@objectstack/platform-objects 14.8.0 → 15.1.0

package/dist/index.mjs

@@ -53,7 +53,7 @@ var SysUser = ObjectSchema.create({
       // "add a teammate" affordance — the Users list is always reachable —
       // and every add flows through better-auth invitations, never bespoke
       // sys_user CRUD.
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       successMessage: "Invitation sent",
       refreshAfter: true,
       params: [
@@ -64,9 +64,11 @@ var SysUser = ObjectSchema.create({
     // ── Platform admin operations (require better-auth `admin` plugin) ─
     //
     // These actions hit /api/v1/auth/admin/* endpoints that are only
-    // wired when `auth.plugins.admin` is enabled. When the plugin is
-    // disabled the actions still render (schema is static) but server
-    // returns 404. UI surfaces them under the row menu AND the
+    // wired when `auth.plugins.admin` is enabled, so each one is gated on
+    // `requiresFeature: 'admin'` (#2874) — when the plugin is off the UI
+    // hides them instead of rendering buttons that 404. SCIM deployments
+    // keep them: SCIM forces the admin plugin (and `features.admin`) on
+    // (ADR-0071). UI surfaces them under the row menu AND the
     // record-detail header (`record_header`, overflowing into the ⋯
     // "More" menu) so platform admins can manage an account from either
     // the Users list or an open user record — without dropping to SQL or
@@ -79,6 +81,7 @@ var SysUser = ObjectSchema.create({
       locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/ban-user",
+      requiresFeature: "admin",
       recordIdParam: "userId",
       successMessage: "User banned",
       refreshAfter: true,
@@ -95,6 +98,7 @@ var SysUser = ObjectSchema.create({
       locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/unban-user",
+      requiresFeature: "admin",
       recordIdParam: "userId",
       successMessage: "User unbanned",
       refreshAfter: true
@@ -110,6 +114,7 @@ var SysUser = ObjectSchema.create({
       locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/unlock-user",
+      requiresFeature: "admin",
       recordIdParam: "userId",
       successMessage: "Account unlocked",
       refreshAfter: true
@@ -129,7 +134,7 @@ var SysUser = ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/admin/create-user",
-      visible: "features.admin == true",
+      requiresFeature: "admin",
       successMessage: "User created",
       refreshAfter: true,
       params: [
@@ -146,7 +151,7 @@ var SysUser = ObjectSchema.create({
           // otherwise the create-user endpoint rejects a phone with
           // "Phone numbers require the phoneNumber auth plugin". `features.phoneNumber`
           // is served in /api/v1/auth/config (getPublicConfig).
-          visible: "features.phoneNumber == true"
+          requiresFeature: "phoneNumber"
         },
         { field: "name", required: false },
         {
@@ -188,6 +193,7 @@ var SysUser = ObjectSchema.create({
       // legacy role scalar), can mint a temporary password, and stamps
       // must_change_password.
       target: "/api/v1/auth/admin/set-user-password",
+      requiresFeature: "admin",
       recordIdParam: "userId",
       successMessage: "Password updated",
       refreshAfter: false,
@@ -225,6 +231,7 @@ var SysUser = ObjectSchema.create({
       locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/set-role",
+      requiresFeature: "admin",
       recordIdParam: "userId",
       successMessage: "Role updated",
       refreshAfter: true,
@@ -240,6 +247,7 @@ var SysUser = ObjectSchema.create({
       locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/impersonate-user",
+      requiresFeature: "admin",
       recordIdParam: "userId",
       successMessage: "Now impersonating user",
       refreshAfter: true,
@@ -357,6 +365,7 @@ var SysUser = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/two-factor/enable",
       visible: "record.id == ctx.user.id && record.two_factor_enabled != true",
+      requiresFeature: "twoFactor",
       successMessage: "Two-factor authentication enabled. Scan the QR code or paste the otpauth URI into your authenticator app, then verify a code to complete setup.",
       refreshAfter: true,
       params: [
@@ -372,6 +381,7 @@ var SysUser = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/two-factor/disable",
       visible: "record.id == ctx.user.id && record.two_factor_enabled == true",
+      requiresFeature: "twoFactor",
       confirmText: "Turn off two-factor authentication? Your account will be less secure.",
       successMessage: "Two-factor authentication disabled.",
       refreshAfter: true,
@@ -388,6 +398,7 @@ var SysUser = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/two-factor/generate-backup-codes",
       visible: "record.id == ctx.user.id && record.two_factor_enabled == true",
+      requiresFeature: "twoFactor",
       confirmText: "Generate a new set of backup codes? Any previously generated codes will stop working.",
       successMessage: "New backup codes generated \u2014 save them somewhere safe.",
       refreshAfter: false,
@@ -1195,7 +1206,7 @@ var SysOrganization = ObjectSchema.create({
       // populated by the console/account shells from `/auth/config`;
       // we default to visible when the flag is undefined so we don't
       // accidentally hide the button while auth config is still loading.
-      visible: "features.multiOrgEnabled != false",
+      requiresFeature: "multiOrgEnabled",
       params: [
         { field: "name", required: true },
         { field: "slug", required: true },
@@ -1216,7 +1227,7 @@ var SysOrganization = ObjectSchema.create({
       // Org-admin actions are multi-org-only; hide them in single-org for
       // consistency with `create_organization` (the org list is empty there,
       // but this also guards direct record-URL access).
-      visible: "features.multiOrgEnabled != false",
+      requiresFeature: "multiOrgEnabled",
       successMessage: "Organization updated",
       refreshAfter: true,
       params: [
@@ -1235,7 +1246,7 @@ var SysOrganization = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/delete",
       recordIdParam: "organizationId",
-      visible: "features.multiOrgEnabled != false",
+      requiresFeature: "multiOrgEnabled",
       confirmText: "Delete this organization? All members will lose access immediately. This cannot be undone.",
       successMessage: "Organization deleted",
       refreshAfter: true
@@ -1254,7 +1265,7 @@ var SysOrganization = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/set-active",
       recordIdParam: "organizationId",
-      visible: "features.multiOrgEnabled != false",
+      requiresFeature: "multiOrgEnabled",
       successMessage: "Active organization switched",
       refreshAfter: true
     },
@@ -1271,7 +1282,7 @@ var SysOrganization = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/leave",
       recordIdParam: "organizationId",
-      visible: "features.multiOrgEnabled != false",
+      requiresFeature: "multiOrgEnabled",
       confirmText: "Leave this organization? You will lose access to all of its resources.",
       successMessage: "You have left the organization",
       refreshAfter: true
@@ -1293,7 +1304,7 @@ var SysOrganization = ObjectSchema.create({
       type: "api",
       target: "/api/v1/cloud/organizations/{id}/change-slug",
       method: "POST",
-      visible: "features.multiOrgEnabled != false",
+      requiresFeature: "multiOrgEnabled",
       confirmText: "Renaming the slug rewrites every platform subdomain for this org and parks the old slug for 90 days. Continue?",
       successMessage: "Organization slug changed",
       refreshAfter: true,
@@ -1431,7 +1442,7 @@ var SysMember = ObjectSchema.create({
       // better-auth endpoints resolve the session's active org, which
       // single-org mode now guarantees via plugin-auth's default-org
       // bootstrap. Same gate on every membership mutation below.
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       successMessage: "Member added",
       refreshAfter: true,
       params: [
@@ -1449,7 +1460,7 @@ var SysMember = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/update-member-role",
       recordIdParam: "memberId",
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       successMessage: "Member role updated",
       refreshAfter: true,
       params: [
@@ -1466,7 +1477,7 @@ var SysMember = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/remove-member",
       recordIdParam: "memberIdOrEmail",
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       confirmText: "Remove this member from the organization? They will lose access to all org resources.",
       successMessage: "Member removed",
       refreshAfter: true
@@ -1488,7 +1499,10 @@ var SysMember = ObjectSchema.create({
       target: "/api/v1/auth/organization/update-member-role",
       recordIdParam: "memberId",
       bodyExtra: { role: "owner" },
-      visible: "record.role != 'owner' && features.organization != false",
+      // The residual row predicate stays hand-written; the feature gate is
+      // AND-composed onto it by the requiresFeature lowering.
+      visible: "record.role != 'owner'",
+      requiresFeature: "organization",
       confirmText: "Transfer ownership of this organization to the selected member? You will be demoted to admin and lose owner-only privileges.",
       successMessage: "Ownership transferred",
       refreshAfter: true
@@ -1596,7 +1610,7 @@ var SysInvitation = ObjectSchema.create({
       // sys_organization.create_organization). The recipient-side
       // accept/reject actions below stay record-gated — they are
       // unreachable in single-org anyway (no invitation rows exist).
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       successMessage: "Invitation sent",
       refreshAfter: true,
       params: [
@@ -1614,7 +1628,7 @@ var SysInvitation = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/cancel-invitation",
       recordIdParam: "invitationId",
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       confirmText: "Cancel this invitation? The recipient will no longer be able to accept it.",
       successMessage: "Invitation canceled",
       refreshAfter: true
@@ -1628,7 +1642,7 @@ var SysInvitation = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/invite-member",
       bodyExtra: { resend: true },
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       successMessage: "Invitation resent",
       refreshAfter: true,
       params: [
@@ -1818,7 +1832,7 @@ var SysTeam = ObjectSchema.create({
       // Teams are nested inside organizations — a multi-org-only concept.
       // Gate every team mutation on the multi-org flag so the affordances
       // disappear in single-org (mirrors sys_organization.create_organization).
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       successMessage: "Team created",
       refreshAfter: true,
       params: [
@@ -1839,7 +1853,7 @@ var SysTeam = ObjectSchema.create({
       target: "/api/v1/auth/organization/update-team",
       recordIdParam: "teamId",
       bodyShape: { wrap: "data" },
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       successMessage: "Team updated",
       refreshAfter: true,
       params: [
@@ -1858,7 +1872,7 @@ var SysTeam = ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/remove-team",
       recordIdParam: "teamId",
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       confirmText: "Delete this team? Members will lose any team-scoped access. This cannot be undone.",
       successMessage: "Team deleted",
       refreshAfter: true
@@ -1972,7 +1986,7 @@ var SysTeamMember = ObjectSchema.create({
       // Team membership lives under organizations — multi-org-only. Gate
       // both mutations so they vanish in single-org (mirrors
       // sys_organization.create_organization).
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       successMessage: "Team member added",
       refreshAfter: true,
       params: [
@@ -1993,7 +2007,7 @@ var SysTeamMember = ObjectSchema.create({
       locations: ["list_item"],
       type: "api",
       target: "/api/v1/auth/organization/remove-team-member",
-      visible: "features.organization != false",
+      requiresFeature: "organization",
       confirmText: "Remove this user from the team? They will lose any team-scoped access.",
       successMessage: "Team member removed",
       refreshAfter: true,
@@ -2549,6 +2563,7 @@ var SysTwoFactor = ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/two-factor/enable",
+      requiresFeature: "twoFactor",
       refreshAfter: true,
       params: [
         { name: "password", label: "Current Password", type: "text", required: true }
@@ -2571,6 +2586,7 @@ var SysTwoFactor = ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/two-factor/disable",
+      requiresFeature: "twoFactor",
       confirmText: "Disable two-factor authentication on your account?",
       successMessage: "2FA disabled",
       refreshAfter: true,
@@ -2586,6 +2602,7 @@ var SysTwoFactor = ObjectSchema.create({
       locations: ["list_toolbar", "list_item"],
       type: "api",
       target: "/api/v1/auth/two-factor/generate-backup-codes",
+      requiresFeature: "twoFactor",
       confirmText: "Regenerate backup codes? All previous backup codes will stop working immediately.",
       refreshAfter: true,
       params: [
@@ -2900,6 +2917,7 @@ var SysOauthApplication = ObjectSchema.create({
       type: "api",
       method: "POST",
       target: "/api/v1/auth/admin/oauth2/toggle-disabled",
+      requiresFeature: "oidcProvider",
       confirmText: "Disable this OAuth application? Active access/refresh tokens issued to it will continue to be rejected at the token, authorize, and introspect endpoints. Existing integrations will stop working immediately.",
       successMessage: "OAuth application disabled",
       refreshAfter: true,
@@ -2919,6 +2937,7 @@ var SysOauthApplication = ObjectSchema.create({
       type: "api",
       method: "POST",
       target: "/api/v1/auth/admin/oauth2/toggle-disabled",
+      requiresFeature: "oidcProvider",
       confirmText: "Re-enable this OAuth application? Token issuance, authorization, and introspection will resume immediately.",
       successMessage: "OAuth application enabled",
       refreshAfter: true,
@@ -2938,6 +2957,7 @@ var SysOauthApplication = ObjectSchema.create({
       type: "api",
       method: "POST",
       target: "/api/v1/auth/sys-oauth-application/register",
+      requiresFeature: "oidcProvider",
       refreshAfter: true,
       params: [
         { name: "name", label: "Application Name", type: "text", required: true },
@@ -2969,6 +2989,7 @@ var SysOauthApplication = ObjectSchema.create({
       type: "api",
       method: "POST",
       target: "/api/v1/auth/oauth2/client/rotate-secret",
+      requiresFeature: "oidcProvider",
       confirmText: "Rotate this OAuth client's secret? The previous secret will stop working immediately and any integrations using it will break until they are updated with the new secret. The new secret is shown only once.",
       refreshAfter: true,
       params: [
@@ -2993,6 +3014,7 @@ var SysOauthApplication = ObjectSchema.create({
       type: "api",
       method: "POST",
       target: "/api/v1/auth/oauth2/delete-client",
+      requiresFeature: "oidcProvider",
       confirmText: "Permanently delete this OAuth application? All issued tokens and consents will be invalidated and integrations using this client_id will stop working immediately. This cannot be undone.",
       successMessage: "OAuth application deleted",
       refreshAfter: true,
@@ -3172,6 +3194,25 @@ var SysOauthApplication = ObjectSchema.create({
       description: "OIDC subject type (e.g. public, pairwise)",
       group: "Credentials"
     }),
+    jwks: Field.textarea({
+      label: "JWKS",
+      required: false,
+      description: "Client JSON Web Key Set (for private_key_jwt / signed-request verification)",
+      group: "Credentials"
+    }),
+    jwks_uri: Field.url({
+      label: "JWKS URI",
+      required: false,
+      description: "URL of the client JSON Web Key Set",
+      group: "Credentials"
+    }),
+    dpop_bound_access_tokens: Field.boolean({
+      label: "DPoP-bound Access Tokens",
+      required: false,
+      defaultValue: false,
+      description: "Require access tokens issued to this client to be DPoP-bound (RFC 9449)",
+      group: "Credentials"
+    }),
     // ── Behaviour flags ──────────────────────────────────────────
     disabled: Field.boolean({
       label: "Disabled",
@@ -3191,6 +3232,18 @@ var SysOauthApplication = ObjectSchema.create({
       description: "Allow the client to call the OIDC end-session endpoint",
       group: "Behaviour"
     }),
+    backchannel_logout_uri: Field.url({
+      label: "Back-channel Logout URI",
+      required: false,
+      description: "OIDC back-channel logout endpoint of the client",
+      group: "Behaviour"
+    }),
+    backchannel_logout_session_required: Field.boolean({
+      label: "Back-channel Logout Session Required",
+      required: false,
+      description: "Whether the back-channel logout token must include a sid claim",
+      group: "Behaviour"
+    }),
     // ── Software statement (RFC 7591 §2.3) ───────────────────────
     software_id: Field.text({
       label: "Software ID",
@@ -3316,6 +3369,22 @@ var SysOauthAccessToken = ObjectSchema.create({
       maxLength: 255,
       description: "Caller-supplied correlation identifier"
     }),
+    authorization_code_id: Field.text({
+      label: "Authorization Code ID",
+      required: false,
+      maxLength: 255,
+      description: "ID of the authorization-code grant this token originates from"
+    }),
+    resources: Field.textarea({
+      label: "Resources",
+      required: false,
+      description: "JSON-serialized list of RFC 8707 resource indicators bound to this token"
+    }),
+    requested_user_info_claims: Field.textarea({
+      label: "Requested UserInfo Claims",
