en.objects.generated.ts

// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.

/**
 * Auto-generated by 'os i18n extract' for locale 'en'.
 * Edit translations in place; re-run extract (with --merge) to fill new gaps.
 * Do not hand-edit the structure — only the leaf string values.
 */

import type { TranslationData } from '@objectstack/spec/system';

export const enObjects: NonNullable<TranslationData['objects']> = {
  sys_user: {
    label: "User",
    pluralLabel: "Users",
    description: "User accounts for authentication",
    fields: {
      name: {
        label: "Name"
      },
      email: {
        label: "Email"
      },
      email_verified: {
        label: "Email Verified"
      },
      two_factor_enabled: {
        label: "Two-Factor Enabled",
        help: "Whether two-factor authentication is enabled for this user. Maintained by the better-auth `twoFactor` plugin."
      },
      role: {
        label: "Platform Role",
        help: "Platform-level role (admin, user, …). Set via the Set Platform Role action."
      },
      banned: {
        label: "Banned",
        help: "When true, the user cannot sign in. Toggle via Ban User / Unban User actions."
      },
      ban_reason: {
        label: "Ban Reason"
      },
      ban_expires: {
        label: "Ban Expires",
        help: "When set, the ban auto-clears at this time."
      },
      failed_login_count: {
        label: "Failed Login Count",
        help: "Consecutive failed sign-in attempts; reset to 0 on success. Maintained by the auth manager."
      },
      locked_until: {
        label: "Locked Until",
        help: "When set and in the future, sign-in is rejected (brute-force lockout). Auto-clears past this time; an admin can clear it early via Unlock."
      },
      password_changed_at: {
        label: "Password Changed At",
        help: "Timestamp of the last password change. Backs password_expiry_days; system-managed."
      },
      phone_number: {
        label: "Phone Number",
        help: "Sign-in phone number (E.164 recommended). Unique per user; managed by better-auth when the phoneNumber plugin is enabled."
      },
      phone_number_verified: {
        label: "Phone Verified",
        help: "Whether the phone number has been verified (OTP verification requires SMS infrastructure; false until that ships). System-managed."
      },
      must_change_password: {
        label: "Must Change Password",
        help: "When true, the user is blocked (403 PASSWORD_EXPIRED) until they change their password. Stamped by the admin user-management routes; system-managed."
      },
      mfa_required_at: {
        label: "MFA Required At",
        help: "When enforced MFA first applied to this user (grace-period clock). Backs mfa_required; system-managed."
      },
      last_login_at: {
        label: "Last Login At",
        help: "Timestamp of the last successful sign-in. Stamped by the auth manager; system-managed."
      },
      last_login_ip: {
        label: "Last Login IP",
        help: "Client IP of the last successful sign-in (from the trusted proxy forwarded header). System-managed."
      },
      ai_access: {
        label: "AI Access",
        help: "Whether this user holds an AI seat — grants access to the in-UI AI agents (build / ask). The framework synthesizes the `ai_seat` capability from this flag (plugin-hono-server resolveCtx). Assignment is capped by the licensed / purchased seat count (enforced by @objectstack/security-enterprise AiSeatPlugin). Owned by objectql (better-auth is oblivious to this column)."
      },
      image: {
        label: "Profile Image"
      },
      manager_id: {
        label: "Manager",
        help: "This user's direct manager. Forms the reporting chain the `own_and_reports` hierarchy scope walks (ADR-0057 / @objectstack/security-enterprise)."
      },
      primary_business_unit_id: {
        label: "Primary Business Unit",
        help: "The user's primary business unit — a denormalised projection of sys_business_unit_member.is_primary, maintained by plugin-sharing (ADR-0057 addendum D12). Lets a user-lookup filter candidates by business unit without traversing the membership junction. Do not edit directly; set it via business-unit membership."
      },
      source: {
        label: "Identity Source",
        help: "How this identity was created — idp_provisioned (federated SSO JIT) or env_native (local signup / app end-user). System-managed; do not edit.",
        options: {
          idp_provisioned: "IdP-Provisioned",
          env_native: "Env-Native"
        }
      },
      id: {
        label: "User ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    },
    _views: {
      me: {
        label: "My Profile"
      },
      all_users: {
        label: "All Users"
      },
      unverified: {
        label: "Unverified"
      },
      two_factor: {
        label: "2FA Enabled"
      },
      banned: {
        label: "Banned"
      }
    },
    _actions: {
      invite_user: {
        label: "Invite User",
        successMessage: "Invitation sent"
      },
      ban_user: {
        label: "Ban User",
        confirmText: "Ban this user? They will be signed out and unable to sign in until unbanned.",
        successMessage: "User banned",
        params: {
          banReason: {
            label: "Ban Reason"
          }
        }
      },
      unban_user: {
        label: "Unban User",
        successMessage: "User unbanned"
      },
      unlock_user: {
        label: "Unlock Account",
        successMessage: "Account unlocked"
      },
      create_user: {
        label: "Create User",
        successMessage: "User created",
        params: {
          phoneNumber: {
            label: "Phone Number",
            helpText: "Sign-in phone number (E.164, e.g. +8613800000000). Required when no email is given."
          },
          generatePassword: {
            label: "Generate Temporary Password"
          },
          password: {
            label: "Password (leave empty to generate)"
          },
          mustChangePassword: {
            label: "Require Password Change On First Login"
          }
        },
        resultDialog: {
          title: "User Created",
          description: "Copy the temporary password now — it is shown only once and never stored.",
          acknowledge: "I have saved this password",
          fields: {
            "user.email": "Email",
            "user.phoneNumber": "Phone Number",
            temporaryPassword: "Temporary Password"
          }
        }
      },
      set_user_password: {
        label: "Set Password",
        successMessage: "Password updated",
        params: {
          generatePassword: {
            label: "Generate Temporary Password"
          },
          newPassword: {
            label: "New Password (leave empty to generate)"
          },
          mustChangePassword: {
            label: "Require Password Change On Next Login"
          }
        },
        resultDialog: {
          title: "Password Updated",
          description: "If a temporary password was generated, copy it now — it is shown only once and never stored.",
          acknowledge: "Done",
          fields: {
            temporaryPassword: "Temporary Password"
          }
        }
      },
      set_user_role: {
        label: "Set Platform Role",
        successMessage: "Role updated",
        params: {
          role: {
            label: "Platform Role"
          }
        }
      },
      impersonate_user: {
        label: "Impersonate User",
        confirmText: "Start an impersonation session for this user? Use only for legitimate support cases — actions will be logged.",
        successMessage: "Now impersonating user"
      },
      update_my_profile: {
        label: "Update Profile",
        successMessage: "Profile updated"
      },
      change_my_password: {
        label: "Change Password",
        successMessage: "Password changed",
        params: {
          currentPassword: {
            label: "Current Password"
          },
          newPassword: {
            label: "New Password"
          },
          revokeOtherSessions: {
            label: "Sign out other devices"
          }
        }
      },
      change_my_email: {
        label: "Change Email",
        successMessage: "Verification email sent — check the new address to confirm.",
        params: {
          newEmail: {
            label: "New Email"
          }
        }
      },
      resend_verification_email: {
        label: "Resend Verification Email",
        successMessage: "Verification email sent — check your inbox."
      },
      delete_my_account: {
        label: "Delete My Account",
        confirmText: "Permanently delete your account? This cannot be undone — all your sessions will be terminated and all data you own will be removed per the configured retention policy.",
        successMessage: "Account deleted",
        params: {
          password: {
            label: "Current Password"
          }
        }
      },
      enable_two_factor: {
        label: "Enable Two-Factor Auth",
        successMessage: "Two-factor authentication enabled. Scan the QR code or paste the otpauth URI into your authenticator app, then verify a code to complete setup.",
        params: {
          password: {
            label: "Current Password"
          }
        }
      },
      disable_two_factor: {
        label: "Disable Two-Factor Auth",
        confirmText: "Turn off two-factor authentication? Your account will be less secure.",
        successMessage: "Two-factor authentication disabled.",
        params: {
          password: {
            label: "Current Password"
          }
        }
      },
      generate_backup_codes: {
        label: "Regenerate Backup Codes",
        confirmText: "Generate a new set of backup codes? Any previously generated codes will stop working.",
        successMessage: "New backup codes generated — save them somewhere safe.",
        params: {
          password: {
            label: "Current Password"
          }
        }
      }
    }
  },
  sys_session: {
    label: "Session",
    pluralLabel: "Sessions",
    description: "Active user sessions",
    fields: {
      user_id: {
        label: "User"
      },
      expires_at: {
        label: "Expires At"
      },
      last_activity_at: {
        label: "Last Activity At",
        help: "Timestamp of the last request on this session; drives idle-timeout. System-managed."
