@stigmer/sdk 3.34.0 → 3.36.0

package/src/__tests__/gen/proto-utils.test.ts

@@ -1,99 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { stripUndefined, toTimestamp } from "../../gen/proto-utils";
-import { timestampDate } from "@bufbuild/protobuf/wkt";
-
-describe("stripUndefined", () => {
-  it("removes keys with undefined values", () => {
-    const result = stripUndefined({ a: 1, b: undefined, c: "hello" });
-    expect(result).toEqual({ a: 1, c: "hello" });
-    expect("b" in result).toBe(false);
-  });
-
-  it("preserves null values (falsy but defined)", () => {
-    const result = stripUndefined({ a: null });
-    expect(result).toEqual({ a: null });
-  });
-
-  it("preserves 0 (falsy but defined)", () => {
-    const result = stripUndefined({ count: 0 });
-    expect(result).toEqual({ count: 0 });
-  });
-
-  it("preserves empty string (falsy but defined)", () => {
-    const result = stripUndefined({ name: "" });
-    expect(result).toEqual({ name: "" });
-  });
-
-  it("preserves false (falsy but defined)", () => {
-    const result = stripUndefined({ enabled: false });
-    expect(result).toEqual({ enabled: false });
-  });
-
-  it("returns empty object when all values are undefined", () => {
-    const result = stripUndefined({ a: undefined, b: undefined });
-    expect(result).toEqual({});
-  });
-
-  it("returns all keys when nothing is undefined", () => {
-    const input = { x: 1, y: "two", z: true };
-    const result = stripUndefined(input);
-    expect(result).toEqual(input);
-  });
-
-  it("preserves nested objects without deep-stripping", () => {
-    const nested = { inner: undefined };
-    const result = stripUndefined({ outer: nested });
-    expect(result).toEqual({ outer: nested });
-    expect((result as Record<string, unknown>).outer).toBe(nested);
-  });
-
-  it("returns empty object for empty input", () => {
-    const result = stripUndefined({});
-    expect(result).toEqual({});
-  });
-});
-
-describe("toTimestamp", () => {
-  it("converts a Date to a Timestamp with correct seconds", () => {
-    const date = new Date("2026-05-19T12:00:00.000Z");
-    const ts = toTimestamp(date);
-    expect(ts.seconds).toBe(BigInt(Math.floor(date.getTime() / 1000)));
-    expect(ts.nanos).toBe(0);
-  });
-
-  it("converts a Date with milliseconds to a Timestamp with nanos", () => {
-    const date = new Date("2026-01-15T08:30:00.456Z");
-    const ts = toTimestamp(date);
-    const expectedSeconds = BigInt(Math.floor(date.getTime() / 1000));
-    expect(ts.seconds).toBe(expectedSeconds);
-    expect(ts.nanos).toBe(456_000_000);
-  });
-
-  it("converts an ISO string to a Timestamp", () => {
-    const isoString = "2026-06-01T00:00:00.000Z";
-    const ts = toTimestamp(isoString);
-    const expected = new Date(isoString);
-    expect(ts.seconds).toBe(BigInt(Math.floor(expected.getTime() / 1000)));
-  });
-
-  it("roundtrips correctly through timestampDate", () => {
-    const original = new Date("2026-03-10T15:45:30.000Z");
-    const ts = toTimestamp(original);
-    const roundtripped = timestampDate(ts);
-    expect(roundtripped.getTime()).toBe(original.getTime());
-  });
-
-  it("handles epoch (Unix timestamp 0)", () => {
-    const epoch = new Date(0);
-    const ts = toTimestamp(epoch);
-    expect(ts.seconds).toBe(BigInt(0));
-    expect(ts.nanos).toBe(0);
-  });
-
-  it("handles far-future dates", () => {
-    const future = new Date("2099-12-31T23:59:59.000Z");
-    const ts = toTimestamp(future);
-    expect(ts.seconds).toBe(BigInt(Math.floor(future.getTime() / 1000)));
-    expect(timestampDate(ts).getTime()).toBe(future.getTime());
-  });
-});

package/src/__tests__/gen/session-client.test.ts

@@ -1,208 +0,0 @@
-import { describe, it, expect, beforeEach } from "vitest";
-import type { Transport } from "@connectrpc/connect";
-import type { Session } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
-import { ExecutionTarget } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