+      required: false,
+      description: "JSON-serialized list of OIDC claims requested for the userinfo endpoint"
+    }),
     scopes: Field.textarea({
       label: "Scopes",
       required: true,
@@ -3329,6 +3398,16 @@ var SysOauthAccessToken = ObjectSchema.create({
       label: "Created At",
       defaultValue: "NOW()",
       readonly: true
+    }),
+    revoked: Field.datetime({
+      label: "Revoked At",
+      required: false,
+      description: "Timestamp at which this access token was revoked"
+    }),
+    confirmation: Field.textarea({
+      label: "Confirmation",
+      required: false,
+      description: "JSON RFC 7800 cnf claim (e.g. DPoP key thumbprint) binding this token to a key"
     })
   },
   indexes: [
@@ -3336,7 +3415,8 @@ var SysOauthAccessToken = ObjectSchema.create({
     { fields: ["client_id"] },
     { fields: ["session_id"] },
     { fields: ["user_id"] },
-    { fields: ["refresh_id"] }
+    { fields: ["refresh_id"] },
+    { fields: ["authorization_code_id"] }
   ],
   enable: {
     trackHistory: false,
@@ -3402,6 +3482,22 @@ var SysOauthRefreshToken = ObjectSchema.create({
       maxLength: 255,
       description: "Caller-supplied correlation identifier"
     }),
+    authorization_code_id: Field.text({
+      label: "Authorization Code ID",
+      required: false,
+      maxLength: 255,
+      description: "ID of the authorization-code grant this token chain originates from"
+    }),
+    resources: Field.textarea({
+      label: "Resources",
+      required: false,
+      description: "JSON-serialized list of RFC 8707 resource indicators bound to this token"
+    }),
+    requested_user_info_claims: Field.textarea({
+      label: "Requested UserInfo Claims",
+      required: false,
+      description: "JSON-serialized list of OIDC claims requested for the userinfo endpoint"
+    }),
     scopes: Field.textarea({
       label: "Scopes",
       required: true,
@@ -3421,17 +3517,38 @@ var SysOauthRefreshToken = ObjectSchema.create({
       required: false,
       description: "Timestamp at which this refresh token was revoked"
     }),
+    rotated_at: Field.datetime({
+      label: "Rotated At",
+      required: false,
+      description: "Timestamp at which this token was rotated (superseded by a new row)"
+    }),
+    rotation_replay_response: Field.textarea({
+      label: "Rotation Replay Response",
+      required: false,
+      description: "Cached token response replayed when the old token is re-presented within the reuse interval"
+    }),
+    rotation_replay_expires_at: Field.datetime({
+      label: "Rotation Replay Expires At",
+      required: false,
+      description: "End of the post-rotation reuse interval during which the replay response is served"
+    }),
     auth_time: Field.datetime({
       label: "Auth Time",
       required: false,
       description: "When the user originally authenticated for this token chain"
+    }),
+    confirmation: Field.textarea({
+      label: "Confirmation",
+      required: false,
+      description: "JSON RFC 7800 cnf claim (e.g. DPoP key thumbprint) binding this token to a key"
     })
   },
   indexes: [
     { fields: ["token"], unique: true },
     { fields: ["client_id"] },
     { fields: ["session_id"] },
-    { fields: ["user_id"] }
+    { fields: ["user_id"] },
+    { fields: ["authorization_code_id"] }
   ],
   enable: {
     trackHistory: false,
@@ -3481,6 +3598,16 @@ var SysOauthConsent = ObjectSchema.create({
       maxLength: 255,
       description: "Caller-supplied correlation identifier"
     }),
+    resources: Field.textarea({
+      label: "Resources",
+      required: false,
+      description: "JSON-serialized list of RFC 8707 resource indicators the consent covers"
+    }),
+    requested_user_info_claims: Field.textarea({
+      label: "Requested UserInfo Claims",
+      required: false,
+      description: "JSON-serialized list of OIDC claims the user consented to expose"
+    }),
     scopes: Field.textarea({
       label: "Scopes",
       required: true,
@@ -3510,6 +3637,215 @@ var SysOauthConsent = ObjectSchema.create({
     mru: false
   }
 });
+var SysOauthResource = ObjectSchema.create({
+  name: "sys_oauth_resource",
+  label: "OAuth Resource",
+  pluralLabel: "OAuth Resources",
+  icon: "server",
+  isSystem: true,
+  managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
+  description: "Registered OAuth protected resources (RFC 8707 resource indicators)",
+  displayNameField: "name",
+  nameField: "name",
+  highlightFields: ["name", "identifier", "disabled"],
+  fields: {
+    id: Field.text({
+      label: "ID",
+      required: true,
+      readonly: true
+    }),
+    identifier: Field.text({
+      label: "Identifier",
+      required: true,
+      maxLength: 1024,
+      description: "Resource indicator URI presented in the RFC 8707 resource parameter"
+    }),
+    name: Field.text({
+      label: "Name",
+      required: true,
+      maxLength: 255
+    }),
+    access_token_ttl: Field.number({
+      label: "Access Token TTL",
+      required: false,
+      description: "Access-token lifetime in seconds for this resource (overrides the server default)"
+    }),
+    refresh_token_ttl: Field.number({
+      label: "Refresh Token TTL",
+      required: false,
+      description: "Refresh-token lifetime in seconds for this resource (overrides the server default)"
+    }),
+    signing_algorithm: Field.text({
+      label: "Signing Algorithm",
+      required: false,
+      maxLength: 32,
+      description: "JWS algorithm used to sign access tokens for this resource"
+    }),
+    signing_key_id: Field.text({
+      label: "Signing Key ID",
+      required: false,
+      maxLength: 255,
+      description: "Key id (kid) used to sign access tokens for this resource"
+    }),
+    allowed_scopes: Field.textarea({
+      label: "Allowed Scopes",
+      required: false,
+      description: "JSON-serialized list of scopes clients may request for this resource"
+    }),
+    custom_claims: Field.textarea({
+      label: "Custom Claims",
+      required: false,
+      description: "JSON object of extra claims stamped on access tokens for this resource"
+    }),
+    dpop_bound_access_tokens_required: Field.boolean({
+      label: "DPoP Required",
+      required: false,
+      defaultValue: false,
+      description: "Require access tokens for this resource to be DPoP-bound (RFC 9449)"
+    }),
+    disabled: Field.boolean({
+      label: "Disabled",
+      required: false,
+      defaultValue: false
+    }),
+    policy_version: Field.number({
+      label: "Policy Version",
+      required: false,
+      defaultValue: 1,
+      description: "Monotonic version of the resource token policy"
+    }),
+    metadata: Field.textarea({
+      label: "Metadata",
+      required: false,
+      description: "JSON object of additional resource metadata"
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    })
+  },
+  indexes: [
+    { fields: ["identifier"], unique: true }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: false,
+    apiMethods: [],
+    trash: false,
+    mru: false
+  }
+});
+var SysOauthClientResource = ObjectSchema.create({
+  name: "sys_oauth_client_resource",
+  label: "OAuth Client Resource",
+  pluralLabel: "OAuth Client Resources",
+  icon: "link",
+  isSystem: true,
+  managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
+  description: "Grants allowing an OAuth client to request tokens for a protected resource",
+  highlightFields: ["client_id", "resource_id"],
+  fields: {
+    id: Field.text({
+      label: "ID",
+      required: true,
+      readonly: true
+    }),
+    client_id: Field.text({
+      label: "Client ID",
+      required: true,
+      description: "Foreign key to sys_oauth_application.client_id"
+    }),
+    resource_id: Field.text({
+      label: "Resource ID",
+      required: true,
+      maxLength: 1024,
+      description: "Foreign key to sys_oauth_resource.identifier"
+    }),
+    metadata: Field.textarea({
+      label: "Metadata",
+      required: false,
+      description: "JSON object of additional grant metadata"
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    })
+  },
+  indexes: [
+    { fields: ["client_id"] },
+    { fields: ["resource_id"] }
+  ],
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: false,
+    apiMethods: [],
+    trash: false,
+    mru: false
+  }
+});
+var SysOauthClientAssertion = ObjectSchema.create({
+  name: "sys_oauth_client_assertion",
+  label: "OAuth Client Assertion",
+  pluralLabel: "OAuth Client Assertions",
+  icon: "shield-check",
+  isSystem: true,
+  managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema,
+  // but may add overlay row-level config. Use `no-overlay` if you need to
+  // forbid sys_metadata overlays entirely.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth \u2014 see ADR-0010.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
+  description: "Consumed OAuth client-assertion JTIs (RFC 7523 replay prevention)",
+  highlightFields: ["expires_at"],
+  fields: {
+    id: Field.text({
+      label: "ID",
+      required: true,
+      readonly: true
+    }),
+    expires_at: Field.datetime({
+      label: "Expires At",
+      required: true,
+      description: "Assertion expiry \u2014 rows past this instant are safe to prune"
+    })
+  },
+  enable: {
+    trackHistory: false,
+    searchable: false,
+    apiEnabled: false,
+    apiMethods: [],
+    trash: false,
+    mru: false
+  }
+});
 var SysJwks = ObjectSchema.create({
   name: "sys_jwks",
   label: "JWKS Key",
@@ -3551,6 +3887,21 @@ var SysJwks = ObjectSchema.create({
       required: true,
       description: "JSON-serialized JWK private key (encrypted at rest)"
     }),
+    // better-auth 1.7 records the key's signing algorithm and (for EdDSA/EC
+    // keys) its curve alongside the key material, so tokens can advertise the
+    // correct `alg`/`crv` in the JWKS response. Both are optional — legacy rows
+    // minted before 1.7 leave them null and better-auth falls back to the
+    // configured `keyPairConfig.alg` (default `EdDSA`).
+    alg: Field.text({
+      label: "Algorithm",
+      required: false,
+      description: "JWK signing algorithm, e.g. `EdDSA` (better-auth 1.7+)"
+    }),
+    crv: Field.text({
+      label: "Curve",
+      required: false,
+      description: "JWK curve for EdDSA/EC keys, e.g. `Ed25519` (better-auth 1.7+)"
+    }),
     created_at: Field.datetime({
       label: "Created At",
       required: true,
@@ -3593,7 +3944,7 @@ var SysSsoProvider = ObjectSchema.create({
   // Together: admins see all env providers; non-admins get 403. better-auth's
   // own endpoints already read via a system context. (Env-only object — no
   // control-plane cross-tenant risk.)
-  tenancy: { enabled: false, strategy: "shared" },
+  tenancy: { enabled: false },
   requiredPermissions: ["manage_platform_settings"],
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema.
   protection: {
@@ -4102,24 +4453,6 @@ var SysAttachment = ObjectSchema.create({
       required: false,
       group: "File"
     }),
-    // ── Sharing ────────────────────────────────────────────────
-    share_type: Field.select(
-      ["viewer", "collaborator", "inferred"],
-      {
-        label: "Share Type",
-        defaultValue: "viewer",
-        description: "viewer | collaborator | inferred (inherited from parent record)",
-        group: "Sharing"
-      }
-    ),
-    visibility: Field.select(
-      ["internal", "all_users", "shared_users"],
-      {
-        label: "Visibility",
-        defaultValue: "internal",
-        group: "Sharing"
-      }
-    ),
     // ── Authoring ──────────────────────────────────────────────
     uploaded_by: Field.lookup("sys_user", {
       label: "Uploaded By",
@@ -4154,7 +4487,12 @@ var SysAttachment = ObjectSchema.create({
     trackHistory: false,
     searchable: true,
     apiEnabled: true,
-    trash: true,
+    // [#2970 item 5 / ADR-0049] `trash` is `dead` in the liveness ledger (no
+    // engine soft-delete reader) and attachment deletes ARE hard (#2755): the
+    // reap guard reclaims a file's bytes once its last join row is gone, so a
+    // "restore" would dangle. Declare `false` — the honest state — rather than
+    // claim a restore capability the runtime does not provide.
+    trash: false,
     mru: false,
     clone: false
   }
@@ -6389,7 +6727,12 @@ var enObjects = {
       ban_user: {
         label: "Ban User",
         confirmText: "Ban this user? They will be signed out and unable to sign in until unbanned.",
-        successMessage: "User banned"
+        successMessage: "User banned",
+        params: {
+          banReason: {
+            label: "Ban Reason"
+          }
+        }
       },
       unban_user: {
         label: "Unban User",
@@ -6401,15 +6744,46 @@ var enObjects = {
       },
       create_user: {
         label: "Create User",
-        successMessage: "User created"
+        successMessage: "User created",
+        params: {
+          phoneNumber: {
+            label: "Phone Number",
+            helpText: "Sign-in phone number (E.164, e.g. +8613800000000). Required when no email is given."
+          },
+          generatePassword: {
+            label: "Generate Temporary Password"
+          },
+          password: {
+            label: "Password (leave empty to generate)"
+          },
+          mustChangePassword: {
+            label: "Require Password Change On First Login"
+          }
+        }
       },
       set_user_password: {
         label: "Set Password",
-        successMessage: "Password updated"
+        successMessage: "Password updated",
+        params: {
+          generatePassword: {
+            label: "Generate Temporary Password"
+          },
+          newPassword: {
+            label: "New Password (leave empty to generate)"
+          },
+          mustChangePassword: {
+            label: "Require Password Change On Next Login"
+          }
+        }
       },
       set_user_role: {
         label: "Set Platform Role",
-        successMessage: "Role updated"
+        successMessage: "Role updated",
+        params: {
+          role: {
+            label: "Platform Role"
+          }
+        }
       },
       impersonate_user: {
         label: "Impersonate User",
@@ -6422,11 +6796,27 @@ var enObjects = {
       },
       change_my_password: {
         label: "Change Password",
-        successMessage: "Password changed"
+        successMessage: "Password changed",
+        params: {
+          currentPassword: {
+            label: "Current Password"
+          },
+          newPassword: {
+            label: "New Password"
+          },
+          revokeOtherSessions: {
+            label: "Sign out other devices"
+          }
+        }
       },
       change_my_email: {
         label: "Change Email",
-        successMessage: "Verification email sent \u2014 check the new address to confirm."
+        successMessage: "Verification email sent \u2014 check the new address to confirm.",
+        params: {
+          newEmail: {
+            label: "New Email"
+          }
+        }
       },
       resend_verification_email: {
         label: "Resend Verification Email",
@@ -6435,21 +6825,41 @@ var enObjects = {
       delete_my_account: {
         label: "Delete My Account",
         confirmText: "Permanently delete your account? This cannot be undone \u2014 all your sessions will be terminated and all data you own will be removed per the configured retention policy.",
-        successMessage: "Account deleted"
+        successMessage: "Account deleted",
+        params: {
+          password: {
+            label: "Current Password"
+          }
+        }
       },
       enable_two_factor: {
         label: "Enable Two-Factor Auth",
-        successMessage: "Two-factor authentication enabled. Scan the QR code or paste the otpauth URI into your authenticator app, then verify a code to complete setup."
+        successMessage: "Two-factor authentication enabled. Scan the QR code or paste the otpauth URI into your authenticator app, then verify a code to complete setup.",
+        params: {
+          password: {
+            label: "Current Password"
+          }
+        }
       },
       disable_two_factor: {
         label: "Disable Two-Factor Auth",
         confirmText: "Turn off two-factor authentication? Your account will be less secure.",
-        successMessage: "Two-factor authentication disabled."
+        successMessage: "Two-factor authentication disabled.",
+        params: {
+          password: {
+            label: "Current Password"
+          }
+        }
       },
       generate_backup_codes: {
         label: "Regenerate Backup Codes",
         confirmText: "Generate a new set of backup codes? Any previously generated codes will stop working.",
-        successMessage: "New backup codes generated \u2014 save them somewhere safe."
+        successMessage: "New backup codes generated \u2014 save them somewhere safe.",
+        params: {
+          password: {
+            label: "Current Password"
+          }
+        }
       }
     }
   },
@@ -6593,7 +7003,21 @@ var enObjects = {
     },
     _actions: {
       link_social: {
-        label: "Link Social Account"
+        label: "Link Social Account",
+        params: {
+          provider: {
+            label: "Provider",
+            options: {
+              google: "Google",
+              github: "GitHub",
+              microsoft: "Microsoft",
+              apple: "Apple",
+              facebook: "Facebook",
+              gitlab: "GitLab",
+              discord: "Discord"
+            }
+          }
+        }
       },
       unlink_account: {
         label: "Unlink Account",
@@ -6726,7 +7150,11 @@ var enObjects = {
     },
     _views: {
       mine: {
-        label: "My Memberships"
+        label: "My Memberships",
+        emptyState: {
+          title: "No organizations yet",
+          message: "You haven't joined any organizations."
