package schema

// registerAttributes registers all 292 GoSec LDAP attribute definitions
// organized by OID branch/domain.
func (r *Registry) registerAttributes() {
	// ── common (7) ──────────────────────────────────────────────────
	r.addAttr("gscCreatedAt", "createdAt", AttrTime, "common", true)
	r.addAttr("gscModifiedAt", "modifiedAt", AttrTime, "common", true)
	r.addAttr("gscCreatedBy", "createdBy", AttrDN, "common", true)
	r.addAttr("gscModifiedBy", "modifiedBy", AttrDN, "common", true)
	r.addAttr("gscDescription", "description", AttrString, "common", false)
	r.addAttr("gscEnabled", "enabled", AttrBool, "common", false)
	r.addAttr("gscNotes", "notes", AttrString, "common", false)

	// ── tenant (10) ─────────────────────────────────────────────────
	r.addAttr("gscTenantId", "tenantId", AttrString, "tenant", false)
	r.addAttr("gscTenantName", "tenantName", AttrString, "tenant", false)
	r.addAttr("gscTenantDomain", "tenantDomain", AttrString, "tenant", false)
	r.addAttr("gscTenantStatus", "tenantStatus", AttrString, "tenant", false)
	r.addAttr("gscTenantQuota", "tenantQuota", AttrInt, "tenant", false)
	r.addAttr("gscTenantMaxUsers", "tenantMaxUsers", AttrInt, "tenant", false)
	r.addAttr("gscTenantCreatedAt", "tenantCreatedAt", AttrTime, "tenant", true)
	r.addAttr("gscTenantServices", "tenantServices", AttrStringMulti, "tenant", false)
	r.addAttr("gscTenantAdminDN", "tenantAdminDN", AttrDN, "tenant", false)
	r.addAttr("gscTenantParentDN", "tenantParentDN", AttrDN, "tenant", false)

	// ── hash (5) ────────────────────────────────────────────────────
	r.addAttr("gscUserTenantHash", "tenantHash", AttrString, "hash", true)
	r.addAttr("gscUserTenantHashSalt", "tenantHashSalt", AttrString, "hash", true)
	r.addAttr("gscUserTenantHashVersion", "tenantHashVersion", AttrInt, "hash", true)
	r.addAttr("gscUserTenantHashCreatedAt", "tenantHashCreatedAt", AttrTime, "hash", true)
	r.addAttr("gscUserTenantHashVerifiedAt", "tenantHashVerifiedAt", AttrTime, "hash", true)

	// ── customer (7) ────────────────────────────────────────────────
	r.addAttr("gscCustomerId", "customerId", AttrString, "customer", false)
	r.addAttr("gscSID", "sid", AttrString, "customer", false)
	r.addAttr("gscSIDCustomerPart", "sidCustomerPart", AttrString, "customer", false)
	r.addAttr("gscSIDTenantPart", "sidTenantPart", AttrString, "customer", false)
	r.addAttr("gscSIDSpecial1", "sidSpecial1", AttrString, "customer", false)
	r.addAttr("gscSIDSpecial2", "sidSpecial2", AttrString, "customer", false)
	r.addAttr("gscSIDUserPart", "sidUserPart", AttrString, "customer", false)

	// ── mail (8) ────────────────────────────────────────────────────
	r.addAttr("gscMailEnabled", "enabled", AttrBool, "mail", false)
	r.addAttr("gscMailQuota", "quota", AttrInt, "mail", false)
	r.addAttr("gscMailAlias", "alias", AttrStringMulti, "mail", false)
	r.addAttr("gscMailForward", "forward", AttrString, "mail", false)
	r.addAttr("gscMailAutoReply", "autoReply", AttrBool, "mail", false)
	r.addAttr("gscMailAutoReplyMessage", "autoReplyMessage", AttrString, "mail", false)
	r.addAttr("gscMailTransport", "transport", AttrString, "mail", false)
	r.addAttr("gscMailDomain", "domain", AttrString, "mail", false)

	// ── conf (5) ────────────────────────────────────────────────────
	r.addAttr("gscConfEnabled", "enabled", AttrBool, "conf", false)
	r.addAttr("gscConfRole", "role", AttrString, "conf", false)
	r.addAttr("gscConfMaxParticipants", "maxParticipants", AttrInt, "conf", false)
	r.addAttr("gscConfRecordingEnabled", "recordingEnabled", AttrBool, "conf", false)
	r.addAttr("gscConfDefaultRoom", "defaultRoom", AttrString, "conf", false)

