@stigmer/react 3.12.4 → 3.12.6

package/src/organization/OrgPreferencesPanel.tsx

@@ -0,0 +1,221 @@
+"use client";
+
+import { type FormEvent, useCallback, useEffect, useId, useMemo, useState } from "react";
+import { cn } from "@stigmer/theme";
+import { getUserMessage, toOrganizationUpdateInput } from "@stigmer/sdk";
+import type { Organization } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+import { useOrganization } from "./useOrganization.js";
+import { useUpdateOrganization } from "./useUpdateOrganization.js";
+import { useCheckPermission } from "../iam-policy/useCheckPermission.js";
+import { StandingContextField } from "../internal/StandingContextField.js";
+import { SpinnerIcon } from "../internal/SpinnerIcon.js";
+
+/** Props for {@link OrgPreferencesPanel}. */
+export interface OrgPreferencesPanelProps {
+  /** The ID of the organization whose preferences to display and edit. */
+  readonly orgId: string;
+  /** Fired with the updated resource after a successful save. */
+  readonly onUpdated?: (org: Organization) => void;
+  /** Additional CSS class names for the root container. */
+  readonly className?: string;
+}
+
+/**
+ * Self-contained editor for an {@link Organization}'s declared
+ * preferences (`spec.preferences.standing_context`).
+ *
+ * The declared text is snapshotted into every eligible agent execution
+ * run by the organization's members (first-party human operators only)
+ * and delivered to the agent as background context. Editing requires
+ * `can_edit` on the organization; viewers without it get a read-only
+ * rendering. On save, calls `organization.update()` with the complete
+ * mapped input (full-spec-replace safety) and fires `onUpdated`.
+ *
+ * All visual properties flow through `--stgm-*` design tokens. Zero
+ * dependencies on Console routing, auth context, or layout — platform
+ * builders can embed it directly:
+ *
+ * @example
+ * ```tsx
+ * <OrgPreferencesPanel orgId="org-id-123" />
+ * ```
+ */
+export function OrgPreferencesPanel({
+  orgId,
+  onUpdated,
+  className,
+}: OrgPreferencesPanelProps) {
+  const baseId = useId();
+  const {
+    organization,
+    isLoading: isFetching,
+    error: fetchError,
+    refetch,
+  } = useOrganization(orgId || null);
+
+  const {
+    update,
+    isUpdating,
+    error: updateError,
+    clearError,
+  } = useUpdateOrganization();
+
+  // Fail-open: OSS local mode has no IAM service, so editing stays
+  // available there; cloud gets a genuine server verdict.
+  const { allowed: canEdit } = useCheckPermission(
+    orgId ? { kind: "organization", id: orgId } : null,
+    "can_edit",
+  );
+
+  const [standingContext, setStandingContext] = useState("");
+
+  const serverStandingContext =
+    organization?.spec?.preferences?.standingContext ?? "";
+
+  // Sync the form field when server data changes.
+  useEffect(() => {
+    if (!organization) return;
+    setStandingContext(
+      organization.spec?.preferences?.standingContext ?? "",
+    );
+  }, [organization]);
+
+  const hasChanges = useMemo(
+    () => standingContext.trim() !== serverStandingContext,
+    [standingContext, serverStandingContext],
+  );
+
+  const canSubmit = canEdit && hasChanges && !isUpdating;
+
+  const handleDiscard = useCallback(() => {
+    setStandingContext(serverStandingContext);
+    clearError();
+  }, [serverStandingContext, clearError]);
+
+  const handleSubmit = useCallback(
+    async (e: FormEvent) => {
+      e.preventDefault();
+      if (!canSubmit || !organization) return;
+
+      clearError();
+      try {
+        // update() is a full-spec replace: spread the complete mapped input
+        // so unedited spec fields survive, and override only preferences.
+        const updated = await update({
+          ...toOrganizationUpdateInput(organization),
+          preferences: { standingContext: standingContext.trim() || undefined },
