The global-admin surface for launching, branding, domain-binding, and managing
white-label tenants + resold sub-orgs. The MANAGEMENT UI over the platform's
provisioning — tenant/package/domain/brand RECORDS are the single source of truth,
nothing hardcoded as the canonical path; honest-state everywhere (real where a
backend answers, honest not-connected where a platform endpoint isn't bound yet).
- TenantsModule (admin: true, category Platform) + tenants/: tenants list COMPOSED
from IAM orgs (brand) + admin cockpit (plan/wallet/status) + platform clusters;
reseller TREE derived from metadata.parentOrg or (honestly flagged) owner email;
package catalog read from the platform (DATA, seeded from platform-seed/packages.json,
never a hardcoded const); New-tenant create (real IAM org); per-tenant manage
(brand write REAL via IAM org fields, cluster provision REAL, domain list+bind,
IAM apps, package grant, suspend/reactivate REAL).
- BFF: no new proxy — all platform calls ride the existing /paas catch-all (light up
when the platform serves them; honest 404 today). Only server change:
add/update/delete-organization added to the /admin/iam allow-list (global-admin
gated, org-name pinned) so tenant-create + brand-write are REAL.
- Data-driven brand resolver: TenantsApi.brandConfig(host) + TenantBrandConfig
replace the hardcoded BRANDS/HOST_BRANDS map in config.ts (marked deprecated with
the precise migration; not swapped this pass — it's a build-time OAuth boundary).
- Missing platform endpoints flagged for the foundation phase: GET /v1/packages +
package table, POST/DELETE /v1/org/{org}/package/{id} (composite provisionPackage),
GET|POST /v1/org/{org}/domain (auto ingress+DNS+cert), GET /v1/brand?host=,
parentOrgId column.
- Tests: +41 (packages normalizer+seed, model compose/tree/infer, tenants-API
path/normalizer) all green; tsc clean for all new files; /tenants + /tenants/packages
render 200 with zero page errors through the admin-gated catch-all.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