+        }
       }
     },
     _actions: {
@@ -7146,16 +7574,31 @@ var enObjects = {
     },
     _actions: {
       enable_two_factor: {
-        label: "Enable 2FA"
+        label: "Enable 2FA",
+        params: {
+          password: {
+            label: "Current Password"
+          }
+        }
       },
       disable_two_factor: {
         label: "Disable 2FA",
         confirmText: "Disable two-factor authentication on your account?",
-        successMessage: "2FA disabled"
+        successMessage: "2FA disabled",
+        params: {
+          password: {
+            label: "Current Password"
+          }
+        }
       },
       regenerate_backup_codes: {
         label: "Regenerate Backup Codes",
-        confirmText: "Regenerate backup codes? All previous backup codes will stop working immediately."
+        confirmText: "Regenerate backup codes? All previous backup codes will stop working immediately.",
+        params: {
+          password: {
+            label: "Current Password"
+          }
+        }
       }
     }
   },
@@ -7335,6 +7778,18 @@ var enObjects = {
         label: "Subject Type",
         help: "OIDC subject type (e.g. public, pairwise)"
       },
+      jwks: {
+        label: "JWKS",
+        help: "Client JSON Web Key Set (for private_key_jwt / signed-request verification)"
+      },
+      jwks_uri: {
+        label: "JWKS URI",
+        help: "URL of the client JSON Web Key Set"
+      },
+      dpop_bound_access_tokens: {
+        label: "DPoP-bound Access Tokens",
+        help: "Require access tokens issued to this client to be DPoP-bound (RFC 9449)"
+      },
       disabled: {
         label: "Disabled"
       },
@@ -7346,6 +7801,14 @@ var enObjects = {
         label: "Enable End Session",
         help: "Allow the client to call the OIDC end-session endpoint"
       },
+      backchannel_logout_uri: {
+        label: "Back-channel Logout URI",
+        help: "OIDC back-channel logout endpoint of the client"
+      },
+      backchannel_logout_session_required: {
+        label: "Back-channel Logout Session Required",
+        help: "Whether the back-channel logout token must include a sid claim"
+      },
       software_id: {
         label: "Software ID"
       },
@@ -7397,7 +7860,25 @@ var enObjects = {
         successMessage: "OAuth application enabled"
       },
       create_oauth_application: {
-        label: "Register OAuth Application"
+        label: "Register OAuth Application",
+        params: {
+          name: {
+            label: "Application Name"
+          },
+          redirectURLs: {
+            label: "Redirect URLs",
+            helpText: "One URL per line. Must use https:// in production."
+          },
+          type: {
+            label: "Application Type",
+            options: {
+              web: "Web",
+              native: "Native",
+              "user-agent-based": "User-agent based",
+              public: "Public"
+            }
+          }
+        }
       },
       rotate_client_secret: {
         label: "Rotate Client Secret",
@@ -7442,6 +7923,18 @@ var enObjects = {
         label: "Reference ID",
         help: "Caller-supplied correlation identifier"
       },
+      authorization_code_id: {
+        label: "Authorization Code ID",
+        help: "ID of the authorization-code grant this token originates from"
+      },
+      resources: {
+        label: "Resources",
+        help: "JSON-serialized list of RFC 8707 resource indicators bound to this token"
+      },
+      requested_user_info_claims: {
+        label: "Requested UserInfo Claims",
+        help: "JSON-serialized list of OIDC claims requested for the userinfo endpoint"
+      },
       scopes: {
         label: "Scopes",
         help: "JSON-serialized list of scopes granted to this token"
@@ -7451,6 +7944,14 @@ var enObjects = {
       },
       created_at: {
         label: "Created At"
+      },
+      revoked: {
+        label: "Revoked At",
+        help: "Timestamp at which this access token was revoked"
+      },
+      confirmation: {
+        label: "Confirmation",
+        help: "JSON RFC 7800 cnf claim (e.g. DPoP key thumbprint) binding this token to a key"
       }
     }
   },
@@ -7482,6 +7983,18 @@ var enObjects = {
         label: "Reference ID",
         help: "Caller-supplied correlation identifier"
       },
+      authorization_code_id: {
+        label: "Authorization Code ID",
+        help: "ID of the authorization-code grant this token chain originates from"
+      },
+      resources: {
+        label: "Resources",
+        help: "JSON-serialized list of RFC 8707 resource indicators bound to this token"
+      },
+      requested_user_info_claims: {
+        label: "Requested UserInfo Claims",
+        help: "JSON-serialized list of OIDC claims requested for the userinfo endpoint"
+      },
       scopes: {
         label: "Scopes",
         help: "JSON-serialized list of scopes granted to this token"
@@ -7496,9 +8009,25 @@ var enObjects = {
         label: "Revoked At",
         help: "Timestamp at which this refresh token was revoked"
       },
+      rotated_at: {
+        label: "Rotated At",
+        help: "Timestamp at which this token was rotated (superseded by a new row)"
+      },
+      rotation_replay_response: {
+        label: "Rotation Replay Response",
+        help: "Cached token response replayed when the old token is re-presented within the reuse interval"
+      },
+      rotation_replay_expires_at: {
+        label: "Rotation Replay Expires At",
+        help: "End of the post-rotation reuse interval during which the replay response is served"
+      },
       auth_time: {
         label: "Auth Time",
         help: "When the user originally authenticated for this token chain"
+      },
+      confirmation: {
+        label: "Confirmation",
+        help: "JSON RFC 7800 cnf claim (e.g. DPoP key thumbprint) binding this token to a key"
       }
     }
   },
@@ -7522,6 +8051,14 @@ var enObjects = {
         label: "Reference ID",
         help: "Caller-supplied correlation identifier"
       },
+      resources: {
+        label: "Resources",
+        help: "JSON-serialized list of RFC 8707 resource indicators the consent covers"
+      },
+      requested_user_info_claims: {
+        label: "Requested UserInfo Claims",
+        help: "JSON-serialized list of OIDC claims the user consented to expose"
+      },
       scopes: {
         label: "Scopes",
         help: "JSON-serialized list of scopes the user consented to"
@@ -7534,6 +8071,107 @@ var enObjects = {
       }
     }
   },
+  sys_oauth_resource: {
+    label: "OAuth Resource",
+    pluralLabel: "OAuth Resources",
+    description: "Registered OAuth protected resources (RFC 8707 resource indicators)",
+    fields: {
+      id: {
+        label: "ID"
+      },
+      identifier: {
+        label: "Identifier",
+        help: "Resource indicator URI presented in the RFC 8707 resource parameter"
+      },
+      name: {
+        label: "Name"
+      },
+      access_token_ttl: {
+        label: "Access Token TTL",
+        help: "Access-token lifetime in seconds for this resource (overrides the server default)"
+      },
+      refresh_token_ttl: {
+        label: "Refresh Token TTL",
+        help: "Refresh-token lifetime in seconds for this resource (overrides the server default)"
+      },
+      signing_algorithm: {
+        label: "Signing Algorithm",
+        help: "JWS algorithm used to sign access tokens for this resource"
+      },
+      signing_key_id: {
+        label: "Signing Key ID",
+        help: "Key id (kid) used to sign access tokens for this resource"
+      },
+      allowed_scopes: {
+        label: "Allowed Scopes",
+        help: "JSON-serialized list of scopes clients may request for this resource"
+      },
+      custom_claims: {
+        label: "Custom Claims",
+        help: "JSON object of extra claims stamped on access tokens for this resource"
+      },
+      dpop_bound_access_tokens_required: {
+        label: "DPoP Required",
+        help: "Require access tokens for this resource to be DPoP-bound (RFC 9449)"
+      },
+      disabled: {
+        label: "Disabled"
+      },
+      policy_version: {
+        label: "Policy Version",
+        help: "Monotonic version of the resource token policy"
+      },
+      metadata: {
+        label: "Metadata",
+        help: "JSON object of additional resource metadata"
+      },
+      created_at: {
+        label: "Created At"
+      },
+      updated_at: {
+        label: "Updated At"
+      }
+    }
+  },
+  sys_oauth_client_resource: {
+    label: "OAuth Client Resource",
+    pluralLabel: "OAuth Client Resources",
+    description: "Grants allowing an OAuth client to request tokens for a protected resource",
+    fields: {
+      id: {
+        label: "ID"
+      },
+      client_id: {
+        label: "Client ID",
+        help: "Foreign key to sys_oauth_application.client_id"
+      },
+      resource_id: {
+        label: "Resource ID",
+        help: "Foreign key to sys_oauth_resource.identifier"
+      },
+      metadata: {
+        label: "Metadata",
+        help: "JSON object of additional grant metadata"
+      },
+      created_at: {
+        label: "Created At"
+      }
+    }
+  },
+  sys_oauth_client_assertion: {
+    label: "OAuth Client Assertion",
+    pluralLabel: "OAuth Client Assertions",
+    description: "Consumed OAuth client-assertion JTIs (RFC 7523 replay prevention)",
+    fields: {
+      id: {
+        label: "ID"
+      },
+      expires_at: {
+        label: "Expires At",
+        help: "Assertion expiry \u2014 rows past this instant are safe to prune"
+      }
+    }
+  },
   sys_jwks: {
     label: "JWKS Key",
     pluralLabel: "JWKS Keys",
@@ -7551,6 +8189,14 @@ var enObjects = {
         label: "Private Key",
         help: "JSON-serialized JWK private key (encrypted at rest)"
       },
+      alg: {
+        label: "Algorithm",
+        help: "JWK signing algorithm, e.g. `EdDSA` (better-auth 1.7+)"
+      },
+      crv: {
+        label: "Curve",
+        help: "JWK curve for EdDSA/EC keys, e.g. `Ed25519` (better-auth 1.7+)"
+      },
       created_at: {
         label: "Created At"
       },
@@ -7607,7 +8253,11 @@ var enObjects = {
     },
     _views: {
       recent: {
-        label: "Recent"
+        label: "Recent",
+        emptyState: {
+          title: "No events",
+          message: "No notification events have been emitted."
+        }
       },
       by_topic: {
         label: "By Topic"
@@ -7644,23 +8294,6 @@ var enObjects = {
       size: {
         label: "Size (bytes)"
       },
-      share_type: {
-        label: "Share Type",
-        help: "viewer | collaborator | inferred (inherited from parent record)",
-        options: {
-          viewer: "viewer",
-          collaborator: "collaborator",
-          inferred: "inferred"
-        }
-      },
-      visibility: {
-        label: "Visibility",
-        options: {
-          internal: "internal",
-          all_users: "all_users",
-          shared_users: "shared_users"
-        }
-      },
       uploaded_by: {
         label: "Uploaded By"
       },
@@ -8967,7 +9600,12 @@ var zhCNObjects = {
       ban_user: {
         label: "\u5C01\u7981\u7528\u6237",
         confirmText: "\u8981\u5C01\u7981\u8BE5\u7528\u6237\u5417\uFF1F\u5C01\u7981\u540E\u4F1A\u7ACB\u5373\u767B\u51FA\uFF0C\u4E14\u5728\u89E3\u9664\u5C01\u7981\u524D\u65E0\u6CD5\u518D\u6B21\u767B\u5F55\u3002",
-        successMessage: "\u7528\u6237\u5DF2\u5C01\u7981"
+        successMessage: "\u7528\u6237\u5DF2\u5C01\u7981",
+        params: {
+          banReason: {
+            label: "\u5C01\u7981\u539F\u56E0"
+          }
+        }
       },
       unban_user: {
         label: "\u89E3\u9664\u5C01\u7981",
@@ -8979,15 +9617,46 @@ var zhCNObjects = {
       },
       create_user: {
         label: "\u521B\u5EFA\u7528\u6237",
-        successMessage: "\u7528\u6237\u5DF2\u521B\u5EFA"
+        successMessage: "\u7528\u6237\u5DF2\u521B\u5EFA",
+        params: {
+          phoneNumber: {
+            label: "\u624B\u673A\u53F7",
+            helpText: "\u767B\u5F55\u624B\u673A\u53F7\uFF08E.164 \u683C\u5F0F\uFF0C\u5982 +8613800000000\uFF09\u3002\u672A\u586B\u5199\u90AE\u7BB1\u65F6\u5FC5\u586B\u3002"
+          },
+          generatePassword: {
+            label: "\u751F\u6210\u4E34\u65F6\u5BC6\u7801"
+          },
+          password: {
+            label: "\u5BC6\u7801\uFF08\u7559\u7A7A\u5219\u81EA\u52A8\u751F\u6210\uFF09"
+          },
+          mustChangePassword: {
+            label: "\u9996\u6B21\u767B\u5F55\u65F6\u5FC5\u987B\u4FEE\u6539\u5BC6\u7801"
+          }
+        }
       },
       set_user_password: {
         label: "\u8BBE\u7F6E\u5BC6\u7801",
-        successMessage: "\u5BC6\u7801\u5DF2\u66F4\u65B0"
+        successMessage: "\u5BC6\u7801\u5DF2\u66F4\u65B0",
+        params: {
+          generatePassword: {
+            label: "\u751F\u6210\u4E34\u65F6\u5BC6\u7801"
+          },
+          newPassword: {
+            label: "\u65B0\u5BC6\u7801\uFF08\u7559\u7A7A\u5219\u81EA\u52A8\u751F\u6210\uFF09"
+          },
+          mustChangePassword: {
+            label: "\u4E0B\u6B21\u767B\u5F55\u65F6\u5FC5\u987B\u4FEE\u6539\u5BC6\u7801"
+          }
+        }
       },
       set_user_role: {
         label: "\u8BBE\u7F6E\u5E73\u53F0\u89D2\u8272",
-        successMessage: "\u89D2\u8272\u5DF2\u66F4\u65B0"
+        successMessage: "\u89D2\u8272\u5DF2\u66F4\u65B0",
+        params: {
+          role: {
+            label: "\u5E73\u53F0\u89D2\u8272"
+          }
+        }
       },
       impersonate_user: {
         label: "\u6A21\u62DF\u7528\u6237",
@@ -9000,11 +9669,27 @@ var zhCNObjects = {
       },
       change_my_password: {
         label: "\u4FEE\u6539\u5BC6\u7801",
-        successMessage: "\u5DF2\u4FEE\u6539\u5BC6\u7801"
+        successMessage: "\u5DF2\u4FEE\u6539\u5BC6\u7801",
+        params: {
+          currentPassword: {
+            label: "\u5F53\u524D\u5BC6\u7801"
+          },
+          newPassword: {
+            label: "\u65B0\u5BC6\u7801"
+          },
+          revokeOtherSessions: {
+            label: "\u767B\u51FA\u5176\u4ED6\u8BBE\u5907"
+          }
+        }
       },
       change_my_email: {
         label: "\u4FEE\u6539\u90AE\u7BB1",
-        successMessage: "\u5DF2\u53D1\u9001\u9A8C\u8BC1\u90AE\u4EF6\uFF0C\u8BF7\u524D\u5F80\u65B0\u90AE\u7BB1\u786E\u8BA4\u3002"
+        successMessage: "\u5DF2\u53D1\u9001\u9A8C\u8BC1\u90AE\u4EF6\uFF0C\u8BF7\u524D\u5F80\u65B0\u90AE\u7BB1\u786E\u8BA4\u3002",
+        params: {
+          newEmail: {
+            label: "\u65B0\u90AE\u7BB1"
+          }
+        }
       },
       resend_verification_email: {
         label: "\u91CD\u53D1\u9A8C\u8BC1\u90AE\u4EF6",
@@ -9013,21 +9698,41 @@ var zhCNObjects = {
       delete_my_account: {
         label: "\u5220\u9664\u6211\u7684\u8D26\u53F7",
         confirmText: "\u786E\u5B9A\u8981\u6C38\u4E45\u5220\u9664\u60A8\u7684\u8D26\u6237\u5417\uFF1F\u6B64\u64CD\u4F5C\u65E0\u6CD5\u64A4\u9500\u2014\u2014\u60A8\u7684\u6240\u6709\u4F1A\u8BDD\u90FD\u5C06\u88AB\u7EC8\u6B62\uFF0C\u5E76\u5C06\u6309\u7167\u914D\u7F6E\u7684\u4FDD\u7559\u7B56\u7565\u79FB\u9664\u60A8\u62E5\u6709\u7684\u6240\u6709\u6570\u636E\u3002",
-        successMessage: "\u5DF2\u5220\u9664\u8D26\u53F7"
+        successMessage: "\u5DF2\u5220\u9664\u8D26\u53F7",
+        params: {
+          password: {
+            label: "\u5F53\u524D\u5BC6\u7801"
+          }
+        }
       },
       enable_two_factor: {
         label: "\u542F\u7528\u53CC\u56E0\u7D20\u8BA4\u8BC1",
-        successMessage: "\u53CC\u56E0\u7D20\u8BA4\u8BC1\u5DF2\u542F\u7528\u3002\u7528\u8EAB\u4EFD\u9A8C\u8BC1\u5668 App \u626B\u63CF\u4E8C\u7EF4\u7801\u6216\u7C98\u8D34 otpauth URI\uFF0C\u7136\u540E\u9A8C\u8BC1\u4E00\u6B21\u52A8\u6001\u7801\u4EE5\u5B8C\u6210\u8BBE\u7F6E\u3002"
+        successMessage: "\u53CC\u56E0\u7D20\u8BA4\u8BC1\u5DF2\u542F\u7528\u3002\u7528\u8EAB\u4EFD\u9A8C\u8BC1\u5668 App \u626B\u63CF\u4E8C\u7EF4\u7801\u6216\u7C98\u8D34 otpauth URI\uFF0C\u7136\u540E\u9A8C\u8BC1\u4E00\u6B21\u52A8\u6001\u7801\u4EE5\u5B8C\u6210\u8BBE\u7F6E\u3002",
+        params: {
+          password: {
+            label: "\u5F53\u524D\u5BC6\u7801"
+          }
+        }
       },
       disable_two_factor: {
         label: "\u505C\u7528\u53CC\u56E0\u7D20\u8BA4\u8BC1",
         confirmText: "\u8981\u5173\u95ED\u53CC\u56E0\u7D20\u8BA4\u8BC1\u5417\uFF1F\u60A8\u7684\u8D26\u6237\u5B89\u5168\u6027\u5C06\u964D\u4F4E\u3002",
-        successMessage: "\u53CC\u56E0\u7D20\u8BA4\u8BC1\u5DF2\u505C\u7528\u3002"
+        successMessage: "\u53CC\u56E0\u7D20\u8BA4\u8BC1\u5DF2\u505C\u7528\u3002",
+        params: {
+          password: {
+            label: "\u5F53\u524D\u5BC6\u7801"
+          }
+        }
       },
       generate_backup_codes: {
         label: "\u91CD\u65B0\u751F\u6210\u5907\u7528\u7801",
         confirmText: "\u8981\u751F\u6210\u4E00\u7EC4\u65B0\u7684\u5907\u7528\u7801\u5417\uFF1F\u4E4B\u524D\u751F\u6210\u7684\u5907\u7528\u7801\u5C06\u5168\u90E8\u5931\u6548\u3002",
-        successMessage: "\u65B0\u5907\u7528\u7801\u5DF2\u751F\u6210\u2014\u2014\u8BF7\u59A5\u5584\u4FDD\u5B58\u3002"
+        successMessage: "\u65B0\u5907\u7528\u7801\u5DF2\u751F\u6210\u2014\u2014\u8BF7\u59A5\u5584\u4FDD\u5B58\u3002",
+        params: {
+          password: {
+            label: "\u5F53\u524D\u5BC6\u7801"
+          }
+        }
       }
     }
   },
@@ -9171,7 +9876,21 @@ var zhCNObjects = {
     },
     _actions: {
       link_social: {
-        label: "\u5173\u8054\u793E\u4EA4\u8D26\u53F7"
+        label: "\u5173\u8054\u793E\u4EA4\u8D26\u53F7",
+        params: {
+          provider: {
+            label: "\u670D\u52A1\u63D0\u4F9B\u5546",
+            options: {
+              google: "Google",
+              github: "GitHub",
+              microsoft: "Microsoft",
+              apple: "Apple",
+              facebook: "Facebook",
+              gitlab: "GitLab",
+              discord: "Discord"
+            }
+          }
+        }
       },
       unlink_account: {
         label: "\u89E3\u9664\u5173\u8054",
@@ -9304,7 +10023,11 @@ var zhCNObjects = {
     },
     _views: {
       mine: {
-        label: "My Memberships"
+        label: "My Memberships",
+        emptyState: {
+          title: "No organizations yet",
+          message: "You haven't joined any organizations."