	// ── ftp (6) ─────────────────────────────────────────────────────
	r.addAttr("gscFtpEnabled", "enabled", AttrBool, "ftp", false)
	r.addAttr("gscFtpQuota", "quota", AttrInt, "ftp", false)
	r.addAttr("gscFtpHomeDir", "homeDir", AttrString, "ftp", false)
	r.addAttr("gscFtpUploadBandwidth", "uploadBandwidth", AttrInt, "ftp", false)
	r.addAttr("gscFtpDownloadBandwidth", "downloadBandwidth", AttrInt, "ftp", false)
	r.addAttr("gscFtpAllowedIPs", "allowedIPs", AttrStringMulti, "ftp", false)

	// ── file (5) ────────────────────────────────────────────────────
	r.addAttr("gscFileEnabled", "enabled", AttrBool, "file", false)
	r.addAttr("gscFileQuota", "quota", AttrInt, "file", false)
	r.addAttr("gscFileHomeDir", "homeDir", AttrString, "file", false)
	r.addAttr("gscFileVersioning", "versioning", AttrBool, "file", false)
	r.addAttr("gscFileMaxFileSize", "maxFileSize", AttrInt, "file", false)

	// ── sharing (5) ────────────────────────────────────────────────
	r.addAttr("gscShareEnabled", "enabled", AttrBool, "sharing", false)
	r.addAttr("gscShareExternalEnabled", "externalEnabled", AttrBool, "sharing", false)
	r.addAttr("gscShareMaxRecipients", "maxRecipients", AttrInt, "sharing", false)
	r.addAttr("gscShareDefaultExpiry", "defaultExpiry", AttrInt, "sharing", false)
	r.addAttr("gscSharePasswordRequired", "passwordRequired", AttrBool, "sharing", false)

	// ── calendar (5) ───────────────────────────────────────────────
	r.addAttr("gscCalEnabled", "enabled", AttrBool, "calendar", false)
	r.addAttr("gscCalDefaultCalendar", "defaultCalendar", AttrString, "calendar", false)
	r.addAttr("gscCalTimezone", "timezone", AttrString, "calendar", false)
	r.addAttr("gscCalFreeBusyPublic", "freeBusyPublic", AttrBool, "calendar", false)
	r.addAttr("gscCalDelegates", "delegates", AttrDNMulti, "calendar", false)

	// ── telephony (8) ──────────────────────────────────────────────
	r.addAttr("gscTelEnabled", "enabled", AttrBool, "telephony", false)
	r.addAttr("gscTelExtension", "extension", AttrString, "telephony", false)
	r.addAttr("gscTelDID", "did", AttrString, "telephony", false)
	r.addAttr("gscTelVoicemailEnabled", "voicemailEnabled", AttrBool, "telephony", false)
	r.addAttr("gscTelVoicemailPin", "voicemailPin", AttrString, "telephony", false)
	r.addAttr("gscTelCallForward", "callForward", AttrString, "telephony", false)
	r.addAttr("gscTelCallGroup", "callGroup", AttrString, "telephony", false)
	r.addAttr("gscTelRecordCalls", "recordCalls", AttrBool, "telephony", false)

	// ── contacts (4) ──────────────────────────────────────────────
	r.addAttr("gscContactsEnabled", "enabled", AttrBool, "contacts", false)
	r.addAttr("gscContactsShared", "shared", AttrBool, "contacts", false)
	r.addAttr("gscContactsMaxContacts", "maxContacts", AttrInt, "contacts", false)
	r.addAttr("gscContactsExportEnabled", "exportEnabled", AttrBool, "contacts", false)

	// ── ai (5) ─────────────────────────────────────────────────────
	r.addAttr("gscAIEnabled", "enabled", AttrBool, "ai", false)
	r.addAttr("gscAIModel", "model", AttrString, "ai", false)
	r.addAttr("gscAIMaxTokens", "maxTokens", AttrInt, "ai", false)
	r.addAttr("gscAIFeatures", "features", AttrStringMulti, "ai", false)
	r.addAttr("gscAIUsageQuota", "usageQuota", AttrInt, "ai", false)

