@remnic/core 9.54.5 → 9.54.7

package/src/support-passport/generated-batch.ts

@@ -0,0 +1,338 @@
+import path from "node:path";
+
+import { z } from "zod";
+
+import type { StorageManager } from "../index.js";
+import type { MemoryFile } from "../types.js";
+import {
+  type StoredSupportPassportCard,
+  computeSupportPassportOwnerKey,
+  projectSupportPassportCard,
+} from "./card-projection.js";
+import { SupportPassportNamespaceSchema } from "./contracts.js";
+import { SupportPassportError } from "./errors.js";
+import {
+  ensurePrivateDirectoryNoFollow,
+  ensurePrivateDirectoryTreeNoFollow,
+  readPrivateFileNoFollow,
+  removePrivateFilesNoFollow,
+  writePrivateFileAtomicallyNoFollow,
+} from "./private-file.js";
+
+const BatchIdSchema = z
+  .string()
+  .uuid()
+  .transform((value) => value.toLowerCase());
+const GeneratedBatchMarkerSchema = z
+  .object({
+    schemaVersion: z.literal(1),
+    batchId: BatchIdSchema,
+    size: z.number().int().min(1).max(8),
+    namespace: SupportPassportNamespaceSchema,
+    owner: z.string().regex(/^[a-f0-9]{64}$/),
+    complete: z.boolean(),
+  })
+  .strict();
+
+export type GeneratedBatchMarker = z.infer<typeof GeneratedBatchMarkerSchema>;
+
+export interface GeneratedBatchContext {
+  storage: StorageManager;
+  principal: string;
+  namespace: string;
+  now: () => Date;
+  requireOwnerLock: () => Promise<void>;
+  onCommitted?: () => void;
+}
+
+type GeneratedBatchMarkerWriter = (storage: StorageManager, marker: GeneratedBatchMarker) => Promise<void>;
+
+const BATCH_ERROR = "The generated draft batch state is not safe.";
+
+function batchDirectory(storage: StorageManager): string {
+  return path.join(storage.dir, "state", "support-passport", "generated-batches");
+}
+
+function batchFileName(batchId: string): string {
+  return `${BatchIdSchema.parse(batchId)}.json`;
+}
+
+function batchPath(storage: StorageManager, batchId: string): string {
+  return path.join(batchDirectory(storage), batchFileName(batchId));
+}
+
+function markerFor(context: GeneratedBatchContext, batchId: string, size: number, complete: boolean) {
+  return GeneratedBatchMarkerSchema.parse({
+    schemaVersion: 1,
+    batchId,
+    size,
+    namespace: context.namespace,
+    owner: computeSupportPassportOwnerKey(context.principal),
+    complete,
+  });
+}
+
+function sameOwner(marker: GeneratedBatchMarker, context: GeneratedBatchContext): boolean {
+  return marker.namespace === context.namespace && marker.owner === computeSupportPassportOwnerKey(context.principal);
+}
+
+async function ensureBatchDirectory(storage: StorageManager): Promise<void> {
+  const directory = batchDirectory(storage);
+  await ensurePrivateDirectoryTreeNoFollow(directory, BATCH_ERROR);
+  await ensurePrivateDirectoryNoFollow(storage.dir, directory, BATCH_ERROR);
+}
+
+export async function readSupportPassportGeneratedBatchMarker(
+  storage: StorageManager,
+  batchId: string
+): Promise<GeneratedBatchMarker | null> {
+  const directory = batchDirectory(storage);
+  try {
+    const content = await readPrivateFileNoFollow(directory, batchPath(storage, batchId), BATCH_ERROR, storage.dir);
+    let value: unknown;
+    try {
+      value = JSON.parse(content);
+    } catch {
+      throw new SupportPassportError("card_data_invalid", "The generated draft batch state is invalid.", 500);
+    }
+    const parsed = GeneratedBatchMarkerSchema.safeParse(value);
+    if (!parsed.success || parsed.data.batchId !== BatchIdSchema.parse(batchId)) {
+      throw new SupportPassportError("card_data_invalid", "The generated draft batch state is invalid.", 500);
+    }
+    return parsed.data;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+export async function isSupportPassportGeneratedBatchCommitted(
+  context: GeneratedBatchContext,
+  marker: GeneratedBatchMarker
+): Promise<boolean> {
+  const current = await readSupportPassportGeneratedBatchMarker(context.storage, marker.batchId);
+  return Boolean(current?.complete && sameOwner(current, context) && current.size === marker.size);
