fix(platform-objects): hide org/membership surfaces in single-org mode

[os-zhuang]

Problem

The platform gates multi-org features two ways — nav entries on requiresService: 'org-scoping' (e.g. setup-nav Organizations/Invitations) and object actions on visible: 'features.multiOrgEnabled != false' (e.g. sys_organization.create_organization). That convention had only been wired in a handful of spots, so a wide band of org/membership surface leaked into single-org deployments (OS_MULTI_ORG_ENABLED unset/false) where it is pure UX noise or a broken affordance.

Triggering example: …/_console/apps/com.objectstack.account/sys_member/view/mine ("My Organizations") shows even in single-org, where there are no sys_organization rows and no auto-stamped memberships — so the view is always empty for every user.

Changes (metadata-only)

Nav (P1)

• Account app nav_account_memberships (sys_member/mine): was gated on requiresObject: 'sys_member', which never fires (system object is always registered). Re-gated on requiresService: 'org-scoping'.
• setup-nav nav_teams (sys_team): had no gate while sibling Organizations/Invitations were service-gated. Added requiresService: 'org-scoping'.

Actions — gated on features.multiOrgEnabled != false (P0)

• sys_user.invite_user (most exposed — the Users list is always reachable in single-org)
• sys_member: add_member / update_member_role / remove_member, and transfer_ownership (combined with its existing record.role != 'owner' condition)
• sys_team: create_team / update_team / remove_team
• sys_team_member: add_team_member / remove_team_member
• sys_invitation: invite_user / resend_invitation / cancel_invitation (recipient-side accept/reject stay record-gated — unreachable in single-org anyway)

Remaining rough edges (P2)

• sys_organization admin actions (update / delete / set_active / leave / change_slug) now all gated too — previously only create_organization was.
• titleFormat no longer renders a null organization: sys_member → {user_id} ({role}), sys_invitation → Invitation for {email} (org_id is null in single-org → old formats read "… null").

sys_team's by_org view left as-is: the teams list is empty in single-org (create is gated) so the grouping never degenerates in practice, and the nav entry is hidden anyway.

Scope / safety

No behavior change in multi-org deployments (OS_MULTI_ORG_ENABLED=true): features.multiOrgEnabled is true and the org-scoping service is present, so every gate evaluates to visible exactly as before. No schema, API, or runtime changes.

Not in scope (follow-up): single-sourcing the multi-org flag resolution (driver-sql reads the env var directly instead of the resolved flag; ~8 scattered detection sites) and a regression gate asserting org-scoped surfaces are hidden in single-org.

Verification

• @objectstack/platform-objects build + DTS succeed
• Package tests 63/63 pass

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jun 26, 2026 1:55pm

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/platform-objects.

3 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/concepts/packages.mdx (via @objectstack/platform-objects)
• content/docs/concepts/setup-app.mdx (via @objectstack/platform-objects)
• content/docs/guides/packages.mdx (via @objectstack/platform-objects)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.