@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/component/schema.d.ts

@@ -0,0 +1,1530 @@
+import * as convex_values1839 from "convex/values";
+import * as convex_server32 from "convex/server";
+
+//#region src/component/schema.d.ts
+/**
+ * Schema for the auth component.
+ *
+ * Contains tables for core authentication (users, sessions, accounts, tokens,
+ * verification codes, PKCE verifiers, rate limits) and hierarchical group
+ * management (groups, members, invites).
+ */
+declare const _default: convex_server32.SchemaDefinition<{
+  /**
+   * Authenticated users. A user may have multiple linked accounts
+   * and multiple concurrent sessions.
+   */
+  User: convex_server32.TableDefinition<convex_values1839.VObject<{
+    name?: string | undefined;
+    email?: string | undefined;
+    phone?: string | undefined;
+    firstName?: string | undefined;
+    lastName?: string | undefined;
+    image?: string | undefined;
+    emailVerificationTime?: number | undefined;
+    phoneVerificationTime?: number | undefined;
+    isAnonymous?: boolean | undefined;
+    lastActiveGroup?: convex_values1839.GenericId<"Group"> | undefined;
+    hasTotp?: boolean | undefined;
+    extend?: any;
+  }, {
+    name: convex_values1839.VString<string | undefined, "optional">;
+    firstName: convex_values1839.VString<string | undefined, "optional">;
+    lastName: convex_values1839.VString<string | undefined, "optional">;
+    image: convex_values1839.VString<string | undefined, "optional">;
+    email: convex_values1839.VString<string | undefined, "optional">;
+    emailVerificationTime: convex_values1839.VFloat64<number | undefined, "optional">;
+    phone: convex_values1839.VString<string | undefined, "optional">;
+    phoneVerificationTime: convex_values1839.VFloat64<number | undefined, "optional">;
+    isAnonymous: convex_values1839.VBoolean<boolean | undefined, "optional">;
+    lastActiveGroup: convex_values1839.VId<convex_values1839.GenericId<"Group"> | undefined, "optional">;
+    /**
+     * @deprecated Retained so pre-existing rows still validate after the
+     * denormalized-cache removal. Still accepted on the `user.patch` validator
+     * (`vUserPatchData`) until the major-version removal — nothing writes a
+     * meaningful value; strip existing data via the `dropHasTotp` migration.
+     */
+    hasTotp: convex_values1839.VBoolean<boolean | undefined, "optional">;
+    extend: convex_values1839.VAny<any, "optional", string>;
+  }, "required", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | "extend" | `extend.${string}`>, {
+    email: ["email", "_creationTime"];
+    email_verified: ["email", "emailVerificationTime", "_creationTime"];
+    phone: ["phone", "_creationTime"];
+    phone_verified: ["phone", "phoneVerificationTime", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * All emails a user owns, across providers/connections. `User.email`
+   * remains the single denormalized primary pointer (the row with
+   * `isPrimary: true`); this table is the source of truth for the full
+   * set and carries provenance so Connection linking can be connection-scoped.
+   *
+   * `verificationTime` present ⇔ the email is verified. `source` and
+   * `connectionId` record which provider/Connection connection asserted it —
+   * email-based account linking for Connection must stay scoped to the same
+   * `connectionId` (see server/users.ts) to avoid cross-IdP takeover.
+   */
+  UserEmail: convex_server32.TableDefinition<convex_values1839.VObject<{
+    verificationTime?: number | undefined;
+    accountId?: convex_values1839.GenericId<"Account"> | undefined;
+    provider?: string | undefined;
+    connectionId?: convex_values1839.GenericId<"GroupConnection"> | undefined;
+    email: string;
+    userId: convex_values1839.GenericId<"User">;
+    isPrimary: boolean;
+    source: "password" | "oauth" | "oidc" | "saml" | "scim";
+  }, {
+    userId: convex_values1839.VId<convex_values1839.GenericId<"User">, "required">;
+    email: convex_values1839.VString<string, "required">;
+    verificationTime: convex_values1839.VFloat64<number | undefined, "optional">;
+    isPrimary: convex_values1839.VBoolean<boolean, "required">;
+    source: convex_values1839.VUnion<"password" | "oauth" | "oidc" | "saml" | "scim", [convex_values1839.VLiteral<"password", "required">, convex_values1839.VLiteral<"oauth", "required">, convex_values1839.VLiteral<"oidc", "required">, convex_values1839.VLiteral<"saml", "required">, convex_values1839.VLiteral<"scim", "required">], "required", never>;
+    accountId: convex_values1839.VId<convex_values1839.GenericId<"Account"> | undefined, "optional">;
+    provider: convex_values1839.VString<string | undefined, "optional">;
+    connectionId: convex_values1839.VId<convex_values1839.GenericId<"GroupConnection"> | undefined, "optional">;
+  }, "required", "email" | "userId" | "verificationTime" | "isPrimary" | "source" | "accountId" | "provider" | "connectionId">, {
+    user_id: ["userId", "_creationTime"];
+    user_id_email: ["userId", "email", "_creationTime"];
+    connection_id_email: ["connectionId", "email", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Active sessions. A single user can have multiple concurrent sessions
+   * across different devices or browsers. Sessions expire after a
+   * configurable duration.
+   */
+  Session: convex_server32.TableDefinition<convex_values1839.VObject<{
+    userId: convex_values1839.GenericId<"User">;
+    expirationTime: number;
+  }, {
+    userId: convex_values1839.VId<convex_values1839.GenericId<"User">, "required">;
+    expirationTime: convex_values1839.VFloat64<number, "required">;
+  }, "required", "userId" | "expirationTime">, {
+    user_id: ["userId", "_creationTime"];
+    expiration_time: ["expirationTime", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Authentication accounts. Each account links a user to a single
+   * authentication provider (e.g. Google OAuth, email/password).
+   * A user can have multiple accounts linked.
+   */
+  Account: convex_server32.TableDefinition<convex_values1839.VObject<{
+    extend?: any;
+    secret?: string | undefined;
+    emailVerified?: string | undefined;
+    phoneVerified?: string | undefined;
+    userId: convex_values1839.GenericId<"User">;
+    provider: string;
+    providerAccountId: string;
+  }, {
+    userId: convex_values1839.VId<convex_values1839.GenericId<"User">, "required">;
+    provider: convex_values1839.VString<string, "required">;
+    providerAccountId: convex_values1839.VString<string, "required">;
+    secret: convex_values1839.VString<string | undefined, "optional">;
+    emailVerified: convex_values1839.VString<string | undefined, "optional">;
+    phoneVerified: convex_values1839.VString<string | undefined, "optional">;
+    extend: convex_values1839.VAny<any, "optional", string>;
+  }, "required", "extend" | `extend.${string}` | "userId" | "provider" | "providerAccountId" | "secret" | "emailVerified" | "phoneVerified">, {
+    user_id_provider: ["userId", "provider", "_creationTime"];
+    provider_account_id: ["provider", "providerAccountId", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Refresh tokens for session continuity. Tokens are single-use and form
+   * a chain — each token references the one it was exchanged from.
+   *
+   * The active refresh token is the most recently created token that has not
+   * been used yet. A 10-second reuse window allows for concurrent requests.
+   * Any invalid use of a token invalidates the entire chain.
+   */
+  RefreshToken: convex_server32.TableDefinition<convex_values1839.VObject<{
+    firstUsedTime?: number | undefined;
+    parentRefreshTokenId?: convex_values1839.GenericId<"RefreshToken"> | undefined;
+    expirationTime: number;
+    sessionId: convex_values1839.GenericId<"Session">;
+  }, {
+    sessionId: convex_values1839.VId<convex_values1839.GenericId<"Session">, "required">;
+    expirationTime: convex_values1839.VFloat64<number, "required">;
+    firstUsedTime: convex_values1839.VFloat64<number | undefined, "optional">;
+    parentRefreshTokenId: convex_values1839.VId<convex_values1839.GenericId<"RefreshToken"> | undefined, "optional">;
+  }, "required", "expirationTime" | "sessionId" | "firstUsedTime" | "parentRefreshTokenId">, {
+    session_id: ["sessionId", "_creationTime"];
+    session_id_first_used: ["sessionId", "firstUsedTime", "_creationTime"];
+    session_id_parent_refresh_token_id: ["sessionId", "parentRefreshTokenId", "_creationTime"];
+    expiration_time: ["expirationTime", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Verification codes for OTP tokens, magic link tokens, and OAuth codes.