+        }
       }
     },
     _actions: {
@@ -9724,16 +10447,31 @@ var zhCNObjects = {
     },
     _actions: {
       enable_two_factor: {
-        label: "\u542F\u7528 2FA"
+        label: "\u542F\u7528 2FA",
+        params: {
+          password: {
+            label: "\u5F53\u524D\u5BC6\u7801"
+          }
+        }
       },
       disable_two_factor: {
         label: "\u505C\u7528 2FA",
         confirmText: "\u8981\u505C\u7528\u4F60\u8D26\u53F7\u4E0A\u7684\u53CC\u56E0\u7D20\u8BA4\u8BC1\u5417\uFF1F",
-        successMessage: "2FA \u5DF2\u505C\u7528"
+        successMessage: "2FA \u5DF2\u505C\u7528",
+        params: {
+          password: {
+            label: "\u5F53\u524D\u5BC6\u7801"
+          }
+        }
       },
       regenerate_backup_codes: {
         label: "\u91CD\u65B0\u751F\u6210\u5907\u7528\u7801",
-        confirmText: "\u786E\u5B9A\u8981\u91CD\u65B0\u751F\u6210\u5907\u4EFD\u7801\u5417\uFF1F\u6B64\u524D\u7684\u6240\u6709\u5907\u4EFD\u7801\u5C06\u7ACB\u5373\u5931\u6548\u3002"
+        confirmText: "\u786E\u5B9A\u8981\u91CD\u65B0\u751F\u6210\u5907\u4EFD\u7801\u5417\uFF1F\u6B64\u524D\u7684\u6240\u6709\u5907\u4EFD\u7801\u5C06\u7ACB\u5373\u5931\u6548\u3002",
+        params: {
+          password: {
+            label: "\u5F53\u524D\u5BC6\u7801"
+          }
+        }
       }
     }
   },
@@ -9913,6 +10651,18 @@ var zhCNObjects = {
         label: "\u4E3B\u4F53\u7C7B\u578B",
         help: "OIDC \u4E3B\u4F53\u7C7B\u578B\uFF08\u4F8B\u5982 public\u3001pairwise\uFF09"
       },
+      jwks: {
+        label: "JWKS",
+        help: "Client JSON Web Key Set (for private_key_jwt / signed-request verification)"
+      },
+      jwks_uri: {
+        label: "JWKS URI",
+        help: "URL of the client JSON Web Key Set"
+      },
+      dpop_bound_access_tokens: {
+        label: "DPoP-bound Access Tokens",
+        help: "Require access tokens issued to this client to be DPoP-bound (RFC 9449)"
+      },
       disabled: {
         label: "\u5DF2\u7981\u7528"
       },
@@ -9924,6 +10674,14 @@ var zhCNObjects = {
         label: "\u542F\u7528 End Session",
         help: "\u5141\u8BB8\u5BA2\u6237\u7AEF\u8C03\u7528 OIDC end-session \u7AEF\u70B9"
       },
+      backchannel_logout_uri: {
+        label: "Back-channel Logout URI",
+        help: "OIDC back-channel logout endpoint of the client"
+      },
+      backchannel_logout_session_required: {
+        label: "Back-channel Logout Session Required",
+        help: "Whether the back-channel logout token must include a sid claim"
+      },
       software_id: {
         label: "\u8F6F\u4EF6 ID"
       },
@@ -9975,7 +10733,25 @@ var zhCNObjects = {
         successMessage: "OAuth \u5E94\u7528\u5DF2\u542F\u7528"
       },
       create_oauth_application: {
-        label: "\u6CE8\u518C OAuth \u5E94\u7528"
+        label: "\u6CE8\u518C OAuth \u5E94\u7528",
+        params: {
+          name: {
+            label: "\u5E94\u7528\u540D\u79F0"
+          },
+          redirectURLs: {
+            label: "\u56DE\u8C03 URL",
+            helpText: "\u6BCF\u884C\u4E00\u4E2A URL\u3002\u751F\u4EA7\u73AF\u5883\u5FC5\u987B\u4F7F\u7528 https://\u3002"
+          },
+          type: {
+            label: "\u5E94\u7528\u7C7B\u578B",
+            options: {
+              web: "Web",
+              native: "\u539F\u751F\u5E94\u7528",
+              "user-agent-based": "\u57FA\u4E8E User-Agent",
+              public: "\u516C\u5171\u5BA2\u6237\u7AEF"
+            }
+          }
+        }
       },
       rotate_client_secret: {
         label: "\u8F6E\u6362 Client Secret",
@@ -10020,6 +10796,18 @@ var zhCNObjects = {
         label: "\u5F15\u7528 ID",
         help: "\u8C03\u7528\u65B9\u63D0\u4F9B\u7684\u5173\u8054\u6807\u8BC6\u7B26"
       },
+      authorization_code_id: {
+        label: "Authorization Code ID",
+        help: "ID of the authorization-code grant this token originates from"
+      },
+      resources: {
+        label: "Resources",
+        help: "JSON-serialized list of RFC 8707 resource indicators bound to this token"
+      },
+      requested_user_info_claims: {
+        label: "Requested UserInfo Claims",
+        help: "JSON-serialized list of OIDC claims requested for the userinfo endpoint"
+      },
       scopes: {
         label: "\u8303\u56F4",
         help: "\u6388\u4E88\u8BE5\u4EE4\u724C\u7684 scopes \u7684 JSON \u5E8F\u5217\u5316\u5217\u8868"
@@ -10029,6 +10817,14 @@ var zhCNObjects = {
       },
       created_at: {
         label: "\u521B\u5EFA\u65F6\u95F4"
+      },
+      revoked: {
+        label: "Revoked At",
+        help: "Timestamp at which this access token was revoked"
+      },
+      confirmation: {
+        label: "Confirmation",
+        help: "JSON RFC 7800 cnf claim (e.g. DPoP key thumbprint) binding this token to a key"
       }
     }
   },
@@ -10060,6 +10856,18 @@ var zhCNObjects = {
         label: "\u5F15\u7528 ID",
         help: "\u8C03\u7528\u65B9\u63D0\u4F9B\u7684\u5173\u8054\u6807\u8BC6\u7B26"
       },
+      authorization_code_id: {
+        label: "Authorization Code ID",
+        help: "ID of the authorization-code grant this token chain originates from"
+      },
+      resources: {
+        label: "Resources",
+        help: "JSON-serialized list of RFC 8707 resource indicators bound to this token"
+      },
+      requested_user_info_claims: {
+        label: "Requested UserInfo Claims",
+        help: "JSON-serialized list of OIDC claims requested for the userinfo endpoint"
+      },
       scopes: {
         label: "\u8303\u56F4",
         help: "\u6388\u4E88\u8BE5\u4EE4\u724C\u7684 scopes \u7684 JSON \u5E8F\u5217\u5316\u5217\u8868"
@@ -10074,9 +10882,25 @@ var zhCNObjects = {
         label: "\u64A4\u9500\u65F6\u95F4",
         help: "\u8BE5\u5237\u65B0\u4EE4\u724C\u88AB\u64A4\u9500\u7684\u65F6\u95F4\u6233"
       },
+      rotated_at: {
+        label: "Rotated At",
+        help: "Timestamp at which this token was rotated (superseded by a new row)"
+      },
+      rotation_replay_response: {
+        label: "Rotation Replay Response",
+        help: "Cached token response replayed when the old token is re-presented within the reuse interval"
+      },
+      rotation_replay_expires_at: {
+        label: "Rotation Replay Expires At",
+        help: "End of the post-rotation reuse interval during which the replay response is served"
+      },
       auth_time: {
         label: "\u8BA4\u8BC1\u65F6\u95F4",
         help: "\u8BE5\u4EE4\u724C\u94FE\u4E2D\u7528\u6237\u6700\u521D\u5B8C\u6210\u8BA4\u8BC1\u7684\u65F6\u95F4"
+      },
+      confirmation: {
+        label: "Confirmation",
+        help: "JSON RFC 7800 cnf claim (e.g. DPoP key thumbprint) binding this token to a key"
       }
     }
   },
@@ -10100,6 +10924,14 @@ var zhCNObjects = {
         label: "\u5F15\u7528 ID",
         help: "\u8C03\u7528\u65B9\u63D0\u4F9B\u7684\u5173\u8054\u6807\u8BC6\u7B26"
       },
+      resources: {
+        label: "Resources",
+        help: "JSON-serialized list of RFC 8707 resource indicators the consent covers"
+      },
+      requested_user_info_claims: {
+        label: "Requested UserInfo Claims",
+        help: "JSON-serialized list of OIDC claims the user consented to expose"
+      },
       scopes: {
         label: "\u8303\u56F4",
         help: "\u7528\u6237\u540C\u610F\u7684 scopes \u7684 JSON \u5E8F\u5217\u5316\u5217\u8868"
@@ -10112,6 +10944,107 @@ var zhCNObjects = {
       }
     }
   },
+  sys_oauth_resource: {
+    label: "OAuth Resource",
+    pluralLabel: "OAuth Resources",
+    description: "Registered OAuth protected resources (RFC 8707 resource indicators)",
+    fields: {
+      id: {
+        label: "ID"
+      },
+      identifier: {
+        label: "Identifier",
+        help: "Resource indicator URI presented in the RFC 8707 resource parameter"
+      },
+      name: {
+        label: "Name"
+      },
+      access_token_ttl: {
+        label: "Access Token TTL",
+        help: "Access-token lifetime in seconds for this resource (overrides the server default)"
+      },
+      refresh_token_ttl: {
+        label: "Refresh Token TTL",
+        help: "Refresh-token lifetime in seconds for this resource (overrides the server default)"
+      },
+      signing_algorithm: {
+        label: "Signing Algorithm",
+        help: "JWS algorithm used to sign access tokens for this resource"
+      },
+      signing_key_id: {
+        label: "Signing Key ID",
+        help: "Key id (kid) used to sign access tokens for this resource"
+      },
+      allowed_scopes: {
+        label: "Allowed Scopes",
+        help: "JSON-serialized list of scopes clients may request for this resource"
+      },
+      custom_claims: {
+        label: "Custom Claims",
+        help: "JSON object of extra claims stamped on access tokens for this resource"
+      },
+      dpop_bound_access_tokens_required: {
+        label: "DPoP Required",
+        help: "Require access tokens for this resource to be DPoP-bound (RFC 9449)"
+      },
+      disabled: {
+        label: "Disabled"
+      },
+      policy_version: {
+        label: "Policy Version",
+        help: "Monotonic version of the resource token policy"
+      },
+      metadata: {
+        label: "Metadata",
+        help: "JSON object of additional resource metadata"
+      },
+      created_at: {
+        label: "Created At"
+      },
+      updated_at: {
+        label: "Updated At"
+      }
+    }
+  },
+  sys_oauth_client_resource: {
+    label: "OAuth Client Resource",
+    pluralLabel: "OAuth Client Resources",
+    description: "Grants allowing an OAuth client to request tokens for a protected resource",
+    fields: {
+      id: {
+        label: "ID"
+      },
+      client_id: {
+        label: "Client ID",
+        help: "Foreign key to sys_oauth_application.client_id"
+      },
+      resource_id: {
+        label: "Resource ID",
+        help: "Foreign key to sys_oauth_resource.identifier"
+      },
+      metadata: {
+        label: "Metadata",
+        help: "JSON object of additional grant metadata"
+      },
+      created_at: {
+        label: "Created At"
+      }
+    }
+  },
+  sys_oauth_client_assertion: {
+    label: "OAuth Client Assertion",
+    pluralLabel: "OAuth Client Assertions",
+    description: "Consumed OAuth client-assertion JTIs (RFC 7523 replay prevention)",
+    fields: {
+      id: {
+        label: "ID"
+      },
+      expires_at: {
+        label: "Expires At",
+        help: "Assertion expiry \u2014 rows past this instant are safe to prune"
+      }
+    }
+  },
   sys_jwks: {
     label: "\u7B7E\u540D\u5BC6\u94A5 (JWKS)",
     pluralLabel: "\u7B7E\u540D\u5BC6\u94A5 (JWKS)",
@@ -10129,6 +11062,14 @@ var zhCNObjects = {
         label: "\u79C1\u94A5",
         help: "JWK \u79C1\u94A5\u7684 JSON \u5E8F\u5217\u5316\u5185\u5BB9\uFF08\u9759\u6001\u5B58\u50A8\u65F6\u52A0\u5BC6\uFF09"
       },
+      alg: {
+        label: "\u7B97\u6CD5",
+        help: "JWK \u7B7E\u540D\u7B97\u6CD5\uFF0C\u5982 `EdDSA`\uFF08better-auth 1.7+\uFF09"
+      },
+      crv: {
+        label: "\u66F2\u7EBF",
+        help: "EdDSA/EC \u5BC6\u94A5\u4F7F\u7528\u7684 JWK \u66F2\u7EBF\uFF0C\u5982 `Ed25519`\uFF08better-auth 1.7+\uFF09"
+      },
       created_at: {
         label: "\u521B\u5EFA\u65F6\u95F4"
       },
@@ -10185,7 +11126,11 @@ var zhCNObjects = {
     },
     _views: {
       recent: {
-        label: "Recent"
+        label: "Recent",
+        emptyState: {
+          title: "No events",
+          message: "No notification events have been emitted."