+}
+
+async function writeBatchMarker(storage: StorageManager, marker: GeneratedBatchMarker): Promise<void> {
+  const directory = batchDirectory(storage);
+  await writePrivateFileAtomicallyNoFollow(
+    directory,
+    batchPath(storage, marker.batchId),
+    `${JSON.stringify(marker)}\n`,
+    BATCH_ERROR,
+    storage.dir
+  );
+}
+
+async function removeBatchMarker(storage: StorageManager, batchId: string): Promise<void> {
+  await removePrivateFilesNoFollow(batchDirectory(storage), [batchFileName(batchId)], BATCH_ERROR, storage.dir);
+}
+
+function projectOwnedCard(memory: MemoryFile, namespace: string, principal: string): StoredSupportPassportCard | null {
+  const card = projectSupportPassportCard(memory);
+  return card?.namespace === namespace && card.owner === computeSupportPassportOwnerKey(principal) ? card : null;
+}
+
+export async function persistSupportPassportGeneratedBatchMarker(
+  context: GeneratedBatchContext,
+  batchId: string,
+  size: number,
+  writeMarker: GeneratedBatchMarkerWriter = writeBatchMarker
+): Promise<GeneratedBatchMarker> {
+  const marker = markerFor(context, batchId, size, false);
+  await context.requireOwnerLock();
+  await ensureBatchDirectory(context.storage);
+  await writeMarker(context.storage, marker);
+  context.onCommitted?.();
+  return marker;
+}
+
+export async function commitSupportPassportGeneratedBatch(
+  context: GeneratedBatchContext,
+  marker: GeneratedBatchMarker,
+  cards: readonly StoredSupportPassportCard[],
+  writeMarker: GeneratedBatchMarkerWriter = writeBatchMarker
+): Promise<void> {
+  const cardIds = cards.map((card) => card.card.cardId);
+  if (!sameOwner(marker, context) || cards.length !== marker.size || new Set(cardIds).size !== cards.length) {
+    throw new SupportPassportError("storage_conflict", "The generated draft batch is incomplete.", 409);
+  }
+  for (const card of cards) {
+    if (
+      card.namespace !== context.namespace ||
+      card.owner !== computeSupportPassportOwnerKey(context.principal) ||
+      card.card.status !== "pending_review" ||
+      card.generatedBatchId !== marker.batchId ||
+      card.generatedBatchSize !== marker.size
+    ) {
+      throw new SupportPassportError("storage_conflict", "The generated draft batch is incomplete.", 409);
+    }
+  }
+  await context.requireOwnerLock();
+  const committed = { ...marker, complete: true };
+  try {
+    await writeMarker(context.storage, committed);
+  } catch (error) {
+    if (!(await isSupportPassportGeneratedBatchCommitted(context, marker))) throw error;
+  }
+  context.onCommitted?.();
+}
+
+async function rejectGeneratedDraft(context: GeneratedBatchContext, cardId: string): Promise<boolean> {
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    const memory = await context.storage.getMemoryById(cardId);
+    if (!memory) return true;
+    const stored = projectOwnedCard(memory, context.namespace, context.principal);
+    if (!stored) return false;
+    if (stored.card.status === "rejected") return true;
+    if (stored.card.status !== "pending_review") return false;
+    await context.requireOwnerLock();
+    if (
+      await context.storage.writeMemoryFrontmatterIfUnchanged(
+        memory,
+        { status: "rejected", updated: context.now().toISOString() },
+        { actor: context.principal, reasonCode: "draft-batch-failed" }
+      )
+    ) {
+      context.onCommitted?.();
+      return true;
+    }
+  }
+  return false;
+}
+
+export async function rollbackSupportPassportGeneratedBatch(
+  context: GeneratedBatchContext,
+  batchId: string,
+  knownCardIds: readonly string[]
+): Promise<boolean> {
+  const marker = await readSupportPassportGeneratedBatchMarker(context.storage, batchId);
+  if (marker && !sameOwner(marker, context)) return false;
+  if (marker?.complete) return false;
+  const cardIds = new Set(knownCardIds);
+  let scanComplete = true;
+  try {
+    for (const memory of await context.storage.readAllMemories()) {
+      const card = projectOwnedCard(memory, context.namespace, context.principal);