-import { SessionClient, type SessionInput } from "../../gen/session";
-
-interface CapturedRequest {
-  methodName: string;
-  message: unknown;
-}
-
-function createCapturingTransport(): {
-  transport: Transport;
-  captured: CapturedRequest[];
-} {
-  const captured: CapturedRequest[] = [];
-
-  const transport = {
-    unary: async (
-      method: { name: string },
-      _signal: unknown,
-      _timeout: unknown,
-      _header: unknown,
-      message: unknown,
-    ) => ({
-      header: new Headers(),
-      trailer: new Headers(),
-      message,
-    }),
-    stream: async () => {
-      throw new Error("streaming not implemented in test transport");
-    },
-  } as unknown as Transport;
-
-  const originalUnary = (transport as unknown as Record<string, unknown>).unary as (
-    ...args: unknown[]
-  ) => Promise<unknown>;
-
-  (transport as unknown as Record<string, unknown>).unary = async (
-    method: { name: string },
-    signal: unknown,
-    timeout: unknown,
-    header: unknown,
-    message: unknown,
-    ...rest: unknown[]
-  ) => {
-    captured.push({ methodName: method.name, message });
-    return originalUnary(method, signal, timeout, header, message, ...rest);
-  };
-
-  return { transport, captured };
-}
-
-describe("SessionClient proto serialization", () => {
-  let client: SessionClient;
-  let captured: CapturedRequest[];
-
-  beforeEach(() => {
-    const ctx = createCapturingTransport();
-    client = new SessionClient(ctx.transport);
-    captured = ctx.captured;
-  });
-
-  it("sets apiVersion and kind on the proto", async () => {
-    await client.create({ name: "test-session", org: "my-org" });
-
-    const proto = captured[0].message as Session;
-    expect(proto.apiVersion).toBe("agentic.stigmer.ai/v1");
-    expect(proto.kind).toBe("Session");
-  });
-
-  it("sets required fields on metadata", async () => {
-    await client.create({ name: "my-session", org: "acme" });
-
-    const proto = captured[0].message as Session;
-    expect(proto.metadata?.name).toBe("my-session");
-    expect(proto.metadata?.org).toBe("acme");
-  });
-
-  it("sets optional spec fields when provided", async () => {
-    const input: SessionInput = {
-      name: "s1",
-      org: "o1",
-      agentInstanceId: "ai-123",
-      subject: "Help with deployment",
-    };
-
-    await client.create(input);
-
-    const proto = captured[0].message as Session;
-    expect(proto.spec?.agentInstanceId).toBe("ai-123");
-    expect(proto.spec?.subject).toBe("Help with deployment");
-  });
-
-  it("does not overwrite protobuf defaults when optional fields are omitted", async () => {
-    await client.create({ name: "minimal", org: "org" });
-
-    const proto = captured[0].message as Session;
-    expect(proto.spec?.agentInstanceId).toBe("");
-    expect(proto.spec?.subject).toBe("");
-  });
-
-  it("serializes executionTarget when provided", async () => {
-    await client.create({
-      name: "s1",
-      org: "o1",
-      executionTarget: ExecutionTarget.LOCAL,
-    });
-
-    const proto = captured[0].message as Session;
-    expect(proto.spec?.executionTarget).toBe(ExecutionTarget.LOCAL);
-  });
-
-  it("serializes metadata map when provided", async () => {
-    await client.create({
-      name: "s1",
-      org: "o1",
-      metadata: { env: "production", region: "us-east-1" },
-    });
-
-    const proto = captured[0].message as Session;
-    expect(proto.spec?.metadata).toEqual({
-      env: "production",
-      region: "us-east-1",
-    });
-  });
-
-  it("serializes workspace entries with git repo source", async () => {
-    await client.create({
-      name: "s1",
-      org: "o1",
-      workspaceEntries: [
-        {
-          name: "my-repo",
-          source: {
-            gitRepo: {
-              url: "https://github.com/example/repo.git",
-              branch: "main",
-            },
-          },
-        },
-      ],
-    });
-