+        });
+        refetch();
+        onUpdated?.(updated);
+      } catch {
+        // error state is managed by useUpdateOrganization
+      }
+    },
+    [canSubmit, organization, standingContext, update, clearError, refetch, onUpdated],
+  );
+
+  // -----------------------------------------------------------------------
+  // Loading state
+  // -----------------------------------------------------------------------
+
+  if (isFetching && !organization) {
+    return (
+      <div
+        className={cn("stg:space-y-4", className)}
+        aria-busy="true"
+        aria-label="Loading organization preferences"
+      >
+        <div className="stg:bg-muted-subtle stg:h-28 stg:animate-pulse stg:rounded" />
+        <div className="stg:bg-muted-subtle stg:h-8 stg:w-32 stg:animate-pulse stg:rounded" />
+      </div>
+    );
+  }
+
+  // -----------------------------------------------------------------------
+  // Fetch error
+  // -----------------------------------------------------------------------
+
+  if (fetchError) {
+    return (
+      <div className={cn("stg:space-y-3", className)} role="alert">
+        <p className="stg:text-destructive stg:text-sm">
+          {getUserMessage(fetchError)}
+        </p>
+        <button
+          type="button"
+          onClick={refetch}
+          className={cn(
+            "stg:rounded-md stg:px-3 stg:py-1.5 stg:text-xs stg:font-medium",
+            "stg:bg-primary stg:text-primary-foreground stg:hover:bg-primary-hover",
+          )}
+        >
+          Retry
+        </button>
+      </div>
+    );
+  }
+
+  if (!organization) return null;
+
+  // -----------------------------------------------------------------------
+  // Render
+  // -----------------------------------------------------------------------
+
+  return (
+    <form onSubmit={handleSubmit} className={cn("stg:space-y-4", className)}>
+      <StandingContextField
+        id={`${baseId}-standing-context`}
+        value={standingContext}
+        onChange={setStandingContext}
+        disabled={isUpdating}
+        readOnly={!canEdit}
+        placeholder={
+          "e.g. We deploy to us-east-1. Our stack is Go and TypeScript. Prefer concise answers."
+        }
+        helperText="Shared with agents as background context — not instructions. Applies to executions started by signed-in members of this organization and is visible on their execution records."
+      />
+
+      {!canEdit && (
+        <p className="stg:text-[0.65rem] stg:text-muted-foreground">
+          Only organization admins can edit these preferences.
+        </p>
+      )}
+
+      {updateError && (
+        <p className="stg:text-destructive stg:text-[0.65rem]" role="alert">
+          {getUserMessage(updateError)}
+        </p>
+      )}
+
+      {canEdit && (
+        <div className="stg:flex stg:items-center stg:gap-2">
+          <button
+            type="submit"
+            disabled={!canSubmit}
+            className={cn(
+              "stg:inline-flex stg:items-center stg:gap-1.5 stg:rounded-md stg:px-3 stg:py-1.5 stg:text-xs stg:font-medium",
+              "stg:bg-primary stg:text-primary-foreground stg:hover:bg-primary-hover",
+              "stg:disabled:pointer-events-none stg:disabled:opacity-40",
+            )}
+          >
+            {isUpdating && <SpinnerIcon size={12} />}
+            Save changes
+          </button>
+
+          {hasChanges && !isUpdating && (
+            <button
+              type="button"
+              onClick={handleDiscard}
+              className={cn(
+                "stg:rounded-md stg:px-3 stg:py-1.5 stg:text-xs",
+                "stg:text-muted-foreground stg:hover:text-foreground stg:hover:bg-accent-hover",
+              )}
+            >
+              Discard
+            </button>
+          )}
+        </div>
+      )}
+    </form>
+  );
+}