      },
      revoked_at: {
        label: "Revoked At",
        help: "When set, this session was revoked (idle / absolute-max / concurrent-cap / admin). System-managed."
      },
      revoke_reason: {
        label: "Revoke Reason",
        help: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, …)."
      },
      active_organization_id: {
        label: "Active Organization"
      },
      active_team_id: {
        label: "Active Team"
      },
      ip_address: {
        label: "IP Address"
      },
      user_agent: {
        label: "User Agent"
      },
      impersonated_by: {
        label: "Impersonated By",
        help: "User id of the admin that started this impersonation session, if any."
      },
      token: {
        label: "Session Token",
        help: "Opaque session token — never exposed in UI"
      },
      id: {
        label: "Session ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    },
    _views: {
      mine: {
        label: "My Sessions"
      },
      all_sessions: {
        label: "All"
      }
    },
    _actions: {
      revoke_my_other_sessions: {
        label: "Sign out other devices",
        confirmText: "Sign out of every other device where you're currently logged in? Your current session will remain active.",
        successMessage: "All other sessions revoked"
      },
      revoke_session: {
        label: "Revoke Session",
        confirmText: "Revoke this session? The user will be signed out from that device.",
        successMessage: "Session revoked"
      }
    }
  },
  sys_account: {
    label: "Account",
    pluralLabel: "Accounts",
    description: "OAuth and authentication provider accounts",
    fields: {
      id: {
        label: "Account ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      },
      provider_id: {
        label: "Provider ID",
        help: "OAuth provider identifier (google, github, etc.)"
      },
      account_id: {
        label: "Provider Account ID",
        help: "User's ID in the provider's system"
      },
      user_id: {
        label: "User",
        help: "Link to user table"
      },
      access_token: {
        label: "Access Token"
      },
      refresh_token: {
        label: "Refresh Token"
      },
      id_token: {
        label: "ID Token"
      },
      access_token_expires_at: {
        label: "Access Token Expires At"
      },
      refresh_token_expires_at: {
        label: "Refresh Token Expires At"
      },
      scope: {
        label: "OAuth Scope"
      },
      password: {
        label: "Password Hash",
        help: "Hashed password for email/password provider"
      },
      previous_password_hashes: {
        label: "Previous Password Hashes",
        help: "JSON array of prior password hashes (bounded by password_history_count); reuse-prevention only. System-managed."
      }
    },
    _views: {
      mine: {
        label: "My Links"
      },
      by_provider: {
        label: "By Provider"
      },
      all_links: {
        label: "All"
      }
    },
    _actions: {
      link_social: {
        label: "Link Social Account",
        params: {
          provider: {
            label: "Provider",
            options: {
              google: "Google",
              github: "GitHub",
              microsoft: "Microsoft",
              apple: "Apple",
              facebook: "Facebook",
              gitlab: "GitLab",
              discord: "Discord"
            }
          }
        }
      },
      unlink_account: {
        label: "Unlink Account",
        confirmText: "Unlink this identity link? The user will no longer be able to sign in with this provider until they re-link it from their account settings.",
        successMessage: "Identity link removed"
      }
    }
  },
  sys_verification: {
    label: "Verification",
    pluralLabel: "Verifications",
    description: "Email and phone verification tokens",
    fields: {
      id: {
        label: "Verification ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      },
      value: {
        label: "Verification Token",
        help: "Token or code for verification"
      },
      expires_at: {
        label: "Expires At"
      },
      identifier: {
        label: "Identifier",
        help: "Email address or phone number"
      }
    }
  },
  sys_organization: {
    label: "Organization",
    pluralLabel: "Organizations",
    description: "Organizations for multi-tenant grouping",
    fields: {
      name: {
        label: "Name"
      },
      slug: {
        label: "Slug",
        help: "URL-friendly identifier"
      },
      logo: {
        label: "Logo"
      },
      metadata: {
        label: "Metadata",
        help: "JSON-serialized organization metadata"
      },
      require_mfa: {
        label: "Require Multi-Factor Auth",
        help: "When true, every member of this organization must enroll an authenticator app to access data."
      },
      id: {
        label: "Organization ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    },
    _views: {
      all_orgs: {
        label: "All"
      }
    },
    _actions: {
      create_organization: {
        label: "Create Organization",
        successMessage: "Organization created"
      },
      update_organization: {
        label: "Edit Organization",
        successMessage: "Organization updated"
      },
      delete_organization: {
        label: "Delete Organization",
        confirmText: "Delete this organization? All members will lose access immediately. This cannot be undone.",
        successMessage: "Organization deleted"
      },
      set_active_organization: {
        label: "Set Active",
        successMessage: "Active organization switched"
      },
      leave_organization: {
        label: "Leave Organization",
        confirmText: "Leave this organization? You will lose access to all of its resources.",
        successMessage: "You have left the organization"
      },
      change_slug: {
        label: "Change Slug",
        confirmText: "Renaming the slug rewrites every platform subdomain for this org and parks the old slug for 90 days. Continue?",
        successMessage: "Organization slug changed"
      }
    }
  },
  sys_member: {
    label: "Member",
    pluralLabel: "Members",
    description: "Organization membership records",
    fields: {
      id: {
        label: "Member ID"
      },
      created_at: {
        label: "Created At"
      },
      organization_id: {
        label: "Organization"
      },
      user_id: {
        label: "User"
      },
      role: {
        label: "Role",
        help: "Member role within the organization",
        options: {
          owner: "Owner",
          admin: "Admin",
          member: "Member"
        }
      }
    },
    _views: {
      mine: {
        label: "My Memberships",
        emptyState: {
          title: "No organizations yet",
          message: "You haven't joined any organizations."
        }
      }
    },
    _actions: {
      add_member: {
        label: "Add Member",
        successMessage: "Member added"
      },
      update_member_role: {
        label: "Change Role",
        successMessage: "Member role updated"
      },
      remove_member: {
        label: "Remove Member",
        confirmText: "Remove this member from the organization? They will lose access to all org resources.",
        successMessage: "Member removed"
      },
      transfer_ownership: {
        label: "Transfer Ownership",
        confirmText: "Transfer ownership of this organization to the selected member? You will be demoted to admin and lose owner-only privileges.",
        successMessage: "Ownership transferred"
      }
    }
  },
  sys_invitation: {
    label: "Invitation",
    pluralLabel: "Invitations",
    description: "Organization invitations for user onboarding",
    fields: {
      id: {
        label: "Invitation ID"
      },
      created_at: {
        label: "Created At"
      },
      organization_id: {
        label: "Organization"
      },
      email: {
        label: "Email",
        help: "Email address of the invited user"
      },
      role: {
        label: "Role",
        help: "Role to assign upon acceptance",
        options: {
          owner: "Owner",
          admin: "Admin",
          member: "Member"
        }
      },
      status: {
        label: "Status",
        options: {
          pending: "pending",
          accepted: "accepted",
          rejected: "rejected",
          expired: "expired",
          canceled: "canceled"
        }
      },
      inviter_id: {
        label: "Inviter",
        help: "User who sent the invitation"
      },
      expires_at: {
        label: "Expires At"
      },
      team_id: {
        label: "Team",
        help: "Optional team to assign upon acceptance"
      }
    },
    _views: {
      pending: {
        label: "Pending"
      },
      accepted: {
        label: "Accepted"
      },
      expired: {
        label: "Expired / Canceled"
      },
      all_invitations: {
        label: "All"
      }
    },
    _actions: {
      invite_user: {
        label: "Invite User",
        successMessage: "Invitation sent"
      },
      cancel_invitation: {
        label: "Cancel Invitation",
        confirmText: "Cancel this invitation? The recipient will no longer be able to accept it.",
        successMessage: "Invitation canceled"
      },
      resend_invitation: {
        label: "Resend Invitation",
        successMessage: "Invitation resent"
      },
      accept_invitation: {
        label: "Accept Invitation",
        successMessage: "Invitation accepted"
      },
      reject_invitation: {
        label: "Decline Invitation",
        confirmText: "Decline this invitation? The inviter will be notified and you will need a new invitation to join.",
        successMessage: "Invitation declined"
      }
    }
  },
  sys_team: {
    label: "Team",
    pluralLabel: "Teams",
    description: "Teams within organizations for fine-grained grouping",
    fields: {
      name: {
        label: "Name"
      },
      organization_id: {
        label: "Organization",
        help: "Parent organization for this team"
      },
      id: {
        label: "Team ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    },
    _views: {
      by_org: {
        label: "By Organization"
      },
      all_teams: {
        label: "All"
      }
    },
    _actions: {
      create_team: {
        label: "Create Team",
        successMessage: "Team created"
      },
      update_team: {
        label: "Edit Team",
        successMessage: "Team updated"
      },
      remove_team: {
        label: "Delete Team",
        confirmText: "Delete this team? Members will lose any team-scoped access. This cannot be undone.",
        successMessage: "Team deleted"
      }
    }
  },
  sys_team_member: {
    label: "Team Member",
    pluralLabel: "Team Members",
    description: "Team membership records linking users to teams",
    fields: {
      id: {
        label: "Team Member ID"
      },
      created_at: {
        label: "Created At"
      },
      team_id: {
        label: "Team"
      },
      user_id: {
        label: "User"
      }
    },
    _actions: {
      add_team_member: {
        label: "Add Member",
        successMessage: "Team member added"
      },
      remove_team_member: {
        label: "Remove from Team",
        confirmText: "Remove this user from the team? They will lose any team-scoped access.",
        successMessage: "Team member removed"
      }
    }
  },
  sys_business_unit: {
    label: "Business Unit",
    pluralLabel: "Business Units",
    description: "Hierarchical org-skeleton node (department / division / business unit / office).",
    fields: {
      name: {
        label: "Name"
      },
      code: {
        label: "Code",
        help: "Short stable code (e.g. EMEA-SALES). Unique within tenant."
