@objectstack/platform-objects 13.0.0 → 14.5.0

package/dist/index.js

@@ -12,6 +12,15 @@ var SysUser = data.ObjectSchema.create({
   icon: "user",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0092 D4 — the ONE generic affordance opened on an identity table:
+  // standard row editing. Safe because the plugin-auth identity write guard
+  // (ADR-0092 D2) enforces the profile whitelist server-side — a user-context
+  // update may only touch SYS_USER_PROFILE_EDIT_FIELDS ({name, image});
+  // everything else is stripped/rejected regardless of what a form submits.
+  // The permission layer still decides WHO may edit (platform admins only by
+  // default; member/org-admin sets keep allowEdit: false). create / import /
+  // delete stay bucket-default (off).
+  userActions: { edit: true },
   // ADR-0010 §3.7 — identity table is managed by better-auth; schema must not drift.
   protection: {
     lock: "full",
@@ -59,15 +68,17 @@ var SysUser = data.ObjectSchema.create({
     // These actions hit /api/v1/auth/admin/* endpoints that are only
     // wired when `auth.plugins.admin` is enabled. When the plugin is
     // disabled the actions still render (schema is static) but server
-    // returns 404. UI surfaces them under the row menu so platform
-    // admins can manage accounts without dropping to SQL or
+    // returns 404. UI surfaces them under the row menu AND the
+    // record-detail header (`record_header`, overflowing into the ⋯
+    // "More" menu) so platform admins can manage an account from either
+    // the Users list or an open user record — without dropping to SQL or
     // a custom Setup wizard.
     {
       name: "ban_user",
       label: "Ban User",
       icon: "ban",
       variant: "danger",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/ban-user",
       recordIdParam: "userId",
@@ -83,7 +94,7 @@ var SysUser = data.ObjectSchema.create({
       label: "Unban User",
       icon: "check-circle-2",
       variant: "secondary",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/unban-user",
       recordIdParam: "userId",
@@ -98,34 +109,117 @@ var SysUser = data.ObjectSchema.create({
       label: "Unlock Account",
       icon: "lock-open",
       variant: "secondary",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/unlock-user",
       recordIdParam: "userId",
       successMessage: "Account unlocked",
       refreshAfter: true
     },
+    {
+      // #2766 V1 — a platform admin can add a login-capable teammate without
+      // the email-dependent invite flow. Hits the plugin-auth wrapper route
+      // (NOT better-auth's stock /admin/create-user): the wrapper runs the
+      // ADR-0068 admin gate, drives the better-auth pipeline (scrypt hash +
+      // credential sys_account), stamps must_change_password, and — when
+      // "Generate temporary password" is picked — returns the password ONCE
+      // in the response for the result dialog. It is never persisted or logged.
+      name: "create_user",
+      label: "Create User",
+      icon: "user-plus",
+      variant: "secondary",
+      locations: ["list_toolbar"],
+      type: "api",
+      target: "/api/v1/auth/admin/create-user",
+      visible: "features.admin == true",
+      successMessage: "User created",
+      refreshAfter: true,
+      params: [
+        // The endpoint requires email OR phone (phone-only users get a
+        // placeholder address; requires auth.plugins.phoneNumber).
+        { field: "email", required: false },
+        {
+          name: "phoneNumber",
+          label: "Phone Number",
+          type: "text",
+          required: false,
+          helpText: "Sign-in phone number (E.164, e.g. +8613800000000). Required when no email is given."
+        },
+        { field: "name", required: false },
+        {
+          name: "generatePassword",
+          label: "Generate Temporary Password",
+          type: "boolean",
+          required: false,
+          defaultValue: true
+        },
+        { name: "password", label: "Password (leave empty to generate)", type: "text", required: false },
+        {
+          name: "mustChangePassword",
+          label: "Require Password Change On First Login",
+          type: "boolean",
+          required: false,
+          defaultValue: true
+        }
+      ],
+      resultDialog: {
+        title: "User Created",
+        description: "Copy the temporary password now \u2014 it is shown only once and never stored.",
+        acknowledge: "I have saved this password",
+        fields: [
+          { path: "user.email", label: "Email", format: "text" },
+          { path: "temporaryPassword", label: "Temporary Password", format: "secret" }
+        ]
+      }
+    },
     {
       name: "set_user_password",
       label: "Set Password",
       icon: "key-round",
       variant: "secondary",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
+      // #2766 V1 — same path as better-auth's stock route, but served by the
+      // plugin-auth wrapper registered ahead of the catch-all: it accepts the
+      // ADR-0068 platform-admin signals (the stock handler only honors the
+      // legacy role scalar), can mint a temporary password, and stamps
+      // must_change_password.
       target: "/api/v1/auth/admin/set-user-password",
       recordIdParam: "userId",
       successMessage: "Password updated",
       refreshAfter: false,
       params: [
-        { name: "newPassword", label: "New Password", type: "text", required: true }
-      ]
+        {
+          name: "generatePassword",
+          label: "Generate Temporary Password",
+          type: "boolean",
+          required: false,
+          defaultValue: false
+        },
+        { name: "newPassword", label: "New Password (leave empty to generate)", type: "text", required: false },
+        {
+          name: "mustChangePassword",
+          label: "Require Password Change On Next Login",
+          type: "boolean",
+          required: false,
+          defaultValue: true
+        }
+      ],
+      resultDialog: {
+        title: "Password Updated",
+        description: "If a temporary password was generated, copy it now \u2014 it is shown only once and never stored.",
+        acknowledge: "Done",
+        fields: [
+          { path: "temporaryPassword", label: "Temporary Password", format: "secret" }
+        ]
+      }
     },
     {
       name: "set_user_role",
       label: "Set Platform Role",
       icon: "shield-check",
       variant: "secondary",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/set-role",
       recordIdParam: "userId",
@@ -140,7 +234,7 @@ var SysUser = data.ObjectSchema.create({
       label: "Impersonate User",
       icon: "user-cog",
       variant: "secondary",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/impersonate-user",
       recordIdParam: "userId",
@@ -364,20 +458,28 @@ var SysUser = data.ObjectSchema.create({
       maxLength: 255,
       group: "Identity"
     }),
+    // ADR-0092 D4 — with the generic edit affordance open, every non-profile
+    // field is readonly so the standard edit form renders it non-editable.
+    // This is UX only; the server boundary is the plugin-auth identity write
+    // guard (ADR-0092 D2), which strips/rejects these regardless.
     email: data.Field.email({
       label: "Email",
       required: true,
+      readonly: true,
+      // login identity — change flows through better-auth change-email verification
       searchable: true,
       group: "Identity"
     }),
     email_verified: data.Field.boolean({
       label: "Email Verified",
       defaultValue: false,
+      readonly: true,
       group: "Identity"
     }),
     two_factor_enabled: data.Field.boolean({
       label: "Two-Factor Enabled",
       defaultValue: false,
+      readonly: true,
       group: "Identity",
       description: "Whether two-factor authentication is enabled for this user. Maintained by the better-auth `twoFactor` plugin."
     }),
@@ -385,6 +487,8 @@ var SysUser = data.ObjectSchema.create({
     role: data.Field.text({
       label: "Platform Role",
       required: false,
+      readonly: true,
+      // ADR-0092 — set via the Set Platform Role action, never the edit form
       maxLength: 64,
       group: "Admin",
       description: "Platform-level role (admin, user, \u2026). Set via the Set Platform Role action."
@@ -392,18 +496,24 @@ var SysUser = data.ObjectSchema.create({
     banned: data.Field.boolean({
       label: "Banned",
       defaultValue: false,
+      readonly: true,
+      // ADR-0092 — toggled via Ban/Unban actions (session side effects)
       group: "Admin",
       description: "When true, the user cannot sign in. Toggle via Ban User / Unban User actions."
     }),
     ban_reason: data.Field.text({
       label: "Ban Reason",
       required: false,
+      readonly: true,
+      // ADR-0092 — written by the Ban User action
       maxLength: 255,
       group: "Admin"
     }),
     ban_expires: data.Field.datetime({
       label: "Ban Expires",
       required: false,
+      readonly: true,
+      // ADR-0092 — written by the Ban User action
       group: "Admin",
       description: "When set, the ban auto-clears at this time."
     }),
@@ -437,6 +547,37 @@ var SysUser = data.ObjectSchema.create({
       group: "Admin",
       description: "Timestamp of the last password change. Backs password_expiry_days; system-managed."
     }),
+    // #2766 V1.5 — phone-number sign-in identifier (better-auth phoneNumber
+    // plugin, mapped via buildPhoneNumberPluginSchema). Unique when present;
+    // null for email-only accounts. Written through better-auth, not CRUD.
+    phone_number: data.Field.text({
+      label: "Phone Number",
+      required: false,
+      readonly: true,
+      searchable: true,
+      maxLength: 32,
+      group: "Account",
+      description: "Sign-in phone number (E.164 recommended). Unique per user; managed by better-auth when the phoneNumber plugin is enabled."
+    }),
+    phone_number_verified: data.Field.boolean({
+      label: "Phone Verified",
+      defaultValue: false,
+      readonly: true,
+      group: "Account",
+      description: "Whether the phone number has been verified (OTP verification requires SMS infrastructure; false until that ships). System-managed."
+    }),
+    // #2766 V1 — admin-issued "must change password on next sign-in" flag.
+    // Set by the /admin/create-user and /admin/set-user-password routes when
+    // a temporary password is issued; enforced through the ADR-0069 authGate
+    // (surfaces as PASSWORD_EXPIRED); cleared by stampPasswordChangedAt once
+    // the user completes a password change.
+    must_change_password: data.Field.boolean({
+      label: "Must Change Password",
+      defaultValue: false,
+      readonly: true,
+      group: "Admin",
+      description: "When true, the user is blocked (403 PASSWORD_EXPIRED) until they change their password. Stamped by the admin user-management routes; system-managed."
+    }),
     // ADR-0069 D3 — when enforced MFA first applied to this user; starts the
     // grace clock. Stamped lazily at session validation; system-managed.
     mfa_required_at: data.Field.datetime({
@@ -468,6 +609,8 @@ var SysUser = data.ObjectSchema.create({
     ai_access: data.Field.boolean({
       label: "AI Access",
       defaultValue: false,
+      readonly: true,
+      // ADR-0092 — a licensed-seat grant; flows through the AiSeatPlugin enforcement path
       group: "Admin",
       description: "Whether this user holds an AI seat \u2014 grants access to the in-UI AI agents (build / ask). The framework synthesizes the `ai_seat` capability from this flag (plugin-hono-server resolveCtx). Assignment is capped by the licensed / purchased seat count (enforced by @objectstack/security-enterprise AiSeatPlugin). Owned by objectql (better-auth is oblivious to this column)."
     }),
@@ -481,12 +624,16 @@ var SysUser = data.ObjectSchema.create({
     manager_id: data.Field.lookup("sys_user", {
       label: "Manager",
       required: false,
+      readonly: true,
+      // ADR-0092 — drives own_and_reports RLS scope; org-structure maintenance is its own surface
       group: "Organization",
       description: "This user's direct manager. Forms the reporting chain the `own_and_reports` hierarchy scope walks (ADR-0057 / @objectstack/security-enterprise)."
     }),
     primary_business_unit_id: data.Field.lookup("sys_business_unit", {
       label: "Primary Business Unit",
       required: false,
+      readonly: true,
+      // ADR-0092 — denormalised projection maintained by plugin-sharing; never hand-edited
       group: "Organization",
       description: "The user's primary business unit \u2014 a denormalised projection of sys_business_unit_member.is_primary, maintained by plugin-sharing (ADR-0057 addendum D12). Lets a user-lookup filter candidates by business unit without traversing the membership junction. Do not edit directly; set it via business-unit membership."
     }),
@@ -534,7 +681,10 @@ var SysUser = data.ObjectSchema.create({
   },
   indexes: [
     { fields: ["email"], unique: true },
-    { fields: ["created_at"], unique: false }
+    { fields: ["created_at"], unique: false },
+    // #2766 V1.5 — phone sign-in identifier; unique when present (null for
+    // email-only accounts), also the upsert match key for identity import.
+    { fields: ["phone_number"], unique: true }
   ],
   enable: {
     trackHistory: true,
@@ -2503,6 +2653,12 @@ var SysDeviceCode = data.ObjectSchema.create({
   icon: "key-round",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0057: device codes are dead the moment `expires_at` passes — keep a
+  // 1d grace for post-mortem, then reap.
+  lifecycle: {
+    class: "transient",
+    ttl: { field: "expires_at", expireAfter: "1d" }
+  },
   // [ADR-0066 D2/④] Secure-by-default: rows are LIVE pending device-grant
   // codes — reading `user_code`/`device_code` lets an attacker hijack a
   // pending CLI login. Not covered by the wildcard `'*'` grant; admins retain
@@ -3521,9 +3677,13 @@ var SysSsoProvider = data.ObjectSchema.create({
       // for a one-time DNS-TXT challenge and reveals the ready-to-paste record
       // ONCE via `resultDialog`. Routed through the env bridge (plugin-auth /
       // cloud AuthProxyPlugin) which reshapes the `{domainVerificationToken}`
-      // response into the `{ data: { dnsRecordName, dnsRecordValue } }` envelope
-      // the dialog reads. When the feature is OFF the bridge returns a clear
-      // "not enabled for this environment" error instead of a bare 404.
+      // response into a `{ success, data: { dnsRecordName, dnsRecordValue } }`
+      // envelope. The console action runtime unwraps that envelope, so the
+      // `resultDialog` field paths are relative to the inner `data` payload
+      // (`dnsRecordName`, not `data.dnsRecordName`) — consistent with every
+      // other object's resultDialog (create_user, two-factor, OAuth). When the
+      // feature is OFF the bridge returns a clear "not enabled for this
+      // environment" error instead of a bare 404.
       target: "/api/v1/auth/admin/sso/request-domain-verification",
       params: [
         { name: "providerId", field: "provider_id", defaultFromRow: true, required: true },
@@ -3534,9 +3694,9 @@ var SysSsoProvider = data.ObjectSchema.create({
         description: "Add the DNS TXT record below at your domain\u2019s DNS provider, then run \u201CVerify Domain\u201D. The token is shown once.",
         acknowledge: "Done",
         fields: [
-          { path: "data.dnsRecordType", label: "Record type", format: "text" },
-          { path: "data.dnsRecordName", label: "Name / Host", format: "secret" },
-          { path: "data.dnsRecordValue", label: "Value", format: "secret" }
+          { path: "dnsRecordType", label: "Record type", format: "text" },
+          { path: "dnsRecordName", label: "Name / Host", format: "secret" },
+          { path: "dnsRecordValue", label: "Value", format: "secret" }
         ]
       }
     },
@@ -3768,6 +3928,13 @@ var SysNotification = data.ObjectSchema.create({
   icon: "bell",
   isSystem: true,
   managedBy: "system",
+  // ADR-0057: one 90d window across the whole notification pipeline
+  // (event → delivery → receipt/inbox), enforced by the LifecycleService
+  // (the retired NotificationRetention sweeper kept the same default).
+  lifecycle: {
+    class: "telemetry",
+    retention: { maxAge: "90d" }
+  },
   description: "Notification events \u2014 one row per emit() (ADR-0030 Layer 2 ingress)",
   displayNameField: "topic",
   nameField: "topic",
@@ -4574,6 +4741,13 @@ var SysJobRun = data.ObjectSchema.create({
   icon: "play",
   isSystem: true,
   managedBy: "append-only",
+  // ADR-0057: run history is append-only telemetry. The platform
+  // LifecycleService is the ONE sweeper for this window (the plugin-local
+  // JobRunRetention it replaced kept the same 30d default).
+  lifecycle: {
+    class: "telemetry",
+    retention: { maxAge: "30d" }
+  },
   description: "Background job execution audit trail",
   displayNameField: "job_name",
   nameField: "job_name",
@@ -5350,12 +5524,12 @@ var SETUP_NAV_CONTRIBUTIONS = [
   {
     app: "setup",
     group: "group_access_control",
-    // Priority 300 keeps API Keys after plugin-security's Roles / Permission
+    // Priority 300 keeps API Keys after plugin-security's Positions / Permission
     // Sets (100) and plugin-sharing's Sharing Rules / Record Shares (200),
     // preserving the original menu order.
     priority: 300,
     items: [
-      // Roles / Permission Sets are contributed by @objectstack/plugin-security
+      // Positions / Permission Sets are contributed by @objectstack/plugin-security
       // and Sharing Rules / Record Shares by @objectstack/plugin-sharing
       // (ADR-0029 K2). Only API Keys (sys_api_key, an identity object owned by
       // plugin-auth) remains a platform-objects base entry here.
@@ -6118,14 +6292,64 @@ var enObjects = {
         label: "Ban Expires",
         help: "When set, the ban auto-clears at this time."
       },
+      failed_login_count: {
+        label: "Failed Login Count",
+        help: "Consecutive failed sign-in attempts; reset to 0 on success. Maintained by the auth manager."
+      },
+      locked_until: {
+        label: "Locked Until",
+        help: "When set and in the future, sign-in is rejected (brute-force lockout). Auto-clears past this time; an admin can clear it early via Unlock."
+      },
+      password_changed_at: {
+        label: "Password Changed At",
+        help: "Timestamp of the last password change. Backs password_expiry_days; system-managed."
+      },
+      phone_number: {
+        label: "Phone Number",
+        help: "Sign-in phone number (E.164 recommended). Unique per user; managed by better-auth when the phoneNumber plugin is enabled."
+      },
+      phone_number_verified: {
+        label: "Phone Verified",
+        help: "Whether the phone number has been verified (OTP verification requires SMS infrastructure; false until that ships). System-managed."
+      },
+      must_change_password: {
+        label: "Must Change Password",
+        help: "When true, the user is blocked (403 PASSWORD_EXPIRED) until they change their password. Stamped by the admin user-management routes; system-managed."
+      },
+      mfa_required_at: {
+        label: "MFA Required At",
+        help: "When enforced MFA first applied to this user (grace-period clock). Backs mfa_required; system-managed."
+      },
+      last_login_at: {
+        label: "Last Login At",
+        help: "Timestamp of the last successful sign-in. Stamped by the auth manager; system-managed."
+      },
+      last_login_ip: {
+        label: "Last Login IP",
+        help: "Client IP of the last successful sign-in (from the trusted proxy forwarded header). System-managed."
+      },
+      ai_access: {
+        label: "AI Access",
+        help: "Whether this user holds an AI seat \u2014 grants access to the in-UI AI agents (build / ask). The framework synthesizes the `ai_seat` capability from this flag (plugin-hono-server resolveCtx). Assignment is capped by the licensed / purchased seat count (enforced by @objectstack/security-enterprise AiSeatPlugin). Owned by objectql (better-auth is oblivious to this column)."
+      },
       image: {
         label: "Profile Image"
       },
       manager_id: {
-        label: "Manager"
+        label: "Manager",
+        help: "This user's direct manager. Forms the reporting chain the `own_and_reports` hierarchy scope walks (ADR-0057 / @objectstack/security-enterprise)."
       },
       primary_business_unit_id: {
-        label: "Primary Business Unit"
+        label: "Primary Business Unit",
+        help: "The user's primary business unit \u2014 a denormalised projection of sys_business_unit_member.is_primary, maintained by plugin-sharing (ADR-0057 addendum D12). Lets a user-lookup filter candidates by business unit without traversing the membership junction. Do not edit directly; set it via business-unit membership."
+      },
+      source: {
+        label: "Identity Source",
+        help: "How this identity was created \u2014 idp_provisioned (federated SSO JIT) or env_native (local signup / app end-user). System-managed; do not edit.",
+        options: {
+          idp_provisioned: "IdP-Provisioned",
+          env_native: "Env-Native"
+        }
       },
       id: {
         label: "User ID"
@@ -6168,6 +6392,14 @@ var enObjects = {
         label: "Unban User",
         successMessage: "User unbanned"
       },
+      unlock_user: {
+        label: "Unlock Account",
+        successMessage: "Account unlocked"
+      },
+      create_user: {
+        label: "Create User",
+        successMessage: "User created"
+      },
       set_user_password: {
         label: "Set Password",
         successMessage: "Password updated"
@@ -6229,6 +6461,18 @@ var enObjects = {
       expires_at: {
         label: "Expires At"
       },
+      last_activity_at: {
+        label: "Last Activity At",
+        help: "Timestamp of the last request on this session; drives idle-timeout. System-managed."
+      },
+      revoked_at: {
+        label: "Revoked At",
+        help: "When set, this session was revoked (idle / absolute-max / concurrent-cap / admin). System-managed."
+      },
+      revoke_reason: {
+        label: "Revoke Reason",
+        help: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, \u2026)."
+      },
       active_organization_id: {
         label: "Active Organization"
       },
@@ -6327,6 +6571,10 @@ var enObjects = {
       password: {
         label: "Password Hash",
         help: "Hashed password for email/password provider"
+      },
+      previous_password_hashes: {
+        label: "Previous Password Hashes",
+        help: "JSON array of prior password hashes (bounded by password_history_count); reuse-prevention only. System-managed."
       }
     },
     _views: {
@@ -6397,6 +6645,10 @@ var enObjects = {
         label: "Metadata",
         help: "JSON-serialized organization metadata"
       },
+      require_mfa: {
+        label: "Require Multi-Factor Auth",
+        help: "When true, every member of this organization must enroll an authenticator app to access data."
+      },
       id: {
         label: "Organization ID"
       },
@@ -6721,6 +6973,9 @@ var enObjects = {
       }
     },
     _views: {
+      org_chart: {
+        label: "Org Chart"
+      },
       active: {
         label: "Active"
       },
@@ -7302,263 +7557,57 @@ var enObjects = {
       }
     }
   },
-  sys_audit_log: {
-    label: "Audit Log",
-    pluralLabel: "Audit Logs",
-    description: "Immutable audit trail for platform events",
-    fields: {
-      created_at: {
-        label: "Timestamp"
-      },
-      action: {
-        label: "Action",
-        help: "Action type (snake_case)",
-        options: {
-          create: "create",
-          update: "update",
-          delete: "delete",
-          restore: "restore",
-          login: "login",
-          logout: "logout",
-          permission_change: "permission_change",
-          config_change: "config_change",
-          export: "export",
-          import: "import"
-        }
-      },
-      user_id: {
-        label: "Actor",
-        help: "User who performed the action (null for system actions)"
-      },
-      object_name: {
-        label: "Object",
-        help: "Target object (e.g. sys_user, project_task)"
-      },
-      record_id: {
-        label: "Record ID",
-        help: "ID of the affected record"
-      },
-      old_value: {
-        label: "Old Value",
-        help: "JSON-serialized previous state"
-      },
-      new_value: {
-        label: "New Value",
-        help: "JSON-serialized new state"
-      },
-      ip_address: {
-        label: "IP Address"
-      },
-      user_agent: {
-        label: "User Agent"
-      },
-      tenant_id: {
-        label: "Tenant",
-        help: "Tenant context for multi-tenant isolation"
-      },
-      metadata: {
-        label: "Metadata",
-        help: "JSON-serialized additional context"
-      },
-      id: {
-        label: "Audit Log ID"
-      }
-    },
-    _views: {
-      recent: {
-        label: "Recent"
-      },
-      writes_only: {
-        label: "Writes"
-      },
-      auth_events: {
-        label: "Auth"
-      },
-      config_changes: {
-        label: "Config"
-      },
-      all_events: {
-        label: "All"
-      }
-    }
-  },
-  sys_presence: {
-    label: "Presence",
-    pluralLabel: "Presences",
-    description: "Real-time user presence and activity tracking",
+  sys_notification: {
+    label: "Notification",
+    pluralLabel: "Notifications",
+    description: "Per-user notification inbox entries",
     fields: {
       id: {
-        label: "Presence ID"
-      },
-      created_at: {
-        label: "Created At"
-      },
-      updated_at: {
-        label: "Updated At"
-      },
-      user_id: {
-        label: "User"
-      },
-      session_id: {
-        label: "Session"
-      },
-      status: {
-        label: "Status",
-        options: {
-          online: "Online",
-          away: "Away",
-          busy: "Busy",
-          offline: "Offline"
-        }
+        label: "Notification ID"
       },
-      last_seen: {
-        label: "Last Seen"
+      topic: {
+        label: "Topic",
+        help: "Notification topic, e.g. task.assigned, collab.mention"
       },
-      current_location: {
-        label: "Current Location"
+      payload: {
+        label: "Payload",
+        help: "Template inputs carried to channels (title/body/url/actor/source/\u2026)"
       },
-      device: {
-        label: "Device",
+      severity: {
+        label: "Severity",
+        help: "Severity hint for rendering / filtering",
         options: {
-          desktop: "Desktop",
-          mobile: "Mobile",
-          tablet: "Tablet",
-          other: "Other"
+          info: "info",
+          warning: "warning",
+          critical: "critical"
         }
       },
-      custom_status: {
-        label: "Custom Status"
-      },
-      metadata: {
-        label: "Metadata",
-        help: "Arbitrary JSON metadata associated with the presence state (matches PresenceStateSchema.metadata)."
