// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.

/**
 * Auto-generated by 'os i18n extract' for locale 'en'.
 * Edit translations in place; re-run extract (with --merge) to fill new gaps.
 * Do not hand-edit the structure — only the leaf string values.
 */

import type { TranslationData } from '@objectstack/spec/system';

export const enObjects: NonNullable<TranslationData['objects']> = {
  sys_user: {
    label: "User",
    pluralLabel: "Users",
    description: "User accounts for authentication",
    fields: {
      name: {
        label: "Name"
      },
      email: {
        label: "Email"
      },
      email_verified: {
        label: "Email Verified"
      },
      two_factor_enabled: {
        label: "Two-Factor Enabled",
        help: "Whether two-factor authentication is enabled for this user. Maintained by the better-auth `twoFactor` plugin."
      },
      role: {
        label: "Platform Role",
        help: "Platform-level role (admin, user, …). Set via the Set Platform Role action."
      },
      banned: {
        label: "Banned",
        help: "When true, the user cannot sign in. Toggle via Ban User / Unban User actions."
      },
      ban_reason: {
        label: "Ban Reason"
      },
      ban_expires: {
        label: "Ban Expires",
        help: "When set, the ban auto-clears at this time."
      },
      image: {
        label: "Profile Image"
      },
      id: {
        label: "User ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    },
    _views: {
      me: {
        label: "My Profile"
      },
      all_users: {
        label: "All Users"
      },
      unverified: {
        label: "Unverified"
      },
      two_factor: {
        label: "2FA Enabled"
      },
      banned: {
        label: "Banned"
      }
    },
    _actions: {
      invite_user: {
        label: "Invite User",
        successMessage: "Invitation sent"
      },
      ban_user: {
        label: "Ban User",
        confirmText: "Ban this user? They will be signed out and unable to sign in until unbanned.",
        successMessage: "User banned"
      },
      unban_user: {
        label: "Unban User",
        successMessage: "User unbanned"
      },
      set_user_password: {
        label: "Set Password",
        successMessage: "Password updated"
      },
      set_user_role: {
        label: "Set Platform Role",
        successMessage: "Role updated"
      },
      impersonate_user: {
        label: "Impersonate User",
        confirmText: "Start an impersonation session for this user? Use only for legitimate support cases — actions will be logged.",
        successMessage: "Now impersonating user"
      },
      update_my_profile: {
        label: "Update Profile",
        successMessage: "Profile updated"
      },
      change_my_password: {
        label: "Change Password",
        successMessage: "Password changed"
      },
      change_my_email: {
        label: "Change Email",
        successMessage: "Verification email sent — check the new address to confirm."
      },
      resend_verification_email: {
        label: "Resend Verification Email",
        successMessage: "Verification email sent — check your inbox."
      },
      delete_my_account: {
        label: "Delete My Account",
        confirmText: "Permanently delete your account? This cannot be undone — all your sessions will be terminated and all data you own will be removed per the configured retention policy.",
        successMessage: "Account deleted"
      },
      enable_two_factor: {
        label: "Enable Two-Factor Auth",
        successMessage: "Two-factor authentication enabled. Scan the QR code or paste the otpauth URI into your authenticator app, then verify a code to complete setup."
      },
      disable_two_factor: {
        label: "Disable Two-Factor Auth",
        confirmText: "Turn off two-factor authentication? Your account will be less secure.",
        successMessage: "Two-factor authentication disabled."
      },
      generate_backup_codes: {
        label: "Regenerate Backup Codes",
        confirmText: "Generate a new set of backup codes? Any previously generated codes will stop working.",
        successMessage: "New backup codes generated — save them somewhere safe."
      }
    }
  },
  sys_session: {
    label: "Session",
    pluralLabel: "Sessions",
    description: "Active user sessions",
    fields: {
      user_id: {
        label: "User"
      },
      expires_at: {
        label: "Expires At"
      },
      active_organization_id: {
        label: "Active Organization"
      },
      active_team_id: {
        label: "Active Team"
      },
      ip_address: {
        label: "IP Address"
      },
      user_agent: {
        label: "User Agent"
      },
      impersonated_by: {
        label: "Impersonated By",
        help: "User id of the admin that started this impersonation session, if any."
      },
      token: {
        label: "Session Token",
        help: "Opaque session token — never exposed in UI"
      },
      id: {
        label: "Session ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    },
    _views: {
      mine: {
        label: "My Sessions"
      },
      all_sessions: {
        label: "All"
      }
    },
    _actions: {
      revoke_my_other_sessions: {
        label: "Sign out other devices",
        confirmText: "Sign out of every other device where you're currently logged in? Your current session will remain active.",
        successMessage: "All other sessions revoked"
      },
      revoke_session: {
        label: "Revoke Session",
        confirmText: "Revoke this session? The user will be signed out from that device.",
        successMessage: "Session revoked"
      }
    }
  },
  sys_account: {
    label: "Account",
    pluralLabel: "Accounts",
    description: "OAuth and authentication provider accounts",
    fields: {
      id: {
        label: "Account ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      },
      provider_id: {
        label: "Provider ID",
        help: "OAuth provider identifier (google, github, etc.)"