      },
      kind: {
        label: "Kind",
        help: "Categorisation hint — does not change graph semantics.",
        options: {
          company: "company",
          division: "division",
          department: "department",
          office: "office",
          cost_center: "cost_center"
        }
      },
      parent_business_unit_id: {
        label: "Parent Business Unit",
        help: "Self-reference for the org tree. Null = root of tenant."
      },
      organization_id: {
        label: "Organization",
        help: "Tenant scope."
      },
      manager_user_id: {
        label: "Business Unit Head",
        help: "User responsible for this org unit (business unit head / lead)."
      },
      active: {
        label: "Active",
        help: "When false, members are not expanded by graph queries."
      },
      effective_from: {
        label: "Effective From",
        help: "When this business unit came into existence (HRIS sync)."
      },
      effective_to: {
        label: "Effective To",
        help: "When this business unit was retired (HRIS sync)."
      },
      external_ref: {
        label: "External Reference",
        help: "ID in upstream HRIS (Workday / SAP HR / 北森)."
      },
      id: {
        label: "Business Unit ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    },
    _views: {
      org_chart: {
        label: "Org Chart"
      },
      active: {
        label: "Active"
      },
      inactive: {
        label: "Inactive"
      },
      by_kind: {
        label: "By Kind"
      },
      all_departments: {
        label: "All"
      }
    }
  },
  sys_business_unit_member: {
    label: "Business Unit Member",
    pluralLabel: "Business Unit Members",
    description: "User assignment to a business unit (matrix-org friendly, effective-dated).",
    fields: {
      id: {
        label: "Member ID"
      },
      business_unit_id: {
        label: "Business Unit"
      },
      user_id: {
        label: "User"
      },
      function_in_business_unit: {
        label: "Function in Business Unit",
        help: "`lead` is the day-to-day head; `deputy` may stand in for the lead in approval routing.",
        options: {
          member: "member",
          lead: "lead",
          deputy: "deputy"
        }
      },
      is_primary: {
        label: "Primary Assignment",
        help: "When the user is in multiple departments, this marks the canonical one for reporting."
      },
      effective_from: {
        label: "Effective From"
      },
      effective_to: {
        label: "Effective To"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_api_key: {
    label: "API Key",
    pluralLabel: "API Keys",
    description: "API keys for programmatic access",
    fields: {
      name: {
        label: "Name",
        help: "Human-readable label for the API key"
      },
      prefix: {
        label: "Prefix",
        help: "Visible prefix for identifying the key (e.g., \"osk_\")"
      },
      user_id: {
        label: "Owner",
        help: "User who owns this API key"
      },
      scopes: {
        label: "Scopes",
        help: "JSON array of permission scopes"
      },
      expires_at: {
        label: "Expires At"
      },
      last_used_at: {
        label: "Last Used At",
        help: "Automatically updated on each API call"
      },
      revoked: {
        label: "Revoked"
      },
      key: {
        label: "Hashed Key",
        help: "Hashed API key value — never exposed to clients"
      },
      id: {
        label: "API Key ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    },
    _views: {
      mine: {
        label: "My Keys"
      },
      active: {
        label: "Active"
      },
      revoked: {
        label: "Revoked"
      },
      all_keys: {
        label: "All"
      }
    },
    _actions: {
      revoke_api_key: {
        label: "Revoke API Key",
        confirmText: "Revoke this API key? Any clients using it will immediately lose access.",
        successMessage: "API key revoked"
      },
      restore_api_key: {
        label: "Restore API Key",
        confirmText: "Restore this revoked API key? Existing clients holding the key will regain access.",
        successMessage: "API key restored"
      }
    }
  },
  sys_two_factor: {
    label: "Two Factor",
    pluralLabel: "Two Factor Credentials",
    description: "Two-factor authentication credentials",
    fields: {
      id: {
        label: "Two Factor ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      },
      user_id: {
        label: "User"
      },
      secret: {
        label: "Secret",
        help: "TOTP secret key"
      },
      backup_codes: {
        label: "Backup Codes",
        help: "JSON-serialized backup recovery codes"
      },
      verified: {
        label: "Verified",
        help: "Whether the enrollment was confirmed with a valid TOTP code (managed by better-auth)"
      }
    },
    _views: {
      mine: {
        label: "My Enrollment"
      },
      all_enrollments: {
        label: "All"
      }
    },
    _actions: {
      enable_two_factor: {
        label: "Enable 2FA",
        params: {
          password: {
            label: "Current Password"
          }
        },
        resultDialog: {
          title: "Two-factor authentication enabled",
          description: "Scan the QR code with your authenticator app, then save the backup codes somewhere safe. The backup codes are shown only once.",
          acknowledge: "I have saved my backup codes",
          fields: {
            totpURI: "Authenticator URI",
            backupCodes: "Backup Codes"
          }
        }
      },
      disable_two_factor: {
        label: "Disable 2FA",
        confirmText: "Disable two-factor authentication on your account?",
        successMessage: "2FA disabled",
        params: {
          password: {
            label: "Current Password"
          }
        }
      },
      regenerate_backup_codes: {
        label: "Regenerate Backup Codes",
        confirmText: "Regenerate backup codes? All previous backup codes will stop working immediately.",
        params: {
          password: {
            label: "Current Password"
          }
        },
        resultDialog: {
          title: "New backup codes generated",
          description: "Previous backup codes are now invalid. Save these new codes somewhere safe — they are shown only once.",
          acknowledge: "I have saved the new codes",
          fields: {
            backupCodes: "Backup Codes"
          }
        }
      }
    }
  },
  sys_device_code: {
    label: "Device Code",
    pluralLabel: "Device Codes",
    description: "OAuth 2.0 Device Authorization Grant (RFC 8628) pending requests",
    fields: {
      id: {
        label: "Device Code ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      },
      device_code: {
        label: "Device Code",
        help: "High-entropy token returned to the polling device"
      },
      user_code: {
        label: "User Code",
        help: "Short user-facing code (e.g. ABCD-EFGH)"
      },
      user_id: {
        label: "User",
        help: "User who approved the device authorization"
      },
      expires_at: {
        label: "Expires At",
        help: "When the device & user codes are no longer valid"
      },
      status: {
        label: "Status",
        help: "Current status: 'pending' | 'approved' | 'denied'"
      },
      last_polled_at: {
        label: "Last Polled At",
        help: "Timestamp of the most recent /device/token poll"
      },
      polling_interval: {
        label: "Polling Interval (ms)",
        help: "Server-recommended minimum polling interval, in ms"
      },
      client_id: {
        label: "Client ID",
        help: "OAuth client identifier of the requesting device"
      },
      scope: {
        label: "Scope",
        help: "Space-separated OAuth scopes requested by the device"
      }
    }
  },
  sys_user_preference: {
    label: "User Preference",
    pluralLabel: "User Preferences",
    description: "Per-user key-value preferences (theme, locale, etc.)",
    fields: {
      id: {
        label: "Preference ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      },
      user_id: {
        label: "User",
        help: "Owner user of this preference"
      },
      key: {
        label: "Key",
        help: "Preference key (e.g., theme, locale, plugin.ai.auto_save)"
      },
      value: {
        label: "Value",
        help: "Preference value (any JSON-serializable type)"
      }
    },
    _views: {
      mine: {
        label: "My Preferences"
      },
      by_user: {
        label: "By User"
      },
      all_preferences: {
        label: "All"
      }
    }
  },
  sys_oauth_application: {
    label: "OAuth Application",
    pluralLabel: "OAuth Applications",
    description: "Registered OAuth/OIDC client applications",
    fields: {
      id: {
        label: "ID"
      },
      name: {
        label: "Name"
      },
      icon: {
        label: "Icon",
        help: "Logo URL shown on the consent screen"
      },
      uri: {
        label: "Home URI",
        help: "Public homepage of the registered client"
      },
      contacts: {
        label: "Contacts",
        help: "JSON-serialized list of contact email addresses"
      },
      tos: {
        label: "Terms of Service"
      },
      policy: {
        label: "Privacy Policy"
      },
      metadata: {
        label: "Metadata",
        help: "JSON-serialized application metadata"
      },
      client_id: {
        label: "Client ID",
