@kindgi/platform 0.1.3 → 0.1.4-rc.1

package/tests/project-binding.conformance.ts

@@ -10,8 +10,15 @@
  * - CRUD happy paths.
  * - `getDefault` returns the tenant's Default row when `isDefault=true`.
  * - `isDefault` uniqueness guardrail — creating a second Default in
- *   the same tenant rejects (in-memory adapter enforces at write
- *   time; Postgres impl enforces via partial-unique-index).
+ *   the same tenant resolves to `project-default-already-exists`
+ *   (in-memory adapter enforces at write time; Postgres impl enforces
+ *   via partial-unique-index).
+ * - Slug uniqueness within an org (and, for projects without an org,
+ *   among those): `create` and `update` (a new slug, or a move to
+ *   another org) resolve to `slug-conflict`; another org, or another
+ *   tenant, may reuse the slug.
+ * - `project-not-found` / `project-membership-not-found` outcomes from
+ *   writes on a missing row.
  * - `listForUser` aggregates memberships across projects.
  * - Cross-tenant isolation on every reachable read.
  */
@@ -22,6 +29,7 @@ import type { OrgId, ProjectId, TeamId, TenantId, UserId } from '@kindgi/types';
 
 import type { ProjectBinding, ProjectMembershipBinding } from '../src/project-binding.js';
 import type { TeamProjectGrantBinding } from '../src/team-project-grant-binding.js';
+import type { ProjectSpec } from '../src/types.js';
 
 const T1 = 'tenant-1' as TenantId;
 const T2 = 'tenant-2' as TenantId;
@@ -30,6 +38,25 @@ const U2 = 'user-2' as UserId;
 const TEAM_A = 'team-A' as TeamId;
 const TEAM_B = 'team-B' as TeamId;
 const ORG_A = 'org-A' as OrgId;
+const ORG_B = 'org-B' as OrgId;
+/**
+ * An org the binding doesn't know (T220), for the `checksOrgs` cases: a
+ * binding that checks orgs is made so this one isn't the tenant's.
+ */
+export const CONFORMANCE_MISSING_ORG = 'org-missing' as OrgId;
+
+/** Create a project the test expects to succeed; its id. */
+async function createProject(
+  projects: ProjectBinding,
+  tenantId: TenantId,
+  spec: ProjectSpec,
+): Promise<ProjectId> {
+  const outcome = await projects.create(tenantId, spec);
+  if (outcome.kind !== 'ok') {
+    throw new Error(`expected the project to be created, got ${outcome.kind}`);
+  }
+  return outcome.projectId;
+}
 
 export function runProjectBindingConformance(
   makeBinding: () => {
@@ -38,11 +65,19 @@ export function runProjectBindingConformance(
     readonly grants: TeamProjectGrantBinding;
   },
   label = 'ProjectBinding',
+  options: {
+    /**
+     * The binding checks that an org exists (`CONFORMANCE_MISSING_ORG`
+     * doesn't): a project created in or moved to a missing org is
+     * `org-not-found`.
+     */
+    readonly checksOrgs?: boolean;
+  } = {},
 ): void {
   describe(`${label} — project CRUD`, () => {
     it('creates + gets a project', async () => {
       const { projects } = makeBinding();
-      const id = await projects.create(T1, { name: 'Matter #1', slug: 'm1' });
+      const id = await createProject(projects, T1, { name: 'Matter #1', slug: 'm1' });
       const got = await projects.get(T1, id);
       expect(got?.name).toBe('Matter #1');
       expect(got?.isDefault).toBe(false);
@@ -50,8 +85,8 @@ export function runProjectBindingConformance(
 
     it('lists projects filtered by orgId', async () => {
       const { projects } = makeBinding();
-      await projects.create(T1, { name: 'A', slug: 'a', orgId: ORG_A });
-      await projects.create(T1, { name: 'B', slug: 'b' });
+      await createProject(projects, T1, { name: 'A', slug: 'a', orgId: ORG_A });
+      await createProject(projects, T1, { name: 'B', slug: 'b' });
       const inOrg = await projects.list(T1, { orgId: ORG_A });
       expect(inOrg.items).toHaveLength(1);
       expect(inOrg.items[0]?.name).toBe('A');
@@ -59,15 +94,15 @@ export function runProjectBindingConformance(
 