+        }
       },
       by_topic: {
         label: "By Topic"
@@ -10222,23 +11167,6 @@ var zhCNObjects = {
       size: {
         label: "\u5927\u5C0F\uFF08\u5B57\u8282\uFF09"
       },
-      share_type: {
-        label: "\u5171\u4EAB\u7C7B\u578B",
-        help: "viewer | collaborator | inferred\uFF08\u7EE7\u627F\u81EA\u7236\u8BB0\u5F55\uFF09",
-        options: {
-          viewer: "\u67E5\u770B\u8005",
-          collaborator: "\u534F\u4F5C\u8005",
-          inferred: "\u63A8\u65AD"
-        }
-      },
-      visibility: {
-        label: "\u53EF\u89C1\u6027",
-        options: {
-          internal: "\u5185\u90E8",
-          all_users: "\u5168\u90E8\u7528\u6237",
-          shared_users: "\u5171\u4EAB\u7528\u6237"
-        }
-      },
       uploaded_by: {
         label: "\u4E0A\u4F20\u4EBA"
       },
@@ -11509,7 +12437,12 @@ var jaJPObjects = {
       ban_user: {
         label: "\u5229\u7528\u505C\u6B62",
         confirmText: "\u3053\u306E\u30E6\u30FC\u30B6\u30FC\u3092\u5229\u7528\u505C\u6B62\u306B\u3057\u307E\u3059\u304B\uFF1F\u5229\u7528\u505C\u6B62\u306B\u306A\u308B\u3068\u30B5\u30A4\u30F3\u30A2\u30A6\u30C8\u3055\u308C\u3001\u89E3\u9664\u3055\u308C\u308B\u307E\u3067\u30B5\u30A4\u30F3\u30A4\u30F3\u3067\u304D\u306A\u304F\u306A\u308A\u307E\u3059\u3002",
-        successMessage: "\u30E6\u30FC\u30B6\u30FC\u3092\u5229\u7528\u505C\u6B62\u306B\u3057\u307E\u3057\u305F"
+        successMessage: "\u30E6\u30FC\u30B6\u30FC\u3092\u5229\u7528\u505C\u6B62\u306B\u3057\u307E\u3057\u305F",
+        params: {
+          banReason: {
+            label: "\u5229\u7528\u505C\u6B62\u306E\u7406\u7531"
+          }
+        }
       },
       unban_user: {
         label: "\u5229\u7528\u505C\u6B62\u3092\u89E3\u9664",
@@ -11521,15 +12454,46 @@ var jaJPObjects = {
       },
       create_user: {
         label: "\u30E6\u30FC\u30B6\u30FC\u3092\u4F5C\u6210",
-        successMessage: "\u30E6\u30FC\u30B6\u30FC\u3092\u4F5C\u6210\u3057\u307E\u3057\u305F"
+        successMessage: "\u30E6\u30FC\u30B6\u30FC\u3092\u4F5C\u6210\u3057\u307E\u3057\u305F",
+        params: {
+          phoneNumber: {
+            label: "\u96FB\u8A71\u756A\u53F7",
+            helpText: "\u30B5\u30A4\u30F3\u30A4\u30F3\u7528\u306E\u96FB\u8A71\u756A\u53F7\uFF08E.164 \u5F62\u5F0F\u3001\u4F8B: +8613800000000\uFF09\u3002\u30E1\u30FC\u30EB\u30A2\u30C9\u30EC\u30B9\u3092\u6307\u5B9A\u3057\u306A\u3044\u5834\u5408\u306F\u5FC5\u9808\u3067\u3059\u3002"
+          },
+          generatePassword: {
+            label: "\u4E00\u6642\u30D1\u30B9\u30EF\u30FC\u30C9\u3092\u751F\u6210"
+          },
+          password: {
+            label: "\u30D1\u30B9\u30EF\u30FC\u30C9\uFF08\u7A7A\u6B04\u306E\u5834\u5408\u306F\u81EA\u52D5\u751F\u6210\uFF09"
+          },
+          mustChangePassword: {
+            label: "\u521D\u56DE\u30B5\u30A4\u30F3\u30A4\u30F3\u6642\u306B\u30D1\u30B9\u30EF\u30FC\u30C9\u5909\u66F4\u3092\u5FC5\u9808\u306B\u3059\u308B"
+          }
+        }
       },
       set_user_password: {
         label: "\u30D1\u30B9\u30EF\u30FC\u30C9\u3092\u8A2D\u5B9A",
-        successMessage: "\u30D1\u30B9\u30EF\u30FC\u30C9\u3092\u66F4\u65B0\u3057\u307E\u3057\u305F"
+        successMessage: "\u30D1\u30B9\u30EF\u30FC\u30C9\u3092\u66F4\u65B0\u3057\u307E\u3057\u305F",
+        params: {
+          generatePassword: {
+            label: "\u4E00\u6642\u30D1\u30B9\u30EF\u30FC\u30C9\u3092\u751F\u6210"
+          },
+          newPassword: {
+            label: "\u65B0\u3057\u3044\u30D1\u30B9\u30EF\u30FC\u30C9\uFF08\u7A7A\u6B04\u306E\u5834\u5408\u306F\u81EA\u52D5\u751F\u6210\uFF09"
+          },
+          mustChangePassword: {
+            label: "\u6B21\u56DE\u30B5\u30A4\u30F3\u30A4\u30F3\u6642\u306B\u30D1\u30B9\u30EF\u30FC\u30C9\u5909\u66F4\u3092\u5FC5\u9808\u306B\u3059\u308B"
+          }
+        }
       },
       set_user_role: {
         label: "\u30D7\u30E9\u30C3\u30C8\u30D5\u30A9\u30FC\u30E0\u30ED\u30FC\u30EB\u3092\u8A2D\u5B9A",
-        successMessage: "\u30ED\u30FC\u30EB\u3092\u66F4\u65B0\u3057\u307E\u3057\u305F"
+        successMessage: "\u30ED\u30FC\u30EB\u3092\u66F4\u65B0\u3057\u307E\u3057\u305F",
+        params: {
+          role: {
+            label: "\u30D7\u30E9\u30C3\u30C8\u30D5\u30A9\u30FC\u30E0\u30ED\u30FC\u30EB"
+          }
+        }
       },
       impersonate_user: {
         label: "\u4EE3\u7406\u30ED\u30B0\u30A4\u30F3",
@@ -11542,11 +12506,27 @@ var jaJPObjects = {
       },
       change_my_password: {
         label: "\u30D1\u30B9\u30EF\u30FC\u30C9\u5909\u66F4",
-        successMessage: "\u30D1\u30B9\u30EF\u30FC\u30C9\u3092\u5909\u66F4\u3057\u307E\u3057\u305F"
+        successMessage: "\u30D1\u30B9\u30EF\u30FC\u30C9\u3092\u5909\u66F4\u3057\u307E\u3057\u305F",
+        params: {
+          currentPassword: {
+            label: "\u73FE\u5728\u306E\u30D1\u30B9\u30EF\u30FC\u30C9"
+          },
+          newPassword: {
+            label: "\u65B0\u3057\u3044\u30D1\u30B9\u30EF\u30FC\u30C9"
+          },
+          revokeOtherSessions: {
+            label: "\u4ED6\u306E\u30C7\u30D0\u30A4\u30B9\u304B\u3089\u30B5\u30A4\u30F3\u30A2\u30A6\u30C8"
+          }
+        }
       },
       change_my_email: {
         label: "\u30E1\u30FC\u30EB\u30A2\u30C9\u30EC\u30B9\u5909\u66F4",
-        successMessage: "\u78BA\u8A8D\u30E1\u30FC\u30EB\u3092\u9001\u4FE1\u3057\u307E\u3057\u305F\u3002\u65B0\u3057\u3044\u30E1\u30FC\u30EB\u30A2\u30C9\u30EC\u30B9\u3067\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
+        successMessage: "\u78BA\u8A8D\u30E1\u30FC\u30EB\u3092\u9001\u4FE1\u3057\u307E\u3057\u305F\u3002\u65B0\u3057\u3044\u30E1\u30FC\u30EB\u30A2\u30C9\u30EC\u30B9\u3067\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+        params: {
+          newEmail: {
+            label: "\u65B0\u3057\u3044\u30E1\u30FC\u30EB\u30A2\u30C9\u30EC\u30B9"
+          }
+        }
       },
       resend_verification_email: {
         label: "\u78BA\u8A8D\u30E1\u30FC\u30EB\u3092\u518D\u9001",
@@ -11555,21 +12535,41 @@ var jaJPObjects = {
       delete_my_account: {
         label: "\u30A2\u30AB\u30A6\u30F3\u30C8\u524A\u9664",
         confirmText: "\u30A2\u30AB\u30A6\u30F3\u30C8\u3092\u5B8C\u5168\u306B\u524A\u9664\u3057\u307E\u3059\u304B\uFF1F\u3053\u306E\u64CD\u4F5C\u306F\u5143\u306B\u623B\u305B\u307E\u305B\u3093\u3002\u3059\u3079\u3066\u306E\u30BB\u30C3\u30B7\u30E7\u30F3\u304C\u7D42\u4E86\u3055\u308C\u3001\u8A2D\u5B9A\u3055\u308C\u305F\u4FDD\u6301\u30DD\u30EA\u30B7\u30FC\u306B\u5F93\u3063\u3066\u6240\u6709\u3059\u308B\u3059\u3079\u3066\u306E\u30C7\u30FC\u30BF\u304C\u524A\u9664\u3055\u308C\u307E\u3059\u3002",
-        successMessage: "\u30A2\u30AB\u30A6\u30F3\u30C8\u3092\u524A\u9664\u3057\u307E\u3057\u305F"
+        successMessage: "\u30A2\u30AB\u30A6\u30F3\u30C8\u3092\u524A\u9664\u3057\u307E\u3057\u305F",
+        params: {
+          password: {
+            label: "\u73FE\u5728\u306E\u30D1\u30B9\u30EF\u30FC\u30C9"
+          }
+        }
       },
       enable_two_factor: {
         label: "\u4E8C\u8981\u7D20\u8A8D\u8A3C\u3092\u6709\u52B9\u5316",
-        successMessage: "\u4E8C\u8981\u7D20\u8A8D\u8A3C\u3092\u6709\u52B9\u306B\u3057\u307E\u3057\u305F\u3002\u8A8D\u8A3C\u30A2\u30D7\u30EA\u3067 QR \u30B3\u30FC\u30C9\u3092\u30B9\u30AD\u30E3\u30F3\u3059\u308B\u304B otpauth URI \u3092\u8CBC\u308A\u4ED8\u3051\u3001\u30B3\u30FC\u30C9\u3092\u691C\u8A3C\u3057\u3066\u8A2D\u5B9A\u3092\u5B8C\u4E86\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
+        successMessage: "\u4E8C\u8981\u7D20\u8A8D\u8A3C\u3092\u6709\u52B9\u306B\u3057\u307E\u3057\u305F\u3002\u8A8D\u8A3C\u30A2\u30D7\u30EA\u3067 QR \u30B3\u30FC\u30C9\u3092\u30B9\u30AD\u30E3\u30F3\u3059\u308B\u304B otpauth URI \u3092\u8CBC\u308A\u4ED8\u3051\u3001\u30B3\u30FC\u30C9\u3092\u691C\u8A3C\u3057\u3066\u8A2D\u5B9A\u3092\u5B8C\u4E86\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+        params: {
+          password: {
+            label: "\u73FE\u5728\u306E\u30D1\u30B9\u30EF\u30FC\u30C9"
+          }
+        }
       },
       disable_two_factor: {
         label: "\u4E8C\u8981\u7D20\u8A8D\u8A3C\u3092\u7121\u52B9\u5316",
         confirmText: "\u4E8C\u8981\u7D20\u8A8D\u8A3C\u3092\u30AA\u30D5\u306B\u3057\u307E\u3059\u304B\uFF1F\u30A2\u30AB\u30A6\u30F3\u30C8\u306E\u5B89\u5168\u6027\u304C\u4F4E\u4E0B\u3057\u307E\u3059\u3002",
-        successMessage: "\u4E8C\u8981\u7D20\u8A8D\u8A3C\u3092\u7121\u52B9\u306B\u3057\u307E\u3057\u305F\u3002"
+        successMessage: "\u4E8C\u8981\u7D20\u8A8D\u8A3C\u3092\u7121\u52B9\u306B\u3057\u307E\u3057\u305F\u3002",
+        params: {
+          password: {
+            label: "\u73FE\u5728\u306E\u30D1\u30B9\u30EF\u30FC\u30C9"
+          }
+        }
       },
       generate_backup_codes: {
         label: "\u30D0\u30C3\u30AF\u30A2\u30C3\u30D7\u30B3\u30FC\u30C9\u3092\u518D\u751F\u6210",
         confirmText: "\u65B0\u3057\u3044\u30D0\u30C3\u30AF\u30A2\u30C3\u30D7\u30B3\u30FC\u30C9\u3092\u751F\u6210\u3057\u307E\u3059\u304B\uFF1F\u4EE5\u524D\u306B\u751F\u6210\u3055\u308C\u305F\u30B3\u30FC\u30C9\u306F\u3059\u3079\u3066\u4F7F\u7528\u3067\u304D\u306A\u304F\u306A\u308A\u307E\u3059\u3002",
-        successMessage: "\u65B0\u3057\u3044\u30D0\u30C3\u30AF\u30A2\u30C3\u30D7\u30B3\u30FC\u30C9\u3092\u751F\u6210\u3057\u307E\u3057\u305F\u3002\u5B89\u5168\u306A\u5834\u6240\u306B\u4FDD\u7BA1\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
+        successMessage: "\u65B0\u3057\u3044\u30D0\u30C3\u30AF\u30A2\u30C3\u30D7\u30B3\u30FC\u30C9\u3092\u751F\u6210\u3057\u307E\u3057\u305F\u3002\u5B89\u5168\u306A\u5834\u6240\u306B\u4FDD\u7BA1\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+        params: {
+          password: {
+            label: "\u73FE\u5728\u306E\u30D1\u30B9\u30EF\u30FC\u30C9"
+          }
+        }
       }
     }
   },
@@ -11713,7 +12713,21 @@ var jaJPObjects = {
     },
     _actions: {
       link_social: {
-        label: "\u30BD\u30FC\u30B7\u30E3\u30EB\u30A2\u30AB\u30A6\u30F3\u30C8\u9023\u643A"
+        label: "\u30BD\u30FC\u30B7\u30E3\u30EB\u30A2\u30AB\u30A6\u30F3\u30C8\u9023\u643A",
+        params: {
+          provider: {
+            label: "\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC",
+            options: {
+              google: "Google",
+              github: "GitHub",
+              microsoft: "Microsoft",
+              apple: "Apple",
+              facebook: "Facebook",
+              gitlab: "GitLab",
+              discord: "Discord"
+            }
+          }
+        }
       },
       unlink_account: {
         label: "\u9023\u643A\u89E3\u9664",
@@ -11846,7 +12860,11 @@ var jaJPObjects = {
     },
     _views: {
       mine: {
-        label: "My Memberships"
+        label: "My Memberships",
+        emptyState: {
+          title: "No organizations yet",
+          message: "You haven't joined any organizations."