        help: "Public OAuth client identifier"
      },
      client_secret: {
        label: "Client Secret",
        help: "OAuth client secret (hashed/encrypted at rest)"
      },
      redirect_uris: {
        label: "Redirect URIs",
        help: "JSON-serialized list of allowed redirect URIs"
      },
      post_logout_redirect_uris: {
        label: "Post-logout Redirect URIs",
        help: "JSON-serialized list of allowed post-logout redirect URIs"
      },
      type: {
        label: "Client Type",
        options: {
          web: "web",
          native: "native",
          useragentbased: "user-agent-based",
          public: "public"
        }
      },
      public: {
        label: "Public Client",
        help: "Marks the client as a public (non-confidential) OAuth client"
      },
      require_pkce: {
        label: "Require PKCE"
      },
      token_endpoint_auth_method: {
        label: "Token Endpoint Auth Method",
        help: "e.g. client_secret_basic, client_secret_post, none"
      },
      grant_types: {
        label: "Grant Types",
        help: "JSON-serialized list of allowed grant types"
      },
      response_types: {
        label: "Response Types",
        help: "JSON-serialized list of allowed response types"
      },
      scopes: {
        label: "Allowed Scopes",
        help: "JSON-serialized list of scopes the client may request"
      },
      subject_type: {
        label: "Subject Type",
        help: "OIDC subject type (e.g. public, pairwise)"
      },
      jwks: {
        label: "JWKS",
        help: "Client JSON Web Key Set (for private_key_jwt / signed-request verification)"
      },
      jwks_uri: {
        label: "JWKS URI",
        help: "URL of the client JSON Web Key Set"
      },
      dpop_bound_access_tokens: {
        label: "DPoP-bound Access Tokens",
        help: "Require access tokens issued to this client to be DPoP-bound (RFC 9449)"
      },
      disabled: {
        label: "Disabled"
      },
      skip_consent: {
        label: "Skip Consent",
        help: "Treat as a trusted client and bypass the consent screen"
      },
      enable_end_session: {
        label: "Enable End Session",
        help: "Allow the client to call the OIDC end-session endpoint"
      },
      backchannel_logout_uri: {
        label: "Back-channel Logout URI",
        help: "OIDC back-channel logout endpoint of the client"
      },
      backchannel_logout_session_required: {
        label: "Back-channel Logout Session Required",
        help: "Whether the back-channel logout token must include a sid claim"
      },
      software_id: {
        label: "Software ID"
      },
      software_version: {
        label: "Software Version"
      },
      software_statement: {
        label: "Software Statement",
        help: "Signed JWT asserting the client metadata (RFC 7591 §2.3)"
      },
      user_id: {
        label: "Owner User",
        help: "User who registered this application"
      },
      reference_id: {
        label: "Reference ID",
        help: "Caller-supplied correlation identifier"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    },
    _views: {
      mine: {
        label: "My Applications"
      },
      active: {
        label: "Active"
      },
      disabled_apps: {
        label: "Disabled"
      },
      all_apps: {
        label: "All"
      }
    },
    _actions: {
      disable_oauth_application: {
        label: "Disable OAuth Application",
        confirmText: "Disable this OAuth application? Active access/refresh tokens issued to it will continue to be rejected at the token, authorize, and introspect endpoints. Existing integrations will stop working immediately.",
        successMessage: "OAuth application disabled"
      },
      enable_oauth_application: {
        label: "Enable OAuth Application",
        confirmText: "Re-enable this OAuth application? Token issuance, authorization, and introspection will resume immediately.",
        successMessage: "OAuth application enabled"
      },
      create_oauth_application: {
        label: "Register OAuth Application",
        params: {
          name: {
            label: "Application Name"
          },
          redirectURLs: {
            label: "Redirect URLs",
            helpText: "One URL per line. Must use https:// in production."
          },
          type: {
            label: "Application Type",
            options: {
              web: "Web",
              native: "Native",
              "user-agent-based": "User-agent based",
              public: "Public"
            }
          }
        },
        resultDialog: {
          title: "OAuth application registered",
          description: "Save the client_secret now — it is shown only once and cannot be recovered. You can rotate it later if it leaks.",
          acknowledge: "I have saved the client secret",
          fields: {
            "client.client_id": "Client ID",
            "client.client_secret": "Client Secret"
          }
        }
      },
      rotate_client_secret: {
        label: "Rotate Client Secret",
        confirmText: "Rotate this OAuth client's secret? The previous secret will stop working immediately and any integrations using it will break until they are updated with the new secret. The new secret is shown only once.",
        resultDialog: {
          title: "Client secret rotated",
          description: "Save the new secret now — it is shown only once. Update every integration before the previous secret's grace period ends.",
          acknowledge: "I have updated my integrations",
          fields: {
            client_secret: "New Client Secret"
          }
        }
      },
      delete_oauth_application: {
        label: "Delete OAuth Application",
        confirmText: "Permanently delete this OAuth application? All issued tokens and consents will be invalidated and integrations using this client_id will stop working immediately. This cannot be undone.",
        successMessage: "OAuth application deleted"
      }
    }
  },
  sys_oauth_access_token: {
    label: "OAuth Access Token",
    pluralLabel: "OAuth Access Tokens",
    description: "Opaque OAuth access tokens issued to client applications",
    fields: {
      id: {
        label: "ID"
      },
      token: {
        label: "Token",
        help: "Opaque access token value"
      },
      client_id: {
        label: "Client ID",
        help: "Foreign key to sys_oauth_application.client_id"
      },
      session_id: {
        label: "Session",
        help: "Foreign key to sys_session.id"
      },
      user_id: {
        label: "User",
        help: "Foreign key to sys_user.id"
      },
      refresh_id: {
        label: "Refresh Token",
        help: "Foreign key to sys_oauth_refresh_token.id"
      },
      reference_id: {
        label: "Reference ID",
        help: "Caller-supplied correlation identifier"
      },
      authorization_code_id: {
        label: "Authorization Code ID",
        help: "ID of the authorization-code grant this token originates from"
      },
      resources: {
        label: "Resources",
        help: "JSON-serialized list of RFC 8707 resource indicators bound to this token"
      },
      requested_user_info_claims: {
        label: "Requested UserInfo Claims",
        help: "JSON-serialized list of OIDC claims requested for the userinfo endpoint"
      },
      scopes: {
        label: "Scopes",
        help: "JSON-serialized list of scopes granted to this token"
      },
      expires_at: {
        label: "Expires At"
      },
      created_at: {
        label: "Created At"
      },
      revoked: {
        label: "Revoked At",
        help: "Timestamp at which this access token was revoked"
      },
      confirmation: {
        label: "Confirmation",
        help: "JSON RFC 7800 cnf claim (e.g. DPoP key thumbprint) binding this token to a key"
      }
    }
  },
  sys_oauth_refresh_token: {
    label: "OAuth Refresh Token",
    pluralLabel: "OAuth Refresh Tokens",
    description: "Opaque OAuth refresh tokens (linked to a session)",
    fields: {
      id: {
        label: "ID"
      },
      token: {
        label: "Token",
        help: "Opaque refresh token value"
      },
      client_id: {
        label: "Client ID",
        help: "Foreign key to sys_oauth_application.client_id"
      },
      session_id: {
        label: "Session",
        help: "Foreign key to sys_session.id"
      },
      user_id: {
        label: "User",
        help: "Foreign key to sys_user.id"
      },
      reference_id: {
        label: "Reference ID",
        help: "Caller-supplied correlation identifier"
      },
      authorization_code_id: {
        label: "Authorization Code ID",
        help: "ID of the authorization-code grant this token chain originates from"
      },
      resources: {
        label: "Resources",
        help: "JSON-serialized list of RFC 8707 resource indicators bound to this token"
      },
      requested_user_info_claims: {
        label: "Requested UserInfo Claims",
        help: "JSON-serialized list of OIDC claims requested for the userinfo endpoint"
      },
      scopes: {
        label: "Scopes",
        help: "JSON-serialized list of scopes granted to this token"
      },
      expires_at: {
        label: "Expires At"
      },
      created_at: {
        label: "Created At"
      },
      revoked: {
        label: "Revoked At",
        help: "Timestamp at which this refresh token was revoked"
      },
      rotated_at: {
        label: "Rotated At",
