@kindgi/platform 0.0.0-bootstrap.0 → 0.1.0

package/dist/types.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Multi-tenant hierarchy primitives — the type surface for the
+ * `Tenant → Org → Team → Project + User` flow.
+ *
+ * **Pure type shapes.** No runtime code, no validation, no defaults.
+ * Binding interfaces live in the sibling `*-binding.ts` files;
+ * reference in-memory adapters live under `in-memory/`.
+ *
+ * Branded IDs are imported from `@kindgi/types` — this package
+ * adds no new IDs. `Tenant` itself has no full shape here (only the
+ * read-only `TenantSummary` in `tenant-hierarchy-binding.ts`); this
+ * package models the hierarchy that sits *under* the tenant.
+ */
+import type { OrgId, ProjectId, TeamId, TenantId, Timestamp, UserId } from '@kindgi/types';
+export interface Org {
+    readonly id: OrgId;
+    readonly tenantId: TenantId;
+    readonly name: string;
+    readonly slug: string;
+    readonly createdAt: Timestamp;
+    readonly updatedAt: Timestamp;
+}
+export interface OrgSpec {
+    readonly name: string;
+    readonly slug: string;
+}
+export interface OrgPatch {
+    readonly name?: string;
+    readonly slug?: string;
+}
+export interface Team {
+    readonly id: TeamId;
+    readonly tenantId: TenantId;
+    /**
+     * Optional — a team may belong to an org, or be cross-org (no
+     * `orgId`).
+     */
+    readonly orgId?: OrgId;
+    readonly name: string;
+    readonly slug: string;
+    readonly description?: string;
+    readonly createdAt: Timestamp;
+    readonly updatedAt: Timestamp;
+}
+export interface TeamSpec {
+    readonly name: string;
+    readonly slug: string;
+    readonly description?: string;
+    readonly orgId?: OrgId;
+}
+export interface TeamPatch {
+    readonly name?: string;
+    readonly slug?: string;
+    readonly description?: string;
+    /**
+     * `null` explicitly re-assigns the team out of any org (cross-org).
+     * `undefined` leaves the FK untouched.
+     */
+    readonly orgId?: OrgId | null;
+}
+/**
+ * Roles on a `TeamMembership`. Aligned with org/project vocabulary:
+ * `admin` + `member`. Additive with project-level grants: a user in
+ * three teams has the union of the three teams' project grants.
+ * Framework-owned — no external directory sync.
+ */
+export type TeamRole = 'member' | 'admin';
+export interface TeamMembership {
+    readonly teamId: TeamId;
+    readonly userId: UserId;
+    readonly role: TeamRole;
+    readonly joinedAt: Timestamp;
+}
+export interface Project {
+    readonly id: ProjectId;
+    readonly tenantId: TenantId;
+    /**
+     * Optional — a project may belong to an org, or be cross-org (no
+     * `orgId`).
+     */
+    readonly orgId?: OrgId;
+    readonly name: string;
+    readonly slug: string;
+    /**
+     * `true` for the tenant's auto-created "Default" project. Exactly
+     * one row per tenant carries `isDefault = true`.
+     * `false` for every user-created project.
+     */
+    readonly isDefault: boolean;
+    readonly description?: string;
+    readonly createdAt: Timestamp;
+    readonly updatedAt: Timestamp;
+}
+export interface ProjectSpec {
+    readonly name: string;
+    readonly slug: string;
+    readonly description?: string;
+    readonly orgId?: OrgId;
+    /**
+     * Optional at spec time — the tenant's Default project is created
+     * by the framework at tenant-inception, not by a caller. User
+     * projects created via `POST /v1/projects` default to `false`.
+     */
+    readonly isDefault?: boolean;
+}
+export interface ProjectPatch {
+    readonly name?: string;
+    readonly slug?: string;
+    readonly description?: string;
+    /**
+     * `null` explicitly re-assigns the project out of any org.
+     * `undefined` leaves the FK untouched.
+     */
+    readonly orgId?: OrgId | null;
+}
+/**
+ * Roles on a `ProjectMembership` — the direct `User → Project` grant
+ * shape. Additive with team-grants. Mirrors the OpenFGA project-type
+ * relations (owner / editor / viewer) plus the
+ * lightweight `member` and administrative `admin` shorthands.
+ */
+export type ProjectRole = 'viewer' | 'editor' | 'owner' | 'admin' | 'member';
+export interface ProjectMembership {
+    readonly projectId: ProjectId;
+    readonly userId: UserId;
+    readonly role: ProjectRole;
+    readonly joinedAt: Timestamp;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAU3F,MAAM,WAAW,GAAG;IAClB,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAWD,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;CAC/B;AAED;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE1C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;CAC9B;AAcD,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;CAC/B;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE7E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;CAC9B"}