+        }
       }
     },
     _actions: {
@@ -12266,16 +13284,31 @@ var jaJPObjects = {
     },
     _actions: {
       enable_two_factor: {
-        label: "2FA \u3092\u6709\u52B9\u5316"
+        label: "2FA \u3092\u6709\u52B9\u5316",
+        params: {
+          password: {
+            label: "\u73FE\u5728\u306E\u30D1\u30B9\u30EF\u30FC\u30C9"
+          }
+        }
       },
       disable_two_factor: {
         label: "2FA \u3092\u7121\u52B9\u5316",
         confirmText: "\u30A2\u30AB\u30A6\u30F3\u30C8\u306E\u4E8C\u8981\u7D20\u8A8D\u8A3C\u3092\u7121\u52B9\u5316\u3057\u307E\u3059\u304B\uFF1F",
-        successMessage: "2FA \u3092\u7121\u52B9\u5316\u3057\u307E\u3057\u305F"
+        successMessage: "2FA \u3092\u7121\u52B9\u5316\u3057\u307E\u3057\u305F",
+        params: {
+          password: {
+            label: "\u73FE\u5728\u306E\u30D1\u30B9\u30EF\u30FC\u30C9"
+          }
+        }
       },
       regenerate_backup_codes: {
         label: "\u30D0\u30C3\u30AF\u30A2\u30C3\u30D7\u30B3\u30FC\u30C9\u518D\u751F\u6210",
-        confirmText: "\u30D0\u30C3\u30AF\u30A2\u30C3\u30D7\u30B3\u30FC\u30C9\u3092\u518D\u751F\u6210\u3057\u307E\u3059\u304B\uFF1F\u4EE5\u524D\u306E\u30D0\u30C3\u30AF\u30A2\u30C3\u30D7\u30B3\u30FC\u30C9\u306F\u3059\u3079\u3066\u76F4\u3061\u306B\u4F7F\u7528\u3067\u304D\u306A\u304F\u306A\u308A\u307E\u3059\u3002"
+        confirmText: "\u30D0\u30C3\u30AF\u30A2\u30C3\u30D7\u30B3\u30FC\u30C9\u3092\u518D\u751F\u6210\u3057\u307E\u3059\u304B\uFF1F\u4EE5\u524D\u306E\u30D0\u30C3\u30AF\u30A2\u30C3\u30D7\u30B3\u30FC\u30C9\u306F\u3059\u3079\u3066\u76F4\u3061\u306B\u4F7F\u7528\u3067\u304D\u306A\u304F\u306A\u308A\u307E\u3059\u3002",
+        params: {
+          password: {
+            label: "\u73FE\u5728\u306E\u30D1\u30B9\u30EF\u30FC\u30C9"
+          }
+        }
       }
     }
   },
@@ -12455,6 +13488,18 @@ var jaJPObjects = {
         label: "\u30B5\u30D6\u30B8\u30A7\u30AF\u30C8\u30BF\u30A4\u30D7",
         help: "OIDC \u30B5\u30D6\u30B8\u30A7\u30AF\u30C8\u30BF\u30A4\u30D7\uFF08\u4F8B: public\u3001pairwise\uFF09"
       },
+      jwks: {
+        label: "JWKS",
+        help: "Client JSON Web Key Set (for private_key_jwt / signed-request verification)"
+      },
+      jwks_uri: {
+        label: "JWKS URI",
+        help: "URL of the client JSON Web Key Set"
+      },
+      dpop_bound_access_tokens: {
+        label: "DPoP-bound Access Tokens",
+        help: "Require access tokens issued to this client to be DPoP-bound (RFC 9449)"
+      },
       disabled: {
         label: "\u7121\u52B9"
       },
@@ -12466,6 +13511,14 @@ var jaJPObjects = {
         label: "\u30A8\u30F3\u30C9\u30BB\u30C3\u30B7\u30E7\u30F3\u3092\u6709\u52B9\u5316",
         help: "\u30AF\u30E9\u30A4\u30A2\u30F3\u30C8\u304C OIDC \u30A8\u30F3\u30C9\u30BB\u30C3\u30B7\u30E7\u30F3\u30A8\u30F3\u30C9\u30DD\u30A4\u30F3\u30C8\u3092\u547C\u3073\u51FA\u305B\u308B\u3088\u3046\u306B\u3057\u307E\u3059"
       },
+      backchannel_logout_uri: {
+        label: "Back-channel Logout URI",
+        help: "OIDC back-channel logout endpoint of the client"
+      },
+      backchannel_logout_session_required: {
+        label: "Back-channel Logout Session Required",
+        help: "Whether the back-channel logout token must include a sid claim"
+      },
       software_id: {
         label: "\u30BD\u30D5\u30C8\u30A6\u30A7\u30A2 ID"
       },
@@ -12517,7 +13570,25 @@ var jaJPObjects = {
         successMessage: "OAuth\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\u3092\u6709\u52B9\u5316\u3057\u307E\u3057\u305F"
       },
       create_oauth_application: {
-        label: "OAuth\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\u3092\u767B\u9332"
+        label: "OAuth\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\u3092\u767B\u9332",
+        params: {
+          name: {
+            label: "\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\u540D"
+          },
+          redirectURLs: {
+            label: "\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8 URL",
+            helpText: "1 \u884C\u306B\u3064\u304D 1 \u3064\u306E URL\u3002\u672C\u756A\u74B0\u5883\u3067\u306F https:// \u304C\u5FC5\u9808\u3067\u3059\u3002"
+          },
+          type: {
+            label: "\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\u30BF\u30A4\u30D7",
+            options: {
+              web: "Web",
+              native: "\u30CD\u30A4\u30C6\u30A3\u30D6",
+              "user-agent-based": "\u30E6\u30FC\u30B6\u30FC\u30A8\u30FC\u30B8\u30A7\u30F3\u30C8\u578B",
+              public: "\u30D1\u30D6\u30EA\u30C3\u30AF"
+            }
+          }
+        }
       },
       rotate_client_secret: {
         label: "\u30AF\u30E9\u30A4\u30A2\u30F3\u30C8\u30B7\u30FC\u30AF\u30EC\u30C3\u30C8\u66F4\u65B0",
@@ -12562,6 +13633,18 @@ var jaJPObjects = {
         label: "\u53C2\u7167 ID",
         help: "\u547C\u3073\u51FA\u3057\u5143\u304C\u6307\u5B9A\u3057\u305F\u76F8\u95A2\u8B58\u5225\u5B50"
       },
+      authorization_code_id: {
+        label: "Authorization Code ID",
+        help: "ID of the authorization-code grant this token originates from"
+      },
+      resources: {
+        label: "Resources",
+        help: "JSON-serialized list of RFC 8707 resource indicators bound to this token"
+      },
+      requested_user_info_claims: {
+        label: "Requested UserInfo Claims",
+        help: "JSON-serialized list of OIDC claims requested for the userinfo endpoint"
+      },
       scopes: {
         label: "\u30B9\u30B3\u30FC\u30D7",
         help: "\u3053\u306E\u30C8\u30FC\u30AF\u30F3\u306B\u4ED8\u4E0E\u3055\u308C\u305F\u30B9\u30B3\u30FC\u30D7\u306E JSON \u30B7\u30EA\u30A2\u30E9\u30A4\u30BA\u30EA\u30B9\u30C8"
@@ -12571,6 +13654,14 @@ var jaJPObjects = {
       },
       created_at: {
         label: "\u4F5C\u6210\u65E5\u6642"
+      },
+      revoked: {
+        label: "Revoked At",
+        help: "Timestamp at which this access token was revoked"
+      },
+      confirmation: {
+        label: "Confirmation",
+        help: "JSON RFC 7800 cnf claim (e.g. DPoP key thumbprint) binding this token to a key"
       }
     }
   },
@@ -12602,6 +13693,18 @@ var jaJPObjects = {
         label: "\u53C2\u7167 ID",
         help: "\u547C\u3073\u51FA\u3057\u5143\u304C\u6307\u5B9A\u3057\u305F\u76F8\u95A2\u8B58\u5225\u5B50"
       },
+      authorization_code_id: {
+        label: "Authorization Code ID",
+        help: "ID of the authorization-code grant this token chain originates from"
+      },
+      resources: {
+        label: "Resources",
+        help: "JSON-serialized list of RFC 8707 resource indicators bound to this token"
+      },
+      requested_user_info_claims: {
+        label: "Requested UserInfo Claims",
+        help: "JSON-serialized list of OIDC claims requested for the userinfo endpoint"
+      },
       scopes: {
         label: "\u30B9\u30B3\u30FC\u30D7",
         help: "\u3053\u306E\u30C8\u30FC\u30AF\u30F3\u306B\u4ED8\u4E0E\u3055\u308C\u305F\u30B9\u30B3\u30FC\u30D7\u306E JSON \u30B7\u30EA\u30A2\u30E9\u30A4\u30BA\u30EA\u30B9\u30C8"
@@ -12616,9 +13719,25 @@ var jaJPObjects = {
         label: "\u5931\u52B9\u65E5\u6642",
         help: "\u3053\u306E\u30EA\u30D5\u30EC\u30C3\u30B7\u30E5\u30C8\u30FC\u30AF\u30F3\u304C\u5931\u52B9\u3057\u305F\u30BF\u30A4\u30E0\u30B9\u30BF\u30F3\u30D7"
       },
+      rotated_at: {
+        label: "Rotated At",
+        help: "Timestamp at which this token was rotated (superseded by a new row)"
+      },
+      rotation_replay_response: {
+        label: "Rotation Replay Response",
+        help: "Cached token response replayed when the old token is re-presented within the reuse interval"
+      },
+      rotation_replay_expires_at: {
+        label: "Rotation Replay Expires At",
+        help: "End of the post-rotation reuse interval during which the replay response is served"
+      },
       auth_time: {
         label: "\u8A8D\u8A3C\u65E5\u6642",
         help: "\u3053\u306E\u30C8\u30FC\u30AF\u30F3\u30C1\u30A7\u30FC\u30F3\u306E\u305F\u3081\u306B\u30E6\u30FC\u30B6\u30FC\u304C\u6700\u521D\u306B\u8A8D\u8A3C\u3057\u305F\u65E5\u6642"
+      },
+      confirmation: {
+        label: "Confirmation",
+        help: "JSON RFC 7800 cnf claim (e.g. DPoP key thumbprint) binding this token to a key"
       }
     }
   },
@@ -12631,26 +13750,135 @@ var jaJPObjects = {
         label: "ID"
       },
       client_id: {
-        label: "\u30AF\u30E9\u30A4\u30A2\u30F3\u30C8 ID",
-        help: "sys_oauth_application.client_id \u3078\u306E\u5916\u90E8\u30AD\u30FC"
-      },
-      user_id: {
-        label: "\u30E6\u30FC\u30B6\u30FC",
-        help: "sys_user.id \u3078\u306E\u5916\u90E8\u30AD\u30FC"
+        label: "\u30AF\u30E9\u30A4\u30A2\u30F3\u30C8 ID",
+        help: "sys_oauth_application.client_id \u3078\u306E\u5916\u90E8\u30AD\u30FC"
+      },
+      user_id: {
+        label: "\u30E6\u30FC\u30B6\u30FC",
+        help: "sys_user.id \u3078\u306E\u5916\u90E8\u30AD\u30FC"
+      },
+      reference_id: {
+        label: "\u53C2\u7167 ID",
+        help: "\u547C\u3073\u51FA\u3057\u5143\u304C\u6307\u5B9A\u3057\u305F\u76F8\u95A2\u8B58\u5225\u5B50"
+      },
+      resources: {
+        label: "Resources",
+        help: "JSON-serialized list of RFC 8707 resource indicators the consent covers"
+      },
+      requested_user_info_claims: {
+        label: "Requested UserInfo Claims",
+        help: "JSON-serialized list of OIDC claims the user consented to expose"
+      },
+      scopes: {
+        label: "\u30B9\u30B3\u30FC\u30D7",
+        help: "\u30E6\u30FC\u30B6\u30FC\u304C\u540C\u610F\u3057\u305F\u30B9\u30B3\u30FC\u30D7\u306E JSON \u30B7\u30EA\u30A2\u30E9\u30A4\u30BA\u30EA\u30B9\u30C8"
+      },
+      created_at: {
+        label: "\u4F5C\u6210\u65E5\u6642"
+      },
+      updated_at: {
+        label: "\u66F4\u65B0\u65E5\u6642"
+      }
+    }
+  },
+  sys_oauth_resource: {
+    label: "OAuth Resource",
+    pluralLabel: "OAuth Resources",
+    description: "Registered OAuth protected resources (RFC 8707 resource indicators)",
+    fields: {
+      id: {
+        label: "ID"
+      },
+      identifier: {
+        label: "Identifier",
+        help: "Resource indicator URI presented in the RFC 8707 resource parameter"
+      },
+      name: {
+        label: "Name"
+      },
+      access_token_ttl: {
+        label: "Access Token TTL",
+        help: "Access-token lifetime in seconds for this resource (overrides the server default)"
+      },
+      refresh_token_ttl: {
+        label: "Refresh Token TTL",
+        help: "Refresh-token lifetime in seconds for this resource (overrides the server default)"
+      },
+      signing_algorithm: {
+        label: "Signing Algorithm",
+        help: "JWS algorithm used to sign access tokens for this resource"
+      },
+      signing_key_id: {
+        label: "Signing Key ID",
+        help: "Key id (kid) used to sign access tokens for this resource"
+      },
+      allowed_scopes: {
+        label: "Allowed Scopes",
+        help: "JSON-serialized list of scopes clients may request for this resource"
+      },
+      custom_claims: {
+        label: "Custom Claims",
+        help: "JSON object of extra claims stamped on access tokens for this resource"
+      },
+      dpop_bound_access_tokens_required: {
+        label: "DPoP Required",
+        help: "Require access tokens for this resource to be DPoP-bound (RFC 9449)"
+      },
+      disabled: {
+        label: "Disabled"
+      },
+      policy_version: {
+        label: "Policy Version",
+        help: "Monotonic version of the resource token policy"
+      },
+      metadata: {
+        label: "Metadata",
+        help: "JSON object of additional resource metadata"
+      },
+      created_at: {
+        label: "Created At"
+      },
+      updated_at: {
+        label: "Updated At"
+      }
+    }
+  },
+  sys_oauth_client_resource: {
+    label: "OAuth Client Resource",
+    pluralLabel: "OAuth Client Resources",
+    description: "Grants allowing an OAuth client to request tokens for a protected resource",
+    fields: {
+      id: {
+        label: "ID"
+      },
+      client_id: {
+        label: "Client ID",
+        help: "Foreign key to sys_oauth_application.client_id"
       },
-      reference_id: {
-        label: "\u53C2\u7167 ID",
-        help: "\u547C\u3073\u51FA\u3057\u5143\u304C\u6307\u5B9A\u3057\u305F\u76F8\u95A2\u8B58\u5225\u5B50"
+      resource_id: {
+        label: "Resource ID",
+        help: "Foreign key to sys_oauth_resource.identifier"
       },
-      scopes: {
-        label: "\u30B9\u30B3\u30FC\u30D7",
-        help: "\u30E6\u30FC\u30B6\u30FC\u304C\u540C\u610F\u3057\u305F\u30B9\u30B3\u30FC\u30D7\u306E JSON \u30B7\u30EA\u30A2\u30E9\u30A4\u30BA\u30EA\u30B9\u30C8"
+      metadata: {
+        label: "Metadata",
+        help: "JSON object of additional grant metadata"
       },
       created_at: {
-        label: "\u4F5C\u6210\u65E5\u6642"
+        label: "Created At"
+      }
+    }
+  },
+  sys_oauth_client_assertion: {
+    label: "OAuth Client Assertion",
+    pluralLabel: "OAuth Client Assertions",
+    description: "Consumed OAuth client-assertion JTIs (RFC 7523 replay prevention)",
+    fields: {
+      id: {
+        label: "ID"
       },
-      updated_at: {
-        label: "\u66F4\u65B0\u65E5\u6642"
+      expires_at: {
+        label: "Expires At",
+        help: "Assertion expiry \u2014 rows past this instant are safe to prune"
       }
     }
   },
@@ -12671,6 +13899,14 @@ var jaJPObjects = {
         label: "\u79D8\u5BC6\u9375",
         help: "JSON \u30B7\u30EA\u30A2\u30E9\u30A4\u30BA\u3055\u308C\u305F JWK \u79D8\u5BC6\u9375\uFF08\u4FDD\u5B58\u6642\u306B\u6697\u53F7\u5316\u6E08\u307F\uFF09"
       },
+      alg: {
+        label: "\u30A2\u30EB\u30B4\u30EA\u30BA\u30E0",
+        help: "JWK \u7F72\u540D\u30A2\u30EB\u30B4\u30EA\u30BA\u30E0\uFF08\u4F8B: `EdDSA`\u3001better-auth 1.7+\uFF09"
+      },
+      crv: {
+        label: "\u66F2\u7DDA",
+        help: "EdDSA/EC \u9375\u3067\u4F7F\u3046 JWK \u66F2\u7DDA\uFF08\u4F8B: `Ed25519`\u3001better-auth 1.7+\uFF09"
+      },
       created_at: {
         label: "\u4F5C\u6210\u65E5\u6642"
       },
@@ -12727,7 +13963,11 @@ var jaJPObjects = {
     },
     _views: {
       recent: {
-        label: "Recent"
+        label: "Recent",
+        emptyState: {
+          title: "No events",
+          message: "No notification events have been emitted."