        help: "Timestamp at which this token was rotated (superseded by a new row)"
      },
      rotation_replay_response: {
        label: "Rotation Replay Response",
        help: "Cached token response replayed when the old token is re-presented within the reuse interval"
      },
      rotation_replay_expires_at: {
        label: "Rotation Replay Expires At",
        help: "End of the post-rotation reuse interval during which the replay response is served"
      },
      auth_time: {
        label: "Auth Time",
        help: "When the user originally authenticated for this token chain"
      },
      confirmation: {
        label: "Confirmation",
        help: "JSON RFC 7800 cnf claim (e.g. DPoP key thumbprint) binding this token to a key"
      }
    }
  },
  sys_oauth_consent: {
    label: "OAuth Consent",
    pluralLabel: "OAuth Consents",
    description: "User consent records for OAuth client applications",
    fields: {
      id: {
        label: "ID"
      },
      client_id: {
        label: "Client ID",
        help: "Foreign key to sys_oauth_application.client_id"
      },
      user_id: {
        label: "User",
        help: "Foreign key to sys_user.id"
      },
      reference_id: {
        label: "Reference ID",
        help: "Caller-supplied correlation identifier"
      },
      resources: {
        label: "Resources",
        help: "JSON-serialized list of RFC 8707 resource indicators the consent covers"
      },
      requested_user_info_claims: {
        label: "Requested UserInfo Claims",
        help: "JSON-serialized list of OIDC claims the user consented to expose"
      },
      scopes: {
        label: "Scopes",
        help: "JSON-serialized list of scopes the user consented to"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_oauth_resource: {
    label: "OAuth Resource",
    pluralLabel: "OAuth Resources",
    description: "Registered OAuth protected resources (RFC 8707 resource indicators)",
    fields: {
      id: {
        label: "ID"
      },
      identifier: {
        label: "Identifier",
        help: "Resource indicator URI presented in the RFC 8707 resource parameter"
      },
      name: {
        label: "Name"
      },
      access_token_ttl: {
        label: "Access Token TTL",
        help: "Access-token lifetime in seconds for this resource (overrides the server default)"
      },
      refresh_token_ttl: {
        label: "Refresh Token TTL",
        help: "Refresh-token lifetime in seconds for this resource (overrides the server default)"
      },
      signing_algorithm: {
        label: "Signing Algorithm",
        help: "JWS algorithm used to sign access tokens for this resource"
      },
      signing_key_id: {
        label: "Signing Key ID",
        help: "Key id (kid) used to sign access tokens for this resource"
      },
      allowed_scopes: {
        label: "Allowed Scopes",
        help: "JSON-serialized list of scopes clients may request for this resource"
      },
      custom_claims: {
        label: "Custom Claims",
        help: "JSON object of extra claims stamped on access tokens for this resource"
      },
      dpop_bound_access_tokens_required: {
        label: "DPoP Required",
        help: "Require access tokens for this resource to be DPoP-bound (RFC 9449)"
      },
      disabled: {
        label: "Disabled"
      },
      policy_version: {
        label: "Policy Version",
        help: "Monotonic version of the resource token policy"
      },
      metadata: {
        label: "Metadata",
        help: "JSON object of additional resource metadata"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_oauth_client_resource: {
    label: "OAuth Client Resource",
    pluralLabel: "OAuth Client Resources",
    description: "Grants allowing an OAuth client to request tokens for a protected resource",
    fields: {
      id: {
        label: "ID"
      },
      client_id: {
        label: "Client ID",
        help: "Foreign key to sys_oauth_application.client_id"
      },
      resource_id: {
        label: "Resource ID",
        help: "Foreign key to sys_oauth_resource.identifier"
      },
      metadata: {
        label: "Metadata",
        help: "JSON object of additional grant metadata"
      },
      created_at: {
        label: "Created At"
      }
    }
  },
  sys_oauth_client_assertion: {
    label: "OAuth Client Assertion",
    pluralLabel: "OAuth Client Assertions",
    description: "Consumed OAuth client-assertion JTIs (RFC 7523 replay prevention)",
    fields: {
      id: {
        label: "ID"
      },
      expires_at: {
        label: "Expires At",
        help: "Assertion expiry — rows past this instant are safe to prune"
      }
    }
  },
  sys_jwks: {
    label: "JWKS Key",
    pluralLabel: "JWKS Keys",
    description: "Asymmetric key pairs used to sign and verify issued JWTs",
    fields: {
      id: {
        label: "Key ID",
        help: "JWK `kid` value"
      },
      public_key: {
        label: "Public Key",
        help: "JSON-serialized JWK public key"
      },
      private_key: {
        label: "Private Key",
        help: "JSON-serialized JWK private key (encrypted at rest)"
      },
      alg: {
        label: "Algorithm",
        help: "JWK signing algorithm, e.g. `EdDSA` (better-auth 1.7+)"
      },
      crv: {
        label: "Curve",
        help: "JWK curve for EdDSA/EC keys, e.g. `Ed25519` (better-auth 1.7+)"
      },
      created_at: {
        label: "Created At"
      },
      expires_at: {
        label: "Expires At",
        help: "When the key may no longer be used to verify tokens"
      }
    }
  },
  sys_sso_provider: {
    label: "SSO Provider",
    pluralLabel: "SSO Providers",
    description: "External SSO identity providers (OIDC / SAML) this environment federates login to",
    fields: {
      id: {
        label: "ID"
      },
      provider_id: {
        label: "Provider ID",
        help: "Stable provider identifier (unique within the environment)"
      },
      issuer: {
        label: "Issuer",
        help: "IdP issuer URL"
      },
      domain: {
        label: "Email Domain",
        help: "Email domain routed to this IdP (e.g. acme.com)"
      },
      domain_verified: {
        label: "Domain Verified",
        help: "Whether DNS ownership of the email domain has been proven (ADR-0024 ②). Set by “Verify Domain” after the DNS TXT record resolves. Managed by better-auth — not directly editable. Only enforced when domain verification is enabled for the environment."
      },
      oidc_config: {
        label: "OIDC Config",
        help: "JSON: clientId, clientSecret, endpoints, scopes, mapping, pkce (managed by better-auth)"
      },
      saml_config: {
        label: "SAML Config",
        help: "JSON: entryPoint, cert, identifierFormat, mapping (managed by better-auth)"
      },
      user_id: {
        label: "Registered By",
        help: "User who registered this provider"
      },
      organization_id: {
        label: "Organization",
        help: "Organization scope (when org-scoped SSO is used)"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    },
    _views: {
      all: {
        label: "All",
        emptyState: {
          title: "No SSO providers yet",
          message: "Register your organization’s external IdP — OIDC (Okta, Entra, Auth0, …) with “Register SSO Provider”, or SAML 2.0 with “Register SAML Provider”. Members whose email domain matches can then sign in through it."
        }
      }
    },
    _actions: {
      register_sso_provider: {
        label: "Register SSO Provider",
        params: {
          providerId: {
            label: "Provider ID",
            helpText: "Stable identifier, e.g. \"okta\" or \"acme-entra\"."
          },
          issuer: {
            label: "Issuer URL",
            helpText: "IdP issuer, e.g. https://acme.okta.com. Discovery is fetched from here unless an explicit URL is given below."
          },
          domain: {
            label: "Email Domain",
            helpText: "Users with this email domain are routed to this IdP, e.g. acme.com."
          },
          clientId: {
            label: "Client ID",
            helpText: "OAuth client ID issued by the IdP for this environment."
          },
          clientSecret: {
            label: "Client Secret",
            helpText: "OAuth client secret (stored encrypted by better-auth)."
          },
          discoveryEndpoint: {
            label: "Discovery URL",
            helpText: "Optional. OIDC discovery document URL. Leave blank to derive `<issuer>/.well-known/openid-configuration`."
          },
          scopes: {
            label: "Scopes",
            helpText: "Optional. Space- or comma-separated OAuth scopes. Defaults to \"openid email profile\".",
            placeholder: "openid email profile"
          },
          mapId: {
            label: "Map: User ID claim",
            helpText: "Optional. ID-token claim mapped to the user ID. Defaults to \"sub\".",
            placeholder: "sub"
          },
          mapEmail: {
            label: "Map: Email claim",
            helpText: "Optional. Claim mapped to email. Defaults to \"email\".",
            placeholder: "email"
          },
          mapName: {
            label: "Map: Name claim",
            helpText: "Optional. Claim mapped to display name. Defaults to \"name\".",
            placeholder: "name"
          }
        }
      },
      register_saml_provider: {
        label: "Register SAML Provider",
        params: {
          providerId: {
            label: "Provider ID",
            helpText: "Stable identifier, e.g. \"acme-saml\"."