package/dist/types.js

@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+// Authorization types (object types, actions, tuples, checks) live in
+// `@kindgi/authz`.
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;;AA8KjC,sEAAsE;AACtE,mBAAmB"}

package/package.json

@@ -1,7 +1,52 @@
 {
   "name": "@kindgi/platform",
-  "version": "0.0.0-bootstrap.0",
-  "description": "Placeholder so a trusted publisher can be attached. Releases are published from https://github.com/kindgi/kindgi-sdk with provenance; use 0.1.0 or later.",
+  "version": "0.1.0",
+  "description": "Multi-tenant hierarchy primitives — the Tenant → Org → Team → Project + User type surface, the `Scope` discriminated access-boundary, binding interfaces for orgs, teams, projects, memberships, team-project grants and the tenant hierarchy, and reference in-memory adapters.",
   "license": "Apache-2.0",
-  "repository": { "type": "git", "url": "git+https://github.com/kindgi/kindgi-sdk.git" }
-}
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kindgi/kindgi-sdk.git",
+    "directory": "packages/platform"
+  },
+  "homepage": "https://github.com/kindgi/kindgi-sdk/tree/main/packages/platform#readme",
+  "bugs": {
+    "url": "https://github.com/kindgi/kindgi-sdk/issues"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./tests/*": "./tests/*"
+  },
+  "files": [
+    "dist",
+    "src",
+    "tests",
+    "README.md"
+  ],
+  "dependencies": {
+    "@kindgi/types": "0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.5",
+    "typescript": "^5.7.3",
+    "vitest": "^2.1.8"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "clean": "rm -rf dist *.tsbuildinfo"
+  }
+}

package/src/in-memory/index.ts

@@ -0,0 +1,12 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+
+/**
+ * Barrel export for the reference in-memory adapters. Consumers wire
+ * these into dev-time defaults + tests; production deployments supply
+ * durable implementations of the same binding interfaces.
+ */
+
+export { makeInMemoryOrgBinding } from './org-binding.js';
+export { makeInMemoryTeamBinding } from './team-binding.js';
+export { makeInMemoryProjectBinding } from './project-binding.js';

