fix(auth-proxy): short-circuit /auth/config and /auth/bootstrap-status

The AuthProxyPlugin forwards every /api/v1/auth/* request straight to
the per-project better-auth handler, but better-auth has no /config or
/bootstrap-status endpoints. That hid the platform-SSO 'Continue with
ObjectStack' button on per-project subdomains (the Account SPA's
SocialSignInButtons probes /auth/config and falls back to no providers
on 404).

Intercept those two paths inside the proxy and answer them from the
project AuthManager directly:
  - /config         → authManager.getPublicConfig()
  - /bootstrap-status → dataEngine.count('sys_user') > 0

Revert the equivalent hack in http-dispatcher.handleAuth that touched
the wrong code path (the host kernel, not the project kernel).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: hotlong

CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added — M10.30b Setup app audit + listViews batch 🎯
+Followup to M10.30a. Walked every Setup menu in a real tenant; produced verdict matrix; shipped the safe fixes plus structural cleanup.
+
+- **`packages/platform-objects/src/apps/setup.app.ts`** — sidebar trimmed from 7 groups / 41 menus → 6 groups / 26 menus with no loss of capability:
+  - Removed 5 M:N join-table menus (Department Members, Team Members, Org Members, User Permission Sets, Role Permission Sets) — these are tabs on parent records, not entry points.
+  - Removed 3 marketplace-only menus (Apps, Packages, Installations) which only render when `@objectstack/service-tenant` is loaded; in single-project runtimes they 404'd.
+  - Removed 3 OAuth satellite menus (Access Tokens, Refresh Tokens, Consents); they live under their parent OAuth Application detail.
+  - Removed Activity + Comments from Diagnostics; both are CRM operational data, not platform admin surfaces.
+  - Demoted "All Metadata" from a top-level Platform group to Advanced/debug. Platform group is now empty and removed.
+  - Renamed "Linked Accounts" → "Identity Links" to disambiguate from sys_user / org members.
+- **listViews extension** — mirroring the M10.30a pattern, the following sys_* schemas now ship curated, segmented views:
+  - `sys_user`: All Users / Unverified / 2FA Enabled
+  - `sys_role`: Active / Default / Custom / All
+  - `sys_permission_set`: Active / Inactive / All
+  - `sys_invitation`: Pending / Accepted / Expired-Canceled / All
+  - `sys_session`: My Sessions / All
+  - `sys_sharing_rule`: Active / Inactive / By Object / All
+  - `sys_department`: Active / Inactive / By Kind / All
+  - `sys_team`: By Organization / All
+  - `sys_organization`: All (curated columns)
+- **Classification fixes** (correctness):
+  - `sys_metadata` — `managedBy: 'config'` → `'system'`. The metadata table backs every typed config object; writing raw rows here bypasses Zod validation. The list page now correctly hides the New button (Export-only).
+  - `sys_user_preference` — `managedBy: 'platform'` → `'system'`. Per-user state authored from the user's own settings page; the admin list is a support/diagnostic surface only. New + Import buttons are now correctly hidden.
+
 ### Added — M10.30 Built-in list views for system objects 🎯
 - **`packages/spec/src/data/object.zod.ts`** — added optional `listViews?: Record<string, ListViewSchema>` to `ObjectSchemaBase`. Already consumed by the console's `ObjectView`; previously dead because no schema declared it (Zod was stripping unknown keys). Authors can now bundle curated, segmented list views directly with the object definition.
 - **`packages/platform-objects/src/audit/sys-approval-request.object.ts`** — ships 4 views: `my_pending` (`status=pending AND pending_approvers contains {current_user_id}`, sort `updated_at desc`), `submitted_by_me` (`submitter_id={current_user_id}`), `completed` (`status in approved/rejected/recalled`, sort `completed_at desc`), `all_requests`.

apps/cloud/package.json

@@ -51,7 +51,7 @@
   },
   "devDependencies": {
     "@cloudflare/containers": "^0.3.4",
-    "@cloudflare/workers-types": "^4.20260518.1",
+    "@cloudflare/workers-types": "^4.20260519.1",
     "@types/pg": "^8.20.0",
     "esbuild": "^0.28.0",
     "ts-node": "^10.9.2",

apps/objectos/package.json

@@ -55,7 +55,7 @@
   },
   "devDependencies": {
     "@cloudflare/containers": "^0.3.4",
-    "@cloudflare/workers-types": "^4.20260518.1",
+    "@cloudflare/workers-types": "^4.20260519.1",
     "esbuild": "^0.28.0",
     "ts-node": "^10.9.2",
     "tsup": "^8.5.1",

