@remnic/core 9.54.4 → 9.54.6

package/src/support-passport/access-http.ts

@@ -0,0 +1,172 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+
+import { type OperationName, getOperation } from "../access-boundary.js";
+import type { EngramAccessService } from "../access-service.js";
+import { SupportPassportError } from "./errors.js";
+import { SupportPassportOwnerCreateGrantRequestSchema } from "./grant-contracts.js";
+
+export interface SupportPassportOwnerHttpDependencies {
+  req: IncomingMessage;
+  res: ServerResponse;
+  pathname: string;
+  hasQuery: boolean;
+  service: EngramAccessService;
+  principal?: string;
+  abortSignal: AbortSignal;
+  readJsonBody(): Promise<Record<string, unknown>>;
+  respondJson(status: number, payload: unknown): void;
+  reserveWriteRateLimitSlot(): { commit(): void; release(): void };
+}
+
+const OWNER_ROOT = "/engram/v1/support-passport";
+
+export const SUPPORT_PASSPORT_OWNER_HTTP_ROUTES = [
+  { method: "GET", pathname: `${OWNER_ROOT}/cards`, operation: "support_passport_cards_list" },
+  { method: "POST", pathname: `${OWNER_ROOT}/drafts`, operation: "support_passport_draft_create" },
+  { method: "POST", pathname: `${OWNER_ROOT}/drafts/generate`, operation: "support_passport_drafts_generate" },
+  { method: "GET", pathname: `${OWNER_ROOT}/grants`, operation: "support_passport_grants_list" },
+  { method: "POST", pathname: `${OWNER_ROOT}/grants`, operation: "support_passport_grant_create" },
+  { method: "GET", pathname: `${OWNER_ROOT}/memories/:id`, operation: "support_passport_memory_preview" },
+  { method: "PUT", pathname: `${OWNER_ROOT}/cards/:id`, operation: "support_passport_card_replace" },
+  { method: "POST", pathname: `${OWNER_ROOT}/cards/:id/approve`, operation: "support_passport_card_approve" },
+  { method: "POST", pathname: `${OWNER_ROOT}/cards/:id/reject`, operation: "support_passport_card_reject" },
+  { method: "POST", pathname: `${OWNER_ROOT}/cards/:id/withdraw`, operation: "support_passport_card_withdraw" },
+  { method: "POST", pathname: `${OWNER_ROOT}/grants/:id/revoke`, operation: "support_passport_grant_revoke" },
+] as const satisfies ReadonlyArray<{ method: string; pathname: string; operation: OperationName }>;
+
+function decodeId(value: string, label: string): string {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    throw new SupportPassportError("invalid_input", `${label} is invalid.`, 400);
+  }
+}
+
+function closeUnreadRequestAfterResponse(req: IncomingMessage, res: ServerResponse): void {
+  const contentLength = req.headers["content-length"];
+  const declaresBody =
+    req.headers["transfer-encoding"] !== undefined ||
+    (contentLength !== undefined && contentLength !== "0");
+  if (!declaresBody || req.readableEnded || req.destroyed) return;
+  res.shouldKeepAlive = false;
+  res.setHeader("connection", "close");
+  res.once("finish", () => req.destroy());
+}
+
+async function runOperation(
+  name: OperationName,
+  input: Record<string, unknown>,
+  dependencies: SupportPassportOwnerHttpDependencies,
+  recordWriteCommit?: () => void
+): Promise<unknown> {
+  const operation = getOperation(name);
+  if (!operation) throw new Error(`access-boundary: operation not registered: ${name}`);
+  const output = (await operation.run(input, {
+    service: dependencies.service,
+    authenticatedPrincipal: dependencies.principal,
+    abortSignal: dependencies.abortSignal,
+    ...(recordWriteCommit ? { hooks: { recordWriteCommit } } : {}),
+  })) as { result: unknown };
+  return output.result;
+}
+
+async function runWrite(
+  name: OperationName,
+  input: Record<string, unknown>,
+  dependencies: SupportPassportOwnerHttpDependencies
+): Promise<unknown> {
+  const writeQuota = dependencies.reserveWriteRateLimitSlot();
+  try {
+    const result = await runOperation(name, input, dependencies, writeQuota.commit);
+    writeQuota.commit();
+    return result;
+  } catch (error) {
+    writeQuota.release();
+    throw error;
+  }
+}
+
+export async function handleSupportPassportOwnerHttp(
+  dependencies: SupportPassportOwnerHttpDependencies
+): Promise<boolean> {
