e2e: org-slug routing scenario (cross-target browser)

Pins the slug-URL contract end to end: /account/me advertises a
grammar-valid slug, bare deep links canonicalize onto it, unknown slugs
snap back to the active org, and in-shell navigation keeps the prefix.
Runs against cloud and selfhost.

Author: RhysSullivan

e2e/scenarios/org-slug-routing.test.ts

@@ -0,0 +1,64 @@
+// Cross-target (browser): org-slug console URLs. Console routes live under an
+// optional `{-$orgSlug}` segment and the authenticated shell canonicalizes
+// the URL onto the ACTIVE organization's slug — this scenario pins that
+// contract end to end through the real web UI:
+//
+//   - /account/me advertises the org's URL slug (valid grammar)
+//   - a bare deep link (/policies) canonicalizes to /<slug>/policies
+//   - an unknown slug (/zz-no-such-org/policies) snaps back to the active
+//     org's URL instead of rendering as if it were that org
+//   - in-shell navigation keeps the slug prefix on every link
+//
+// Cloud's switch-into-another-org-by-URL behavior is covered separately by
+// cloud/org-switcher.test.ts; this scenario only uses slugs no identity owns.
+import { expect } from "@effect/vitest";
+import { Effect } from "effect";
+import { AccountHttpApi, isValidOrgSlug } from "@executor-js/api";
+
+import { scenario } from "../src/scenario";
+import { Api, Browser, Target } from "../src/services";
+
+scenario(
+  "Org URLs · console paths carry the organization slug",
+  {},
+  Effect.gen(function* () {
+    const target = yield* Target;
+    const browser = yield* Browser;
+    const { client: apiClient } = yield* Api;
+    const identity = yield* target.newIdentity();
+
+    // The slug the URL must canonicalize onto, from the same account surface
+    // the shell reads.
+    const client = yield* apiClient(AccountHttpApi, identity);
+    const me = yield* client.account.me();
+    const slug = me.organization?.slug;
+    expect(slug, "the active organization advertises a URL slug").toBeTruthy();
+    expect(isValidOrgSlug(slug!) || slug === "default", "the slug fits the URL grammar").toBe(true);
+
+    yield* browser.session(identity, async ({ page, step }) => {
+      await step("A bare deep link canonicalizes onto the org slug", async () => {
+        await page.goto("/policies", { waitUntil: "networkidle" });
+        await page.waitForURL((url) => url.pathname === `/${slug}/policies`, {
+          timeout: 30_000,
+        });
+        await page.getByText("Policies").first().waitFor();
+      });
+
+      await step("An unknown org slug snaps back to the active org", async () => {
+        await page.goto("/zz-no-such-org/policies", { waitUntil: "networkidle" });
+        await page.waitForURL((url) => url.pathname === `/${slug}/policies`, {
+          timeout: 30_000,
+        });
+      });
+
+      await step("In-shell navigation keeps the slug prefix", async () => {
+        await page.getByRole("link", { name: "Integrations" }).first().click();
+        await page.waitForURL((url) => url.pathname === `/${slug}`, { timeout: 30_000 });
+        await page.getByRole("link", { name: "Policies" }).first().click();
+        await page.waitForURL((url) => url.pathname === `/${slug}/policies`, {
+          timeout: 30_000,
+        });
+      });
+    });
+  }),
+);