      },
      account_id: {
        label: "Provider Account ID",
        help: "User's ID in the provider's system"
      },
      user_id: {
        label: "User",
        help: "Link to user table"
      },
      access_token: {
        label: "Access Token"
      },
      refresh_token: {
        label: "Refresh Token"
      },
      id_token: {
        label: "ID Token"
      },
      access_token_expires_at: {
        label: "Access Token Expires At"
      },
      refresh_token_expires_at: {
        label: "Refresh Token Expires At"
      },
      scope: {
        label: "OAuth Scope"
      },
      password: {
        label: "Password Hash",
        help: "Hashed password for email/password provider"
      }
    },
    _views: {
      mine: {
        label: "My Links"
      },
      by_provider: {
        label: "By Provider"
      },
      all_links: {
        label: "All"
      }
    },
    _actions: {
      link_social: {
        label: "Link Social Account"
      },
      unlink_account: {
        label: "Unlink Account",
        confirmText: "Unlink this identity link? The user will no longer be able to sign in with this provider until they re-link it from their account settings.",
        successMessage: "Identity link removed"
      }
    }
  },
  sys_verification: {
    label: "Verification",
    pluralLabel: "Verifications",
    description: "Email and phone verification tokens",
    fields: {
      id: {
        label: "Verification ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      },
      value: {
        label: "Verification Token",
        help: "Token or code for verification"
      },
      expires_at: {
        label: "Expires At"
      },
      identifier: {
        label: "Identifier",
        help: "Email address or phone number"
      }
    }
  },
  sys_organization: {
    label: "Organization",
    pluralLabel: "Organizations",
    description: "Organizations for multi-tenant grouping",
    fields: {
      name: {
        label: "Name"
      },
      slug: {
        label: "Slug",
        help: "URL-friendly identifier"
      },
      logo: {
        label: "Logo"
      },
      metadata: {
        label: "Metadata",
        help: "JSON-serialized organization metadata"
      },
      id: {
        label: "Organization ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    },
    _views: {
      all_orgs: {
        label: "All"
      }
    },
    _actions: {
      create_organization: {
        label: "Create Organization",
        successMessage: "Organization created"
      },
      update_organization: {
        label: "Edit Organization",
        successMessage: "Organization updated"
      },
      delete_organization: {
        label: "Delete Organization",
        confirmText: "Delete this organization? All members will lose access immediately. This cannot be undone.",
        successMessage: "Organization deleted"
      },
      set_active_organization: {
        label: "Set Active",
        successMessage: "Active organization switched"
      },
      leave_organization: {
        label: "Leave Organization",
        confirmText: "Leave this organization? You will lose access to all of its resources.",
        successMessage: "You have left the organization"
      },
      change_slug: {
        label: "Change Slug",
        confirmText: "Renaming the slug rewrites every platform subdomain for this org and parks the old slug for 90 days. Continue?",
        successMessage: "Organization slug changed"
      }
    }
  },
  sys_member: {
    label: "Member",
    pluralLabel: "Members",
    description: "Organization membership records",
    fields: {
      id: {
        label: "Member ID"
      },
      created_at: {
        label: "Created At"
      },
      organization_id: {
        label: "Organization"
      },
      user_id: {
        label: "User"
      },
      role: {
        label: "Role",
        help: "Member role within the organization",
        options: {
          owner: "Owner",
          admin: "Admin",
          member: "Member"
        }
      }
    },
    _views: {
      mine: {
        label: "My Memberships"
      }
    },
    _actions: {
      add_member: {
        label: "Add Member",
        successMessage: "Member added"
      },
      update_member_role: {
        label: "Change Role",
        successMessage: "Member role updated"
      },
      remove_member: {
        label: "Remove Member",
        confirmText: "Remove this member from the organization? They will lose access to all org resources.",
        successMessage: "Member removed"
      },
      transfer_ownership: {
        label: "Transfer Ownership",
        confirmText: "Transfer ownership of this organization to the selected member? You will be demoted to admin and lose owner-only privileges.",
        successMessage: "Ownership transferred"
      }
    }
  },
  sys_invitation: {
    label: "Invitation",
    pluralLabel: "Invitations",
    description: "Organization invitations for user onboarding",
    fields: {
      id: {
        label: "Invitation ID"
      },
      created_at: {
        label: "Created At"
      },
      organization_id: {
        label: "Organization"
      },
      email: {
        label: "Email",
        help: "Email address of the invited user"
      },
      role: {
        label: "Role",
        help: "Role to assign upon acceptance",
        options: {
          owner: "Owner",
          admin: "Admin",
          member: "Member"
        }
      },
      status: {
        label: "Status",
        options: {
          pending: "pending",
          accepted: "accepted",
          rejected: "rejected",
          expired: "expired",
          canceled: "canceled"
        }
      },
      inviter_id: {
        label: "Inviter",
        help: "User who sent the invitation"
      },
      expires_at: {
        label: "Expires At"
      },
      team_id: {
        label: "Team",
        help: "Optional team to assign upon acceptance"
      }
    },
    _views: {
      pending: {
        label: "Pending"
      },
      accepted: {
        label: "Accepted"
      },
      expired: {
        label: "Expired / Canceled"
      },
      all_invitations: {
        label: "All"
      }
    },
    _actions: {
      invite_user: {
        label: "Invite User",
        successMessage: "Invitation sent"
      },
      cancel_invitation: {
        label: "Cancel Invitation",
        confirmText: "Cancel this invitation? The recipient will no longer be able to accept it.",
        successMessage: "Invitation canceled"
      },
      resend_invitation: {
        label: "Resend Invitation",
        successMessage: "Invitation resent"
      },
      accept_invitation: {
        label: "Accept Invitation",
        successMessage: "Invitation accepted"
      },
      reject_invitation: {
        label: "Decline Invitation",
        confirmText: "Decline this invitation? The inviter will be notified and you will need a new invitation to join.",
        successMessage: "Invitation declined"
      }
    }
  },
  sys_team: {
    label: "Team",
    pluralLabel: "Teams",
    description: "Teams within organizations for fine-grained grouping",
    fields: {
      name: {
        label: "Name"
      },
      organization_id: {
        label: "Organization",
        help: "Parent organization for this team"
      },
      id: {
        label: "Team ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    },
    _views: {
      by_org: {
        label: "By Organization"
      },
      all_teams: {
        label: "All"
      }
    },
    _actions: {
      create_team: {
        label: "Create Team",
        successMessage: "Team created"
      },
      update_team: {
        label: "Edit Team",
        successMessage: "Team updated"
      },
      remove_team: {
        label: "Delete Team",
        confirmText: "Delete this team? Members will lose any team-scoped access. This cannot be undone.",
        successMessage: "Team deleted"
      }
    }
  },
  sys_team_member: {
    label: "Team Member",
    pluralLabel: "Team Members",
    description: "Team membership records linking users to teams",
    fields: {
      id: {
        label: "Team Member ID"
      },
      created_at: {
        label: "Created At"
      },
      team_id: {
        label: "Team"
      },
      user_id: {
        label: "User"
      }
    },
    _actions: {
      add_team_member: {
        label: "Add Member",
        successMessage: "Team member added"
      },
      remove_team_member: {
        label: "Remove from Team",
        confirmText: "Remove this user from the team? They will lose any team-scoped access.",
        successMessage: "Team member removed"
      }
    }
  },
  sys_department: {
    label: "Department",
    pluralLabel: "Departments",
    description: "Hierarchical org-skeleton node (department / division / business unit / office).",
    fields: {
      name: {
        label: "Name"
      },
      code: {
        label: "Code",
        help: "Short stable code (e.g. EMEA-SALES). Unique within tenant."
      },
      kind: {
        label: "Kind",
        help: "Categorisation hint — does not change graph semantics.",
        options: {
          company: "company",
          division: "division",
          department: "department",
          team: "team",
          office: "office",
          cost_center: "cost_center"
        }
      },
      parent_department_id: {
        label: "Parent Department",
        help: "Self-reference for the org tree. Null = root of tenant."
      },
      organization_id: {
        label: "Organization",
        help: "Tenant scope."
      },
      manager_user_id: {
        label: "Department Head",
        help: "User responsible for this org unit (department head / lead)."
      },
      active: {
        label: "Active",
        help: "When false, members are not expanded by graph queries."
      },
      effective_from: {
        label: "Effective From",
        help: "When this department came into existence (HRIS sync)."