+  const { req, pathname } = dependencies;
+  try {
+    let operation: OperationName | undefined;
+    let input: Record<string, unknown> = {};
+    let quotaLimitedWrite = false;
+
+    if (req.method === "GET" && pathname === `${OWNER_ROOT}/cards`) {
+      operation = "support_passport_cards_list";
+    } else if (req.method === "POST" && pathname === `${OWNER_ROOT}/drafts`) {
+      operation = "support_passport_draft_create";
+      quotaLimitedWrite = true;
+    } else if (req.method === "POST" && pathname === `${OWNER_ROOT}/drafts/generate`) {
+      operation = "support_passport_drafts_generate";
+      quotaLimitedWrite = true;
+    } else if (pathname === `${OWNER_ROOT}/grants` && req.method === "GET") {
+      operation = "support_passport_grants_list";
+    } else if (pathname === `${OWNER_ROOT}/grants` && req.method === "POST") {
+      operation = "support_passport_grant_create";
+      quotaLimitedWrite = true;
+    } else {
+      const memoryMatch = new RegExp(`^${OWNER_ROOT}/memories/([^/]+)$`).exec(pathname);
+      const cardMatch = new RegExp(`^${OWNER_ROOT}/cards/([^/]+)(?:/(approve|reject|withdraw))?$`).exec(pathname);
+      const grantMatch = new RegExp(`^${OWNER_ROOT}/grants/([^/]+)/revoke$`).exec(pathname);
+      if (memoryMatch && req.method === "GET") {
+        operation = "support_passport_memory_preview";
+        input.memoryId = decodeId(memoryMatch[1] ?? "", "memoryId");
+      } else if (cardMatch && req.method === "PUT" && !cardMatch[2]) {
+        operation = "support_passport_card_replace";
+        input.cardId = decodeId(cardMatch[1] ?? "", "cardId");
+        quotaLimitedWrite = true;
+      } else if (cardMatch && req.method === "POST" && cardMatch[2]) {
+        operation = `support_passport_card_${cardMatch[2]}` as OperationName;
+        input.cardId = decodeId(cardMatch[1] ?? "", "cardId");
+        quotaLimitedWrite = true;
+      } else if (grantMatch && req.method === "POST") {
+        operation = "support_passport_grant_revoke";
+        input.grantId = decodeId(grantMatch[1] ?? "", "grantId");
+        quotaLimitedWrite = true;
+      }
+    }
+
+    if (!operation) return false;
+    dependencies.res.setHeader("cache-control", "private, no-store");
+    dependencies.res.setHeader("vary", "Authorization");
+    if (dependencies.hasQuery) {
+      throw new SupportPassportError("invalid_input", "Support passport routes do not accept query values.", 400);
+    }
+    if (req.method !== "GET") {
+      const body = await dependencies.readJsonBody();
+      for (const pathField of Object.keys(input)) {
+        if (Object.hasOwn(body, pathField)) {
+          throw new SupportPassportError("invalid_input", `${pathField} belongs in the URL path.`, 400);
+        }
+      }
+      input = { ...input, ...body };
+    }
+    if (operation === "support_passport_drafts_generate" && !Object.hasOwn(input, "sourceMemoryRevisions")) {
+      throw new SupportPassportError("invalid_input", "Review the selected notes again before drafting.", 400);
+    }
+    if (operation === "support_passport_grant_create") {
+      const grant = SupportPassportOwnerCreateGrantRequestSchema.safeParse(input);
+      if (!grant.success) throw new SupportPassportError("invalid_input", "The share link request is invalid.", 400);
+      input = {
+        cardIds: grant.data.cardIds,
+        cardRevisions: grant.data.cardRevisions,
+        ...(grant.data.expiresAt !== undefined
+          ? { expiresAt: grant.data.expiresAt }
+          : { durationMs: grant.data.durationMs }),
+      };
+    }
+    const result = quotaLimitedWrite
+      ? await runWrite(operation, input, dependencies)
+      : await runOperation(operation, input, dependencies);
+    dependencies.respondJson(200, result);
+  } catch (error) {
+    if (!(error instanceof SupportPassportError)) throw error;
+    closeUnreadRequestAfterResponse(req, dependencies.res);
+    dependencies.respondJson(error.status, { error: error.message, code: error.code });
+  }
+  return true;
+}

package/src/support-passport/access-operations.ts

@@ -0,0 +1,272 @@