+   */
+  VerificationCode: convex_server32.TableDefinition<convex_values1839.VObject<{
+    emailVerified?: string | undefined;
+    phoneVerified?: string | undefined;
+    verifier?: string | undefined;
+    accountId: convex_values1839.GenericId<"Account">;
+    provider: string;
+    expirationTime: number;
+    code: string;
+  }, {
+    accountId: convex_values1839.VId<convex_values1839.GenericId<"Account">, "required">;
+    provider: convex_values1839.VString<string, "required">;
+    code: convex_values1839.VString<string, "required">;
+    expirationTime: convex_values1839.VFloat64<number, "required">;
+    verifier: convex_values1839.VString<string | undefined, "optional">;
+    emailVerified: convex_values1839.VString<string | undefined, "optional">;
+    phoneVerified: convex_values1839.VString<string | undefined, "optional">;
+  }, "required", "accountId" | "provider" | "expirationTime" | "emailVerified" | "phoneVerified" | "code" | "verifier">, {
+    account_id: ["accountId", "_creationTime"];
+    code: ["code", "_creationTime"];
+    expiration_time: ["expirationTime", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * PKCE verifiers for OAuth flows. Stores the cryptographic verifier
+   * used to prove the authorization request originated from this client.
+   */
+  AuthVerifier: convex_server32.TableDefinition<convex_values1839.VObject<{
+    expirationTime?: number | undefined;
+    sessionId?: convex_values1839.GenericId<"Session"> | undefined;
+    signature?: string | undefined;
+  }, {
+    sessionId: convex_values1839.VId<convex_values1839.GenericId<"Session"> | undefined, "optional">;
+    signature: convex_values1839.VString<string | undefined, "optional">;
+    expirationTime: convex_values1839.VFloat64<number | undefined, "optional">;
+  }, "required", "expirationTime" | "sessionId" | "signature">, {
+    signature: ["signature", "_creationTime"];
+    expiration_time: ["expirationTime", "_creationTime"];
+  }, {}, {}>; /** Token-bucket state for guessable-secret authentication attempts. */
+  SignInLimit: convex_server32.TableDefinition<convex_values1839.VObject<{
+    identifier: string;
+    tokens: number;
+    updatedAt: number;
+  }, {
+    identifier: convex_values1839.VString<string, "required">;
+    tokens: convex_values1839.VFloat64<number, "required">;
+    updatedAt: convex_values1839.VFloat64<number, "required">;
+  }, "required", "identifier" | "tokens" | "updatedAt">, {
+    identifier: ["identifier", "_creationTime"];
+    updated_at: ["updatedAt", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * WebAuthn passkey credentials. Each credential links a user to a
+   * registered authenticator (Touch ID, Face ID, security key, etc.).
+   * A user can have multiple passkeys across different devices.
+   */
+  Passkey: convex_server32.TableDefinition<convex_values1839.VObject<{
+    name?: string | undefined;
+    transports?: string[] | undefined;
+    attestation?: {
+      metadataDescription?: string | undefined;
+      verifier: string;
+      aaguid: string;
+      format: string;
+      verifiedAt: number;
+      status: "trusted";
+    } | undefined;
+    lastUsedAt?: number | undefined;
+    userId: convex_values1839.GenericId<"User">;
+    credentialId: string;
+    publicKey: ArrayBuffer;
+    algorithm: number;
+    counter: number;
+    deviceType: string;
+    backedUp: boolean;
+    createdAt: number;
+  }, {
+    userId: convex_values1839.VId<convex_values1839.GenericId<"User">, "required">; /** Base64url-encoded credential ID from the authenticator. */
+    credentialId: convex_values1839.VString<string, "required">; /** Public key bytes (SEC1 uncompressed for EC, SPKI for RSA). */
+    publicKey: convex_values1839.VBytes<ArrayBuffer, "required">; /** COSE algorithm identifier (-7 for ES256, -257 for RS256, -8 for EdDSA). */
+    algorithm: convex_values1839.VFloat64<number, "required">; /** Signature counter for clone detection. Many authenticators return 0. */
+    counter: convex_values1839.VFloat64<number, "required">; /** Authenticator transport hints (e.g. "internal", "hybrid", "usb", "ble", "nfc"). */
+    transports: convex_values1839.VArray<string[] | undefined, convex_values1839.VString<string, "required">, "optional">; /** Whether this is a single-device or multi-device (synced) credential. */
+    deviceType: convex_values1839.VString<string, "required">; /** Whether the credential is backed up (synced passkey). */
+    backedUp: convex_values1839.VBoolean<boolean, "required">; /** User-assigned friendly name (e.g. "MacBook Touch ID"). */
+    name: convex_values1839.VString<string | undefined, "optional">; /** Trusted authenticator-attestation evidence, absent on legacy/unattested credentials. */
+    attestation: convex_values1839.VObject<{
+      metadataDescription?: string | undefined;
+      verifier: string;
+      aaguid: string;
+      format: string;
+      verifiedAt: number;
+      status: "trusted";
+    } | undefined, {
+      verifier: convex_values1839.VString<string, "required">;
+      aaguid: convex_values1839.VString<string, "required">;
+      format: convex_values1839.VString<string, "required">;
+      metadataDescription: convex_values1839.VString<string | undefined, "optional">;
+      verifiedAt: convex_values1839.VFloat64<number, "required">;
+      status: convex_values1839.VLiteral<"trusted", "required">;
+    }, "optional", "verifier" | "aaguid" | "format" | "metadataDescription" | "verifiedAt" | "status">;
+    createdAt: convex_values1839.VFloat64<number, "required">;
+    lastUsedAt: convex_values1839.VFloat64<number | undefined, "optional">;
+  }, "required", "name" | "userId" | "credentialId" | "publicKey" | "algorithm" | "counter" | "transports" | "deviceType" | "backedUp" | "attestation" | "createdAt" | "lastUsedAt" | "attestation.verifier" | "attestation.aaguid" | "attestation.format" | "attestation.metadataDescription" | "attestation.verifiedAt" | "attestation.status">, {
+    user_id: ["userId", "_creationTime"];
+    credential_id: ["credentialId", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * TOTP two-factor authentication secrets. Each record links a user to
+   * an authenticator app. A user can have multiple TOTP enrollments
+   * (e.g. different authenticator apps) but typically has one.
+   *
+   * The `verified` flag indicates whether the user has completed setup
+   * by successfully entering a code from their authenticator app.
+   * Unverified enrollments are in-progress setup that can be discarded.
+   */
+  TotpFactor: convex_server32.TableDefinition<convex_values1839.VObject<{
+    name?: string | undefined;
+    lastUsedAt?: number | undefined;
+    userId: convex_values1839.GenericId<"User">;
+    secret: ArrayBuffer;
+    createdAt: number;
+    digits: number;
+    period: number;
+    verified: boolean;
+  }, {
+    userId: convex_values1839.VId<convex_values1839.GenericId<"User">, "required">; /** Raw TOTP secret key bytes. */
+    secret: convex_values1839.VBytes<ArrayBuffer, "required">; /** Number of digits in each code (typically 6). */
+    digits: convex_values1839.VFloat64<number, "required">; /** Time period in seconds for code rotation (typically 30). */
+    period: convex_values1839.VFloat64<number, "required">; /** Whether setup has been confirmed with a valid code. */
+    verified: convex_values1839.VBoolean<boolean, "required">; /** User-assigned friendly name (e.g. "Google Authenticator"). */
+    name: convex_values1839.VString<string | undefined, "optional">;
+    createdAt: convex_values1839.VFloat64<number, "required">;
+    lastUsedAt: convex_values1839.VFloat64<number | undefined, "optional">;
+  }, "required", "name" | "userId" | "secret" | "createdAt" | "lastUsedAt" | "digits" | "period" | "verified">, {
+    user_id: ["userId", "_creationTime"];
+    user_id_verified: ["userId", "verified", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Device authorization codes (RFC 8628). Each record tracks a pending
+   * device auth session — the device polls with `deviceCode` while the
+   * user authorizes via `userCode` on a secondary device.