+      if (card?.generatedBatchId === batchId) cardIds.add(card.card.cardId);
+    }
+  } catch {
+    scanComplete = false;
+  }
+  let complete = scanComplete;
+  for (const cardId of cardIds) {
+    try {
+      if (!(await rejectGeneratedDraft(context, cardId))) complete = false;
+    } catch {
+      complete = false;
+    }
+  }
+  if (!complete) return false;
+  try {
+    await removeBatchMarker(context.storage, batchId);
+    context.onCommitted?.();
+  } catch {
+    complete = false;
+  }
+  return complete;
+}
+
+export async function isCommittedGeneratedCard(
+  storage: StorageManager,
+  card: StoredSupportPassportCard,
+  markerCache?: Map<string, GeneratedBatchMarker | null>
+): Promise<boolean> {
+  if (!card.generatedBatchId) return true;
+  let marker = markerCache?.get(card.generatedBatchId);
+  if (!markerCache?.has(card.generatedBatchId)) {
+    marker = await readSupportPassportGeneratedBatchMarker(storage, card.generatedBatchId);
+    markerCache?.set(card.generatedBatchId, marker);
+  }
+  return Boolean(
+    marker?.complete &&
+      marker.size === card.generatedBatchSize &&
+      marker.namespace === card.namespace &&
+      marker.owner === card.owner
+  );
+}
+
+export async function projectCommittedSupportPassportCards(
+  storage: StorageManager,
+  memories: readonly MemoryFile[],
+  namespace: string,
+  principal: string
+): Promise<StoredSupportPassportCard[]> {
+  const projected = memories
+    .map(projectSupportPassportCard)
+    .filter(
+      (card): card is StoredSupportPassportCard =>
+        card?.namespace === namespace && card.owner === computeSupportPassportOwnerKey(principal)
+    );
+  const markers = new Map<string, GeneratedBatchMarker | null>();
+  const committed: StoredSupportPassportCard[] = [];
+  for (const card of projected) {
+    if (await isCommittedGeneratedCard(storage, card, markers)) committed.push(card);
+  }
+  const ids = new Set<string>();
+  for (const card of committed) {
+    if (ids.has(card.card.cardId)) {
+      throw new SupportPassportError("card_data_invalid", "Support card IDs must be unique.", 500);
+    }
+    ids.add(card.card.cardId);
+  }
+  return committed;
+}
+
+export async function readCommittedSupportPassportCards(
+  storage: StorageManager,
+  namespace: string,
+  principal: string
+): Promise<StoredSupportPassportCard[]> {
+  return await projectCommittedSupportPassportCards(
+    storage,
+    await storage.readAllMemories(),
+    namespace,
+    principal
+  );
+}
+
+export async function recoverSupportPassportGeneratedBatches(
+  context: GeneratedBatchContext,
+  memories: readonly MemoryFile[]
+): Promise<void> {
+  const cardsByBatch = new Map<string, StoredSupportPassportCard[]>();
+  for (const memory of memories) {
+    const card = projectOwnedCard(memory, context.namespace, context.principal);
+    if (!card?.generatedBatchId) continue;
+    const cards = cardsByBatch.get(card.generatedBatchId) ?? [];
+    cards.push(card);
+    cardsByBatch.set(card.generatedBatchId, cards);
+  }
+  for (const [batchId, cards] of cardsByBatch) {
+    const marker = await readSupportPassportGeneratedBatchMarker(context.storage, batchId);
+    if (marker?.complete === true && sameOwner(marker, context)) continue;
+    if (!marker) {
+      let recovered = true;
+      for (const card of cards) {
+        if (card.card.status !== "pending_review") continue;
+        try {
+          if (!(await rejectGeneratedDraft(context, card.card.cardId))) recovered = false;
+        } catch {
+          recovered = false;
+        }
+      }
+      if (recovered) continue;
+      throw new SupportPassportError("storage_conflict", "An incomplete generated draft batch could not recover.", 500);
+    }
+    if (
+      !(await rollbackSupportPassportGeneratedBatch(
+        context,
+        batchId,
+        cards.map((card) => card.card.cardId)
+      ))
+    ) {
+      throw new SupportPassportError("storage_conflict", "An incomplete generated draft batch could not recover.", 500);
+    }
+  }
+}