      },
      effective_to: {
        label: "Effective To",
        help: "When this department was retired (HRIS sync)."
      },
      external_ref: {
        label: "External Reference",
        help: "ID in upstream HRIS (Workday / SAP HR / 北森)."
      },
      id: {
        label: "Department ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    },
    _views: {
      active: {
        label: "Active"
      },
      inactive: {
        label: "Inactive"
      },
      by_kind: {
        label: "By Kind"
      },
      all_departments: {
        label: "All"
      }
    }
  },
  sys_department_member: {
    label: "Department Member",
    pluralLabel: "Department Members",
    description: "User assignment to a department (matrix-org friendly, effective-dated).",
    fields: {
      id: {
        label: "Member ID"
      },
      department_id: {
        label: "Department"
      },
      user_id: {
        label: "User"
      },
      role_in_department: {
        label: "Role in Department",
        help: "`lead` is the day-to-day head; `deputy` may stand in for the lead in approval routing.",
        options: {
          member: "member",
          lead: "lead",
          deputy: "deputy"
        }
      },
      is_primary: {
        label: "Primary Assignment",
        help: "When the user is in multiple departments, this marks the canonical one for reporting."
      },
      effective_from: {
        label: "Effective From"
      },
      effective_to: {
        label: "Effective To"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_api_key: {
    label: "API Key",
    pluralLabel: "API Keys",
    description: "API keys for programmatic access",
    fields: {
      name: {
        label: "Name",
        help: "Human-readable label for the API key"
      },
      prefix: {
        label: "Prefix",
        help: "Visible prefix for identifying the key (e.g., \"osk_\")"
      },
      user_id: {
        label: "Owner",
        help: "User who owns this API key"
      },
      scopes: {
        label: "Scopes",
        help: "JSON array of permission scopes"
      },
      expires_at: {
        label: "Expires At"
      },
      last_used_at: {
        label: "Last Used At",
        help: "Automatically updated on each API call"
      },
      revoked: {
        label: "Revoked"
      },
      key: {
        label: "Hashed Key",
        help: "Hashed API key value — never exposed to clients"
      },
      id: {
        label: "API Key ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    },
    _views: {
      mine: {
        label: "My Keys"
      },
      active: {
        label: "Active"
      },
      revoked: {
        label: "Revoked"
      },
      all_keys: {
        label: "All"
      }
    },
    _actions: {
      revoke_api_key: {
        label: "Revoke API Key",
        confirmText: "Revoke this API key? Any clients using it will immediately lose access.",
        successMessage: "API key revoked"
      },
      restore_api_key: {
        label: "Restore API Key",
        confirmText: "Restore this revoked API key? Existing clients holding the key will regain access.",
        successMessage: "API key restored"
      }
    }
  },
  sys_two_factor: {
    label: "Two Factor",
    pluralLabel: "Two Factor Credentials",
    description: "Two-factor authentication credentials",
    fields: {
      id: {
        label: "Two Factor ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      },
      user_id: {
        label: "User"
      },
      secret: {
        label: "Secret",
        help: "TOTP secret key"
      },
      backup_codes: {
        label: "Backup Codes",
        help: "JSON-serialized backup recovery codes"
      },
      verified: {
        label: "Verified",
        help: "Whether the enrollment was confirmed with a valid TOTP code (managed by better-auth)"
      }
    },
    _views: {
      mine: {
        label: "My Enrollment"
      },
      all_enrollments: {
        label: "All"
      }
    },
    _actions: {
      enable_two_factor: {
        label: "Enable 2FA"
      },
      disable_two_factor: {
        label: "Disable 2FA",
        confirmText: "Disable two-factor authentication on your account?",
        successMessage: "2FA disabled"
      },
      regenerate_backup_codes: {
        label: "Regenerate Backup Codes",
        confirmText: "Regenerate backup codes? All previous backup codes will stop working immediately."
      }
    }
  },
  sys_device_code: {
    label: "Device Code",
    pluralLabel: "Device Codes",
    description: "OAuth 2.0 Device Authorization Grant (RFC 8628) pending requests",
    fields: {
      id: {
        label: "Device Code ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      },
      device_code: {
        label: "Device Code",
        help: "High-entropy token returned to the polling device"
      },
      user_code: {
        label: "User Code",
        help: "Short user-facing code (e.g. ABCD-EFGH)"
      },
      user_id: {
        label: "User",
        help: "User who approved the device authorization"
      },
      expires_at: {
        label: "Expires At",
        help: "When the device & user codes are no longer valid"
      },
      status: {
        label: "Status",
        help: "Current status: 'pending' | 'approved' | 'denied'"
      },
      last_polled_at: {
        label: "Last Polled At",
        help: "Timestamp of the most recent /device/token poll"
      },
      polling_interval: {
        label: "Polling Interval (ms)",
        help: "Server-recommended minimum polling interval, in ms"
      },
      client_id: {
        label: "Client ID",
        help: "OAuth client identifier of the requesting device"
      },
      scope: {
        label: "Scope",
        help: "Space-separated OAuth scopes requested by the device"
      }
    }
  },
  sys_user_preference: {
    label: "User Preference",
    pluralLabel: "User Preferences",
    description: "Per-user key-value preferences (theme, locale, etc.)",
    fields: {
      id: {
        label: "Preference ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      },
      user_id: {
        label: "User",
        help: "Owner user of this preference"
      },
      key: {
        label: "Key",
        help: "Preference key (e.g., theme, locale, plugin.ai.auto_save)"
      },
      value: {
        label: "Value",
        help: "Preference value (any JSON-serializable type)"
      }
    },
    _views: {
      mine: {
        label: "My Preferences"
      },
      by_user: {
        label: "By User"
      },
      all_preferences: {
        label: "All"
      }
    }
  },
  sys_oauth_application: {
    label: "OAuth Application",
    pluralLabel: "OAuth Applications",
    description: "Registered OAuth/OIDC client applications",
    fields: {
      id: {
        label: "ID"
      },
      name: {
        label: "Name"
      },
      icon: {
        label: "Icon",
        help: "Logo URL shown on the consent screen"
      },
      uri: {
        label: "Home URI",
        help: "Public homepage of the registered client"
      },
      contacts: {
        label: "Contacts",
        help: "JSON-serialized list of contact email addresses"
      },
      tos: {
        label: "Terms of Service"
      },
      policy: {
        label: "Privacy Policy"
      },
      metadata: {
        label: "Metadata",
        help: "JSON-serialized application metadata"
      },
      client_id: {
        label: "Client ID",
        help: "Public OAuth client identifier"
      },
      client_secret: {
        label: "Client Secret",
        help: "OAuth client secret (hashed/encrypted at rest)"
      },
      redirect_uris: {
        label: "Redirect URIs",
        help: "JSON-serialized list of allowed redirect URIs"
      },
      post_logout_redirect_uris: {
        label: "Post-logout Redirect URIs",
        help: "JSON-serialized list of allowed post-logout redirect URIs"
      },
      type: {
        label: "Client Type",
        options: {
          web: "web",
          native: "native",
          useragentbased: "user-agent-based",
          public: "public"
        }
      },
      public: {
        label: "Public Client",
        help: "Marks the client as a public (non-confidential) OAuth client"
      },