	// ── resource (9) ──────────────────────────────────────────────
	r.addAttr("gscResourceId", "resourceId", AttrString, "resource", false)
	r.addAttr("gscResourceName", "resourceName", AttrString, "resource", false)
	r.addAttr("gscResourceType", "resourceType", AttrString, "resource", false)
	r.addAttr("gscResourceEmail", "resourceEmail", AttrString, "resource", false)
	r.addAttr("gscResourceCapacity", "capacity", AttrInt, "resource", false)
	r.addAttr("gscResourceLocation", "location", AttrString, "resource", false)
	r.addAttr("gscResourceBookable", "bookable", AttrBool, "resource", false)
	r.addAttr("gscResourceApprovalRequired", "approvalRequired", AttrBool, "resource", false)
	r.addAttr("gscResourceOwnerDN", "ownerDN", AttrDN, "resource", false)

	// ── dlp (10) ──────────────────────────────────────────────────
	r.addAttr("gscDlpEnabled", "enabled", AttrBool, "dlp", false)
	r.addAttr("gscDlpPolicyDN", "policyDN", AttrDNMulti, "dlp", false)
	r.addAttr("gscDlpExempt", "exempt", AttrBool, "dlp", false)
	r.addAttr("gscDlpPolicyName", "policyName", AttrString, "dlp", false)
	r.addAttr("gscDlpPolicyType", "policyType", AttrString, "dlp", false)
	r.addAttr("gscDlpPolicyRules", "policyRules", AttrStringMulti, "dlp", false)
	r.addAttr("gscDlpPolicyAction", "policyAction", AttrString, "dlp", false)
	r.addAttr("gscDlpPolicyPriority", "policyPriority", AttrInt, "dlp", false)
	r.addAttr("gscDlpPolicyScope", "policyScope", AttrStringMulti, "dlp", false)
	r.addAttr("gscDlpPolicyStatus", "policyStatus", AttrString, "dlp", false)

	// ── sensitivity (9) ──────────────────────────────────────────
	r.addAttr("gscSensitivityEnabled", "enabled", AttrBool, "sensitivity", false)
	r.addAttr("gscSensitivityDefaultLabel", "defaultLabel", AttrString, "sensitivity", false)
	r.addAttr("gscSensitivityLabelName", "labelName", AttrString, "sensitivity", false)
	r.addAttr("gscSensitivityLabelPriority", "labelPriority", AttrInt, "sensitivity", false)
	r.addAttr("gscSensitivityLabelColor", "labelColor", AttrString, "sensitivity", false)
	r.addAttr("gscSensitivityLabelTooltip", "labelTooltip", AttrString, "sensitivity", false)
	r.addAttr("gscSensitivityLabelScope", "labelScope", AttrStringMulti, "sensitivity", false)
	r.addAttr("gscSensitivityEncryptionRequired", "encryptionRequired", AttrBool, "sensitivity", false)
	r.addAttr("gscSensitivityWatermark", "watermark", AttrBool, "sensitivity", false)

	// ── encryption (8) ──────────────────────────────────────────
	r.addAttr("gscEncryptionEnabled", "enabled", AttrBool, "encryption", false)
	r.addAttr("gscEncryptionKeyDN", "keyDN", AttrDN, "encryption", false)
	r.addAttr("gscEncryptionPolicyName", "policyName", AttrString, "encryption", false)
	r.addAttr("gscEncryptionPolicyType", "policyType", AttrString, "encryption", false)
	r.addAttr("gscEncryptionAlgorithm", "algorithm", AttrString, "encryption", false)
	r.addAttr("gscEncryptionKeyLength", "keyLength", AttrInt, "encryption", false)
	r.addAttr("gscEncryptionScope", "scope", AttrStringMulti, "encryption", false)
	r.addAttr("gscEncryptionPolicyStatus", "policyStatus", AttrString, "encryption", false)

