@desplega.ai/agent-swarm 2.3.0 → 2.4.0

package/src/telemetry.ts

@@ -630,6 +630,7 @@ function emit(
   metadata?: Record<string, unknown>,
   actor?: TelemetryActor,
   emitter: string = source,
+  identity?: { orgName: string; orgWebsite: string },
 ): void {
   if (!isTelemetryEnabled() || !installationId) return;
   maybeRefreshOrgIdentity();
@@ -639,7 +640,9 @@ function emit(
     const occurredAt = new Date().toISOString();
     const sentFor = installationId;
     const isCloud = cachedIsCloud || isCloudDeployment();
-    const orgIdentity = getOrgIdentity();
+    const orgIdentity = identity
+      ? { ...getOrgIdentity(), organization_name: identity.orgName }
+      : getOrgIdentity();
     const userId = actor?.userId?.trim() || undefined;
     const payload = {
       schema_version: 2 as const,
@@ -653,7 +656,7 @@ function emit(
         orgId,
         orgName: orgIdentity.organization_name,
         orgDomain: cachedOrgDomain,
-        orgWebsite: normalizeOrgWebsite(process.env.SWARM_ORG_WEBSITE),
+        orgWebsite: identity?.orgWebsite ?? normalizeOrgWebsite(process.env.SWARM_ORG_WEBSITE),
         installationId,
         actor: userId ? { userId, role: actor?.role ?? roleResolver?.(userId) ?? null } : undefined,
         isCloud,
@@ -820,6 +823,27 @@ export const telemetry = {
     );
   },
 
+  /**
+   * Public-ranking events. The API passes the org identity it just read from
+   * config, so a listing built right after an identity edit still matches the
+   * envelope's `org_name` / `org_website` (the proxy rejects a mismatch) before
+   * the debounced config reload updates `process.env`.
+   */
+  ranking<S extends EventSuffix<"ranking">>(
+    event: S,
+    props: FamilyProps<"ranking", S>,
+    identity?: { orgName: string; orgWebsite: string },
+  ): void {
+    emit(
+      `ranking.${event}`,
+      props as Record<string, unknown>,
+      undefined,
+      undefined,
+      source,
+      identity,
+    );
+  },
+
   org<S extends EventSuffix<"org">>(event: S, props: FamilyProps<"org", S>): void {
     emit(`org.${event}`, props as Record<string, unknown>, undefined);
   },

package/src/tests/apps-rbac.test.ts

@@ -7,9 +7,20 @@ import {
   type ServerResponse,
 } from "node:http";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { closeDb, createAgent, createUser, getDbClient, getTaskById, initDb } from "../be/db";
+import type { AppActionCaller } from "../apps/action-caller";
+import {
+  closeDb,
+  createAgent,
+  createPage,
+  createUser,
+  getDbClient,
+  getTaskById,
+  initDb,
+} from "../be/db";
+import { createRuntimeController } from "../be/runtime-pools/db";
+import { mintControllerToken } from "../be/runtime-pools/tokens";
 import { upsertScriptByName } from "../be/scripts/db";
-import { type IdentityActor, mintToken } from "../be/users";
+import { type IdentityActor, mintRuntimeToken, mintToken } from "../be/users";
 import { handleApps } from "../http/apps";
 import { resolveHttpRequestAuth } from "../http/auth";
 import { getPathSegments, parseQueryParams } from "../http/utils";
@@ -19,13 +30,18 @@ import { registerAppDiffTool } from "../tools/app-diff";
 import { registerAppGetTool, registerAppQueryTool } from "../tools/app-get";
 import { registerAppHistoryTool } from "../tools/app-history";
 import { registerAppPatchTool } from "../tools/app-patch";
+import { signPageSession } from "../utils/page-session";
 import { setRequestAuth } from "../utils/request-auth-context";
+import { SKIP_SANDBOX_SPAWN_TESTS } from "./sandbox-spawn-test-helpers";
+import { CHILD_PROCESS_TEST_BUDGET_MS } from "./test-proc";
 
 const TEST_DB_PATH = `/private/tmp/test-apps-rbac-${process.pid}.sqlite`;
 const API_KEY = "example-apps-rbac-test-key";
 const AGENT_ID = crypto.randomUUID();
 const LEAD_ID = crypto.randomUUID();
 const OPERATOR_ACTOR: IdentityActor = { kind: "operator", id: "apps-rbac-test" };
+const previousPageSecret = process.env.PAGE_SESSION_SECRET;
+const previousSwarmKey = process.env.AGENT_SWARM_API_KEY;
 
 const definition = {
   models: { note: { columns: { title: { kind: "string" } } } },
@@ -45,6 +61,7 @@ let server: Server;
 let base = "";
 let userId = "";
 let userToken = "";
+let agentToken = "";
 let appId = "";
 let tools: Record<string, RegisteredTool>;
 