     it('updates a project', async () => {
       const { projects } = makeBinding();
-      const id = await projects.create(T1, { name: 'A', slug: 'a' });
-      await projects.update(T1, id, { name: 'A-updated' });
+      const id = await createProject(projects, T1, { name: 'A', slug: 'a' });
+      expect(await projects.update(T1, id, { name: 'A-updated' })).toEqual({ kind: 'ok' });
       const got = await projects.get(T1, id);
       expect(got?.name).toBe('A-updated');
     });
 
     it('deletes a project + cascades memberships + grants', async () => {
       const { projects, memberships, grants } = makeBinding();
-      const id = await projects.create(T1, { name: 'A', slug: 'a' });
+      const id = await createProject(projects, T1, { name: 'A', slug: 'a' });
       await memberships.add(T1, { projectId: id, userId: U1, role: 'editor' });
       await grants.add(T1, { teamId: TEAM_A, projectId: id, role: 'editor' });
       await projects.delete(T1, id);
@@ -86,7 +121,7 @@ export function runProjectBindingConformance(
 
     it('getDefault returns the isDefault=true row', async () => {
       const { projects } = makeBinding();
-      const id = await projects.create(T1, {
+      const id = await createProject(projects, T1, {
         name: 'Default',
         slug: 'default',
         isDefault: true,
@@ -97,18 +132,28 @@ export function runProjectBindingConformance(
       expect(got?.isDefault).toBe(true);
     });
 
-    it('isDefault uniqueness — a second Default in the same tenant errors', async () => {
+    it('isDefault uniqueness — a second Default in the same tenant → project-default-already-exists', async () => {
       const { projects } = makeBinding();
-      await projects.create(T1, { name: 'D1', slug: 'd1', isDefault: true });
-      await expect(
-        projects.create(T1, { name: 'D2', slug: 'd2', isDefault: true }),
-      ).rejects.toThrow();
+      await createProject(projects, T1, { name: 'D1', slug: 'd1', isDefault: true });
+      expect(await projects.create(T1, { name: 'D2', slug: 'd2', isDefault: true })).toEqual({
+        kind: 'project-default-already-exists',
+      });
+    });
+
+    it('isDefault with only the slug taken → slug-conflict', async () => {
+      const { projects } = makeBinding();
+      await createProject(projects, T1, { name: 'P', slug: 'p' });
+      expect(await projects.create(T1, { name: 'D', slug: 'p', isDefault: true })).toEqual({
+        kind: 'slug-conflict',
+        slug: 'p',
+      });
+      expect(await projects.getDefault(T1)).toBeUndefined();
     });
 
     it('a Default in tenant A does NOT block a Default in tenant B', async () => {
       const { projects } = makeBinding();
-      await projects.create(T1, { name: 'D1', slug: 'd1', isDefault: true });
-      const d2 = await projects.create(T2, {
+      await createProject(projects, T1, { name: 'D1', slug: 'd1', isDefault: true });
+      const d2 = await createProject(projects, T2, {
         name: 'D2',
         slug: 'd2',
         isDefault: true,
@@ -121,28 +166,45 @@ export function runProjectBindingConformance(
   describe(`${label} — cross-tenant isolation`, () => {
     it('project get across tenants returns undefined', async () => {
       const { projects } = makeBinding();
-      const id = await projects.create(T1, { name: 'A', slug: 'a' });
+      const id = await createProject(projects, T1, { name: 'A', slug: 'a' });
       expect(await projects.get(T2, id)).toBeUndefined();
     });
 
     it('project list across tenants does not leak', async () => {
       const { projects } = makeBinding();
-      await projects.create(T1, { name: 'A', slug: 'a' });
+      await createProject(projects, T1, { name: 'A', slug: 'a' });
       const page = await projects.list(T2, {});
       expect(page.items).toEqual([]);
     });
 
