chore(console): standardize the global-admin org on 'admin' (drop casdoor built-in dual-recognition) — matches commerce/ai/gateway. v0.7.15

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanzo/console2",
-  "version": "0.7.14",
+  "version": "0.7.15",
   "private": true,
   "license": "BSD-3-Clause",
   "author": "Hanzo AI <dev@hanzo.ai>",

src/components/OrgGate.tsx

@@ -81,7 +81,7 @@ export function OrgGate({ children }: { children: ReactNode }) {
   // built-in metadata org. (Account's index signature exposes isGlobalAdmin when present.)
   const isGlobalAdmin =
     Boolean((account as { isGlobalAdmin?: boolean } | null)?.isGlobalAdmin) ||
-    ((owner === 'admin' || owner === 'built-in') && isAdmin)
+    ((owner === 'admin') && isAdmin)
   const [bannerDismissed, setBannerDismissed] = useState(true) // start hidden to avoid flash
 
   // Restore banner dismissed state and last org on mount

src/lib/server/admin-policy.ts

@@ -16,7 +16,7 @@
 export type AdminPrincipal = { email: string; emailVerified: boolean; isAdmin: boolean; isGlobalAdmin: boolean }
 
 /** Org-metadata owners casdoor reports — acceptable only on org-list endpoints. */
-const ORG_METADATA_OWNERS = new Set(['admin', 'built-in'])
+const ORG_METADATA_OWNERS = new Set(['admin'])
 
 /** Email is on the brand's admin domain (case-insensitive). */
 export function emailOnBrand(email: string, adminDomain: string): boolean {

src/lib/server/identity.ts

@@ -39,12 +39,14 @@ const KMS_URL = trim(process.env.KMS_URL ?? 'http://kms.hanzo.svc')
 /** Confidential client used for app-on-behalf mint/issue/revoke. */
 const MINT_CLIENT_ID = process.env.IAM_MINT_CLIENT_ID ?? ''
 const MINT_CLIENT_SECRET = process.env.IAM_MINT_CLIENT_SECRET ?? ''
-/** The metadata orgs whose admins are GLOBAL (cross-tenant) admins — casdoor's
- *  reserved `built-in` and the platform `admin` org. A member-admin of either is
- *  a global admin (matches admin-policy ORG_METADATA_OWNERS). A tenant org owner
- *  (hanzo, maxpower, …) is NEVER global, even with org-level isAdmin. */
-const ADMIN_ORGS = new Set(['built-in', 'admin'])
-const isAdminOrg = (owner: string): boolean => ADMIN_ORGS.has(owner)
+/** THE global-admin org — standardized as `admin` across the whole stack
+ *  (commerce, ai, gateway all gate cross-tenant on owner=="admin"). A member-admin
+ *  of `admin` is a global (cross-tenant) admin; casdoor's reserved `built-in` is
+ *  NOT used (per the "no built-in admin — seed the z@<domain> superuser in the
+ *  admin org" convention). A tenant org owner (hanzo, maxpower, …) is NEVER global,
+ *  even with org-level isAdmin. */
+const ADMIN_ORG = 'admin'
+const isAdminOrg = (owner: string): boolean => owner === ADMIN_ORG
 
 /** IAM base URL (the admin IAM proxy forwards `/v1/iam/*` here). */
 export const iamBaseUrl = (): string => IAM_URL