-    const proto = captured[0].message as Session;
-    const entries = proto.spec?.workspaceEntries;
-    expect(entries).toHaveLength(1);
-    expect(entries![0].name).toBe("my-repo");
-
-    const source = entries![0].source;
-    expect(source?.source?.case).toBe("gitRepo");
-    if (source?.source?.case === "gitRepo") {
-      expect(source.source.value.url).toBe(
-        "https://github.com/example/repo.git",
-      );
-      expect(source.source.value.branch).toBe("main");
-    }
-  });
-
-  it("serializes workspace entries with local path source", async () => {
-    await client.create({
-      name: "s1",
-      org: "o1",
-      workspaceEntries: [
-        {
-          name: "local",
-          source: {
-            localPath: { path: "/home/user/project" },
-          },
-        },
-      ],
-    });
-
-    const proto = captured[0].message as Session;
-    const entries = proto.spec?.workspaceEntries;
-    expect(entries).toHaveLength(1);
-
-    const source = entries![0].source;
-    expect(source?.source?.case).toBe("localPath");
-    if (source?.source?.case === "localPath") {
-      expect(source.source.value.path).toBe("/home/user/project");
-    }
-  });
-
-  it("routes create through the command controller", async () => {
-    await client.create({ name: "s1", org: "o1" });
-    expect(captured[0].methodName).toBe("create");
-  });
-
-  it("routes apply through the command controller", async () => {
-    await client.apply({ name: "s1", org: "o1" });
-    expect(captured[0].methodName).toBe("apply");
-  });
-
-  it("routes get through the query controller with SessionId", async () => {
-    await client.get("session-id-123");
-    const message = captured[0].message as { value: string };
-    expect(captured[0].methodName).toBe("get");
-    expect(message.value).toBe("session-id-123");
-  });
-
-  it("routes delete through the command controller with SessionId", async () => {
-    await client.delete("session-id-456");
-    const message = captured[0].message as { value: string };
-    expect(captured[0].methodName).toBe("delete");
-    expect(message.value).toBe("session-id-456");
-  });
-});

package/src/__tests__/guest-auth.test.ts

@@ -1,287 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { create } from "@bufbuild/protobuf";
-import { MintGuestTokenResponseSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/token_pb";
-import { ConnectError, Code } from "@connectrpc/connect";
-
-// Intercept the token client so no transport is exercised. The mock
-// preserves the real module (create/Code/ConnectError) and only stubs
-// createClient, which GuestAuth uses to build its RPC client.
-const mintGuestToken = vi.fn();
-vi.mock("@connectrpc/connect", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("@connectrpc/connect")>();
-  return {
-    ...actual,
-    createClient: () => ({ mintGuestToken }),
-  };
-});
-
-import { createGuestAuth, GuestAuth, type GuestIdStorage } from "../guest-auth";
-
-const CONFIG = {
-  baseUrl: "https://api.stigmer.ai",
-  org: "acme",
-  slug: "support-agent",
-};
-
-function createMemoryStorage(): GuestIdStorage & { store: Map<string, string> } {
-  const store = new Map<string, string>();
-  return {
-    store,
-    getItem: (key) => store.get(key) ?? null,
-    setItem: (key, value) => {
-      store.set(key, value);
-    },
-  };
-}
-
-function mintResponse(overrides?: {
-  accessToken?: string;
-  expiresIn?: number;
-  guestCookieId?: string;
-}) {
-  return create(MintGuestTokenResponseSchema, {
-    accessToken: overrides?.accessToken ?? "guest-jwt-1",
-    tokenType: "Bearer",
-    expiresIn: overrides?.expiresIn ?? 900,
-    guestCookieId: overrides?.guestCookieId ?? "cookie-abc",
-  });
-}
-
-beforeEach(() => {
-  mintGuestToken.mockReset();
-  vi.useFakeTimers();
-});
-
-afterEach(() => {
-  vi.useRealTimers();
-});
-
-describe("createGuestAuth", () => {
-  it("throws when baseUrl is missing", () => {
-    expect(() =>
-      createGuestAuth({ ...CONFIG, baseUrl: "" }),