package/src/in-memory/org-binding.ts

@@ -0,0 +1,101 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+
+/**
+ * `makeInMemoryOrgBinding` — reference in-memory implementation of
+ * `OrgBinding`. Used by tests + dev-time defaults. Not durable —
+ * production deployments supply their own implementation.
+ *
+ * Storage: a single `Map<OrgId, Org>` keyed by orgId. Every operation
+ * filters by `tenantId` at the row level — a lookup from tenant A
+ * against an orgId that exists in tenant B returns `undefined` (not a
+ * hit). Cross-tenant leakage is a hard guardrail, asserted by the
+ * conformance suite.
+ */
+
+import type { OrgId, Page, TenantId, Timestamp } from '@kindgi/types';
+
+import type { OrgBinding, OrgListFilter } from '../org-binding.js';
+import type { Org, OrgPatch, OrgSpec } from '../types.js';
+
+import { nowTimestamp, paginate } from './util.js';
+
+let orgIdCounter = 0;
+function nextOrgId(): OrgId {
+  orgIdCounter += 1;
+  return `org-${orgIdCounter}` as OrgId;
+}
+
+/**
+ * Factory for the in-memory `OrgBinding`.
+ */
+export function makeInMemoryOrgBinding(): OrgBinding {
+  const rows = new Map<OrgId, Org>();
+
+  return {
+    async create(tenantId: TenantId, spec: OrgSpec): Promise<OrgId> {
+      const id = nextOrgId();
+      const now = nowTimestamp();
+      const row: Org = {
+        id,
+        tenantId,
+        name: spec.name,
+        slug: spec.slug,
+        createdAt: now,
+        updatedAt: now,
+      };
+      rows.set(id, row);
+      return id;
+    },
+
+    async get(tenantId: TenantId, orgId: OrgId): Promise<Org | undefined> {
+      const row = rows.get(orgId);
+      if (row === undefined) return undefined;
+      if (row.tenantId !== tenantId) return undefined;
+      return row;
+    },
+
+    async list(tenantId: TenantId, filter: OrgListFilter): Promise<Page<Org>> {
+      const all: Org[] = [];
+      for (const row of rows.values()) {
+        if (row.tenantId !== tenantId) continue;
+        if (filter.nameContains !== undefined && !row.name.includes(filter.nameContains)) {
+          continue;
+        }
+        all.push(row);
+      }
+      // Deterministic ordering by createdAt then id for stable pagination.
+      all.sort((a, b) => {
+        if (a.createdAt !== b.createdAt) return a.createdAt < b.createdAt ? -1 : 1;
+        return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
+      });
+      return paginate(all, filter.limit, filter.cursor);
+    },
+
+    async update(tenantId: TenantId, orgId: OrgId, patch: OrgPatch): Promise<void> {
+      const row = rows.get(orgId);
+      if (row === undefined || row.tenantId !== tenantId) {
+        throw new Error(`org-not-found: ${orgId}`);
+      }
+      const now: Timestamp = nowTimestamp();
+      const next: Org = {
+        id: row.id,
+        tenantId: row.tenantId,
+        name: patch.name ?? row.name,
+        slug: patch.slug ?? row.slug,
+        createdAt: row.createdAt,
+        updatedAt: now,
+      };
+      rows.set(orgId, next);
+    },
+
+    async delete(tenantId: TenantId, orgId: OrgId): Promise<void> {
+      const row = rows.get(orgId);
+      if (row === undefined || row.tenantId !== tenantId) {
+        // Idempotent delete — no-op when absent or in another tenant.
+        return;
+      }
+      rows.delete(orgId);
+    },
+  };
+}