+        }
       },
       by_topic: {
         label: "By Topic"
@@ -12764,23 +14004,6 @@ var jaJPObjects = {
       size: {
         label: "\u30B5\u30A4\u30BA\uFF08\u30D0\u30A4\u30C8\uFF09"
       },
-      share_type: {
-        label: "\u5171\u6709\u30BF\u30A4\u30D7",
-        help: "viewer | collaborator | inferred\uFF08\u89AA\u30EC\u30B3\u30FC\u30C9\u304B\u3089\u7D99\u627F\uFF09",
-        options: {
-          viewer: "\u95B2\u89A7\u8005",
-          collaborator: "\u5171\u540C\u7DE8\u96C6\u8005",
-          inferred: "\u63A8\u5B9A"
-        }
-      },
-      visibility: {
-        label: "\u516C\u958B\u7BC4\u56F2",
-        options: {
-          internal: "\u5185\u90E8",
-          all_users: "\u3059\u3079\u3066\u306E\u30E6\u30FC\u30B6\u30FC",
-          shared_users: "\u5171\u6709\u30E6\u30FC\u30B6\u30FC"
-        }
-      },
       uploaded_by: {
         label: "\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u8005"
       },
@@ -14047,7 +15270,12 @@ var esESObjects = {
       ban_user: {
         label: "Bloquear usuario",
         confirmText: "\xBFBloquear a este usuario? Cerrar\xE1 sesi\xF3n y no podr\xE1 volver a iniciarla hasta que se desbloquee.",
-        successMessage: "Usuario bloqueado"
+        successMessage: "Usuario bloqueado",
+        params: {
+          banReason: {
+            label: "Motivo del bloqueo"
+          }
+        }
       },
       unban_user: {
         label: "Desbloquear usuario",
@@ -14059,15 +15287,46 @@ var esESObjects = {
       },
       create_user: {
         label: "Crear usuario",
-        successMessage: "Usuario creado"
+        successMessage: "Usuario creado",
+        params: {
+          phoneNumber: {
+            label: "N\xFAmero de tel\xE9fono",
+            helpText: "N\xFAmero de tel\xE9fono para iniciar sesi\xF3n (E.164, p. ej. +8613800000000). Obligatorio si no se indica un correo."
+          },
+          generatePassword: {
+            label: "Generar contrase\xF1a temporal"
+          },
+          password: {
+            label: "Contrase\xF1a (dejar en blanco para generarla)"
+          },
+          mustChangePassword: {
+            label: "Exigir cambio de contrase\xF1a en el primer inicio de sesi\xF3n"
+          }
+        }
       },
       set_user_password: {
         label: "Establecer contrase\xF1a",
-        successMessage: "Contrase\xF1a actualizada"
+        successMessage: "Contrase\xF1a actualizada",
+        params: {
+          generatePassword: {
+            label: "Generar contrase\xF1a temporal"
+          },
+          newPassword: {
+            label: "Nueva contrase\xF1a (dejar en blanco para generarla)"
+          },
+          mustChangePassword: {
+            label: "Exigir cambio de contrase\xF1a en el pr\xF3ximo inicio de sesi\xF3n"
+          }
+        }
       },
       set_user_role: {
         label: "Establecer rol de plataforma",
-        successMessage: "Rol actualizado"
+        successMessage: "Rol actualizado",
+        params: {
+          role: {
+            label: "Rol de plataforma"
+          }
+        }
       },
       impersonate_user: {
         label: "Suplantar usuario",
@@ -14080,11 +15339,27 @@ var esESObjects = {
       },
       change_my_password: {
         label: "Cambiar contrase\xF1a",
-        successMessage: "Contrase\xF1a cambiada"
+        successMessage: "Contrase\xF1a cambiada",
+        params: {
+          currentPassword: {
+            label: "Contrase\xF1a actual"
+          },
+          newPassword: {
+            label: "Nueva contrase\xF1a"
+          },
+          revokeOtherSessions: {
+            label: "Cerrar sesi\xF3n en los dem\xE1s dispositivos"
+          }
+        }
       },
       change_my_email: {
         label: "Cambiar correo",
-        successMessage: "Correo de verificaci\xF3n enviado; revisa la nueva direcci\xF3n para confirmar."
+        successMessage: "Correo de verificaci\xF3n enviado; revisa la nueva direcci\xF3n para confirmar.",
+        params: {
+          newEmail: {
+            label: "Nuevo correo"
+          }
+        }
       },
       resend_verification_email: {
         label: "Reenviar correo de verificaci\xF3n",
@@ -14093,21 +15368,41 @@ var esESObjects = {
       delete_my_account: {
         label: "Eliminar mi cuenta",
         confirmText: "\xBFEliminar tu cuenta de forma permanente? Esta acci\xF3n no se puede deshacer: se cerrar\xE1n todas tus sesiones y se eliminar\xE1n todos los datos de tu propiedad seg\xFAn la pol\xEDtica de retenci\xF3n configurada.",
-        successMessage: "Cuenta eliminada"
+        successMessage: "Cuenta eliminada",
+        params: {
+          password: {
+            label: "Contrase\xF1a actual"
+          }
+        }
       },
       enable_two_factor: {
         label: "Habilitar autenticaci\xF3n de dos factores",
-        successMessage: "Autenticaci\xF3n de dos factores habilitada. Escanea el c\xF3digo QR o pega el URI otpauth en tu aplicaci\xF3n de autenticaci\xF3n y verifica un c\xF3digo para completar la configuraci\xF3n."
+        successMessage: "Autenticaci\xF3n de dos factores habilitada. Escanea el c\xF3digo QR o pega el URI otpauth en tu aplicaci\xF3n de autenticaci\xF3n y verifica un c\xF3digo para completar la configuraci\xF3n.",
+        params: {
+          password: {
+            label: "Contrase\xF1a actual"
+          }
+        }
       },
       disable_two_factor: {
         label: "Deshabilitar autenticaci\xF3n de dos factores",
         confirmText: "\xBFDesactivar la autenticaci\xF3n de dos factores? Tu cuenta ser\xE1 menos segura.",
-        successMessage: "Autenticaci\xF3n de dos factores deshabilitada."
+        successMessage: "Autenticaci\xF3n de dos factores deshabilitada.",
+        params: {
+          password: {
+            label: "Contrase\xF1a actual"
+          }
+        }
       },
       generate_backup_codes: {
         label: "Regenerar c\xF3digos de respaldo",
         confirmText: "\xBFGenerar un nuevo juego de c\xF3digos de respaldo? Los c\xF3digos generados anteriormente dejar\xE1n de funcionar.",
-        successMessage: "Nuevos c\xF3digos de respaldo generados; gu\xE1rdalos en un lugar seguro."
+        successMessage: "Nuevos c\xF3digos de respaldo generados; gu\xE1rdalos en un lugar seguro.",
+        params: {
+          password: {
+            label: "Contrase\xF1a actual"
+          }
+        }
       }
     }
   },
@@ -14251,7 +15546,21 @@ var esESObjects = {
     },
     _actions: {
       link_social: {
-        label: "Vincular cuenta social"
+        label: "Vincular cuenta social",
+        params: {
+          provider: {
+            label: "Proveedor",
+            options: {
+              google: "Google",
+              github: "GitHub",
+              microsoft: "Microsoft",
+              apple: "Apple",
+              facebook: "Facebook",
+              gitlab: "GitLab",
+              discord: "Discord"
+            }
+          }
+        }
       },
       unlink_account: {
         label: "Desvincular cuenta",
@@ -14384,7 +15693,11 @@ var esESObjects = {
     },
     _views: {
       mine: {
-        label: "My Memberships"
+        label: "My Memberships",
+        emptyState: {
+          title: "No organizations yet",
+          message: "You haven't joined any organizations."
+        }
       }
     },
     _actions: {
@@ -14804,16 +16117,31 @@ var esESObjects = {
     },
     _actions: {
       enable_two_factor: {
-        label: "Habilitar 2FA"
+        label: "Habilitar 2FA",
+        params: {
+          password: {
+            label: "Contrase\xF1a actual"
+          }
+        }
       },
       disable_two_factor: {
         label: "Deshabilitar 2FA",
         confirmText: "\xBFDeshabilitar la autenticaci\xF3n de doble factor en su cuenta?",
-        successMessage: "2FA deshabilitado"
+        successMessage: "2FA deshabilitado",
+        params: {
+          password: {
+            label: "Contrase\xF1a actual"
+          }
+        }
       },
       regenerate_backup_codes: {
         label: "Regenerar c\xF3digos de respaldo",
-        confirmText: "\xBFRegenerar los c\xF3digos de respaldo? Todos los c\xF3digos de respaldo anteriores dejar\xE1n de funcionar de inmediato."
+        confirmText: "\xBFRegenerar los c\xF3digos de respaldo? Todos los c\xF3digos de respaldo anteriores dejar\xE1n de funcionar de inmediato.",
+        params: {
+          password: {
+            label: "Contrase\xF1a actual"
+          }
+        }
       }
     }
   },
@@ -14993,6 +16321,18 @@ var esESObjects = {
         label: "Tipo de sujeto",
         help: "Tipo de sujeto OIDC (p. ej. public, pairwise)."
       },
+      jwks: {
+        label: "JWKS",
+        help: "Client JSON Web Key Set (for private_key_jwt / signed-request verification)"
+      },
+      jwks_uri: {
+        label: "JWKS URI",
+        help: "URL of the client JSON Web Key Set"
+      },
+      dpop_bound_access_tokens: {
+        label: "DPoP-bound Access Tokens",
+        help: "Require access tokens issued to this client to be DPoP-bound (RFC 9449)"
+      },
       disabled: {
         label: "Deshabilitado"
       },
@@ -15004,6 +16344,14 @@ var esESObjects = {
         label: "Habilitar finalizaci\xF3n de sesi\xF3n",
         help: "Permitir que el cliente llame al endpoint OIDC de finalizaci\xF3n de sesi\xF3n."
       },
+      backchannel_logout_uri: {
+        label: "Back-channel Logout URI",
+        help: "OIDC back-channel logout endpoint of the client"
+      },
+      backchannel_logout_session_required: {
+        label: "Back-channel Logout Session Required",
+        help: "Whether the back-channel logout token must include a sid claim"
+      },
       software_id: {
         label: "ID de software"
       },
@@ -15055,7 +16403,25 @@ var esESObjects = {
         successMessage: "Aplicaci\xF3n OAuth habilitada"
       },
       create_oauth_application: {
-        label: "Registrar aplicaci\xF3n OAuth"
+        label: "Registrar aplicaci\xF3n OAuth",
+        params: {
+          name: {
+            label: "Nombre de la aplicaci\xF3n"
+          },
+          redirectURLs: {
+            label: "URLs de redirecci\xF3n",
+            helpText: "Una URL por l\xEDnea. Debe usar https:// en producci\xF3n."
+          },
+          type: {
+            label: "Tipo de aplicaci\xF3n",
+            options: {
+              web: "Web",
+              native: "Nativa",
+              "user-agent-based": "Basada en user-agent",
+              public: "P\xFAblica"
+            }
+          }
+        }
       },
       rotate_client_secret: {
         label: "Rotar Client Secret",
@@ -15100,6 +16466,18 @@ var esESObjects = {
         label: "ID de referencia",
         help: "Identificador de correlaci\xF3n proporcionado por quien llama."
       },
+      authorization_code_id: {
+        label: "Authorization Code ID",
+        help: "ID of the authorization-code grant this token originates from"
+      },
+      resources: {
+        label: "Resources",
+        help: "JSON-serialized list of RFC 8707 resource indicators bound to this token"
+      },
+      requested_user_info_claims: {
+        label: "Requested UserInfo Claims",
+        help: "JSON-serialized list of OIDC claims requested for the userinfo endpoint"
+      },
       scopes: {
         label: "\xC1mbitos",
         help: "Lista serializada en JSON de \xE1mbitos concedidos a este token."
@@ -15109,6 +16487,14 @@ var esESObjects = {
       },
       created_at: {
         label: "Creado el"
+      },
+      revoked: {
+        label: "Revoked At",
+        help: "Timestamp at which this access token was revoked"
+      },
+      confirmation: {
+        label: "Confirmation",
+        help: "JSON RFC 7800 cnf claim (e.g. DPoP key thumbprint) binding this token to a key"
       }
     }
   },
@@ -15140,6 +16526,18 @@ var esESObjects = {
         label: "ID de referencia",
         help: "Identificador de correlaci\xF3n proporcionado por quien llama."
       },
+      authorization_code_id: {
+        label: "Authorization Code ID",
+        help: "ID of the authorization-code grant this token chain originates from"
+      },
+      resources: {
+        label: "Resources",
+        help: "JSON-serialized list of RFC 8707 resource indicators bound to this token"
+      },
+      requested_user_info_claims: {
+        label: "Requested UserInfo Claims",
+        help: "JSON-serialized list of OIDC claims requested for the userinfo endpoint"
+      },
       scopes: {
         label: "\xC1mbitos",
         help: "Lista serializada en JSON de \xE1mbitos concedidos a este token."
@@ -15154,9 +16552,25 @@ var esESObjects = {
         label: "Revocado el",
         help: "Marca temporal en la que se revoc\xF3 este token de actualizaci\xF3n."
       },
+      rotated_at: {
+        label: "Rotated At",
+        help: "Timestamp at which this token was rotated (superseded by a new row)"
+      },
+      rotation_replay_response: {
+        label: "Rotation Replay Response",
+        help: "Cached token response replayed when the old token is re-presented within the reuse interval"
+      },
+      rotation_replay_expires_at: {
+        label: "Rotation Replay Expires At",
+        help: "End of the post-rotation reuse interval during which the replay response is served"
+      },
       auth_time: {
         label: "Hora de autenticaci\xF3n",
         help: "Momento en que el usuario se autentic\xF3 originalmente para esta cadena de tokens."
+      },
+      confirmation: {
+        label: "Confirmation",
+        help: "JSON RFC 7800 cnf claim (e.g. DPoP key thumbprint) binding this token to a key"
       }
     }
   },
@@ -15180,6 +16594,14 @@ var esESObjects = {
         label: "ID de referencia",
         help: "Identificador de correlaci\xF3n proporcionado por quien llama."
       },
+      resources: {
+        label: "Resources",
+        help: "JSON-serialized list of RFC 8707 resource indicators the consent covers"
+      },
+      requested_user_info_claims: {
+        label: "Requested UserInfo Claims",
+        help: "JSON-serialized list of OIDC claims the user consented to expose"
+      },
       scopes: {
         label: "\xC1mbitos",
         help: "Lista serializada en JSON de \xE1mbitos a los que el usuario dio consentimiento."