+   */
+  DeviceCode: convex_server32.TableDefinition<convex_values1839.VObject<{
+    userId?: convex_values1839.GenericId<"User"> | undefined;
+    sessionId?: convex_values1839.GenericId<"Session"> | undefined;
+    lastPolledAt?: number | undefined;
+    status: "pending" | "authorized" | "denied";
+    deviceCodeHash: string;
+    userCode: string;
+    expiresAt: number;
+    interval: number;
+  }, {
+    /** High-entropy code used by the device for polling. Stored as SHA-256 hash. */deviceCodeHash: convex_values1839.VString<string, "required">; /** Short human-readable code the user enters (e.g. "WDJB-MJHT"). */
+    userCode: convex_values1839.VString<string, "required">; /** Expiration timestamp (ms since epoch). */
+    expiresAt: convex_values1839.VFloat64<number, "required">; /** Minimum polling interval in seconds. */
+    interval: convex_values1839.VFloat64<number, "required">; /** Current status of this device authorization session. */
+    status: convex_values1839.VUnion<"pending" | "authorized" | "denied", [convex_values1839.VLiteral<"pending", "required">, convex_values1839.VLiteral<"authorized", "required">, convex_values1839.VLiteral<"denied", "required">], "required", never>; /** Set when the user authorizes — links to the authorizing user. */
+    userId: convex_values1839.VId<convex_values1839.GenericId<"User"> | undefined, "optional">; /** Set when the user authorizes — the session created for the device. */
+    sessionId: convex_values1839.VId<convex_values1839.GenericId<"Session"> | undefined, "optional">; /** Timestamp of the last poll request (for slow_down enforcement). */
+    lastPolledAt: convex_values1839.VFloat64<number | undefined, "optional">;
+  }, "required", "userId" | "sessionId" | "status" | "deviceCodeHash" | "userCode" | "expiresAt" | "interval" | "lastPolledAt">, {
+    device_code_hash: ["deviceCodeHash", "_creationTime"];
+    user_code_status: ["userCode", "status", "_creationTime"];
+    expires_at: ["expiresAt", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Hierarchical groups. A group with no `parentGroupId` is a root group.
+   * Groups can nest arbitrarily deep via `parentGroupId` for modeling
+   * organizations, teams, departments, or any tree structure.
+   */
+  Group: convex_server32.TableDefinition<convex_values1839.VObject<{
+    extend?: any;
+    type?: string | undefined;
+    slug?: string | undefined;
+    parentGroupId?: convex_values1839.GenericId<"Group"> | undefined;
+    rootGroupId?: convex_values1839.GenericId<"Group"> | undefined;
+    isRoot?: boolean | undefined;
+    policy?: {
+      extend?: any;
+      version: 1;
+      identity: {
+        accountLinking: {
+          oidc: "verifiedEmail" | "none" | "sameConnection";
+          saml: "verifiedEmail" | "none" | "sameConnection";
+        };
+      };
+      provisioning: {
+        user: {
+          createOnSignIn: boolean;
+          updateProfileOnLogin: "never" | "missing" | "always";
+          updateProfileFromScim: "never" | "missing" | "always";
+          authority: "scim" | "app" | "connection";
+        };
+        scimReuse: {
+          user: "none" | "externalId";
+        };
+        jit: {
+          defaultRole?: string | undefined;
+          defaultRoleIds?: string[] | undefined;
+          mode: "off" | "createUser" | "createUserAndMembership";
+        };
+        deprovision: {
+          mode: "soft" | "hard";
+        };
+        groups: {
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "ignore" | "sync";
+        };
+        roles: {
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "map" | "ignore";
+        };
+      };
+    } | undefined;
+    tags?: any;
+    name: string;
+  }, {
+    name: convex_values1839.VString<string, "required">;
+    slug: convex_values1839.VString<string | undefined, "optional">;
+    type: convex_values1839.VString<string | undefined, "optional">;
+    parentGroupId: convex_values1839.VId<convex_values1839.GenericId<"Group"> | undefined, "optional">; /** Denormalized root group ID. Self-referencing for root groups. */
+    rootGroupId: convex_values1839.VId<convex_values1839.GenericId<"Group"> | undefined, "optional">; /** Denormalized flag: `true` when `parentGroupId` is absent. */
+    isRoot: convex_values1839.VBoolean<boolean | undefined, "optional">;
+    policy: convex_values1839.VObject<{
+      extend?: any;
+      version: 1;
+      identity: {
+        accountLinking: {
+          oidc: "verifiedEmail" | "none" | "sameConnection";
+          saml: "verifiedEmail" | "none" | "sameConnection";
+        };
+      };
+      provisioning: {
+        user: {
+          createOnSignIn: boolean;
+          updateProfileOnLogin: "never" | "missing" | "always";
+          updateProfileFromScim: "never" | "missing" | "always";
+          authority: "scim" | "app" | "connection";
+        };
+        scimReuse: {
+          user: "none" | "externalId";
+        };
+        jit: {
+          defaultRole?: string | undefined;
+          defaultRoleIds?: string[] | undefined;
+          mode: "off" | "createUser" | "createUserAndMembership";
+        };
+        deprovision: {
+          mode: "soft" | "hard";
+        };
+        groups: {
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "ignore" | "sync";
+        };
+        roles: {
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "map" | "ignore";
+        };
+      };
+    } | undefined, {
+      version: convex_values1839.VLiteral<1, "required">;
+      identity: convex_values1839.VObject<{
+        accountLinking: {
+          oidc: "verifiedEmail" | "none" | "sameConnection";
+          saml: "verifiedEmail" | "none" | "sameConnection";
+        };
+      }, {
+        accountLinking: convex_values1839.VObject<{
+          oidc: "verifiedEmail" | "none" | "sameConnection";
+          saml: "verifiedEmail" | "none" | "sameConnection";
+        }, {
+          oidc: convex_values1839.VUnion<"verifiedEmail" | "none" | "sameConnection", [convex_values1839.VLiteral<"verifiedEmail", "required">, convex_values1839.VLiteral<"none", "required">, convex_values1839.VLiteral<"sameConnection", "required">], "required", never>;
+          saml: convex_values1839.VUnion<"verifiedEmail" | "none" | "sameConnection", [convex_values1839.VLiteral<"verifiedEmail", "required">, convex_values1839.VLiteral<"none", "required">, convex_values1839.VLiteral<"sameConnection", "required">], "required", never>;
+        }, "required", "oidc" | "saml">;
+      }, "required", "accountLinking" | "accountLinking.oidc" | "accountLinking.saml">;
+      provisioning: convex_values1839.VObject<{
+        user: {
+          createOnSignIn: boolean;
+          updateProfileOnLogin: "never" | "missing" | "always";
+          updateProfileFromScim: "never" | "missing" | "always";
+          authority: "scim" | "app" | "connection";
+        };
+        scimReuse: {
+          user: "none" | "externalId";
+        };
+        jit: {
+          defaultRole?: string | undefined;
+          defaultRoleIds?: string[] | undefined;
+          mode: "off" | "createUser" | "createUserAndMembership";
+        };
+        deprovision: {
+          mode: "soft" | "hard";
+        };
+        groups: {
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "ignore" | "sync";
+        };
+        roles: {
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "map" | "ignore";
+        };
+      }, {
+        user: convex_values1839.VObject<{
+          createOnSignIn: boolean;
+          updateProfileOnLogin: "never" | "missing" | "always";
+          updateProfileFromScim: "never" | "missing" | "always";
+          authority: "scim" | "app" | "connection";
+        }, {
+          createOnSignIn: convex_values1839.VBoolean<boolean, "required">;
+          updateProfileOnLogin: convex_values1839.VUnion<"never" | "missing" | "always", [convex_values1839.VLiteral<"never", "required">, convex_values1839.VLiteral<"missing", "required">, convex_values1839.VLiteral<"always", "required">], "required", never>;
+          updateProfileFromScim: convex_values1839.VUnion<"never" | "missing" | "always", [convex_values1839.VLiteral<"never", "required">, convex_values1839.VLiteral<"missing", "required">, convex_values1839.VLiteral<"always", "required">], "required", never>;
+          authority: convex_values1839.VUnion<"scim" | "app" | "connection", [convex_values1839.VLiteral<"app", "required">, convex_values1839.VLiteral<"connection", "required">, convex_values1839.VLiteral<"scim", "required">], "required", never>;