package/src/organization/OrgProfilePanel.tsx

@@ -2,7 +2,7 @@
 
 import { type FormEvent, useCallback, useEffect, useId, useMemo, useState } from "react";
 import { cn } from "@stigmer/theme";
-import { getUserMessage } from "@stigmer/sdk";
+import { getUserMessage, toOrganizationUpdateInput } from "@stigmer/sdk";
 import type { Organization } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
 import { useOrganization } from "./useOrganization.js";
 import { useUpdateOrganization } from "./useUpdateOrganization.js";
@@ -116,10 +116,12 @@ export function OrgProfilePanel({
 
       clearError();
       try {
+        // update() is a full-spec replace: spread the complete mapped input
+        // so unedited spec fields (e.g. preferences) survive the save, and
+        // override only the fields this form edits.
         const updated = await update({
+          ...toOrganizationUpdateInput(organization),
           name: name.trim(),
-          slug: serverSlug,
-          org: serverSlug,
           description: description.trim() || undefined,
           logoUrl: logoUrl.trim() || undefined,
         });
@@ -135,7 +137,6 @@ export function OrgProfilePanel({
       name,
       description,
       logoUrl,
-      serverSlug,
       update,
       clearError,
       refetch,

package/src/organization/__tests__/OrgPreferencesPanel.test.tsx

@@ -0,0 +1,145 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { create } from "@bufbuild/protobuf";
+import {
+  OrganizationSchema,
+  type Organization,
+} from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+import type { OrganizationInput } from "@stigmer/sdk";
+import { StigmerContext } from "../../context";
+import { DeploymentModeContext } from "../../deployment-mode";
+import { OrgPreferencesPanel } from "../OrgPreferencesPanel";
+
+const ORG: Organization = create(OrganizationSchema, {
+  metadata: { id: "acme", name: "Acme Corp", slug: "acme", org: "acme" },
+  spec: {
+    description: "We make everything.",
+    logoUrl: "https://acme.example/logo.png",
+    preferences: { standingContext: "We deploy to us-east-1." },
+  },
+});
+
+function createMockStigmer(overrides?: {
+  update?: ReturnType<typeof vi.fn>;
+  canEdit?: boolean;
+}) {
+  return {
+    organization: {
+      get: vi.fn(async () => ORG),
+      update: overrides?.update ?? vi.fn(async () => ORG),
+    },
+    iamPolicy: {
+      checkMyPermission: vi.fn(async () => ({
+        isAuthorized: overrides?.canEdit ?? true,
+      })),
+    },
+  } as never;
+}
+
+function renderPanel(client: unknown) {
+  return render(
+    <StigmerContext.Provider value={client as never}>
+      <DeploymentModeContext.Provider value="local">
+        <OrgPreferencesPanel orgId="acme" />
+      </DeploymentModeContext.Provider>
+    </StigmerContext.Provider>,
+  );
+}
+
+afterEach(cleanup);
+
+/**
+ * Waits until the form has synced from server data (the panel copies the
+ * fetched value into local state in a passive effect, one flush after the
+ * field first renders) — interacting earlier races the sync.
+ */
+async function findSyncedField(value: string) {
+  const field = await screen.findByLabelText("Standing context");
+  await waitFor(() => expect(field).toHaveProperty("value", value));
+  return field;
+}
+
+describe("OrgPreferencesPanel", () => {
+  it("loads and displays the declared standing context", async () => {
+    renderPanel(createMockStigmer());
+
+    await findSyncedField("We deploy to us-east-1.");
+  });
+
+  it("saves the full mapped input — unedited profile fields survive (wipe-bug guard)", async () => {
+    const update = vi.fn(async (_input: OrganizationInput) => ORG);
+    renderPanel(createMockStigmer({ update }));
+
+    const field = await findSyncedField("We deploy to us-east-1.");
+    fireEvent.change(field, { target: { value: "Prefer terse answers." } });
+    fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+
+    await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+    const input = update.mock.calls[0]![0];
+
+    expect(input.preferences).toEqual({
+      standingContext: "Prefer terse answers.",
+    });
+    // Fields this form never renders must round-trip untouched.
+    expect(input.name).toBe("Acme Corp");
+    expect(input.description).toBe("We make everything.");
+    expect(input.logoUrl).toBe("https://acme.example/logo.png");
+    expect(input.org).toBe("acme");
+    expect(input.slug).toBe("acme");
+  });
+
+  it("clears the standing context when the text is emptied", async () => {
+    const update = vi.fn(async (_input: OrganizationInput) => ORG);
+    renderPanel(createMockStigmer({ update }));
+
+    const field = await findSyncedField("We deploy to us-east-1.");
+    fireEvent.change(field, { target: { value: "" } });
+    fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+
+    await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+    expect(update.mock.calls[0]![0].preferences).toEqual({
+      standingContext: undefined,
+    });
+  });
+
+  it("discard resets the field to the server value", async () => {
+    renderPanel(createMockStigmer());
+
+    const field = await findSyncedField("We deploy to us-east-1.");
+    fireEvent.change(field, { target: { value: "Edited but regretted" } });
+    fireEvent.click(screen.getByRole("button", { name: "Discard" }));
+
+    expect(field).toHaveProperty("value", "We deploy to us-east-1.");
+  });
+
+  it("renders read-only with an explanation when the caller lacks can_edit", async () => {
+    renderPanel(createMockStigmer({ canEdit: false }));
+
+    const field = await screen.findByLabelText("Standing context");
+    await waitFor(() =>
+      expect(field).toHaveProperty("readOnly", true),
+    );
+    expect(
+      screen.getByText("Only organization admins can edit these preferences."),
+    ).toBeTruthy();
+    expect(screen.queryByRole("button", { name: "Save changes" })).toBeNull();
+  });
+
+  it("shows the fetch error with a retry action when loading fails", async () => {
+    const client = {
+      organization: {
+        get: vi.fn(async () => {
+          throw new Error("boom");
+        }),
+        update: vi.fn(),
+      },
+      iamPolicy: {
+        checkMyPermission: vi.fn(async () => ({ isAuthorized: true })),
+      },
+    } as never;
+    renderPanel(client);
+
+    expect(await screen.findByRole("alert")).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Retry" })).toBeTruthy();
+  });
+});

