ADR-0081 (cloud): open org-management basics + retire plugin-org-scoping to enterprise (#2699)

* chore: bump objectui to 195121ade6ec

feat(studio): match form designer/preview column density to the runtime form (#2345)

objectui@195121ade6ec921e5786030093f0b23fc58d02f7

* feat(auth,platform-objects): open single-org org-management basics (cloud ADR-0081 D1)

Single-org deployments had NO way to add a user at all: the invite
affordances hid behind 'features.multiOrgEnabled' gates, and nothing ever
created an organization (OrgScopingPlugin and its default-org bootstrap are
multi-org-gated), so sessions carried no activeOrganizationId and better-auth
organization/invite-member had no org to resolve.

- plugin-auth: ensureDefaultOrganization moves here (open home; the
  multi-org seed-ownership step becomes an injectable option that
  plugin-org-scoping's wrapper keeps providing), wired in single-org mode on
  kernel:ready + after every sys_user_permission_set insert
  (autoDefaultOrganization opt-out).
- plugin-auth: default session.create.before hook stamps
  activeOrganizationId from the caller's sys_member row (owner-preferred);
  host-supplied hooks chain first and win (autoActiveOrganization opt-out).
- platform-objects: member/invitation/team actions re-gate from
  'features.multiOrgEnabled' to 'features.organization' (the capability is
  always mounted); sys_organization's own create/leave/delete keep the
  multi-org gate so the single-org default org stays protected.
- setup nav: new nav_organization entry deep-links to the ACTIVE org's
  record page ({current_org_id}); nav_teams / nav_invitations drop the
  org-scoping service gate; the Organizations LIST keeps it (multi-org only).

Live-verified single-org via browser: first-run wizard -> default org
(renamed, CJK name) + owner membership + active-org session; invite ->
accept -> change role -> remove, all through better-auth endpoints.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat!: retire plugin-org-scoping — multi-org runtime moves to the enterprise @objectstack/organizations package (cloud ADR-0081 D2)

BREAKING: the open @objectstack/plugin-org-scoping package is removed. The
multi-org runtime (organization_id auto-stamp, per-org seed replay, multi-org
default-org bootstrap) is now the closed-source @objectstack/organizations
package, which keeps registering the historical 'org-scoping' service — the
plugin-security RLS probe and the requiresService nav gates are unaffected.

- cli serve / plugin-dev / verify harness mount it best-effort by name when
  OS_MULTI_ORG_ENABLED=true; a missing package WARNS loudly (serve/dev) or
  throws an actionable error (verify's explicit multiTenant opt-in) instead
  of silently downgrading the RLS posture.
- The open member-management basics are unaffected: plugin-auth's single-org
  default-org bootstrap + better-auth invitations (ADR-0081 D1) keep working
  without the enterprise package.
- dogfood multi-org RLS gate skips (loudly) when the package isn't linked;
  enterprise/cloud CI runs it.

Live-verified: multi-org stack with the enterprise package linked (bootstrap,
second-org create, {current_org_id} nav following org switch) and the
missing-package single-org downgrade warning.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(verify,changeset): keep the verify harness pure single-tenant; drop deleted package from changeset fixed group

- verify harness: pass autoDefaultOrganization: false to AuthPlugin. The
  single-org default-org bootstrap (ADR-0081 D1) is a product onboarding
  convenience for objectstack dev/serve; running it inside the harness minted
  a Default Organization + bound the dev admin as owner, giving every
  'single-tenant' fixture an active org — which switched on org-scoped RLS and
  reparented seeded rows, breaking the pure single-tenant baseline the dogfood
  proofs assert (ADR-0057 identity create, ADR-0062 federation, ADR-0086
  two-doors). The bootstrap stays covered by plugin-auth unit tests + browser E2E.
- .changeset/config.json: remove @objectstack/plugin-org-scoping from the
  fixed group (package deleted in this branch).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: os-zhuang

.changeset/config.json

@@ -41,7 +41,6 @@
       "@objectstack/plugin-email",
       "@objectstack/plugin-hono-server",
       "@objectstack/mcp",
-      "@objectstack/plugin-org-scoping",
       "@objectstack/plugin-reports",
       "@objectstack/plugin-security",
       "@objectstack/plugin-sharing",