          },
          issuer: {
            label: "IdP Entity ID",
            helpText: "The IdP’s SAML EntityID (issuer), e.g. https://saml.acme.com/entityid."
          },
          domain: {
            label: "Email Domain",
            helpText: "Users with this email domain are routed to this IdP, e.g. acme.com."
          },
          entryPoint: {
            label: "IdP SSO URL",
            helpText: "The IdP’s SAML single sign-on (redirect) endpoint that receives the SAMLRequest."
          },
          cert: {
            label: "IdP Signing Certificate",
            helpText: "The IdP’s X.509 signing certificate (PEM body). Used to verify assertion signatures."
          },
          identifierFormat: {
            label: "NameID Format",
            helpText: "Optional. Requested SAML NameID format. Defaults to the IdP’s configured format.",
            placeholder: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
          }
        }
      },
      request_domain_verification: {
        label: "Request Domain Verification",
        resultDialog: {
          title: "Verify your domain",
          description: "Add the DNS TXT record below at your domain’s DNS provider, then run “Verify Domain”. The token is shown once.",
          acknowledge: "Done",
          fields: {
            dnsRecordType: "Record type",
            dnsRecordName: "Name / Host",
            dnsRecordValue: "Value"
          }
        }
      },
      verify_domain: {
        label: "Verify Domain",
        successMessage: "Domain ownership verified"
      },
      delete_sso_provider: {
        label: "Delete SSO Provider",
        confirmText: "Delete this SSO provider? Users from its domain will no longer be able to sign in through it.",
        successMessage: "SSO provider deleted"
      }
    }
  },
  sys_scim_provider: {
    label: "SCIM Provider",
    pluralLabel: "SCIM Providers",
    description: "SCIM 2.0 connections (bearer tokens) external IdPs use to provision/deprovision this environment's users",
    fields: {
      id: {
        label: "ID"
      },
      provider_id: {
        label: "Provider ID",
        help: "Stable SCIM provider identifier (e.g. \"okta-scim\")"
      },
      scim_token: {
        label: "SCIM Token (hash)",
        help: "Hashed bearer credential for this SCIM connection — the plaintext is shown once at generate-token. Sensitive; do not expose."
      },
      organization_id: {
        label: "Organization",
        help: "Organization scope of this token (org-scoped tokens restrict provisioning to that org)"
      },
      user_id: {
        label: "Owned By",
        help: "User who generated this token (when provider-ownership is enabled)"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    },
    _views: {
      all: {
        label: "All"
      }
    }
  },
  sys_notification: {
    label: "Notification",
    pluralLabel: "Notifications",
    description: "Per-user notification inbox entries",
    fields: {
      id: {
        label: "Notification ID"
      },
      topic: {
        label: "Topic",
        help: "Notification topic, e.g. task.assigned, collab.mention"
      },
      payload: {
        label: "Payload",
        help: "Template inputs carried to channels (title/body/url/actor/source/…)"
      },
      severity: {
        label: "Severity",
        help: "Severity hint for rendering / filtering",
        options: {
          info: "info",
          warning: "warning",
          critical: "critical"
        }
      },
      dedup_key: {
        label: "Dedup Key",
        help: "Idempotency key within a topic window; a repeat emit is a no-op"
      },
      source_object: {
        label: "Source Object",
        help: "Object name of the related record (e.g. lead, opportunity)"
      },
      source_id: {
        label: "Source Record",
        help: "Record id within source_object"
      },
      actor_id: {
        label: "Actor",
        help: "User who caused the notification (mentioner, assigner)"
      },
      created_at: {
        label: "Created At"
      }
    },
    _views: {
      recent: {
        label: "Recent",
        emptyState: {
          title: "No events",
          message: "No notification events have been emitted."
        }
      },
      by_topic: {
        label: "By Topic"
      }
    }
  },
  sys_attachment: {
    label: "Attachment",
    pluralLabel: "Attachments",
    description: "Polymorphic link between a sys_file and any other record",
    fields: {
      id: {
        label: "Attachment ID"
      },
      parent_object: {
        label: "Parent Object",
        help: "Short object name of the attached-to record (e.g. account, lead)"
      },
      parent_id: {
        label: "Parent Record",
        help: "Primary key of the attached-to record"
      },
      file_id: {
        label: "File",
        help: "The sys_file storage entry being attached"
      },
      file_name: {
        label: "File Name",
        help: "Denormalised copy of sys_file.name for fast list rendering"
      },
      mime_type: {
        label: "MIME Type"
      },
      size: {
        label: "Size (bytes)"
      },
      uploaded_by: {
        label: "Uploaded By"
      },
      description: {
        label: "Description"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_email: {
    label: "Email",
    pluralLabel: "Emails",
    description: "Outbound email delivery log",
    fields: {
      id: {
        label: "Email ID"
      },
      message_id: {
        label: "Message-ID",
        help: "RFC-5322 Message-ID assigned by the transport"
      },
      from_address: {
        label: "From"
      },
      to_addresses: {
        label: "To",
        help: "Comma-separated recipient addresses"
      },
      cc_addresses: {
        label: "Cc"
      },
      bcc_addresses: {
        label: "Bcc"
      },
      reply_to: {
        label: "Reply-To"
      },
      subject: {
        label: "Subject"
      },
      body_text: {
        label: "Body (text)"
      },
      body_html: {
        label: "Body (HTML)"
      },
      status: {
        label: "Status",
        help: "Lifecycle state — queued by IEmailService.send before transport call",
        options: {
          queued: "queued",
          sent: "sent",
          failed: "failed"
        }
      },
      error: {
        label: "Error",
        help: "Transport error message when status=failed"
      },
      attempt_count: {
        label: "Attempts",
        help: "Number of delivery attempts performed by the service"
      },
      sent_at: {
        label: "Sent At",
        help: "Set when status transitions to \"sent\""
      },
      related_object: {
        label: "Related Object",
        help: "Object name of the related record (e.g. lead, opportunity)"
      },
      related_id: {
        label: "Related Record",
        help: "Record id within related_object"
      },
      sent_by: {
        label: "Sent By"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_email_template: {
    label: "Email Template",
    pluralLabel: "Email Templates",
    description: "Outbound email template (subject + body + variables) resolved by name+locale",
    fields: {
      id: {
        label: "ID"
      },
      name: {
        label: "Name",
        help: "Dotted snake_case identifier (e.g. auth.password_reset)"
      },
      label: {
        label: "Label",
        help: "Human-readable name shown in Studio"
      },
      category: {
        label: "Category",
        options: {
          auth: "auth",
          notification: "notification",
          workflow: "workflow",
          marketing: "marketing",
          custom: "custom"
        }
      },
      locale: {
        label: "Locale",
        help: "BCP-47 locale tag (en-US, zh-CN, …)"
      },
      description: {
        label: "Description"
      },
      subject: {
        label: "Subject",
        help: "Subject template; supports {{var.path}} placeholders"
      },
      body_html: {
        label: "HTML Body",
        help: "HTML body template; supports {{var.path}} placeholders"
      },
      body_text: {
        label: "Plain Text Body",
        help: "Optional plain-text alternative (auto-derived from HTML when blank)"
      },
      from_name: {
        label: "From Name"
      },
      from_address: {
        label: "From Address"
      },
      reply_to: {
        label: "Reply-To"
      },
      active: {
        label: "Active"
      },
      is_system: {
        label: "System Template",
        help: "Provided by a plugin / platform; tenants may edit but should not delete"
      },
      variables_json: {
        label: "Variables (JSON)",
        help: "JSON array of {name,type,required,description}"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_saved_report: {
    label: "Saved Report",
    pluralLabel: "Saved Reports",
    description: "Persisted ObjectQL report definition — re-runnable and schedulable",
    fields: {
      id: {
        label: "Report ID"
      },
      name: {
        label: "Name"
      },
      description: {
        label: "Description"
      },
      object_name: {
        label: "Object",
        help: "Short object name the report queries"
      },
      query_json: {
        label: "Query",
        help: "ObjectQL query envelope — { filter, fields, orderBy, limit, groupBy }"
      },
      format: {
        label: "Format",
        help: "Rendering used by IReportService.run() and email digests",
        options: {
          csv: "csv",
          json: "json",
          html_table: "html_table"
        }
      },
      owner_id: {
        label: "Owner",
        help: "User that owns the report definition (drives sharing)"
      },
      last_run_at: {
        label: "Last Run",
        help: "Stamped by IReportService.run() on successful execution"
      },
      last_row_count: {
        label: "Last Row Count"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_report_schedule: {
    label: "Report Schedule",
    pluralLabel: "Report Schedules",
    description: "Recurring delivery of a sys_saved_report via email",
    fields: {
      id: {
        label: "Schedule ID"
      },
      report_id: {
        label: "Report"
      },
      name: {
        label: "Name",
        help: "Optional label for the digest — used in the email subject"
      },
      interval_minutes: {
        label: "Interval (minutes)",
        help: "How often to send (1440 = daily, 10080 = weekly)"