@@ -144,12 +161,15 @@ async function callTool(name: string, args: unknown): Promise<unknown> {
 }
 
 beforeAll(async () => {
+  process.env.PAGE_SESSION_SECRET = "example-apps-rbac-page-session-secret";
+  process.env.AGENT_SWARM_API_KEY = API_KEY;
   for (const suffix of ["", "-wal", "-shm"]) {
     await unlink(`${TEST_DB_PATH}${suffix}`).catch(() => undefined);
   }
   initDb(TEST_DB_PATH);
   await createAgent({ id: AGENT_ID, name: "apps-rbac-worker", isLead: false, status: "idle" });
   await createAgent({ id: LEAD_ID, name: "apps-rbac-lead", isLead: true, status: "idle" });
+  agentToken = (await mintRuntimeToken(AGENT_ID, crypto.randomUUID())).plaintext;
   const user = await createUser({ name: "Apps RBAC User" });
   userId = user.id;
   userToken = (await mintToken(user.id, "apps-rbac", OPERATOR_ACTOR)).plaintext;
@@ -177,6 +197,10 @@ afterEach(() => {
 afterAll(async () => {
   await new Promise<void>((resolve) => server.close(() => resolve()));
   closeDb();
+  if (previousPageSecret === undefined) delete process.env.PAGE_SESSION_SECRET;
+  else process.env.PAGE_SESSION_SECRET = previousPageSecret;
+  if (previousSwarmKey === undefined) delete process.env.AGENT_SWARM_API_KEY;
+  else process.env.AGENT_SWARM_API_KEY = previousSwarmKey;
   for (const suffix of ["", "-wal", "-shm"]) {
     await unlink(`${TEST_DB_PATH}${suffix}`).catch(() => undefined);
   }
@@ -323,6 +347,9 @@ describe("app viewer identity", () => {
     });
     expect(action.status).toBe(200);
     expect((await getTaskById(action.body.taskId))?.requestedByUserId).toBe(userId);
+    expect((await getTaskById(action.body.taskId))?.task).toContain(
+      `Caller (server-verified): ${JSON.stringify({ kind: "user", id: userId, name: "Apps RBAC User" })}`,
+    );
 
     const operatorAction = await request<{ taskId: string }>(
       `/api/apps/${appId}/actions/triage`,
@@ -342,6 +369,166 @@ describe("app viewer identity", () => {
   });
 });
 