+        }, "required", "createOnSignIn" | "updateProfileOnLogin" | "updateProfileFromScim" | "authority">;
+        scimReuse: convex_values1839.VObject<{
+          user: "none" | "externalId";
+        }, {
+          user: convex_values1839.VUnion<"none" | "externalId", [convex_values1839.VLiteral<"externalId", "required">, convex_values1839.VLiteral<"none", "required">], "required", never>;
+        }, "required", "user">;
+        jit: convex_values1839.VObject<{
+          defaultRole?: string | undefined;
+          defaultRoleIds?: string[] | undefined;
+          mode: "off" | "createUser" | "createUserAndMembership";
+        }, {
+          mode: convex_values1839.VUnion<"off" | "createUser" | "createUserAndMembership", [convex_values1839.VLiteral<"off", "required">, convex_values1839.VLiteral<"createUser", "required">, convex_values1839.VLiteral<"createUserAndMembership", "required">], "required", never>;
+          defaultRole: convex_values1839.VString<string | undefined, "optional">;
+          defaultRoleIds: convex_values1839.VArray<string[] | undefined, convex_values1839.VString<string, "required">, "optional">;
+        }, "required", "mode" | "defaultRole" | "defaultRoleIds">;
+        deprovision: convex_values1839.VObject<{
+          mode: "soft" | "hard";
+        }, {
+          mode: convex_values1839.VUnion<"soft" | "hard", [convex_values1839.VLiteral<"soft", "required">, convex_values1839.VLiteral<"hard", "required">], "required", never>;
+        }, "required", "mode">;
+        groups: convex_values1839.VObject<{
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "ignore" | "sync";
+        }, {
+          mode: convex_values1839.VUnion<"ignore" | "sync", [convex_values1839.VLiteral<"ignore", "required">, convex_values1839.VLiteral<"sync", "required">], "required", never>;
+          source: convex_values1839.VLiteral<"protocol", "required">;
+          mapping: convex_values1839.VRecord<Record<string, string[]> | undefined, convex_values1839.VString<string, "required">, convex_values1839.VArray<string[], convex_values1839.VString<string, "required">, "required">, "optional", string>;
+        }, "required", "source" | "mode" | "mapping" | `mapping.${string}`>;
+        roles: convex_values1839.VObject<{
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "map" | "ignore";
+        }, {
+          mode: convex_values1839.VUnion<"map" | "ignore", [convex_values1839.VLiteral<"ignore", "required">, convex_values1839.VLiteral<"map", "required">], "required", never>;
+          source: convex_values1839.VLiteral<"protocol", "required">;
+          mapping: convex_values1839.VRecord<Record<string, string[]> | undefined, convex_values1839.VString<string, "required">, convex_values1839.VArray<string[], convex_values1839.VString<string, "required">, "required">, "optional", string>;
+        }, "required", "source" | "mode" | "mapping" | `mapping.${string}`>;
+      }, "required", "user" | "scimReuse" | "jit" | "deprovision" | "groups" | "roles" | "user.createOnSignIn" | "user.updateProfileOnLogin" | "user.updateProfileFromScim" | "user.authority" | "scimReuse.user" | "jit.mode" | "jit.defaultRole" | "jit.defaultRoleIds" | "deprovision.mode" | "groups.source" | "groups.mode" | "groups.mapping" | `groups.mapping.${string}` | "roles.source" | "roles.mode" | "roles.mapping" | `roles.mapping.${string}`>;
+      extend: convex_values1839.VAny<any, "optional", string>;
+    }, "optional", "extend" | `extend.${string}` | "version" | "identity" | "provisioning" | "identity.accountLinking" | "identity.accountLinking.oidc" | "identity.accountLinking.saml" | "provisioning.user" | "provisioning.scimReuse" | "provisioning.jit" | "provisioning.deprovision" | "provisioning.groups" | "provisioning.roles" | "provisioning.user.createOnSignIn" | "provisioning.user.updateProfileOnLogin" | "provisioning.user.updateProfileFromScim" | "provisioning.user.authority" | "provisioning.scimReuse.user" | "provisioning.jit.mode" | "provisioning.jit.defaultRole" | "provisioning.jit.defaultRoleIds" | "provisioning.deprovision.mode" | "provisioning.groups.source" | "provisioning.groups.mode" | "provisioning.groups.mapping" | `provisioning.groups.mapping.${string}` | "provisioning.roles.source" | "provisioning.roles.mode" | "provisioning.roles.mapping" | `provisioning.roles.mapping.${string}`>;
+    extend: convex_values1839.VAny<any, "optional", string>;
+    /**
+     * @deprecated Removed faceted classification tags (was
+     * `v.array(v.object({ key, value }))`). Retained as `v.any()` so
+     * pre-existing rows still validate on deploy — do NOT re-narrow it here.
+     * Clear existing data via the `dropGroupTags` migration, then drop this
+     * field in a later major release.
+     */
+    tags: convex_values1839.VAny<any, "optional", string>;
+  }, "required", "name" | "extend" | "type" | `extend.${string}` | "slug" | "parentGroupId" | "rootGroupId" | "isRoot" | "policy" | "tags" | "policy.extend" | `policy.extend.${string}` | "policy.version" | "policy.identity" | "policy.provisioning" | "policy.identity.accountLinking" | "policy.identity.accountLinking.oidc" | "policy.identity.accountLinking.saml" | "policy.provisioning.user" | "policy.provisioning.scimReuse" | "policy.provisioning.jit" | "policy.provisioning.deprovision" | "policy.provisioning.groups" | "policy.provisioning.roles" | "policy.provisioning.user.createOnSignIn" | "policy.provisioning.user.updateProfileOnLogin" | "policy.provisioning.user.updateProfileFromScim" | "policy.provisioning.user.authority" | "policy.provisioning.scimReuse.user" | "policy.provisioning.jit.mode" | "policy.provisioning.jit.defaultRole" | "policy.provisioning.jit.defaultRoleIds" | "policy.provisioning.deprovision.mode" | "policy.provisioning.groups.source" | "policy.provisioning.groups.mode" | "policy.provisioning.groups.mapping" | `policy.provisioning.groups.mapping.${string}` | "policy.provisioning.roles.source" | "policy.provisioning.roles.mode" | "policy.provisioning.roles.mapping" | `policy.provisioning.roles.mapping.${string}` | `tags.${string}`>, {
+    name: ["name", "_creationTime"];
+    slug: ["slug", "_creationTime"];
+    parent_group_id: ["parentGroupId", "_creationTime"];
+    parent_group_id_name: ["parentGroupId", "name", "_creationTime"];
+    parent_group_id_slug: ["parentGroupId", "slug", "_creationTime"];
+    parent_group_id_type: ["parentGroupId", "type", "_creationTime"];
+    root_group_id: ["rootGroupId", "_creationTime"];
+    is_root: ["isRoot", "_creationTime"];
+    type: ["type", "_creationTime"];
+    type_parent_group_id: ["type", "parentGroupId", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Durable state for large group subtree removals and root-id re-stamps.
+   * These rows are component-internal implementation details; the public
+   * `Group` document stays free of workflow metadata.
+   */
+  GroupHierarchyOperation: convex_server32.TableDefinition<convex_values1839.VObject<{
+    newRootGroupId?: convex_values1839.GenericId<"Group"> | undefined;
+    expectedParentGroupId?: convex_values1839.GenericId<"Group"> | undefined;
+    groupId: convex_values1839.GenericId<"Group">;
+    phase: "planning" | "applying" | "cleaning";
+    kind: "remove" | "restamp";
+  }, {
+    groupId: convex_values1839.VId<convex_values1839.GenericId<"Group">, "required">;
+    kind: convex_values1839.VUnion<"remove" | "restamp", [convex_values1839.VLiteral<"remove", "required">, convex_values1839.VLiteral<"restamp", "required">], "required", never>;
+    phase: convex_values1839.VUnion<"planning" | "applying" | "cleaning", [convex_values1839.VLiteral<"planning", "required">, convex_values1839.VLiteral<"applying", "required">, convex_values1839.VLiteral<"cleaning", "required">], "required", never>;
+    newRootGroupId: convex_values1839.VId<convex_values1839.GenericId<"Group"> | undefined, "optional">;
+    expectedParentGroupId: convex_values1839.VId<convex_values1839.GenericId<"Group"> | undefined, "optional">;
+  }, "required", "groupId" | "phase" | "newRootGroupId" | "expectedParentGroupId" | "kind">, {
+    group_id_kind: ["groupId", "kind", "_creationTime"];
+    group_id_kind_parent_root: ["groupId", "kind", "expectedParentGroupId", "newRootGroupId", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * One durable queue row per group in a hierarchy operation. Keeping work as
+   * rows instead of a carried array avoids an unbounded scheduled-function
+   * argument/frontier and makes every continuation safe to retry.