package/src/organization/__tests__/OrgProfilePanel.test.tsx

@@ -0,0 +1,108 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { create } from "@bufbuild/protobuf";
+import {
+  OrganizationSchema,
+  type Organization,
+} from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+import type { OrganizationInput } from "@stigmer/sdk";
+import { StigmerContext } from "../../context";
+import { DeploymentModeContext } from "../../deployment-mode";
+import { OrgProfilePanel } from "../OrgProfilePanel";
+
+/**
+ * Regression suite for the full-spec-replace wipe bug (oss#293 Phase 1):
+ * `organization.update()` wholesale replaces the stored spec, so a profile
+ * save that sends only the edited fields silently wipes every other mutable
+ * spec field — most visibly `spec.preferences.standing_context` set via the
+ * CLI or the preferences page. The panel must spread the complete mapped
+ * input and override only what it edits.
+ */
+
+const ORG: Organization = create(OrganizationSchema, {
+  metadata: {
+    id: "acme",
+    name: "Acme Corp",
+    slug: "acme",
+    org: "acme",
+  },
+  spec: {
+    description: "We make everything.",
+    logoUrl: "https://acme.example/logo.png",
+    preferences: { standingContext: "We deploy to us-east-1." },
+  },
+});
+
+function createMockStigmer(overrides?: {
+  update?: ReturnType<typeof vi.fn>;
+}) {
+  return {
+    organization: {
+      get: vi.fn(async () => ORG),
+      update: overrides?.update ?? vi.fn(async () => ORG),
+    },
+  } as never;
+}
+
+// Deployment mode "local" keeps the IdentityProvidersSummary sub-panel
+// inert (identity_provider is cloud-only), so no extra client stubs are
+// needed — the suite tests the form, not the summary.
+function renderPanel(client: unknown) {
+  return render(
+    <StigmerContext.Provider value={client as never}>
+      <DeploymentModeContext.Provider value="local">
+        <OrgProfilePanel orgId="acme" />
+      </DeploymentModeContext.Provider>
+    </StigmerContext.Provider>,
+  );
+}
+
+afterEach(cleanup);
+
+describe("OrgProfilePanel save payload", () => {
+  it("round-trips unedited spec fields — preferences survive a profile save", async () => {
+    const update = vi.fn(async (_input: OrganizationInput) => ORG);
+    const client = createMockStigmer({ update });
+    renderPanel(client);
+
+    // Wait for the server-sync effect to fill the form before editing —
+    // interacting on first appearance races the sync.
+    const description = await screen.findByLabelText("Description");
+    await waitFor(() =>
+      expect(description).toHaveProperty("value", "We make everything."),
+    );
+    fireEvent.change(description, { target: { value: "New description" } });
+    fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+
+    await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+    const input = update.mock.calls[0]![0];
+
+    // The edited field.
+    expect(input.description).toBe("New description");
+    // The unedited fields the form does not render — the wipe-bug guard.
+    expect(input.preferences).toEqual({
+      standingContext: "We deploy to us-east-1.",
+    });
+    expect(input.logoUrl).toBe("https://acme.example/logo.png");
+    // Addressing fields for the update pipeline's org+slug lookup.
+    expect(input.org).toBe("acme");
+    expect(input.slug).toBe("acme");
+    expect(input.name).toBe("Acme Corp");
+  });
+
+  it("sends the edited name and keeps discard/dirty semantics intact", async () => {