+import { z } from "zod";
+
+import { defineOperation } from "../access-boundary.js";
+import {
+  SupportPassportCardCategorySchema,
+  SupportPassportMemoryIdSchema,
+  SupportPassportSourceMemoryIdSchema,
+} from "./contracts.js";
+import { SupportPassportCreateGrantRequestSchema } from "./grant-contracts.js";
+
+const IsoTimestampSchema = z.string().datetime({ offset: true });
+const RevisionSchema = z.string().regex(/^[a-f0-9]{64}$/);
+const ReasonCodeSchema = z
+  .string()
+  .trim()
+  .min(1)
+  .max(64)
+  .regex(/^[a-z0-9-]+$/);
+const GrantIdSchema = z
+  .string()
+  .trim()
+  .min(1)
+  .max(128)
+  .regex(/^[A-Za-z0-9_-]+$/);
+const EmptySchema = z.object({}).strict();
+
+const ManualDraftSchema = z
+  .object({
+    title: z.string().trim().min(1).max(80),
+    statement: z.string().trim().min(1).max(500),
+    category: SupportPassportCardCategorySchema,
+    reviewBy: IsoTimestampSchema,
+  })
+  .strict();
+
+const GenerateDraftsSchema = z
+  .object({
+    sourceMemoryIds: z.array(SupportPassportSourceMemoryIdSchema).min(1).max(20),
+    sourceMemoryRevisions: z
+      .array(z.object({ memoryId: SupportPassportSourceMemoryIdSchema, revision: RevisionSchema }).strict())
+      .min(1)
+      .max(20),
+    consent: z.literal(true),
+  })
+  .strict()
+  .superRefine((input, ctx) => {
+    if (new Set(input.sourceMemoryIds).size !== input.sourceMemoryIds.length) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "source memory IDs must be unique",
+        path: ["sourceMemoryIds"],
+      });
+    }
+    const revisionIds = input.sourceMemoryRevisions.map((source) => source.memoryId);
+    if (
+      new Set(revisionIds).size !== revisionIds.length ||
+      revisionIds.length !== input.sourceMemoryIds.length ||
+      input.sourceMemoryIds.some((memoryId) => !revisionIds.includes(memoryId))
+    ) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "source memory revisions must match the selected memory IDs",
+        path: ["sourceMemoryRevisions"],
+      });
+    }
+  });
+
+const ReplaceCardSchema = ManualDraftSchema.extend({
+  cardId: SupportPassportMemoryIdSchema,
+  expectedRevision: RevisionSchema,
+}).strict();
+
+const CardMutationSchema = z
+  .object({
+    cardId: SupportPassportMemoryIdSchema,
+    expectedRevision: RevisionSchema,
+    reasonCode: ReasonCodeSchema,
+  })
+  .strict();
+
+const RevokeGrantSchema = z
+  .object({
+    grantId: GrantIdSchema,
+    expectedVersion: z.number().int().positive(),
+  })
+  .strict();
+
+const PublicGrantSchema = z
+  .object({
+    grantId: GrantIdSchema,
+    secret: z.string().regex(/^[A-Za-z0-9_-]{32,256}$/),
+  })
+  .strict();
+
+const AskGrantSchema = PublicGrantSchema.extend({
+  question: z.string().trim().min(1).max(500),
+}).strict();
+
+function principal(value: string | undefined): string {
+  return value ?? "";
+}
+
+export const supportPassportMemoryPreviewOperation = defineOperation({
+  name: "support_passport_memory_preview",
+  description: "Preview one owner memory and bind it to a support-card consent revision.",
+  schema: z.object({ memoryId: SupportPassportSourceMemoryIdSchema }).strict(),
+  handler: async (input, ctx) => ({
+    result: await ctx.service.supportPassportPreviewMemory(principal(ctx.authenticatedPrincipal), input.memoryId),
+  }),
+});
+
+export const supportPassportCardsListOperation = defineOperation({
+  name: "support_passport_cards_list",
+  description: "List the authenticated owner's support cards.",
+  schema: EmptySchema,
+  handler: async (_input, ctx) => ({
+    result: { cards: await ctx.service.supportPassportListCards(principal(ctx.authenticatedPrincipal)) },
+  }),
+});
+
+export const supportPassportDraftCreateOperation = defineOperation({
+  name: "support_passport_draft_create",
+  description: "Create one support card draft for the authenticated owner.",
+  schema: ManualDraftSchema,
+  handler: async (input, ctx) => ({
+    result: {
+      card: await ctx.service.supportPassportCreateManualDraft(
+        principal(ctx.authenticatedPrincipal),
+        input,
+        {
+          ...(ctx.abortSignal ? { signal: ctx.abortSignal } : {}),