-    it('project-membership add under wrong tenant errors', async () => {
+    it('project-membership add under wrong tenant → project-not-found', async () => {
       const { projects, memberships } = makeBinding();
-      const id = await projects.create(T1, { name: 'A', slug: 'a' });
-      await expect(
-        memberships.add(T2, { projectId: id, userId: U1, role: 'editor' }),
-      ).rejects.toThrow();
+      const id = await createProject(projects, T1, { name: 'A', slug: 'a' });
+      expect(await memberships.add(T2, { projectId: id, userId: U1, role: 'editor' })).toEqual({
+        kind: 'project-not-found',
+      });
+      expect((await memberships.list(T1, id, {})).items).toEqual([]);
+    });
+
+    it('project update under wrong tenant → project-not-found', async () => {
+      const { projects } = makeBinding();
+      const id = await createProject(projects, T1, { name: 'A', slug: 'a' });
+      expect(await projects.update(T2, id, { name: 'B' })).toEqual({ kind: 'project-not-found' });
+      expect((await projects.get(T1, id))?.name).toBe('A');
+    });
+
+    it('membership updateRole under wrong tenant → project-not-found', async () => {
+      const { projects, memberships } = makeBinding();
+      const id = await createProject(projects, T1, { name: 'A', slug: 'a' });
+      await memberships.add(T1, { projectId: id, userId: U1, role: 'editor' });
+      expect(await memberships.updateRole(T2, id, U1, 'owner')).toEqual({
+        kind: 'project-not-found',
+      });
     });
 
     it('team-project grant add under wrong tenant errors', async () => {
       const { projects, grants } = makeBinding();
-      const id = await projects.create(T1, { name: 'A', slug: 'a' });
+      const id = await createProject(projects, T1, { name: 'A', slug: 'a' });
       await expect(
         grants.add(T2, { teamId: TEAM_A, projectId: id, role: 'editor' }),
       ).rejects.toThrow();
@@ -150,8 +212,8 @@ export function runProjectBindingConformance(
 
     it('listForUser across tenants only returns tenant-scoped rows', async () => {
       const { projects, memberships } = makeBinding();
-      const p1 = await projects.create(T1, { name: 'A', slug: 'a' });
-      const p2 = await projects.create(T2, { name: 'B', slug: 'b' });
+      const p1 = await createProject(projects, T1, { name: 'A', slug: 'a' });
+      const p2 = await createProject(projects, T2, { name: 'B', slug: 'b' });
       await memberships.add(T1, { projectId: p1, userId: U1, role: 'editor' });
       await memberships.add(T2, { projectId: p2, userId: U1, role: 'editor' });
       const t1Page = await memberships.listForUser(T1, U1, {});
@@ -163,17 +225,37 @@ export function runProjectBindingConformance(
   describe(`${label} — membership + grant idempotency`, () => {
     it('project-membership add is idempotent (does not overwrite role)', async () => {
       const { projects, memberships } = makeBinding();
-      const id = await projects.create(T1, { name: 'A', slug: 'a' });
-      await memberships.add(T1, { projectId: id, userId: U1, role: 'owner' });
-      await memberships.add(T1, { projectId: id, userId: U1, role: 'viewer' });
+      const id = await createProject(projects, T1, { name: 'A', slug: 'a' });
+      expect(await memberships.add(T1, { projectId: id, userId: U1, role: 'owner' })).toEqual({
+        kind: 'ok',
+      });
+      expect(await memberships.add(T1, { projectId: id, userId: U1, role: 'viewer' })).toEqual({
+        kind: 'ok',
+      });
       const page = await memberships.list(T1, id, {});
       expect(page.items).toHaveLength(1);
       expect(page.items[0]?.role).toBe('owner');
     });
 
+    it('project-membership updateRole mutates the role', async () => {
+      const { projects, memberships } = makeBinding();
+      const id = await createProject(projects, T1, { name: 'A', slug: 'a' });
+      await memberships.add(T1, { projectId: id, userId: U1, role: 'editor' });
+      expect(await memberships.updateRole(T1, id, U1, 'owner')).toEqual({ kind: 'ok' });
+      expect((await memberships.list(T1, id, {})).items[0]?.role).toBe('owner');
+    });
+
+    it('project-membership updateRole on a missing membership → project-membership-not-found', async () => {
+      const { projects, memberships } = makeBinding();
+      const id = await createProject(projects, T1, { name: 'A', slug: 'a' });
+      expect(await memberships.updateRole(T1, id, U1, 'owner')).toEqual({
+        kind: 'project-membership-not-found',
+      });
+    });
+
     it('grant add is idempotent', async () => {
       const { projects, grants } = makeBinding();
-      const id = await projects.create(T1, { name: 'A', slug: 'a' });
+      const id = await createProject(projects, T1, { name: 'A', slug: 'a' });
       await grants.add(T1, { teamId: TEAM_A, projectId: id, role: 'owner' });
       await grants.add(T1, { teamId: TEAM_A, projectId: id, role: 'viewer' });
       const page = await grants.listForProject(T1, id, {});
@@ -183,7 +265,7 @@ export function runProjectBindingConformance(
 