package/src/in-memory/project-binding.ts

@@ -0,0 +1,327 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+
+/**
+ * `makeInMemoryProjectBinding` — reference in-memory implementations of
+ * `ProjectBinding` + `ProjectMembershipBinding` + `TeamProjectGrantBinding`.
+ *
+ * Storage: three maps — projects, direct-grant memberships, team-project
+ * grants. All share the same tenant-isolation guardrail + return the
+ * combined trio so callers wire the whole surface at once. The
+ * in-memory adapter keeps the team↔project join (`TeamProjectGrant`)
+ * here for simplicity.
+ *
+ * `create` enforces the `Project.isDefault = true` uniqueness
+ * guardrail at write time: creating a second Default in the same
+ * tenant rejects.
+ */
+
+import type { Filter, Page, ProjectId, TeamId, TenantId, UserId } from '@kindgi/types';
+
+import type {
+  ProjectBinding,
+  ProjectListFilter,
+  ProjectMembershipAddInput,
+  ProjectMembershipBinding,
+} from '../project-binding.js';
+import type {
+  TeamProjectGrant,
+  TeamProjectGrantAddInput,
+  TeamProjectGrantBinding,
+} from '../team-project-grant-binding.js';
+import type {
+  Project,
+  ProjectMembership,
+  ProjectPatch,
+  ProjectRole,
+  ProjectSpec,
+} from '../types.js';
+
+import { nowTimestamp, paginate } from './util.js';
+
+let projectIdCounter = 0;
+function nextProjectId(): ProjectId {
+  projectIdCounter += 1;
+  return `project-${projectIdCounter}` as ProjectId;
+}
+
+function projMembershipKey(projectId: ProjectId, userId: UserId): string {
+  return `${projectId}::${userId}`;
+}
+
+function grantKey(teamId: TeamId, projectId: ProjectId): string {
+  return `${teamId}::${projectId}`;
+}
+
+/**
+ * Combined factory — returns the three project-related bindings that
+ * share underlying storage. Any of them can be plucked out and passed
+ * individually to consumers that need just one.
+ */
+export function makeInMemoryProjectBinding(): {
+  readonly projects: ProjectBinding;
+  readonly memberships: ProjectMembershipBinding;
+  readonly grants: TeamProjectGrantBinding;
+} {
+  const projectRows = new Map<ProjectId, Project>();
+  const membershipRows = new Map<string, ProjectMembership>();
+  const grantRows = new Map<string, TeamProjectGrant>();
+  // Track grant insertion order for deterministic `list` ordering.
+  const grantOrder: string[] = [];
+
+  function findProjectInTenant(tenantId: TenantId, projectId: ProjectId): Project | undefined {
+    const p = projectRows.get(projectId);
+    if (p === undefined || p.tenantId !== tenantId) return undefined;
+    return p;
+  }
+
+  function tenantAlreadyHasDefault(tenantId: TenantId): boolean {
+    for (const row of projectRows.values()) {
+      if (row.tenantId === tenantId && row.isDefault) return true;
+    }
+    return false;
+  }
+
+  const projects: ProjectBinding = {
+    async create(tenantId, spec: ProjectSpec): Promise<ProjectId> {
+      const isDefault = spec.isDefault === true;
+      if (isDefault && tenantAlreadyHasDefault(tenantId)) {
+        throw new Error(
+          `project-default-already-exists: tenant ${tenantId} already has an isDefault=true project`,
+        );
+      }
+      const id = nextProjectId();
+      const now = nowTimestamp();
+      const row: Project = {
+        id,
+        tenantId,
+        name: spec.name,
+        slug: spec.slug,
+        isDefault,
+        createdAt: now,
+        updatedAt: now,
+        ...(spec.orgId !== undefined ? { orgId: spec.orgId } : {}),
+        ...(spec.description !== undefined ? { description: spec.description } : {}),
+      };
+      projectRows.set(id, row);
+      return id;
+    },
+
+    async get(tenantId, projectId): Promise<Project | undefined> {
+      return findProjectInTenant(tenantId, projectId);
+    },
+
+    async list(tenantId, filter: ProjectListFilter): Promise<Page<Project>> {
+      const all: Project[] = [];
+      for (const row of projectRows.values()) {
+        if (row.tenantId !== tenantId) continue;
+        if (filter.orgId !== undefined && row.orgId !== filter.orgId) continue;