-      }
-    }
-  },
-  sys_activity: {
-    label: "Activity",
-    pluralLabel: "Activities",
-    description: "Recent activity stream entries (lightweight, denormalized)",
-    fields: {
-      id: {
-        label: "Activity ID"
-      },
-      timestamp: {
-        label: "Timestamp"
+      dedup_key: {
+        label: "Dedup Key",
+        help: "Idempotency key within a topic window; a repeat emit is a no-op"
       },
-      type: {
-        label: "Type",
-        options: {
-          created: "created",
-          updated: "updated",
-          deleted: "deleted",
-          commented: "commented",
-          mentioned: "mentioned",
-          shared: "shared",
-          assigned: "assigned",
-          completed: "completed",
-          login: "login",
-          logout: "logout",
-          system: "system"
-        }
+      source_object: {
+        label: "Source Object",
+        help: "Object name of the related record (e.g. lead, opportunity)"
       },
-      summary: {
-        label: "Summary",
-        help: "Human-readable one-line summary"
+      source_id: {
+        label: "Source Record",
+        help: "Record id within source_object"
       },
       actor_id: {
-        label: "Actor"
-      },
-      actor_name: {
-        label: "Actor Name"
-      },
-      actor_avatar_url: {
-        label: "Actor Avatar"
-      },
-      object_name: {
-        label: "Object",
-        help: "Target object short name (e.g. account, sys_user)"
-      },
-      record_id: {
-        label: "Record ID"
-      },
-      record_label: {
-        label: "Record Label",
-        help: "Display label of the target record at write time"
-      },
-      url: {
-        label: "URL",
-        help: "Optional deep-link to the activity target"
-      },
-      environment_id: {
-        label: "Project",
-        help: "Environment context (multi-environment deployments)"
-      },
-      metadata: {
-        label: "Metadata",
-        help: "JSON-serialized additional context"
-      }
-    }
-  },
-  sys_comment: {
-    label: "Comment",
-    pluralLabel: "Comments",
-    description: "Threaded comments attached to records via thread_id",
-    fields: {
-      id: {
-        label: "Comment ID"
-      },
-      thread_id: {
-        label: "Thread",
-        help: "Thread identifier \u2014 conventionally `{object}:{record_id}` (e.g. `sys_user:abc123`)"
-      },
-      parent_id: {
-        label: "Parent Comment",
-        help: "Optional parent comment for nested replies"
-      },
-      reply_count: {
-        label: "Reply Count"
-      },
-      author_id: {
-        label: "Author"
-      },
-      author_name: {
-        label: "Author Name"
-      },
-      author_avatar_url: {
-        label: "Author Avatar"
-      },
-      body: {
-        label: "Body",
-        help: "Comment text (Markdown supported)"
-      },
-      mentions: {
-        label: "Mentions",
-        help: "JSON array of @mention objects"
-      },
-      reactions: {
-        label: "Reactions",
-        help: "JSON array of emoji reaction objects"
-      },
-      is_edited: {
-        label: "Edited"
-      },
-      edited_at: {
-        label: "Edited At"
-      },
-      visibility: {
-        label: "Visibility",
-        options: {
-          public: "public",
-          internal: "internal",
-          private: "private"
-        }
+        label: "Actor",
+        help: "User who caused the notification (mentioner, assigner)"
       },
       created_at: {
         label: "Created At"
+      }
+    },
+    _views: {
+      recent: {
+        label: "Recent"
       },
-      updated_at: {
-        label: "Updated At"
+      by_topic: {
+        label: "By Topic"
       }
     }
   },
@@ -7623,67 +7672,13 @@ var enObjects = {
       }
     }
   },
-  sys_notification: {
-    label: "Notification",
-    pluralLabel: "Notifications",
-    description: "Per-user notification inbox entries",
+  sys_email: {
+    label: "Email",
+    pluralLabel: "Emails",
+    description: "Outbound email delivery log",
     fields: {
       id: {
-        label: "Notification ID"
-      },
-      topic: {
-        label: "Topic",
-        help: "Notification topic, e.g. task.assigned, collab.mention"
-      },
-      payload: {
-        label: "Payload",
-        help: "Template inputs carried to channels (title/body/url/actor/source/\u2026)"
-      },
-      severity: {
-        label: "Severity",
-        help: "Severity hint for rendering / filtering",
-        options: {
-          info: "info",
-          warning: "warning",
-          critical: "critical"
-        }
-      },
-      dedup_key: {
-        label: "Dedup Key",
-        help: "Idempotency key within a topic window; a repeat emit is a no-op"
-      },
-      source_object: {
-        label: "Source Object",
-        help: "Object name of the related record (e.g. lead, opportunity)"
-      },
-      source_id: {
-        label: "Source Record",
-        help: "Record id within source_object"
-      },
-      actor_id: {
-        label: "Actor",
-        help: "User who caused the notification (mentioner, assigner)"
-      },
-      created_at: {
-        label: "Created At"
-      }
-    },
-    _views: {
-      recent: {
-        label: "Recent"
-      },
-      by_topic: {
-        label: "By Topic"
-      }
-    }
-  },
-  sys_email: {
-    label: "Email",
-    pluralLabel: "Emails",
-    description: "Outbound email delivery log",
-    fields: {
-      id: {
-        label: "Email ID"
+        label: "Email ID"
       },
       message_id: {
         label: "Message-ID",
@@ -8581,6 +8576,11 @@ var enObjects = {
         label: "Ciphertext",
         help: "Provider-encoded ciphertext blob (base64 / JSON). Implementation-defined; only the matching ICryptoProvider can read it."
       }
+    },
+    _views: {
+      all: {
+        label: "All Secrets"
+      }
     }
   },
   sys_setting_audit: {
@@ -8656,6 +8656,11 @@ var enObjects = {
         label: "Request ID",
         help: "Correlates with sys_audit_log / tracing."
       }
+    },
+    _views: {
+      recent: {
+        label: "Recent"
+      }
     }
   }
 };
@@ -8708,7 +8713,7 @@ var en = {
         nav_organizations: { label: "Organizations" },
         nav_invitations: { label: "Invitations" },
         // Access Control
-        nav_roles: { label: "Roles" },
+        nav_positions: { label: "Positions" },
         nav_permission_sets: { label: "Permission Sets" },
         nav_sharing_rules: { label: "Sharing Rules" },
         nav_record_shares: { label: "Record Shares" },
@@ -8865,14 +8870,64 @@ var zhCNObjects = {
         label: "\u5C01\u7981\u5230\u671F\u65F6\u95F4",
         help: "\u8BBE\u7F6E\u540E\uFF0C\u5230\u8FBE\u8BE5\u65F6\u95F4\u4F1A\u81EA\u52A8\u89E3\u9664\u5C01\u7981\u3002"
       },
+      failed_login_count: {
+        label: "Failed Login Count",
+        help: "Consecutive failed sign-in attempts; reset to 0 on success. Maintained by the auth manager."
+      },
+      locked_until: {
+        label: "Locked Until",
+        help: "When set and in the future, sign-in is rejected (brute-force lockout). Auto-clears past this time; an admin can clear it early via Unlock."
+      },
+      password_changed_at: {
+        label: "Password Changed At",
+        help: "Timestamp of the last password change. Backs password_expiry_days; system-managed."
+      },
+      phone_number: {
+        label: "Phone Number",
+        help: "Sign-in phone number (E.164 recommended). Unique per user; managed by better-auth when the phoneNumber plugin is enabled."
+      },
+      phone_number_verified: {
+        label: "Phone Verified",
+        help: "Whether the phone number has been verified (OTP verification requires SMS infrastructure; false until that ships). System-managed."
+      },
+      must_change_password: {
+        label: "Must Change Password",
+        help: "When true, the user is blocked (403 PASSWORD_EXPIRED) until they change their password. Stamped by the admin user-management routes; system-managed."
+      },
+      mfa_required_at: {
+        label: "MFA Required At",
+        help: "When enforced MFA first applied to this user (grace-period clock). Backs mfa_required; system-managed."
+      },
+      last_login_at: {
+        label: "Last Login At",
+        help: "Timestamp of the last successful sign-in. Stamped by the auth manager; system-managed."
+      },
+      last_login_ip: {
+        label: "Last Login IP",
+        help: "Client IP of the last successful sign-in (from the trusted proxy forwarded header). System-managed."
+      },
+      ai_access: {
+        label: "AI Access",
+        help: "Whether this user holds an AI seat \u2014 grants access to the in-UI AI agents (build / ask). The framework synthesizes the `ai_seat` capability from this flag (plugin-hono-server resolveCtx). Assignment is capped by the licensed / purchased seat count (enforced by @objectstack/security-enterprise AiSeatPlugin). Owned by objectql (better-auth is oblivious to this column)."
+      },
       image: {
         label: "\u5934\u50CF"
       },
       manager_id: {
-        label: "\u7ECF\u7406"
+        label: "\u7ECF\u7406",
+        help: "This user's direct manager. Forms the reporting chain the `own_and_reports` hierarchy scope walks (ADR-0057 / @objectstack/security-enterprise)."
       },
       primary_business_unit_id: {
-        label: "\u4E3B\u5C5E\u4E1A\u52A1\u5355\u5143"
+        label: "\u4E3B\u5C5E\u4E1A\u52A1\u5355\u5143",
+        help: "The user's primary business unit \u2014 a denormalised projection of sys_business_unit_member.is_primary, maintained by plugin-sharing (ADR-0057 addendum D12). Lets a user-lookup filter candidates by business unit without traversing the membership junction. Do not edit directly; set it via business-unit membership."
+      },
+      source: {
+        label: "Identity Source",
+        help: "How this identity was created \u2014 idp_provisioned (federated SSO JIT) or env_native (local signup / app end-user). System-managed; do not edit.",
+        options: {
+          idp_provisioned: "IdP-Provisioned",
+          env_native: "Env-Native"
+        }
       },
       id: {
         label: "\u7528\u6237 ID"
@@ -8915,6 +8970,14 @@ var zhCNObjects = {
         label: "\u89E3\u9664\u5C01\u7981",
         successMessage: "\u7528\u6237\u5DF2\u89E3\u9664\u5C01\u7981"
       },
+      unlock_user: {
+        label: "Unlock Account",
+        successMessage: "Account unlocked"
+      },
+      create_user: {
+        label: "Create User",
+        successMessage: "User created"
+      },
       set_user_password: {
         label: "\u8BBE\u7F6E\u5BC6\u7801",
         successMessage: "\u5BC6\u7801\u5DF2\u66F4\u65B0"
@@ -8976,6 +9039,18 @@ var zhCNObjects = {
       expires_at: {
         label: "\u8FC7\u671F\u65F6\u95F4"
       },
+      last_activity_at: {
+        label: "Last Activity At",
+        help: "Timestamp of the last request on this session; drives idle-timeout. System-managed."
+      },
+      revoked_at: {
+        label: "Revoked At",
+        help: "When set, this session was revoked (idle / absolute-max / concurrent-cap / admin). System-managed."
+      },
+      revoke_reason: {
+        label: "Revoke Reason",
+        help: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, \u2026)."
+      },
       active_organization_id: {
         label: "\u5F53\u524D\u7EC4\u7EC7"
       },
@@ -9074,6 +9149,10 @@ var zhCNObjects = {
       password: {
         label: "\u5BC6\u7801\u54C8\u5E0C",
         help: "\u90AE\u7BB1/\u5BC6\u7801\u63D0\u4F9B\u65B9\u4F7F\u7528\u7684\u5BC6\u7801\u54C8\u5E0C"
+      },
+      previous_password_hashes: {
+        label: "Previous Password Hashes",
+        help: "JSON array of prior password hashes (bounded by password_history_count); reuse-prevention only. System-managed."
       }
     },
     _views: {
@@ -9144,6 +9223,10 @@ var zhCNObjects = {
         label: "\u5143\u6570\u636E",
         help: "JSON \u5E8F\u5217\u5316\u7684\u7EC4\u7EC7\u5143\u6570\u636E"
       },
+      require_mfa: {
+        label: "Require Multi-Factor Auth",
+        help: "When true, every member of this organization must enroll an authenticator app to access data."
+      },
       id: {
         label: "\u7EC4\u7EC7 ID"
       },
@@ -9468,6 +9551,9 @@ var zhCNObjects = {
       }
     },
     _views: {
+      org_chart: {
+        label: "Org Chart"
+      },
       active: {
         label: "\u542F\u7528"
       },
@@ -10049,263 +10135,57 @@ var zhCNObjects = {
       }
     }
   },
-  sys_audit_log: {
-    label: "\u5BA1\u8BA1\u65E5\u5FD7",
-    pluralLabel: "\u5BA1\u8BA1\u65E5\u5FD7",
-    description: "\u5E73\u53F0\u4E8B\u4EF6\u7684\u4E0D\u53EF\u53D8\u5BA1\u8BA1\u8FFD\u8E2A",
-    fields: {
-      created_at: {
-        label: "\u65F6\u95F4\u6233"
-      },
-      action: {
-        label: "\u64CD\u4F5C",
-        help: "\u64CD\u4F5C\u7C7B\u578B\uFF08snake_case\uFF09",
-        options: {
-          create: "\u521B\u5EFA",
-          update: "\u66F4\u65B0",
-          delete: "\u5220\u9664",
-          restore: "\u6062\u590D",
-          login: "\u767B\u5F55",
-          logout: "\u767B\u51FA",
-          permission_change: "\u6743\u9650\u53D8\u66F4",
-          config_change: "\u914D\u7F6E\u53D8\u66F4",
-          export: "\u5BFC\u51FA",
-          import: "\u5BFC\u5165"
-        }
-      },
-      user_id: {
-        label: "\u6267\u884C\u4EBA",
-        help: "\u6267\u884C\u8BE5\u64CD\u4F5C\u7684\u7528\u6237\uFF08\u7CFB\u7EDF\u64CD\u4F5C\u65F6\u4E3A null\uFF09"
-      },
-      object_name: {
-        label: "\u5BF9\u8C61",
-        help: "\u76EE\u6807\u5BF9\u8C61\uFF08\u4F8B\u5982 sys_user\u3001project_task\uFF09"
-      },
-      record_id: {
-        label: "\u8BB0\u5F55 ID",
-        help: "\u53D7\u5F71\u54CD\u8BB0\u5F55\u7684 ID"
-      },
-      old_value: {
-        label: "\u65E7\u503C",
-        help: "\u65E7\u72B6\u6001\u7684 JSON \u5E8F\u5217\u5316\u5185\u5BB9"
-      },
-      new_value: {
-        label: "\u65B0\u503C",
-        help: "\u65B0\u72B6\u6001\u7684 JSON \u5E8F\u5217\u5316\u5185\u5BB9"
-      },
-      ip_address: {
-        label: "IP \u5730\u5740"
-      },
-      user_agent: {
-        label: "\u7528\u6237\u4EE3\u7406"
-      },
-      tenant_id: {
-        label: "\u79DF\u6237",
-        help: "\u7528\u4E8E\u591A\u79DF\u6237\u9694\u79BB\u7684\u79DF\u6237\u4E0A\u4E0B\u6587"
-      },
-      metadata: {
-        label: "\u5143\u6570\u636E",
-        help: "\u9644\u52A0\u4E0A\u4E0B\u6587\u7684 JSON \u5E8F\u5217\u5316\u5185\u5BB9"
-      },
-      id: {
-        label: "\u5BA1\u8BA1\u65E5\u5FD7 ID"
-      }
-    },
-    _views: {
-      recent: {
-        label: "\u6700\u8FD1"
-      },
-      writes_only: {
-        label: "\u5199\u5165"
-      },
-      auth_events: {
-        label: "\u8BA4\u8BC1"
-      },
-      config_changes: {
-        label: "\u914D\u7F6E"
-      },
-      all_events: {
-        label: "\u5168\u90E8"
-      }
-    }
-  },
-  sys_presence: {
-    label: "\u5728\u7EBF\u72B6\u6001",
-    pluralLabel: "\u5728\u7EBF\u72B6\u6001",
-    description: "\u5B9E\u65F6\u7528\u6237\u5728\u7EBF\u4E0E\u6D3B\u52A8\u8DDF\u8E2A",
+  sys_notification: {
+    label: "\u901A\u77E5",
+    pluralLabel: "\u901A\u77E5",
+    description: "\u6309\u7528\u6237\u5B58\u50A8\u7684\u901A\u77E5\u6536\u4EF6\u7BB1\u6761\u76EE",
     fields: {
       id: {
-        label: "\u5728\u7EBF\u72B6\u6001 ID"
-      },
-      created_at: {
-        label: "\u521B\u5EFA\u65F6\u95F4"
-      },
-      updated_at: {
-        label: "\u66F4\u65B0\u65F6\u95F4"
-      },
-      user_id: {
-        label: "\u7528\u6237"
-      },
-      session_id: {
-        label: "\u4F1A\u8BDD"
-      },
-      status: {
-        label: "\u72B6\u6001",
-        options: {
-          online: "\u5728\u7EBF",
-          away: "\u79BB\u5F00",
-          busy: "\u5FD9\u788C",
-          offline: "\u79BB\u7EBF"
-        }
+        label: "\u901A\u77E5 ID"
       },
-      last_seen: {
-        label: "\u6700\u8FD1\u5728\u7EBF\u65F6\u95F4"
+      topic: {
+        label: "Topic",
+        help: "Notification topic, e.g. task.assigned, collab.mention"
       },
-      current_location: {
-        label: "\u5F53\u524D\u4F4D\u7F6E"
+      payload: {
+        label: "Payload",
+        help: "Template inputs carried to channels (title/body/url/actor/source/\u2026)"
       },
-      device: {
-        label: "\u8BBE\u5907",
+      severity: {
+        label: "Severity",
+        help: "Severity hint for rendering / filtering",
         options: {
-          desktop: "\u684C\u9762\u7AEF",
-          mobile: "\u79FB\u52A8\u7AEF",
-          tablet: "\u5E73\u677F\u7AEF",
-          other: "\u5176\u4ED6"
+          info: "info",
+          warning: "warning",
+          critical: "critical"
         }
       },
-      custom_status: {
-        label: "\u81EA\u5B9A\u4E49\u72B6\u6001"
-      },
-      metadata: {
-        label: "\u5143\u6570\u636E",
-        help: "\u4E0E\u5728\u7EBF\u72B6\u6001\u5173\u8054\u7684\u4EFB\u610F JSON \u5143\u6570\u636E\uFF08\u5BF9\u5E94 PresenceStateSchema.metadata\uFF09\u3002"
-      }
-    }
-  },
-  sys_activity: {
-    label: "\u6D3B\u52A8",
-    pluralLabel: "\u6D3B\u52A8",
-    description: "\u6700\u8FD1\u6D3B\u52A8\u6D41\u6761\u76EE\uFF08\u8F7B\u91CF\u3001\u53BB\u89C4\u8303\u5316\uFF09",
-    fields: {
-      id: {
-        label: "\u6D3B\u52A8 ID"
-      },
-      timestamp: {
-        label: "\u65F6\u95F4\u6233"
+      dedup_key: {
+        label: "Dedup Key",
+        help: "Idempotency key within a topic window; a repeat emit is a no-op"
       },
-      type: {
-        label: "\u7C7B\u578B",
-        options: {
-          created: "\u5DF2\u521B\u5EFA",
-          updated: "\u5DF2\u66F4\u65B0",
-          deleted: "\u5DF2\u5220\u9664",
-          commented: "\u5DF2\u8BC4\u8BBA",
-          mentioned: "\u88AB\u63D0\u53CA",
-          shared: "\u5DF2\u5171\u4EAB",
-          assigned: "\u5DF2\u5206\u914D",
-          completed: "\u5DF2\u5B8C\u6210",
-          login: "\u767B\u5F55",
-          logout: "\u767B\u51FA",
-          system: "\u7CFB\u7EDF"
-        }
+      source_object: {
+        label: "\u6765\u6E90\u5BF9\u8C61",
+        help: "\u5173\u8054\u8BB0\u5F55\u7684\u5BF9\u8C61\u540D\u79F0\uFF08\u4F8B\u5982 lead\u3001opportunity\uFF09"
       },
-      summary: {
-        label: "\u6458\u8981",
-        help: "\u4EBA\u7C7B\u53EF\u8BFB\u7684\u5355\u884C\u6458\u8981"
+      source_id: {
+        label: "\u6765\u6E90\u8BB0\u5F55",
+        help: "source_object \u4E2D\u7684\u8BB0\u5F55 ID"
       },
       actor_id: {
-        label: "\u6267\u884C\u4EBA"
-      },
-      actor_name: {
-        label: "\u6267\u884C\u4EBA\u540D\u79F0"
-      },
-      actor_avatar_url: {
-        label: "\u6267\u884C\u4EBA\u5934\u50CF"
-      },
-      object_name: {
-        label: "\u5BF9\u8C61",
-        help: "\u76EE\u6807\u5BF9\u8C61\u77ED\u540D\u79F0\uFF08\u4F8B\u5982 account\u3001sys_user\uFF09"
-      },
-      record_id: {
-        label: "\u8BB0\u5F55 ID"
-      },
-      record_label: {
-        label: "\u8BB0\u5F55\u6807\u7B7E",
-        help: "\u5199\u5165\u65F6\u76EE\u6807\u8BB0\u5F55\u7684\u663E\u793A\u6807\u7B7E"
-      },
-      url: {
-        label: "URL",
-        help: "\u6307\u5411\u6D3B\u52A8\u76EE\u6807\u7684\u53EF\u9009\u6DF1\u5EA6\u94FE\u63A5"
-      },
-      environment_id: {
-        label: "\u9879\u76EE",
-        help: "\u9879\u76EE\u4E0A\u4E0B\u6587\uFF08\u591A\u9879\u76EE\u90E8\u7F72\uFF09"
-      },
-      metadata: {
-        label: "\u5143\u6570\u636E",
-        help: "\u9644\u52A0\u4E0A\u4E0B\u6587\u7684 JSON \u5E8F\u5217\u5316\u5185\u5BB9"
-      }
-    }
-  },
-  sys_comment: {
-    label: "\u8BC4\u8BBA",
-    pluralLabel: "\u8BC4\u8BBA",
-    description: "\u901A\u8FC7 thread_id \u9644\u52A0\u5230\u8BB0\u5F55\u7684\u7EBF\u7A0B\u5316\u8BC4\u8BBA",
-    fields: {
-      id: {
-        label: "\u8BC4\u8BBA ID"
-      },
-      thread_id: {
-        label: "\u7EBF\u7A0B",
-        help: "\u7EBF\u7A0B\u6807\u8BC6\u2014\u2014\u7EA6\u5B9A\u683C\u5F0F\u4E3A `{object}:{record_id}`\uFF08\u4F8B\u5982 `sys_user:abc123`\uFF09"
-      },
-      parent_id: {
-        label: "\u7236\u8BC4\u8BBA",
-        help: "\u53EF\u9009\u7684\u7236\u8BC4\u8BBA\uFF0C\u7528\u4E8E\u5D4C\u5957\u56DE\u590D"
