@kindgi/platform 0.0.0-bootstrap.0 → 0.1.1

package/dist/org-binding.d.ts

@@ -0,0 +1,70 @@
+/**
+ * `OrgBinding` — CRUD surface for the `Org` primitive within a tenant.
+ *
+ * Conventions shared by every binding in this package:
+ * - Every method takes `tenantId: TenantId` as its first argument. The
+ *   binding is responsible for enforcing tenant isolation: a call from
+ *   tenant A must never surface a row from tenant B.
+ * - `list` returns the shared `Page<T>` envelope from
+ *   `@kindgi/types` (`items` + `nextCursor`).
+ * - `list` filters extend the shared `Filter` shape so every list call
+ *   shares the same pagination fields.
+ *
+ * This package ships the interface + reference in-memory adapter
+ * (in `./in-memory/org-binding.ts`). Any adapter can be checked with
+ * the conformance suite in `packages/platform/tests/`
+ * (`runOrgBindingConformance`).
+ */
+import type { Filter, OrgId, Page, TenantId } from '@kindgi/types';
+import type { Org, OrgPatch, OrgSpec } from './types.js';
+/**
+ * `list` filter for orgs. Extends the shared `Filter` with `orgs`-
+ * specific facets. Every additional field on the list contract lives
+ * here (not on the method signature) so the shape survives SDK codegen
+ * unchanged.
+ *
+ * - `nameContains` — case-sensitive substring match on `Org.name`.
+ *   Optional; absent = no name filter. The `@kindgi/api` orgs route
+ *   exposes it as `?nameContains=`.
+ */
+export interface OrgListFilter extends Filter {
+    readonly nameContains?: string;
+}
+/**
+ * The org CRUD binding. Framework consumers implement one of these
+ * per persistence backend (Postgres, in-memory for tests).
+ */
+export interface OrgBinding {
+    /**
+     * Create a new `Org` in the given tenant. Returns the freshly-
+     * assigned `OrgId`. The binding is responsible for allocating IDs,
+     * timestamps, and slug-uniqueness enforcement within the tenant.
+     */
+    create(tenantId: TenantId, spec: OrgSpec): Promise<OrgId>;
+    /**
+     * Look up an `Org` by id. Returns `undefined` when no row exists in
+     * the given tenant, or when the row exists in a different tenant
+     * (tenant isolation is by construction, never a silent leak).
+     */
+    get(tenantId: TenantId, orgId: OrgId): Promise<Org | undefined>;
+    /**
+     * Cursor-paginated list of orgs within a tenant. Uses the shared
+     * `Page<Org>` envelope from `@kindgi/types` — consumers loop on
+     * `nextCursor` until it's absent.
+     */
+    list(tenantId: TenantId, filter: OrgListFilter): Promise<Page<Org>>;
+    /**
+     * Partially update an `Org`. Fields absent from `patch` are left
+     * unchanged; fields present are set to the new value. Not-found is
+     * an error the adapter surfaces (e.g. as a rejected promise); the
+     * conformance suite specifies the exact shape.
+     */
+    update(tenantId: TenantId, orgId: OrgId, patch: OrgPatch): Promise<void>;
+    /**
+     * Delete an `Org`. Cascade semantics (dependent teams / projects) are
+     * a storage-layer concern — the in-memory adapter does the delete
+     * unconditionally.
+     */
+    delete(tenantId: TenantId, orgId: OrgId): Promise<void>;
+}
+//# sourceMappingURL=org-binding.d.ts.map

package/dist/org-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-binding.d.ts","sourceRoot":"","sources":["../src/org-binding.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEnE,OAAO,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAEzD;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAc,SAAQ,MAAM;IAC3C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB;;;;OAIG;IACH,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1D;;;;OAIG;IACH,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;IAChE;;;;OAIG;IACH,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE;;;;OAIG;IACH,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD"}

package/dist/org-binding.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=org-binding.js.map

package/dist/org-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-binding.js","sourceRoot":"","sources":["../src/org-binding.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}