+    const update = vi.fn(async (_input: OrganizationInput) => ORG);
+    renderPanel(createMockStigmer({ update }));
+
+    const name = await screen.findByLabelText("Name");
+    await waitFor(() => expect(name).toHaveProperty("value", "Acme Corp"));
+    fireEvent.change(name, { target: { value: "Acme Corporation" } });
+    fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+
+    await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+    expect(update.mock.calls[0]![0].name).toBe("Acme Corporation");
+    expect(update.mock.calls[0]![0].preferences).toEqual({
+      standingContext: "We deploy to us-east-1.",
+    });
+  });
+});

package/src/organization/index.ts

@@ -16,5 +16,7 @@ export { CreateOrganizationForm } from "./CreateOrganizationForm.js";
 export type { CreateOrganizationFormProps } from "./CreateOrganizationForm.js";
 export { OrgProfilePanel } from "./OrgProfilePanel.js";
 export type { OrgProfilePanelProps } from "./OrgProfilePanel.js";
+export { OrgPreferencesPanel } from "./OrgPreferencesPanel.js";
+export type { OrgPreferencesPanelProps } from "./OrgPreferencesPanel.js";
 export { OrgSwitcher } from "./OrgSwitcher.js";
 export type { OrgSwitcherProps } from "./OrgSwitcher.js";

package/src/platform-client/PlatformClientDetailPanel.tsx

@@ -3,7 +3,7 @@
 import { type FormEvent, type KeyboardEvent, useCallback, useId, useState } from "react";
 import { cn } from "@stigmer/theme";
 import { UNSTYLED_FIELDSET } from "../internal/element-resets.js";
-import { getUserMessage } from "@stigmer/sdk";
+import { getUserMessage, toPlatformClientUpdateInput } from "@stigmer/sdk";
 import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { timestampDate, type Timestamp } from "@bufbuild/protobuf/wkt";
 import type { PlatformClient } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
@@ -176,21 +176,22 @@ export function PlatformClientDetailPanel({
       e.preventDefault();
       clearUpdateError();
       try {
+        // Full-spec-replace safety: spread the complete mapped input and
+        // override only the edited fields, so unlisted spec fields (e.g.
+        // environment_refs, the embedded-assistant credential binding)
+        // survive the save. Cleared fields are set to undefined
+        // explicitly — omitting them would carry the stale mapped value.
         const updated = await update({
-          name: meta?.name ?? "",
-          slug: meta?.slug,
-          org: meta?.org ?? "",
+          ...toPlatformClientUpdateInput(platformClient),
           neverExpires,
-          ...(!neverExpires &&
-            expiresAt && {
-              expiresAt: new Date(expiresAt).toISOString(),
-            }),
+          expiresAt:
+            !neverExpires && expiresAt ? new Date(expiresAt) : undefined,
           autoProvisionAccounts: autoProvision,
           autoGrantOnOrg: autoGrant,
-          ...(autoGrant &&
-            autoGrantRole !== IamRole.iam_role_unspecified && {
-              autoGrantRole,
-            }),
+          autoGrantRole:
+            autoGrant && autoGrantRole !== IamRole.iam_role_unspecified
+              ? autoGrantRole
+              : undefined,
           allowedOrigins: origins,
         });
         setMode("view");
@@ -200,7 +201,7 @@ export function PlatformClientDetailPanel({
       }
     },
     [
-      meta,
+      platformClient,
       neverExpires,
       expiresAt,
       autoProvision,