-      },
-      reply_count: {
-        label: "\u56DE\u590D\u6570"
-      },
-      author_id: {
-        label: "\u4F5C\u8005"
-      },
-      author_name: {
-        label: "\u4F5C\u8005\u540D\u79F0"
-      },
-      author_avatar_url: {
-        label: "\u4F5C\u8005\u5934\u50CF"
-      },
-      body: {
-        label: "\u6B63\u6587",
-        help: "\u8BC4\u8BBA\u6587\u672C\uFF08\u652F\u6301 Markdown\uFF09"
-      },
-      mentions: {
-        label: "\u63D0\u53CA",
-        help: "@mention \u5BF9\u8C61\u7684 JSON \u6570\u7EC4"
-      },
-      reactions: {
-        label: "\u56DE\u5E94",
-        help: "\u8868\u60C5\u56DE\u5E94\u5BF9\u8C61\u7684 JSON \u6570\u7EC4"
-      },
-      is_edited: {
-        label: "\u5DF2\u7F16\u8F91"
-      },
-      edited_at: {
-        label: "\u7F16\u8F91\u65F6\u95F4"
-      },
-      visibility: {
-        label: "\u53EF\u89C1\u6027",
-        options: {
-          public: "\u516C\u5F00",
-          internal: "\u5185\u90E8",
-          private: "\u79C1\u6709"
-        }
+        label: "\u6267\u884C\u4EBA",
+        help: "\u89E6\u53D1\u8BE5\u901A\u77E5\u7684\u7528\u6237\uFF08\u63D0\u53CA\u4EBA\u3001\u5206\u914D\u4EBA\uFF09"
       },
       created_at: {
         label: "\u521B\u5EFA\u65F6\u95F4"
+      }
+    },
+    _views: {
+      recent: {
+        label: "Recent"
       },
-      updated_at: {
-        label: "\u66F4\u65B0\u65F6\u95F4"
+      by_topic: {
+        label: "By Topic"
       }
     }
   },
@@ -10370,74 +10250,20 @@ var zhCNObjects = {
       }
     }
   },
-  sys_notification: {
-    label: "\u901A\u77E5",
-    pluralLabel: "\u901A\u77E5",
-    description: "\u6309\u7528\u6237\u5B58\u50A8\u7684\u901A\u77E5\u6536\u4EF6\u7BB1\u6761\u76EE",
+  sys_email: {
+    label: "\u90AE\u4EF6",
+    pluralLabel: "\u90AE\u4EF6",
+    description: "\u5916\u53D1\u90AE\u4EF6\u6295\u9012\u65E5\u5FD7",
     fields: {
       id: {
-        label: "\u901A\u77E5 ID"
+        label: "\u90AE\u4EF6 ID"
       },
-      topic: {
-        label: "Topic",
-        help: "Notification topic, e.g. task.assigned, collab.mention"
+      message_id: {
+        label: "Message-ID",
+        help: "\u4F20\u8F93\u5C42\u5206\u914D\u7684 RFC-5322 Message-ID"
       },
-      payload: {
-        label: "Payload",
-        help: "Template inputs carried to channels (title/body/url/actor/source/\u2026)"
-      },
-      severity: {
-        label: "Severity",
-        help: "Severity hint for rendering / filtering",
-        options: {
-          info: "info",
-          warning: "warning",
-          critical: "critical"
-        }
-      },
-      dedup_key: {
-        label: "Dedup Key",
-        help: "Idempotency key within a topic window; a repeat emit is a no-op"
-      },
-      source_object: {
-        label: "\u6765\u6E90\u5BF9\u8C61",
-        help: "\u5173\u8054\u8BB0\u5F55\u7684\u5BF9\u8C61\u540D\u79F0\uFF08\u4F8B\u5982 lead\u3001opportunity\uFF09"
-      },
-      source_id: {
-        label: "\u6765\u6E90\u8BB0\u5F55",
-        help: "source_object \u4E2D\u7684\u8BB0\u5F55 ID"
-      },
-      actor_id: {
-        label: "\u6267\u884C\u4EBA",
-        help: "\u89E6\u53D1\u8BE5\u901A\u77E5\u7684\u7528\u6237\uFF08\u63D0\u53CA\u4EBA\u3001\u5206\u914D\u4EBA\uFF09"
-      },
-      created_at: {
-        label: "\u521B\u5EFA\u65F6\u95F4"
-      }
-    },
-    _views: {
-      recent: {
-        label: "Recent"
-      },
-      by_topic: {
-        label: "By Topic"
-      }
-    }
-  },
-  sys_email: {
-    label: "\u90AE\u4EF6",
-    pluralLabel: "\u90AE\u4EF6",
-    description: "\u5916\u53D1\u90AE\u4EF6\u6295\u9012\u65E5\u5FD7",
-    fields: {
-      id: {
-        label: "\u90AE\u4EF6 ID"
-      },
-      message_id: {
-        label: "Message-ID",
-        help: "\u4F20\u8F93\u5C42\u5206\u914D\u7684 RFC-5322 Message-ID"
-      },
-      from_address: {
-        label: "\u53D1\u4EF6\u4EBA"
+      from_address: {
+        label: "\u53D1\u4EF6\u4EBA"
       },
       to_addresses: {
         label: "\u6536\u4EF6\u4EBA",
@@ -11328,6 +11154,11 @@ var zhCNObjects = {
         label: "\u5BC6\u6587",
         help: "\u63D0\u4F9B\u65B9\u7F16\u7801\u540E\u7684\u5BC6\u6587\u6570\u636E\uFF08base64 / JSON\uFF09\u3002\u5B9E\u73B0\u5B9A\u4E49\uFF1B\u4EC5\u5339\u914D\u7684 ICryptoProvider \u53EF\u8BFB\u53D6\u3002"
       }
+    },
+    _views: {
+      all: {
+        label: "All Secrets"
+      }
     }
   },
   sys_setting_audit: {
@@ -11403,6 +11234,11 @@ var zhCNObjects = {
         label: "\u8BF7\u6C42 ID",
         help: "\u4E0E sys_audit_log / tracing \u5173\u8054\u3002"
       }
+    },
+    _views: {
+      recent: {
+        label: "Recent"
+      }
     }
   }
 };
@@ -11451,12 +11287,13 @@ var zhCN = {
         nav_teams: { label: "\u56E2\u961F" },
         nav_organizations: { label: "\u7EC4\u7EC7" },
         nav_invitations: { label: "\u9080\u8BF7" },
-        nav_roles: { label: "\u89D2\u8272" },
+        nav_positions: { label: "\u5C97\u4F4D" },
         nav_capabilities: { label: "\u80FD\u529B" },
         nav_permission_sets: { label: "\u6743\u9650\u96C6" },
         nav_sharing_rules: { label: "\u5171\u4EAB\u89C4\u5219" },
         nav_record_shares: { label: "\u8BB0\u5F55\u5171\u4EAB" },
         nav_api_keys: { label: "API \u5BC6\u94A5" },
+        nav_connect_agent: { label: "\u8FDE\u63A5\u667A\u80FD\u4F53" },
         nav_approval_processes: { label: "\u5BA1\u6279\u6D41\u7A0B" },
         nav_approval_requests: { label: "\u5BA1\u6279\u7533\u8BF7" },
         nav_approval_actions: { label: "\u5BA1\u6279\u5386\u53F2" },
@@ -11575,14 +11412,64 @@ var jaJPObjects = {
         label: "\u5229\u7528\u505C\u6B62\u671F\u9650",
         help: "\u8A2D\u5B9A\u3055\u308C\u3066\u3044\u308B\u5834\u5408\u3001\u3053\u306E\u65E5\u6642\u306B\u5229\u7528\u505C\u6B62\u304C\u81EA\u52D5\u89E3\u9664\u3055\u308C\u307E\u3059\u3002"
       },
+      failed_login_count: {
+        label: "Failed Login Count",
+        help: "Consecutive failed sign-in attempts; reset to 0 on success. Maintained by the auth manager."
+      },
+      locked_until: {
+        label: "Locked Until",
+        help: "When set and in the future, sign-in is rejected (brute-force lockout). Auto-clears past this time; an admin can clear it early via Unlock."
+      },
+      password_changed_at: {
+        label: "Password Changed At",
+        help: "Timestamp of the last password change. Backs password_expiry_days; system-managed."
+      },
+      phone_number: {
+        label: "Phone Number",
+        help: "Sign-in phone number (E.164 recommended). Unique per user; managed by better-auth when the phoneNumber plugin is enabled."
+      },
+      phone_number_verified: {
+        label: "Phone Verified",
+        help: "Whether the phone number has been verified (OTP verification requires SMS infrastructure; false until that ships). System-managed."
+      },
+      must_change_password: {
+        label: "Must Change Password",
+        help: "When true, the user is blocked (403 PASSWORD_EXPIRED) until they change their password. Stamped by the admin user-management routes; system-managed."
+      },
+      mfa_required_at: {
+        label: "MFA Required At",
+        help: "When enforced MFA first applied to this user (grace-period clock). Backs mfa_required; system-managed."
+      },
+      last_login_at: {
+        label: "Last Login At",
+        help: "Timestamp of the last successful sign-in. Stamped by the auth manager; system-managed."
+      },
+      last_login_ip: {
+        label: "Last Login IP",
+        help: "Client IP of the last successful sign-in (from the trusted proxy forwarded header). System-managed."
+      },
+      ai_access: {
+        label: "AI Access",
+        help: "Whether this user holds an AI seat \u2014 grants access to the in-UI AI agents (build / ask). The framework synthesizes the `ai_seat` capability from this flag (plugin-hono-server resolveCtx). Assignment is capped by the licensed / purchased seat count (enforced by @objectstack/security-enterprise AiSeatPlugin). Owned by objectql (better-auth is oblivious to this column)."
+      },
       image: {
         label: "\u30D7\u30ED\u30D5\u30A3\u30FC\u30EB\u753B\u50CF"
       },
       manager_id: {
-        label: "\u30DE\u30CD\u30FC\u30B8\u30E3\u30FC"
+        label: "\u30DE\u30CD\u30FC\u30B8\u30E3\u30FC",
+        help: "This user's direct manager. Forms the reporting chain the `own_and_reports` hierarchy scope walks (ADR-0057 / @objectstack/security-enterprise)."
       },
       primary_business_unit_id: {
-        label: "\u4E3B\u6240\u5C5E\u30D3\u30B8\u30CD\u30B9\u30E6\u30CB\u30C3\u30C8"
+        label: "\u4E3B\u6240\u5C5E\u30D3\u30B8\u30CD\u30B9\u30E6\u30CB\u30C3\u30C8",
+        help: "The user's primary business unit \u2014 a denormalised projection of sys_business_unit_member.is_primary, maintained by plugin-sharing (ADR-0057 addendum D12). Lets a user-lookup filter candidates by business unit without traversing the membership junction. Do not edit directly; set it via business-unit membership."
+      },
+      source: {
+        label: "Identity Source",
+        help: "How this identity was created \u2014 idp_provisioned (federated SSO JIT) or env_native (local signup / app end-user). System-managed; do not edit.",
+        options: {
+          idp_provisioned: "IdP-Provisioned",
+          env_native: "Env-Native"
+        }
       },
       id: {
         label: "\u30E6\u30FC\u30B6\u30FC ID"
@@ -11625,6 +11512,14 @@ var jaJPObjects = {
         label: "\u5229\u7528\u505C\u6B62\u3092\u89E3\u9664",
         successMessage: "\u30E6\u30FC\u30B6\u30FC\u306E\u5229\u7528\u505C\u6B62\u3092\u89E3\u9664\u3057\u307E\u3057\u305F"
       },
+      unlock_user: {
+        label: "Unlock Account",
+        successMessage: "Account unlocked"
+      },
+      create_user: {
+        label: "Create User",
+        successMessage: "User created"
+      },
       set_user_password: {
         label: "\u30D1\u30B9\u30EF\u30FC\u30C9\u3092\u8A2D\u5B9A",
         successMessage: "\u30D1\u30B9\u30EF\u30FC\u30C9\u3092\u66F4\u65B0\u3057\u307E\u3057\u305F"
@@ -11686,6 +11581,18 @@ var jaJPObjects = {
       expires_at: {
         label: "\u6709\u52B9\u671F\u9650"
       },
+      last_activity_at: {
+        label: "Last Activity At",
+        help: "Timestamp of the last request on this session; drives idle-timeout. System-managed."
+      },
+      revoked_at: {
+        label: "Revoked At",
+        help: "When set, this session was revoked (idle / absolute-max / concurrent-cap / admin). System-managed."
+      },
+      revoke_reason: {
+        label: "Revoke Reason",
+        help: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, \u2026)."
+      },
       active_organization_id: {
         label: "\u30A2\u30AF\u30C6\u30A3\u30D6\u7D44\u7E54"
       },
@@ -11784,6 +11691,10 @@ var jaJPObjects = {
       password: {
         label: "\u30D1\u30B9\u30EF\u30FC\u30C9\u30CF\u30C3\u30B7\u30E5",
         help: "\u30E1\u30FC\u30EB/\u30D1\u30B9\u30EF\u30FC\u30C9\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u7528\u306E\u30CF\u30C3\u30B7\u30E5\u5316\u30D1\u30B9\u30EF\u30FC\u30C9"
+      },
+      previous_password_hashes: {
+        label: "Previous Password Hashes",
+        help: "JSON array of prior password hashes (bounded by password_history_count); reuse-prevention only. System-managed."
       }
     },
     _views: {
@@ -11854,6 +11765,10 @@ var jaJPObjects = {
         label: "\u30E1\u30BF\u30C7\u30FC\u30BF",
         help: "JSON \u30B7\u30EA\u30A2\u30E9\u30A4\u30BA\u3055\u308C\u305F\u7D44\u7E54\u30E1\u30BF\u30C7\u30FC\u30BF"
       },
+      require_mfa: {
+        label: "Require Multi-Factor Auth",
+        help: "When true, every member of this organization must enroll an authenticator app to access data."
+      },
       id: {
         label: "\u7D44\u7E54 ID"
       },
@@ -12178,6 +12093,9 @@ var jaJPObjects = {
       }
     },
     _views: {
+      org_chart: {
+        label: "Org Chart"
+      },
       active: {
         label: "\u6709\u52B9"
       },
@@ -12759,263 +12677,57 @@ var jaJPObjects = {
       }
     }
   },
-  sys_audit_log: {
-    label: "\u76E3\u67FB\u30ED\u30B0",
-    pluralLabel: "\u76E3\u67FB\u30ED\u30B0",
-    description: "\u30D7\u30E9\u30C3\u30C8\u30D5\u30A9\u30FC\u30E0\u30A4\u30D9\u30F3\u30C8\u306E\u4E0D\u5909\u306E\u76E3\u67FB\u8A3C\u8DE1",
-    fields: {
-      created_at: {
-        label: "\u30BF\u30A4\u30E0\u30B9\u30BF\u30F3\u30D7"
-      },
-      action: {
-        label: "\u30A2\u30AF\u30B7\u30E7\u30F3",
-        help: "\u30A2\u30AF\u30B7\u30E7\u30F3\u30BF\u30A4\u30D7\uFF08snake_case\uFF09",
-        options: {
-          create: "\u4F5C\u6210",
-          update: "\u66F4\u65B0",
-          delete: "\u524A\u9664",
-          restore: "\u5FA9\u5143",
-          login: "\u30ED\u30B0\u30A4\u30F3",
-          logout: "\u30ED\u30B0\u30A2\u30A6\u30C8",
-          permission_change: "\u6A29\u9650\u5909\u66F4",
-          config_change: "\u69CB\u6210\u5909\u66F4",
-          export: "\u30A8\u30AF\u30B9\u30DD\u30FC\u30C8",
-          import: "\u30A4\u30F3\u30DD\u30FC\u30C8"
-        }
-      },
-      user_id: {
-        label: "\u64CD\u4F5C\u8005",
-        help: "\u30A2\u30AF\u30B7\u30E7\u30F3\u3092\u5B9F\u884C\u3057\u305F\u30E6\u30FC\u30B6\u30FC\uFF08\u30B7\u30B9\u30C6\u30E0\u64CD\u4F5C\u306E\u5834\u5408\u306F null\uFF09"
-      },
-      object_name: {
-        label: "\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8",
-        help: "\u5BFE\u8C61\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\uFF08\u4F8B: sys_user\u3001project_task\uFF09"
-      },
-      record_id: {
-        label: "\u30EC\u30B3\u30FC\u30C9 ID",
-        help: "\u5F71\u97FF\u3092\u53D7\u3051\u305F\u30EC\u30B3\u30FC\u30C9\u306E ID"
-      },
-      old_value: {
-        label: "\u5909\u66F4\u524D\u306E\u5024",
-        help: "JSON \u30B7\u30EA\u30A2\u30E9\u30A4\u30BA\u3055\u308C\u305F\u4EE5\u524D\u306E\u72B6\u614B"
-      },
-      new_value: {
-        label: "\u5909\u66F4\u5F8C\u306E\u5024",
-        help: "JSON \u30B7\u30EA\u30A2\u30E9\u30A4\u30BA\u3055\u308C\u305F\u65B0\u3057\u3044\u72B6\u614B"
-      },
-      ip_address: {
-        label: "IP \u30A2\u30C9\u30EC\u30B9"
-      },
-      user_agent: {
-        label: "\u30E6\u30FC\u30B6\u30FC\u30A8\u30FC\u30B8\u30A7\u30F3\u30C8"
-      },
-      tenant_id: {
-        label: "\u30C6\u30CA\u30F3\u30C8",
-        help: "\u30DE\u30EB\u30C1\u30C6\u30CA\u30F3\u30C8\u5206\u96E2\u306E\u305F\u3081\u306E\u30C6\u30CA\u30F3\u30C8\u30B3\u30F3\u30C6\u30AD\u30B9\u30C8"
-      },
-      metadata: {
-        label: "\u30E1\u30BF\u30C7\u30FC\u30BF",
-        help: "JSON \u30B7\u30EA\u30A2\u30E9\u30A4\u30BA\u3055\u308C\u305F\u8FFD\u52A0\u30B3\u30F3\u30C6\u30AD\u30B9\u30C8"
-      },
-      id: {
-        label: "\u76E3\u67FB\u30ED\u30B0 ID"
-      }
-    },
-    _views: {
-      recent: {
-        label: "\u6700\u8FD1"
-      },
-      writes_only: {
-        label: "\u66F8\u304D\u8FBC\u307F"
-      },
-      auth_events: {
-        label: "\u8A8D\u8A3C"
-      },
-      config_changes: {
-        label: "\u69CB\u6210\u5909\u66F4"
-      },
-      all_events: {
-        label: "\u3059\u3079\u3066"
-      }
-    }
-  },
-  sys_presence: {
-    label: "\u5728\u5E2D\u72B6\u6CC1",
-    pluralLabel: "\u5728\u5E2D\u72B6\u6CC1",
-    description: "\u30EA\u30A2\u30EB\u30BF\u30A4\u30E0\u306E\u30E6\u30FC\u30B6\u30FC\u5728\u5E2D\u72B6\u6CC1\u3068\u30A2\u30AF\u30C6\u30A3\u30D3\u30C6\u30A3\u8FFD\u8DE1",
+  sys_notification: {
+    label: "\u901A\u77E5",
+    pluralLabel: "\u901A\u77E5",
+    description: "\u30E6\u30FC\u30B6\u30FC\u3054\u3068\u306E\u901A\u77E5\u53D7\u4FE1\u30DC\u30C3\u30AF\u30B9\u30A8\u30F3\u30C8\u30EA",
     fields: {
       id: {
-        label: "\u5728\u5E2D ID"
-      },
-      created_at: {
-        label: "\u4F5C\u6210\u65E5\u6642"
-      },
-      updated_at: {
-        label: "\u66F4\u65B0\u65E5\u6642"
-      },
-      user_id: {
-        label: "\u30E6\u30FC\u30B6\u30FC"
-      },
-      session_id: {
-        label: "\u30BB\u30C3\u30B7\u30E7\u30F3"
-      },
-      status: {
-        label: "\u30B9\u30C6\u30FC\u30BF\u30B9",
-        options: {
-          online: "\u30AA\u30F3\u30E9\u30A4\u30F3",
-          away: "\u96E2\u5E2D\u4E2D",
-          busy: "\u53D6\u308A\u8FBC\u307F\u4E2D",
-          offline: "\u30AA\u30D5\u30E9\u30A4\u30F3"
-        }
+        label: "\u901A\u77E5 ID"
       },
-      last_seen: {
-        label: "\u6700\u7D42\u78BA\u8A8D\u65E5\u6642"
+      topic: {
+        label: "Topic",
+        help: "Notification topic, e.g. task.assigned, collab.mention"
       },
-      current_location: {
-        label: "\u73FE\u5728\u5730"
+      payload: {
+        label: "Payload",
+        help: "Template inputs carried to channels (title/body/url/actor/source/\u2026)"
       },
-      device: {
-        label: "\u30C7\u30D0\u30A4\u30B9",
+      severity: {
+        label: "Severity",
+        help: "Severity hint for rendering / filtering",
         options: {
-          desktop: "\u30C7\u30B9\u30AF\u30C8\u30C3\u30D7",
-          mobile: "\u30E2\u30D0\u30A4\u30EB",
-          tablet: "\u30BF\u30D6\u30EC\u30C3\u30C8",
-          other: "\u305D\u306E\u4ED6"
+          info: "info",
+          warning: "warning",
+          critical: "critical"
         }
       },
-      custom_status: {
-        label: "\u30AB\u30B9\u30BF\u30E0\u30B9\u30C6\u30FC\u30BF\u30B9"
-      },
-      metadata: {
-        label: "\u30E1\u30BF\u30C7\u30FC\u30BF",
-        help: "\u5728\u5E2D\u72B6\u614B\u306B\u95A2\u9023\u4ED8\u3051\u3089\u308C\u305F\u4EFB\u610F\u306E JSON \u30E1\u30BF\u30C7\u30FC\u30BF\uFF08PresenceStateSchema.metadata \u306B\u5BFE\u5FDC\uFF09\u3002"
-      }
-    }
-  },
-  sys_activity: {
-    label: "\u30A2\u30AF\u30C6\u30A3\u30D3\u30C6\u30A3",
-    pluralLabel: "\u30A2\u30AF\u30C6\u30A3\u30D3\u30C6\u30A3",
-    description: "\u6700\u8FD1\u306E\u30A2\u30AF\u30C6\u30A3\u30D3\u30C6\u30A3\u30B9\u30C8\u30EA\u30FC\u30E0\u30A8\u30F3\u30C8\u30EA\uFF08\u8EFD\u91CF\u3001\u975E\u6B63\u898F\u5316\uFF09",
-    fields: {
-      id: {
-        label: "\u30A2\u30AF\u30C6\u30A3\u30D3\u30C6\u30A3 ID"
-      },
-      timestamp: {
-        label: "\u30BF\u30A4\u30E0\u30B9\u30BF\u30F3\u30D7"
+      dedup_key: {
+        label: "Dedup Key",
+        help: "Idempotency key within a topic window; a repeat emit is a no-op"
       },
-      type: {
-        label: "\u30BF\u30A4\u30D7",
-        options: {
-          created: "\u4F5C\u6210",
-          updated: "\u66F4\u65B0",
-          deleted: "\u524A\u9664",
-          commented: "\u30B3\u30E1\u30F3\u30C8",
-          mentioned: "\u30E1\u30F3\u30B7\u30E7\u30F3",
-          shared: "\u5171\u6709",
-          assigned: "\u5272\u308A\u5F53\u3066",
-          completed: "\u5B8C\u4E86",
-          login: "\u30ED\u30B0\u30A4\u30F3",
-          logout: "\u30ED\u30B0\u30A2\u30A6\u30C8",
-          system: "\u30B7\u30B9\u30C6\u30E0"
-        }
+      source_object: {
+        label: "\u30BD\u30FC\u30B9\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8",
+        help: "\u95A2\u9023\u30EC\u30B3\u30FC\u30C9\u306E\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u540D\uFF08\u4F8B: lead\u3001opportunity\uFF09"
       },
-      summary: {
-        label: "\u30B5\u30DE\u30EA\u30FC",
-        help: "\u5224\u5225\u3057\u3084\u3059\u3044 1 \u884C\u30B5\u30DE\u30EA\u30FC"
+      source_id: {
+        label: "\u30BD\u30FC\u30B9\u30EC\u30B3\u30FC\u30C9",
+        help: "source_object \u5185\u306E\u30EC\u30B3\u30FC\u30C9 ID"
       },
       actor_id: {
-        label: "\u64CD\u4F5C\u8005"
-      },
-      actor_name: {
-        label: "\u64CD\u4F5C\u8005\u540D"
-      },
-      actor_avatar_url: {
-        label: "\u64CD\u4F5C\u8005\u30A2\u30D0\u30BF\u30FC"
-      },
-      object_name: {
-        label: "\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8",
-        help: "\u5BFE\u8C61\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u306E\u77ED\u3044\u540D\u524D\uFF08\u4F8B: account\u3001sys_user\uFF09"
-      },
-      record_id: {
-        label: "\u30EC\u30B3\u30FC\u30C9 ID"
-      },
-      record_label: {
-        label: "\u30EC\u30B3\u30FC\u30C9\u8868\u793A\u540D",
-        help: "\u66F8\u304D\u8FBC\u307F\u6642\u70B9\u306E\u5BFE\u8C61\u30EC\u30B3\u30FC\u30C9\u306E\u8868\u793A\u540D"