package/dist/project-binding.d.ts

@@ -0,0 +1,115 @@
+/**
+ * `ProjectBinding` + `ProjectMembershipBinding` — the project CRUD
+ * surface + the user↔project direct-grant membership surface within a
+ * tenant.
+ *
+ * Projects are the primary content-scope; all content (memory /
+ * agents / flows / guardrails / runs / artifacts / cost / evals /
+ * approvals / evidence / provenance / observations) carries a
+ * required `projectId` and is read/written filtered by it.
+ *
+ * `getDefault` returns the tenant's auto-created "Default" project.
+ * That row is the only one where `Project.isDefault = true`;
+ * implementations keep exactly one per tenant (this binding's
+ * in-memory adapter checks at write time, before the row lands in the
+ * map). Callers that don't naturally know a project resolve the
+ * Default with `getDefault` and pass its id explicitly (see e.g.
+ * `AgentPublishInput.projectId` in `@kindgi/api`).
+ *
+ * Same convention as `org-binding.ts`: `tenantId` first, `Page<T>`
+ * return, `Filter`-extending filter shapes.
+ */
+import type { Filter, OrgId, Page, ProjectId, TenantId, UserId } from '@kindgi/types';
+import type { Project, ProjectMembership, ProjectPatch, ProjectRole, ProjectSpec } from './types.js';
+/**
+ * `list` filter for projects. Same shape as `TeamListFilter` — `orgId`
+ * narrows to a specific org's projects (nullable FK);
+ * `nameContains` is a substring match on `Project.name`.
+ */
+export interface ProjectListFilter extends Filter {
+    readonly orgId?: OrgId;
+    readonly nameContains?: string;
+}
+/**
+ * Input for `ProjectMembershipBinding.add`. Distinct interface so
+ * downstream additions extend without breaking call sites.
+ */
+export interface ProjectMembershipAddInput {
+    readonly projectId: ProjectId;
+    readonly userId: UserId;
+    readonly role: ProjectRole;
+}
+/**
+ * The project CRUD binding.
+ */
+export interface ProjectBinding {
+    /**
+     * Create a `Project` within the tenant. `spec.orgId` optional. If
+     * `spec.isDefault === true` and a Default already exists, the
+     * binding rejects — the isDefault-uniqueness guardrail is enforced
+     * at write time.
+     */
+    create(tenantId: TenantId, spec: ProjectSpec): Promise<ProjectId>;
+    /**
+     * Look up a `Project` by id. `undefined` when unknown or in a
+     * different tenant.
+     */
+    get(tenantId: TenantId, projectId: ProjectId): Promise<Project | undefined>;
+    /**
+     * Cursor-paginated list of projects. Filter by `orgId` or
+     * `nameContains`.
+     */
+    list(tenantId: TenantId, filter: ProjectListFilter): Promise<Page<Project>>;
+    /**
+     * The tenant's Default project (`isDefault: true`). Returns
+     * `undefined` when no Default project exists for the tenant.
+     */
+    getDefault(tenantId: TenantId): Promise<Project | undefined>;
+    /**
+     * Partially update a `Project`. `ProjectPatch.orgId` supports
+     * `null` to re-assign the project out of any org.
+     */
+    update(tenantId: TenantId, projectId: ProjectId, patch: ProjectPatch): Promise<void>;
+    /**
+     * Delete a `Project`. What happens to content rows that still
+     * reference the project is the storage layer's concern; the
+     * in-memory adapter removes the project's direct memberships and
+     * team grants with it.
+     */
+    delete(tenantId: TenantId, projectId: ProjectId): Promise<void>;
+}
+/**
+ * User↔project direct-grant membership. Additive with team grants
+ * (the union rules); a user may have both a direct
+ * `ProjectMembership` and access via a team-project grant.
+ * Authorization resolves the union.
+ */
+export interface ProjectMembershipBinding {
+    /**
+     * Add a user directly to a project. Idempotent on
+     * `(projectId, userId)` — re-adding the same user does not mutate
+     * a stored differing role. Use `updateRole` to change roles.
+     */
+    add(tenantId: TenantId, input: ProjectMembershipAddInput): Promise<void>;
+    /**
+     * Remove the direct project grant. No-op when absent.
+     */
+    remove(tenantId: TenantId, projectId: ProjectId, userId: UserId): Promise<void>;
+    /**
+     * Cursor-paginated direct memberships of a project. Ordered by
+     * `joinedAt` ascending.
+     */
+    list(tenantId: TenantId, projectId: ProjectId, filter: Filter): Promise<Page<ProjectMembership>>;
+    /**
+     * Cursor-paginated direct memberships of a user (across every
+     * project the user is directly a member of within the tenant).
+     * Used to resolve a user's direct project set.
+     */
+    listForUser(tenantId: TenantId, userId: UserId, filter: Filter): Promise<Page<ProjectMembership>>;
+    /**
+     * Update an existing direct-membership's role. Errors when the
+     * membership doesn't exist.
+     */
+    updateRole(tenantId: TenantId, projectId: ProjectId, userId: UserId, role: ProjectRole): Promise<void>;
+}
+//# sourceMappingURL=project-binding.d.ts.map