+   */
+  GroupHierarchyWork: convex_server32.TableDefinition<convex_values1839.VObject<{
+    expectedParentGroupId?: convex_values1839.GenericId<"Group"> | undefined;
+    parentWorkId?: convex_values1839.GenericId<"GroupHierarchyWork"> | undefined;
+    eligible?: boolean | undefined;
+    scanCursor?: string | undefined;
+    groupId: convex_values1839.GenericId<"Group">;
+    kind: "remove" | "restamp";
+    operationId: convex_values1839.GenericId<"GroupHierarchyOperation">;
+    depth: number;
+    planned: boolean;
+    applied: boolean;
+  }, {
+    operationId: convex_values1839.VId<convex_values1839.GenericId<"GroupHierarchyOperation">, "required">;
+    kind: convex_values1839.VUnion<"remove" | "restamp", [convex_values1839.VLiteral<"remove", "required">, convex_values1839.VLiteral<"restamp", "required">], "required", never>;
+    groupId: convex_values1839.VId<convex_values1839.GenericId<"Group">, "required">;
+    parentWorkId: convex_values1839.VId<convex_values1839.GenericId<"GroupHierarchyWork"> | undefined, "optional">;
+    expectedParentGroupId: convex_values1839.VId<convex_values1839.GenericId<"Group"> | undefined, "optional">;
+    depth: convex_values1839.VFloat64<number, "required">;
+    planned: convex_values1839.VBoolean<boolean, "required">;
+    applied: convex_values1839.VBoolean<boolean, "required">;
+    eligible: convex_values1839.VBoolean<boolean | undefined, "optional">;
+    scanCursor: convex_values1839.VString<string | undefined, "optional">;
+  }, "required", "groupId" | "expectedParentGroupId" | "kind" | "operationId" | "parentWorkId" | "depth" | "planned" | "applied" | "eligible" | "scanCursor">, {
+    operation_id_group_id: ["operationId", "groupId", "_creationTime"];
+    operation_id_planned: ["operationId", "planned", "_creationTime"];
+    operation_id_applied_depth: ["operationId", "applied", "depth", "_creationTime"];
+    group_id: ["groupId", "_creationTime"];
+    group_id_kind: ["groupId", "kind", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Group membership. Links a user to a group with an application-defined
+   * role (e.g. "owner", "admin", "member", "viewer"). A user can be a
+   * member of multiple groups with different roles in each.
+   */
+  GroupMember: convex_server32.TableDefinition<convex_values1839.VObject<{
+    extend?: any;
+    status?: string | undefined;
+    role?: string | undefined;
+    roleIds?: string[] | undefined;
+    userId: convex_values1839.GenericId<"User">;
+    groupId: convex_values1839.GenericId<"Group">;
+  }, {
+    groupId: convex_values1839.VId<convex_values1839.GenericId<"Group">, "required">;
+    userId: convex_values1839.VId<convex_values1839.GenericId<"User">, "required">;
+    role: convex_values1839.VString<string | undefined, "optional">;
+    roleIds: convex_values1839.VArray<string[] | undefined, convex_values1839.VString<string, "required">, "optional">;
+    status: convex_values1839.VString<string | undefined, "optional">;
+    extend: convex_values1839.VAny<any, "optional", string>;
+  }, "required", "extend" | `extend.${string}` | "userId" | "status" | "groupId" | "role" | "roleIds">, {
+    group_id: ["groupId", "_creationTime"];
+    group_id_user_id: ["groupId", "userId", "_creationTime"];
+    group_id_status: ["groupId", "status", "_creationTime"];
+    user_id: ["userId", "_creationTime"];
+    user_id_status: ["userId", "status", "_creationTime"];
+    status: ["status", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Invitations. Tracks pending, accepted, revoked, and expired
+   * invitations. Optionally scoped to a group via `groupId`, or
+   * platform-level when `groupId` is omitted.
+   *
+   * `email` and `invitedByUserId` are optional to support CLI-generated
+   * invite links where neither is known upfront.
+   */
+  GroupInvite: convex_server32.TableDefinition<convex_values1839.VObject<{
+    email?: string | undefined;
+    extend?: any;
+    groupId?: convex_values1839.GenericId<"Group"> | undefined;
+    role?: string | undefined;
+    roleIds?: string[] | undefined;
+    invitedByUserId?: convex_values1839.GenericId<"User"> | undefined;
+    expiresTime?: number | undefined;
+    acceptedByUserId?: convex_values1839.GenericId<"User"> | undefined;
+    acceptedTime?: number | undefined;
+    status: "pending" | "accepted" | "revoked" | "expired";
+    tokenHash: string;
+  }, {
+    groupId: convex_values1839.VId<convex_values1839.GenericId<"Group"> | undefined, "optional">;
+    invitedByUserId: convex_values1839.VId<convex_values1839.GenericId<"User"> | undefined, "optional">;
+    email: convex_values1839.VString<string | undefined, "optional">;
+    tokenHash: convex_values1839.VString<string, "required">;
+    role: convex_values1839.VString<string | undefined, "optional">;
+    roleIds: convex_values1839.VArray<string[] | undefined, convex_values1839.VString<string, "required">, "optional">;
+    status: convex_values1839.VUnion<"pending" | "accepted" | "revoked" | "expired", [convex_values1839.VLiteral<"pending", "required">, convex_values1839.VLiteral<"accepted", "required">, convex_values1839.VLiteral<"revoked", "required">, convex_values1839.VLiteral<"expired", "required">], "required", never>;
+    expiresTime: convex_values1839.VFloat64<number | undefined, "optional">;
+    acceptedByUserId: convex_values1839.VId<convex_values1839.GenericId<"User"> | undefined, "optional">;
+    acceptedTime: convex_values1839.VFloat64<number | undefined, "optional">;
+    extend: convex_values1839.VAny<any, "optional", string>;
+  }, "required", "email" | "extend" | `extend.${string}` | "status" | "groupId" | "role" | "roleIds" | "invitedByUserId" | "tokenHash" | "expiresTime" | "acceptedByUserId" | "acceptedTime">, {
+    token_hash: ["tokenHash", "_creationTime"];
+    status: ["status", "_creationTime"];
+    email_status: ["email", "status", "_creationTime"];
+    email_group_id_status: ["email", "groupId", "status", "_creationTime"];
+    invited_by_user_id_status: ["invitedByUserId", "status", "_creationTime"];
+    group_id: ["groupId", "_creationTime"];
+    group_id_status: ["groupId", "status", "_creationTime"];
+    group_id_email_status: ["groupId", "email", "status", "_creationTime"];
+    expires_time: ["expiresTime", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Group Connection configuration attached to a root group/organization.
+   *
+   * The `config` payload intentionally stays flexible so the headless group connection
+   * SDK can evolve without forcing schema churn for every protocol-specific
+   * field addition.