      require_pkce: {
        label: "Require PKCE"
      },
      token_endpoint_auth_method: {
        label: "Token Endpoint Auth Method",
        help: "e.g. client_secret_basic, client_secret_post, none"
      },
      grant_types: {
        label: "Grant Types",
        help: "JSON-serialized list of allowed grant types"
      },
      response_types: {
        label: "Response Types",
        help: "JSON-serialized list of allowed response types"
      },
      scopes: {
        label: "Allowed Scopes",
        help: "JSON-serialized list of scopes the client may request"
      },
      subject_type: {
        label: "Subject Type",
        help: "OIDC subject type (e.g. public, pairwise)"
      },
      disabled: {
        label: "Disabled"
      },
      skip_consent: {
        label: "Skip Consent",
        help: "Treat as a trusted client and bypass the consent screen"
      },
      enable_end_session: {
        label: "Enable End Session",
        help: "Allow the client to call the OIDC end-session endpoint"
      },
      software_id: {
        label: "Software ID"
      },
      software_version: {
        label: "Software Version"
      },
      software_statement: {
        label: "Software Statement",
        help: "Signed JWT asserting the client metadata (RFC 7591 §2.3)"
      },
      user_id: {
        label: "Owner User",
        help: "User who registered this application"
      },
      reference_id: {
        label: "Reference ID",
        help: "Caller-supplied correlation identifier"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    },
    _views: {
      mine: {
        label: "My Applications"
      },
      active: {
        label: "Active"
      },
      disabled_apps: {
        label: "Disabled"
      },
      all_apps: {
        label: "All"
      }
    },
    _actions: {
      disable_oauth_application: {
        label: "Disable OAuth Application",
        confirmText: "Disable this OAuth application? Active access/refresh tokens issued to it will continue to be rejected at the token, authorize, and introspect endpoints. Existing integrations will stop working immediately.",
        successMessage: "OAuth application disabled"
      },
      enable_oauth_application: {
        label: "Enable OAuth Application",
        confirmText: "Re-enable this OAuth application? Token issuance, authorization, and introspection will resume immediately.",
        successMessage: "OAuth application enabled"
      },
      create_oauth_application: {
        label: "Register OAuth Application"
      },
      rotate_client_secret: {
        label: "Rotate Client Secret",
        confirmText: "Rotate this OAuth client's secret? The previous secret will stop working immediately and any integrations using it will break until they are updated with the new secret. The new secret is shown only once."
      },
      delete_oauth_application: {
        label: "Delete OAuth Application",
        confirmText: "Permanently delete this OAuth application? All issued tokens and consents will be invalidated and integrations using this client_id will stop working immediately. This cannot be undone.",
        successMessage: "OAuth application deleted"
      }
    }
  },
  sys_oauth_access_token: {
    label: "OAuth Access Token",
    pluralLabel: "OAuth Access Tokens",
    description: "Opaque OAuth access tokens issued to client applications",
    fields: {
      id: {
        label: "ID"
      },
      token: {
        label: "Token",
        help: "Opaque access token value"
      },
      client_id: {
        label: "Client ID",
        help: "Foreign key to sys_oauth_application.client_id"
      },
      session_id: {
        label: "Session",
        help: "Foreign key to sys_session.id"
      },
      user_id: {
        label: "User",
        help: "Foreign key to sys_user.id"
      },
      refresh_id: {
        label: "Refresh Token",
        help: "Foreign key to sys_oauth_refresh_token.id"
      },
      reference_id: {
        label: "Reference ID",
        help: "Caller-supplied correlation identifier"
      },
      scopes: {
        label: "Scopes",
        help: "JSON-serialized list of scopes granted to this token"
      },
      expires_at: {
        label: "Expires At"
      },
      created_at: {
        label: "Created At"
      }
    }
  },
  sys_oauth_refresh_token: {
    label: "OAuth Refresh Token",
    pluralLabel: "OAuth Refresh Tokens",
    description: "Opaque OAuth refresh tokens (linked to a session)",
    fields: {
      id: {
        label: "ID"
      },
      token: {
        label: "Token",
        help: "Opaque refresh token value"
      },
      client_id: {
        label: "Client ID",
        help: "Foreign key to sys_oauth_application.client_id"
      },
      session_id: {
        label: "Session",
        help: "Foreign key to sys_session.id"
      },
      user_id: {
        label: "User",
        help: "Foreign key to sys_user.id"
      },
      reference_id: {
        label: "Reference ID",
        help: "Caller-supplied correlation identifier"
      },
      scopes: {
        label: "Scopes",
        help: "JSON-serialized list of scopes granted to this token"
      },
      expires_at: {
        label: "Expires At"
      },
      created_at: {
        label: "Created At"
      },
      revoked: {
        label: "Revoked At",
        help: "Timestamp at which this refresh token was revoked"
      },
      auth_time: {
        label: "Auth Time",
        help: "When the user originally authenticated for this token chain"
      }
    }
  },
  sys_oauth_consent: {
    label: "OAuth Consent",
    pluralLabel: "OAuth Consents",
    description: "User consent records for OAuth client applications",
    fields: {
      id: {
        label: "ID"
      },
      client_id: {
        label: "Client ID",
        help: "Foreign key to sys_oauth_application.client_id"
      },
      user_id: {
        label: "User",
        help: "Foreign key to sys_user.id"
      },
      reference_id: {
        label: "Reference ID",
        help: "Caller-supplied correlation identifier"
      },
      scopes: {
        label: "Scopes",
        help: "JSON-serialized list of scopes the user consented to"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_jwks: {
    label: "JWKS Key",
    pluralLabel: "JWKS Keys",
    description: "Asymmetric key pairs used to sign and verify issued JWTs",
    fields: {
      id: {
        label: "Key ID",
        help: "JWK `kid` value"
      },
      public_key: {
        label: "Public Key",
        help: "JSON-serialized JWK public key"
      },
      private_key: {
        label: "Private Key",
        help: "JSON-serialized JWK private key (encrypted at rest)"
      },
      created_at: {
        label: "Created At"
      },
      expires_at: {
        label: "Expires At",
        help: "When the key may no longer be used to verify tokens"
      }
    }
  },
  sys_audit_log: {
    label: "Audit Log",
    pluralLabel: "Audit Logs",
    description: "Immutable audit trail for platform events",
    fields: {
      created_at: {
        label: "Timestamp"
      },
      action: {
        label: "Action",
        help: "Action type (snake_case)",
        options: {
          create: "create",
          update: "update",
          delete: "delete",
          restore: "restore",
          login: "login",
          logout: "logout",
          permission_change: "permission_change",
          config_change: "config_change",
          export: "export",
          import: "import"
        }
      },
      user_id: {
        label: "Actor",
        help: "User who performed the action (null for system actions)"
      },
      object_name: {
        label: "Object",
        help: "Target object (e.g. sys_user, project_task)"
      },
      record_id: {
        label: "Record ID",
        help: "ID of the affected record"
      },
      old_value: {
        label: "Old Value",
        help: "JSON-serialized previous state"
      },
      new_value: {
        label: "New Value",
        help: "JSON-serialized new state"
      },
      ip_address: {
        label: "IP Address"
      },
      user_agent: {
        label: "User Agent"
      },
      tenant_id: {
        label: "Tenant",
        help: "Tenant context for multi-tenant isolation"