	// ── retention (10) ──────────────────────────────────────────
	r.addAttr("gscRetentionEnabled", "enabled", AttrBool, "retention", false)
	r.addAttr("gscRetentionPolicyDN", "policyDN", AttrDNMulti, "retention", false)
	r.addAttr("gscRetentionPolicyName", "policyName", AttrString, "retention", false)
	r.addAttr("gscRetentionPolicyType", "policyType", AttrString, "retention", false)
	r.addAttr("gscRetentionDuration", "duration", AttrInt, "retention", false)
	r.addAttr("gscRetentionAction", "action", AttrString, "retention", false)
	r.addAttr("gscRetentionScope", "scope", AttrStringMulti, "retention", false)
	r.addAttr("gscRetentionPolicyStatus", "policyStatus", AttrString, "retention", false)
	r.addAttr("gscRetentionExcludeFolders", "excludeFolders", AttrStringMulti, "retention", false)
	r.addAttr("gscRetentionLegalHold", "legalHold", AttrBool, "retention", false)

	// ── ediscovery (11) ─────────────────────────────────────────
	r.addAttr("gscEDiscoveryEnabled", "enabled", AttrBool, "ediscovery", false)
	r.addAttr("gscEDiscoveryCustodian", "custodian", AttrBool, "ediscovery", false)
	r.addAttr("gscEDiscoveryCaseName", "caseName", AttrString, "ediscovery", false)
	r.addAttr("gscEDiscoveryCaseStatus", "caseStatus", AttrString, "ediscovery", false)
	r.addAttr("gscEDiscoveryCaseCreatedAt", "caseCreatedAt", AttrTime, "ediscovery", false)
	r.addAttr("gscEDiscoveryCaseClosedAt", "caseClosedAt", AttrTime, "ediscovery", false)
	r.addAttr("gscEDiscoveryHoldName", "holdName", AttrString, "ediscovery", false)
	r.addAttr("gscEDiscoveryHoldScope", "holdScope", AttrStringMulti, "ediscovery", false)
	r.addAttr("gscEDiscoveryHoldStatus", "holdStatus", AttrString, "ediscovery", false)
	r.addAttr("gscEDiscoveryHoldCreatedAt", "holdCreatedAt", AttrTime, "ediscovery", false)
	r.addAttr("gscEDiscoverySearchQuery", "searchQuery", AttrString, "ediscovery", false)

	// ── audit (9) ───────────────────────────────────────────────
	r.addAttr("gscAuditEnabled", "enabled", AttrBool, "audit", false)
	r.addAttr("gscAuditLevel", "level", AttrString, "audit", false)
	r.addAttr("gscAuditPolicyName", "policyName", AttrString, "audit", false)
	r.addAttr("gscAuditPolicyScope", "policyScope", AttrStringMulti, "audit", false)
	r.addAttr("gscAuditPolicyActions", "policyActions", AttrStringMulti, "audit", false)
	r.addAttr("gscAuditPolicyStatus", "policyStatus", AttrString, "audit", false)
	r.addAttr("gscAuditRetentionDays", "retentionDays", AttrInt, "audit", false)
	r.addAttr("gscAuditAlertEnabled", "alertEnabled", AttrBool, "audit", false)
	r.addAttr("gscAuditAlertRecipients", "alertRecipients", AttrStringMulti, "audit", false)

	// ── iam (12) ────────────────────────────────────────────────
	r.addAttr("gscIAMEnabled", "enabled", AttrBool, "iam", false)
	r.addAttr("gscIAMMFARequired", "mfaRequired", AttrBool, "iam", false)
	r.addAttr("gscIAMMFAMethod", "mfaMethod", AttrString, "iam", false)
	r.addAttr("gscIAMPasswordPolicy", "passwordPolicy", AttrString, "iam", false)
	r.addAttr("gscIAMSessionTimeout", "sessionTimeout", AttrInt, "iam", false)
	r.addAttr("gscIAMMaxSessions", "maxSessions", AttrInt, "iam", false)
	r.addAttr("gscIAMIPRestrictions", "ipRestrictions", AttrStringMulti, "iam", false)
	r.addAttr("gscIAMRiskLevel", "riskLevel", AttrString, "iam", false)
	r.addAttr("gscIAMCAPolicyName", "caPolicyName", AttrString, "iam", false)
	r.addAttr("gscIAMCAPolicyConditions", "caPolicyConditions", AttrStringMulti, "iam", false)
	r.addAttr("gscIAMCAPolicyActions", "caPolicyActions", AttrStringMulti, "iam", false)
	r.addAttr("gscIAMCAPolicyStatus", "caPolicyStatus", AttrString, "iam", false)