+   */
+  GroupConnection: convex_server32.TableDefinition<convex_values1839.VObject<{
+    name?: string | undefined;
+    extend?: any;
+    slug?: string | undefined;
+    config?: any;
+    status: "draft" | "active" | "disabled";
+    protocol: "oidc" | "saml";
+    groupId: convex_values1839.GenericId<"Group">;
+  }, {
+    groupId: convex_values1839.VId<convex_values1839.GenericId<"Group">, "required">;
+    slug: convex_values1839.VString<string | undefined, "optional">;
+    name: convex_values1839.VString<string | undefined, "optional">;
+    protocol: convex_values1839.VUnion<"oidc" | "saml", [convex_values1839.VLiteral<"oidc", "required">, convex_values1839.VLiteral<"saml", "required">], "required", never>;
+    status: convex_values1839.VUnion<"draft" | "active" | "disabled", [convex_values1839.VLiteral<"draft", "required">, convex_values1839.VLiteral<"active", "required">, convex_values1839.VLiteral<"disabled", "required">], "required", never>;
+    config: convex_values1839.VAny<any, "optional", string>;
+    extend: convex_values1839.VAny<any, "optional", string>;
+  }, "required", "name" | "extend" | `extend.${string}` | "status" | "slug" | "protocol" | "groupId" | "config" | `config.${string}`>, {
+    group_id: ["groupId", "_creationTime"];
+    name: ["name", "_creationTime"];
+    slug: ["slug", "_creationTime"];
+    status: ["status", "_creationTime"];
+    group_id_name: ["groupId", "name", "_creationTime"];
+    group_id_status: ["groupId", "status", "_creationTime"];
+    group_id_slug: ["groupId", "slug", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Verified or pending domains linked to an group connection record.
+   */
+  GroupConnectionDomain: convex_server32.TableDefinition<convex_values1839.VObject<{
+    verifiedAt?: number | undefined;
+    isPrimary: boolean;
+    connectionId: convex_values1839.GenericId<"GroupConnection">;
+    groupId: convex_values1839.GenericId<"Group">;
+    domain: string;
+  }, {
+    connectionId: convex_values1839.VId<convex_values1839.GenericId<"GroupConnection">, "required">;
+    groupId: convex_values1839.VId<convex_values1839.GenericId<"Group">, "required">;
+    domain: convex_values1839.VString<string, "required">;
+    isPrimary: convex_values1839.VBoolean<boolean, "required">;
+    verifiedAt: convex_values1839.VFloat64<number | undefined, "optional">;
+  }, "required", "isPrimary" | "connectionId" | "verifiedAt" | "groupId" | "domain">, {
+    connection_id: ["connectionId", "_creationTime"];
+    group_id: ["groupId", "_creationTime"];
+    domain: ["domain", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Pending SAML AuthnRequest IDs awaiting a matching ACS response.
+   *
+   * A row is created when the SP generates a SAML sign-in request and accepted
+   * (single-use) at the ACS handler. Because the ID is looked up server-side and
+   * marked `acceptedAt`, a captured SAMLResponse/RelayState pair cannot be
+   * replayed — the second accept fails. Rows are pruned by `expiresAt`.
+   */
+  SamlLoginRequest: convex_server32.TableDefinition<convex_values1839.VObject<{
+    acceptedAt?: number | undefined;
+    connectionId: convex_values1839.GenericId<"GroupConnection">;
+    createdAt: number;
+    expiresAt: number;
+    requestId: string;
+  }, {
+    connectionId: convex_values1839.VId<convex_values1839.GenericId<"GroupConnection">, "required">;
+    requestId: convex_values1839.VString<string, "required">;
+    createdAt: convex_values1839.VFloat64<number, "required">;
+    expiresAt: convex_values1839.VFloat64<number, "required">;
+    acceptedAt: convex_values1839.VFloat64<number | undefined, "optional">;
+  }, "required", "connectionId" | "createdAt" | "expiresAt" | "requestId" | "acceptedAt">, {
+    request_id: ["requestId", "_creationTime"];
+    expires_at: ["expiresAt", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Replay cache of SAML assertion IDs already accepted at the ACS handler.
+   *
+   * Catches IdP-initiated responses that carry no `InResponseTo` (so have no
+   * pending {@link SamlLoginRequest} to accept): an assertion ID is recorded
+   * on first acceptance and rejected if seen again. `expiresAt` is bounded by
+   * the assertion's `NotOnOrAfter`, and rows are pruned by `expiresAt`.
+   */
+  SamlSeenAssertion: convex_server32.TableDefinition<convex_values1839.VObject<{
+    connectionId: convex_values1839.GenericId<"GroupConnection">;
+    expiresAt: number;
+    assertionId: string;
+  }, {
+    connectionId: convex_values1839.VId<convex_values1839.GenericId<"GroupConnection">, "required">;
+    assertionId: convex_values1839.VString<string, "required">;
+    expiresAt: convex_values1839.VFloat64<number, "required">;
+  }, "required", "connectionId" | "expiresAt" | "assertionId">, {
+    connection_id_assertion_id: ["connectionId", "assertionId", "_creationTime"];
+    expires_at: ["expiresAt", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Pending DNS TXT verification challenges for group connection domains.
+   */
+  GroupConnectionDomainVerification: convex_server32.TableDefinition<convex_values1839.VObject<{
+    connectionId: convex_values1839.GenericId<"GroupConnection">;
+    expiresAt: number;
+    groupId: convex_values1839.GenericId<"Group">;
+    tokenHash: string;
+    domain: string;
+    domainId: convex_values1839.GenericId<"GroupConnectionDomain">;
+    recordName: string;
+    token: string;
+    requestedAt: number;
+  }, {
+    connectionId: convex_values1839.VId<convex_values1839.GenericId<"GroupConnection">, "required">;
+    groupId: convex_values1839.VId<convex_values1839.GenericId<"Group">, "required">;
+    domainId: convex_values1839.VId<convex_values1839.GenericId<"GroupConnectionDomain">, "required">;
+    domain: convex_values1839.VString<string, "required">;
+    recordName: convex_values1839.VString<string, "required">;
+    token: convex_values1839.VString<string, "required">;
+    tokenHash: convex_values1839.VString<string, "required">;
+    requestedAt: convex_values1839.VFloat64<number, "required">;
+    expiresAt: convex_values1839.VFloat64<number, "required">;
+  }, "required", "connectionId" | "expiresAt" | "groupId" | "tokenHash" | "domain" | "domainId" | "recordName" | "token" | "requestedAt">, {
+    connection_id: ["connectionId", "_creationTime"];
+    domain_id: ["domainId", "_creationTime"];
+    token_hash: ["tokenHash", "_creationTime"];
+    expires_at: ["expiresAt", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Encrypted group connection secrets stored separately from protocol config.
+   */
+  GroupConnectionSecret: convex_server32.TableDefinition<convex_values1839.VObject<{
+    connectionId: convex_values1839.GenericId<"GroupConnection">;
+    updatedAt: number;
+    groupId: convex_values1839.GenericId<"Group">;
+    kind: "oidc_client_secret";
+    ciphertext: string;
+  }, {
+    connectionId: convex_values1839.VId<convex_values1839.GenericId<"GroupConnection">, "required">;
+    groupId: convex_values1839.VId<convex_values1839.GenericId<"Group">, "required">;
+    kind: convex_values1839.VUnion<"oidc_client_secret", [convex_values1839.VLiteral<"oidc_client_secret", "required">], "required", never>;
+    ciphertext: convex_values1839.VString<string, "required">;
+    updatedAt: convex_values1839.VFloat64<number, "required">;
+  }, "required", "connectionId" | "updatedAt" | "groupId" | "kind" | "ciphertext">, {
+    connection_id: ["connectionId", "_creationTime"];
+    connection_id_kind: ["connectionId", "kind", "_creationTime"];
+    group_id: ["groupId", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * SCIM configuration for an group connection tenant.
+   */
+  GroupConnectionScimConfig: convex_server32.TableDefinition<convex_values1839.VObject<{
+    extend?: any;
+    lastRotatedAt?: number | undefined;
+    connectionId: convex_values1839.GenericId<"GroupConnection">;
+    status: "draft" | "active" | "disabled";
+    groupId: convex_values1839.GenericId<"Group">;
+    tokenHash: string;
+    basePath: string;
+  }, {
+    connectionId: convex_values1839.VId<convex_values1839.GenericId<"GroupConnection">, "required">;
+    groupId: convex_values1839.VId<convex_values1839.GenericId<"Group">, "required">;
+    status: convex_values1839.VUnion<"draft" | "active" | "disabled", [convex_values1839.VLiteral<"draft", "required">, convex_values1839.VLiteral<"active", "required">, convex_values1839.VLiteral<"disabled", "required">], "required", never>;
+    basePath: convex_values1839.VString<string, "required">;
+    tokenHash: convex_values1839.VString<string, "required">;
+    lastRotatedAt: convex_values1839.VFloat64<number | undefined, "optional">;
+    extend: convex_values1839.VAny<any, "optional", string>;
+  }, "required", "extend" | `extend.${string}` | "connectionId" | "status" | "groupId" | "tokenHash" | "basePath" | "lastRotatedAt">, {
+    group_connection_id: ["connectionId", "_creationTime"];
+    group_id: ["groupId", "_creationTime"];
+    token_hash: ["tokenHash", "_creationTime"];
+    status: ["status", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * External SCIM identities mapped into local users/groups.