+          ...(ctx.hooks?.recordWriteCommit ? { onCommitted: ctx.hooks.recordWriteCommit } : {}),
+        }
+      ),
+    },
+  }),
+});
+
+export const supportPassportDraftsGenerateOperation = defineOperation({
+  name: "support_passport_drafts_generate",
+  description: "Draft support cards from selected owner memories after explicit consent.",
+  schema: GenerateDraftsSchema,
+  handler: async (input, ctx) => ({
+    result: {
+      cards: await ctx.service.supportPassportGenerateDrafts(principal(ctx.authenticatedPrincipal), {
+        ...input,
+        signal: ctx.abortSignal,
+        ...(ctx.hooks?.recordWriteCommit ? { onCommitted: ctx.hooks.recordWriteCommit } : {}),
+      }),
+    },
+  }),
+});
+
+export const supportPassportCardReplaceOperation = defineOperation({
+  name: "support_passport_card_replace",
+  description: "Replace one support card with a new owner-reviewed draft.",
+  schema: ReplaceCardSchema,
+  handler: async ({ cardId, ...input }, ctx) => ({
+    result: {
+      card: await ctx.service.supportPassportReplaceCard(
+        principal(ctx.authenticatedPrincipal),
+        cardId,
+        input,
+        {
+          ...(ctx.abortSignal ? { signal: ctx.abortSignal } : {}),
+          ...(ctx.hooks?.recordWriteCommit ? { onCommitted: ctx.hooks.recordWriteCommit } : {}),
+        }
+      ),
+    },
+  }),
+});
+
+function defineCardMutation(
+  name: "support_passport_card_approve" | "support_passport_card_reject" | "support_passport_card_withdraw",
+  description: string,
+  run: "supportPassportApproveCard" | "supportPassportRejectCard" | "supportPassportWithdrawCard"
+) {
+  return defineOperation({
+    name,
+    description,
+    schema: CardMutationSchema,
+    handler: async ({ cardId, ...input }, ctx) => ({
+      result: {
+        card: await ctx.service[run](
+          principal(ctx.authenticatedPrincipal),
+          cardId,
+          input,
+          {
+            ...(ctx.abortSignal ? { signal: ctx.abortSignal } : {}),
+            ...(ctx.hooks?.recordWriteCommit ? { onCommitted: ctx.hooks.recordWriteCommit } : {}),
+          }
+        ),
+      },
+    }),
+  });
+}
+
+export const supportPassportCardApproveOperation = defineCardMutation(
+  "support_passport_card_approve",
+  "Approve one pending support card as its authenticated owner.",
+  "supportPassportApproveCard"
+);
+export const supportPassportCardRejectOperation = defineCardMutation(
+  "support_passport_card_reject",
+  "Reject one pending support card as its authenticated owner.",
+  "supportPassportRejectCard"
+);
+export const supportPassportCardWithdrawOperation = defineCardMutation(
+  "support_passport_card_withdraw",
+  "Withdraw one approved support card as its authenticated owner.",
+  "supportPassportWithdrawCard"
+);
+
+export const supportPassportGrantCreateOperation = defineOperation({
+  name: "support_passport_grant_create",
+  description: "Create one timed share link for exact approved support card versions.",
+  schema: SupportPassportCreateGrantRequestSchema,
+  handler: async (input, ctx) => ({
+    result: await ctx.service.supportPassportCreateGrant(
+      principal(ctx.authenticatedPrincipal),
+      input,
+      {
+        ...(ctx.abortSignal ? { signal: ctx.abortSignal } : {}),
+        ...(ctx.hooks?.recordWriteCommit ? { onCommitted: ctx.hooks.recordWriteCommit } : {}),
+      }
+    ),
+  }),
+});
+
+export const supportPassportGrantsListOperation = defineOperation({
+  name: "support_passport_grants_list",
+  description: "List the authenticated owner's support passport share links without secrets.",
+  schema: EmptySchema,
+  handler: async (_input, ctx) => ({
+    result: { grants: await ctx.service.supportPassportListGrants(principal(ctx.authenticatedPrincipal)) },
+  }),
+});
+
+export const supportPassportGrantRevokeOperation = defineOperation({
+  name: "support_passport_grant_revoke",
+  description: "Stop one support passport share link as its authenticated owner.",
+  schema: RevokeGrantSchema,
+  handler: async ({ grantId, ...input }, ctx) => ({