apps/studio/package.json

@@ -23,10 +23,10 @@
   },
   "dependencies": {
     "@ai-sdk/anthropic": "^3.0.78",
-    "@ai-sdk/gateway": "^3.0.115",
+    "@ai-sdk/gateway": "^3.0.116",
     "@ai-sdk/google": "^3.0.75",
     "@ai-sdk/openai": "^3.0.64",
-    "@ai-sdk/react": "^3.0.186",
+    "@ai-sdk/react": "^3.0.187",
     "@hono/node-server": "^2.0.3",
     "@objectstack/client": "workspace:*",
     "@objectstack/client-react": "workspace:*",
@@ -63,7 +63,7 @@
     "@radix-ui/react-toast": "^1.2.15",
     "@radix-ui/react-tooltip": "^1.2.8",
     "@tanstack/react-router": "^1.170.4",
-    "ai": "^6.0.184",
+    "ai": "^6.0.185",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "hono": "^4.12.19",

packages/cli/package.json

@@ -39,7 +39,7 @@
     "topicSeparator": " "
   },
   "dependencies": {
-    "@ai-sdk/gateway": "^3.0.115",
+    "@ai-sdk/gateway": "^3.0.116",
     "@objectstack/client": "workspace:*",
     "@objectstack/core": "workspace:*",
     "@objectstack/driver-memory": "workspace:^",

packages/platform-objects/src/security/sys-sharing-rule.object.ts

@@ -37,6 +37,48 @@ export const SysSharingRule = ObjectSchema.create({
   titleFormat: '{label}',
   compactLayout: ['name', 'object_name', 'recipient_type', 'recipient_id', 'access_level', 'active'],
 
+  listViews: {
+    active: {
+      type: 'grid',
+      name: 'active',
+      label: 'Active',
+      data: { provider: 'object', object: 'sys_sharing_rule' },
+      columns: ['label', 'object_name', 'recipient_type', 'recipient_id', 'access_level', 'updated_at'],
+      filter: [{ field: 'active', operator: 'equals', value: true }],
+      sort: [{ field: 'object_name', order: 'asc' }, { field: 'label', order: 'asc' }],
+      pagination: { pageSize: 50 },
+    },
+    inactive: {
+      type: 'grid',
+      name: 'inactive',
+      label: 'Inactive',
+      data: { provider: 'object', object: 'sys_sharing_rule' },
+      columns: ['label', 'object_name', 'recipient_type', 'recipient_id', 'updated_at'],
+      filter: [{ field: 'active', operator: 'equals', value: false }],
+      sort: [{ field: 'label', order: 'asc' }],
+      pagination: { pageSize: 50 },
+    },
+    by_object: {
+      type: 'grid',
+      name: 'by_object',
+      label: 'By Object',
+      data: { provider: 'object', object: 'sys_sharing_rule' },
+      columns: ['object_name', 'label', 'recipient_type', 'access_level', 'active'],
+      sort: [{ field: 'object_name', order: 'asc' }, { field: 'label', order: 'asc' }],
+      grouping: { fields: [{ field: 'object_name', order: 'asc', collapsed: false }] },
+      pagination: { pageSize: 100 },
+    },
+    all_rules: {
+      type: 'grid',
+      name: 'all_rules',
+      label: 'All',
+      data: { provider: 'object', object: 'sys_sharing_rule' },
+      columns: ['label', 'object_name', 'recipient_type', 'recipient_id', 'access_level', 'active', 'updated_at'],
+      sort: [{ field: 'label', order: 'asc' }],
+      pagination: { pageSize: 50 },
+    },
+  },
+
   fields: {
     id: Field.text({ label: 'Rule ID', required: true, readonly: true, group: 'System' }),
 

packages/runtime/src/cloud/auth-proxy-plugin.ts

@@ -112,6 +112,44 @@ export class AuthProxyPlugin implements Plugin {
                         try { authSvc = (projectKernel as any).getService?.('auth'); } catch { /* ignore */ }
                     }
 