+   */
+  GroupConnectionScimIdentity: convex_server32.TableDefinition<convex_values1839.VObject<{
+    userId?: convex_values1839.GenericId<"User"> | undefined;
+    active?: boolean | undefined;
+    mappedGroupId?: convex_values1839.GenericId<"Group"> | undefined;
+    lastProvisionedAt?: number | undefined;
+    raw?: any;
+    connectionId: convex_values1839.GenericId<"GroupConnection">;
+    externalId: string;
+    groupId: convex_values1839.GenericId<"Group">;
+    resourceType: "user" | "group";
+  }, {
+    connectionId: convex_values1839.VId<convex_values1839.GenericId<"GroupConnection">, "required">;
+    groupId: convex_values1839.VId<convex_values1839.GenericId<"Group">, "required">;
+    resourceType: convex_values1839.VUnion<"user" | "group", [convex_values1839.VLiteral<"user", "required">, convex_values1839.VLiteral<"group", "required">], "required", never>;
+    externalId: convex_values1839.VString<string, "required">;
+    userId: convex_values1839.VId<convex_values1839.GenericId<"User"> | undefined, "optional">;
+    mappedGroupId: convex_values1839.VId<convex_values1839.GenericId<"Group"> | undefined, "optional">;
+    lastProvisionedAt: convex_values1839.VFloat64<number | undefined, "optional">;
+    active: convex_values1839.VBoolean<boolean | undefined, "optional">;
+    raw: convex_values1839.VAny<any, "optional", string>;
+  }, "required", "userId" | "connectionId" | "externalId" | "groupId" | "active" | "resourceType" | "mappedGroupId" | "lastProvisionedAt" | "raw" | `raw.${string}`>, {
+    group_connection_id: ["connectionId", "_creationTime"];
+    group_id: ["groupId", "_creationTime"];
+    group_connection_id_resource_type_external_id: ["connectionId", "resourceType", "externalId", "_creationTime"];
+    group_connection_id_user_id: ["connectionId", "userId", "_creationTime"];
+    user_id: ["userId", "_creationTime"];
+    mapped_group_id: ["mappedGroupId", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Durable, queryable auth-event projection rows.
+   *
+   * Each target owns one immutable copy of the fields needed for indexed reads.
+   * Legacy stream fields remain temporarily so existing deployments can
+   * migrate in place.
+   *
+   * NOTE (0.1 upgrade): this table REPLACES the removed `GroupAuditEvent` table.
+   * Dropping a table is not deploy-blocking (Convex simply orphans its rows), so
+   * there is intentionally NO data-copy migration: the old audit rows used a
+   * different taxonomy (`eventType`/`actorType`/`status` vs the event
+   * `kind`/`actorType`/`outcome` here) and cannot be projected without lossy
+   * guesswork. Pre-0.1 `GroupAuditEvent` history is therefore not carried
+   * forward; consumers that need it must export it from the old deployment
+   * before upgrading. See `migrations.ts` for the runnable upgrade sequence.
+   */
+  AuthEventProjection: convex_server32.TableDefinition<convex_values1839.VObject<{
+    requestId?: string | undefined;
+    actorId?: string | undefined;
+    subjectId?: string | undefined;
+    errorCode?: string | undefined;
+    ip?: string | undefined;
+    userAgent?: string | undefined;
+    data?: {
+      profile?: Record<string, any> | undefined;
+      type?: string | undefined;
+      provider?: string | undefined;
+      existingUserId?: string | undefined;
+    } | {
+      method?: string | undefined;
+      provider: string;
+    } | {
+      userId?: string | undefined;
+      sessionId?: string | undefined;
+      reason?: string | undefined;
+      refreshTokenId?: string | undefined;
+      flow?: "reset" | "change" | undefined;
+    } | {
+      accountId?: string | undefined;
+      provider?: string | undefined;
+      providerAccountId?: string | undefined;
+    } | {
+      name?: string | undefined;
+      credentialId?: string | undefined;
+      reason?: string | undefined;
+      passkeyId?: string | undefined;
+      totpId?: string | undefined;
+      keyId?: string | undefined;
+      prefix?: string | undefined;
+    } | {
+      email?: string | undefined;
+      phone?: string | undefined;
+      userId?: string | undefined;
+    } | {
+      name?: string | undefined;
+      userId?: string | undefined;
+      clientId?: string | undefined;
+      codeId?: string | undefined;
+      scopes?: string[] | undefined;
+      redirectUri?: string | undefined;
+      grantType?: string | undefined;
+      resource?: string | undefined;
+    } | {
+      userId?: string | undefined;
+      connectionId?: string | undefined;
+      verifiedAt?: number | undefined;
+      expiresAt?: number | undefined;
+      version?: number | undefined;
+      protocol?: "oidc" | "saml" | undefined;
+      domain?: string | undefined;
+      recordName?: string | undefined;
+      errorCode?: string | undefined;
+      changed?: string[] | undefined;
+      metadataUrl?: string | undefined;
+      domains?: string[] | undefined;
+      issuer?: string | undefined;
+      discoveryUrl?: string | undefined;
+      jwksUri?: string | undefined;
+      audience?: string | string[] | undefined;
+      tokenEndpointAuthMethod?: string | undefined;
+    } | {
+      userId?: string | undefined;
+      externalId?: string | undefined;
+      groupId?: string | undefined;
+      active?: boolean | undefined;
+      resourceType?: "user" | "group" | undefined;
+      scimConfigId?: string | undefined;
+      resourceId?: string | undefined;
+      operation?: string | undefined;
+    } | {
+      status?: number | undefined;
+      endpointId?: string | undefined;
+      deliveryId?: string | undefined;
+      sourceEventId?: string | undefined;
+      sourceEventType?: "user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed" | undefined;
+      attemptCount?: number | undefined;
+      error?: string | undefined;
+    } | undefined;
+    streamId?: string | undefined;
+    streamIndex?: number | undefined;
+    kind: "user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed";
+    targetKind: "user" | "connection" | "group" | "session" | "api_key" | "oauth_client" | "global";
+    category: "email" | "phone" | "password" | "oauth" | "scim" | "user" | "connection" | "session" | "account" | "passkey" | "totp" | "api_key" | "webhook" | "security";
+    actorType: "scim" | "user" | "api_key" | "webhook" | "oauth_client" | "system" | "anonymous";
+    subjectType: "email" | "phone" | "user" | "connection" | "group" | "session" | "account" | "passkey" | "totp" | "api_key" | "oauth_client" | "system" | "oauth_code" | "scim_identity" | "webhook_endpoint" | "webhook_delivery";
+    outcome: "success" | "failure";
+    eventId: string;
+    targetId: string;
+    occurredAt: number;
+  }, {
+    eventId: convex_values1839.VString<string, "required">;
+    targetKind: convex_values1839.VUnion<"user" | "connection" | "group" | "session" | "api_key" | "oauth_client" | "global", [convex_values1839.VLiteral<"user", "required">, convex_values1839.VLiteral<"session", "required">, convex_values1839.VLiteral<"group", "required">, convex_values1839.VLiteral<"connection", "required">, convex_values1839.VLiteral<"oauth_client", "required">, convex_values1839.VLiteral<"api_key", "required">, convex_values1839.VLiteral<"global", "required">], "required", never>;
+    targetId: convex_values1839.VString<string, "required">;
+    kind: convex_values1839.VUnion<"user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed", convex_values1839.VLiteral<"user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed", "required">[], "required", never>;
+    category: convex_values1839.VUnion<"email" | "phone" | "password" | "oauth" | "scim" | "user" | "connection" | "session" | "account" | "passkey" | "totp" | "api_key" | "webhook" | "security", convex_values1839.VLiteral<"email" | "phone" | "password" | "oauth" | "scim" | "user" | "connection" | "session" | "account" | "passkey" | "totp" | "api_key" | "webhook" | "security", "required">[], "required", never>;
+    occurredAt: convex_values1839.VFloat64<number, "required">;