     it('grant updateRole mutates the role', async () => {
       const { projects, grants } = makeBinding();
-      const id = await projects.create(T1, { name: 'A', slug: 'a' });
+      const id = await createProject(projects, T1, { name: 'A', slug: 'a' });
       await grants.add(T1, { teamId: TEAM_A, projectId: id, role: 'editor' });
       await grants.updateRole(T1, TEAM_A, id, 'owner');
       const page = await grants.listForTeam(T1, TEAM_A, {});
@@ -194,9 +276,9 @@ export function runProjectBindingConformance(
   describe(`${label} — listForUser aggregates across projects`, () => {
     it('returns every direct-grant project the user has', async () => {
       const { projects, memberships } = makeBinding();
-      const a = await projects.create(T1, { name: 'A', slug: 'a' });
-      const b = await projects.create(T1, { name: 'B', slug: 'b' });
-      const c = await projects.create(T1, { name: 'C', slug: 'c' });
+      const a = await createProject(projects, T1, { name: 'A', slug: 'a' });
+      const b = await createProject(projects, T1, { name: 'B', slug: 'b' });
+      const c = await createProject(projects, T1, { name: 'C', slug: 'c' });
       await memberships.add(T1, { projectId: a, userId: U1, role: 'editor' });
       await memberships.add(T1, { projectId: b, userId: U1, role: 'viewer' });
       await memberships.add(T1, { projectId: c, userId: U2, role: 'editor' });
@@ -211,7 +293,7 @@ export function runProjectBindingConformance(
   describe(`${label} — grant listForProject + listForTeam`, () => {
     it('listForProject returns every team-grant on the project', async () => {
       const { projects, grants } = makeBinding();
-      const id = await projects.create(T1, { name: 'A', slug: 'a' });
+      const id = await createProject(projects, T1, { name: 'A', slug: 'a' });
       await grants.add(T1, { teamId: TEAM_A, projectId: id, role: 'editor' });
       await grants.add(T1, { teamId: TEAM_B, projectId: id, role: 'viewer' });
       const page = await grants.listForProject(T1, id, {});
@@ -220,12 +302,114 @@ export function runProjectBindingConformance(
 