package/dist/project-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-binding.d.ts","sourceRoot":"","sources":["../src/project-binding.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEtF,OAAO,KAAK,EACV,OAAO,EACP,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,WAAW,EACZ,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,MAAM,WAAW,iBAAkB,SAAQ,MAAM;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClE;;;OAGG;IACH,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IAC5E;;;OAGG;IACH,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E;;;OAGG;IACH,UAAU,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IAC7D;;;OAGG;IACH,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF;;;OAGG;IACH,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjG;;;;OAIG;IACH,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAClG;;;OAGG;IACH,UAAU,CACR,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB"}

package/dist/project-binding.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=project-binding.js.map

package/dist/project-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-binding.js","sourceRoot":"","sources":["../src/project-binding.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}

package/dist/scope.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The `Scope` primitive — a required, discriminated access boundary.
+ *
+ * Design decision: a subset of framework resources —
+ * those that describe policy, configuration, or authoring templates
+ * rather than run-time content — carry a required, discriminated
+ * `Scope` value that names the level at which the resource is
+ * visible. The `Scope` is not a filter; it's a **row-level property**
+ * recorded at insert time.
+ *
+ * Which resources carry `Scope` (vs `projectId`)?
+ * - **Content-scoped** (agents, flows, tools, guardrails, memory
+ *   facts, artifacts, runs, cost records, eval suites, eval runs,
+ *   approvals, evidence, provenance, observations): a required
+ *   `projectId`. Rows are the *contents* of a project.
+ * - **Policy/config-scoped** (MCP endpoints, secrets, env values,
+ *   pack templates, S3 credentials): `Scope` discriminated
+ *   (Tenant / Org / Project). Describes *how* content is served —
+ *   auth providers, credentials, template catalogs. A firm may want
+ *   firm-wide MCP endpoints OR matter-scoped MCP endpoints; fixed to
+ *   one level is wrong, nullable is worse.
+ * - **Tenant-only** (adapters, capabilities, identity providers,
+ *   deployment ledger, signing keys, tenant config): a required
+ *   `tenantId` only. Deployment-wide framework configuration.
+ *
+ * Resolution semantics (most-specific-wins): for a resource lookup
+ * within a request context that carries `{ tenantId, projectId }`,
+ * walk `project → org → tenant` (the org is the project's `orgId`);
+ * first match wins.
+ */
+import type { OrgId, ProjectId, TenantId } from '@kindgi/types';
+export type Scope = {
+    readonly kind: 'tenant';
+    readonly tenantId: TenantId;
+} | {
+    readonly kind: 'org';
+    readonly tenantId: TenantId;
+    readonly orgId: OrgId;
+} | {
+    readonly kind: 'project';
+    readonly tenantId: TenantId;
+    readonly projectId: ProjectId;
+};
+export declare function scopeKey(s: Scope): string;
+//# sourceMappingURL=scope.d.ts.map

package/dist/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEhE,MAAM,MAAM,KAAK,GACb;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AAE7F,wBAAgB,QAAQ,CAAC,CAAC,EAAE,KAAK,GAAG,MAAM,CASzC"}

package/dist/scope.js

@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export function scopeKey(s) {
+    switch (s.kind) {
+        case 'tenant':
+            return `tenant:${s.tenantId}`;
+        case 'org':
+            return `org:${s.orgId}`;
+        case 'project':
+            return `project:${s.projectId}`;
+    }
+}
+//# sourceMappingURL=scope.js.map

package/dist/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAwCjC,MAAM,UAAU,QAAQ,CAAC,CAAQ;IAC/B,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChC,KAAK,KAAK;YACR,OAAO,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC;QAC1B,KAAK,SAAS;YACZ,OAAO,WAAW,CAAC,CAAC,SAAS,EAAE,CAAC;IACpC,CAAC;AACH,CAAC"}