	// ── collaboration (10) ──────────────────────────────────────
	r.addAttr("gscCollabEnabled", "enabled", AttrBool, "collaboration", false)
	r.addAttr("gscCollabTeamsEnabled", "teamsEnabled", AttrBool, "collaboration", false)
	r.addAttr("gscCollabChannelsEnabled", "channelsEnabled", AttrBool, "collaboration", false)
	r.addAttr("gscCollabExternalEnabled", "externalEnabled", AttrBool, "collaboration", false)
	r.addAttr("gscCollabPolicyName", "policyName", AttrString, "collaboration", false)
	r.addAttr("gscCollabPolicyScope", "policyScope", AttrStringMulti, "collaboration", false)
	r.addAttr("gscCollabPolicyActions", "policyActions", AttrStringMulti, "collaboration", false)
	r.addAttr("gscCollabPolicyStatus", "policyStatus", AttrString, "collaboration", false)
	r.addAttr("gscCollabMaxTeamSize", "maxTeamSize", AttrInt, "collaboration", false)
	r.addAttr("gscCollabGuestAccessEnabled", "guestAccessEnabled", AttrBool, "collaboration", false)

	// ── barriers (9) ───────────────────────────────────────────
	r.addAttr("gscBarrierEnabled", "enabled", AttrBool, "barriers", false)
	r.addAttr("gscBarrierSegmentDN", "segmentDN", AttrDNMulti, "barriers", false)
	r.addAttr("gscBarrierSegmentName", "segmentName", AttrString, "barriers", false)
	r.addAttr("gscBarrierSegmentMembers", "segmentMembers", AttrDNMulti, "barriers", false)
	r.addAttr("gscBarrierPolicyName", "policyName", AttrString, "barriers", false)
	r.addAttr("gscBarrierPolicyType", "policyType", AttrString, "barriers", false)
	r.addAttr("gscBarrierPolicySegments", "policySegments", AttrStringMulti, "barriers", false)
	r.addAttr("gscBarrierPolicyAction", "policyAction", AttrString, "barriers", false)
	r.addAttr("gscBarrierPolicyStatus", "policyStatus", AttrString, "barriers", false)

	// ── guest (26) ─────────────────────────────────────────────
	// identity core
	r.addAttr("gscGuestEnabled", "enabled", AttrBool, "guest", false)
	r.addAttr("gscGuestType", "type", AttrString, "guest", false)
	r.addAttr("gscGuestOrganization", "organization", AttrString, "guest", false)
	r.addAttr("gscGuestExternalEmail", "externalEmail", AttrString, "guest", false)
	r.addAttr("gscGuestVerified", "verified", AttrBool, "guest", false)
	// federation
	r.addAttr("gscGuestFederatedIdpDN", "federatedIdpDN", AttrDN, "guest", false)
	r.addAttr("gscGuestFederatedId", "federatedId", AttrString, "guest", false)
	r.addAttr("gscGuestIdpName", "idpName", AttrString, "guest", false)
	r.addAttr("gscGuestIdpType", "idpType", AttrString, "guest", false)
	r.addAttr("gscGuestIdpEntityId", "idpEntityId", AttrString, "guest", false)
	r.addAttr("gscGuestIdpMetadataURL", "idpMetadataURL", AttrString, "guest", false)
	r.addAttr("gscGuestIdpDomains", "idpDomains", AttrStringMulti, "guest", false)
	r.addAttr("gscGuestIdpStatus", "idpStatus", AttrString, "guest", false)
	// access control
	r.addAttr("gscGuestAccessScope", "accessScope", AttrStringMulti, "guest", false)
	r.addAttr("gscGuestPermissionLevel", "permissionLevel", AttrString, "guest", false)
	r.addAttr("gscGuestResourceDN", "resourceDN", AttrDNMulti, "guest", false)
	// invitation/audit
	r.addAttr("gscGuestInvitedBy", "invitedBy", AttrDN, "guest", true)
	r.addAttr("gscGuestInvitedAt", "invitedAt", AttrTime, "guest", true)
	r.addAttr("gscGuestExpiresAt", "expiresAt", AttrTime, "guest", false)
	r.addAttr("gscGuestLastAccessAt", "lastAccessAt", AttrTime, "guest", true)
	r.addAttr("gscGuestAccessCount", "accessCount", AttrInt, "guest", true)
	// policy/restrictions
	r.addAttr("gscGuestPolicyName", "policyName", AttrString, "guest", false)
	r.addAttr("gscGuestPolicyScope", "policyScope", AttrStringMulti, "guest", false)
	r.addAttr("gscGuestPolicyAction", "policyAction", AttrString, "guest", false)
	r.addAttr("gscGuestPolicyStatus", "policyStatus", AttrString, "guest", false)
	r.addAttr("gscGuestMaxDuration", "maxDuration", AttrInt, "guest", false)