package/src/support-passport/grant-contracts.ts

@@ -60,7 +60,8 @@ export const SupportPassportCreateGrantInputSchema = z
   .object({
     principal: z.string().trim().min(1).max(512),
     cards: z.array(SupportPassportGrantCardRefSchema).min(1).max(8),
-    expiresAt: IsoTimestampSchema,
+    expiresAt: IsoTimestampSchema.optional(),
+    durationMs: z.number().int().min(300_000).max(604_800_000).optional(),
   })
   .strict()
   .superRefine((input, ctx) => {
@@ -75,8 +76,49 @@ export const SupportPassportCreateGrantInputSchema = z
       }
       ids.add(card.cardId);
     }
+    if ((input.expiresAt === undefined) === (input.durationMs === undefined)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "one expiry value is required",
+        path: ["expiresAt"],
+      });
+    }
   });
 
+export const SupportPassportCreateGrantRequestSchema = z
+  .object({
+    cardIds: z.array(SupportPassportMemoryIdSchema).min(1).max(8),
+    cardRevisions: z.array(SupportPassportGrantCardRefSchema).min(1).max(8),
+    expiresAt: IsoTimestampSchema.optional(),
+    durationMs: z.number().int().min(300_000).max(604_800_000).optional(),
+  })
+  .strict()
+  .superRefine((input, ctx) => {
+    const cardIds = new Set(input.cardIds);
+    const revisionIds = new Set(input.cardRevisions.map((card) => card.cardId));
+    if (
+      cardIds.size !== input.cardIds.length ||
+      revisionIds.size !== input.cardRevisions.length ||
+      cardIds.size !== revisionIds.size ||
+      input.cardIds.some((cardId) => !revisionIds.has(cardId))
+    ) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "card revisions must match the selected card IDs",
+        path: ["cardRevisions"],
+      });
+    }
+    if ((input.expiresAt === undefined) === (input.durationMs === undefined)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "one expiry value is required",
+        path: ["expiresAt"],
+      });
+    }
+  });
+
+export const SupportPassportOwnerCreateGrantRequestSchema = SupportPassportCreateGrantRequestSchema;
+
 export const SupportPassportOwnerGrantSchema = z
   .object({
     grantId: GrantIdSchema,
@@ -133,6 +175,8 @@ export const SupportPassportListGrantsInputSchema = z
 export type SupportPassportGrantCardRef = z.infer<typeof SupportPassportGrantCardRefSchema>;
 export type SupportPassportGrantState = z.infer<typeof SupportPassportGrantStateSchema>;
 export type SupportPassportCreateGrantInput = z.input<typeof SupportPassportCreateGrantInputSchema>;
+export type SupportPassportCreateGrantRequest = z.input<typeof SupportPassportCreateGrantRequestSchema>;
+export type SupportPassportOwnerCreateGrantRequest = z.input<typeof SupportPassportOwnerCreateGrantRequestSchema>;
 export type SupportPassportOwnerGrant = z.infer<typeof SupportPassportOwnerGrantSchema>;
 export type SupportPassportCreatedGrant = z.infer<typeof SupportPassportCreatedGrantSchema>;
 export type SupportPassportPublicGuide = z.infer<typeof SupportPassportPublicGuideSchema>;