package/dist/team-binding.d.ts

@@ -0,0 +1,108 @@
+/**
+ * `TeamBinding` + `TeamMembershipBinding` — the team CRUD surface + the
+ * user↔team membership surface within a tenant.
+ *
+ * Team memberships are **framework-owned**: there is no external
+ * directory sync. `TeamMembershipBinding` is the sole source of
+ * truth.
+ *
+ * Same convention as `org-binding.ts`: `tenantId` first, `Page<T>`
+ * return, `Filter`-extending filter shapes.
+ */
+import type { Filter, OrgId, Page, TeamId, TenantId, UserId } from '@kindgi/types';
+import type { Team, TeamMembership, TeamPatch, TeamRole, TeamSpec } from './types.js';
+/**
+ * `list` filter for teams. `orgId` narrows to teams belonging to a
+ * specific org (the `Team.orgId?` nullable FK); absent =
+ * no org filter, including cross-org teams. `nameContains` mirrors
+ * the org shape.
+ */
+export interface TeamListFilter extends Filter {
+    readonly orgId?: OrgId;
+    readonly nameContains?: string;
+}
+/**
+ * Input for `TeamMembershipBinding.add`. Distinct interface (not
+ * positional args) so downstream additions — e.g., an `addedBy?:
+ * UserId` audit field added later — extend without breaking
+ * every call site.
+ */
+export interface TeamMembershipAddInput {
+    readonly teamId: TeamId;
+    readonly userId: UserId;
+    readonly role: TeamRole;
+}
+/**
+ * The team CRUD binding.
+ */
+export interface TeamBinding {
+    /**
+     * Create a `Team` within the tenant. `spec.orgId` optional (a team
+     * may be cross-org — nullable FK). Returns the assigned
+     * `TeamId`.
+     */
+    create(tenantId: TenantId, spec: TeamSpec): Promise<TeamId>;
+    /**
+     * Look up a `Team` by id. `undefined` when unknown or in a different
+     * tenant.
+     */
+    get(tenantId: TenantId, teamId: TeamId): Promise<Team | undefined>;
+    /**
+     * Cursor-paginated list of teams. Filter by `orgId` (narrow to one
+     * org's teams) or `nameContains` (substring match on `Team.name`).
+     */
+    list(tenantId: TenantId, filter: TeamListFilter): Promise<Page<Team>>;
+    /**
+     * Partially update a `Team`. `TeamPatch.orgId` supports `null` to
+     * explicitly re-assign the team out of any org (cross-org), and
+     * `undefined` to leave the FK untouched.
+     */
+    update(tenantId: TenantId, teamId: TeamId, patch: TeamPatch): Promise<void>;
+    /**
+     * Delete a `Team`. Its membership rows are removed with it (the
+     * in-memory adapter deletes them from its map).
+     */
+    delete(tenantId: TenantId, teamId: TeamId): Promise<void>;
+}
+/**
+ * User↔team membership CRUD. Typical consumers: identity views that
+ * show a user's teams, and authorization, where the `team:T#member`
+ * userset (see `@kindgi/authz`) gives members access to projects
+ * through a team-project grant.
+ */
+export interface TeamMembershipBinding {
+    /**
+     * Add a user to a team with a given role. Idempotent on the
+     * `(teamId, userId)` primary key — re-adding the same user does not
+     * duplicate the row. To change an existing member's role use
+     * `updateRole` (semantics are explicit; add-with-role does not
+     * silently mutate a differing role).
+     *
+     * The conformance suite pins this: adding an existing member whose
+     * stored role differs is a no-op (not a role overwrite).
+     */
+    add(tenantId: TenantId, input: TeamMembershipAddInput): Promise<void>;
+    /**
+     * Remove a user from a team. Missing membership is a no-op (not an
+     * error) — matches every peer platform's membership-remove shape.
+     */
+    remove(tenantId: TenantId, teamId: TeamId, userId: UserId): Promise<void>;
+    /**
+     * Cursor-paginated memberships of a team. Ordered by `joinedAt`
+     * ascending; the conformance suite pins this ordering.
+     */
+    list(tenantId: TenantId, teamId: TeamId, filter: Filter): Promise<Page<TeamMembership>>;
+    /**
+     * Cursor-paginated memberships of a user (across every team the
+     * user belongs to within the tenant). Used to resolve a user's team
+     * set (identity views, authorization inheritance).
+     */
+    listForUser(tenantId: TenantId, userId: UserId, filter: Filter): Promise<Page<TeamMembership>>;
+    /**
+     * Update an existing membership's role. Errors when the membership
+     * doesn't exist — role mutation of a non-member is a caller mistake,
+     * not a silent add. Conformance suite pins the not-found behaviour.
+     */
+    updateRole(tenantId: TenantId, teamId: TeamId, userId: UserId, role: TeamRole): Promise<void>;
+}
+//# sourceMappingURL=team-binding.d.ts.map