	// ── kms-user (12) ──────────────────────────────────────────
	r.addAttr("gscKmsEnabled", "enabled", AttrBool, "kms-user", false)
	r.addAttr("gscKmsRole", "role", AttrString, "kms-user", false)
	r.addAttr("gscKmsKeyAccess", "keyAccess", AttrStringMulti, "kms-user", false)
	r.addAttr("gscKmsMaxKeys", "maxKeys", AttrInt, "kms-user", false)
	r.addAttr("gscKmsAllowedAlgorithms", "allowedAlgorithms", AttrStringMulti, "kms-user", false)
	r.addAttr("gscKmsAllowedOperations", "allowedOperations", AttrStringMulti, "kms-user", false)
	r.addAttr("gscKmsApprovalRequired", "approvalRequired", AttrBool, "kms-user", false)
	r.addAttr("gscKmsAuditEnabled", "auditEnabled", AttrBool, "kms-user", false)
	r.addAttr("gscKmsLastKeyAccess", "lastKeyAccess", AttrTime, "kms-user", true)
	r.addAttr("gscKmsKeyCount", "keyCount", AttrInt, "kms-user", true)
	r.addAttr("gscKmsPolicyDN", "policyDN", AttrDNMulti, "kms-user", false)
	r.addAttr("gscKmsHsmAccess", "hsmAccess", AttrBool, "kms-user", false)

	// ── kms-tenant (12) ────────────────────────────────────────
	r.addAttr("gscKmsTenantEnabled", "enabled", AttrBool, "kms-tenant", false)
	r.addAttr("gscKmsTenantMaxKeys", "maxKeys", AttrInt, "kms-tenant", false)
	r.addAttr("gscKmsTenantAllowedAlgorithms", "allowedAlgorithms", AttrStringMulti, "kms-tenant", false)
	r.addAttr("gscKmsTenantKeyRotationDays", "keyRotationDays", AttrInt, "kms-tenant", false)
	r.addAttr("gscKmsTenantHsmEnabled", "hsmEnabled", AttrBool, "kms-tenant", false)
	r.addAttr("gscKmsTenantHsmPartition", "hsmPartition", AttrString, "kms-tenant", false)
	r.addAttr("gscKmsTenantAutoRotate", "autoRotate", AttrBool, "kms-tenant", false)
	r.addAttr("gscKmsTenantKeyCount", "keyCount", AttrInt, "kms-tenant", true)
	r.addAttr("gscKmsTenantQuota", "quota", AttrInt, "kms-tenant", false)
	r.addAttr("gscKmsTenantDefaultAlgorithm", "defaultAlgorithm", AttrString, "kms-tenant", false)
	r.addAttr("gscKmsTenantDefaultKeyLength", "defaultKeyLength", AttrInt, "kms-tenant", false)
	r.addAttr("gscKmsTenantPolicyDN", "policyDN", AttrDNMulti, "kms-tenant", false)