+        if (filter.nameContains !== undefined && !row.name.includes(filter.nameContains)) {
+          continue;
+        }
+        all.push(row);
+      }
+      all.sort((a, b) => {
+        if (a.createdAt !== b.createdAt) return a.createdAt < b.createdAt ? -1 : 1;
+        return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
+      });
+      return paginate(all, filter.limit, filter.cursor);
+    },
+
+    async getDefault(tenantId): Promise<Project | undefined> {
+      for (const row of projectRows.values()) {
+        if (row.tenantId === tenantId && row.isDefault) return row;
+      }
+      return undefined;
+    },
+
+    async update(tenantId, projectId, patch: ProjectPatch): Promise<void> {
+      const row = findProjectInTenant(tenantId, projectId);
+      if (row === undefined) {
+        throw new Error(`project-not-found: ${projectId}`);
+      }
+      let nextOrgId = row.orgId;
+      if (patch.orgId !== undefined) {
+        nextOrgId = patch.orgId === null ? undefined : patch.orgId;
+      }
+      const nextDescription = patch.description ?? row.description;
+      const next: Project = {
+        id: row.id,
+        tenantId: row.tenantId,
+        name: patch.name ?? row.name,
+        slug: patch.slug ?? row.slug,
+        isDefault: row.isDefault,
+        createdAt: row.createdAt,
+        updatedAt: nowTimestamp(),
+        ...(nextOrgId !== undefined ? { orgId: nextOrgId } : {}),
+        ...(nextDescription !== undefined ? { description: nextDescription } : {}),
+      };
+      projectRows.set(projectId, next);
+    },
+
+    async delete(tenantId, projectId): Promise<void> {
+      const row = findProjectInTenant(tenantId, projectId);
+      if (row === undefined) return;
+      projectRows.delete(projectId);
+      // Cascade — direct memberships + team grants drop with the project.
+      for (const key of membershipRows.keys()) {
+        if (key.startsWith(`${projectId}::`)) {
+          membershipRows.delete(key);
+        }
+      }
+      for (let i = grantOrder.length - 1; i >= 0; i -= 1) {
+        const key = grantOrder[i];
+        if (key === undefined) continue;
+        if (key.endsWith(`::${projectId}`)) {
+          grantRows.delete(key);
+          grantOrder.splice(i, 1);
+        }
+      }
+    },
+  };
+
+  const memberships: ProjectMembershipBinding = {
+    async add(tenantId, input: ProjectMembershipAddInput): Promise<void> {
+      const proj = findProjectInTenant(tenantId, input.projectId);
+      if (proj === undefined) {
+        throw new Error(`project-not-found: ${input.projectId}`);
+      }
+      const key = projMembershipKey(input.projectId, input.userId);
+      if (membershipRows.has(key)) return;
+      const row: ProjectMembership = {
+        projectId: input.projectId,
+        userId: input.userId,
+        role: input.role,
+        joinedAt: nowTimestamp(),
+      };
+      membershipRows.set(key, row);
+    },
+
+    async remove(tenantId, projectId, userId): Promise<void> {
+      const proj = findProjectInTenant(tenantId, projectId);
+      if (proj === undefined) return;
+      membershipRows.delete(projMembershipKey(projectId, userId));
+    },
+
+    async list(tenantId, projectId, filter: Filter): Promise<Page<ProjectMembership>> {
+      const proj = findProjectInTenant(tenantId, projectId);
+      if (proj === undefined) return { items: [] };
+      const all: ProjectMembership[] = [];
+      for (const row of membershipRows.values()) {
+        if (row.projectId !== projectId) continue;
+        all.push(row);
+      }
+      all.sort((a, b) => (a.joinedAt < b.joinedAt ? -1 : a.joinedAt > b.joinedAt ? 1 : 0));
+      return paginate(all, filter.limit, filter.cursor);
+    },
+
+    async listForUser(tenantId, userId, filter: Filter): Promise<Page<ProjectMembership>> {
+      const all: ProjectMembership[] = [];
+      for (const row of membershipRows.values()) {
+        if (row.userId !== userId) continue;
+        const p = projectRows.get(row.projectId);