package/dist/team-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-binding.d.ts","sourceRoot":"","sources":["../src/team-binding.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEnF,OAAO,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtF;;;;;GAKG;AACH,MAAM,WAAW,cAAe,SAAQ,MAAM;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D;;;OAGG;IACH,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IACnE;;;OAGG;IACH,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE;;;;OAIG;IACH,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E;;;OAGG;IACH,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;OASG;IACH,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE;;;OAGG;IACH,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E;;;OAGG;IACH,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IACxF;;;;OAIG;IACH,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAC/F;;;;OAIG;IACH,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/F"}

package/dist/team-binding.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=team-binding.js.map

package/dist/team-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-binding.js","sourceRoot":"","sources":["../src/team-binding.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}

package/dist/team-project-grant-binding.d.ts

@@ -0,0 +1,49 @@
+/**
+ * `TeamProjectGrant` — the team↔project join surface. One row per
+ * `(teamId, projectId)` primary key; the `role` names the project-
+ * scope grant every team member inherits via the FGA `team:T#member`
+ * userset (see `@kindgi/authz`).
+ *
+ * Same tenant-first convention as every other binding in
+ * `@kindgi/platform`. The in-memory reference implementation is part
+ * of `makeInMemoryProjectBinding` (its `grants` binding).
+ */
+import type { Filter, Page, ProjectId, TeamId, TenantId } from '@kindgi/types';
+import type { ProjectRole } from './types.js';
+/**
+ * A team-mediated grant on a project. The `role` uses the same
+ * `ProjectRole` union as direct `ProjectMembership.role` — semantics
+ * compose (the authorization model resolves the union / inheritance).
+ */
+export interface TeamProjectGrant {
+    readonly teamId: TeamId;
+    readonly projectId: ProjectId;
+    readonly role: ProjectRole;
+}
+export interface TeamProjectGrantAddInput {
+    readonly teamId: TeamId;
+    readonly projectId: ProjectId;
+    readonly role: ProjectRole;
+}
+/**
+ * CRUD for team↔project grants.
+ */
+export interface TeamProjectGrantBinding {
+    /**
+     * Add a team-project grant. Idempotent on `(teamId, projectId)` —
+     * re-adding the same team on the same project does not mutate a
+     * stored differing role. Use `updateRole` to change roles.
+     */
+    add(tenantId: TenantId, input: TeamProjectGrantAddInput): Promise<void>;
+    /** Remove a team-project grant. No-op when absent. */
+    remove(tenantId: TenantId, teamId: TeamId, projectId: ProjectId): Promise<void>;
+    /** Cursor-paginated grants filtered by tenant. */
+    list(tenantId: TenantId, filter: Filter): Promise<Page<TeamProjectGrant>>;
+    /** Cursor-paginated grants for a specific team. */
+    listForTeam(tenantId: TenantId, teamId: TeamId, filter: Filter): Promise<Page<TeamProjectGrant>>;
+    /** Cursor-paginated grants for a specific project. */
+    listForProject(tenantId: TenantId, projectId: ProjectId, filter: Filter): Promise<Page<TeamProjectGrant>>;
+    /** Update a grant's role. Errors when the grant doesn't exist. */
+    updateRole(tenantId: TenantId, teamId: TeamId, projectId: ProjectId, role: ProjectRole): Promise<void>;
+}
+//# sourceMappingURL=team-project-grant-binding.d.ts.map

package/dist/team-project-grant-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-project-grant-binding.d.ts","sourceRoot":"","sources":["../src/team-project-grant-binding.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,sDAAsD;IACtD,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF,kDAAkD;IAClD,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC1E,mDAAmD;IACnD,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACjG,sDAAsD;IACtD,cAAc,CACZ,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACnC,kEAAkE;IAClE,UAAU,CACR,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB"}

package/dist/team-project-grant-binding.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=team-project-grant-binding.js.map

package/dist/team-project-grant-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-project-grant-binding.js","sourceRoot":"","sources":["../src/team-project-grant-binding.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}