+describe("verified app action caller", () => {
+  beforeEach(async () => {
+    const saved = await upsertScriptByName({
+      name: `apps_caller_${crypto.randomUUID().replaceAll("-", "")}`,
+      scope: "agent",
+      scopeId: AGENT_ID,
+      agentId: AGENT_ID,
+      source: "export default function run(args: Record<string, unknown>) { return args; }",
+      description: "Action caller fixture",
+      intent: "Return the arguments received by a script action",
+      signatureJson: JSON.stringify({ args: { type: "object" }, result: { type: "object" } }),
+      typeChecked: true,
+      embeddingMode: "skip",
+    });
+    const patched = await request(`/api/apps/${appId}`, "operator", {
+      method: "PATCH",
+      body: JSON.stringify({
+        definition: {
+          actions: {
+            echo: {
+              kind: "script",
+              scriptId: saved.script.id,
+              args: { caller: { kind: "guest", id: "default-forgery" }, base: 2 },
+            },
+          },
+        },
+      }),
+    });
+    expect(patched.status).toBe(200);
+  });
+
+  const scriptTest = test.skipIf(SKIP_SANDBOX_SPAWN_TESTS);
+  scriptTest.each([
+    ["user", undefined],
+    ["operator", AGENT_ID],
+    ["operator", crypto.randomUUID()],
+    ["operator", undefined],
+    ["agent", AGENT_ID],
+  ] as const)(
+    "%s caller with agent header %s preserves identity and overwrites forged input",
+    async (principal, agentId) => {
+      const caller: AppActionCaller =
+        principal === "user"
+          ? { kind: "user", id: userId, name: "Apps RBAC User" }
+          : agentId === AGENT_ID
+            ? { kind: "agent", id: AGENT_ID, name: "apps-rbac-worker" }
+            : { kind: "operator", id: null };
+      const requestHeaders = {
+        ...(agentId ? { "X-Agent-ID": agentId } : {}),
+        ...(principal === "agent" ? { Authorization: `Bearer ${agentToken}` } : {}),
+      };
+      const checks: RbacCheck[] = [];
+      setAuditSink((check) => checks.push(check));
+      const row = await request<{ row: { createdBy: string } }>(
+        `/api/apps/${appId}/models/note/rows`,
+        principal,
+        {
+          method: "POST",
+          headers: requestHeaders,
+          body: JSON.stringify({ values: { title: "caller row" } }),
+        },
+      );
+      expect(row.status).toBe(201);
+      expect(row.body.row.createdBy).toBe(caller.id ? `${caller.kind}:${caller.id}` : "operator");
+
+      const action = await request<{
+        ok: boolean;
+        result: { caller: AppActionCaller; app: { id: string }; base: number; add: number };
+      }>(`/api/apps/${appId}/actions/echo`, principal, {
+        method: "POST",
+        headers: requestHeaders,
+        body: JSON.stringify({
+          input: { caller: { kind: "operator", id: "input-forgery" }, app: { id: "fake" }, add: 3 },
+        }),
+      });
+      expect(action.status).toBe(200);
+      expect(action.body.ok).toBe(true);
+      expect(action.body.result).toEqual({ caller, app: { id: appId }, base: 2, add: 3 });
+
+      const taskAction = await request<{ taskId: string }>(
+        `/api/apps/${appId}/actions/triage`,
+        principal,
+        { method: "POST", headers: requestHeaders, body: JSON.stringify({ input: {} }) },
+      );
+      expect(taskAction.status).toBe(200);
+      expect((await getTaskById(taskAction.body.taskId))?.task).toContain(
+        `Caller (server-verified): ${JSON.stringify(caller)}`,
+      );
+      expect(checks).toHaveLength(3);
+      expect(checks.every((check) => check.principal.kind === principal)).toBe(true);
+    },
+    CHILD_PROCESS_TEST_BUDGET_MS,
+  );
+
+  scriptTest(
+    "a signed page session includes the verified page id and viewer identity",
+    async () => {
+      const page = await createPage({
+        agentId: AGENT_ID,
+        slug: `caller-${crypto.randomUUID()}`,
+        title: "Caller page",
+        contentType: "text/html",
+        body: "<p>Caller page</p>",
+      });
+      const session = await signPageSession({
+        pageId: page.id,
+        exp: Math.floor(Date.now() / 1000) + 3600,
+        uid: userId,
+      });
+      const action = await request<{ ok: boolean; result: { caller: AppActionCaller } }>(
+        `/api/apps/${appId}/actions/echo`,
+        "operator",
+        {
+          method: "POST",
+          headers: {
+            "X-Agent-ID": AGENT_ID,
+            "X-Page-ID": page.id,
+            "X-Page-Session": session,
+          },
+          body: JSON.stringify({ input: { caller: { pageId: "fake" } } }),
+        },
+      );
+      expect(action.status).toBe(200);
+      expect(action.body.ok).toBe(true);
+      expect(action.body.result.caller).toEqual({
+        kind: "user",
+        id: userId,
+        name: "Apps RBAC User",
+        pageId: page.id,
+      });
+    },
+    CHILD_PROCESS_TEST_BUDGET_MS,
+  );
+
+  test("controller tokens use the guest principal even with a registered agent header", async () => {
+    const controller = await createRuntimeController({
+      name: "apps-caller-controller",
+      kind: "docker",
+      placement: "remote",
+    });
+    const token = await mintControllerToken(controller.id);
+    const checks: RbacCheck[] = [];
+    setAuditSink((check) => checks.push(check));
+    const action = await request(`/api/apps/${appId}/actions/echo`, "operator", {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token.plaintext}`, "X-Agent-ID": AGENT_ID },
+      body: JSON.stringify({ input: {} }),
+    });
+    expect(action.status).toBe(403);
+    expect(checks).toEqual([
+      {
+        principal: { kind: "guest" },
+        verb: "app.use",
+        resource: { kind: "app", appId },
+        source: "http",
+      },
+    ]);
+  });
+});
+
 describe("user writers and the script ownership gate", () => {
   async function saveScript(scope: "agent" | "global", ownerId: string | null): Promise<string> {
     const result = await upsertScriptByName({

package/src/tests/apps-script-types.test.ts

@@ -127,9 +127,16 @@ describe("renderAppTypes", () => {
     expect(rendered).toContain("params: { value: never };");
   });
 