      },
      metadata: {
        label: "Metadata",
        help: "JSON-serialized additional context"
      },
      id: {
        label: "Audit Log ID"
      }
    },
    _views: {
      recent: {
        label: "Recent"
      },
      writes_only: {
        label: "Writes"
      },
      auth_events: {
        label: "Auth"
      },
      config_changes: {
        label: "Config"
      },
      all_events: {
        label: "All"
      }
    }
  },
  sys_presence: {
    label: "Presence",
    pluralLabel: "Presences",
    description: "Real-time user presence and activity tracking",
    fields: {
      id: {
        label: "Presence ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      },
      user_id: {
        label: "User"
      },
      session_id: {
        label: "Session"
      },
      status: {
        label: "Status",
        options: {
          online: "Online",
          away: "Away",
          busy: "Busy",
          offline: "Offline"
        }
      },
      last_seen: {
        label: "Last Seen"
      },
      current_location: {
        label: "Current Location"
      },
      device: {
        label: "Device",
        options: {
          desktop: "Desktop",
          mobile: "Mobile",
          tablet: "Tablet",
          other: "Other"
        }
      },
      custom_status: {
        label: "Custom Status"
      },
      metadata: {
        label: "Metadata",
        help: "Arbitrary JSON metadata associated with the presence state (matches PresenceStateSchema.metadata)."
      }
    }
  },
  sys_activity: {
    label: "Activity",
    pluralLabel: "Activities",
    description: "Recent activity stream entries (lightweight, denormalized)",
    fields: {
      id: {
        label: "Activity ID"
      },
      timestamp: {
        label: "Timestamp"
      },
      type: {
        label: "Type",
        options: {
          created: "created",
          updated: "updated",
          deleted: "deleted",
          commented: "commented",
          mentioned: "mentioned",
          shared: "shared",
          assigned: "assigned",
          completed: "completed",
          login: "login",
          logout: "logout",
          system: "system"
        }
      },
      summary: {
        label: "Summary",
        help: "Human-readable one-line summary"
      },
      actor_id: {
        label: "Actor"
      },
      actor_name: {
        label: "Actor Name"
      },
      actor_avatar_url: {
        label: "Actor Avatar"
      },
      object_name: {
        label: "Object",
        help: "Target object short name (e.g. account, sys_user)"
      },
      record_id: {
        label: "Record ID"
      },
      record_label: {
        label: "Record Label",
        help: "Display label of the target record at write time"
      },
      url: {
        label: "URL",
        help: "Optional deep-link to the activity target"
      },
      environment_id: {
        label: "Project",
        help: "Environment context (multi-environment deployments)"
      },
      metadata: {
        label: "Metadata",
        help: "JSON-serialized additional context"
      }
    }
  },
  sys_comment: {
    label: "Comment",
    pluralLabel: "Comments",
    description: "Threaded comments attached to records via thread_id",
    fields: {
      id: {
        label: "Comment ID"
      },
      thread_id: {
        label: "Thread",
        help: "Thread identifier — conventionally `{object}:{record_id}` (e.g. `sys_user:abc123`)"
      },
      parent_id: {
        label: "Parent Comment",
        help: "Optional parent comment for nested replies"
      },
      reply_count: {
        label: "Reply Count"
      },
      author_id: {
        label: "Author"
      },
      author_name: {
        label: "Author Name"
      },
      author_avatar_url: {
        label: "Author Avatar"
      },
      body: {
        label: "Body",
        help: "Comment text (Markdown supported)"
      },
      mentions: {
        label: "Mentions",
        help: "JSON array of @mention objects"
      },
      reactions: {
        label: "Reactions",
        help: "JSON array of emoji reaction objects"
      },
      is_edited: {
        label: "Edited"
      },
      edited_at: {
        label: "Edited At"
      },
      visibility: {
        label: "Visibility",
        options: {
          public: "public",
          internal: "internal",
          private: "private"
        }
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_attachment: {
    label: "Attachment",
    pluralLabel: "Attachments",
    description: "Polymorphic link between a sys_file and any other record",
    fields: {
      id: {
        label: "Attachment ID"
      },
      parent_object: {
        label: "Parent Object",
        help: "Short object name of the attached-to record (e.g. account, lead)"
      },
      parent_id: {
        label: "Parent Record",
        help: "Primary key of the attached-to record"
      },
      file_id: {
        label: "File",
        help: "The sys_file storage entry being attached"
      },
      file_name: {
        label: "File Name",
        help: "Denormalised copy of sys_file.name for fast list rendering"
      },
      mime_type: {
        label: "MIME Type"
      },
      size: {
        label: "Size (bytes)"
      },
      share_type: {
        label: "Share Type",
        help: "viewer | collaborator | inferred (inherited from parent record)",
        options: {
          viewer: "viewer",
          collaborator: "collaborator",
          inferred: "inferred"
        }
      },
      visibility: {
        label: "Visibility",
        options: {
          internal: "internal",
          all_users: "all_users",
          shared_users: "shared_users"
        }
      },
      uploaded_by: {
        label: "Uploaded By"
      },
      description: {
        label: "Description"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_notification: {
    label: "Notification",
    pluralLabel: "Notifications",
    description: "Per-user notification inbox entries",
    fields: {
      id: {
        label: "Notification ID"
      },
      topic: {
        label: "Topic",
        help: "Notification topic, e.g. task.assigned, collab.mention"
      },
      payload: {
        label: "Payload",
        help: "Template inputs carried to channels (title/body/url/actor/source/…)"
      },
      severity: {
        label: "Severity",
        help: "Severity hint for rendering / filtering",
        options: {
          info: "info",
          warning: "warning",
          critical: "critical"
        }
      },
      dedup_key: {
        label: "Dedup Key",
        help: "Idempotency key within a topic window; a repeat emit is a no-op"
      },
      source_object: {
        label: "Source Object",
        help: "Object name of the related record (e.g. lead, opportunity)"
      },
      source_id: {
        label: "Source Record",
        help: "Record id within source_object"
      },
      actor_id: {
        label: "Actor",
        help: "User who caused the notification (mentioner, assigner)"
      },
      created_at: {
        label: "Created At"
      }
    },
    _views: {
      recent: {
        label: "Recent"
      },
      by_topic: {
        label: "By Topic"
      }
    }
  },
  sys_email: {
    label: "Email",
    pluralLabel: "Emails",
    description: "Outbound email delivery log",
    fields: {
      id: {
        label: "Email ID"
      },
      message_id: {
        label: "Message-ID",
        help: "RFC-5322 Message-ID assigned by the transport"
      },
      from_address: {
        label: "From"
      },
      to_addresses: {
        label: "To",
        help: "Comma-separated recipient addresses"
      },
      cc_addresses: {
        label: "Cc"
      },
      bcc_addresses: {
        label: "Bcc"
      },
      reply_to: {
        label: "Reply-To"
      },
      subject: {
        label: "Subject"
      },
      body_text: {
        label: "Body (text)"
      },
      body_html: {
        label: "Body (HTML)"
      },
      status: {
        label: "Status",
        help: "Lifecycle state — queued by IEmailService.send before transport call",
        options: {
          queued: "queued",
          sent: "sent",
          failed: "failed"
