Interface IPlainField

Finished documentation for this persisted data field: business prose about the stored value, lifecycle meaning, and requirement purpose.

When the requirements restrict who may read it (owner-only, hidden from public or cross-actor views, or never exposed), state that access/visibility constraint here. If the value is current output reconstructed from other source rows, keep it out of plainFields unless the row explicitly materializes it.

MUST use snake_case.

True only when Analyze, raw-file evidence, or workflow timing says the stored value may be absent. Required temporal fields and system invariants must remain non-null.

Field-level security classification of this stored value, or null for ordinary exposable data.

• "password": persisted password credential — always the stored hash, never a plain password.
• "token": persisted application token proof, such as reset/ verification/invitation token hashes. Raw AutoBe-issued access/refresh JWT strings have no matching literal here.
• "externalCredential": third-party/provider credential (external API keys, OAuth client secrets, provider tokens, webhook signing secrets, private keys). Encrypted at rest, decrypted only for controlled server-side integration use.
• "sensitive": personal or regulated sensitive data. Encrypted at rest, but may still be exposed through an explicitly authorized DTO policy, possibly masked or field-level encrypted.
• "role": the actor's current/latest role field. When an analyzed actor declares business roles, its account table MUST store the current role with this classification.
• null: ordinary data with no special handling (an exposable email is not a secret).

A credential classification (password, token, externalCredential) marks a column the interface phase forces into excludes; realize never returns it.

Prisma/PostgreSQL type mapping: boolean, int, double, decimal, string, uri, uuid (non-FK), datetime, email, ipv4.