+    result: await ctx.service.supportPassportRevokeGrant(
+      principal(ctx.authenticatedPrincipal),
+      grantId,
+      input,
+      {
+        ...(ctx.abortSignal ? { signal: ctx.abortSignal } : {}),
+        ...(ctx.hooks?.recordWriteCommit ? { onCommitted: ctx.hooks.recordWriteCommit } : {}),
+      }
+    ),
+  }),
+});
+
+export const supportPassportGrantReadOperation = defineOperation({
+  name: "support_passport_grant_read",
+  description: "Read one active support passport share link.",
+  schema: PublicGrantSchema,
+  handler: async ({ grantId, secret }, ctx) => ({
+    result: await ctx.service.supportPassportReadGrant(grantId, secret),
+  }),
+});
+
+export const supportPassportGrantAskOperation = defineOperation({
+  name: "support_passport_grant_ask",
+  description: "Answer one helper question from an active support passport share link.",
+  schema: AskGrantSchema,
+  handler: async ({ grantId, secret, question }, ctx) => ({
+    result: await ctx.service.supportPassportAskGrant(grantId, secret, question, ctx.abortSignal),
+  }),
+});

package/src/support-passport/access-service-base.test.ts

@@ -0,0 +1,193 @@
+import assert from "node:assert/strict";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { EngramAccessForbiddenError } from "../access-errors.js";
+import { tokenCapabilityStore } from "../access-token-capabilities.js";
+import { parseConfig } from "../config.js";
+import { StorageManager } from "../storage.js";
+import { SupportPassportAccessServiceBase } from "./access-service-base.js";
+import type { SupportPassportModelRoute } from "./model-adapter.js";
+
+test("support passport stays disabled when a partial host config omits its settings", async () => {
+  class TestService extends SupportPassportAccessServiceBase {
+    readonly configRef = {} as ReturnType<typeof parseConfig>;
+    readonly localLlmRef = null;
+
+    async getWritableStorageForNamespace(): Promise<never> {
+      throw new Error("not used");
+    }
+
+    async getStorageForResolvedNamespace(): Promise<never> {
+      throw new Error("not used");
+    }
+  }
+
+  const service = new TestService();
+  assert.equal(service.supportPassportEnabled, false);
+  await assert.rejects(service.supportPassportListCards("owner:alice"), /Support passport is disabled/);
+  await assert.rejects(service.supportPassportReadGrant("grant", "secret"), /share link was not found/);
+});
+
+test("support passport stays unavailable when private file pinning is unsupported", async () => {
+  class TestService extends SupportPassportAccessServiceBase {
+    readonly configRef = parseConfig({ supportPassport: { enabled: true } });
+    readonly localLlmRef = null;
+
+    override get supportPassportPlatformRef(): NodeJS.Platform {
+      return "win32";
+    }
+
+    async getWritableStorageForNamespace(): Promise<never> {
+      throw new Error("owner resolution must not run");
+    }
+
+    async getStorageForResolvedNamespace(): Promise<never> {
+      throw new Error("namespace resolution must not run");
+    }
+  }
+
+  const service = new TestService();
+  assert.equal(service.supportPassportEnabled, false);
+  await assert.rejects(service.supportPassportListCards("owner:alice"), /Support passport is disabled/);
+  await assert.rejects(service.supportPassportReadGrant("grant", "secret"), /share link was not found/);
+});
+
+test("support passport owner operations enforce the presenting token namespace", async () => {
+  StorageManager.clearAllStaticCaches();
+  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-scope-"));
+  try {
+    const storage = new StorageManager(path.join(root, "owner"));
+    await storage.ensureDirectories();
+    class TestService extends SupportPassportAccessServiceBase {
+      readonly configRef = parseConfig({
+        memoryDir: root,
+        defaultNamespace: "default",
+        supportPassport: { enabled: true },
+      });
+      readonly localLlmRef = null;
+
+      async getWritableStorageForNamespace(_namespace?: string, principal?: string) {
+        return { principal: principal ?? "system", namespace: "owner", storage };
+      }