-      },
-      url: {
-        label: "URL",
-        help: "\u30A2\u30AF\u30C6\u30A3\u30D3\u30C6\u30A3\u30BF\u30FC\u30B2\u30C3\u30C8\u3078\u306E\u30AA\u30D7\u30B7\u30E7\u30F3\u306E\u30C7\u30A3\u30FC\u30D7\u30EA\u30F3\u30AF"
-      },
-      environment_id: {
-        label: "\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8",
-        help: "\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u30B3\u30F3\u30C6\u30AD\u30B9\u30C8\uFF08\u30DE\u30EB\u30C1\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u30C7\u30D7\u30ED\u30A4\u30E1\u30F3\u30C8\uFF09"
-      },
-      metadata: {
-        label: "\u30E1\u30BF\u30C7\u30FC\u30BF",
-        help: "JSON \u30B7\u30EA\u30A2\u30E9\u30A4\u30BA\u3055\u308C\u305F\u8FFD\u52A0\u30B3\u30F3\u30C6\u30AD\u30B9\u30C8"
-      }
-    }
-  },
-  sys_comment: {
-    label: "\u30B3\u30E1\u30F3\u30C8",
-    pluralLabel: "\u30B3\u30E1\u30F3\u30C8",
-    description: "thread_id \u3092\u4ECB\u3057\u3066\u30EC\u30B3\u30FC\u30C9\u306B\u6DFB\u4ED8\u3055\u308C\u305F\u30B9\u30EC\u30C3\u30C9\u30B3\u30E1\u30F3\u30C8",
-    fields: {
-      id: {
-        label: "\u30B3\u30E1\u30F3\u30C8 ID"
-      },
-      thread_id: {
-        label: "\u30B9\u30EC\u30C3\u30C9",
-        help: "\u30B9\u30EC\u30C3\u30C9\u8B58\u5225\u5B50 \u2014 \u901A\u5E38\u306F `{object}:{record_id}`\uFF08\u4F8B: `sys_user:abc123`\uFF09"
-      },
-      parent_id: {
-        label: "\u89AA\u30B3\u30E1\u30F3\u30C8",
-        help: "\u30CD\u30B9\u30C8\u3057\u305F\u8FD4\u4FE1\u7528\u306E\u30AA\u30D7\u30B7\u30E7\u30F3\u306E\u89AA\u30B3\u30E1\u30F3\u30C8"
-      },
-      reply_count: {
-        label: "\u8FD4\u4FE1\u6570"
-      },
-      author_id: {
-        label: "\u6295\u7A3F\u8005"
-      },
-      author_name: {
-        label: "\u6295\u7A3F\u8005\u540D"
-      },
-      author_avatar_url: {
-        label: "\u6295\u7A3F\u8005\u30A2\u30D0\u30BF\u30FC"
-      },
-      body: {
-        label: "\u672C\u6587",
-        help: "\u30B3\u30E1\u30F3\u30C8\u30C6\u30AD\u30B9\u30C8\uFF08Markdown \u5BFE\u5FDC\uFF09"
-      },
-      mentions: {
-        label: "\u30E1\u30F3\u30B7\u30E7\u30F3",
-        help: "@\u30E1\u30F3\u30B7\u30E7\u30F3\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u306E JSON \u914D\u5217"
-      },
-      reactions: {
-        label: "\u30EA\u30A2\u30AF\u30B7\u30E7\u30F3",
-        help: "\u7D75\u6587\u5B57\u30EA\u30A2\u30AF\u30B7\u30E7\u30F3\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u306E JSON \u914D\u5217"
-      },
-      is_edited: {
-        label: "\u7DE8\u96C6\u6E08\u307F"
-      },
-      edited_at: {
-        label: "\u7DE8\u96C6\u65E5\u6642"
-      },
-      visibility: {
-        label: "\u516C\u958B\u7BC4\u56F2",
-        options: {
-          public: "\u516C\u958B",
-          internal: "\u5185\u90E8",
-          private: "\u975E\u516C\u958B"
-        }
+        label: "\u64CD\u4F5C\u8005",
+        help: "\u901A\u77E5\u3092\u5F15\u304D\u8D77\u3053\u3057\u305F\u30E6\u30FC\u30B6\u30FC\uFF08\u30E1\u30F3\u30B7\u30E7\u30F3\u8005\u3001\u62C5\u5F53\u8005\uFF09"
       },
       created_at: {
         label: "\u4F5C\u6210\u65E5\u6642"
+      }
+    },
+    _views: {
+      recent: {
+        label: "Recent"
       },
-      updated_at: {
-        label: "\u66F4\u65B0\u65E5\u6642"
+      by_topic: {
+        label: "By Topic"
       }
     }
   },
@@ -13080,74 +12792,20 @@ var jaJPObjects = {
       }
     }
   },
-  sys_notification: {
-    label: "\u901A\u77E5",
-    pluralLabel: "\u901A\u77E5",
-    description: "\u30E6\u30FC\u30B6\u30FC\u3054\u3068\u306E\u901A\u77E5\u53D7\u4FE1\u30DC\u30C3\u30AF\u30B9\u30A8\u30F3\u30C8\u30EA",
+  sys_email: {
+    label: "\u30E1\u30FC\u30EB",
+    pluralLabel: "\u30E1\u30FC\u30EB",
+    description: "\u9001\u4FE1\u30E1\u30FC\u30EB\u914D\u4FE1\u30ED\u30B0",
     fields: {
       id: {
-        label: "\u901A\u77E5 ID"
+        label: "\u30E1\u30FC\u30EB ID"
       },
-      topic: {
-        label: "Topic",
-        help: "Notification topic, e.g. task.assigned, collab.mention"
+      message_id: {
+        label: "Message-ID",
+        help: "\u30C8\u30E9\u30F3\u30B9\u30DD\u30FC\u30C8\u304C\u5272\u308A\u5F53\u3066\u308B RFC-5322 Message-ID"
       },
-      payload: {
-        label: "Payload",
-        help: "Template inputs carried to channels (title/body/url/actor/source/\u2026)"
-      },
-      severity: {
-        label: "Severity",
-        help: "Severity hint for rendering / filtering",
-        options: {
-          info: "info",
-          warning: "warning",
-          critical: "critical"
-        }
-      },
-      dedup_key: {
-        label: "Dedup Key",
-        help: "Idempotency key within a topic window; a repeat emit is a no-op"
-      },
-      source_object: {
-        label: "\u30BD\u30FC\u30B9\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8",
-        help: "\u95A2\u9023\u30EC\u30B3\u30FC\u30C9\u306E\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u540D\uFF08\u4F8B: lead\u3001opportunity\uFF09"
-      },
-      source_id: {
-        label: "\u30BD\u30FC\u30B9\u30EC\u30B3\u30FC\u30C9",
-        help: "source_object \u5185\u306E\u30EC\u30B3\u30FC\u30C9 ID"
-      },
-      actor_id: {
-        label: "\u64CD\u4F5C\u8005",
-        help: "\u901A\u77E5\u3092\u5F15\u304D\u8D77\u3053\u3057\u305F\u30E6\u30FC\u30B6\u30FC\uFF08\u30E1\u30F3\u30B7\u30E7\u30F3\u8005\u3001\u62C5\u5F53\u8005\uFF09"
-      },
-      created_at: {
-        label: "\u4F5C\u6210\u65E5\u6642"
-      }
-    },
-    _views: {
-      recent: {
-        label: "Recent"
-      },
-      by_topic: {
-        label: "By Topic"
-      }
-    }
-  },
-  sys_email: {
-    label: "\u30E1\u30FC\u30EB",
-    pluralLabel: "\u30E1\u30FC\u30EB",
-    description: "\u9001\u4FE1\u30E1\u30FC\u30EB\u914D\u4FE1\u30ED\u30B0",
-    fields: {
-      id: {
-        label: "\u30E1\u30FC\u30EB ID"
-      },
-      message_id: {
-        label: "Message-ID",
-        help: "\u30C8\u30E9\u30F3\u30B9\u30DD\u30FC\u30C8\u304C\u5272\u308A\u5F53\u3066\u308B RFC-5322 Message-ID"
-      },
-      from_address: {
-        label: "\u9001\u4FE1\u5143"
+      from_address: {
+        label: "\u9001\u4FE1\u5143"
       },
       to_addresses: {
         label: "\u5B9B\u5148",
@@ -14038,6 +13696,11 @@ var jaJPObjects = {
         label: "\u6697\u53F7\u6587",
         help: "\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u30A8\u30F3\u30B3\u30FC\u30C9\u3055\u308C\u305F\u6697\u53F7\u6587 blob\uFF08base64 / JSON\uFF09\u3002\u5B9F\u88C5\u5B9A\u7FA9\u306E\u305F\u3081\u3001\u5BFE\u5FDC\u3059\u308B ICryptoProvider \u306E\u307F\u304C\u8AAD\u307F\u53D6\u308A\u53EF\u80FD\u3002"
       }
+    },
+    _views: {
+      all: {
+        label: "All Secrets"
+      }
     }
   },
   sys_setting_audit: {
@@ -14113,6 +13776,11 @@ var jaJPObjects = {
         label: "\u30EA\u30AF\u30A8\u30B9\u30C8 ID",
         help: "sys_audit_log / \u30C8\u30EC\u30FC\u30B7\u30F3\u30B0\u3068\u306E\u76F8\u95A2\u7528\u3002"
       }
+    },
+    _views: {
+      recent: {
+        label: "Recent"
+      }
     }
   }
 };
@@ -14160,7 +13828,7 @@ var jaJP = {
         nav_teams: { label: "\u30C1\u30FC\u30E0" },
         nav_organizations: { label: "\u7D44\u7E54" },
         nav_invitations: { label: "\u62DB\u5F85" },
-        nav_roles: { label: "\u30ED\u30FC\u30EB" },
+        nav_positions: { label: "\u30DD\u30B8\u30B7\u30E7\u30F3" },
         nav_permission_sets: { label: "\u6A29\u9650\u30BB\u30C3\u30C8" },
         nav_sharing_rules: { label: "\u5171\u6709\u30EB\u30FC\u30EB" },
         nav_record_shares: { label: "\u30EC\u30B3\u30FC\u30C9\u5171\u6709" },
@@ -14282,14 +13950,64 @@ var esESObjects = {
         label: "El bloqueo caduca el",
         help: "Si se establece, el bloqueo se elimina autom\xE1ticamente en ese momento."
       },
+      failed_login_count: {
+        label: "Failed Login Count",
+        help: "Consecutive failed sign-in attempts; reset to 0 on success. Maintained by the auth manager."
+      },
+      locked_until: {
+        label: "Locked Until",
+        help: "When set and in the future, sign-in is rejected (brute-force lockout). Auto-clears past this time; an admin can clear it early via Unlock."
+      },
+      password_changed_at: {
+        label: "Password Changed At",
+        help: "Timestamp of the last password change. Backs password_expiry_days; system-managed."
+      },
+      phone_number: {
+        label: "Phone Number",
+        help: "Sign-in phone number (E.164 recommended). Unique per user; managed by better-auth when the phoneNumber plugin is enabled."
+      },
+      phone_number_verified: {
+        label: "Phone Verified",
+        help: "Whether the phone number has been verified (OTP verification requires SMS infrastructure; false until that ships). System-managed."
+      },
+      must_change_password: {
+        label: "Must Change Password",
+        help: "When true, the user is blocked (403 PASSWORD_EXPIRED) until they change their password. Stamped by the admin user-management routes; system-managed."
+      },
+      mfa_required_at: {
+        label: "MFA Required At",
+        help: "When enforced MFA first applied to this user (grace-period clock). Backs mfa_required; system-managed."
+      },
+      last_login_at: {
+        label: "Last Login At",
+        help: "Timestamp of the last successful sign-in. Stamped by the auth manager; system-managed."
+      },
+      last_login_ip: {
+        label: "Last Login IP",
+        help: "Client IP of the last successful sign-in (from the trusted proxy forwarded header). System-managed."
+      },
+      ai_access: {
+        label: "AI Access",
+        help: "Whether this user holds an AI seat \u2014 grants access to the in-UI AI agents (build / ask). The framework synthesizes the `ai_seat` capability from this flag (plugin-hono-server resolveCtx). Assignment is capped by the licensed / purchased seat count (enforced by @objectstack/security-enterprise AiSeatPlugin). Owned by objectql (better-auth is oblivious to this column)."
+      },
       image: {
         label: "Imagen de perfil"
       },
       manager_id: {
-        label: "Gerente"
+        label: "Gerente",
+        help: "This user's direct manager. Forms the reporting chain the `own_and_reports` hierarchy scope walks (ADR-0057 / @objectstack/security-enterprise)."
       },
       primary_business_unit_id: {
-        label: "Unidad de negocio principal"
+        label: "Unidad de negocio principal",
+        help: "The user's primary business unit \u2014 a denormalised projection of sys_business_unit_member.is_primary, maintained by plugin-sharing (ADR-0057 addendum D12). Lets a user-lookup filter candidates by business unit without traversing the membership junction. Do not edit directly; set it via business-unit membership."
+      },
+      source: {
+        label: "Identity Source",
+        help: "How this identity was created \u2014 idp_provisioned (federated SSO JIT) or env_native (local signup / app end-user). System-managed; do not edit.",
+        options: {
+          idp_provisioned: "IdP-Provisioned",
+          env_native: "Env-Native"
+        }
       },
       id: {
         label: "ID de usuario"
@@ -14332,6 +14050,14 @@ var esESObjects = {
         label: "Desbloquear usuario",
         successMessage: "Usuario desbloqueado"
       },
+      unlock_user: {
+        label: "Unlock Account",
+        successMessage: "Account unlocked"
+      },
+      create_user: {
+        label: "Create User",
+        successMessage: "User created"
+      },
       set_user_password: {
         label: "Establecer contrase\xF1a",
         successMessage: "Contrase\xF1a actualizada"
@@ -14393,6 +14119,18 @@ var esESObjects = {
       expires_at: {
         label: "Caduca el"
       },
+      last_activity_at: {
+        label: "Last Activity At",
+        help: "Timestamp of the last request on this session; drives idle-timeout. System-managed."
+      },
+      revoked_at: {
+        label: "Revoked At",
+        help: "When set, this session was revoked (idle / absolute-max / concurrent-cap / admin). System-managed."
+      },
+      revoke_reason: {
+        label: "Revoke Reason",
+        help: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, \u2026)."
+      },
       active_organization_id: {
         label: "Organizaci\xF3n activa"
       },
@@ -14491,6 +14229,10 @@ var esESObjects = {
       password: {
         label: "Hash de la contrase\xF1a",
         help: "Hash de la contrase\xF1a para el proveedor de correo electr\xF3nico/contrase\xF1a."
+      },
+      previous_password_hashes: {
+        label: "Previous Password Hashes",
+        help: "JSON array of prior password hashes (bounded by password_history_count); reuse-prevention only. System-managed."
       }
     },
     _views: {
@@ -14561,6 +14303,10 @@ var esESObjects = {
         label: "Metadatos",
         help: "Metadatos de la organizaci\xF3n serializados en JSON."
       },
+      require_mfa: {
+        label: "Require Multi-Factor Auth",
+        help: "When true, every member of this organization must enroll an authenticator app to access data."
+      },
       id: {
         label: "ID de organizaci\xF3n"
       },
@@ -14885,6 +14631,9 @@ var esESObjects = {
       }
     },
     _views: {
+      org_chart: {
+        label: "Org Chart"
+      },
       active: {
         label: "Activo"
       },
@@ -15466,263 +15215,57 @@ var esESObjects = {
       }
     }
   },
-  sys_audit_log: {
-    label: "Registro de auditor\xEDa",
-    pluralLabel: "Registros de auditor\xEDa",
-    description: "Registro de auditor\xEDa inmutable para eventos de la plataforma",
-    fields: {
-      created_at: {
-        label: "Marca temporal"
-      },
-      action: {
-        label: "Acci\xF3n",
-        help: "Tipo de acci\xF3n (snake_case).",
-        options: {
-          create: "Crear",
-          update: "Actualizar",
-          delete: "Eliminar",
-          restore: "Restaurar",
-          login: "Inicio de sesi\xF3n",
-          logout: "Cierre de sesi\xF3n",
-          permission_change: "Cambio de permisos",
-          config_change: "Cambio de configuraci\xF3n",
-          export: "Exportar",
-          import: "Importar"
-        }
-      },
-      user_id: {
-        label: "Actor",
-        help: "Usuario que realiz\xF3 la acci\xF3n (null para acciones del sistema)."
-      },
-      object_name: {
-        label: "Objeto",
-        help: "Objeto de destino (p. ej. sys_user, project_task)."
-      },
-      record_id: {
-        label: "ID de registro",
-        help: "ID del registro afectado."
-      },
-      old_value: {
-        label: "Valor anterior",
-        help: "Estado anterior serializado en JSON."
-      },
-      new_value: {
-        label: "Valor nuevo",
-        help: "Estado nuevo serializado en JSON."
-      },
-      ip_address: {
-        label: "Direcci\xF3n IP"
-      },
-      user_agent: {
-        label: "Agente de usuario"
-      },
-      tenant_id: {
-        label: "Inquilino",
-        help: "Contexto del tenant para el aislamiento multi-tenant."
-      },
-      metadata: {
-        label: "Metadatos",
-        help: "Contexto adicional serializado en JSON."
-      },
-      id: {
-        label: "ID de registro de auditor\xEDa"
-      }
-    },
-    _views: {
-      recent: {
-        label: "Recientes"
-      },
-      writes_only: {
-        label: "Escrituras"
-      },
-      auth_events: {
-        label: "Autenticaci\xF3n"
-      },
-      config_changes: {
-        label: "Configuraci\xF3n"
-      },
-      all_events: {
-        label: "Todos"
-      }
-    }
-  },
-  sys_presence: {
-    label: "Presencia",
-    pluralLabel: "Presencias",
-    description: "Seguimiento en tiempo real de presencia y actividad de usuarios",
+  sys_notification: {
+    label: "Notificaci\xF3n",
+    pluralLabel: "Notificaciones",
+    description: "Entradas del buz\xF3n de notificaciones por usuario",
     fields: {
       id: {
-        label: "ID de presencia"
-      },
-      created_at: {
-        label: "Creado el"
-      },
-      updated_at: {
-        label: "Actualizado el"
-      },
-      user_id: {
-        label: "Usuario"
-      },
-      session_id: {
-        label: "Sesi\xF3n"
-      },
-      status: {
-        label: "Estado",
-        options: {
-          online: "En l\xEDnea",
-          away: "Ausente",
-          busy: "Ocupado",
-          offline: "Desconectado"
-        }
+        label: "ID de notificaci\xF3n"
       },
-      last_seen: {
-        label: "Visto por \xFAltima vez"
+      topic: {
+        label: "Topic",
+        help: "Notification topic, e.g. task.assigned, collab.mention"
       },
-      current_location: {
-        label: "Ubicaci\xF3n actual"
+      payload: {
+        label: "Payload",
+        help: "Template inputs carried to channels (title/body/url/actor/source/\u2026)"
       },
-      device: {
-        label: "Dispositivo",
+      severity: {
+        label: "Severity",
+        help: "Severity hint for rendering / filtering",
         options: {
-          desktop: "Escritorio",
-          mobile: "M\xF3vil",
-          tablet: "Tableta",
-          other: "Otro"
+          info: "info",
+          warning: "warning",
+          critical: "critical"
         }
       },
-      custom_status: {
-        label: "Estado personalizado"
-      },
-      metadata: {
-        label: "Metadatos",
-        help: "Metadatos JSON arbitrarios asociados al estado de presencia (coincide con PresenceStateSchema.metadata)."
-      }
-    }
-  },
-  sys_activity: {
-    label: "Actividad",
-    pluralLabel: "Actividades",
-    description: "Entradas recientes del flujo de actividad (ligeras y desnormalizadas).",
-    fields: {
-      id: {
-        label: "ID de actividad"
-      },
-      timestamp: {
-        label: "Marca temporal"
+      dedup_key: {
+        label: "Dedup Key",
+        help: "Idempotency key within a topic window; a repeat emit is a no-op"
       },
-      type: {
-        label: "Tipo",
-        options: {
-          created: "Creado",
-          updated: "Actualizado",
-          deleted: "Eliminado",
-          commented: "Comentado",
-          mentioned: "Mencionado",
-          shared: "Compartido",
-          assigned: "Asignado",
-          completed: "Completado",
-          login: "Inicio de sesi\xF3n",
-          logout: "Cierre de sesi\xF3n",
-          system: "Sistema"
-        }
+      source_object: {
+        label: "Objeto de origen",
+        help: "Nombre del objeto del registro relacionado (p. ej. lead, opportunity)."
       },
-      summary: {
-        label: "Resumen",
-        help: "Resumen legible de una l\xEDnea."
+      source_id: {
+        label: "Registro de origen",
+        help: "ID del registro dentro de source_object."
       },
       actor_id: {
-        label: "Actor"
-      },
-      actor_name: {
-        label: "Nombre del actor"
-      },
-      actor_avatar_url: {
-        label: "Avatar del actor"
-      },
-      object_name: {
-        label: "Objeto",
-        help: "Nombre corto del objeto de destino (p. ej. account, sys_user)."
-      },
-      record_id: {
-        label: "ID de registro"
-      },
-      record_label: {
-        label: "Nombre visible del registro",
-        help: "Nombre visible del registro de destino en el momento de escritura."
-      },
-      url: {
-        label: "URL",
-        help: "Enlace profundo opcional al destino de la actividad."
-      },
-      environment_id: {
-        label: "Proyecto",
-        help: "Contexto del proyecto (implementaciones multiproyecto)."
-      },
-      metadata: {
-        label: "Metadatos",
-        help: "Contexto adicional serializado en JSON."
-      }
-    }
-  },
-  sys_comment: {
-    label: "Comentario",
-    pluralLabel: "Comentarios",
-    description: "Comentarios en hilo adjuntos a registros mediante thread_id.",
-    fields: {
-      id: {
-        label: "ID de comentario"
-      },
-      thread_id: {
-        label: "Hilo",
-        help: "Identificador del hilo; por convenci\xF3n `{object}:{record_id}` (p. ej. `sys_user:abc123`)."
-      },
-      parent_id: {
-        label: "Comentario principal",
-        help: "Comentario principal opcional para respuestas anidadas."
