Four real surfaces backed by live tenant-registry data:
/[slug]/settings read-only tenant identity + plan + status
+ lifecycle dates with badge for status
/[slug]/settings/api-keys full CRUD: list active + revoked keys,
create form, plaintext-shown-once banner,
revoke action
/[slug]/audit paginated table with cursor-based next-page
navigation, action+actor_id GET filters,
formatRelative timestamps, metadata
preview
/[slug]/products live entitlements (filtered to enabled),
trial expiry chip, links to catalog when
empty
Five remaining surfaces upgraded to milestone-aware empty states
(projects / users / integrations / billing / support) with CTAs where
useful — billing links to catalog, support points at oncall@.
ShellEmpty component grew a 'details' string and a 'cta' ReactNode
slot so the empty pages don't all look identical.
Library additions:
src/lib/format.ts formatRelative, formatDateTime, truncate
src/lib/tenant-registry fetchAPIKeys, createAPIKey, revokeAPIKey,
fetchAudit — typed result shapes so server
actions can branch cleanly
Tests:
src/lib/format.test.ts 12 cases, 100% coverage
src/lib/tenant-registry.test +14 cases for new client methods,
100% line+branch+function
tests/e2e/surfaces.spec.ts one canary per of 10 customer-area
routes (signed-out → 403)
CI all green: lint / typecheck / test / build.
Refs: M10.1
Capture the redirect_uri gotcha from the live-stack smoke. .env.example pins AUTH_URL to acme.localhost:3000 with a long-form comment; README gets an 'AUTH_URL gotcha' callout.
Refs: M5.1 follow-up
playwright.config.ts + tests/e2e/{apex,tenant,health}.spec.ts. make e2e for local. CI e2e job opt-in via RUN_E2E repo variable. OIDC click-through deferred to when stage is up.
Refs: M5.3
10 route shells under /[slug]/, role-filtered Nav, backstage stub at /__backstage__, dashboard reads session.products to render tiles. src/lib/session.ts is the canonical role × surface matrix; canSee() is the only RBAC primitive in the portal (real enforcement remains at the API layer). 24 vitest tests; 100% src/lib coverage.
Refs: M5.2
Next.js 16 + Auth.js v5 skeleton: host→slug middleware, tenant-context layout, OIDC sign-in flow against breakpilot-dev realm. 100% coverage on src/lib. Bumps next to 16.2.6 to clear trivy CVEs in 15.0.3.
sharang