        }
      },
      error: {
        label: "Error",
        help: "Transport error message when status=failed"
      },
      attempt_count: {
        label: "Attempts",
        help: "Number of delivery attempts performed by the service"
      },
      sent_at: {
        label: "Sent At",
        help: "Set when status transitions to \"sent\""
      },
      related_object: {
        label: "Related Object",
        help: "Object name of the related record (e.g. lead, opportunity)"
      },
      related_id: {
        label: "Related Record",
        help: "Record id within related_object"
      },
      sent_by: {
        label: "Sent By"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_email_template: {
    label: "Email Template",
    pluralLabel: "Email Templates",
    description: "Outbound email template (subject + body + variables) resolved by name+locale",
    fields: {
      id: {
        label: "ID"
      },
      name: {
        label: "Name",
        help: "Dotted snake_case identifier (e.g. auth.password_reset)"
      },
      label: {
        label: "Label",
        help: "Human-readable name shown in Studio"
      },
      category: {
        label: "Category",
        options: {
          auth: "auth",
          notification: "notification",
          workflow: "workflow",
          marketing: "marketing",
          custom: "custom"
        }
      },
      locale: {
        label: "Locale",
        help: "BCP-47 locale tag (en-US, zh-CN, …)"
      },
      description: {
        label: "Description"
      },
      subject: {
        label: "Subject",
        help: "Subject template; supports {{var.path}} placeholders"
      },
      body_html: {
        label: "HTML Body",
        help: "HTML body template; supports {{var.path}} placeholders"
      },
      body_text: {
        label: "Plain Text Body",
        help: "Optional plain-text alternative (auto-derived from HTML when blank)"
      },
      from_name: {
        label: "From Name"
      },
      from_address: {
        label: "From Address"
      },
      reply_to: {
        label: "Reply-To"
      },
      active: {
        label: "Active"
      },
      is_system: {
        label: "System Template",
        help: "Provided by a plugin / platform; tenants may edit but should not delete"
      },
      variables_json: {
        label: "Variables (JSON)",
        help: "JSON array of {name,type,required,description}"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_saved_report: {
    label: "Saved Report",
    pluralLabel: "Saved Reports",
    description: "Persisted ObjectQL report definition — re-runnable and schedulable",
    fields: {
      id: {
        label: "Report ID"
      },
      name: {
        label: "Name"
      },
      description: {
        label: "Description"
      },
      object_name: {
        label: "Object",
        help: "Short object name the report queries"
      },
      query_json: {
        label: "Query",
        help: "ObjectQL query envelope — { filter, fields, orderBy, limit, groupBy }"
      },
      format: {
        label: "Format",
        help: "Rendering used by IReportService.run() and email digests",
        options: {
          csv: "csv",
          json: "json",
          html_table: "html_table"
        }
      },
      owner_id: {
        label: "Owner",
        help: "User that owns the report definition (drives sharing)"
      },
      last_run_at: {
        label: "Last Run",
        help: "Stamped by IReportService.run() on successful execution"
      },
      last_row_count: {
        label: "Last Row Count"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_report_schedule: {
    label: "Report Schedule",
    pluralLabel: "Report Schedules",
    description: "Recurring delivery of a sys_saved_report via email",
    fields: {
      id: {
        label: "Schedule ID"
      },
      report_id: {
        label: "Report"
      },
      name: {
        label: "Name",
        help: "Optional label for the digest — used in the email subject"
      },
      interval_minutes: {
        label: "Interval (minutes)",
        help: "How often to send (1440 = daily, 10080 = weekly)"
      },
      cron_expression: {
        label: "Cron Expression",
        help: "Optional 5/6-field cron — overrides interval_minutes when present"
      },
      timezone: {
        label: "Timezone"
      },
      active: {
        label: "Active"
      },
      recipients: {
        label: "Recipients",
        help: "Comma-separated email addresses"
      },
      format: {
        label: "Format",
        help: "Render format — csv is attached, html_table is inlined",
        options: {
          csv: "csv",
          html_table: "html_table"
        }
      },
      subject_template: {
        label: "Subject Template",
        help: "Email subject; {{name}} / {{date}} / {{rows}} are substituted"
      },
      owner_id: {
        label: "Owner"
      },
      next_run_at: {
        label: "Next Run",
        help: "Dispatcher loads schedules where next_run_at <= now"
      },
      last_sent_at: {
        label: "Last Sent"
      },
      last_status: {
        label: "Last Status",
        options: {
          ok: "ok",
          failed: "failed",
          skipped: "skipped"
        }
      },
      last_error: {
        label: "Last Error"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_job: {
    label: "Background Job",
    pluralLabel: "Background Jobs",
    description: "Catalogue of registered background jobs",
    fields: {
      id: {
        label: "Job ID"
      },
      name: {
        label: "Job Name",
        help: "Unique job identifier (snake_case)"
      },
      schedule_type: {
        label: "Schedule Type",
        options: {
          cron: "cron",
          interval: "interval",
          once: "once"
        }
      },
      schedule_expression: {
        label: "Expression",
        help: "Cron expression / interval ms / ISO datetime"
      },
      timezone: {
        label: "Timezone"
      },
      active: {
        label: "Active",
        help: "Whether the scheduler is currently running this job"
      },
      last_run_at: {
        label: "Last Run At"
      },
      last_status: {
        label: "Last Status",
        options: {
          success: "success",
          failed: "failed",
          timeout: "timeout",
          running: "running"
        }
      },
      last_error: {
        label: "Last Error"
      },
      run_count: {
        label: "Run Count"
      },
      failure_count: {
        label: "Failure Count"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_job_run: {
    label: "Job Run",
    pluralLabel: "Job Runs",
    description: "Background job execution audit trail",
    fields: {
      id: {
        label: "Run ID"
      },
      job_name: {
        label: "Job"
      },
      status: {
        label: "Status",
        options: {
          running: "running",
          success: "success",
          failed: "failed",
          timeout: "timeout"
        }
      },
      started_at: {
        label: "Started At"
      },
      completed_at: {
        label: "Completed At"
      },
      duration_ms: {
        label: "Duration (ms)"
      },
      attempt: {
        label: "Attempt",
        help: "1 for first run, >1 for retries/replays"
      },
      trigger: {
        label: "Trigger",
        options: {
          schedule: "schedule",
          manual: "manual",
          replay: "replay"
        }
      },
      error: {
        label: "Error"
      },
      created_at: {
        label: "Created At"
      }
    }
  },
  sys_job_queue: {
    label: "Job Queue Message",
    pluralLabel: "Job Queue Messages",
    description: "Durable job/message queue including dead letters",
    fields: {
      id: {
        label: "Message ID"
      },
      queue: {
        label: "Queue",
        help: "Logical queue name (snake_case)"
      },
      idempotency_key: {
        label: "Idempotency Key",
        help: "Deduplication key within (queue, window)"
      },
      payload_json: {
        label: "Payload (JSON)",
        help: "Serialized message body"
      },
      metadata_json: {
        label: "Metadata (JSON)",
        help: "Serialized metadata bag (tenant_id, source_record, ...)"