-      },
-      reply_count: {
-        label: "N\xFAmero de respuestas"
-      },
-      author_id: {
-        label: "Autor"
-      },
-      author_name: {
-        label: "Nombre del autor"
-      },
-      author_avatar_url: {
-        label: "Avatar del autor"
-      },
-      body: {
-        label: "Contenido",
-        help: "Texto del comentario (compatible con Markdown)."
-      },
-      mentions: {
-        label: "Menciones",
-        help: "Matriz JSON de objetos @mention."
-      },
-      reactions: {
-        label: "Reacciones",
-        help: "Matriz JSON de objetos de reacci\xF3n emoji."
-      },
-      is_edited: {
-        label: "Editado"
-      },
-      edited_at: {
-        label: "Editado el"
-      },
-      visibility: {
-        label: "Visibilidad",
-        options: {
-          public: "P\xFAblico",
-          internal: "Interno",
-          private: "Privado"
-        }
+        label: "Actor",
+        help: "Usuario que provoc\xF3 la notificaci\xF3n (quien menciona, quien asigna)."
       },
       created_at: {
         label: "Creado el"
+      }
+    },
+    _views: {
+      recent: {
+        label: "Recent"
       },
-      updated_at: {
-        label: "Actualizado el"
+      by_topic: {
+        label: "By Topic"
       }
     }
   },
@@ -15787,74 +15330,20 @@ var esESObjects = {
       }
     }
   },
-  sys_notification: {
-    label: "Notificaci\xF3n",
-    pluralLabel: "Notificaciones",
-    description: "Entradas del buz\xF3n de notificaciones por usuario",
+  sys_email: {
+    label: "Correo",
+    pluralLabel: "Correos",
+    description: "Registro de env\xEDos de correo salientes",
     fields: {
       id: {
-        label: "ID de notificaci\xF3n"
+        label: "ID de correo"
       },
-      topic: {
-        label: "Topic",
-        help: "Notification topic, e.g. task.assigned, collab.mention"
+      message_id: {
+        label: "Message-ID",
+        help: "Message-ID RFC-5322 asignado por el transporte."
       },
-      payload: {
-        label: "Payload",
-        help: "Template inputs carried to channels (title/body/url/actor/source/\u2026)"
-      },
-      severity: {
-        label: "Severity",
-        help: "Severity hint for rendering / filtering",
-        options: {
-          info: "info",
-          warning: "warning",
-          critical: "critical"
-        }
-      },
-      dedup_key: {
-        label: "Dedup Key",
-        help: "Idempotency key within a topic window; a repeat emit is a no-op"
-      },
-      source_object: {
-        label: "Objeto de origen",
-        help: "Nombre del objeto del registro relacionado (p. ej. lead, opportunity)."
-      },
-      source_id: {
-        label: "Registro de origen",
-        help: "ID del registro dentro de source_object."
-      },
-      actor_id: {
-        label: "Actor",
-        help: "Usuario que provoc\xF3 la notificaci\xF3n (quien menciona, quien asigna)."
-      },
-      created_at: {
-        label: "Creado el"
-      }
-    },
-    _views: {
-      recent: {
-        label: "Recent"
-      },
-      by_topic: {
-        label: "By Topic"
-      }
-    }
-  },
-  sys_email: {
-    label: "Correo",
-    pluralLabel: "Correos",
-    description: "Registro de env\xEDos de correo salientes",
-    fields: {
-      id: {
-        label: "ID de correo"
-      },
-      message_id: {
-        label: "Message-ID",
-        help: "Message-ID RFC-5322 asignado por el transporte."
-      },
-      from_address: {
-        label: "De"
+      from_address: {
+        label: "De"
       },
       to_addresses: {
         label: "Para",
@@ -16745,6 +16234,11 @@ var esESObjects = {
         label: "Texto cifrado",
         help: "Blob de texto cifrado codificado por el proveedor (base64 / JSON). La implementaci\xF3n lo define; solo el ICryptoProvider correspondiente puede leerlo."
       }
+    },
+    _views: {
+      all: {
+        label: "All Secrets"
+      }
     }
   },
   sys_setting_audit: {
@@ -16820,6 +16314,11 @@ var esESObjects = {
         label: "ID de solicitud",
         help: "Se correlaciona con sys_audit_log / tracing."
       }
+    },
+    _views: {
+      recent: {
+        label: "Recent"
+      }
     }
   }
 };
@@ -16867,7 +16366,7 @@ var esES = {
         nav_teams: { label: "Equipos" },
         nav_organizations: { label: "Organizaciones" },
         nav_invitations: { label: "Invitaciones" },
-        nav_roles: { label: "Roles" },
+        nav_positions: { label: "Posiciones" },
         nav_permission_sets: { label: "Conjuntos de Permisos" },
         nav_sharing_rules: { label: "Reglas de Compartici\xF3n" },
         nav_record_shares: { label: "Registros Compartidos" },
@@ -17121,6 +16620,38 @@ var SysUserDetailPage = {
         type: "line",
         position: "top",
         items: [
+          {
+            label: "Positions",
+            icon: "shield-check",
+            children: [
+              {
+                // [ADR-0090 D3] Position assignments (岗位分派) — pure SDUI:
+                // the Add picker creates sys_user_position rows storing the
+                // position's MACHINE NAME (valueField: 'name'), and every
+                // server-side rule (the D12 delegated-admin gate, audience-
+                // anchor rejection) surfaces its error in the dialog.
+                type: "record:related_list",
+                properties: {
+                  objectName: "sys_user_position",
+                  relationshipField: "user_id",
+                  columns: ["position", "business_unit_id", "granted_by", "created_at"],
+                  sort: [{ field: "created_at", order: "desc" }],
+                  limit: 25,
+                  showViewAll: true,
+                  title: "Positions",
+                  add: {
+                    picker: {
+                      object: "sys_position",
+                      valueField: "name",
+                      labelField: "label"
+                    },
+                    linkField: "position",
+                    label: "Assign position"
+                  }
+                }
+              }
+            ]
+          },
           {
             label: "Sessions",
             icon: "monitor",
@@ -17327,6 +16858,84 @@ var SysUserDetailPage = {
   }
 };
 
+// src/pages/sys-position.page.ts
+var SysPositionDetailPage = {
+  name: "sys_position_detail",
+  label: "Position",
+  type: "record",
+  object: "sys_position",
+  template: "default",
+  kind: "slotted",
+  isDefault: true,
+  regions: [],
+  slots: {
+    tabs: {
+      type: "page:tabs",
+      properties: {
+        type: "line",
+        position: "top",
+        items: [
+          {
+            label: "Holders",
+            icon: "users",
+            children: [
+              {
+                type: "record:related_list",
+                properties: {
+                  objectName: "sys_user_position",
+                  relationshipField: "position",
+                  relationshipValueField: "name",
+                  columns: ["user_id", "business_unit_id", "granted_by", "created_at"],
+                  sort: [{ field: "created_at", order: "desc" }],
+                  limit: 25,
+                  showViewAll: true,
+                  title: "Holders",
+                  add: {
+                    picker: {
+                      object: "sys_user",
+                      labelField: "name"
+                    },
+                    linkField: "user_id",
+                    label: "Assign user"
+                  }
+                }
+              }
+            ]
+          },
+          {
+            label: "Permission Sets",
+            icon: "lock",
+            children: [
+              {
+                type: "record:related_list",
+                properties: {
+                  objectName: "sys_position_permission_set",
+                  relationshipField: "position_id",
+                  columns: ["permission_set_id", "created_at"],
+                  sort: [{ field: "created_at", order: "desc" }],
+                  limit: 25,
+                  showViewAll: true,
+                  title: "Permission Sets",
+                  add: {
+                    picker: {
+                      object: "sys_permission_set",
+                      labelField: "label"
+                    },
+                    linkField: "permission_set_id",
+                    label: "Bind permission set"
+                  }
+                }
+              }
+            ]
+          }
+        ]
+      }
+    },
+    // No Chatter feed on an RBAC primitive.
+    discussion: []
+  }
+};
+
 // src/apps/translations/en.metadata-forms.generated.ts
 var enMetadataForms = {
   object: {
@@ -17592,6 +17201,70 @@ var enMetadataForms = {
       datasource: {
         label: "Datasource",
         helpText: 'Target datasource ID (default: "default")'
+      },
+      lifecycle: {
+        label: "Lifecycle",
+        helpText: "Data lifecycle contract (ADR-0057): how long rows live and how space is reclaimed. Leave empty for permanent record semantics. Non-record classes require at least one bounding policy (retention, TTL, or rotation)."
+      },
+      "lifecycle.class": {
+        label: "Class",
+        helpText: "Persistence contract for the rows of this object"
+      },
+      "lifecycle.retention": {
+        label: "Retention",
+        helpText: "Age-based retention window"
+      },
+      "lifecycle.retention.maxAge": {
+        label: "Max Age",
+        helpText: 'Rows older than this (by created_at) are reaped. Duration literal: h/d/w/y, e.g. "30d"'
+      },
+      "lifecycle.ttl": {
+        label: "Ttl",
+        helpText: "Per-row TTL expiry"
+      },
+      "lifecycle.ttl.field": {
+        label: "Field",
+        helpText: "Timestamp field the TTL is measured from (e.g. expires_at)"
+      },
+      "lifecycle.ttl.expireAfter": {
+        label: "Expire After",
+        helpText: 'Rows expire this long after the field, e.g. "1d"'
+      },
+      "lifecycle.storage": {
+        label: "Storage",
+        helpText: "Physical rotation for high-frequency telemetry (SQLite: O(1) shard DROP)"
+      },
+      "lifecycle.storage.strategy": {
+        label: "Strategy",
+        helpText: "Storage strategy"
+      },
+      "lifecycle.storage.shards": {
+        label: "Shards",
+        helpText: "Shards retained; total window = shards \xD7 unit"
+      },
+      "lifecycle.storage.unit": {
+        label: "Unit",
+        helpText: "Time width of one shard"
+      },
+      "lifecycle.archive": {
+        label: "Archive",
+        helpText: "Cold-store hand-off (audit class). Rows are never hot-deleted before the archive copy succeeded."
+      },
+      "lifecycle.archive.after": {
+        label: "After",
+        helpText: "Archive rows older than this \u2014 must equal retention.maxAge"
+      },
+      "lifecycle.archive.to": {
+        label: "To",
+        helpText: "Target datasource name for cold storage"
+      },
+      "lifecycle.archive.keep": {
+        label: "Keep",
+        helpText: 'How long the archive keeps rows (empty = forever), e.g. "7y"'
+      },
+      "lifecycle.reclaim": {
+        label: "Reclaim",
+        helpText: "Reclaim driver space after sweeps (default on for non-record classes)"
       }
     }
   },
@@ -17700,10 +17373,6 @@ var enMetadataForms = {
         label: "Summary Operations",
         helpText: "Roll-up summary configuration (for parent-child relationships)"
       },
-      cached: {
-        label: "Cached",
-        helpText: "Caching configuration for computed fields"
-      },
       columnName: {
         label: "Column Name",
         helpText: "Physical column name in database (defaults to field name)"
@@ -17731,28 +17400,9 @@ var enMetadataForms = {
       sortable: {
         label: "Sortable",
         helpText: "Allow sorting lists by this field"
-      },
-      auditTrail: {
-        label: "Audit Trail",
-        helpText: "Track detailed changes with user and timestamp"
-      },
-      trackFeedHistory: {
-        label: "Track Feed History",
-        helpText: "Show changes in activity feed"
-      },
-      encryptionConfig: {
-        label: "Encryption Config",
-        helpText: "Field-level encryption (GDPR/HIPAA/PCI-DSS)"
-      },
-      maskingRule: {
-        label: "Masking Rule",
-        helpText: "Data masking rules for PII protection"
       }
     }
   },
-  trigger: {
-    label: "Trigger"
-  },
   validation: {
     label: "Validation Rule"
   },
@@ -17829,12 +17479,36 @@ var enMetadataForms = {
       onError: {
         label: "On Error"
       },
+      timeout: {
+        label: "Timeout",
+        helpText: "Abort the hook after N milliseconds"
+      },
       condition: {
         label: "Condition",
         helpText: "Optional formula \u2014 skip the hook when this evaluates to false"
+      },
+      retryPolicy: {
+        label: "Retry Policy",
+        helpText: "Retry on failure \u2014 most useful for async hooks"
+      },
+      "retryPolicy.maxRetries": {
+        label: "Max Retries",
+        helpText: "Maximum retry attempts"
+      },
+      "retryPolicy.backoffMs": {
+        label: "Backoff Ms",
+        helpText: "Delay between retries (ms)"
       }
     }
   },
+  seed: {
+    label: "Seed Data",
+    description: "Fixture / initialization data applied on publish"
+  },
+  mapping: {
+    label: "Import Mapping",
+    description: "Reusable import/export field mapping (rename + transforms), referenced by name at import"
+  },
   view: {
     label: "View",
     sections: {
@@ -18006,6 +17680,10 @@ var enMetadataForms = {
         label: "Layout",
         description: "Page regions and components placed within them."
       },
+      interface: {
+        label: "Interface (list pages)",
+        description: "Interface mode (Airtable parity): the page defines its own data surface directly \u2014 columns, filters, visualizations and toolbar \u2014 no inheriting from a separate view."
+      },
       advanced: {
         label: "Advanced",
         description: "Activation, audience, and accessibility."
@@ -18048,6 +17726,58 @@ var enMetadataForms = {
         label: "Regions",
         helpText: "Layout regions (header, main, sidebar, footer) with components"
       },
+      interfaceConfig: {
+        label: "Interface Config",
+        helpText: "The page IS the view: source picks the object, columns/filterBy are defined directly here; appearance.allowedVisualizations whitelists renderers (one entry = locked); userActions toggles the toolbar."
+      },
+      "interfaceConfig.source": {
+        label: "Source",
+        helpText: "Object this page reads from"
+      },
+      "interfaceConfig.columns": {
+        label: "Columns",
+        helpText: "Columns to show \u2014 defined directly on the page (blank = all object fields)"
+      },
+      "interfaceConfig.filterBy": {
+        label: "Filter By",
+        helpText: "Always-on base filter for the page \u2014 same visual builder as the list toolbar."
+      },
+      "interfaceConfig.levels": {
+        label: "Levels",
+        helpText: "Hierarchy levels to display (tree-like sources)"
+      },
+      "interfaceConfig.appearance": {
+        label: "Appearance",
+        helpText: "Allowed visualizations (Grid / Kanban / Calendar / \u2026) and description visibility"
+      },
+      "interfaceConfig.userFilters": {
+        label: "User Filters",
+        helpText: "End-user filter bar: None (no bar) / Tabs (named presets) / Dropdown (per-field). None removes the config."
+      },
+      "interfaceConfig.userActions": {
+        label: "User Actions",
+        helpText: "Toolbar toggles (search, sort, filter, row height)"
+      },
+      "interfaceConfig.addRecord": {
+        label: "Add Record",
+        helpText: "Add-record entry point"
+      },
+      "interfaceConfig.buttons": {
+        label: "Buttons",
+        helpText: "Toolbar buttons \u2014 pick from this object's actions"
+      },
+      "interfaceConfig.recordAction": {
+        label: "Record Action",
+        helpText: "How clicking a record opens its detail"
+      },
+      "interfaceConfig.showRecordCount": {
+        label: "Show Record Count",
+        helpText: "Show the record count bar"
+      },
+      "interfaceConfig.allowPrinting": {
+        label: "Allow Printing",
+        helpText: "Allow users to print this page"
+      },
       isDefault: {
         label: "Is Default",
         helpText: "Set as default page for this page type"
@@ -18296,6 +18026,22 @@ var enMetadataForms = {
         label: "Body",
         helpText: "JavaScript code to execute"
       },
+      "body.language": {
+        label: "Language",
+        helpText: "expression = pure formula; js = sandboxed JavaScript"
+      },
+      "body.source": {
+        label: "Source",
+        helpText: "Function body source \u2014 no top-level imports"
+      },
+      "body.capabilities": {
+        label: "Capabilities",
+        helpText: "Allowed ctx APIs (api.read, api.write, crypto.uuid, log, \u2026)"
+      },
+      "body.timeoutMs": {
+        label: "Timeout Ms",
+        helpText: "Per-invocation timeout (ms)"
+      },
       params: {
         label: "Params",
         helpText: "User input parameters (show form before executing)"
@@ -18336,9 +18082,9 @@ var enMetadataForms = {
         label: "Bulk Enabled",
         helpText: "Allow applying to multiple selected records"
       },
-      aiExposed: {
-        label: "Ai Exposed",
-        helpText: "Allow AI agents to call this action"
+      ai: {
+        label: "Ai",
+        helpText: "AI exposure (opt-in): set ai.exposed=true and write ai.description (\u226540 chars) to make this callable by agents."
       },
       recordIdParam: {
         label: "Record Id Param",
@@ -18361,13 +18107,9 @@ var enMetadataForms = {
         label: "Basics",
         description: "Identity and data source."
       },
-      columns: {
-        label: "Columns",
-        description: "Columns shown in the report output."
-      },
-      groupings: {
-        label: "Groupings",
-        description: "How rows (and columns, for matrix reports) are grouped."
+      dataset_binding: {
+        label: "Dataset binding",
+        description: "The semantic-layer dataset this report renders. Values are the dataset\u2019s measures; rows are its dimensions."
       },
       joined_blocks: {
         label: "Joined blocks",
@@ -18393,33 +18135,37 @@ var enMetadataForms = {
       description: {
         label: "Description"
       },
-      objectName: {
-        label: "Object Name",
-        helpText: "Data source object"
-      },
       type: {
         label: "Type",
         helpText: "Report type: tabular/summary/matrix/joined"
       },
+      dataset: {
+        label: "Dataset",
+        helpText: "Dataset to bind (measures/dimensions come from its semantic layer)"
+      },
+      values: {
+        label: "Values",
+        helpText: "Measure names (from the dataset) to display"
+      },
+      rows: {
+        label: "Rows",
+        helpText: "Dimension names (from the dataset) to group rows by"
+      },
       columns: {
         label: "Columns",
         helpText: "Columns to display in the report"
       },
-      groupingsDown: {
-        label: "Groupings Down",
-        helpText: "Row grouping levels"
-      },
-      groupingsAcross: {
-        label: "Groupings Across",
-        helpText: "Column grouping levels (matrix only)"
+      drilldown: {
+        label: "Drilldown",
+        helpText: "Click an aggregated row/cell to open the underlying records"
       },
       blocks: {
         label: "Blocks",
         helpText: "Join multiple objects (joined report only)"
       },
-      filter: {
-        label: "Filter",
-        helpText: "Report-level filters"
+      runtimeFilter: {
+        label: "Runtime Filter",
+        helpText: "Render-time scope filter, ANDed at query time"
       },
       chart: {
         label: "Chart",
@@ -18435,6 +18181,62 @@ var enMetadataForms = {
       }
     }
   },
+  dataset: {
+    label: "Dataset",
+    description: "Analytics semantic layer \u2014 dimensions & measures",
+    sections: {
+      basics: {
+        label: "Basics",
+        description: "Dataset identity."
+      },
+      source: {
+        label: "Source",
+        description: "The base object, the relationships to join, and the dataset\u2019s intrinsic scope. Joins are derived from the object graph \u2014 pick relationship (lookup / master_detail) names, never write an ON clause."
+      },
+      dimensions: {
+        label: "Dimensions",
+        description: "Groupable axes. Use a base field, or `relationship.field` (e.g. account.region) for a relationship included above."
+      },
+      measures: {
+        label: "Measures",
+        description: "Aggregatable values defined once and referenced by name. A measure is sum/avg/count/\u2026 of a field; a derived measure combines other measures (ratio/sum/difference/product). Measure-scoped filters and derived ops are edited per-row in the dataset designer."
+      }
+    },
+    fields: {
+      name: {
+        label: "Name",
+        helpText: "snake_case unique identifier"
+      },
+      label: {
+        label: "Label",
+        helpText: "Display name"
+      },
+      description: {
+        label: "Description",
+        helpText: "What this dataset measures"
+      },
+      object: {
+        label: "Object",
+        helpText: "Base object \u2014 the FROM"
+      },
+      include: {
+        label: "Include",
+        helpText: 'Relationship (lookup / master_detail) field names to join \u2014 enables `relationship.field` dimensions/measures (e.g. include "account" \u2192 group by account.region)'
+      },
+      filter: {
+        label: "Filter",
+        helpText: "Intrinsic scope filter (e.g. exclude soft-deleted records), ANDed into every query"
+      },
+      dimensions: {
+        label: "Dimensions",
+        helpText: "Each: name (referenced by presentations), field, type, and \u2014 for dates \u2014 a default bucketing granularity"
+      },
+      measures: {
+        label: "Measures",
+        helpText: "Each: name, aggregate, field (optional for count), display format/currency, and a \u201Ccertified\u201D governance flag"
+      }
+    }
+  },
   flow: {
     label: "Flow",
     sections: {
@@ -18514,15 +18316,6 @@ var enMetadataForms = {
   translation: {
     label: "Translation"
   },
-  router: {
-    label: "Router"
-  },
-  function: {
-    label: "Function"
-  },
-  service: {
-    label: "Service"
-  },
   email_template: {
     label: "Email Template",
     sections: {
@@ -18603,6 +18396,14 @@ var enMetadataForms = {
       }
     }
   },
+  doc: {
+    label: "Documentation",
+    description: "Package documentation \u2014 flat Markdown items (ADR-0046)"
+  },
+  book: {
+    label: "Documentation Book",
+    description: "Documentation navigation spine \u2014 ordered groups with derived membership (ADR-0046 \xA76)"
+  },
   permission: {
     label: "Permission Set",
     sections: {
@@ -18658,80 +18459,21 @@ var enMetadataForms = {
       }
     }
   },
-  profile: {
-    label: "Profile",
+  position: {
+    label: "Position",
     sections: {
-      identity: {
-        label: "Identity",
-        description: "Permission Sets stack on top of a Profile to grant additional access. Profiles are the base set assigned 1:1 to each user."
-      },
-      system_permissions: {
-        label: "System Permissions",
-        description: "High-level capabilities not tied to a specific object \u2014 e.g. manage_users, view_audit_logs."
-      },
-      object_and_field_permissions: {
-        label: "Object & Field Permissions",
-        description: "Per-object CRUD + per-field FLS. Edit via the matrix editor or paste JSON here."
-      },
-      tab_and_row_level_security: {
-        label: "Tab & Row-Level Security",
-        description: "Tab visibility, RLS policies, and custom context variables for predicate evaluation."
+      position: {
+        label: "Position",
+        description: "A position is a flat, assignable bundle of permission sets (e.g. sales_rep, sales_manager). Capability lives on permission sets; visibility depth lives on the business-unit tree."
       }
     },
     fields: {
       name: {
         label: "Name",
-        helpText: "Machine name (snake_case)"
+        helpText: "snake_case"
       },
       label: {
-        label: "Label",
-        helpText: "Display label for admins"
-      },
-      systemPermissions: {
-        label: "System Permissions",
-        helpText: "List of system capability keys"
-      },
-      objects: {
-        label: "Objects",
-        helpText: '{ "account": { allowRead: true, allowEdit: true, ... } }'
-      },
-      fields: {
-        label: "Fields",
-        helpText: '{ "account.amount": { readable: true, editable: false } }'
-      },
-      tabPermissions: {
-        label: "Tab Permissions",
-        helpText: '{ "app_crm": "visible", "app_admin": "hidden" }'
-      },
-      rowLevelSecurity: {
-        label: "Row Level Security",
-        helpText: "Array of RLS policies (see rls.zod.ts)"
-      },
-      contextVariables: {
-        label: "Context Variables",
-        helpText: "Custom variables referenced in RLS predicates"
-      }
-    }
-  },
-  role: {
-    label: "Role",
-    sections: {
-      role: {
-        label: "Role",
-        description: "Roles compose a hierarchy used for record sharing (sales VP \u2192 sales mgr \u2192 sales rep). Permissions themselves live on Permission Sets and Profiles."