-    ).toThrow("baseUrl is required");
-  });
-
-  it("throws when org is missing", () => {
-    expect(() => createGuestAuth({ ...CONFIG, org: "" })).toThrow(
-      "org is required",
-    );
-  });
-
-  it("throws when slug is missing", () => {
-    expect(() => createGuestAuth({ ...CONFIG, slug: "" })).toThrow(
-      "slug is required",
-    );
-  });
-
-  it("returns a GuestAuth instance with valid config", () => {
-    expect(createGuestAuth(CONFIG)).toBeInstanceOf(GuestAuth);
-  });
-});
-
-describe("GuestAuth.getAccessToken", () => {
-  it("mints on first call and sends an empty guest id", async () => {
-    mintGuestToken.mockResolvedValue(mintResponse());
-    const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
-
-    const token = await auth.getAccessToken();
-
-    expect(token).toBe("guest-jwt-1");
-    expect(mintGuestToken).toHaveBeenCalledTimes(1);
-    expect(mintGuestToken.mock.calls[0][0]).toMatchObject({
-      org: "acme",
-      slug: "support-agent",
-      guestCookieId: "",
-      // No embedOrigin configured (the unframed hosted page): the field
-      // must stay empty so the server's absence-means-exempt rule applies.
-      embedOrigin: "",
-    });
-  });
-
-  it("passes the configured embedOrigin through to every mint", async () => {
-    mintGuestToken.mockResolvedValue(mintResponse());
-    const auth = createGuestAuth({
-      ...CONFIG,
-      storage: createMemoryStorage(),
-      embedOrigin: "https://docs.example.com",
-    });
-
-    await auth.getAccessToken();
-    // Expire the cached token, forcing a re-mint — the origin must persist.
-    vi.advanceTimersByTime(900_000);
-    await auth.getAccessToken();
-
-    expect(mintGuestToken).toHaveBeenCalledTimes(2);
-    for (const call of mintGuestToken.mock.calls) {
-      expect(call[0]).toMatchObject({ embedOrigin: "https://docs.example.com" });
-    }
-  });
-
-  it("passes the configured linkToken through to every mint", async () => {
-    mintGuestToken.mockResolvedValue(mintResponse());
-    const auth = createGuestAuth({
-      ...CONFIG,
-      storage: createMemoryStorage(),
-      linkToken: "tok123",
-    });
-
-    await auth.getAccessToken();
-    // Expire the cached token, forcing a re-mint — the token must persist
-    // so a locked link keeps working across silent re-mints.
-    vi.advanceTimersByTime(900_000);
-    await auth.getAccessToken();
-
-    expect(mintGuestToken).toHaveBeenCalledTimes(2);
-    for (const call of mintGuestToken.mock.calls) {
-      expect(call[0]).toMatchObject({ linkToken: "tok123" });
-    }
-  });
-
-  it("sends an empty linkToken when none is configured (plain link)", async () => {
-    mintGuestToken.mockResolvedValue(mintResponse());
-    const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
-
-    await auth.getAccessToken();
-
-    expect(mintGuestToken.mock.calls[0][0]).toMatchObject({ linkToken: "" });
-  });
-
-  it("rejects with permission-denied when the embed origin is refused", async () => {
-    mintGuestToken.mockRejectedValue(
-      new ConnectError(
-        "This agent can\u2019t be embedded on this site.",
-        Code.PermissionDenied,
-      ),
-    );
-    const auth = createGuestAuth({
-      ...CONFIG,
-      storage: createMemoryStorage(),
-      embedOrigin: "https://evil.example.com",
-    });
-
-    await expect(auth.getAccessToken()).rejects.toMatchObject({
-      code: "permission-denied",
-    });
-  });
-
-  it("persists the server-issued guest id and presents it on re-mint", async () => {
-    const storage = createMemoryStorage();
-    mintGuestToken.mockResolvedValue(mintResponse({ guestCookieId: "cookie-abc" }));
-    const auth = createGuestAuth({ ...CONFIG, storage });
-
-    await auth.getAccessToken();
-    expect(storage.store.get("stigmer:guest-id:acme")).toBe("cookie-abc");
-    expect(auth.guestCookieId).toBe("cookie-abc");
-
-    // Expire the cached token, forcing a second mint.