-  test("renders a documentation-grade action union", () => {
+  test("renders action names and arguments with server-stamped caller context", () => {
     const rendered = renderAppTypes([app("PM Inbox", issueDefinition())]);
     expect(rendered).toContain('export type ActionName = "closeIssue" | "notifyOwner";');
+    expect(rendered).toContain("export interface ActionArgs");
+    expect(rendered).toContain('app: { id: "PM Inbox-id" };');
+    expect(rendered).toContain("caller: AppActionCaller;");
+    expect(rendered).toContain('kind: "user" | "agent" | "operator" | "guest";');
+    expect(rendered).toContain("id: string | null;");
+    expect(rendered).toContain("name?: string;");
+    expect(rendered).toContain("pageId?: string;");
   });
 
   test("derives and dedupes namespaces and model interface names", () => {
@@ -262,14 +269,20 @@ describe("renderAppTypes", () => {
     expect(rendered).not.toMatch(/^export const pwned2/m);
   });
 
-  test("a model named actionName does not collide with the ActionName alias", () => {
+  test("model names do not collide with generated action types", () => {
     const rendered = renderAppTypes([
       app("Collision", {
-        models: { actionName: { columns: { title: { kind: "string" } } } },
+        models: {
+          actionName: { columns: { title: { kind: "string" } } },
+          actionArgs: { columns: { title: { kind: "string" } } },
+          appActionCaller: { columns: { title: { kind: "string" } } },
+        },
         actions: { close: { kind: "task", prompt: "close" } },
       }),
     ]);
     expect(rendered).toContain("export interface ActionName_2");
+    expect(rendered).toContain("export interface ActionArgs_2");
+    expect(rendered).toContain("export interface AppActionCaller_2");
     expect(rendered).toContain('export type ActionName = "close";');
   });
 

package/src/tests/check-pr-body.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, test } from "bun:test";
 import {
   checkPrBody,
   isFixTitle,
+  isRankingEntryPr,
   pickedChoices,
   prBodyWarnings,
   proseWordCount,
@@ -34,6 +35,28 @@ const TEMPLATE = `<!-- top comment -->
 
 const URGENT = "## Urgency\n- [ ] asap\n- [x] nice to have\n";
 
+describe("isRankingEntryPr", () => {
+  test("exempts only a one-file entry PR with the matching title", () => {
+    expect(
+      isRankingEntryPr("chore(ranking): add acme.dev", ["community/ranking/acme.dev.json"]),
+    ).toBe(true);
+    expect(
+      isRankingEntryPr("chore(ranking): remove acme.dev", ["community/ranking/acme.dev.json"]),
+    ).toBe(true);
+    expect(
+      isRankingEntryPr("chore(ranking): add acme.dev", ["community/ranking/acme.com.json"]),
+    ).toBe(false);
+    expect(
+      isRankingEntryPr("chore(ranking): add acme.dev", [
+        "community/ranking/acme.dev.json",
+        "src/server.ts",
+      ]),
+    ).toBe(false);
+    expect(isRankingEntryPr("feat: add acme.dev", ["community/ranking/acme.dev.json"])).toBe(false);
+    expect(isRankingEntryPr("chore(ranking): add acme.dev", undefined)).toBe(false);
+  });
+});
+
 describe("check-pr-body", () => {
   test("template markers set when a section is required", () => {
     expect(templateSections(TEMPLATE)).toEqual([