package/src/support-passport/grant-generated-batch-scope.test.ts

@@ -0,0 +1,201 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, unlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { test } from "node:test";
+
+import { StorageManager } from "../storage.js";
+import { SUPPORT_PASSPORT_ATTRIBUTE_KEYS, computeSupportPassportOwnerKey } from "./card-projection.js";
+import { SupportPassportCardService } from "./card-service.js";
+import { SupportPassportError } from "./errors.js";
+import { SupportPassportGrantService } from "./grant-service.js";
+import { SupportPassportGrantStore } from "./grant-store.js";
+
+test("grant reads do not open another owner's generated batch marker", async () => {
+  StorageManager.clearAllStaticCaches();
+  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-batch-scope-"));
+  try {
+    const storage = new StorageManager(path.join(root, "shared"));
+    await storage.ensureDirectories();
+    const now = () => new Date("2026-08-13T12:00:00.000Z");
+    const resolveOwner = async (principal: string) => ({ principal, namespace: "team", storage });
+    const cardService = new SupportPassportCardService({ resolveOwner, now });
+    const grantStore = new SupportPassportGrantStore({ memoryDir: path.join(root, "grants"), now });
+    const grantService = new SupportPassportGrantService({
+      grantStore,
+      resolveOwner,
+      resolveNamespace: async () => storage,
+      now,
+    });
+    const cards = new Map<string, Awaited<ReturnType<typeof cardService.approveCard>>>();
+    for (const principal of ["owner:alice", "owner:bob"]) {
+      const [draft] = await cardService.createGeneratedDrafts({
+        principal,
+        cards: [{
+          title: `${principal} support`,
+          statement: "Give me time to answer.",
+          category: "communication",
+          sourceMemoryIds: ["source-1"],
+        }],
+      });
+      assert.ok(draft);
+      cards.set(principal, await cardService.approveCard({
+        principal,
+        cardId: draft.cardId,
+        expectedRevision: draft.revision,
+      }));
+    }
+    const grants = new Map<string, Awaited<ReturnType<typeof grantService.createGrant>>>();
+    for (const principal of ["owner:alice", "owner:bob"]) {
+      const card = cards.get(principal);
+      assert.ok(card);
+      grants.set(principal, await grantService.createGrant({
+        principal,
+        cards: [{ cardId: card.cardId, revision: card.revision }],
+        expiresAt: "2026-08-13T13:00:00.000Z",
+      }));
+    }
+
+    const bobCard = cards.get("owner:bob");
+    assert.ok(bobCard);
+    const bobMemory = await storage.getMemoryById(bobCard.cardId);
+    const batchId = bobMemory?.frontmatter.structuredAttributes?.[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.generatedBatchId];
+    assert.ok(batchId);
+    await writeFile(
+      path.join(storage.dir, "state", "support-passport", "generated-batches", `${batchId}.json`),
+      "not-json\n",
+      "utf8",
+    );
+    const freshService = new SupportPassportGrantService({
+      grantStore,
+      resolveOwner,
+      resolveNamespace: async () => storage,
+      now,
+    });
+    const aliceGrant = grants.get("owner:alice");
+    const bobGrant = grants.get("owner:bob");
+    assert.ok(aliceGrant);
+    assert.ok(bobGrant);
+
+    assert.equal(
+      (await freshService.readGrant({ grantId: aliceGrant.grant.grantId, secret: aliceGrant.secret })).cards[0]?.cardId,
+      cards.get("owner:alice")?.cardId,
+    );
+    await assert.rejects(
+      freshService.readGrant({ grantId: bobGrant.grant.grantId, secret: bobGrant.secret }),
+      (error: unknown) => error instanceof SupportPassportError && error.code === "card_data_invalid",
+    );
+  } finally {
+    StorageManager.clearAllStaticCaches();
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("a removed generated batch marker invalidates a cached grant snapshot", async () => {
+  StorageManager.clearAllStaticCaches();
+  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-batch-cache-"));
+  try {
+    const storage = new StorageManager(path.join(root, "owner"));
+    await storage.ensureDirectories();
+    const now = () => new Date("2026-08-13T12:00:00.000Z");
+    const resolveOwner = async (principal: string) => ({ principal, namespace: "owner", storage });