-    vi.advanceTimersByTime(900_000);
-    await auth.getAccessToken();
-
-    expect(mintGuestToken).toHaveBeenCalledTimes(2);
-    expect(mintGuestToken.mock.calls[1][0]).toMatchObject({
-      guestCookieId: "cookie-abc",
-    });
-  });
-
-  it("restores a persisted guest id from a prior visit", async () => {
-    const storage = createMemoryStorage();
-    storage.setItem("stigmer:guest-id:acme", "cookie-from-last-visit");
-    mintGuestToken.mockResolvedValue(mintResponse());
-    const auth = createGuestAuth({ ...CONFIG, storage });
-
-    await auth.getAccessToken();
-
-    expect(mintGuestToken.mock.calls[0][0]).toMatchObject({
-      guestCookieId: "cookie-from-last-visit",
-    });
-  });
-
-  it("returns the cached token while it is fresh", async () => {
-    mintGuestToken.mockResolvedValue(mintResponse());
-    const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
-
-    await auth.getAccessToken();
-    // 13 minutes into a 15-minute token: still beyond the 60s skew.
-    vi.advanceTimersByTime(13 * 60_000);
-    const token = await auth.getAccessToken();
-
-    expect(token).toBe("guest-jwt-1");
-    expect(mintGuestToken).toHaveBeenCalledTimes(1);
-  });
-
-  it("re-mints when the cached token is within the expiry skew", async () => {
-    mintGuestToken
-      .mockResolvedValueOnce(mintResponse({ accessToken: "guest-jwt-1" }))
-      .mockResolvedValueOnce(mintResponse({ accessToken: "guest-jwt-2" }));
-    const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
-
-    await auth.getAccessToken();
-    // 30 seconds of life left — inside the 60s skew window.
-    vi.advanceTimersByTime(900_000 - 30_000);
-    const token = await auth.getAccessToken();
-
-    expect(token).toBe("guest-jwt-2");
-    expect(mintGuestToken).toHaveBeenCalledTimes(2);
-  });
-
-  it("collapses concurrent callers into a single mint", async () => {
-    let release!: (value: ReturnType<typeof mintResponse>) => void;
-    mintGuestToken.mockImplementation(
-      () => new Promise((resolve) => { release = resolve; }),
-    );
-    const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
-
-    const first = auth.getAccessToken();
-    const second = auth.getAccessToken();
-    release(mintResponse());
-
-    await expect(first).resolves.toBe("guest-jwt-1");
-    await expect(second).resolves.toBe("guest-jwt-1");
-    expect(mintGuestToken).toHaveBeenCalledTimes(1);
-  });
-
-  it("rejects with a wrapped StigmerError when sharing is revoked", async () => {
-    mintGuestToken.mockRejectedValue(
-      new ConnectError("agent not found", Code.NotFound),
-    );
-    const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
-
-    try {
-      await auth.getAccessToken();
-      expect.fail("should have thrown");
-    } catch (e: unknown) {
-      expect(e).toHaveProperty("name", "StigmerError");
-      expect(e).toHaveProperty("code", "not-found");
-    }
-  });
-
-  it("recovers after a failed mint instead of caching the failure", async () => {
-    mintGuestToken
-      .mockRejectedValueOnce(new ConnectError("unavailable", Code.Unavailable))
-      .mockResolvedValueOnce(mintResponse());
-    const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
-
-    await expect(auth.getAccessToken()).rejects.toMatchObject({
-      code: "unavailable",
-    });
-    await expect(auth.getAccessToken()).resolves.toBe("guest-jwt-1");
-    expect(mintGuestToken).toHaveBeenCalledTimes(2);
-  });
-
-  it("still mints when storage throws", async () => {
-    const brokenStorage: GuestIdStorage = {
-      getItem: () => {
-        throw new Error("storage disabled");
-      },
-      setItem: () => {
-        throw new Error("storage disabled");
-      },
-    };
-    mintGuestToken.mockResolvedValue(mintResponse());
-    const auth = createGuestAuth({ ...CONFIG, storage: brokenStorage });
-
-    await expect(auth.getAccessToken()).resolves.toBe("guest-jwt-1");
-    expect(auth.guestCookieId).toBeNull();
-  });
-});

package/src/__tests__/iam-principal.test.ts

@@ -1,82 +0,0 @@
-/**
- * Pins the grantee vocabulary (`iam-principal.ts`) and the team half of the
- * authorization config (`authorization-config.ts`):
- *
- *   - a team is always granted as `team:<id>#member` and a person always
- *     unqualified, because the server's revoke matches the qualifier
- *     exactly and a dropped `#member` revokes nothing while reporting
- *     success;
- *   - reading an access-list entry back is the inverse of building one,
- *     and anything else (a structural principal, another team qualifier)
- *     is refused rather than guessed at;
- *   - a team may only ever be offered a subset of a person's roles, never
- *     `owner`, and nothing on `organization` (the circular grant the
- *     model's membership bound forbids).