      },
      cron_expression: {
        label: "Cron Expression",
        help: "Optional 5/6-field cron — overrides interval_minutes when present"
      },
      timezone: {
        label: "Timezone"
      },
      active: {
        label: "Active"
      },
      recipients: {
        label: "Recipients",
        help: "Comma-separated email addresses"
      },
      format: {
        label: "Format",
        help: "Render format — csv is attached, html_table is inlined",
        options: {
          csv: "csv",
          html_table: "html_table"
        }
      },
      subject_template: {
        label: "Subject Template",
        help: "Email subject; {{name}} / {{date}} / {{rows}} are substituted"
      },
      owner_id: {
        label: "Owner"
      },
      next_run_at: {
        label: "Next Run",
        help: "Dispatcher loads schedules where next_run_at <= now"
      },
      last_sent_at: {
        label: "Last Sent"
      },
      last_status: {
        label: "Last Status",
        options: {
          ok: "ok",
          failed: "failed",
          skipped: "skipped"
        }
      },
      last_error: {
        label: "Last Error"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_job: {
    label: "Background Job",
    pluralLabel: "Background Jobs",
    description: "Catalogue of registered background jobs",
    fields: {
      id: {
        label: "Job ID"
      },
      name: {
        label: "Job Name",
        help: "Unique job identifier (snake_case)"
      },
      schedule_type: {
        label: "Schedule Type",
        options: {
          cron: "cron",
          interval: "interval",
          once: "once"
        }
      },
      schedule_expression: {
        label: "Expression",
        help: "Cron expression / interval ms / ISO datetime"
      },
      timezone: {
        label: "Timezone"
      },
      active: {
        label: "Active",
        help: "Whether the scheduler is currently running this job"
      },
      last_run_at: {
        label: "Last Run At"
      },
      last_status: {
        label: "Last Status",
        options: {
          success: "success",
          failed: "failed",
          timeout: "timeout",
          running: "running"
        }
      },
      last_error: {
        label: "Last Error"
      },
      run_count: {
        label: "Run Count"
      },
      failure_count: {
        label: "Failure Count"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_job_run: {
    label: "Job Run",
    pluralLabel: "Job Runs",
    description: "Background job execution audit trail",
    fields: {
      id: {
        label: "Run ID"
      },
      job_name: {
        label: "Job"
      },
      status: {
        label: "Status",
        options: {
          running: "running",
          success: "success",
          failed: "failed",
          timeout: "timeout"
        }
      },
      started_at: {
        label: "Started At"
      },
      completed_at: {
        label: "Completed At"
      },
      duration_ms: {
        label: "Duration (ms)"
      },
      attempt: {
        label: "Attempt",
        help: "1 for first run, >1 for retries/replays"
      },
      trigger: {
        label: "Trigger",
        options: {
          schedule: "schedule",
          manual: "manual",
          replay: "replay"
        }
      },
      error: {
        label: "Error"
      },
      created_at: {
        label: "Created At"
      }
    }
  },
  sys_job_queue: {
    label: "Job Queue Message",
    pluralLabel: "Job Queue Messages",
    description: "Durable job/message queue including dead letters",
    fields: {
      id: {
        label: "Message ID"
      },
      queue: {
        label: "Queue",
        help: "Logical queue name (snake_case)"
      },
      idempotency_key: {
        label: "Idempotency Key",
        help: "Deduplication key within (queue, window)"
      },
      payload_json: {
        label: "Payload (JSON)",
        help: "Serialized message body"
      },
      metadata_json: {
        label: "Metadata (JSON)",
        help: "Serialized metadata bag (tenant_id, source_record, ...)"
      },
      status: {
        label: "Status",
        help: "Lifecycle state",
        options: {
          pending: "pending",
          running: "running",
          completed: "completed",
          failed: "failed",
          dlq: "dlq"
        }
      },
      priority: {
        label: "Priority",
        help: "Lower = higher priority"
      },
      attempts: {
        label: "Attempts"
      },
      max_attempts: {
        label: "Max Attempts"
      },
      backoff_type: {
        label: "Backoff",
        options: {
          fixed: "fixed",
          exponential: "exponential"
        }
      },
      backoff_delay_ms: {
        label: "Backoff Base (ms)"
      },
      backoff_max_delay_ms: {
        label: "Backoff Cap (ms)"
      },
      scheduled_for: {
        label: "Scheduled For",
        help: "Earliest time a worker may lease this message"
      },
      locked_by: {
        label: "Locked By",
        help: "Worker id holding the lease"
      },
      locked_until: {
        label: "Locked Until",
        help: "Lease expiry; if past, another worker may claim"
      },
      last_error: {
        label: "Last Error"
      },
      completed_at: {
        label: "Completed At"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_import_job: {
    label: "Import Job",
    pluralLabel: "Import Jobs",
    description: "Asynchronous bulk-import job state, progress, and history",
    fields: {
      id: {
        label: "Job ID"
      },
      object_name: {
        label: "Object",
        help: "API name of the object being imported into"
      },
      status: {
        label: "Status",
        options: {
          pending: "pending",
          running: "running",
          succeeded: "succeeded",
          failed: "failed",
          cancelled: "cancelled"
        }
      },
      total_rows: {
        label: "Total Rows"
      },
      processed_rows: {
        label: "Processed Rows"
      },
      created_count: {
        label: "Created"
      },
      updated_count: {
        label: "Updated"
      },
      skipped_count: {
        label: "Skipped"
      },
      error_count: {
        label: "Errors"
      },
      write_mode: {
        label: "Write Mode",
        options: {
          insert: "insert",
          update: "update",
          upsert: "upsert"
        }
      },
      dry_run: {
        label: "Dry Run"
      },
      run_automations: {
        label: "Run Automations"
      },
      treat_as_historical: {
        label: "Treat As Historical"
      },
      error: {
        label: "Fatal Error"
      },
      results: {
        label: "Row Results (sample)",
        help: "Capped sample of per-row results (failures first) for the UI"
      },
      undo_log: {
        label: "Undo Log",
        help: "Reversal instructions ({created:[ids], updated:[{id,before}]}) captured for small non-dry-run jobs so the import can be undone"
      },
      reverted_at: {
        label: "Reverted At",
        help: "Set when the import was undone (created records deleted, updated records restored)"
      },
      started_at: {
        label: "Started At"
      },
      completed_at: {
        label: "Completed At"
      },
      created_by: {
        label: "Created By"
      },
      created_at: {
        label: "Created At"
      }
    }
  },
  sys_metadata: {
    label: "System Metadata",
    pluralLabel: "System Metadata",
    description: "Stores platform and user-scope metadata records (objects, views, flows, etc.)",
    fields: {
      id: {
        label: "ID"
      },
      name: {
        label: "Name"
      },
      type: {
        label: "Metadata Type"
      },
      namespace: {
        label: "Namespace"
      },
      package_id: {
        label: "Package ID",
        help: "Legacy package manifest ID string. Use package_version_id for new records."
      },
      package_version_id: {
        label: "Package Version",
        help: "Foreign key to sys_package_version (UUID). Null = platform-built-in or env-level override."
      },
      managed_by: {
        label: "Managed By",
        options: {
          package: "package",
          platform: "platform",
          user: "user"
        }
      },
      scope: {
        label: "Scope",
        options: {
          system: "system",
          platform: "platform",
          user: "user"
        }
      },
      metadata: {
        label: "Metadata",
        help: "JSON-serialized metadata payload"
      },
      extends: {
        label: "Extends"
      },
      strategy: {
        label: "Strategy",
        options: {
          merge: "merge",
          replace: "replace"
        }
      },
      owner: {
        label: "Owner"
      },
      state: {
        label: "State",
        options: {
          draft: "draft",
          active: "active",
          archived: "archived",
          deprecated: "deprecated"
        }
      },
      organization_id: {
        label: "Organization",
        help: "Organization for multi-tenant isolation."
      },
      environment_id: {
        label: "Project (deprecated)",
        help: "DEPRECATED. Use organization_id for tenant isolation."
      },
      version: {
        label: "Version"
      },
      checksum: {
        label: "Checksum"
      },
      source: {
        label: "Source",
        options: {
          filesystem: "filesystem",
          database: "database",
          api: "api",
          migration: "migration"
        }
      },
      tags: {
        label: "Tags",
        help: "JSON-serialized array of classification tags"
      },
      created_by: {
        label: "Created By"
      },
      created_at: {
        label: "Created At"
      },
      updated_by: {
        label: "Updated By"
      },
      updated_at: {
        label: "Updated At"
      }
    },
    _views: {
      only_objects: {
        label: "Objects"
      },
      only_fields: {
        label: "Fields"
      },
      all_metadata: {
        label: "All"
      }
    }
  },
  sys_metadata_history: {
    label: "Metadata History",
    pluralLabel: "Metadata History",
    description: "Version history and audit trail for metadata changes",
    fields: {
      id: {
        label: "ID"
      },
      event_seq: {
        label: "Event Seq",
        help: "Per-organization monotonic event log cursor."