package/src/platform-client/__tests__/PlatformClientDetailPanel.test.tsx

@@ -0,0 +1,82 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { create } from "@bufbuild/protobuf";
+import { timestampFromDate } from "@bufbuild/protobuf/wkt";
+import {
+  PlatformClientSchema,
+  type PlatformClient,
+} from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import type { PlatformClientInput } from "@stigmer/sdk";
+import { StigmerContext } from "../../context";
+import { PlatformClientDetailPanel } from "../PlatformClientDetailPanel";
+
+/**
+ * Regression suite for the full-spec-replace wipe bug: before the
+ * generated-mapper migration, this panel hand-built its update input and
+ * NEVER sent `environment_refs` — saving any edit silently wiped the
+ * client's credential-delivery environment bindings. The panel must
+ * spread `toPlatformClientUpdateInput` and override only what it edits.
+ */
+
+const PLATFORM_CLIENT: PlatformClient = create(PlatformClientSchema, {
+  metadata: {
+    id: "pc-1",
+    name: "Embed Client",
+    slug: "embed-client",
+    org: "acme",
+  },
+  spec: {
+    clientId: "client-abc",
+    expiresAt: timestampFromDate(new Date("2027-06-01T00:00:00Z")),
+    neverExpires: false,
+    autoProvisionAccounts: true,
+    autoGrantOnOrg: true,
+    autoGrantRole: IamRole.admin,
+    allowedOrigins: ["https://embed.acme.example"],
+    environmentRefs: [
+      { org: "acme", slug: "prod", kind: ApiResourceKind.environment },
+    ],
+  },
+});
+
+function renderPanel(update: ReturnType<typeof vi.fn>) {
+  const client = {
+    platformclient: { update },
+  } as never;
+  return render(
+    <StigmerContext.Provider value={client}>
+      <PlatformClientDetailPanel platformClient={PLATFORM_CLIENT} />
+    </StigmerContext.Provider>,
+  );
+}
+
+afterEach(cleanup);
+
+describe("PlatformClientDetailPanel save payload", () => {
+  it("round-trips environment_refs on an origins-only edit (the wipe bug)", async () => {
+    const update = vi.fn(async (_input: PlatformClientInput) => PLATFORM_CLIENT);
+    renderPanel(update);
+
+    fireEvent.click(screen.getByRole("button", { name: "Edit" }));
+    fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+
+    await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+    const input = update.mock.calls[0]![0];
+
+    // The wipe-bug guard: the form does not render environment bindings,
+    // yet they must survive the save.
+    expect(input.environmentRefs).toEqual([
+      { org: "acme", slug: "prod", kind: ApiResourceKind.environment },
+    ]);
+    // Form-owned fields round-trip from the edit state.
+    expect(input.allowedOrigins).toEqual(["https://embed.acme.example"]);
+    expect(input.autoGrantRole).toBe(IamRole.admin);
+    expect(input.expiresAt).toBeInstanceOf(Date);
+    // Addressing fields for the update pipeline's org+slug lookup.
+    expect(input.org).toBe("acme");
+    expect(input.slug).toBe("embed-client");
+    expect(input.name).toBe("Embed Client");
+  });
+});