      },
      status: {
        label: "Status",
        help: "Lifecycle state",
        options: {
          pending: "pending",
          running: "running",
          completed: "completed",
          failed: "failed",
          dlq: "dlq"
        }
      },
      priority: {
        label: "Priority",
        help: "Lower = higher priority"
      },
      attempts: {
        label: "Attempts"
      },
      max_attempts: {
        label: "Max Attempts"
      },
      backoff_type: {
        label: "Backoff",
        options: {
          fixed: "fixed",
          exponential: "exponential"
        }
      },
      backoff_delay_ms: {
        label: "Backoff Base (ms)"
      },
      backoff_max_delay_ms: {
        label: "Backoff Cap (ms)"
      },
      scheduled_for: {
        label: "Scheduled For",
        help: "Earliest time a worker may lease this message"
      },
      locked_by: {
        label: "Locked By",
        help: "Worker id holding the lease"
      },
      locked_until: {
        label: "Locked Until",
        help: "Lease expiry; if past, another worker may claim"
      },
      last_error: {
        label: "Last Error"
      },
      completed_at: {
        label: "Completed At"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_metadata: {
    label: "System Metadata",
    pluralLabel: "System Metadata",
    description: "Stores platform and user-scope metadata records (objects, views, flows, etc.)",
    fields: {
      id: {
        label: "ID"
      },
      name: {
        label: "Name"
      },
      type: {
        label: "Metadata Type"
      },
      namespace: {
        label: "Namespace"
      },
      package_id: {
        label: "Package ID",
        help: "Legacy package manifest ID string. Use package_version_id for new records."
      },
      package_version_id: {
        label: "Package Version",
        help: "Foreign key to sys_package_version (UUID). Null = platform-built-in or env-level override."
      },
      managed_by: {
        label: "Managed By",
        options: {
          package: "package",
          platform: "platform",
          user: "user"
        }
      },
      scope: {
        label: "Scope",
        options: {
          system: "system",
          platform: "platform",
          user: "user"
        }
      },
      metadata: {
        label: "Metadata",
        help: "JSON-serialized metadata payload"
      },
      extends: {
        label: "Extends"
      },
      strategy: {
        label: "Strategy",
        options: {
          merge: "merge",
          replace: "replace"
        }
      },
      owner: {
        label: "Owner"
      },
      state: {
        label: "State",
        options: {
          draft: "draft",
          active: "active",
          archived: "archived",
          deprecated: "deprecated"
        }
      },
      organization_id: {
        label: "Organization",
        help: "Organization for multi-tenant isolation."
      },
      environment_id: {
        label: "Project (deprecated)",
        help: "DEPRECATED. Use organization_id for tenant isolation."
      },
      version: {
        label: "Version"
      },
      checksum: {
        label: "Checksum"
      },
      source: {
        label: "Source",
        options: {
          filesystem: "filesystem",
          database: "database",
          api: "api",
          migration: "migration"
        }
      },
      tags: {
        label: "Tags",
        help: "JSON-serialized array of classification tags"
      },
      created_by: {
        label: "Created By"
      },
      created_at: {
        label: "Created At"
      },
      updated_by: {
        label: "Updated By"
      },
      updated_at: {
        label: "Updated At"
      }
    },
    _views: {
      only_objects: {
        label: "Objects"
      },
      only_fields: {
        label: "Fields"
      },
      all_metadata: {
        label: "All"
      }
    }
  },
  sys_metadata_history: {
    label: "Metadata History",
    pluralLabel: "Metadata History",
    description: "Version history and audit trail for metadata changes",
    fields: {
      id: {
        label: "ID"
      },
      event_seq: {
        label: "Event Seq",
        help: "Per-organization monotonic event log cursor."
      },
      name: {
        label: "Name"
      },
      type: {
        label: "Metadata Type"
      },
      version: {
        label: "Version"
      },
      operation_type: {
        label: "Operation Type",
        options: {
          create: "create",
          update: "update",
          publish: "publish",
          revert: "revert",
          delete: "delete"
        }
      },
      metadata: {
        label: "Metadata",
        help: "JSON-serialized metadata snapshot at this version"
      },
      checksum: {
        label: "Checksum"
      },
      previous_checksum: {
        label: "Previous Checksum"
      },
      change_note: {
        label: "Change Note",
        help: "Description of what changed in this version"
      },
      source: {
        label: "Source"
      },
      organization_id: {
        label: "Organization",
        help: "Organization for multi-tenant isolation."
      },
      recorded_by: {
        label: "Recorded By"
      },
      recorded_at: {
        label: "Recorded At"
      }
    }
  },
  sys_view_definition: {
    label: "View Definition",
    pluralLabel: "View Definitions",
    description: "Runtime-authored view definitions (shared / personal layers). The package layer ships from source.",
    fields: {
      id: {
        label: "ID"
      },
      name: {
        label: "Name"
      },
      object: {
        label: "Object"
      },
      view_kind: {
        label: "View Kind",
        options: {
          list: "list",
          form: "form"
        }
      },
      label: {
        label: "Label"
      },
      is_default: {
        label: "Is Default"
      },
      view_order: {
        label: "Order"
      },
      scope: {
        label: "Scope",
        options: {
          shared: "shared",
          personal: "personal"
        }
      },
      owner: {
        label: "Owner"
      },
      hidden: {
        label: "Hidden"
      },
      config: {
        label: "Config",
        help: "ListView or FormView configuration (matches spec ViewItem.config)."
