim().min(1).max(512),
+    grantId: GrantIdSchema,
+    expectedStateVersion: z.number().int().positive().optional(),
+  })
+  .strict();
+
+export const SupportPassportListGrantsInputSchema = z
+  .object({
+    principal: z.string().trim().min(1).max(512),
+  })
+  .strict();
+
+export type SupportPassportGrantCardRef = z.infer<typeof SupportPassportGrantCardRefSchema>;
+export type SupportPassportGrantState = z.infer<typeof SupportPassportGrantStateSchema>;
+export type SupportPassportCreateGrantInput = z.input<typeof SupportPassportCreateGrantInputSchema>;
+export type SupportPassportOwnerGrant = z.infer<typeof SupportPassportOwnerGrantSchema>;
+export type SupportPassportCreatedGrant = z.infer<typeof SupportPassportCreatedGrantSchema>;
+export type SupportPassportPublicGuide = z.infer<typeof SupportPassportPublicGuideSchema>;
+export type SupportPassportRevokeGrantInput = z.input<typeof SupportPassportRevokeGrantInputSchema>;

package/src/support-passport/grant-service-cache.test.ts

@@ -0,0 +1,148 @@
+import assert from "node:assert/strict";
+import { mkdir, mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import type { StorageManager } from "../index.js";
+import type { MemoryFile } from "../types.js";
+import { computeSupportPassportOwnerKey, projectSupportPassportCard } from "./card-projection.js";
+import { SupportPassportError } from "./errors.js";
+import type { SupportPassportGrantState } from "./grant-contracts.js";
+import { SupportPassportGrantService } from "./grant-service.js";
+import type { SupportPassportGrantStore } from "./grant-store.js";
+
+function supportCardMemory(): MemoryFile {
+  return {
+    path: path.resolve(import.meta.dirname, "fixtures", "support-card.md"),
+    content: "Offer me a quiet place and time.",
+    frontmatter: {
+      id: "support-card-1",
+      category: "preference",
+      source: "support-passport",
+      confidence: 1,
+      confidenceTier: "explicit",
+      created: "2026-08-11T12:00:00.000Z",
+      updated: "2026-08-11T12:00:00.000Z",
+      status: "active",
+      tags: ["support-passport-card"],
+      structuredAttributes: {
+        "support-passport-namespace": "alice",
+        "support-passport-owner": computeSupportPassportOwnerKey("owner:alice"),
+        "support-passport-title": "Quiet space",
+        "support-passport-category": "environment",
+        "support-passport-order": "0",
+        "support-passport-review-by": "2026-09-01T12:00:00.000Z",
+        "support-passport-source-ids": "source-1",
+      },
+    },
+  } as MemoryFile;
+}
+
+test("card snapshots match the storage cache freshness window", async () => {
+  let nowMs = Date.parse("2026-08-11T12:00:00.000Z");
+  let diskMemories = [supportCardMemory()];
+  let cachedMemories: MemoryFile[] | undefined;
+  let cacheLoadedAt = 0;
+  let calls = 0;
+  let diskReads = 0;
+  const storage = {
+    getCorpusScanVersion: () => 1,
+    hotCacheKeyId: () => "stable",
+    hotCacheTtlMs: () => 60_000,
+    isHotCacheEnabled: () => true,
+    readAllMemories: async () => {
+      calls += 1;
+      if (cachedMemories && nowMs - cacheLoadedAt <= 60_000) return cachedMemories;
+      diskReads += 1;
+      cachedMemories = diskMemories;
+      cacheLoadedAt = nowMs;
+      return cachedMemories;
+    },
+  } as unknown as StorageManager;
+  const service = new SupportPassportGrantService({
+    grantStore: {} as SupportPassportGrantStore,
+    resolveOwner: async (principal) => ({ principal, namespace: "alice", storage }),
+    resolveNamespace: async () => storage,
+    now: () => new Date(nowMs),
+  });
+  const inspected = service as unknown as {
+    readStoredCardSnapshot(
+      storage: StorageManager,
+      namespace?: string,
+      ownerKey?: string
+    ): Promise<{ cardsById: ReadonlyMap<string, unknown> }>;
+  };
+  const ownerKey = computeSupportPassportOwnerKey("owner:alice");
+
+  assert.equal((await inspected.readStoredCardSnapshot(storage, "alice", ownerKey)).cardsById.size, 1);
+  diskMemories = [];
+  nowMs += 1_001;
+  assert.equal((await inspected.readStoredCardSnapshot(storage, "alice", ownerKey)).cardsById.size, 1);
+  assert.equal(calls, 2);
+  assert.equal(diskReads, 1);
+  nowMs += 59_000;
+
+  assert.equal((await inspected.readStoredCardSnapshot(storage, "alice", ownerKey)).cardsById.size, 0);
+  assert.equal(calls, 3);
+  assert.equal(diskReads, 2);
+});
+
+test("guide assembly rechecks snapshot age after owner-lock delay", async () => {
+  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-cache-"));
+  try {
+    await mkdir(path.join(root, "state"), { recursive: true });
+    let nowMs = Date.parse("2026-08-11T12:00:00.000Z");
+    let memories = [supportCardMemory()];
+    const projected = projectSupportPassportCard(memories[0]);
+    assert.ok(projected);
+    const state: SupportPassportGrantState = {
+      schemaVersion: 1,
+      stateVersion: 1,
+      grantId: "00000000-0000-4000-8000-000000000001",
+      namespace: "alice",
+      principalHash: computeSupportPassportOwnerKey("owner:alice"),
+      ownerLockKey: "a".repeat(64),
+      secretHash: "b".repeat(64),
+      cards: [{ cardId: projected.card.cardId, revision: projected.card.revision }],
+      createdAt: "2026-08-11T12:00:00.000Z",
+      expiresAt: "2026-08-11T13:00:00.000Z",
+    };
+    const storage = {
+      dir: root,
+      getCorpusScanVersion: () => 1,
+      hotCacheKeyId: () => "stable",
+      hotCacheTtlMs: () => 1_000,
+      isHotCacheEnabled: () => true,
+      readAllMemories: async () => memories,
+    } as unknown as StorageManager;
+    const grantStore = {
+      authenticate: async () => state,
+      withAuthenticatedGrant: async <T>(
+        _grantId: string,
+        _secret: string,
+        task: (current: SupportPassportGrantState) => Promise<T>,
+        beforeReturn?: (current: SupportPassportGrantState) => Promise<void>
+      ): Promise<T> => {
+        nowMs += 1_001;
+        memories = [];
+        const result = await task(state);
+        await beforeReturn?.(state);
+        return result;
+      },
+    } as unknown as SupportPassportGrantStore;
+    const service = new SupportPassportGrantService({
+      grantStore,
+      resolveOwner: async (principal) => ({ principal, namespace: "alice", storage }),
+      resolveNamespace: async () => storage,
+      now: () => new Date(nowMs),
+    });
+
+    await assert.rejects(
+      service.readGrant({ grantId: state.grantId, secret: "secret" }),
+      (error: unknown) => error instanceof SupportPassportError && error.code === "grant_stale"
+    );
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/src/support-passport/grant-service-cancellation.test.ts