package/src/tests/check-ranking-entry.test.ts

@@ -0,0 +1,146 @@
+import { describe, expect, test } from "bun:test";
+import {
+  checkRankingEntries,
+  type Entry,
+  isEntryPath,
+  parseEntry,
+  type Verification,
+} from "../../scripts/check-ranking-entry";
+
+const CLAIM = "rk_3f9a1c0e7b2d4a6f8e1c3b5d7f9a2c4e";
+const OTHER_CLAIM = "rk_00000000000000000000000000000001";
+const file = (domain: string, claim = CLAIM) =>
+  JSON.stringify({ $schema: "./schema.json", domain, claim });
+
+const VERIFIED: Verification = {
+  verified: true,
+  reasons: [],
+  telemetryActive7d: true,
+  websiteMatchesDomain: true,
+  listing: {
+    name: "Acme",
+    domain: "acme.dev",
+    category: "engineering",
+    subcategory: "qa-testing",
+    description: "QA | release automation",
+    sourceCodeUrl: null,
+  },
+};
+
+describe("parseEntry", () => {
+  test("accepts the opt-in file", () => {
+    expect(parseEntry("acme.dev.json", file("acme.dev"))).toEqual({
+      domain: "acme.dev",
+      claim: CLAIM,
+    });
+  });
+
+  test.each([
+    ["acme.dev.json", "{", "valid JSON"],
+    ["acme.dev.json", "[]", "JSON object"],
+    [
+      "acme.dev.json",
+      JSON.stringify({ domain: "acme.dev", claim: CLAIM, name: "Acme" }),
+      "unknown keys",
+    ],
+    ["www.acme.dev.json", file("www.acme.dev"), "bare lowercase hostname"],
+    ["Acme.ba.json", file("Acme.ba"), "bare lowercase hostname"],
+    ["other.ba.json", file("acme.dev"), "must be named acme.dev.json"],
+    ["acme.dev.json", file("acme.dev", "rk_short"), "claim"],
+  ])("rejects %s %s", (name, text, message) => {
+    expect(() => parseEntry(name, text)).toThrow(message);
+  });
+
+  test("README and schema are not entries", () => {
+    expect(isEntryPath("community/ranking/acme.dev.json")).toBe(true);
+    expect(isEntryPath("community/ranking/schema.json")).toBe(false);
+    expect(isEntryPath("community/ranking/README.md")).toBe(false);
+    expect(isEntryPath("community/ranking/nested/acme.dev.json")).toBe(false);
+  });
+});
+
+describe("checkRankingEntries", () => {
+  const files: Record<string, string> = {
+    "community/ranking/acme.dev.json": file("acme.dev"),
+    "community/ranking/acme.com.json": file("acme.com", CLAIM),
+  };
+  const run = (
+    paths: string[],
+    verify: (entry: Entry) => Promise<Verification>,
+    all = ["acme.dev.json"],
+  ) =>
+    checkRankingEntries({
+      changes: paths.map((path) => ({ status: "A", path })),
+      readEntry: (path) => files[path] ?? "",
+      allEntries: all.map((name) => [name, files[`community/ranking/${name}`] ?? ""]),
+      verify,
+    });
+
+  test("a verified entry passes and the summary shows the listing", async () => {
+    const asked: Entry[] = [];
+    const result = await run(["community/ranking/acme.dev.json"], async (entry) => {
+      asked.push(entry);
+      return VERIFIED;
+    });
+    expect(result.problems).toEqual([]);
+    expect(asked).toEqual([{ domain: "acme.dev", claim: CLAIM }]);
+    const summary = result.summary.join("\n");
+    expect(summary).toContain("### acme.dev: verified");
+    expect(summary).toContain(
+      "| Acme | engineering | qa-testing | QA \\| release automation | — |",
+    );
+  });
+
+  test("an unverified entry fails with the proxy's reasons", async () => {
+    const result = await run(["community/ranking/acme.dev.json"], async () => ({
+      ...VERIFIED,
+      verified: false,
+      reasons: ["telemetry_inactive_7d"],
+    }));
+    expect(result.problems).toHaveLength(1);
+    expect(result.problems[0]).toContain("telemetry_inactive_7d");
+  });
+
+  test("a proxy error fails without throwing", async () => {
+    const result = await run(["community/ranking/acme.dev.json"], async () => {
+      throw new Error("the proxy answered 503");
+    });
+    expect(result.problems[0]).toContain("503");
+  });
+
+  test("a claim shared with another entry fails before verify", async () => {
+    let called = false;
+    const result = await run(["community/ranking/acme.com.json"], async () => {
+      called = true;
+      return VERIFIED;
+    }, ["acme.dev.json", "acme.com.json"]);
+    expect(called).toBe(false);
+    expect(result.problems[0]).toContain("acme.dev.json");
+  });
+
+  test("a removal needs no proof, and README edits are ignored", async () => {
+    const result = await checkRankingEntries({
+      changes: [
+        { status: "D", path: "community/ranking/acme.dev.json" },
+        { status: "M", path: "community/ranking/README.md" },
+      ],
+      readEntry: () => "",
+      allEntries: [],
+      verify: async () => {
+        throw new Error("must not be called");
+      },
+    });
+    expect(result.problems).toEqual([]);
+    expect(result.summary).toEqual(["- Removed `acme.dev.json`."]);
+  });
+
+  test("the claim differs per entry in a valid two-entry PR", async () => {
+    files["community/ranking/acme.com.json"] = file("acme.com", OTHER_CLAIM);
+    const result = await run(
+      ["community/ranking/acme.com.json", "community/ranking/acme.dev.json"],
+      async () => VERIFIED,
+      ["acme.dev.json", "acme.com.json"],
+    );
+    expect(result.problems).toEqual([]);
+  });
+});