-      }
-    },
-    fields: {
-      name: {
-        label: "Name",
-        helpText: "snake_case"
-      },
-      label: {
-        label: "Label"
-      },
-      parent: {
-        label: "Parent",
-        helpText: "Parent role machine name (Reports To)"
+        label: "Label"
       },
       description: {
         label: "Description"
@@ -19222,6 +18964,70 @@ var zhCNMetadataForms = {
       datasource: {
         label: "\u6570\u636E\u6E90",
         helpText: '\u76EE\u6807\u6570\u636E\u6E90 ID\uFF08\u9ED8\u8BA4\uFF1A"default"\uFF09'
+      },
+      lifecycle: {
+        label: "\u6570\u636E\u751F\u547D\u5468\u671F",
+        helpText: "\u6570\u636E\u751F\u547D\u5468\u671F\u5951\u7EA6\uFF08ADR-0057\uFF09\uFF1A\u6570\u636E\u4FDD\u7559\u591A\u4E45\u3001\u7A7A\u95F4\u5982\u4F55\u56DE\u6536\u3002\u7559\u7A7A\u5373\u6C38\u4E45\u4FDD\u7559\uFF08record \u8BED\u4E49\uFF09\u3002\u975E record \u7C7B\u5FC5\u987B\u58F0\u660E\u81F3\u5C11\u4E00\u4E2A\u754C\u5B9A\u7B56\u7565\uFF08\u4FDD\u7559\u671F\u3001TTL \u6216\u8F6E\u8F6C\uFF09\u3002"
+      },
+      "lifecycle.class": {
+        label: "\u751F\u547D\u5468\u671F\u7C7B\u522B",
+        helpText: "\u672C\u5BF9\u8C61\u6570\u636E\u7684\u6301\u4E45\u5316\u5951\u7EA6"
+      },
+      "lifecycle.retention": {
+        label: "\u4FDD\u7559\u671F",
+        helpText: "\u6309\u6570\u636E\u5E74\u9F84\u754C\u5B9A\u7684\u4FDD\u7559\u7A97\u53E3"
+      },
+      "lifecycle.retention.maxAge": {
+        label: "\u6700\u957F\u4FDD\u7559",
+        helpText: '\u65E9\u4E8E\u8BE5\u7A97\u53E3\uFF08\u6309 created_at\uFF09\u7684\u884C\u5C06\u88AB\u6E05\u7406\u3002\u65F6\u957F\u5B57\u9762\u91CF\uFF1Ah/d/w/y\uFF0C\u5982 "30d"'
+      },
+      "lifecycle.ttl": {
+        label: "TTL \u8FC7\u671F",
+        helpText: "\u6309\u884C\u7684 TTL \u81EA\u52A8\u8FC7\u671F"
+      },
+      "lifecycle.ttl.field": {
+        label: "\u65F6\u95F4\u5B57\u6BB5",
+        helpText: "TTL \u8BA1\u65F6\u8D77\u70B9\u7684\u65F6\u95F4\u6233\u5B57\u6BB5\uFF08\u5982 expires_at\uFF09"
+      },
+      "lifecycle.ttl.expireAfter": {
+        label: "\u8FC7\u671F\u65F6\u957F",
+        helpText: '\u884C\u5728\u8BE5\u5B57\u6BB5\u4E4B\u540E\u8FD9\u4E48\u4E45\u8FC7\u671F\uFF0C\u5982 "1d"'
+      },
+      "lifecycle.storage": {
+        label: "\u5B58\u50A8\u7B56\u7565",
+        helpText: "\u9AD8\u9891\u9065\u6D4B\u7684\u7269\u7406\u8F6E\u8F6C\uFF08SQLite\uFF1AO(1) \u5206\u7247 DROP\uFF09"
+      },
+      "lifecycle.storage.strategy": {
+        label: "\u7B56\u7565",
+        helpText: "\u5B58\u50A8\u7B56\u7565"
+      },
+      "lifecycle.storage.shards": {
+        label: "\u5206\u7247\u6570",
+        helpText: "\u4FDD\u7559\u7684\u5206\u7247\u6570\u91CF\uFF1B\u603B\u7A97\u53E3 = \u5206\u7247\u6570 \xD7 \u5355\u4F4D"
+      },
+      "lifecycle.storage.unit": {
+        label: "\u5206\u7247\u5355\u4F4D",
+        helpText: "\u5355\u4E2A\u5206\u7247\u7684\u65F6\u95F4\u5BBD\u5EA6"
+      },
+      "lifecycle.archive": {
+        label: "\u5F52\u6863",
+        helpText: "\u51B7\u5B58\u4EA4\u63A5\uFF08audit \u7C7B\uFF09\u3002\u5F52\u6863\u62F7\u8D1D\u6210\u529F\u524D\uFF0C\u884C\u7EDD\u4E0D\u4F1A\u88AB\u70ED\u5220\u9664\u3002"
+      },
+      "lifecycle.archive.after": {
+        label: "\u5F52\u6863\u65F6\u70B9",
+        helpText: "\u65E9\u4E8E\u8BE5\u7A97\u53E3\u7684\u884C\u8FDB\u5165\u5F52\u6863 \u2014 \u5FC5\u987B\u7B49\u4E8E retention.maxAge"
+      },
+      "lifecycle.archive.to": {
+        label: "\u5F52\u6863\u6570\u636E\u6E90",
+        helpText: "\u51B7\u5B58\u50A8\u7684\u76EE\u6807\u6570\u636E\u6E90\u540D\u79F0"
+      },
+      "lifecycle.archive.keep": {
+        label: "\u5F52\u6863\u4FDD\u7559",
+        helpText: '\u5F52\u6863\u4E2D\u4FDD\u7559\u591A\u4E45\uFF08\u7559\u7A7A = \u6C38\u4E45\uFF09\uFF0C\u5982 "7y"'
+      },
+      "lifecycle.reclaim": {
+        label: "\u7A7A\u95F4\u56DE\u6536",
+        helpText: "\u6E05\u7406\u540E\u56DE\u6536\u9A71\u52A8\u5C42\u7A7A\u95F4\uFF08\u975E record \u7C7B\u9ED8\u8BA4\u5F00\u542F\uFF09"
       }
     }
   },
@@ -19330,10 +19136,6 @@ var zhCNMetadataForms = {
         label: "\u6C47\u603B\u64CD\u4F5C",
         helpText: "\u7236\u5B50\u5173\u7CFB\u4E0B\u7684\u6C47\u603B\u805A\u5408\u914D\u7F6E"
       },
-      cached: {
-        label: "\u7F13\u5B58",
-        helpText: "\u8BA1\u7B97\u5B57\u6BB5\u7684\u7F13\u5B58\u914D\u7F6E"
-      },
       columnName: {
         label: "\u5217\u540D",
         helpText: "\u6570\u636E\u5E93\u4E2D\u7684\u7269\u7406\u5217\u540D\uFF08\u9ED8\u8BA4\u4E0E\u5B57\u6BB5\u540D\u76F8\u540C\uFF09"
@@ -19361,28 +19163,9 @@ var zhCNMetadataForms = {
       sortable: {
         label: "\u53EF\u6392\u5E8F",
         helpText: "\u5141\u8BB8\u6309\u6B64\u5B57\u6BB5\u6392\u5E8F"
-      },
-      auditTrail: {
-        label: "\u5BA1\u8BA1\u8DDF\u8E2A",
-        helpText: "\u8BB0\u5F55\u8BE6\u7EC6\u53D8\u66F4\u4E0E\u64CD\u4F5C\u4EBA\u3001\u65F6\u95F4\u6233"
-      },
-      trackFeedHistory: {
-        label: "\u52A8\u6001\u5386\u53F2\u8DDF\u8E2A",
-        helpText: "\u5728\u6D3B\u52A8\u52A8\u6001\u4E2D\u5C55\u793A\u53D8\u66F4"
-      },
-      encryptionConfig: {
-        label: "\u52A0\u5BC6\u914D\u7F6E",
-        helpText: "\u5B57\u6BB5\u7EA7\u52A0\u5BC6\uFF08GDPR / HIPAA / PCI-DSS\uFF09"
-      },
-      maskingRule: {
-        label: "\u63A9\u7801\u89C4\u5219",
-        helpText: "PII \u6570\u636E\u8131\u654F\u89C4\u5219"
       }
     }
   },
-  trigger: {
-    label: "\u89E6\u53D1\u5668"
-  },
   validation: {
     label: "\u9A8C\u8BC1\u89C4\u5219"
   },
@@ -19459,12 +19242,36 @@ var zhCNMetadataForms = {
       onError: {
         label: "\u9519\u8BEF\u5904\u7406"
       },
+      timeout: {
+        label: "Timeout",
+        helpText: "Abort the hook after N milliseconds"
+      },
       condition: {
         label: "\u6761\u4EF6",
         helpText: "\u53EF\u9009\u516C\u5F0F\u2014\u2014\u6C42\u503C\u4E3A false \u65F6\u8DF3\u8FC7\u8BE5\u94A9\u5B50"
+      },
+      retryPolicy: {
+        label: "Retry Policy",
+        helpText: "Retry on failure \u2014 most useful for async hooks"
+      },
+      "retryPolicy.maxRetries": {
+        label: "Max Retries",
+        helpText: "Maximum retry attempts"
+      },
+      "retryPolicy.backoffMs": {
+        label: "Backoff Ms",
+        helpText: "Delay between retries (ms)"
       }
     }
   },
+  seed: {
+    label: "Seed Data",
+    description: "Fixture / initialization data applied on publish"
+  },
+  mapping: {
+    label: "Import Mapping",
+    description: "Reusable import/export field mapping (rename + transforms), referenced by name at import"
+  },
   view: {
     label: "\u89C6\u56FE",
     sections: {
@@ -19636,6 +19443,10 @@ var zhCNMetadataForms = {
         label: "\u5E03\u5C40",
         description: "\u9875\u9762\u533A\u5757\u4E0E\u7EC4\u4EF6"
       },
+      interface: {
+        label: "Interface (list pages)",
+        description: "Interface mode (Airtable parity): the page defines its own data surface directly \u2014 columns, filters, visualizations and toolbar \u2014 no inheriting from a separate view."
+      },
       advanced: {
         label: "\u9AD8\u7EA7\u8BBE\u7F6E",
         description: "\u9ED8\u8BA4\u9875\u3001\u7C7B\u578B\u4E0E\u5206\u914D"
@@ -19678,6 +19489,58 @@ var zhCNMetadataForms = {
         label: "\u533A\u57DF",
         helpText: "\u5E03\u5C40\u533A\u57DF\uFF08header\u3001main\u3001sidebar\u3001footer\uFF09\u53CA\u5176\u7EC4\u4EF6"
       },
+      interfaceConfig: {
+        label: "Interface Config",
+        helpText: "The page IS the view: source picks the object, columns/filterBy are defined directly here; appearance.allowedVisualizations whitelists renderers (one entry = locked); userActions toggles the toolbar."
+      },
+      "interfaceConfig.source": {
+        label: "Source",
+        helpText: "Object this page reads from"
+      },
+      "interfaceConfig.columns": {
+        label: "Columns",
+        helpText: "Columns to show \u2014 defined directly on the page (blank = all object fields)"
+      },
+      "interfaceConfig.filterBy": {
+        label: "Filter By",
+        helpText: "Always-on base filter for the page \u2014 same visual builder as the list toolbar."
+      },
+      "interfaceConfig.levels": {
+        label: "Levels",
+        helpText: "Hierarchy levels to display (tree-like sources)"
+      },
+      "interfaceConfig.appearance": {
+        label: "Appearance",
+        helpText: "Allowed visualizations (Grid / Kanban / Calendar / \u2026) and description visibility"
+      },
+      "interfaceConfig.userFilters": {
+        label: "User Filters",
+        helpText: "End-user filter bar: None (no bar) / Tabs (named presets) / Dropdown (per-field). None removes the config."
+      },
+      "interfaceConfig.userActions": {
+        label: "User Actions",
+        helpText: "Toolbar toggles (search, sort, filter, row height)"
+      },
+      "interfaceConfig.addRecord": {
+        label: "Add Record",
+        helpText: "Add-record entry point"
+      },
+      "interfaceConfig.buttons": {
+        label: "Buttons",
+        helpText: "Toolbar buttons \u2014 pick from this object's actions"
+      },
+      "interfaceConfig.recordAction": {
+        label: "Record Action",
+        helpText: "How clicking a record opens its detail"
+      },
+      "interfaceConfig.showRecordCount": {
+        label: "Show Record Count",
+        helpText: "Show the record count bar"
+      },
+      "interfaceConfig.allowPrinting": {
+        label: "Allow Printing",
+        helpText: "Allow users to print this page"
+      },
       isDefault: {
         label: "\u9ED8\u8BA4",
         helpText: "\u8BBE\u4E3A\u8BE5\u9875\u9762\u7C7B\u578B\u7684\u9ED8\u8BA4\u9875"
@@ -19926,6 +19789,22 @@ var zhCNMetadataForms = {
         label: "\u6B63\u6587",
         helpText: "\u8981\u6267\u884C\u7684 JavaScript \u4EE3\u7801"
       },
+      "body.language": {
+        label: "Language",
+        helpText: "expression = pure formula; js = sandboxed JavaScript"
+      },
+      "body.source": {
+        label: "Source",
+        helpText: "Function body source \u2014 no top-level imports"
+      },
+      "body.capabilities": {
+        label: "Capabilities",
+        helpText: "Allowed ctx APIs (api.read, api.write, crypto.uuid, log, \u2026)"
+      },
+      "body.timeoutMs": {
+        label: "Timeout Ms",
+        helpText: "Per-invocation timeout (ms)"
+      },
       params: {
         label: "\u53C2\u6570",
         helpText: "\u6267\u884C\u524D\u5411\u7528\u6237\u6536\u96C6\u7684\u8F93\u5165\u53C2\u6570"
@@ -19966,9 +19845,9 @@ var zhCNMetadataForms = {
         label: "\u6279\u91CF\u542F\u7528",
         helpText: "\u5141\u8BB8\u5BF9\u591A\u6761\u9009\u4E2D\u8BB0\u5F55\u6267\u884C"
       },
-      aiExposed: {
-        label: "\u66B4\u9732\u7ED9 AI",
-        helpText: "\u5141\u8BB8 AI \u667A\u80FD\u4F53\u8C03\u7528\u6B64\u64CD\u4F5C"
+      ai: {
+        label: "Ai",
+        helpText: "AI exposure (opt-in): set ai.exposed=true and write ai.description (\u226540 chars) to make this callable by agents."
       },
       recordIdParam: {
         label: "\u8BB0\u5F55 ID \u53C2\u6570",
@@ -19991,13 +19870,9 @@ var zhCNMetadataForms = {
         label: "\u57FA\u7840\u4FE1\u606F",
         description: "\u540D\u79F0\u4E0E\u6570\u636E\u6E90"
       },
-      columns: {
-        label: "\u5217",
-        description: "\u9009\u62E9\u8981\u5C55\u793A\u7684\u5217"
-      },
-      groupings: {
-        label: "\u5206\u7EC4\u4E0E\u6C47\u603B",
-        description: "\u884C\u5217\u5206\u7EC4\u7EF4\u5EA6"
+      dataset_binding: {
+        label: "Dataset binding",
+        description: "The semantic-layer dataset this report renders. Values are the dataset\u2019s measures; rows are its dimensions."
       },
       joined_blocks: {
         label: "\u5173\u8054\u5BF9\u8C61",
@@ -20023,33 +19898,37 @@ var zhCNMetadataForms = {
       description: {
         label: "\u63CF\u8FF0"
       },
-      objectName: {
-        label: "\u5BF9\u8C61\u540D\u79F0",
-        helpText: "\u62A5\u8868\u6570\u636E\u6E90\u5BF9\u8C61"
-      },
       type: {
         label: "\u7C7B\u578B",
         helpText: "\u62A5\u8868\u7C7B\u578B\uFF1Atabular / summary / matrix / joined"
       },
+      dataset: {
+        label: "Dataset",
+        helpText: "Dataset to bind (measures/dimensions come from its semantic layer)"
+      },
+      values: {
+        label: "Values",
+        helpText: "Measure names (from the dataset) to display"
+      },
+      rows: {
+        label: "Rows",
+        helpText: "Dimension names (from the dataset) to group rows by"
+      },
       columns: {
         label: "\u5217",
         helpText: "\u62A5\u8868\u4E2D\u663E\u793A\u7684\u5217"
       },
-      groupingsDown: {
-        label: "\u884C\u5206\u7EC4",
-        helpText: "\u884C\u65B9\u5411\u5206\u7EC4\u5C42\u7EA7"
-      },
-      groupingsAcross: {
-        label: "\u5217\u5206\u7EC4",
-        helpText: "\u5217\u65B9\u5411\u5206\u7EC4\u5C42\u7EA7\uFF08matrix \u62A5\u8868\uFF09"
+      drilldown: {
+        label: "Drilldown",
+        helpText: "Click an aggregated row/cell to open the underlying records"
       },
       blocks: {
         label: "\u5206\u5757",
         helpText: "joined \u62A5\u8868\u7684\u8054\u5408\u67E5\u8BE2\u5757"
       },
-      filter: {
-        label: "\u7B5B\u9009",
-        helpText: "\u62A5\u8868\u7EA7\u522B\u7684\u7B5B\u9009\u89C4\u5219"
+      runtimeFilter: {
+        label: "Runtime Filter",
+        helpText: "Render-time scope filter, ANDed at query time"
       },
       chart: {
         label: "\u56FE\u8868",
@@ -20065,6 +19944,62 @@ var zhCNMetadataForms = {
       }
     }
   },
+  dataset: {
+    label: "Dataset",
+    description: "Analytics semantic layer \u2014 dimensions & measures",
+    sections: {
+      basics: {
+        label: "Basics",
+        description: "Dataset identity."
+      },
+      source: {
+        label: "Source",
+        description: "The base object, the relationships to join, and the dataset\u2019s intrinsic scope. Joins are derived from the object graph \u2014 pick relationship (lookup / master_detail) names, never write an ON clause."
+      },
+      dimensions: {
+        label: "Dimensions",
+        description: "Groupable axes. Use a base field, or `relationship.field` (e.g. account.region) for a relationship included above."
+      },
+      measures: {
+        label: "Measures",
+        description: "Aggregatable values defined once and referenced by name. A measure is sum/avg/count/\u2026 of a field; a derived measure combines other measures (ratio/sum/difference/product). Measure-scoped filters and derived ops are edited per-row in the dataset designer."
+      }
+    },
+    fields: {
+      name: {
+        label: "Name",
+        helpText: "snake_case unique identifier"
+      },
+      label: {
+        label: "Label",
+        helpText: "Display name"
+      },
+      description: {
+        label: "Description",
+        helpText: "What this dataset measures"
+      },
+      object: {
+        label: "Object",
+        helpText: "Base object \u2014 the FROM"
+      },
+      include: {
+        label: "Include",
+        helpText: 'Relationship (lookup / master_detail) field names to join \u2014 enables `relationship.field` dimensions/measures (e.g. include "account" \u2192 group by account.region)'
+      },
+      filter: {
+        label: "Filter",
+        helpText: "Intrinsic scope filter (e.g. exclude soft-deleted records), ANDed into every query"
+      },
+      dimensions: {
+        label: "Dimensions",
+        helpText: "Each: name (referenced by presentations), field, type, and \u2014 for dates \u2014 a default bucketing granularity"
+      },
+      measures: {
+        label: "Measures",
+        helpText: "Each: name, aggregate, field (optional for count), display format/currency, and a \u201Ccertified\u201D governance flag"
+      }
+    }
+  },
   flow: {
     label: "\u6D41\u7A0B",
     sections: {
@@ -20144,15 +20079,6 @@ var zhCNMetadataForms = {
   translation: {
     label: "\u7FFB\u8BD1"
   },
-  router: {
-    label: "\u8DEF\u7531\u5668"
-  },
-  function: {
-    label: "\u51FD\u6570"
-  },
-  service: {
-    label: "\u670D\u52A1"
-  },
   email_template: {
     label: "\u90AE\u4EF6\u6A21\u677F",
     sections: {
@@ -20233,6 +20159,14 @@ var zhCNMetadataForms = {
       }
     }
   },
+  doc: {
+    label: "Documentation",
+    description: "Package documentation \u2014 flat Markdown items (ADR-0046)"
+  },
+  book: {
+    label: "Documentation Book",
+    description: "Documentation navigation spine \u2014 ordered groups with derived membership (ADR-0046 \xA76)"
+  },
   permission: {
     label: "\u6743\u9650\u96C6 / \u914D\u7F6E\u6587\u4EF6",
     sections: {
@@ -20288,67 +20222,12 @@ var zhCNMetadataForms = {
       }
     }
   },
-  profile: {
-    label: "\u914D\u7F6E\u6587\u4EF6",
-    sections: {
-      identity: {
-        label: "\u6807\u8BC6",
-        description: "\u6743\u9650\u96C6\u53E0\u52A0\u5728\u914D\u7F6E\u6587\u4EF6\u4E4B\u4E0A\u4EE5\u6388\u4E88\u989D\u5916\u7684\u8BBF\u95EE\u6743\u9650\u3002\u914D\u7F6E\u6587\u4EF6\u662F\u6309 1:1 \u5206\u914D\u7ED9\u6BCF\u4E2A\u7528\u6237\u7684\u57FA\u7840\u96C6\u5408\u3002"
-      },
-      system_permissions: {
-        label: "\u7CFB\u7EDF\u6743\u9650",
-        description: "\u4E0E\u7279\u5B9A\u5BF9\u8C61\u65E0\u5173\u7684\u9AD8\u7EA7\u80FD\u529B\u2014\u2014\u4F8B\u5982 manage_users\u3001view_audit_logs\u3002"
-      },
-      object_and_field_permissions: {
-        label: "\u5BF9\u8C61\u4E0E\u5B57\u6BB5\u6743\u9650",
-        description: "\u6309\u5BF9\u8C61\u7684\u589E\u5220\u6539\u67E5 + \u6309\u5B57\u6BB5\u7684\u5B57\u6BB5\u7EA7\u5B89\u5168\uFF08FLS\uFF09\u3002\u53EF\u901A\u8FC7\u77E9\u9635\u7F16\u8F91\u5668\u7F16\u8F91\uFF0C\u6216\u5728\u6B64\u5904\u7C98\u8D34 JSON\u3002"
-      },
-      tab_and_row_level_security: {
-        label: "\u6807\u7B7E\u9875\u4E0E\u884C\u7EA7\u5B89\u5168",
-        description: "\u6807\u7B7E\u9875\u53EF\u89C1\u6027\u3001RLS \u7B56\u7565\uFF0C\u4EE5\u53CA\u7528\u4E8E\u8C13\u8BCD\u6C42\u503C\u7684\u81EA\u5B9A\u4E49\u4E0A\u4E0B\u6587\u53D8\u91CF\u3002"
-      }
-    },
-    fields: {
-      name: {
-        label: "\u540D\u79F0",
-        helpText: "\u673A\u5668\u540D\uFF08snake_case\uFF09"
-      },
-      label: {
-        label: "\u663E\u793A\u540D\u79F0",
-        helpText: "\u9762\u5411\u7BA1\u7406\u5458\u663E\u793A\u7684\u6807\u7B7E"
-      },
-      systemPermissions: {
-        label: "\u7CFB\u7EDF\u6743\u9650",
-        helpText: "\u7CFB\u7EDF\u80FD\u529B\u952E\u5217\u8868"
-      },
-      objects: {
-        label: "\u5BF9\u8C61\u6743\u9650",
-        helpText: '\u793A\u4F8B\uFF1A{ "account": { allowRead: true, allowEdit: true, ... } }'
-      },
-      fields: {
-        label: "\u5B57\u6BB5",
-        helpText: '\u793A\u4F8B\uFF1A{ "account.amount": { readable: true, editable: false } }'
-      },
-      tabPermissions: {
-        label: "\u6807\u7B7E\u9875\u6743\u9650",
-        helpText: '\u793A\u4F8B\uFF1A{ "app_crm": "visible", "app_admin": "hidden" }'
-      },
-      rowLevelSecurity: {
-        label: "\u884C\u7EA7\u5B89\u5168",
-        helpText: "RLS \u7B56\u7565\u6570\u7EC4\uFF08\u53C2\u89C1 rls.zod.ts\uFF09"
-      },
-      contextVariables: {
-        label: "\u4E0A\u4E0B\u6587\u53D8\u91CF",
-        helpText: "RLS \u8C13\u8BCD\u4E2D\u5F15\u7528\u7684\u81EA\u5B9A\u4E49\u53D8\u91CF"
-      }
-    }
-  },
-  role: {
-    label: "\u89D2\u8272",
+  position: {
+    label: "\u5C97\u4F4D",
     sections: {
-      role: {
-        label: "\u89D2\u8272\u5B9A\u4E49",
-        description: "\u89D2\u8272\u540D\u79F0\u4E0E\u7EE7\u627F\u5173\u7CFB"
+      position: {
+        label: "\u5C97\u4F4D",
+        description: "\u5C97\u4F4D\u662F\u6241\u5E73\u7684\u3001\u53EF\u5206\u914D\u7684\u6743\u9650\u96C6\u7EC4\u5408(\u5982 sales_rep\u3001sales_manager)\u3002\u80FD\u529B\u5728\u6743\u9650\u96C6\u4E0A;\u53EF\u89C1\u8303\u56F4\u6DF1\u5EA6\u5728\u4E1A\u52A1\u5355\u5143\u6811\u4E0A\u3002"
       }
     },
     fields: {
@@ -20359,10 +20238,6 @@ var zhCNMetadataForms = {
       label: {
         label: "\u663E\u793A\u540D\u79F0"
       },
-      parent: {
-        label: "\u7236\u7EA7",
-        helpText: "\u7EE7\u627F\u7236\u89D2\u8272\u7684\u6743\u9650"
-      },
       description: {
         label: "\u63CF\u8FF0"
       }
@@ -20852,6 +20727,70 @@ var jaJPMetadataForms = {
       datasource: {
         label: "\u30C7\u30FC\u30BF\u30BD\u30FC\u30B9",
         helpText: '\u5BFE\u8C61\u30C7\u30FC\u30BF\u30BD\u30FC\u30B9 ID\uFF08\u65E2\u5B9A: "default"\uFF09'
+      },
+      lifecycle: {
+        label: "Lifecycle",
+        helpText: "Data lifecycle contract (ADR-0057): how long rows live and how space is reclaimed. Leave empty for permanent record semantics. Non-record classes require at least one bounding policy (retention, TTL, or rotation)."