+    const cardService = new SupportPassportCardService({ resolveOwner, now });
+    const grantStore = new SupportPassportGrantStore({ memoryDir: path.join(root, "grants"), now });
+    const grantService = new SupportPassportGrantService({
+      grantStore,
+      resolveOwner,
+      resolveNamespace: async () => storage,
+      now,
+    });
+    const [draft] = await cardService.createGeneratedDrafts({
+      principal: "owner:alice",
+      cards: [{
+        title: "Time to answer",
+        statement: "Give me time to answer.",
+        category: "communication",
+        sourceMemoryIds: ["source-1"],
+      }],
+    });
+    assert.ok(draft);
+    const card = await cardService.approveCard({
+      principal: "owner:alice",
+      cardId: draft.cardId,
+      expectedRevision: draft.revision,
+    });
+    const grant = await grantService.createGrant({
+      principal: "owner:alice",
+      cards: [{ cardId: card.cardId, revision: card.revision }],
+      expiresAt: "2026-08-13T13:00:00.000Z",
+    });
+    await grantService.readGrant({ grantId: grant.grant.grantId, secret: grant.secret });
+
+    const memory = await storage.getMemoryById(card.cardId);
+    const batchId = memory?.frontmatter.structuredAttributes?.[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.generatedBatchId];
+    assert.ok(batchId);
+    await unlink(path.join(storage.dir, "state", "support-passport", "generated-batches", `${batchId}.json`));
+
+    await assert.rejects(
+      grantService.readGrant({ grantId: grant.grant.grantId, secret: grant.secret }),
+      (error: unknown) => error instanceof SupportPassportError && error.code === "grant_stale",
+    );
+  } finally {
+    StorageManager.clearAllStaticCaches();
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("a completed generated batch invalidates a cached omission", async () => {
+  StorageManager.clearAllStaticCaches();
+  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-batch-complete-"));
+  try {
+    const storage = new StorageManager(path.join(root, "owner"));
+    await storage.ensureDirectories();
+    const now = () => new Date("2026-08-13T12:00:00.000Z");
+    const principal = "owner:alice";
+    const resolveOwner = async () => ({ principal, namespace: "owner", storage });
+    const cardService = new SupportPassportCardService({ resolveOwner, now });
+    const [draft] = await cardService.createGeneratedDrafts({
+      principal,
+      cards: [{
+        title: "Time to answer",
+        statement: "Give me time to answer.",
+        category: "communication",
+        sourceMemoryIds: ["source-1"],
+      }],
+    });
+    assert.ok(draft);
+    const card = await cardService.approveCard({
+      principal,
+      cardId: draft.cardId,
+      expectedRevision: draft.revision,
+    });
+    const memory = await storage.getMemoryById(card.cardId);
+    const batchId = memory?.frontmatter.structuredAttributes?.[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.generatedBatchId];
+    assert.ok(batchId);
+    const markerPath = path.join(storage.dir, "state", "support-passport", "generated-batches", `${batchId}.json`);
+    const completeMarker = JSON.parse(await readFile(markerPath, "utf8")) as Record<string, unknown>;
+    await writeFile(markerPath, `${JSON.stringify({ ...completeMarker, complete: false })}\n`, "utf8");
+    const service = new SupportPassportGrantService({
+      grantStore: {} as SupportPassportGrantStore,
+      resolveOwner,
+      resolveNamespace: async () => storage,
+      now,
+    });
+    const inspected = service as unknown as {
+      readStoredCardSnapshot(
+        target: StorageManager,
+        namespace: string,
+        ownerKey: string,
+      ): Promise<{ cardsById: ReadonlyMap<string, unknown> }>;
+    };
+    const ownerKey = computeSupportPassportOwnerKey(principal);
+
+    assert.equal((await inspected.readStoredCardSnapshot(storage, "owner", ownerKey)).cardsById.size, 0);
+    await writeFile(markerPath, `${JSON.stringify(completeMarker)}\n`, "utf8");
+
+    assert.equal((await inspected.readStoredCardSnapshot(storage, "owner", ownerKey)).cardsById.size, 1);
+  } finally {
+    StorageManager.clearAllStaticCaches();
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/src/support-passport/grant-service-cache.test.ts