+
+      async getStorageForResolvedNamespace() {
+        return storage;
+      }
+    }
+    const service = new TestService();
+
+    await assert.rejects(
+      tokenCapabilityStore.run({ version: 1, namespaces: ["other"] }, () =>
+        service.supportPassportListCards("owner:alice")
+      ),
+      EngramAccessForbiddenError
+    );
+    assert.deepEqual(
+      await tokenCapabilityStore.run({ version: 1, namespaces: ["owner"] }, () =>
+        service.supportPassportListCards("owner:alice")
+      ),
+      []
+    );
+  } finally {
+    StorageManager.clearAllStaticCaches();
+    await rm(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 20 });
+  }
+});
+
+test("support passport preserves every configured default namespace identity", async () => {
+  StorageManager.clearAllStaticCaches();
+  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-default-namespace-"));
+  try {
+    const storage = new StorageManager(path.join(root, "owner"));
+    await storage.ensureDirectories();
+    class TestService extends SupportPassportAccessServiceBase {
+      readonly configRef = parseConfig({
+        memoryDir: root,
+        defaultNamespace: "team../support\\care]primary",
+        supportPassport: { enabled: true },
+      });
+      readonly localLlmRef = null;
+
+      async getWritableStorageForNamespace(_namespace?: string, principal?: string) {
+        return {
+          principal: principal ?? "system",
+          namespace: this.configRef.defaultNamespace,
+          storage,
+        };
+      }
+
+      async getStorageForResolvedNamespace() {
+        return storage;
+      }
+    }
+
+    assert.deepEqual(await new TestService().supportPassportListCards("owner:alice"), []);
+  } finally {
+    StorageManager.clearAllStaticCaches();
+    await rm(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 20 });
+  }
+});
+
+test("support passport access uses a host-injected gateway route without a direct API key", async () => {
+  StorageManager.clearAllStaticCaches();
+  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-gateway-"));
+  try {
+    const storage = new StorageManager(path.join(root, "owner"));
+    await storage.ensureDirectories();
+    const source = await storage.writeMemory("preference", "Tell me before plans change.", { source: "test" });
+    const route: SupportPassportModelRoute = {
+      kind: "gateway",
+      invoke: async () => ({
+        modelUsed: "gateway/local-model",
+        content: JSON.stringify({
+          cards: [
+            {
+              title: "Plan changes",
+              statement: "Tell me before plans change.",
+              category: "transitions",
+              sourceMemoryIds: [source.id],
+            },
+          ],
+        }),
+      }),
+    };
+    class TestService extends SupportPassportAccessServiceBase {
+      readonly configRef = parseConfig({
+        memoryDir: root,
+        modelSource: "gateway",
+        openaiApiKey: false,
+        supportPassport: { enabled: true },
+      });
+      readonly localLlmRef = null;
+      override get supportPassportGatewayRouteRef() {
+        return route;
+      }
+
+      async getWritableStorageForNamespace(_namespace?: string, principal?: string) {
+        return { principal: principal ?? "system", namespace: "owner", storage };
+      }
+
+      async getStorageForResolvedNamespace() {
+        return storage;
+      }
+    }
+    const service = new TestService();
+    const preview = await service.supportPassportPreviewMemory("owner:alice", source.id);
+    assert.equal(preview.found, true);
+    if (!preview.found) throw new Error("source preview was not found");
+
+    const cards = await service.supportPassportGenerateDrafts("owner:alice", {
+      sourceMemoryIds: [source.id],
+      sourceMemoryRevisions: [{ memoryId: source.id, revision: preview.memory.revision }],
+      consent: true,
+    });
+
+    assert.equal(cards[0]?.title, "Plan changes");
+  } finally {
+    StorageManager.clearAllStaticCaches();
+    await rm(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 20 });
+  }
+});