+      },
+      "lifecycle.class": {
+        label: "Class",
+        helpText: "Persistence contract for the rows of this object"
+      },
+      "lifecycle.retention": {
+        label: "Retention",
+        helpText: "Age-based retention window"
+      },
+      "lifecycle.retention.maxAge": {
+        label: "Max Age",
+        helpText: 'Rows older than this (by created_at) are reaped. Duration literal: h/d/w/y, e.g. "30d"'
+      },
+      "lifecycle.ttl": {
+        label: "Ttl",
+        helpText: "Per-row TTL expiry"
+      },
+      "lifecycle.ttl.field": {
+        label: "Field",
+        helpText: "Timestamp field the TTL is measured from (e.g. expires_at)"
+      },
+      "lifecycle.ttl.expireAfter": {
+        label: "Expire After",
+        helpText: 'Rows expire this long after the field, e.g. "1d"'
+      },
+      "lifecycle.storage": {
+        label: "Storage",
+        helpText: "Physical rotation for high-frequency telemetry (SQLite: O(1) shard DROP)"
+      },
+      "lifecycle.storage.strategy": {
+        label: "Strategy",
+        helpText: "Storage strategy"
+      },
+      "lifecycle.storage.shards": {
+        label: "Shards",
+        helpText: "Shards retained; total window = shards \xD7 unit"
+      },
+      "lifecycle.storage.unit": {
+        label: "Unit",
+        helpText: "Time width of one shard"
+      },
+      "lifecycle.archive": {
+        label: "Archive",
+        helpText: "Cold-store hand-off (audit class). Rows are never hot-deleted before the archive copy succeeded."
+      },
+      "lifecycle.archive.after": {
+        label: "After",
+        helpText: "Archive rows older than this \u2014 must equal retention.maxAge"
+      },
+      "lifecycle.archive.to": {
+        label: "To",
+        helpText: "Target datasource name for cold storage"
+      },
+      "lifecycle.archive.keep": {
+        label: "Keep",
+        helpText: 'How long the archive keeps rows (empty = forever), e.g. "7y"'
+      },
+      "lifecycle.reclaim": {
+        label: "Reclaim",
+        helpText: "Reclaim driver space after sweeps (default on for non-record classes)"
       }
     }
   },
@@ -20960,10 +20899,6 @@ var jaJPMetadataForms = {
         label: "\u96C6\u8A08\u64CD\u4F5C",
         helpText: "\u30ED\u30FC\u30EB\u30A2\u30C3\u30D7\u96C6\u8A08\u8A2D\u5B9A\uFF08\u89AA\u5B50\u95A2\u4FC2\u7528\uFF09"
       },
-      cached: {
-        label: "\u30AD\u30E3\u30C3\u30B7\u30E5",
-        helpText: "\u8A08\u7B97\u30D5\u30A3\u30FC\u30EB\u30C9\u306E\u30AD\u30E3\u30C3\u30B7\u30E5\u8A2D\u5B9A"
-      },
       columnName: {
         label: "\u5217\u540D",
         helpText: "\u30C7\u30FC\u30BF\u30D9\u30FC\u30B9\u4E0A\u306E\u7269\u7406\u5217\u540D\uFF08\u65E2\u5B9A\u306F\u30D5\u30A3\u30FC\u30EB\u30C9\u540D\uFF09"
@@ -20991,28 +20926,9 @@ var jaJPMetadataForms = {
       sortable: {
         label: "\u4E26\u3073\u66FF\u3048\u53EF\u80FD",
         helpText: "\u3053\u306E\u30D5\u30A3\u30FC\u30EB\u30C9\u3067\u30EA\u30B9\u30C8\u306E\u4E26\u3079\u66FF\u3048\u3092\u8A31\u53EF"
-      },
-      auditTrail: {
-        label: "\u76E3\u67FB\u8A3C\u8DE1",
-        helpText: "\u30E6\u30FC\u30B6\u30FC\u3068\u30BF\u30A4\u30E0\u30B9\u30BF\u30F3\u30D7\u4ED8\u304D\u3067\u8A73\u7D30\u5909\u66F4\u3092\u8FFD\u8DE1"
-      },
-      trackFeedHistory: {
-        label: "\u30D5\u30A3\u30FC\u30C9\u5C65\u6B74\u8FFD\u8DE1",
-        helpText: "\u30A2\u30AF\u30C6\u30A3\u30D3\u30C6\u30A3\u30D5\u30A3\u30FC\u30C9\u306B\u5909\u66F4\u3092\u8868\u793A"
-      },
-      encryptionConfig: {
-        label: "\u6697\u53F7\u5316\u8A2D\u5B9A",
-        helpText: "\u30D5\u30A3\u30FC\u30EB\u30C9\u30EC\u30D9\u30EB\u6697\u53F7\u5316\uFF08GDPR/HIPAA/PCI-DSS\uFF09"
-      },
-      maskingRule: {
-        label: "\u30DE\u30B9\u30AD\u30F3\u30B0\u30EB\u30FC\u30EB",
-        helpText: "PII \u4FDD\u8B77\u7528\u30C7\u30FC\u30BF\u30DE\u30B9\u30AD\u30F3\u30B0\u30EB\u30FC\u30EB"
       }
     }
   },
-  trigger: {
-    label: "\u30C8\u30EA\u30AC\u30FC"
-  },
   validation: {
     label: "\u691C\u8A3C\u30EB\u30FC\u30EB"
   },
@@ -21089,12 +21005,36 @@ var jaJPMetadataForms = {
       onError: {
         label: "\u30A8\u30E9\u30FC\u6642"
       },
+      timeout: {
+        label: "Timeout",
+        helpText: "Abort the hook after N milliseconds"
+      },
       condition: {
         label: "\u6761\u4EF6",
         helpText: "\u4EFB\u610F\u306E\u6570\u5F0F \u2014 false \u8A55\u4FA1\u6642\u306F\u30D5\u30C3\u30AF\u3092\u30B9\u30AD\u30C3\u30D7"
+      },
+      retryPolicy: {
+        label: "Retry Policy",
+        helpText: "Retry on failure \u2014 most useful for async hooks"
+      },
+      "retryPolicy.maxRetries": {
+        label: "Max Retries",
+        helpText: "Maximum retry attempts"
+      },
+      "retryPolicy.backoffMs": {
+        label: "Backoff Ms",
+        helpText: "Delay between retries (ms)"
       }
     }
   },
+  seed: {
+    label: "Seed Data",
+    description: "Fixture / initialization data applied on publish"
+  },
+  mapping: {
+    label: "Import Mapping",
+    description: "Reusable import/export field mapping (rename + transforms), referenced by name at import"
+  },
   view: {
     label: "\u30D3\u30E5\u30FC",
     sections: {
@@ -21266,6 +21206,10 @@ var jaJPMetadataForms = {
         label: "\u30EC\u30A4\u30A2\u30A6\u30C8",
         description: "\u30DA\u30FC\u30B8\u9818\u57DF\u3068\u305D\u3053\u306B\u914D\u7F6E\u3059\u308B\u30B3\u30F3\u30DD\u30FC\u30CD\u30F3\u30C8\u3002"
       },
+      interface: {
+        label: "Interface (list pages)",
+        description: "Interface mode (Airtable parity): the page defines its own data surface directly \u2014 columns, filters, visualizations and toolbar \u2014 no inheriting from a separate view."
+      },
       advanced: {
         label: "\u8A73\u7D30",
         description: "\u6709\u52B9\u5316\u3001\u5BFE\u8C61\u30E6\u30FC\u30B6\u30FC\u3001\u30A2\u30AF\u30BB\u30B7\u30D3\u30EA\u30C6\u30A3\u3002"
@@ -21308,6 +21252,58 @@ var jaJPMetadataForms = {
         label: "\u30EA\u30FC\u30B8\u30E7\u30F3",
         helpText: "\u30B3\u30F3\u30DD\u30FC\u30CD\u30F3\u30C8\u3092\u542B\u3080\u30EC\u30A4\u30A2\u30A6\u30C8\u9818\u57DF\uFF08header, main, sidebar, footer\uFF09"
       },
+      interfaceConfig: {
+        label: "Interface Config",
+        helpText: "The page IS the view: source picks the object, columns/filterBy are defined directly here; appearance.allowedVisualizations whitelists renderers (one entry = locked); userActions toggles the toolbar."
+      },
+      "interfaceConfig.source": {
+        label: "Source",
+        helpText: "Object this page reads from"
+      },
+      "interfaceConfig.columns": {
+        label: "Columns",
+        helpText: "Columns to show \u2014 defined directly on the page (blank = all object fields)"
+      },
+      "interfaceConfig.filterBy": {
+        label: "Filter By",
+        helpText: "Always-on base filter for the page \u2014 same visual builder as the list toolbar."
+      },
+      "interfaceConfig.levels": {
+        label: "Levels",
+        helpText: "Hierarchy levels to display (tree-like sources)"
+      },
+      "interfaceConfig.appearance": {
+        label: "Appearance",
+        helpText: "Allowed visualizations (Grid / Kanban / Calendar / \u2026) and description visibility"
+      },
+      "interfaceConfig.userFilters": {
+        label: "User Filters",
+        helpText: "End-user filter bar: None (no bar) / Tabs (named presets) / Dropdown (per-field). None removes the config."
+      },
+      "interfaceConfig.userActions": {
+        label: "User Actions",
+        helpText: "Toolbar toggles (search, sort, filter, row height)"
+      },
+      "interfaceConfig.addRecord": {
+        label: "Add Record",
+        helpText: "Add-record entry point"
+      },
+      "interfaceConfig.buttons": {
+        label: "Buttons",
+        helpText: "Toolbar buttons \u2014 pick from this object's actions"
+      },
+      "interfaceConfig.recordAction": {
+        label: "Record Action",
+        helpText: "How clicking a record opens its detail"
+      },
+      "interfaceConfig.showRecordCount": {
+        label: "Show Record Count",
+        helpText: "Show the record count bar"
+      },
+      "interfaceConfig.allowPrinting": {
+        label: "Allow Printing",
+        helpText: "Allow users to print this page"
+      },
       isDefault: {
         label: "\u65E2\u5B9A",
         helpText: "\u3053\u306E\u30DA\u30FC\u30B8\u7A2E\u5225\u306E\u65E2\u5B9A\u30DA\u30FC\u30B8\u306B\u8A2D\u5B9A"
@@ -21556,15 +21552,31 @@ var jaJPMetadataForms = {
         label: "\u672C\u6587",
         helpText: "\u5B9F\u884C\u3059\u308B JavaScript \u30B3\u30FC\u30C9"
       },
-      params: {
-        label: "\u30D1\u30E9\u30E1\u30FC\u30BF\u30FC",
-        helpText: "\u30E6\u30FC\u30B6\u30FC\u5165\u529B\u30D1\u30E9\u30E1\u30FC\u30BF\u30FC\uFF08\u5B9F\u884C\u524D\u306B\u30D5\u30A9\u30FC\u30E0\u3092\u8868\u793A\uFF09"
-      },
-      confirmText: {
-        label: "\u78BA\u8A8D\u6587",
-        helpText: '\u78BA\u8A8D\u30E1\u30C3\u30BB\u30FC\u30B8\uFF08\u4F8B: "Are you sure?"\uFF09'
+      "body.language": {
+        label: "Language",
+        helpText: "expression = pure formula; js = sandboxed JavaScript"
       },
-      successMessage: {
+      "body.source": {
+        label: "Source",
+        helpText: "Function body source \u2014 no top-level imports"
+      },
+      "body.capabilities": {
+        label: "Capabilities",
+        helpText: "Allowed ctx APIs (api.read, api.write, crypto.uuid, log, \u2026)"
+      },
+      "body.timeoutMs": {
+        label: "Timeout Ms",
+        helpText: "Per-invocation timeout (ms)"
+      },
+      params: {
+        label: "\u30D1\u30E9\u30E1\u30FC\u30BF\u30FC",
+        helpText: "\u30E6\u30FC\u30B6\u30FC\u5165\u529B\u30D1\u30E9\u30E1\u30FC\u30BF\u30FC\uFF08\u5B9F\u884C\u524D\u306B\u30D5\u30A9\u30FC\u30E0\u3092\u8868\u793A\uFF09"
+      },
+      confirmText: {
+        label: "\u78BA\u8A8D\u6587",
+        helpText: '\u78BA\u8A8D\u30E1\u30C3\u30BB\u30FC\u30B8\uFF08\u4F8B: "Are you sure?"\uFF09'
+      },
+      successMessage: {
         label: "\u6210\u529F\u30E1\u30C3\u30BB\u30FC\u30B8",
         helpText: "\u5B8C\u4E86\u5F8C\u306E\u6210\u529F\u30E1\u30C3\u30BB\u30FC\u30B8"
       },
@@ -21596,9 +21608,9 @@ var jaJPMetadataForms = {
         label: "\u4E00\u62EC\u64CD\u4F5C\u6709\u52B9",
         helpText: "\u9078\u629E\u3057\u305F\u8907\u6570\u30EC\u30B3\u30FC\u30C9\u3078\u306E\u9069\u7528\u3092\u8A31\u53EF"
       },
-      aiExposed: {
-        label: "AI \u306B\u516C\u958B",
-        helpText: "AI \u30A8\u30FC\u30B8\u30A7\u30F3\u30C8\u306B\u3088\u308B\u3053\u306E\u30A2\u30AF\u30B7\u30E7\u30F3\u306E\u547C\u3073\u51FA\u3057\u3092\u8A31\u53EF"
+      ai: {
+        label: "Ai",
+        helpText: "AI exposure (opt-in): set ai.exposed=true and write ai.description (\u226540 chars) to make this callable by agents."
       },
       recordIdParam: {
         label: "\u30EC\u30B3\u30FC\u30C9 ID \u30D1\u30E9\u30E1\u30FC\u30BF\u30FC",
@@ -21621,13 +21633,9 @@ var jaJPMetadataForms = {
         label: "\u57FA\u672C",
         description: "ID \u3068\u30C7\u30FC\u30BF\u30BD\u30FC\u30B9\u3002"
       },
-      columns: {
-        label: "\u5217",
-        description: "\u30EC\u30DD\u30FC\u30C8\u51FA\u529B\u306B\u8868\u793A\u3059\u308B\u5217\u3002"
-      },
-      groupings: {
-        label: "\u30B0\u30EB\u30FC\u30D7\u5316",
-        description: "\u884C\uFF08matrix \u30EC\u30DD\u30FC\u30C8\u3067\u306F\u5217\u3082\uFF09\u306E\u30B0\u30EB\u30FC\u30D7\u5316\u65B9\u6CD5\u3002"
+      dataset_binding: {
+        label: "Dataset binding",
+        description: "The semantic-layer dataset this report renders. Values are the dataset\u2019s measures; rows are its dimensions."
       },
       joined_blocks: {
         label: "\u7D50\u5408\u30D6\u30ED\u30C3\u30AF",
@@ -21653,33 +21661,37 @@ var jaJPMetadataForms = {
       description: {
         label: "\u8AAC\u660E"
       },
-      objectName: {
-        label: "\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u540D",
-        helpText: "\u30C7\u30FC\u30BF\u30BD\u30FC\u30B9\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8"
-      },
       type: {
         label: "\u578B",
         helpText: "\u30EC\u30DD\u30FC\u30C8\u7A2E\u5225: tabular/summary/matrix/joined"
       },
+      dataset: {
+        label: "Dataset",
+        helpText: "Dataset to bind (measures/dimensions come from its semantic layer)"
+      },
+      values: {
+        label: "Values",
+        helpText: "Measure names (from the dataset) to display"
+      },
+      rows: {
+        label: "Rows",
+        helpText: "Dimension names (from the dataset) to group rows by"
+      },
       columns: {
         label: "\u5217",
         helpText: "\u30EC\u30DD\u30FC\u30C8\u306B\u8868\u793A\u3059\u308B\u5217"
       },
-      groupingsDown: {
-        label: "\u7E26\u30B0\u30EB\u30FC\u30D7",
-        helpText: "\u884C\u30B0\u30EB\u30FC\u30D7\u5316\u30EC\u30D9\u30EB"
-      },
-      groupingsAcross: {
-        label: "\u6A2A\u30B0\u30EB\u30FC\u30D7",
-        helpText: "\u5217\u30B0\u30EB\u30FC\u30D7\u5316\u30EC\u30D9\u30EB\uFF08matrix \u306E\u307F\uFF09"
+      drilldown: {
+        label: "Drilldown",
+        helpText: "Click an aggregated row/cell to open the underlying records"
       },
       blocks: {
         label: "\u30D6\u30ED\u30C3\u30AF",
         helpText: "\u8907\u6570\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u3092\u7D50\u5408\uFF08joined \u30EC\u30DD\u30FC\u30C8\u306E\u307F\uFF09"
       },
-      filter: {
-        label: "\u30D5\u30A3\u30EB\u30BF\u30FC",
-        helpText: "\u30EC\u30DD\u30FC\u30C8\u30EC\u30D9\u30EB\u306E\u30D5\u30A3\u30EB\u30BF\u30FC"
+      runtimeFilter: {
+        label: "Runtime Filter",
+        helpText: "Render-time scope filter, ANDed at query time"
       },
       chart: {
         label: "\u30C1\u30E3\u30FC\u30C8",
@@ -21695,6 +21707,62 @@ var jaJPMetadataForms = {
       }
     }
   },
+  dataset: {
+    label: "Dataset",
+    description: "Analytics semantic layer \u2014 dimensions & measures",
+    sections: {
+      basics: {
+        label: "Basics",
+        description: "Dataset identity."
+      },
+      source: {
+        label: "Source",
+        description: "The base object, the relationships to join, and the dataset\u2019s intrinsic scope. Joins are derived from the object graph \u2014 pick relationship (lookup / master_detail) names, never write an ON clause."
+      },
+      dimensions: {
+        label: "Dimensions",
+        description: "Groupable axes. Use a base field, or `relationship.field` (e.g. account.region) for a relationship included above."
+      },
+      measures: {
+        label: "Measures",
+        description: "Aggregatable values defined once and referenced by name. A measure is sum/avg/count/\u2026 of a field; a derived measure combines other measures (ratio/sum/difference/product). Measure-scoped filters and derived ops are edited per-row in the dataset designer."