      },
      name: {
        label: "Name"
      },
      type: {
        label: "Metadata Type"
      },
      version: {
        label: "Version"
      },
      operation_type: {
        label: "Operation Type",
        options: {
          create: "create",
          update: "update",
          publish: "publish",
          revert: "revert",
          delete: "delete"
        }
      },
      metadata: {
        label: "Metadata",
        help: "JSON-serialized metadata snapshot at this version"
      },
      checksum: {
        label: "Checksum"
      },
      previous_checksum: {
        label: "Previous Checksum"
      },
      change_note: {
        label: "Change Note",
        help: "Description of what changed in this version"
      },
      source: {
        label: "Source"
      },
      organization_id: {
        label: "Organization",
        help: "Organization for multi-tenant isolation."
      },
      recorded_by: {
        label: "Recorded By"
      },
      recorded_at: {
        label: "Recorded At"
      }
    }
  },
  sys_view_definition: {
    label: "View Definition",
    pluralLabel: "View Definitions",
    description: "Runtime-authored view definitions (shared / personal layers). The package layer ships from source.",
    fields: {
      id: {
        label: "ID"
      },
      name: {
        label: "Name"
      },
      object: {
        label: "Object"
      },
      view_kind: {
        label: "View Kind",
        options: {
          list: "list",
          form: "form"
        }
      },
      label: {
        label: "Label"
      },
      is_default: {
        label: "Is Default"
      },
      view_order: {
        label: "Order"
      },
      scope: {
        label: "Scope",
        options: {
          shared: "shared",
          personal: "personal"
        }
      },
      owner: {
        label: "Owner"
      },
      hidden: {
        label: "Hidden"
      },
      config: {
        label: "Config",
        help: "ListView or FormView configuration (matches spec ViewItem.config)."
      },
      organization_id: {
        label: "Organization",
        help: "Organization for multi-tenant isolation."
      },
      state: {
        label: "State",
        options: {
          draft: "draft",
          active: "active",
          archived: "archived"
        }
      },
      created_by: {
        label: "Created By"
      },
      created_at: {
        label: "Created At"
      },
      updated_by: {
        label: "Updated By"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_metadata_audit: {
    label: "Metadata Audit",
    pluralLabel: "Metadata Audit",
    description: "Append-only audit trail of metadata write decisions (ADR-0010).",
    fields: {
      id: {
        label: "ID"
      },
      occurred_at: {
        label: "Occurred At"
      },
      actor: {
        label: "Actor",
        help: "Acting principal — user id, system id, or \"system\"."
      },
      source: {
        label: "Source"
      },
      type: {
        label: "Metadata Type"
      },
      name: {
        label: "Name"
      },
      organization_id: {
        label: "Organization"
      },
      operation: {
        label: "Operation",
        options: {
          save: "save",
          publish: "publish",
          rollback: "rollback",
          delete: "delete",
          reset: "reset"
        }
      },
      outcome: {
        label: "Outcome",
        options: {
          allowed: "allowed",
          denied: "denied",
          forced: "forced"
        }
      },
      code: {
        label: "Code"
      },
      lock_state: {
        label: "Lock State",
        options: {
          none: "none",
          nooverlay: "no-overlay",
          nodelete: "no-delete",
          full: "full"
        }
      },
      lock_overridden: {
        label: "Lock Overridden"
      },
      request_id: {
        label: "Request ID"
      },
      note: {
        label: "Note"
      }
    }
  },
  sys_setting: {
    label: "Setting",
    pluralLabel: "Settings",
    description: "Generic K/V store backing the SettingsManifest contract.",
    fields: {
      id: {
        label: "Setting ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      },
      namespace: {
        label: "Namespace",
        help: "Manifest namespace (e.g. mail, branding, feature_flags)."
      },
      key: {
        label: "Key",
        help: "Specifier key inside the namespace (snake_case)."
      },
      scope: {
        label: "Scope",
        help: "Which layer of the config-resolution hierarchy this row belongs to.",
        options: {
          global: "Global",
          tenant: "Tenant",
          user: "User",
          runtime: "Runtime"
        }
      },
      user_id: {
        label: "User",
        help: "Owning user when scope=user; null otherwise."
      },
      value: {
        label: "Value",
        help: "JSON-encoded value. Null when encrypted=true (see value_enc)."
      },
      encrypted: {
        label: "Encrypted",
        help: "When true, the value is stored encrypted-at-rest in value_enc; value column is null."
      },
      locked: {
        label: "Locked",
        help: "When true, lower-scope rows cannot override this value; writes against lower scopes return 409. Used by platform administrators to pin a global value for all tenants (Phase 2 cascade)."
      },
      locked_reason: {
        label: "Lock Reason",
        help: "Human-readable explanation surfaced in the UI tooltip when locked=true."
      },
      value_enc: {
        label: "Encrypted Value",
        help: "Ciphertext payload (KMS-wrapped). Set only when encrypted=true."
      },
      updated_by: {
        label: "Updated By",
        help: "Last actor who wrote this row via SettingsService.set()."
      }
    },
    _views: {
      by_namespace: {
        label: "By Namespace"
      },
      tenant_only: {
        label: "Tenant"
      },
      user_only: {
        label: "User"
      },
      all_settings: {
        label: "All"
      }
    }
  },
  sys_secret: {
    label: "Secret",
    pluralLabel: "Secrets",
    description: "Cipher store referenced by sys_setting handles. Never holds plaintext.",
    fields: {
      id: {
        label: "ID",
        help: "Opaque handle referenced by `sys_setting.value_enc`."
      },
      created_at: {
        label: "Created At",
        help: "When the cipher was first written."
      },
      rotated_at: {
        label: "Rotated At",
        help: "When the cipher was last re-wrapped under a new KMS key."
      },
      namespace: {
        label: "Namespace",
        help: "Settings namespace this secret belongs to."
      },
      key: {
        label: "Key",
        help: "Specifier key within the namespace."
      },
      kms_key_id: {
        label: "KMS Key ID",
        help: "External KMS handle (ARN, GCP resource id, or `local`)."
      },
      alg: {
        label: "Algorithm",
        help: "Cipher/AEAD algorithm tag."
      },
      version: {
        label: "Version",
        help: "Bumps each time rotateKey() re-wraps this row."
      },
      ciphertext: {
        label: "Ciphertext",
        help: "Provider-encoded ciphertext blob (base64 / JSON). Implementation-defined; only the matching ICryptoProvider can read it."
      }
    },
    _views: {
      all: {
        label: "All Secrets"
      }
    }
  },
  sys_setting_audit: {
    label: "Setting Audit Entry",
    pluralLabel: "Setting Audit",
    description: "Append-only audit trail for SettingsService mutations.",
    fields: {
      id: {
        label: "ID"
      },
      created_at: {
        label: "Created At",
        help: "When the mutation was recorded."
      },
      namespace: {
        label: "Namespace"
      },
      key: {
        label: "Key"
      },
      scope: {
        label: "Scope",
        help: "Cascade layer the row was written to.",
        options: {
          global: "Global",
          tenant: "Tenant",
          user: "User"
        }
      },
      action: {
        label: "Action",
        help: "Mutation kind.",
        options: {
          set: "Set",
          reset: "Reset",
          lock: "Lock",
          unlock: "Unlock",
          rotate: "Rotate"
        }
      },
      actor_id: {
        label: "Actor",
        help: "User who performed the mutation; null for system jobs."
      },
      source: {
        label: "Source",
        help: "Mutation entry-point.",
        options: {
          ui: "UI",
          api: "API",
          migration: "Migration",
          import: "Import",
          system: "System"
        }
      },
      reason: {
        label: "Reason",
        help: "Free-text justification provided by the actor (optional)."
      },
      old_hash: {
        label: "Old Hash",
        help: "SHA-256 of the previous value (canonicalised). Null when previously unset."
      },
      new_hash: {
        label: "New Hash",
        help: "SHA-256 of the new value (canonicalised). Null on reset."
      },
      encrypted: {
        label: "Encrypted",
        help: "True when the field carries secret material (rotation is interesting)."
      },
      request_id: {
        label: "Request ID",
        help: "Correlates with sys_audit_log / tracing."
      }
    },
    _views: {
      recent: {
        label: "Recent"
      }
    }
  }
};