package/src/tests/db-extraction-contract.test.ts

@@ -15,6 +15,7 @@ test("facade exposes repository bindings without internal exports", () => {
         "rowToAgentTaskSummary",
         "configureTaskReadDependencies",
         "NEVER_STARTED_TASK_STATUSES",
+        "readableSessionCondition",
       ].includes(name)
     ) {
       expect(name in db).toBe(false);

package/src/tests/db-task-read-contract.test.ts

@@ -660,6 +660,7 @@ const internal = [
   "type:AgentTaskRow",
   "value:configureTaskReadDependencies",
   "value:NEVER_STARTED_TASK_STATUSES",
+  "value:readableSessionCondition",
   "value:rowToAgentTask",
   "value:rowToAgentTaskSummary",
 ].sort();

package/src/tests/docs-index-footprint.test.js

@@ -103,8 +103,8 @@ describe("docs API index footprint", () => {
     expect(spec.paths["/api/agents/{id}/runtime"]?.get).toBeDefined();
 
     const generatedKeys = await generatedOperationKeys();
-    expect(operationKeys).toHaveLength(431);
-    expect(generatedKeys).toHaveLength(431);
+    expect(operationKeys).toHaveLength(436);
+    expect(generatedKeys).toHaveLength(436);
     expect(new Set(generatedKeys)).toEqual(new Set(operationKeys));
   });
 

package/src/tests/org-identity.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, test } from "bun:test";
+import { orgIdentityStatus } from "../utils/org-identity";
+
+describe("orgIdentityStatus", () => {
+  test.each([
+    ["empty", {}, ["SWARM_ORG_NAME", "SWARM_ORG_WEBSITE"]],
+    [
+      "whitespace",
+      { SWARM_ORG_NAME: "   ", SWARM_ORG_WEBSITE: "  " },
+      ["SWARM_ORG_NAME", "SWARM_ORG_WEBSITE"],
+    ],
+    [
+      "the catalog default",
+      { SWARM_ORG_NAME: "Swarm", SWARM_ORG_WEBSITE: "acme.com" },
+      ["SWARM_ORG_NAME"],
+    ],
+    [
+      "the Slack fallback",
+      { SWARM_ORG_NAME: " your swarm ", SWARM_ORG_WEBSITE: "acme.com" },
+      ["SWARM_ORG_NAME"],
+    ],
+    [
+      "an invalid website",
+      { SWARM_ORG_NAME: "Acme", SWARM_ORG_WEBSITE: "localhost" },
+      ["SWARM_ORG_WEBSITE"],
+    ],
+    ["both set", { SWARM_ORG_NAME: " Acme ", SWARM_ORG_WEBSITE: "https://www.Acme.com/" }, []],
+  ] as const)("%s", (_label, src, missing) => {
+    const status = orgIdentityStatus(src);
+    expect(status.missing).toEqual([...missing]);
+    expect(status.ok).toBe(missing.length === 0);
+  });
+
+  test("returns the trimmed name and the normalized website", () => {
+    expect(
+      orgIdentityStatus({ SWARM_ORG_NAME: " Acme ", SWARM_ORG_WEBSITE: "https://www.Acme.com/" }),
+    ).toEqual({
+      name: "Acme",
+      website: "acme.com",
+      missing: [],
+      ok: true,
+    });
+  });
+});