.objectui-sha

@@ -1 +1 @@
-c27bd3264f394bec5f5f71326118bfb115fbe884
+195121ade6ec921e5786030093f0b23fc58d02f7

packages/cli/package.json

@@ -59,7 +59,6 @@
     "@objectstack/plugin-auth": "workspace:*",
     "@objectstack/plugin-email": "workspace:*",
     "@objectstack/plugin-hono-server": "workspace:*",
-    "@objectstack/plugin-org-scoping": "workspace:*",
     "@objectstack/plugin-reports": "workspace:*",
     "@objectstack/plugin-security": "workspace:*",
     "@objectstack/plugin-sharing": "workspace:*",

packages/cli/src/commands/serve.ts

@@ -1279,21 +1279,28 @@ export default class Serve extends Command {
               }
             }
 
-            // Pair: OrgScopingPlugin (multi-tenant) — optional, must register BEFORE SecurityPlugin
-            // OrgScopingPlugin provides `organization_id` auto-stamp, per-org
-            // seed-replay, and default-org bootstrap. SecurityPlugin probes
-            // the `org-scoping` service at start() time and conditionally
-            // strips the wildcard `tenant_isolation` RLS when this plugin
-            // is absent — so registration order matters.
+            // Pair: OrganizationsPlugin (multi-org, ENTERPRISE) — must register
+            // BEFORE SecurityPlugin. The multi-org runtime (`organization_id`
+            // auto-stamp, per-org seed replay, multi-org default-org bootstrap)
+            // lives in the closed-source `@objectstack/organizations` package
+            // (ADR-0081 D2; it registers the historical `org-scoping` service
+            // SecurityPlugin probes at start() to keep vs strip the wildcard
+            // `tenant_isolation` RLS — so registration order matters). Without
+            // it, deployments are single-org: the open member-management
+            // basics (plugin-auth's default-org bootstrap + better-auth
+            // invitations) still work.
             const multiTenant = resolveMultiOrgEnabled();
             if (multiTenant) {
               try {
-                const orgScopingPkg = '@objectstack/plugin-org-scoping';
-                const { OrgScopingPlugin } = await import(/* webpackIgnore: true */ orgScopingPkg);
-                await kernel.use(new OrgScopingPlugin());
-                trackPlugin('OrgScoping');
+                const organizationsPkg = '@objectstack/organizations';
+                const mod: any = await import(/* webpackIgnore: true */ organizationsPkg);
+                await kernel.use(new mod.OrganizationsPlugin());
+                trackPlugin('Organizations');
               } catch {
-                // optional — multi-tenant mode requested but plugin not installed
+                // Requested multi-org without the enterprise package — loud,
+                // not silent: RLS tenant policies will be STRIPPED and every
+                // org boundary is inert until the package is installed.
+                console.warn(chalk.yellow('  ⚠ OS_MULTI_ORG_ENABLED=true but @objectstack/organizations (enterprise) is not installed — running single-org.'));
               }
             }
 

packages/cli/src/commands/verify.ts

@@ -42,7 +42,7 @@ export default class Verify extends Command {
       default: false,
     }),
     'multi-tenant': Flags.boolean({
-      description: 'Boot org-scoped (register plugin-org-scoping) so tenant-isolation RLS policies apply (also honors $OS_MULTI_ORG_ENABLED)',
+      description: 'Boot org-scoped (register the enterprise @objectstack/organizations plugin) so tenant-isolation RLS policies apply (also honors $OS_MULTI_ORG_ENABLED)',
       default: false,
     }),
     json: Flags.boolean({ description: 'Emit the structured report as JSON', default: false }),

packages/dogfood/test/authz-conformance.matrix.ts

@@ -41,7 +41,7 @@ export const AUTHZ_CONFORMANCE: AuthzPrimitive[] = [
   { id: 'controlled-by-parent', summary: 'master-detail controlled_by_parent', state: 'enforced',
     enforcement: 'plugin-security/security-plugin.ts computeControlledByParentFilter + assertControlledByParentWrite', proof: 'controlled-by-parent.dogfood.test.ts' },
   { id: 'multi-tenant', summary: 'organization isolation', state: 'enforced',
-    enforcement: 'plugin-org-scoping + wildcard tenant RLS', proof: 'rls-multitenant.dogfood.test.ts' },
+    enforcement: '@objectstack/organizations (enterprise) + wildcard tenant RLS', proof: 'rls-multitenant.dogfood.test.ts' },
   { id: 'anonymous-deny', summary: 'secure-by-default anonymous posture (capability)', state: 'enforced',
     enforcement: 'rest/rest-server.ts enforceAuth (requireAuth)', proof: 'showcase-anonymous-deny.dogfood.test.ts' },
   { id: 'default-profile', summary: 'app-declared default profile (isDefault)', state: 'enforced',

packages/dogfood/test/rls-multitenant.dogfood.test.ts

@@ -30,7 +30,19 @@ import crmStack from '@objectstack/example-crm';
 import { bootStack, type VerifyStack } from '@objectstack/verify';
 import { runRlsProofs, formatRlsReport, type RlsReport } from '@objectstack/verify';
 