- */
-import { describe, expect, it } from "vitest";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
-
-import {
-  getGrantableRoles,
-  getTeamGrantableRoles,
-  hasTeamGrantableRoles,
-  isRoleTeamGrantable,
-} from "../authorization-config";
-import { TEAM_GRANTABLE_ROLES } from "../gen/authorization-config";
-import {
-  granteeFromView,
-  granteeRef,
-  personGrantee,
-  teamGrantee,
-} from "../iam-principal";
-
-describe("granteeRef — the one spelling of a grantee on the wire", () => {
-  it("names a team as its members", () => {
-    const ref = granteeRef(teamGrantee("tm_sre"));
-    expect([ref.kind, ref.id, ref.relation]).toEqual(["team", "tm_sre", "member"]);
-  });
-
-  it("names a person with no relation qualifier", () => {
-    const ref = granteeRef(personGrantee("ida_alice"));
-    expect([ref.kind, ref.id, ref.relation]).toEqual(["identity_account", "ida_alice", ""]);
-  });
-});
-
-describe("granteeFromView — reading an access-list entry back", () => {
-  it("round-trips both grantees through their wire reference", () => {
-    for (const grantee of [teamGrantee("tm_sre"), personGrantee("ida_alice")]) {
-      expect(granteeFromView(granteeRef(grantee))).toEqual(grantee);
-    }
-  });
-
-  it("refuses what it would misname: a team without its members qualifier, a qualified person, a structural principal, an empty id", () => {
-    expect(granteeFromView({ kind: "team", id: "tm_sre", relation: "" })).toBeUndefined();
-    expect(granteeFromView({ kind: "team", id: "tm_sre", relation: "maintainer" })).toBeUndefined();
-    expect(granteeFromView({ kind: "identity_account", id: "ida_alice", relation: "member" })).toBeUndefined();
-    expect(granteeFromView({ kind: "organization", id: "acme", relation: "" })).toBeUndefined();
-    expect(granteeFromView({ kind: "identity_account", id: "", relation: "" })).toBeUndefined();
-  });
-});
-
-describe("team grantable roles", () => {
-  it("are, for every kind, a subset of the person's roles and never owner", () => {
-    for (const [kind, teamRoles] of TEAM_GRANTABLE_ROLES) {
-      const personRoles = getGrantableRoles(kind);
-      for (const role of teamRoles) {
-        expect(personRoles).toContain(role);
-        expect(role).not.toBe(IamRole.owner);
-      }
-    }
-  });
-
-  it("list nothing on organization, so an organization is never shared with a team", () => {
-    expect(hasTeamGrantableRoles(ApiResourceKind.organization)).toBe(false);
-    expect(getTeamGrantableRoles(ApiResourceKind.organization)).toEqual([]);
-  });
-
-  it("answer per role on a kind a team may be shared", () => {
-    expect(isRoleTeamGrantable(ApiResourceKind.agent, IamRole.viewer)).toBe(true);
-    expect(isRoleTeamGrantable(ApiResourceKind.agent, IamRole.owner)).toBe(false);
-  });
-});