      },
      organization_id: {
        label: "Organization",
        help: "Organization for multi-tenant isolation."
      },
      state: {
        label: "State",
        options: {
          draft: "draft",
          active: "active",
          archived: "archived"
        }
      },
      created_by: {
        label: "Created By"
      },
      created_at: {
        label: "Created At"
      },
      updated_by: {
        label: "Updated By"
      },
      updated_at: {
        label: "Updated At"
      }
    }
  },
  sys_metadata_audit: {
    label: "Metadata Audit",
    pluralLabel: "Metadata Audit",
    description: "Append-only audit trail of metadata write decisions (ADR-0010).",
    fields: {
      id: {
        label: "ID"
      },
      occurred_at: {
        label: "Occurred At"
      },
      actor: {
        label: "Actor",
        help: "Acting principal — user id, system id, or \"system\"."
      },
      source: {
        label: "Source"
      },
      type: {
        label: "Metadata Type"
      },
      name: {
        label: "Name"
      },
      organization_id: {
        label: "Organization"
      },
      operation: {
        label: "Operation",
        options: {
          save: "save",
          publish: "publish",
          rollback: "rollback",
          delete: "delete",
          reset: "reset"
        }
      },
      outcome: {
        label: "Outcome",
        options: {
          allowed: "allowed",
          denied: "denied",
          forced: "forced"
        }
      },
      code: {
        label: "Code"
      },
      lock_state: {
        label: "Lock State",
        options: {
          none: "none",
          nooverlay: "no-overlay",
          nodelete: "no-delete",
          full: "full"
        }
      },
      lock_overridden: {
        label: "Lock Overridden"
      },
      request_id: {
        label: "Request ID"
      },
      note: {
        label: "Note"
      }
    }
  },
  sys_setting: {
    label: "Setting",
    pluralLabel: "Settings",
    description: "Generic K/V store backing the SettingsManifest contract.",
    fields: {
      id: {
        label: "Setting ID"
      },
      created_at: {
        label: "Created At"
      },
      updated_at: {
        label: "Updated At"
      },
      namespace: {
        label: "Namespace",
        help: "Manifest namespace (e.g. mail, branding, feature_flags)."
      },
      key: {
        label: "Key",
        help: "Specifier key inside the namespace (snake_case)."
      },
      scope: {
        label: "Scope",
        help: "Which layer of the config-resolution hierarchy this row belongs to.",
        options: {
          global: "Global",
          tenant: "Tenant",
          user: "User",
          runtime: "Runtime"
        }
      },
      user_id: {
        label: "User",
        help: "Owning user when scope=user; null otherwise."
      },
      value: {
        label: "Value",
        help: "JSON-encoded value. Null when encrypted=true (see value_enc)."
      },
      encrypted: {
        label: "Encrypted",
        help: "When true, the value is stored encrypted-at-rest in value_enc; value column is null."
      },
      locked: {
        label: "Locked",
        help: "When true, lower-scope rows cannot override this value; writes against lower scopes return 409. Used by platform administrators to pin a global value for all tenants (Phase 2 cascade)."
      },
      locked_reason: {
        label: "Lock Reason",
        help: "Human-readable explanation surfaced in the UI tooltip when locked=true."
      },
      value_enc: {
        label: "Encrypted Value",
        help: "Ciphertext payload (KMS-wrapped). Set only when encrypted=true."
      },
      updated_by: {
        label: "Updated By",
        help: "Last actor who wrote this row via SettingsService.set()."
      }
    },
    _views: {
      by_namespace: {
        label: "By Namespace"
      },
      tenant_only: {
        label: "Tenant"
      },
      user_only: {
        label: "User"
      },
      all_settings: {
        label: "All"
      }
    }
  },
  sys_secret: {
    label: "Secret",
    pluralLabel: "Secrets",
    description: "Cipher store referenced by sys_setting handles. Never holds plaintext.",
    fields: {
      id: {
        label: "ID",
        help: "Opaque handle referenced by `sys_setting.value_enc`."
      },
      created_at: {
        label: "Created At",
        help: "When the cipher was first written."
      },
      rotated_at: {
        label: "Rotated At",
        help: "When the cipher was last re-wrapped under a new KMS key."
      },
      namespace: {
        label: "Namespace",
        help: "Settings namespace this secret belongs to."
      },
      key: {
        label: "Key",
        help: "Specifier key within the namespace."
      },
      kms_key_id: {
        label: "KMS Key ID",
        help: "External KMS handle (ARN, GCP resource id, or `local`)."
      },
      alg: {
        label: "Algorithm",
        help: "Cipher/AEAD algorithm tag."
      },
      version: {
        label: "Version",
        help: "Bumps each time rotateKey() re-wraps this row."
      },
      ciphertext: {
        label: "Ciphertext",
        help: "Provider-encoded ciphertext blob (base64 / JSON). Implementation-defined; only the matching ICryptoProvider can read it."
      }
    }
  },
  sys_setting_audit: {
    label: "Setting Audit Entry",
    pluralLabel: "Setting Audit",
    description: "Append-only audit trail for SettingsService mutations.",
    fields: {
      id: {
        label: "ID"
      },
      created_at: {
        label: "Created At",
        help: "When the mutation was recorded."
      },
      namespace: {
        label: "Namespace"
      },
      key: {
        label: "Key"
      },
      scope: {
        label: "Scope",
        help: "Cascade layer the row was written to.",
        options: {
          global: "Global",
          tenant: "Tenant",
          user: "User"
        }
      },
      action: {
        label: "Action",
        help: "Mutation kind.",
        options: {
          set: "Set",
          reset: "Reset",
          lock: "Lock",
          unlock: "Unlock",
          rotate: "Rotate"
        }
      },
      actor_id: {
        label: "Actor",
        help: "User who performed the mutation; null for system jobs."
      },
      source: {
        label: "Source",
        help: "Mutation entry-point.",
        options: {
          ui: "UI",
          api: "API",
          migration: "Migration",
          import: "Import",
          system: "System"
        }
      },
      reason: {
        label: "Reason",
        help: "Free-text justification provided by the actor (optional)."
      },
      old_hash: {
        label: "Old Hash",
        help: "SHA-256 of the previous value (canonicalised). Null when previously unset."
      },
      new_hash: {
        label: "New Hash",
        help: "SHA-256 of the new value (canonicalised). Null on reset."
      },
      encrypted: {
        label: "Encrypted",
        help: "True when the field carries secret material (rotation is interesting)."
      },
      request_id: {
        label: "Request ID",
        help: "Correlates with sys_audit_log / tracing."
      }
    }
  }
};