     it('listForTeam returns every project the team has a grant on', async () => {
       const { projects, grants } = makeBinding();
-      const a = await projects.create(T1, { name: 'A', slug: 'a' });
-      const b = await projects.create(T1, { name: 'B', slug: 'b' });
+      const a = await createProject(projects, T1, { name: 'A', slug: 'a' });
+      const b = await createProject(projects, T1, { name: 'B', slug: 'b' });
       await grants.add(T1, { teamId: TEAM_A, projectId: a, role: 'editor' });
       await grants.add(T1, { teamId: TEAM_A, projectId: b, role: 'viewer' });
       const page = await grants.listForTeam(T1, TEAM_A, {});
       expect(page.items).toHaveLength(2);
     });
   });
+
+  describe(`${label} — slug uniqueness`, () => {
+    it('create with a slug a project without an org already has → slug-conflict', async () => {
+      const { projects } = makeBinding();
+      await createProject(projects, T1, { name: 'Matter', slug: 'm1' });
+      expect(await projects.create(T1, { name: 'Matter again', slug: 'm1' })).toEqual({
+        kind: 'slug-conflict',
+        slug: 'm1',
+      });
+      expect((await projects.list(T1, {})).items).toHaveLength(1);
+    });
+
+    it('another tenant may use the same slug', async () => {
+      const { projects } = makeBinding();
+      await createProject(projects, T1, { name: 'Matter', slug: 'm1' });
+      expect((await projects.create(T2, { name: 'Matter', slug: 'm1' })).kind).toBe('ok');
+    });
+
+    it("update to another project's slug → slug-conflict; the project is unchanged", async () => {
+      const { projects } = makeBinding();
+      await createProject(projects, T1, { name: 'A', slug: 'a' });
+      const id = await createProject(projects, T1, { name: 'B', slug: 'b' });
+      expect(await projects.update(T1, id, { slug: 'a' })).toEqual({
+        kind: 'slug-conflict',
+        slug: 'a',
+      });
+      expect((await projects.get(T1, id))?.slug).toBe('b');
+    });
+
+    it('two orgs may each have a project with the same slug', async () => {
+      const { projects } = makeBinding();
+      await createProject(projects, T1, { name: 'A', slug: 'shared', orgId: ORG_A });
+      await createProject(projects, T1, { name: 'B', slug: 'shared', orgId: ORG_B });
+      // And a project without an org may have it too.
+      await createProject(projects, T1, { name: 'C', slug: 'shared' });
+      expect((await projects.list(T1, {})).items.map((p) => p.slug)).toEqual([
+        'shared',
+        'shared',
+        'shared',
+      ]);
+    });
+
+    it("create with a slug the org's project already has → slug-conflict", async () => {
+      const { projects } = makeBinding();
+      await createProject(projects, T1, { name: 'A', slug: 'a', orgId: ORG_A });
+      expect(await projects.create(T1, { name: 'A again', slug: 'a', orgId: ORG_A })).toEqual({
+        kind: 'slug-conflict',
+        slug: 'a',
+      });
+    });
+
+    it('a move to an org that has the slug → slug-conflict; the project stays where it was', async () => {
+      const { projects } = makeBinding();
+      await createProject(projects, T1, { name: 'In A', slug: 's', orgId: ORG_A });
+      const id = await createProject(projects, T1, { name: 'In B', slug: 's', orgId: ORG_B });
+      expect(await projects.update(T1, id, { orgId: ORG_A })).toEqual({
+        kind: 'slug-conflict',
+        slug: 's',
+      });
+      expect((await projects.get(T1, id))?.orgId).toBe(ORG_B);
+    });
+
+    it('a move out of its org, where a project without one has the slug → slug-conflict', async () => {
+      const { projects } = makeBinding();
+      await createProject(projects, T1, { name: 'Org-less', slug: 's' });
+      const id = await createProject(projects, T1, { name: 'In A', slug: 's', orgId: ORG_A });
+      expect(await projects.update(T1, id, { orgId: null })).toEqual({
+        kind: 'slug-conflict',
+        slug: 's',
+      });
+    });
+
+    it('a move to an org without the slug, and a rename to a slug only another org has: ok', async () => {
+      const { projects } = makeBinding();
+      await createProject(projects, T1, { name: 'In A', slug: 'a', orgId: ORG_A });
+      const id = await createProject(projects, T1, { name: 'In B', slug: 'b', orgId: ORG_B });
+      expect(await projects.update(T1, id, { slug: 'a' })).toEqual({ kind: 'ok' });
+      expect(await projects.update(T1, id, { slug: 'c', orgId: ORG_A })).toEqual({ kind: 'ok' });
+    });
+  });
+
+  if (options.checksOrgs === true) {
+    describe(`${label} — an org that isn't the tenant's (T220)`, () => {
+      it('creating a project in it: org-not-found, and nothing is created', async () => {
+        const { projects } = makeBinding();
+        expect(
+          await projects.create(T1, { name: 'P', slug: 'p', orgId: CONFORMANCE_MISSING_ORG }),
+        ).toEqual({ kind: 'org-not-found', orgId: CONFORMANCE_MISSING_ORG });
+        expect((await projects.list(T1, { orgId: CONFORMANCE_MISSING_ORG })).items).toEqual([]);
+      });
+
+      it('moving a project to it: org-not-found, and the project stays where it was', async () => {
+        const { projects } = makeBinding();
+        const id = await createProject(projects, T1, { name: 'P', slug: 'p', orgId: ORG_A });
+        expect(await projects.update(T1, id, { orgId: CONFORMANCE_MISSING_ORG })).toEqual({
+          kind: 'org-not-found',
+          orgId: CONFORMANCE_MISSING_ORG,
+        });
+        expect((await projects.get(T1, id))?.orgId).toBe(ORG_A);
+      });
+    });
+  }
 }

package/tests/team-binding.conformance.ts

@@ -12,6 +12,9 @@
  *   `updateRole`).
  * - `listForUser` returns memberships across teams within a tenant.
  * - Cross-tenant isolation on every reachable read.
+ * - Outcomes: `team-not-found` and `team-membership-not-found` from
+ *   writes on a missing row, `slug-conflict` from a slug the tenant
+ *   already has (another tenant may reuse it).
  */
 
 import { describe, expect, it } from 'vitest';
@@ -19,12 +22,23 @@ import { describe, expect, it } from 'vitest';
 import type { OrgId, TeamId, TenantId, UserId } from '@kindgi/types';
 
