debug(platform-sso): admin endpoint dumps sample rows

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: hotlong

apps/cloud/wrangler.toml

@@ -45,7 +45,7 @@ compatibility_flags = ["nodejs_compat"]
 # rebuild + re-push to ship a new version, then run `wrangler deploy`.
 [[containers]]
 class_name = "CloudContainer"
-image = "registry.cloudflare.com/2846eb40a60f4738e292b90dcd8cce10/objectstack-cloud:836fcfa7"
+image = "registry.cloudflare.com/2846eb40a60f4738e292b90dcd8cce10/objectstack-cloud:0396a5bf"
 max_instances = 3
 instance_type = "standard-1"
 

packages/platform-objects/src/apps/index.ts

@@ -1,5 +1,4 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
 export { SETUP_APP } from './setup.app.js';
-export * from './views/index.js';
 export * from './dashboards/index.js';

packages/platform-objects/src/apps/views/audit_logs.view.ts

@@ -6,12 +6,6 @@ import {
   SETUP_APP,
   SystemOverviewDashboard,
   SecurityOverviewDashboard,
-  UsersView,
-  OrganizationsView,
-  RolesView,
-  SessionsView,
-  AuditLogsView,
-  PackageInstallationsView,
 } from '@objectstack/platform-objects/apps';
 import { AuthManager } from './auth-manager.js';
 import {
@@ -135,18 +129,15 @@ export class AuthPlugin implements Plugin {
       // owner of its registration since it loads first among the trio
       // (auth + security + audit) that supplies the underlying objects.
       apps: [SETUP_APP],
-      // Curated list views and dashboards consumed by the Setup App's
-      // navigation entries. The manifest service does NOT auto-discover
-      // these from the app definition — they must be registered as
-      // explicit top-level arrays per ObjectStackDefinitionSchema.
-      views: [
-        UsersView,
-        OrganizationsView,
-        RolesView,
-        SessionsView,
-        AuditLogsView,
-        PackageInstallationsView,
-      ],
+      // List views for each Setup-nav object are defined on the schema
+      // itself via the canonical `listViews` map (e.g.
+      // sys_user.listViews.{all_users,unverified,two_factor}). Registering
+      // top-level views here is the legacy pre-M10.30c pattern — it caused
+      // duplicate "Users"/"Roles"/"Sessions" tabs to appear alongside the
+      // schema-derived ones, sometimes referencing nonexistent fields
+      // (e.g. legacy `users.view` had phone/status/active columns that do
+      // not exist on sys_user). Schema-embedded listViews is the single
+      // source of truth.
       dashboards: [SystemOverviewDashboard, SecurityOverviewDashboard],
     });