+      }
+    },
+    fields: {
+      name: {
+        label: "Name",
+        helpText: "snake_case unique identifier"
+      },
+      label: {
+        label: "Label",
+        helpText: "Display name"
+      },
+      description: {
+        label: "Description",
+        helpText: "What this dataset measures"
+      },
+      object: {
+        label: "Object",
+        helpText: "Base object \u2014 the FROM"
+      },
+      include: {
+        label: "Include",
+        helpText: 'Relationship (lookup / master_detail) field names to join \u2014 enables `relationship.field` dimensions/measures (e.g. include "account" \u2192 group by account.region)'
+      },
+      filter: {
+        label: "Filter",
+        helpText: "Intrinsic scope filter (e.g. exclude soft-deleted records), ANDed into every query"
+      },
+      dimensions: {
+        label: "Dimensions",
+        helpText: "Each: name (referenced by presentations), field, type, and \u2014 for dates \u2014 a default bucketing granularity"
+      },
+      measures: {
+        label: "Measures",
+        helpText: "Each: name, aggregate, field (optional for count), display format/currency, and a \u201Ccertified\u201D governance flag"
+      }
+    }
+  },
   flow: {
     label: "\u30D5\u30ED\u30FC",
     sections: {
@@ -21774,15 +21842,6 @@ var jaJPMetadataForms = {
   translation: {
     label: "\u7FFB\u8A33"
   },
-  router: {
-    label: "\u30EB\u30FC\u30BF\u30FC"
-  },
-  function: {
-    label: "\u95A2\u6570"
-  },
-  service: {
-    label: "\u30B5\u30FC\u30D3\u30B9"
-  },
   email_template: {
     label: "\u30E1\u30FC\u30EB\u30C6\u30F3\u30D7\u30EC\u30FC\u30C8",
     sections: {
@@ -21863,6 +21922,14 @@ var jaJPMetadataForms = {
       }
     }
   },
+  doc: {
+    label: "Documentation",
+    description: "Package documentation \u2014 flat Markdown items (ADR-0046)"
+  },
+  book: {
+    label: "Documentation Book",
+    description: "Documentation navigation spine \u2014 ordered groups with derived membership (ADR-0046 \xA76)"
+  },
   permission: {
     label: "\u6A29\u9650\u30BB\u30C3\u30C8",
     sections: {
@@ -21918,67 +21985,12 @@ var jaJPMetadataForms = {
       }
     }
   },
-  profile: {
-    label: "\u30D7\u30ED\u30D5\u30A1\u30A4\u30EB",
-    sections: {
-      identity: {
-        label: "ID",
-        description: "\u6A29\u9650\u30BB\u30C3\u30C8\u306F\u30D7\u30ED\u30D5\u30A1\u30A4\u30EB\u306B\u8FFD\u52A0\u30A2\u30AF\u30BB\u30B9\u6A29\u3092\u91CD\u306D\u308B\u3002\u30D7\u30ED\u30D5\u30A1\u30A4\u30EB\u306F\u5404\u30E6\u30FC\u30B6\u30FC\u306B 1:1 \u3067\u5272\u308A\u5F53\u3066\u308B\u57FA\u672C\u30BB\u30C3\u30C8\u3002"
-      },
-      system_permissions: {
-        label: "\u30B7\u30B9\u30C6\u30E0\u6A29\u9650",
-        description: "\u7279\u5B9A\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u306B\u7D10\u3065\u304B\u306A\u3044\u9AD8\u30EC\u30D9\u30EB\u6A5F\u80FD \u2014 \u4F8B: manage_users, view_audit_logs\u3002"
-      },
-      object_and_field_permissions: {
-        label: "\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u3068\u30D5\u30A3\u30FC\u30EB\u30C9\u6A29\u9650",
-        description: "\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u5358\u4F4D\u306E CRUD + \u30D5\u30A3\u30FC\u30EB\u30C9\u5358\u4F4D\u306E FLS\u3002\u30DE\u30C8\u30EA\u30C3\u30AF\u30B9\u30A8\u30C7\u30A3\u30BF\u30FC\u3067\u7DE8\u96C6\u3001\u307E\u305F\u306F\u3053\u3053\u306B JSON \u3092\u8CBC\u308A\u4ED8\u3051\u3002"
-      },
-      tab_and_row_level_security: {
-        label: "\u30BF\u30D6\u3068\u884C\u30EC\u30D9\u30EB\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3",
-        description: "\u30BF\u30D6\u8868\u793A\u3001RLS \u30DD\u30EA\u30B7\u30FC\u3001\u8FF0\u8A9E\u8A55\u4FA1\u7528\u30AB\u30B9\u30BF\u30E0\u30B3\u30F3\u30C6\u30AD\u30B9\u30C8\u5909\u6570\u3002"
-      }
-    },
-    fields: {
-      name: {
-        label: "\u540D\u524D",
-        helpText: "\u30DE\u30B7\u30F3\u540D\uFF08snake_case\uFF09"
-      },
-      label: {
-        label: "\u8868\u793A\u540D",
-        helpText: "\u7BA1\u7406\u8005\u5411\u3051\u8868\u793A\u30E9\u30D9\u30EB"
-      },
-      systemPermissions: {
-        label: "\u30B7\u30B9\u30C6\u30E0\u6A29\u9650",
-        helpText: "\u30B7\u30B9\u30C6\u30E0\u6A5F\u80FD\u30AD\u30FC\u306E\u30EA\u30B9\u30C8"
-      },
-      objects: {
-        label: "\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u6A29\u9650",
-        helpText: '\u4F8B: { "account": { allowRead: true, allowEdit: true, ... } }'
-      },
-      fields: {
-        label: "\u30D5\u30A3\u30FC\u30EB\u30C9",
-        helpText: '\u4F8B: { "account.amount": { readable: true, editable: false } }'
-      },
-      tabPermissions: {
-        label: "\u30BF\u30D6\u6A29\u9650",
-        helpText: '\u4F8B: { "app_crm": "visible", "app_admin": "hidden" }'
-      },
-      rowLevelSecurity: {
-        label: "\u884C\u30EC\u30D9\u30EB\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3",
-        helpText: "RLS \u30DD\u30EA\u30B7\u30FC\u306E\u914D\u5217\uFF08rls.zod.ts \u53C2\u7167\uFF09"
-      },
-      contextVariables: {
-        label: "\u30B3\u30F3\u30C6\u30AD\u30B9\u30C8\u5909\u6570",
-        helpText: "RLS \u8FF0\u8A9E\u3067\u53C2\u7167\u3059\u308B\u30AB\u30B9\u30BF\u30E0\u5909\u6570"
-      }
-    }
-  },
-  role: {
-    label: "\u30ED\u30FC\u30EB",
+  position: {
+    label: "\u30DD\u30B8\u30B7\u30E7\u30F3",
     sections: {
-      role: {
-        label: "\u30ED\u30FC\u30EB",
-        description: "\u30ED\u30FC\u30EB\u306F\u30EC\u30B3\u30FC\u30C9\u5171\u6709\u306B\u4F7F\u3046\u968E\u5C64\u3092\u69CB\u6210\uFF08sales VP \u2192 sales mgr \u2192 sales rep\uFF09\u3002\u6A29\u9650\u81EA\u4F53\u306F Permission Sets \u3068 Profiles \u306B\u5B58\u5728\u3002"
+      position: {
+        label: "\u30DD\u30B8\u30B7\u30E7\u30F3",
+        description: "\u30DD\u30B8\u30B7\u30E7\u30F3\u306F\u6A29\u9650\u30BB\u30C3\u30C8\u3092\u307E\u3068\u3081\u3066\u5272\u308A\u5F53\u3066\u308B\u30D5\u30E9\u30C3\u30C8\u306A\u5358\u4F4D(\u4F8B: sales_rep\u3001sales_manager)\u3002\u80FD\u529B\u306F\u6A29\u9650\u30BB\u30C3\u30C8\u306B\u3001\u53EF\u8996\u7BC4\u56F2\u306E\u6DF1\u3055\u306F\u30D3\u30B8\u30CD\u30B9\u30E6\u30CB\u30C3\u30C8\u30C4\u30EA\u30FC\u306B\u3042\u308A\u307E\u3059\u3002"
       }
     },
     fields: {
@@ -21989,10 +22001,6 @@ var jaJPMetadataForms = {
       label: {
         label: "\u8868\u793A\u540D"
       },
-      parent: {
-        label: "\u89AA",
-        helpText: "\u89AA\u30ED\u30FC\u30EB\u306E\u30DE\u30B7\u30F3\u540D\uFF08Reports To\uFF09"
-      },
       description: {
         label: "\u8AAC\u660E"
       }
@@ -22482,6 +22490,70 @@ var esESMetadataForms = {
       datasource: {
         label: "Fuente de datos",
         helpText: 'ID de fuente de datos de destino (valor predeterminado: "default")'
+      },
+      lifecycle: {
+        label: "Lifecycle",
+        helpText: "Data lifecycle contract (ADR-0057): how long rows live and how space is reclaimed. Leave empty for permanent record semantics. Non-record classes require at least one bounding policy (retention, TTL, or rotation)."
+      },
+      "lifecycle.class": {
+        label: "Class",
+        helpText: "Persistence contract for the rows of this object"
+      },
+      "lifecycle.retention": {
+        label: "Retention",
+        helpText: "Age-based retention window"
+      },
+      "lifecycle.retention.maxAge": {
+        label: "Max Age",
+        helpText: 'Rows older than this (by created_at) are reaped. Duration literal: h/d/w/y, e.g. "30d"'
+      },
+      "lifecycle.ttl": {
+        label: "Ttl",
+        helpText: "Per-row TTL expiry"
+      },
+      "lifecycle.ttl.field": {
+        label: "Field",
+        helpText: "Timestamp field the TTL is measured from (e.g. expires_at)"
+      },
+      "lifecycle.ttl.expireAfter": {
+        label: "Expire After",
+        helpText: 'Rows expire this long after the field, e.g. "1d"'
+      },
+      "lifecycle.storage": {
+        label: "Storage",
+        helpText: "Physical rotation for high-frequency telemetry (SQLite: O(1) shard DROP)"
+      },
+      "lifecycle.storage.strategy": {
+        label: "Strategy",
+        helpText: "Storage strategy"
+      },
+      "lifecycle.storage.shards": {
+        label: "Shards",
+        helpText: "Shards retained; total window = shards \xD7 unit"
+      },
+      "lifecycle.storage.unit": {
+        label: "Unit",
+        helpText: "Time width of one shard"
+      },
+      "lifecycle.archive": {
+        label: "Archive",
+        helpText: "Cold-store hand-off (audit class). Rows are never hot-deleted before the archive copy succeeded."
+      },
+      "lifecycle.archive.after": {
+        label: "After",
+        helpText: "Archive rows older than this \u2014 must equal retention.maxAge"
+      },
+      "lifecycle.archive.to": {
+        label: "To",
+        helpText: "Target datasource name for cold storage"
+      },
+      "lifecycle.archive.keep": {
+        label: "Keep",
+        helpText: 'How long the archive keeps rows (empty = forever), e.g. "7y"'
+      },
+      "lifecycle.reclaim": {
+        label: "Reclaim",
+        helpText: "Reclaim driver space after sweeps (default on for non-record classes)"
       }
     }
   },
@@ -22590,10 +22662,6 @@ var esESMetadataForms = {
         label: "Operaciones de resumen",
         helpText: "Configuraci\xF3n de resumen roll-up (para relaciones padre-hijo)"
       },
-      cached: {
-        label: "En cach\xE9",
-        helpText: "Configuraci\xF3n de cach\xE9 para campos calculados"
-      },
       columnName: {
         label: "Nombre de columna",
         helpText: "Nombre de columna f\xEDsica en la base de datos (por defecto, el nombre del campo)"
@@ -22621,28 +22689,9 @@ var esESMetadataForms = {
       sortable: {
         label: "Ordenable",
         helpText: "Permite ordenar listas por este campo"
-      },
-      auditTrail: {
-        label: "Rastro de auditor\xEDa",
-        helpText: "Registra cambios detallados con usuario y marca temporal"
-      },
-      trackFeedHistory: {
-        label: "Historial de feed",
-        helpText: "Muestra cambios en el feed de actividad"
-      },
-      encryptionConfig: {
-        label: "Configuraci\xF3n de cifrado",
-        helpText: "Cifrado a nivel de campo (GDPR/HIPAA/PCI-DSS)"
-      },
-      maskingRule: {
-        label: "Regla de enmascaramiento",
-        helpText: "Reglas de enmascaramiento de datos para protecci\xF3n de PII"
       }
     }
   },
-  trigger: {
-    label: "Disparador"
-  },
   validation: {
     label: "Regla de validaci\xF3n"
   },
@@ -22719,12 +22768,36 @@ var esESMetadataForms = {
       onError: {
         label: "Al error"
       },
+      timeout: {
+        label: "Timeout",
+        helpText: "Abort the hook after N milliseconds"
+      },
       condition: {
         label: "Condici\xF3n",
         helpText: "F\xF3rmula opcional \u2014 omite el hook cuando eval\xFAa a false"
+      },
+      retryPolicy: {
+        label: "Retry Policy",
+        helpText: "Retry on failure \u2014 most useful for async hooks"
+      },
+      "retryPolicy.maxRetries": {
+        label: "Max Retries",
+        helpText: "Maximum retry attempts"
+      },
+      "retryPolicy.backoffMs": {
+        label: "Backoff Ms",
+        helpText: "Delay between retries (ms)"
       }
     }
   },
+  seed: {
+    label: "Seed Data",
+    description: "Fixture / initialization data applied on publish"
+  },
+  mapping: {
+    label: "Import Mapping",
+    description: "Reusable import/export field mapping (rename + transforms), referenced by name at import"
+  },
   view: {
     label: "Vista",
     sections: {
@@ -22896,6 +22969,10 @@ var esESMetadataForms = {
         label: "Dise\xF1o",
         description: "Regiones de p\xE1gina y componentes colocados en ellas."
       },
+      interface: {
+        label: "Interface (list pages)",
+        description: "Interface mode (Airtable parity): the page defines its own data surface directly \u2014 columns, filters, visualizations and toolbar \u2014 no inheriting from a separate view."
+      },
       advanced: {
         label: "Avanzado",
         description: "Activaci\xF3n, audiencia y accesibilidad."
@@ -22938,6 +23015,58 @@ var esESMetadataForms = {
         label: "Regiones",
         helpText: "Regiones de dise\xF1o (header, main, sidebar, footer) con componentes"
       },
+      interfaceConfig: {
+        label: "Interface Config",
+        helpText: "The page IS the view: source picks the object, columns/filterBy are defined directly here; appearance.allowedVisualizations whitelists renderers (one entry = locked); userActions toggles the toolbar."
+      },
+      "interfaceConfig.source": {
+        label: "Source",
+        helpText: "Object this page reads from"
+      },
+      "interfaceConfig.columns": {
+        label: "Columns",
+        helpText: "Columns to show \u2014 defined directly on the page (blank = all object fields)"
+      },
+      "interfaceConfig.filterBy": {
+        label: "Filter By",
+        helpText: "Always-on base filter for the page \u2014 same visual builder as the list toolbar."
+      },
+      "interfaceConfig.levels": {
+        label: "Levels",
+        helpText: "Hierarchy levels to display (tree-like sources)"
+      },
+      "interfaceConfig.appearance": {
+        label: "Appearance",
+        helpText: "Allowed visualizations (Grid / Kanban / Calendar / \u2026) and description visibility"
+      },
+      "interfaceConfig.userFilters": {
+        label: "User Filters",
+        helpText: "End-user filter bar: None (no bar) / Tabs (named presets) / Dropdown (per-field). None removes the config."
+      },
+      "interfaceConfig.userActions": {
+        label: "User Actions",
+        helpText: "Toolbar toggles (search, sort, filter, row height)"
+      },
+      "interfaceConfig.addRecord": {
+        label: "Add Record",
+        helpText: "Add-record entry point"
+      },
+      "interfaceConfig.buttons": {
+        label: "Buttons",
+        helpText: "Toolbar buttons \u2014 pick from this object's actions"
+      },
+      "interfaceConfig.recordAction": {
+        label: "Record Action",
+        helpText: "How clicking a record opens its detail"
+      },
+      "interfaceConfig.showRecordCount": {
+        label: "Show Record Count",
+        helpText: "Show the record count bar"
+      },
+      "interfaceConfig.allowPrinting": {
+        label: "Allow Printing",
+        helpText: "Allow users to print this page"
+      },
       isDefault: {
         label: "Predeterminado",
         helpText: "Establece como p\xE1gina predeterminada para este tipo de p\xE1gina"
@@ -23186,6 +23315,22 @@ var esESMetadataForms = {
         label: "Cuerpo",
         helpText: "C\xF3digo JavaScript que ejecutar"
       },
+      "body.language": {
+        label: "Language",
+        helpText: "expression = pure formula; js = sandboxed JavaScript"
+      },
+      "body.source": {
+        label: "Source",
+        helpText: "Function body source \u2014 no top-level imports"
+      },
+      "body.capabilities": {
+        label: "Capabilities",
+        helpText: "Allowed ctx APIs (api.read, api.write, crypto.uuid, log, \u2026)"
+      },
+      "body.timeoutMs": {
+        label: "Timeout Ms",
+        helpText: "Per-invocation timeout (ms)"
+      },
       params: {
         label: "Par\xE1metros",
         helpText: "Par\xE1metros de entrada de usuario (muestra el formulario antes de ejecutar)"
@@ -23226,9 +23371,9 @@ var esESMetadataForms = {
         label: "Acci\xF3n masiva",
         helpText: "Permite aplicar a varios registros seleccionados"
       },
-      aiExposed: {
-        label: "Expuesto a IA",
-        helpText: "Permite que agentes de IA llamen a esta acci\xF3n"
+      ai: {
+        label: "Ai",
+        helpText: "AI exposure (opt-in): set ai.exposed=true and write ai.description (\u226540 chars) to make this callable by agents."
       },
       recordIdParam: {
         label: "Par\xE1metro de ID de registro",
@@ -23251,13 +23396,9 @@ var esESMetadataForms = {
         label: "Aspectos b\xE1sicos",
         description: "Identidad y fuente de datos."
       },
-      columns: {
-        label: "Columnas",
-        description: "Columnas mostradas en la salida del informe."
-      },
-      groupings: {
-        label: "Agrupaciones",
-        description: "C\xF3mo se agrupan las filas (y columnas, para informes matrix)."
+      dataset_binding: {
+        label: "Dataset binding",
+        description: "The semantic-layer dataset this report renders. Values are the dataset\u2019s measures; rows are its dimensions."
       },
       joined_blocks: {
         label: "Bloques unidos",
@@ -23283,33 +23424,37 @@ var esESMetadataForms = {
       description: {
         label: "Descripci\xF3n"
       },
-      objectName: {
-        label: "Nombre de objeto",
-        helpText: "Objeto de fuente de datos"
-      },
       type: {
         label: "Tipo",
         helpText: "Tipo de informe: tabular/summary/matrix/joined"
       },
+      dataset: {
+        label: "Dataset",
+        helpText: "Dataset to bind (measures/dimensions come from its semantic layer)"
+      },
+      values: {
+        label: "Values",
+        helpText: "Measure names (from the dataset) to display"
+      },
+      rows: {
+        label: "Rows",
+        helpText: "Dimension names (from the dataset) to group rows by"
+      },
       columns: {
         label: "Columnas",
         helpText: "Columnas que mostrar en el informe"
       },
-      groupingsDown: {
-        label: "Agrupaciones verticales",
-        helpText: "Niveles de agrupaci\xF3n de filas"
-      },
-      groupingsAcross: {
-        label: "Agrupaciones horizontales",
-        helpText: "Niveles de agrupaci\xF3n de columnas (solo matrix)"
+      drilldown: {
+        label: "Drilldown",
+        helpText: "Click an aggregated row/cell to open the underlying records"
       },
       blocks: {
         label: "Bloques",
         helpText: "Une varios objetos (solo informe joined)"
       },
-      filter: {
-        label: "Filtro",
-        helpText: "Filtros a nivel de informe"
+      runtimeFilter: {
+        label: "Runtime Filter",
+        helpText: "Render-time scope filter, ANDed at query time"
       },
       chart: {
         label: "Gr\xE1fico",
@@ -23325,6 +23470,62 @@ var esESMetadataForms = {
       }
     }
   },
+  dataset: {
+    label: "Dataset",
+    description: "Analytics semantic layer \u2014 dimensions & measures",
+    sections: {
+      basics: {
+        label: "Basics",
+        description: "Dataset identity."
+      },
+      source: {
+        label: "Source",
+        description: "The base object, the relationships to join, and the dataset\u2019s intrinsic scope. Joins are derived from the object graph \u2014 pick relationship (lookup / master_detail) names, never write an ON clause."
+      },
+      dimensions: {
+        label: "Dimensions",
+        description: "Groupable axes. Use a base field, or `relationship.field` (e.g. account.region) for a relationship included above."
+      },
+      measures: {
+        label: "Measures",
+        description: "Aggregatable values defined once and referenced by name. A measure is sum/avg/count/\u2026 of a field; a derived measure combines other measures (ratio/sum/difference/product). Measure-scoped filters and derived ops are edited per-row in the dataset designer."
+      }
+    },
+    fields: {
+      name: {
+        label: "Name",
+        helpText: "snake_case unique identifier"
+      },
+      label: {
+        label: "Label",
+        helpText: "Display name"
+      },
+      description: {
+        label: "Description",
+        helpText: "What this dataset measures"
+      },
+      object: {
+        label: "Object",
+        helpText: "Base object \u2014 the FROM"
+      },
+      include: {
+        label: "Include",
+        helpText: 'Relationship (lookup / master_detail) field names to join \u2014 enables `relationship.field` dimensions/measures (e.g. include "account" \u2192 group by account.region)'
+      },
+      filter: {
+        label: "Filter",
+        helpText: "Intrinsic scope filter (e.g. exclude soft-deleted records), ANDed into every query"
+      },
+      dimensions: {
+        label: "Dimensions",
+        helpText: "Each: name (referenced by presentations), field, type, and \u2014 for dates \u2014 a default bucketing granularity"
+      },
+      measures: {
+        label: "Measures",
+        helpText: "Each: name, aggregate, field (optional for count), display format/currency, and a \u201Ccertified\u201D governance flag"
+      }
+    }
+  },
   flow: {
     label: "Flujo",
     sections: {
@@ -23404,15 +23605,6 @@ var esESMetadataForms = {
   translation: {
     label: "Traducci\xF3n"
   },
-  router: {
-    label: "Enrutador"
-  },
-  function: {
-    label: "Funci\xF3n"
-  },
-  service: {
-    label: "Servicio"
-  },
   email_template: {
     label: "Plantilla de email",
     sections: {
@@ -23493,6 +23685,14 @@ var esESMetadataForms = {
       }
     }
   },
+  doc: {
+    label: "Documentation",
+    description: "Package documentation \u2014 flat Markdown items (ADR-0046)"
+  },
+  book: {
+    label: "Documentation Book",
+    description: "Documentation navigation spine \u2014 ordered groups with derived membership (ADR-0046 \xA76)"
+  },
   permission: {
     label: "Conjunto de permisos",
     sections: {
@@ -23548,67 +23748,12 @@ var esESMetadataForms = {
       }
     }
   },
-  profile: {
-    label: "Perfil",
+  position: {
+    label: "Posici\xF3n",
     sections: {
-      identity: {
-        label: "Identidad",
-        description: "Los conjuntos de permisos se apilan sobre un perfil para conceder acceso adicional. Los perfiles son el conjunto base asignado 1:1 a cada usuario."
-      },
-      system_permissions: {
-        label: "Permisos del sistema",
-        description: "Capacidades de alto nivel no vinculadas a un objeto espec\xEDfico \u2014 p. ej. manage_users, view_audit_logs."
-      },
-      object_and_field_permissions: {
-        label: "Permisos de objeto y campo",
-        description: "CRUD por objeto + FLS por campo. Edita mediante el editor matricial o pega JSON aqu\xED."
-      },
-      tab_and_row_level_security: {
-        label: "Pesta\xF1a y seguridad a nivel de fila",
-        description: "Visibilidad de pesta\xF1as, pol\xEDticas RLS y variables de contexto personalizadas para evaluar predicados."
-      }
-    },
-    fields: {
-      name: {
-        label: "Nombre",
-        helpText: "Nombre de m\xE1quina (snake_case)"
-      },
-      label: {
-        label: "Etiqueta",
-        helpText: "Etiqueta mostrada para administradores"
-      },
-      systemPermissions: {
-        label: "Permisos del sistema",
-        helpText: "Lista de claves de capacidades del sistema"
-      },
-      objects: {
-        label: "Permisos de objeto",
-        helpText: 'Ejemplo: { "account": { allowRead: true, allowEdit: true, ... } }'
-      },
-      fields: {
-        label: "Campos",
-        helpText: 'Ejemplo: { "account.amount": { readable: true, editable: false } }'
-      },
-      tabPermissions: {
-        label: "Permisos de pesta\xF1a",
-        helpText: 'Ejemplo: { "app_crm": "visible", "app_admin": "hidden" }'
-      },
-      rowLevelSecurity: {
-        label: "Seguridad a nivel de fila",
-        helpText: "Array de pol\xEDticas RLS (ver rls.zod.ts)"
-      },
-      contextVariables: {
-        label: "Variables de contexto",
-        helpText: "Variables personalizadas referenciadas en predicados RLS"
-      }
-    }
-  },
-  role: {
-    label: "Rol",
-    sections: {
-      role: {
-        label: "Rol",
-        description: "Los roles componen una jerarqu\xEDa usada para compartir registros (sales VP \u2192 sales mgr \u2192 sales rep). Los permisos en s\xED residen en Permission Sets y Profiles."
+      position: {
+        label: "Posici\xF3n",
+        description: "Una posici\xF3n es un conjunto plano y asignable de permission sets (p. ej. sales_rep, sales_manager). La capacidad reside en los permission sets; la profundidad de visibilidad en el \xE1rbol de unidades de negocio."
       }
     },
     fields: {
@@ -23619,10 +23764,6 @@ var esESMetadataForms = {
       label: {
         label: "Etiqueta"
       },
-      parent: {
-        label: "Padre",
-        helpText: "Nombre de m\xE1quina del rol padre (Reports To)"
-      },
       description: {
         label: "Descripci\xF3n"
       }
@@ -23953,6 +24094,7 @@ exports.SysOauthConsent = SysOauthConsent;
 exports.SysOauthRefreshToken = SysOauthRefreshToken;
 exports.SysOrganization = SysOrganization;
 exports.SysOrganizationDetailPage = SysOrganizationDetailPage;
+exports.SysPositionDetailPage = SysPositionDetailPage;
 exports.SysReportSchedule = SysReportSchedule;
 exports.SysSavedReport = SysSavedReport;
 exports.SysScimProvider = SysScimProvider;