 import type { TeamBinding, TeamMembershipBinding } from '../src/team-binding.js';
+import type { TeamSpec } from '../src/types.js';
 
 const T1 = 'tenant-1' as TenantId;
 const T2 = 'tenant-2' as TenantId;
 const U1 = 'user-1' as UserId;
 const U2 = 'user-2' as UserId;
 const ORG_A = 'org-a' as OrgId;
+/** An org the binding doesn't know (T220), for the `checksOrgs` cases. */
+export const CONFORMANCE_MISSING_ORG = 'org-missing' as OrgId;
+
+/** Create a team the test expects to succeed; its id. */
+async function createTeam(teams: TeamBinding, tenantId: TenantId, spec: TeamSpec): Promise<TeamId> {
+  const outcome = await teams.create(tenantId, spec);
+  if (outcome.kind !== 'ok')
+    throw new Error(`expected the team to be created, got ${outcome.kind}`);
+  return outcome.teamId;
+}
 
 export function runTeamBindingConformance(
   makeBinding: () => {
@@ -32,11 +46,15 @@ export function runTeamBindingConformance(
     readonly memberships: TeamMembershipBinding;
   },
   label = 'TeamBinding',
+  options: {
+    /** The binding checks that an org exists (`CONFORMANCE_MISSING_ORG` doesn't). */
+    readonly checksOrgs?: boolean;
+  } = {},
 ): void {
   describe(`${label} — team CRUD`, () => {
     it('creates + gets a team with orgId', async () => {
       const { teams } = makeBinding();
-      const id = await teams.create(T1, {
+      const id = await createTeam(teams, T1, {
         name: 'Litigation',
         slug: 'lit',
         orgId: ORG_A,
@@ -49,27 +67,27 @@ export function runTeamBindingConformance(
 
     it('creates a cross-org team (no orgId)', async () => {
       const { teams } = makeBinding();
-      const id = await teams.create(T1, { name: 'Cross', slug: 'cross' });
+      const id = await createTeam(teams, T1, { name: 'Cross', slug: 'cross' });
       const got = await teams.get(T1, id);
       expect(got?.orgId).toBeUndefined();
     });
 
     it('updates a team; orgId=null clears the FK', async () => {
       const { teams } = makeBinding();
-      const id = await teams.create(T1, {
+      const id = await createTeam(teams, T1, {
         name: 'Litigation',
         slug: 'lit',
         orgId: ORG_A,
       });
-      await teams.update(T1, id, { orgId: null });
+      expect(await teams.update(T1, id, { orgId: null })).toEqual({ kind: 'ok' });
       const got = await teams.get(T1, id);
       expect(got?.orgId).toBeUndefined();
     });
 
     it('lists teams filtered by orgId', async () => {
       const { teams } = makeBinding();
-      await teams.create(T1, { name: 'A', slug: 'a', orgId: ORG_A });
-      await teams.create(T1, { name: 'B', slug: 'b' });
+      await createTeam(teams, T1, { name: 'A', slug: 'a', orgId: ORG_A });
+      await createTeam(teams, T1, { name: 'B', slug: 'b' });
       const inOrg = await teams.list(T1, { orgId: ORG_A });
       expect(inOrg.items).toHaveLength(1);
       expect(inOrg.items[0]?.name).toBe('A');
@@ -77,7 +95,7 @@ export function runTeamBindingConformance(
 
     it('deletes a team + cascades memberships', async () => {
       const { teams, memberships } = makeBinding();
-      const id = await teams.create(T1, { name: 'X', slug: 'x' });
+      const id = await createTeam(teams, T1, { name: 'X', slug: 'x' });
       await memberships.add(T1, { teamId: id, userId: U1, role: 'member' });
       await teams.delete(T1, id);
       const page = await memberships.listForUser(T1, U1, {});
@@ -88,29 +106,37 @@ export function runTeamBindingConformance(
   describe(`${label} — cross-tenant isolation`, () => {
     it('team get across tenants returns undefined', async () => {
       const { teams } = makeBinding();
-      const id = await teams.create(T1, { name: 'X', slug: 'x' });
+      const id = await createTeam(teams, T1, { name: 'X', slug: 'x' });
       expect(await teams.get(T2, id)).toBeUndefined();
     });
 
     it('team list across tenants does not leak', async () => {
       const { teams } = makeBinding();
-      await teams.create(T1, { name: 'X', slug: 'x' });
+      await createTeam(teams, T1, { name: 'X', slug: 'x' });
       const page = await teams.list(T2, {});
       expect(page.items).toEqual([]);
     });
 