package/dist/tenant-hierarchy-binding.d.ts

@@ -0,0 +1,104 @@
+import type { OrgId, ProjectId, Result, TeamId, TenantId, UserId } from '@kindgi/types';
+import type { OrgSpec, ProjectRole, ProjectSpec, TeamRole, TeamSpec } from './types.js';
+export interface CreateOrgParams {
+    readonly tenantId: TenantId;
+    readonly creatorUserId: UserId;
+    readonly spec: OrgSpec;
+}
+export type CreateOrgError = {
+    readonly code: 'slug-conflict';
+    readonly message: string;
+    readonly cause?: unknown;
+} | {
+    readonly code: 'insert-failed';
+    readonly message: string;
+    readonly cause?: unknown;
+};
+export interface CreateTeamParams {
+    readonly tenantId: TenantId;
+    readonly creatorUserId: UserId;
+    readonly spec: TeamSpec;
+}
+export type CreateTeamError = {
+    readonly code: 'slug-conflict';
+    readonly message: string;
+    readonly cause?: unknown;
+} | {
+    readonly code: 'insert-failed';
+    readonly message: string;
+    readonly cause?: unknown;
+};
+export interface AddTeamMemberParams {
+    readonly tenantId: TenantId;
+    readonly teamId: TeamId;
+    readonly userId: UserId;
+    readonly role: TeamRole;
+}
+export interface CreateProjectParams {
+    readonly tenantId: TenantId;
+    readonly creatorUserId: UserId;
+    readonly spec: ProjectSpec;
+}
+export type CreateProjectError = {
+    readonly code: 'slug-conflict';
+    readonly message: string;
+    readonly cause?: unknown;
+} | {
+    readonly code: 'default-conflict';
+    readonly message: string;
+    readonly cause?: unknown;
+} | {
+    readonly code: 'insert-failed';
+    readonly message: string;
+    readonly cause?: unknown;
+};
+export interface AddProjectMemberParams {
+    readonly tenantId: TenantId;
+    readonly projectId: ProjectId;
+    readonly userId: UserId;
+    readonly role: ProjectRole;
+}
+export interface MembershipMutationError {
+    readonly code: string;
+    readonly message: string;
+}
+/**
+ * Tenant-summary read shape returned by `getTenant`. Only the fields
+ * the `/v1/tenant` GET route surfaces — id / name / slug / createdAt /
+ * updatedAt. Timestamps are ISO 8601 strings; impls that hold Date
+ * objects convert at the boundary.
+ */
+export interface TenantSummary {
+    readonly id: TenantId;
+    readonly name: string;
+    readonly slug: string;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+}
+/**
+ * Tenant-hierarchy CRUD binding. Every route that creates orgs /
+ * teams / projects or adds members writes atomically: entity insert
+ * + FGA parent/owner tuples in the same transaction.
+ *
+ * Deployments supply the implementation; tests can substitute a mock.
+ */
+export interface TenantHierarchyBinding {
+    createOrg(params: CreateOrgParams): Promise<Result<{
+        readonly orgId: OrgId;
+    }, CreateOrgError>>;
+    createTeam(params: CreateTeamParams): Promise<Result<{
+        readonly teamId: TeamId;
+    }, CreateTeamError>>;
+    createProject(params: CreateProjectParams): Promise<Result<{
+        readonly projectId: ProjectId;
+    }, CreateProjectError>>;
+    addTeamMember(params: AddTeamMemberParams): Promise<Result<void, MembershipMutationError>>;
+    addProjectMember(params: AddProjectMemberParams): Promise<Result<void, MembershipMutationError>>;
+    /**
+     * Look up a tenant by id. Returns `null` when no tenant exists.
+     * Not itself tenant-scoped: it is how a caller finds out which
+     * tenant it is operating as.
+     */
+    getTenant(tenantId: TenantId): Promise<TenantSummary | null>;
+}
+//# sourceMappingURL=tenant-hierarchy-binding.d.ts.map

package/dist/tenant-hierarchy-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-hierarchy-binding.d.ts","sourceRoot":"","sources":["../src/tenant-hierarchy-binding.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACxF,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAExF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GACtF;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAE3F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GACtF;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAE3F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;CAC5B;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GACtF;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GACzF;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAE3F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;KAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IAC/F,UAAU,CACR,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IACjE,aAAa,CACX,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;KAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC1E,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAC3F,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACjG;;;;OAIG;IACH,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;CAC9D"}

package/dist/tenant-hierarchy-binding.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=tenant-hierarchy-binding.js.map

package/dist/tenant-hierarchy-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-hierarchy-binding.js","sourceRoot":"","sources":["../src/tenant-hierarchy-binding.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}