@@ -0,0 +1,81 @@
+import assert from "node:assert/strict";
+import { mkdir, mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import type { StorageManager } from "../index.js";
+import type { MemoryFile } from "../types.js";
+import { computeSupportPassportOwnerKey, projectSupportPassportCard } from "./card-projection.js";
+import { SupportPassportGrantService } from "./grant-service.js";
+import type { SupportPassportGrantStore } from "./grant-store.js";
+
+test("grant creation checks cancellation again before commit", async () => {
+  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-cancel-"));
+  try {
+    await mkdir(path.join(root, "state"), { recursive: true });
+    const memory = {
+      path: path.join(root, "preferences", "support-card.md"),
+      content: "Offer me a quiet place and time.",
+      frontmatter: {
+        id: "support-card-1",
+        category: "preference",
+        source: "support-passport",
+        confidence: 1,
+        confidenceTier: "explicit",
+        created: "2026-08-11T12:00:00.000Z",
+        updated: "2026-08-11T12:00:00.000Z",
+        status: "active",
+        tags: ["support-passport-card"],
+        structuredAttributes: {
+          "support-passport-namespace": "alice",
+          "support-passport-owner": computeSupportPassportOwnerKey("owner:alice"),
+          "support-passport-title": "Quiet space",
+          "support-passport-category": "environment",
+          "support-passport-order": "0",
+          "support-passport-review-by": "2026-09-01T12:00:00.000Z",
+          "support-passport-source-ids": "source-1",
+        },
+      },
+    } as MemoryFile;
+    const projected = projectSupportPassportCard(memory);
+    assert.ok(projected);
+    const storage = {
+      dir: root,
+      readAllMemories: async () => [memory],
+      getCorpusScanVersion: () => 1,
+      hotCacheKeyId: () => "owner-cache",
+    } as unknown as StorageManager;
+    const controller = new AbortController();
+    let committed = false;
+    const grantStore = {
+      create: async (_input: unknown, hooks: { beforeCommit?: () => Promise<void> }) => {
+        controller.abort();
+        await hooks.beforeCommit?.();
+        committed = true;
+        throw new Error("commit should not run");
+      },
+    } as unknown as SupportPassportGrantStore;
+    const service = new SupportPassportGrantService({
+      grantStore,
+      resolveOwner: async (principal) => ({ principal, namespace: "alice", storage }),
+      resolveNamespace: async () => storage,
+      now: () => new Date("2026-08-11T12:00:00.000Z"),
+    });
+
+    await assert.rejects(
+      service.createGrant(
+        {
+          principal: "owner:alice",
+          cards: [{ cardId: projected.card.cardId, revision: projected.card.revision }],
+          expiresAt: "2026-08-11T13:00:00.000Z",
+        },
+        { signal: controller.signal }
+      ),
+      (error: unknown) => error instanceof Error && error.name === "AbortError"
+    );
+    assert.equal(committed, false);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});