-    it('adding a membership under wrong tenant errors', async () => {
+    it('adding a membership under wrong tenant → team-not-found', async () => {
       const { teams, memberships } = makeBinding();
-      const id = await teams.create(T1, { name: 'X', slug: 'x' });
-      await expect(
-        memberships.add(T2, { teamId: id, userId: U1, role: 'member' }),
-      ).rejects.toThrow();
+      const id = await createTeam(teams, T1, { name: 'X', slug: 'x' });
+      expect(await memberships.add(T2, { teamId: id, userId: U1, role: 'member' })).toEqual({
+        kind: 'team-not-found',
+      });
+      expect((await memberships.list(T1, id, {})).items).toEqual([]);
+    });
+
+    it('update under wrong tenant → team-not-found', async () => {
+      const { teams } = makeBinding();
+      const id = await createTeam(teams, T1, { name: 'X', slug: 'x' });
+      expect(await teams.update(T2, id, { name: 'Y' })).toEqual({ kind: 'team-not-found' });
+      expect((await teams.get(T1, id))?.name).toBe('X');
     });
 
     it('listForUser across tenants only returns tenant-scoped memberships', async () => {
       const { teams, memberships } = makeBinding();
-      const t1Team = await teams.create(T1, { name: 'A', slug: 'a' });
-      const t2Team = await teams.create(T2, { name: 'B', slug: 'b' });
+      const t1Team = await createTeam(teams, T1, { name: 'A', slug: 'a' });
+      const t2Team = await createTeam(teams, T2, { name: 'B', slug: 'b' });
       await memberships.add(T1, { teamId: t1Team, userId: U1, role: 'member' });
       await memberships.add(T2, { teamId: t2Team, userId: U1, role: 'member' });
       const t1Page = await memberships.listForUser(T1, U1, {});
@@ -125,10 +151,14 @@ export function runTeamBindingConformance(
   describe(`${label} — membership idempotency`, () => {
     it('add on existing membership is a no-op (does NOT overwrite role)', async () => {
       const { teams, memberships } = makeBinding();
-      const id = await teams.create(T1, { name: 'X', slug: 'x' });
-      await memberships.add(T1, { teamId: id, userId: U1, role: 'admin' });
+      const id = await createTeam(teams, T1, { name: 'X', slug: 'x' });
+      expect(await memberships.add(T1, { teamId: id, userId: U1, role: 'admin' })).toEqual({
+        kind: 'ok',
+      });
       // Re-add with a different role — should be a no-op, not a mutation.
-      await memberships.add(T1, { teamId: id, userId: U1, role: 'member' });
+      expect(await memberships.add(T1, { teamId: id, userId: U1, role: 'member' })).toEqual({
+        kind: 'ok',
+      });
       const page = await memberships.list(T1, id, {});
       expect(page.items).toHaveLength(1);
       expect(page.items[0]?.role).toBe('admin');
@@ -136,21 +166,32 @@ export function runTeamBindingConformance(
 
     it('remove on missing membership is a no-op', async () => {
       const { teams, memberships } = makeBinding();
-      const id = await teams.create(T1, { name: 'X', slug: 'x' });
+      const id = await createTeam(teams, T1, { name: 'X', slug: 'x' });
       await expect(memberships.remove(T1, id, U1)).resolves.toBeUndefined();
     });
 
-    it('updateRole on missing membership errors', async () => {
+    it('updateRole on missing membership → team-membership-not-found', async () => {
       const { teams, memberships } = makeBinding();
-      const id = await teams.create(T1, { name: 'X', slug: 'x' });
-      await expect(memberships.updateRole(T1, id, U1, 'admin')).rejects.toThrow();
+      const id = await createTeam(teams, T1, { name: 'X', slug: 'x' });
+      expect(await memberships.updateRole(T1, id, U1, 'admin')).toEqual({
+        kind: 'team-membership-not-found',
+      });
+    });
+
+    it('updateRole on a team in another tenant → team-not-found', async () => {
+      const { teams, memberships } = makeBinding();
+      const id = await createTeam(teams, T1, { name: 'X', slug: 'x' });
+      await memberships.add(T1, { teamId: id, userId: U1, role: 'member' });
+      expect(await memberships.updateRole(T2, id, U1, 'admin')).toEqual({
+        kind: 'team-not-found',
+      });
     });
 