@@ -15192,6 +16614,107 @@ var esESObjects = {
       }
     }
   },
+  sys_oauth_resource: {
+    label: "OAuth Resource",
+    pluralLabel: "OAuth Resources",
+    description: "Registered OAuth protected resources (RFC 8707 resource indicators)",
+    fields: {
+      id: {
+        label: "ID"
+      },
+      identifier: {
+        label: "Identifier",
+        help: "Resource indicator URI presented in the RFC 8707 resource parameter"
+      },
+      name: {
+        label: "Name"
+      },
+      access_token_ttl: {
+        label: "Access Token TTL",
+        help: "Access-token lifetime in seconds for this resource (overrides the server default)"
+      },
+      refresh_token_ttl: {
+        label: "Refresh Token TTL",
+        help: "Refresh-token lifetime in seconds for this resource (overrides the server default)"
+      },
+      signing_algorithm: {
+        label: "Signing Algorithm",
+        help: "JWS algorithm used to sign access tokens for this resource"
+      },
+      signing_key_id: {
+        label: "Signing Key ID",
+        help: "Key id (kid) used to sign access tokens for this resource"
+      },
+      allowed_scopes: {
+        label: "Allowed Scopes",
+        help: "JSON-serialized list of scopes clients may request for this resource"
+      },
+      custom_claims: {
+        label: "Custom Claims",
+        help: "JSON object of extra claims stamped on access tokens for this resource"
+      },
+      dpop_bound_access_tokens_required: {
+        label: "DPoP Required",
+        help: "Require access tokens for this resource to be DPoP-bound (RFC 9449)"
+      },
+      disabled: {
+        label: "Disabled"
+      },
+      policy_version: {
+        label: "Policy Version",
+        help: "Monotonic version of the resource token policy"
+      },
+      metadata: {
+        label: "Metadata",
+        help: "JSON object of additional resource metadata"
+      },
+      created_at: {
+        label: "Created At"
+      },
+      updated_at: {
+        label: "Updated At"
+      }
+    }
+  },
+  sys_oauth_client_resource: {
+    label: "OAuth Client Resource",
+    pluralLabel: "OAuth Client Resources",
+    description: "Grants allowing an OAuth client to request tokens for a protected resource",
+    fields: {
+      id: {
+        label: "ID"
+      },
+      client_id: {
+        label: "Client ID",
+        help: "Foreign key to sys_oauth_application.client_id"
+      },
+      resource_id: {
+        label: "Resource ID",
+        help: "Foreign key to sys_oauth_resource.identifier"
+      },
+      metadata: {
+        label: "Metadata",
+        help: "JSON object of additional grant metadata"
+      },
+      created_at: {
+        label: "Created At"
+      }
+    }
+  },
+  sys_oauth_client_assertion: {
+    label: "OAuth Client Assertion",
+    pluralLabel: "OAuth Client Assertions",
+    description: "Consumed OAuth client-assertion JTIs (RFC 7523 replay prevention)",
+    fields: {
+      id: {
+        label: "ID"
+      },
+      expires_at: {
+        label: "Expires At",
+        help: "Assertion expiry \u2014 rows past this instant are safe to prune"
+      }
+    }
+  },
   sys_jwks: {
     label: "Clave de firma (JWKS)",
     pluralLabel: "Claves de firma (JWKS)",
@@ -15209,6 +16732,14 @@ var esESObjects = {
         label: "Clave privada",
         help: "Clave privada JWK serializada en JSON (cifrada en reposo)."
       },
+      alg: {
+        label: "Algoritmo",
+        help: "Algoritmo de firma JWK, p. ej. `EdDSA` (better-auth 1.7+)"
+      },
+      crv: {
+        label: "Curva",
+        help: "Curva JWK para claves EdDSA/EC, p. ej. `Ed25519` (better-auth 1.7+)"
+      },
       created_at: {
         label: "Creado el"
       },
@@ -15265,7 +16796,11 @@ var esESObjects = {
     },
     _views: {
       recent: {
-        label: "Recent"
+        label: "Recent",
+        emptyState: {
+          title: "No events",
+          message: "No notification events have been emitted."
+        }
       },
       by_topic: {
         label: "By Topic"
@@ -15302,23 +16837,6 @@ var esESObjects = {
       size: {
         label: "Tama\xF1o (bytes)"
       },
-      share_type: {
-        label: "Tipo de compartici\xF3n",
-        help: "visualizador | colaborador | inferido (heredado del registro principal)",
-        options: {
-          viewer: "Visualizador",
-          collaborator: "Colaborador",
-          inferred: "Inferido"
-        }
-      },
-      visibility: {
-        label: "Visibilidad",
-        options: {
-          internal: "Interno",
-          all_users: "Todos los usuarios",
-          shared_users: "Usuarios compartidos"
-        }
-      },
       uploaded_by: {
         label: "Subido por"
       },
@@ -16677,6 +18195,83 @@ var SysUserDetailPage = {
               }
             ]
           },
+          {
+            // [ADR-0091 D1] Direct permission-set grants (直接授权) — pure SDUI.
+            // sys_user_permission_set is an ordinary id-keyed junction:
+            // user_id / permission_set_id are lookups keyed by record id, so
+            // the list keys on `relationshipField: 'user_id'` (no
+            // relationshipValueField). The Add picker binds a permission set by
+            // its id (linkField: 'permission_set_id'); server-side gates
+            // (audience-anchor D5/D9, delegated-admin D12) surface their denial
+            // reason in the Add dialog.
+            label: { en: "Permission Sets", "zh-CN": "\u6743\u9650\u96C6", "ja-JP": "\u6A29\u9650\u30BB\u30C3\u30C8", "es-ES": "Conjuntos de permisos" },
+            icon: "lock",
+            children: [
+              {
+                type: "record:related_list",
+                properties: {
+                  objectName: "sys_user_permission_set",
+                  relationshipField: "user_id",
+                  columns: ["permission_set_id", "organization_id", "granted_by", "created_at"],
+                  sort: [{ field: "created_at", order: "desc" }],
+                  limit: 25,
+                  showViewAll: true,
+                  title: { en: "Permission Sets", "zh-CN": "\u6743\u9650\u96C6", "ja-JP": "\u6A29\u9650\u30BB\u30C3\u30C8", "es-ES": "Conjuntos de permisos" },
+                  add: {
+                    picker: {
+                      object: "sys_permission_set",
+                      labelField: "label"
+                    },
+                    linkField: "permission_set_id",
+                    label: {
+                      en: "Grant permission set",
+                      "zh-CN": "\u6388\u4E88\u6743\u9650\u96C6",
+                      "ja-JP": "\u6A29\u9650\u30BB\u30C3\u30C8\u3092\u4ED8\u4E0E",
+                      "es-ES": "Otorgar conjunto de permisos"
+                    }
+                  }
+                }
+              }
+            ]
+          },
+          {
+            // Business-unit membership (业务单元归属) — pure SDUI.
+            // sys_business_unit_member is an id-keyed junction: user_id /
+            // business_unit_id are lookups keyed by record id, so the list keys
+            // on `relationshipField: 'user_id'` (no relationshipValueField).
+            // The Add picker binds a BU by its id (linkField: 'business_unit_id');
+            // sys_business_unit has no `label` field so the picker labels rows by
+            // its display field `name`.
+            label: { en: "Business Units", "zh-CN": "\u4E1A\u52A1\u5355\u5143", "ja-JP": "\u30D3\u30B8\u30CD\u30B9\u30E6\u30CB\u30C3\u30C8", "es-ES": "Unidades de negocio" },
+            icon: "network",
+            children: [
+              {
+                type: "record:related_list",
+                properties: {
+                  objectName: "sys_business_unit_member",
+                  relationshipField: "user_id",
+                  columns: ["business_unit_id", "function_in_business_unit", "is_primary", "created_at"],
+                  sort: [{ field: "created_at", order: "desc" }],
+                  limit: 25,
+                  showViewAll: true,
+                  title: { en: "Business Units", "zh-CN": "\u4E1A\u52A1\u5355\u5143", "ja-JP": "\u30D3\u30B8\u30CD\u30B9\u30E6\u30CB\u30C3\u30C8", "es-ES": "Unidades de negocio" },
+                  add: {
+                    picker: {
+                      object: "sys_business_unit",
+                      labelField: "name"
+                    },
+                    linkField: "business_unit_id",
+                    label: {
+                      en: "Add to business unit",
+                      "zh-CN": "\u52A0\u5165\u4E1A\u52A1\u5355\u5143",
+                      "ja-JP": "\u30D3\u30B8\u30CD\u30B9\u30E6\u30CB\u30C3\u30C8\u306B\u8FFD\u52A0",
+                      "es-ES": "A\xF1adir a unidad de negocio"
+                    }
+                  }
+                }
+              }
+            ]
+          },
           {
             label: { en: "Sessions", "zh-CN": "\u4F1A\u8BDD", "ja-JP": "\u30BB\u30C3\u30B7\u30E7\u30F3", "es-ES": "Sesiones" },
             icon: "monitor",
@@ -17787,6 +19382,22 @@ var enMetadataForms = {
         label: "Variables",
         helpText: "Local page state variables"
       },
+      "variables.name": {
+        label: "Name",
+        helpText: "Variable name \u2014 exposed to expressions as `page.<name>`"
+      },
+      "variables.type": {
+        label: "Type",
+        helpText: "Value type"
+      },
+      "variables.defaultValue": {
+        label: "Default Value",
+        helpText: "Initial value (defaults to a type-appropriate empty value)"
+      },
+      "variables.source": {
+        label: "Source",
+        helpText: "Component (by id) that writes this variable \u2014 e.g. an element:record_picker"
+      },
       regions: {
         label: "Regions",
         helpText: "Layout regions (header, main, sidebar, footer) with components"
@@ -19550,6 +21161,22 @@ var zhCNMetadataForms = {
         label: "\u53D8\u91CF",
         helpText: "\u9875\u9762\u672C\u5730\u72B6\u6001\u53D8\u91CF"
       },
+      "variables.name": {
+        label: "\u540D\u79F0",
+        helpText: "\u53D8\u91CF\u540D\u2014\u2014\u5728\u8868\u8FBE\u5F0F\u4E2D\u4EE5 `page.<name>` \u8BBF\u95EE"
+      },
+      "variables.type": {
+        label: "\u7C7B\u578B",
+        helpText: "\u503C\u7C7B\u578B"
+      },
+      "variables.defaultValue": {
+        label: "\u9ED8\u8BA4\u503C",
+        helpText: "\u521D\u59CB\u503C\uFF08\u9ED8\u8BA4\u4E3A\u5BF9\u5E94\u7C7B\u578B\u7684\u7A7A\u503C\uFF09"
+      },
+      "variables.source": {
+        label: "\u6765\u6E90",
+        helpText: "\u5199\u5165\u8BE5\u53D8\u91CF\u7684\u7EC4\u4EF6\uFF08\u6309 id \u6307\u5B9A\uFF09\uFF0C\u5982 element:record_picker"
+      },
       regions: {
         label: "\u533A\u57DF",
         helpText: "\u5E03\u5C40\u533A\u57DF\uFF08header\u3001main\u3001sidebar\u3001footer\uFF09\u53CA\u5176\u7EC4\u4EF6"
@@ -21313,6 +22940,22 @@ var jaJPMetadataForms = {
         label: "\u5909\u6570",
         helpText: "\u30DA\u30FC\u30B8\u30ED\u30FC\u30AB\u30EB\u72B6\u614B\u5909\u6570"
       },
+      "variables.name": {
+        label: "\u540D\u524D",
+        helpText: "\u5909\u6570\u540D \u2014 \u5F0F\u3067\u306F `page.<name>` \u3068\u3057\u3066\u53C2\u7167\u3067\u304D\u307E\u3059"
+      },
+      "variables.type": {
+        label: "\u578B",
+        helpText: "\u5024\u306E\u578B"
+      },
+      "variables.defaultValue": {
+        label: "\u30C7\u30D5\u30A9\u30EB\u30C8\u5024",
+        helpText: "\u521D\u671F\u5024\uFF08\u672A\u6307\u5B9A\u306E\u5834\u5408\u306F\u578B\u306B\u5FDC\u3058\u305F\u7A7A\u306E\u5024\uFF09"
+      },
+      "variables.source": {
+        label: "\u30BD\u30FC\u30B9",
+        helpText: "\u3053\u306E\u5909\u6570\u306B\u66F8\u304D\u8FBC\u3080\u30B3\u30F3\u30DD\u30FC\u30CD\u30F3\u30C8\uFF08id \u6307\u5B9A\uFF09\u2014 \u4F8B: element:record_picker"
+      },
       regions: {
         label: "\u30EA\u30FC\u30B8\u30E7\u30F3",
         helpText: "\u30B3\u30F3\u30DD\u30FC\u30CD\u30F3\u30C8\u3092\u542B\u3080\u30EC\u30A4\u30A2\u30A6\u30C8\u9818\u57DF\uFF08header, main, sidebar, footer\uFF09"
@@ -23076,6 +24719,22 @@ var esESMetadataForms = {
         label: "Variables de p\xE1gina",
         helpText: "Variables de estado local de p\xE1gina"
       },
+      "variables.name": {
+        label: "Nombre",
+        helpText: "Nombre de la variable \u2014 expuesta en expresiones como `page.<name>`"
+      },
+      "variables.type": {
+        label: "Tipo",
+        helpText: "Tipo de valor"
+      },
+      "variables.defaultValue": {
+        label: "Valor predeterminado",
+        helpText: "Valor inicial (por defecto, un valor vac\xEDo seg\xFAn el tipo)"
+      },
+      "variables.source": {
+        label: "Origen",
+        helpText: "Componente (por id) que escribe esta variable \u2014 p. ej. un element:record_picker"
+      },
       regions: {
         label: "Regiones",
         helpText: "Regiones de dise\xF1o (header, main, sidebar, footer) con componentes"
@@ -24110,6 +25769,6 @@ function createPlatformObjectsPlugin() {
   return new PlatformObjectsPlugin();
 }
 
-export { ACCOUNT_APP, MetadataFormsTranslations, PlatformObjectsPlugin, SETUP_APP, SETUP_NAV_CONTRIBUTIONS, STUDIO_APP, SetupAppTranslations, SysAccount, SysApiKey, SysAttachment, SysBusinessUnit, SysBusinessUnitMember, SysDeviceCode, SysEmail, SysEmailTemplate, SysImportJob, SysInvitation, SysJob, SysJobQueue, SysJobRun, SysJwks, SysMember, SysNotification, SysOauthAccessToken, SysOauthApplication, SysOauthConsent, SysOauthRefreshToken, SysOrganization, SysOrganizationDetailPage, SysPositionDetailPage, SysReportSchedule, SysSavedReport, SysScimProvider, SysSecret, SysSession, SysSetting, SysSettingAudit, SysSsoProvider, SysTeam, SysTeamMember, SysTwoFactor, SysUser, SysUserDetailPage, SysUserPreference, SysVerification, SystemOverviewDashboard, SystemOverviewDatasets, createPlatformObjectsPlugin, en, esES, jaJP, zhCN };
+export { ACCOUNT_APP, MetadataFormsTranslations, PlatformObjectsPlugin, SETUP_APP, SETUP_NAV_CONTRIBUTIONS, STUDIO_APP, SetupAppTranslations, SysAccount, SysApiKey, SysAttachment, SysBusinessUnit, SysBusinessUnitMember, SysDeviceCode, SysEmail, SysEmailTemplate, SysImportJob, SysInvitation, SysJob, SysJobQueue, SysJobRun, SysJwks, SysMember, SysNotification, SysOauthAccessToken, SysOauthApplication, SysOauthClientAssertion, SysOauthClientResource, SysOauthConsent, SysOauthRefreshToken, SysOauthResource, SysOrganization, SysOrganizationDetailPage, SysPositionDetailPage, SysReportSchedule, SysSavedReport, SysScimProvider, SysSecret, SysSession, SysSetting, SysSettingAudit, SysSsoProvider, SysTeam, SysTeamMember, SysTwoFactor, SysUser, SysUserDetailPage, SysUserPreference, SysVerification, SystemOverviewDashboard, SystemOverviewDatasets, createPlatformObjectsPlugin, en, esES, jaJP, zhCN };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map