-describe('objectstack verify RLS: CRM multi-tenant (#1994 org-scoped)', () => {
+// The multi-org runtime moved to the ENTERPRISE `@objectstack/organizations`
+// package (ADR-0081 D2) — not part of this open workspace. Skip (loudly) when
+// it isn't linked in; enterprise/cloud CI, which ships the package, runs this.
+const organizationsPkg = '@objectstack/organizations';
+const organizationsAvailable = await import(/* webpackIgnore: true */ organizationsPkg)
+  .then(() => true)
+  .catch(() => false);
+if (!organizationsAvailable) {
+  // eslint-disable-next-line no-console
+  console.warn('[dogfood] @objectstack/organizations (enterprise) not installed — skipping the multi-org RLS gate');
+}
+
+describe.skipIf(!organizationsAvailable)('objectstack verify RLS: CRM multi-tenant (#1994 org-scoped)', () => {
   let stack: VerifyStack;
   let report: RlsReport;
 

packages/platform-objects/src/apps/setup-nav.contributions.ts

@@ -57,10 +57,22 @@ export const SETUP_NAV_CONTRIBUTIONS: NavigationContribution[] = [
     priority: BASE_PRIORITY,
     items: [
       { id: 'nav_users', type: 'object', label: 'Users', objectName: 'sys_user', icon: 'user' },
+      // The ACTIVE organization's record page (Members / Invitations / Teams
+      // tabs with the better-auth row actions), rendered inside the app shell
+      // (ADR-0081). `{current_org_id}` resolves from the session's active
+      // organization; unresolved (e.g. org-less admin before bootstrap) it
+      // falls back to the sys_organization list — one row in single-org.
+      { id: 'nav_organization', type: 'object', label: 'Organization', objectName: 'sys_organization', recordId: '{current_org_id}', icon: 'building-2' },
       { id: 'nav_business_units', type: 'object', label: 'Business Units', objectName: 'sys_business_unit', icon: 'building', requiresObject: 'sys_business_unit' },
-      { id: 'nav_teams', type: 'object', label: 'Teams', objectName: 'sys_team', icon: 'users-round', requiresService: 'org-scoping' },
+      // Teams / Invitations no longer gate on `org-scoping` (ADR-0081 D1):
+      // the better-auth organization capability is always mounted, and
+      // plugin-auth's single-org default-org bootstrap guarantees an org to
+      // invite into — these are the OPEN member-management basics. Only the
+      // org LIST below keeps the gate: browsing organizations is meaningful
+      // only when more than one can exist (enterprise multi-org).
+      { id: 'nav_teams', type: 'object', label: 'Teams', objectName: 'sys_team', icon: 'users-round' },
       { id: 'nav_organizations', type: 'object', label: 'Organizations', objectName: 'sys_organization', icon: 'building-2', requiresService: 'org-scoping' },
-      { id: 'nav_invitations', type: 'object', label: 'Invitations', objectName: 'sys_invitation', icon: 'mail', requiresService: 'org-scoping' },
+      { id: 'nav_invitations', type: 'object', label: 'Invitations', objectName: 'sys_invitation', icon: 'mail' },
     ],
   },
   {

packages/platform-objects/src/apps/translations/en.ts

@@ -63,6 +63,7 @@ export const en: TranslationData = {
 
         // People & Organization
         nav_users: { label: 'Users' },
+        nav_organization: { label: 'Organization' },
         nav_business_units: { label: 'Business Units' },
         nav_teams: { label: 'Teams' },
         nav_organizations: { label: 'Organizations' },

packages/platform-objects/src/apps/translations/es-ES.ts

@@ -45,6 +45,7 @@ export const esES: TranslationData = {
         nav_system_overview: { label: 'Resumen del Sistema' },
 
         nav_users: { label: 'Usuarios' },
+        nav_organization: { label: 'Organización' },
         nav_business_units: { label: 'Unidades de negocio' },
         nav_teams: { label: 'Equipos' },
         nav_organizations: { label: 'Organizaciones' },