	// ── managed-key (21) ───────────────────────────────────────
	r.addAttr("gscKeyId", "keyId", AttrString, "managed-key", false)
	r.addAttr("gscKeyName", "keyName", AttrString, "managed-key", false)
	r.addAttr("gscKeyAlgorithm", "algorithm", AttrString, "managed-key", false)
	r.addAttr("gscKeyLength", "keyLength", AttrInt, "managed-key", false)
	r.addAttr("gscKeyType", "keyType", AttrString, "managed-key", false)
	r.addAttr("gscKeyStatus", "status", AttrString, "managed-key", false)
	r.addAttr("gscKeyCreatedAt", "createdAt", AttrTime, "managed-key", true)
	r.addAttr("gscKeyExpiresAt", "expiresAt", AttrTime, "managed-key", false)
	r.addAttr("gscKeyRotatedAt", "rotatedAt", AttrTime, "managed-key", true)
	r.addAttr("gscKeyOwnerDN", "ownerDN", AttrDN, "managed-key", false)
	r.addAttr("gscKeyTenantDN", "tenantDN", AttrDN, "managed-key", false)
	r.addAttr("gscKeyOperations", "operations", AttrStringMulti, "managed-key", false)
	r.addAttr("gscKeyMaterial", "material", AttrString, "managed-key", false)
	r.addAttr("gscKeyPublicKey", "publicKey", AttrString, "managed-key", false)
	r.addAttr("gscKeyFingerprint", "fingerprint", AttrString, "managed-key", true)
	r.addAttr("gscKeyVersion", "version", AttrInt, "managed-key", false)
	r.addAttr("gscKeyPreviousVersionDN", "previousVersionDN", AttrDN, "managed-key", false)
	r.addAttr("gscKeyHsmBacked", "hsmBacked", AttrBool, "managed-key", false)
	r.addAttr("gscKeyHsmSlot", "hsmSlot", AttrString, "managed-key", false)
	r.addAttr("gscKeyAutoRotate", "autoRotate", AttrBool, "managed-key", false)
	r.addAttr("gscKeyRotationDays", "rotationDays", AttrInt, "managed-key", false)

	// ── kms-policy (15) ────────────────────────────────────────
	r.addAttr("gscKmsPolicyId", "policyId", AttrString, "kms-policy", false)
	r.addAttr("gscKmsPolicyName", "policyName", AttrString, "kms-policy", false)
	r.addAttr("gscKmsPolicyType", "policyType", AttrString, "kms-policy", false)
	r.addAttr("gscKmsPolicyEffect", "effect", AttrString, "kms-policy", false)
	r.addAttr("gscKmsPolicyPrincipalDN", "principalDN", AttrDNMulti, "kms-policy", false)
	r.addAttr("gscKmsPolicyResourceDN", "resourceDN", AttrDNMulti, "kms-policy", false)
	r.addAttr("gscKmsPolicyOperations", "operations", AttrStringMulti, "kms-policy", false)
	r.addAttr("gscKmsPolicyConditions", "conditions", AttrStringMulti, "kms-policy", false)
	r.addAttr("gscKmsPolicyPriority", "priority", AttrInt, "kms-policy", false)
	r.addAttr("gscKmsPolicyStatus", "status", AttrString, "kms-policy", false)
	r.addAttr("gscKmsPolicyCreatedAt", "createdAt", AttrTime, "kms-policy", true)
	r.addAttr("gscKmsPolicyModifiedAt", "modifiedAt", AttrTime, "kms-policy", true)
	r.addAttr("gscKmsPolicyTenantDN", "tenantDN", AttrDN, "kms-policy", false)
	r.addAttr("gscKmsPolicyMaxKeyAge", "maxKeyAge", AttrInt, "kms-policy", false)
	r.addAttr("gscKmsPolicyRequireHsm", "requireHsm", AttrBool, "kms-policy", false)

	// ── hsm-config (10) ────────────────────────────────────────
	r.addAttr("gscHsmConfigId", "configId", AttrString, "hsm-config", false)
	r.addAttr("gscHsmConfigName", "configName", AttrString, "hsm-config", false)
	r.addAttr("gscHsmConfigType", "type", AttrString, "hsm-config", false)
	r.addAttr("gscHsmConfigVendor", "vendor", AttrString, "hsm-config", false)
	r.addAttr("gscHsmConfigModel", "model", AttrString, "hsm-config", false)
	r.addAttr("gscHsmConfigConnectionString", "connectionString", AttrString, "hsm-config", false)
	r.addAttr("gscHsmConfigSlots", "slots", AttrStringMulti, "hsm-config", false)
	r.addAttr("gscHsmConfigStatus", "status", AttrString, "hsm-config", false)
	r.addAttr("gscHsmConfigMaxKeys", "maxKeys", AttrInt, "hsm-config", false)
	r.addAttr("gscHsmConfigTenantDN", "tenantDN", AttrDNMulti, "hsm-config", false)
}