+                    // Custom non-better-auth endpoints. better-auth has no
+                    // /config or /bootstrap-status route, so without these
+                    // short-circuits the request would fall through to the
+                    // better-auth handler and 404. The Account SPA needs
+                    // /config to render the "Continue with ObjectStack"
+                    // platform SSO button via SocialSignInButtons.
+                    const subPath = url.pathname.startsWith(AUTH_PREFIX + '/')
+                        ? url.pathname.substring(AUTH_PREFIX.length + 1)
+                        : '';
+                    if (c.req.method === 'GET' && (subPath === 'config' || subPath === 'bootstrap-status')) {
+                        if (subPath === 'config') {
+                            try {
+                                const config = typeof authSvc?.getPublicConfig === 'function'
+                                    ? authSvc.getPublicConfig()
+                                    : null;
+                                if (config) {
+                                    return c.json({ success: true, data: config });
+                                }
+                                return c.json({ success: false, error: { code: 'auth_config_unavailable', message: 'AuthManager has no getPublicConfig()' } }, 503);
+                            } catch (e: any) {
+                                return c.json({ success: false, error: { code: 'auth_config_error', message: String(e?.message ?? e) } }, 500);
+                            }
+                        }
+                        // bootstrap-status
+                        try {
+                            const dataEngine = typeof authSvc?.getDataEngine === 'function'
+                                ? authSvc.getDataEngine()
+                                : null;
+                            if (!dataEngine || typeof dataEngine.count !== 'function') {
+                                return c.json({ hasOwner: true });
+                            }
+                            const count = await dataEngine.count('sys_user', {});
+                            return c.json({ hasOwner: (count ?? 0) > 0 });
+                        } catch {
+                            return c.json({ hasOwner: true });
+                        }
+                    }
+
                     const fn = await resolveAuthHandler(authSvc);
                     if (!fn) {
                         return c.json({ error: 'auth_service_unavailable', projectId }, 503);

packages/runtime/src/http-dispatcher.ts

@@ -695,39 +695,8 @@ export class HttpDispatcher {
      * path: sub-path after /auth/
      */
     async handleAuth(path: string, method: string, body: any, context: HttpProtocolContext): Promise<HttpDispatcherResult> {
-        // 0. Custom non-better-auth endpoints. Per-project AuthPlugins run
-        // with registerRoutes:false (the project kernel has no HTTP server
-        // of its own — the host dispatcher routes inbound requests in), so
-        // the `/config` and `/bootstrap-status` routes that AuthPlugin
-        // normally wires onto the raw Hono app are unreachable. Mirror them
-        // here so the per-project Account SPA can render the "Continue with
-        // ObjectStack" SSO button and detect first-run setup.
-        const normalizedShort = path.replace(/^\/+/, '');
-        const authService: any = await this.getService(CoreServiceName.enum.auth);
-        if (authService && method.toUpperCase() === 'GET') {
-            if (normalizedShort === 'config' && typeof authService.getPublicConfig === 'function') {
-                try {
-                    const config = authService.getPublicConfig();
-                    return { handled: true, response: { status: 200, body: { success: true, data: config } } };
-                } catch (e: any) {
-                    return { handled: true, response: { status: 500, body: { success: false, error: { code: 'auth_config_error', message: String(e?.message ?? e) } } } };
-                }
-            }
-            if (normalizedShort === 'bootstrap-status') {
-                try {
-                    const dataEngine = typeof authService.getDataEngine === 'function' ? authService.getDataEngine() : null;
-                    if (!dataEngine || typeof dataEngine.count !== 'function') {
-                        return { handled: true, response: { status: 200, body: { hasOwner: true } } };
-                    }
-                    const count = await dataEngine.count('sys_user', {});
-                    return { handled: true, response: { status: 200, body: { hasOwner: (count ?? 0) > 0 } } };
-                } catch {
-                    return { handled: true, response: { status: 200, body: { hasOwner: true } } };
-                }
-            }
-        }
-
         // 1. Try generic Auth Service
+        const authService = await this.getService(CoreServiceName.enum.auth);
         if (authService && typeof authService.handler === 'function') {
             const response = await authService.handler(context.request, context.response);
             return { handled: true, result: response };

packages/services/service-ai/package.json

@@ -21,7 +21,7 @@
     "@ai-sdk/provider": "^3.0.10",
     "@objectstack/core": "workspace:*",
     "@objectstack/spec": "workspace:*",
-    "ai": "^6.0.184"
+    "ai": "^6.0.185"
   },
   "peerDependencies": {
     "@ai-sdk/anthropic": "^3.0.0",

packages/spec/package.json

@@ -119,7 +119,7 @@
   "devDependencies": {
     "@types/node": "^25.9.0",
     "@vitest/coverage-v8": "^4.1.6",
-    "ai": "^6.0.184",
+    "ai": "^6.0.185",
     "tsx": "^4.22.2",
     "typescript": "^6.0.3",
     "vitest": "^4.1.6"