     it('updateRole on existing membership mutates the role', async () => {
       const { teams, memberships } = makeBinding();
-      const id = await teams.create(T1, { name: 'X', slug: 'x' });
+      const id = await createTeam(teams, T1, { name: 'X', slug: 'x' });
       await memberships.add(T1, { teamId: id, userId: U1, role: 'member' });
-      await memberships.updateRole(T1, id, U1, 'admin');
+      expect(await memberships.updateRole(T1, id, U1, 'admin')).toEqual({ kind: 'ok' });
       const page = await memberships.list(T1, id, {});
       expect(page.items[0]?.role).toBe('admin');
     });
@@ -159,9 +200,9 @@ export function runTeamBindingConformance(
   describe(`${label} — listForUser across teams`, () => {
     it('returns every team the user belongs to in the tenant', async () => {
       const { teams, memberships } = makeBinding();
-      const a = await teams.create(T1, { name: 'A', slug: 'a' });
-      const b = await teams.create(T1, { name: 'B', slug: 'b' });
-      const c = await teams.create(T1, { name: 'C', slug: 'c' });
+      const a = await createTeam(teams, T1, { name: 'A', slug: 'a' });
+      const b = await createTeam(teams, T1, { name: 'B', slug: 'b' });
+      const c = await createTeam(teams, T1, { name: 'C', slug: 'c' });
       await memberships.add(T1, { teamId: a, userId: U1, role: 'member' });
       await memberships.add(T1, { teamId: b, userId: U1, role: 'admin' });
       await memberships.add(T1, { teamId: c, userId: U2, role: 'member' });
@@ -172,4 +213,55 @@ export function runTeamBindingConformance(
       expect(teamIds.has(b)).toBe(true);
     });
   });
+
+  describe(`${label} — slug uniqueness`, () => {
+    it('create with a slug the tenant already has → slug-conflict', async () => {
+      const { teams } = makeBinding();
+      await createTeam(teams, T1, { name: 'Litigation', slug: 'lit' });
+      expect(await teams.create(T1, { name: 'Litigation 2', slug: 'lit' })).toEqual({
+        kind: 'slug-conflict',
+        slug: 'lit',
+      });
+      expect((await teams.list(T1, {})).items).toHaveLength(1);
+    });
+
+    it('another tenant may use the same slug', async () => {
+      const { teams } = makeBinding();
+      await createTeam(teams, T1, { name: 'Litigation', slug: 'lit' });
+      expect((await teams.create(T2, { name: 'Litigation', slug: 'lit' })).kind).toBe('ok');
+    });
+
+    it("update to another team's slug → slug-conflict; the team is unchanged", async () => {
+      const { teams } = makeBinding();
+      await createTeam(teams, T1, { name: 'A', slug: 'a' });
+      const id = await createTeam(teams, T1, { name: 'B', slug: 'b' });
+      expect(await teams.update(T1, id, { slug: 'a' })).toEqual({
+        kind: 'slug-conflict',
+        slug: 'a',
+      });
+      expect((await teams.get(T1, id))?.slug).toBe('b');
+    });
+  });
+
+  if (options.checksOrgs === true) {
+    describe(`${label} — an org that isn't the tenant's (T220)`, () => {
+      it('creating a team in it: org-not-found, and nothing is created', async () => {
+        const { teams } = makeBinding();
+        expect(
+          await teams.create(T1, { name: 'T', slug: 't', orgId: CONFORMANCE_MISSING_ORG }),
+        ).toEqual({ kind: 'org-not-found', orgId: CONFORMANCE_MISSING_ORG });
+        expect((await teams.list(T1, { orgId: CONFORMANCE_MISSING_ORG })).items).toEqual([]);
+      });
+
+      it('moving a team to it: org-not-found, and the team stays where it was', async () => {
+        const { teams } = makeBinding();
+        const id = await createTeam(teams, T1, { name: 'T', slug: 't', orgId: ORG_A });
+        expect(await teams.update(T1, id, { orgId: CONFORMANCE_MISSING_ORG })).toEqual({
+          kind: 'org-not-found',
+          orgId: CONFORMANCE_MISSING_ORG,
+        });
+        expect((await teams.get(T1, id))?.orgId).toBe(ORG_A);
+      });
+    });
+  }
 }