@@ -79,12 +79,12 @@ test("card snapshots match the storage cache freshness window", async () => {
   diskMemories = [];
   nowMs += 1_001;
   assert.equal((await inspected.readStoredCardSnapshot(storage, "alice", ownerKey)).cardsById.size, 1);
-  assert.equal(calls, 2);
+  assert.equal(calls, 1);
   assert.equal(diskReads, 1);
   nowMs += 59_000;
 
   assert.equal((await inspected.readStoredCardSnapshot(storage, "alice", ownerKey)).cardsById.size, 0);
-  assert.equal(calls, 3);
+  assert.equal(calls, 2);
   assert.equal(diskReads, 2);
 });
 

package/src/support-passport/grant-service-cancellation.test.ts

@@ -45,6 +45,8 @@ test("grant creation checks cancellation again before commit", async () => {
       readAllMemories: async () => [memory],
       getCorpusScanVersion: () => 1,
       hotCacheKeyId: () => "owner-cache",
+      hotCacheTtlMs: () => 60_000,
+      isHotCacheEnabled: () => true,
     } as unknown as StorageManager;
     const controller = new AbortController();
     let committed = false;

package/src/support-passport/grant-service-marker-cache.test.ts

@@ -0,0 +1,62 @@
+import assert from "node:assert/strict";
+import { mkdtemp, rm, unlink } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { StorageManager } from "../storage.js";
+import {
+  computeSupportPassportOwnerKey,
+  type StoredSupportPassportCard,
+} from "./card-projection.js";
+import {
+  commitSupportPassportGeneratedBatch,
+  isCommittedGeneratedCard,
+  persistSupportPassportGeneratedBatchMarker,
+} from "./generated-batch.js";
+
+test("generated card checks reuse a marker within one snapshot build", async () => {
+  StorageManager.clearAllStaticCaches();
+  const root = await mkdtemp(path.join(tmpdir(), "remnic-support-grant-marker-cache-"));
+  const storage = new StorageManager(path.join(root, "owner"));
+  await storage.ensureDirectories();
+  const batchId = "00000000-0000-4000-8000-000000000001";
+  const context = {
+    storage,
+    principal: "owner:alice",
+    namespace: "alice",
+    now: () => new Date("2026-08-13T12:00:00.000Z"),
+    requireOwnerLock: async () => undefined,
+  };
+  const owner = computeSupportPassportOwnerKey(context.principal);
+  const cards = [
+    {
+      namespace: "alice",
+      owner,
+      generatedBatchId: batchId,
+      generatedBatchSize: 2,
+      card: { cardId: "00000000-0000-4000-8000-000000000002", status: "pending_review" },
+    },
+    {
+      namespace: "alice",
+      owner,
+      generatedBatchId: batchId,
+      generatedBatchSize: 2,
+      card: { cardId: "00000000-0000-4000-8000-000000000003", status: "pending_review" },
+    },
+  ] as StoredSupportPassportCard[];
+
+  try {
+    const marker = await persistSupportPassportGeneratedBatchMarker(context, batchId, cards.length);
+    await commitSupportPassportGeneratedBatch(context, marker, cards);
+    const markerCache = new Map();
+
+    assert.equal(await isCommittedGeneratedCard(storage, cards[0]!, markerCache), true);
+    await unlink(path.join(storage.dir, "state", "support-passport", "generated-batches", `${batchId}.json`));
+    assert.equal(await isCommittedGeneratedCard(storage, cards[1]!, markerCache), true);
+    assert.equal(await isCommittedGeneratedCard(storage, cards[1]!, new Map()), false);
+  } finally {
+    StorageManager.clearAllStaticCaches();
+    await rm(root, { recursive: true, force: true });
+  }
+});