+        if (p === undefined || p.tenantId !== tenantId) continue;
+        all.push(row);
+      }
+      all.sort((a, b) => (a.joinedAt < b.joinedAt ? -1 : a.joinedAt > b.joinedAt ? 1 : 0));
+      return paginate(all, filter.limit, filter.cursor);
+    },
+
+    async updateRole(tenantId, projectId, userId, role: ProjectRole): Promise<void> {
+      const proj = findProjectInTenant(tenantId, projectId);
+      if (proj === undefined) {
+        throw new Error(`project-not-found: ${projectId}`);
+      }
+      const key = projMembershipKey(projectId, userId);
+      const row = membershipRows.get(key);
+      if (row === undefined) {
+        throw new Error(`project-membership-not-found: ${projectId}/${userId}`);
+      }
+      membershipRows.set(key, { ...row, role });
+    },
+  };
+
+  const grants: TeamProjectGrantBinding = {
+    async add(tenantId, input: TeamProjectGrantAddInput): Promise<void> {
+      // Grant validity requires the project to exist in-tenant. Team
+      // existence is not checked here: teams live in the separate
+      // `makeInMemoryTeamBinding` store.
+      const proj = findProjectInTenant(tenantId, input.projectId);
+      if (proj === undefined) {
+        throw new Error(`project-not-found: ${input.projectId}`);
+      }
+      const key = grantKey(input.teamId, input.projectId);
+      if (grantRows.has(key)) return;
+      const row: TeamProjectGrant = {
+        teamId: input.teamId,
+        projectId: input.projectId,
+        role: input.role,
+      };
+      grantRows.set(key, row);
+      grantOrder.push(key);
+    },
+
+    async remove(tenantId, teamId, projectId): Promise<void> {
+      const proj = findProjectInTenant(tenantId, projectId);
+      if (proj === undefined) return;
+      const key = grantKey(teamId, projectId);
+      if (grantRows.delete(key)) {
+        const idx = grantOrder.indexOf(key);
+        if (idx >= 0) grantOrder.splice(idx, 1);
+      }
+    },
+
+    async list(tenantId, filter: Filter): Promise<Page<TeamProjectGrant>> {
+      const all: TeamProjectGrant[] = [];
+      for (const key of grantOrder) {
+        const row = grantRows.get(key);
+        if (row === undefined) continue;
+        const p = projectRows.get(row.projectId);
+        if (p === undefined || p.tenantId !== tenantId) continue;
+        all.push(row);
+      }
+      return paginate(all, filter.limit, filter.cursor);
+    },
+
+    async listForTeam(tenantId, teamId, filter: Filter): Promise<Page<TeamProjectGrant>> {
+      const all: TeamProjectGrant[] = [];
+      for (const key of grantOrder) {
+        const row = grantRows.get(key);
+        if (row === undefined) continue;
+        if (row.teamId !== teamId) continue;
+        const p = projectRows.get(row.projectId);
+        if (p === undefined || p.tenantId !== tenantId) continue;
+        all.push(row);
+      }
+      return paginate(all, filter.limit, filter.cursor);
+    },
+
+    async listForProject(tenantId, projectId, filter: Filter): Promise<Page<TeamProjectGrant>> {
+      const proj = findProjectInTenant(tenantId, projectId);
+      if (proj === undefined) return { items: [] };
+      const all: TeamProjectGrant[] = [];
+      for (const key of grantOrder) {
+        const row = grantRows.get(key);
+        if (row === undefined) continue;
+        if (row.projectId !== projectId) continue;
+        all.push(row);
+      }
+      return paginate(all, filter.limit, filter.cursor);
+    },
+
+    async updateRole(tenantId, teamId, projectId, role: ProjectRole): Promise<void> {
+      const proj = findProjectInTenant(tenantId, projectId);
+      if (proj === undefined) {
+        throw new Error(`project-not-found: ${projectId}`);
+      }
+      const key = grantKey(teamId, projectId);
+      const row = grantRows.get(key);
+      if (row === undefined) {
+        throw new Error(`team-project-grant-not-found: ${teamId}/${projectId}`);
+      }
+      grantRows.set(key, { ...row, role });
+    },
+  };
+
+  return { projects, memberships, grants };
+}