+    actorType: convex_values1839.VUnion<"scim" | "user" | "api_key" | "webhook" | "oauth_client" | "system" | "anonymous", [convex_values1839.VLiteral<"user", "required">, convex_values1839.VLiteral<"system", "required">, convex_values1839.VLiteral<"scim", "required">, convex_values1839.VLiteral<"api_key", "required">, convex_values1839.VLiteral<"oauth_client", "required">, convex_values1839.VLiteral<"webhook", "required">, convex_values1839.VLiteral<"anonymous", "required">], "required", never>;
+    actorId: convex_values1839.VString<string | undefined, "optional">;
+    subjectType: convex_values1839.VUnion<"email" | "phone" | "user" | "connection" | "group" | "session" | "account" | "passkey" | "totp" | "api_key" | "oauth_client" | "system" | "oauth_code" | "scim_identity" | "webhook_endpoint" | "webhook_delivery", [convex_values1839.VLiteral<"user", "required">, convex_values1839.VLiteral<"session", "required">, convex_values1839.VLiteral<"account", "required">, convex_values1839.VLiteral<"passkey", "required">, convex_values1839.VLiteral<"totp", "required">, convex_values1839.VLiteral<"email", "required">, convex_values1839.VLiteral<"phone", "required">, convex_values1839.VLiteral<"api_key", "required">, convex_values1839.VLiteral<"oauth_client", "required">, convex_values1839.VLiteral<"oauth_code", "required">, convex_values1839.VLiteral<"group", "required">, convex_values1839.VLiteral<"connection", "required">, convex_values1839.VLiteral<"scim_identity", "required">, convex_values1839.VLiteral<"webhook_endpoint", "required">, convex_values1839.VLiteral<"webhook_delivery", "required">, convex_values1839.VLiteral<"system", "required">], "required", never>;
+    subjectId: convex_values1839.VString<string | undefined, "optional">;
+    outcome: convex_values1839.VUnion<"success" | "failure", [convex_values1839.VLiteral<"success", "required">, convex_values1839.VLiteral<"failure", "required">], "required", never>;
+    errorCode: convex_values1839.VString<string | undefined, "optional">;
+    requestId: convex_values1839.VString<string | undefined, "optional">;
+    ip: convex_values1839.VString<string | undefined, "optional">;
+    userAgent: convex_values1839.VString<string | undefined, "optional">;
+    data: convex_values1839.VUnion<{
+      profile?: Record<string, any> | undefined;
+      type?: string | undefined;
+      provider?: string | undefined;
+      existingUserId?: string | undefined;
+    } | {
+      method?: string | undefined;
+      provider: string;
+    } | {
+      userId?: string | undefined;
+      sessionId?: string | undefined;
+      reason?: string | undefined;
+      refreshTokenId?: string | undefined;
+      flow?: "reset" | "change" | undefined;
+    } | {
+      accountId?: string | undefined;
+      provider?: string | undefined;
+      providerAccountId?: string | undefined;
+    } | {
+      name?: string | undefined;
+      credentialId?: string | undefined;
+      reason?: string | undefined;
+      passkeyId?: string | undefined;
+      totpId?: string | undefined;
+      keyId?: string | undefined;
+      prefix?: string | undefined;
+    } | {
+      email?: string | undefined;
+      phone?: string | undefined;
+      userId?: string | undefined;
+    } | {
+      name?: string | undefined;
+      userId?: string | undefined;
+      clientId?: string | undefined;
+      codeId?: string | undefined;
+      scopes?: string[] | undefined;
+      redirectUri?: string | undefined;
+      grantType?: string | undefined;
+      resource?: string | undefined;
+    } | {
+      userId?: string | undefined;
+      connectionId?: string | undefined;
+      verifiedAt?: number | undefined;
+      expiresAt?: number | undefined;
+      version?: number | undefined;
+      protocol?: "oidc" | "saml" | undefined;
+      domain?: string | undefined;
+      recordName?: string | undefined;
+      errorCode?: string | undefined;
+      changed?: string[] | undefined;
+      metadataUrl?: string | undefined;
+      domains?: string[] | undefined;
+      issuer?: string | undefined;
+      discoveryUrl?: string | undefined;
+      jwksUri?: string | undefined;
+      audience?: string | string[] | undefined;
+      tokenEndpointAuthMethod?: string | undefined;
+    } | {
+      userId?: string | undefined;
+      externalId?: string | undefined;
+      groupId?: string | undefined;
+      active?: boolean | undefined;
+      resourceType?: "user" | "group" | undefined;
+      scimConfigId?: string | undefined;
+      resourceId?: string | undefined;
+      operation?: string | undefined;
+    } | {
+      status?: number | undefined;
+      endpointId?: string | undefined;
+      deliveryId?: string | undefined;
+      sourceEventId?: string | undefined;
+      sourceEventType?: "user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed" | undefined;
+      attemptCount?: number | undefined;
+      error?: string | undefined;
+    } | undefined, [convex_values1839.VObject<{
+      profile?: Record<string, any> | undefined;
+      type?: string | undefined;
+      provider?: string | undefined;
+      existingUserId?: string | undefined;
+    }, {
+      type: convex_values1839.VString<string | undefined, "optional">;
+      provider: convex_values1839.VString<string | undefined, "optional">;
+      profile: convex_values1839.VRecord<Record<string, any> | undefined, convex_values1839.VString<string, "required">, convex_values1839.VAny<any, "required", string>, "optional", string>;
+      existingUserId: convex_values1839.VString<string | undefined, "optional">;
+    }, "required", "profile" | "type" | "provider" | "existingUserId" | `profile.${string}`>, convex_values1839.VObject<{
+      method?: string | undefined;
+      provider: string;
+    }, {
+      provider: convex_values1839.VString<string, "required">;
+      method: convex_values1839.VString<string | undefined, "optional">;
+    }, "required", "provider" | "method">, convex_values1839.VObject<{
+      userId?: string | undefined;
+      sessionId?: string | undefined;
+      reason?: string | undefined;
+      refreshTokenId?: string | undefined;
+      flow?: "reset" | "change" | undefined;
+    }, {
+      userId: convex_values1839.VString<string | undefined, "optional">;
+      reason: convex_values1839.VString<string | undefined, "optional">;
+      sessionId: convex_values1839.VString<string | undefined, "optional">;
+      refreshTokenId: convex_values1839.VString<string | undefined, "optional">;
+      flow: convex_values1839.VUnion<"reset" | "change" | undefined, [convex_values1839.VLiteral<"reset", "required">, convex_values1839.VLiteral<"change", "required">], "optional", never>;
+    }, "required", "userId" | "sessionId" | "reason" | "refreshTokenId" | "flow">, convex_values1839.VObject<{
+      accountId?: string | undefined;
+      provider?: string | undefined;
+      providerAccountId?: string | undefined;
+    }, {
+      provider: convex_values1839.VString<string | undefined, "optional">;
+      providerAccountId: convex_values1839.VString<string | undefined, "optional">;
+      accountId: convex_values1839.VString<string | undefined, "optional">;
+    }, "required", "accountId" | "provider" | "providerAccountId">, convex_values1839.VObject<{
+      name?: string | undefined;
+      credentialId?: string | undefined;
+      reason?: string | undefined;
+      passkeyId?: string | undefined;
+      totpId?: string | undefined;
+      keyId?: string | undefined;
+      prefix?: string | undefined;
+    }, {
+      passkeyId: convex_values1839.VString<string | undefined, "optional">;
+      credentialId: convex_values1839.VString<string | undefined, "optional">;
+      totpId: convex_values1839.VString<string | undefined, "optional">;
+      keyId: convex_values1839.VString<string | undefined, "optional">;
+      name: convex_values1839.VString<string | undefined, "optional">;
+      prefix: convex_values1839.VString<string | undefined, "optional">;
+      reason: convex_values1839.VString<string | undefined, "optional">;
+    }, "required", "name" | "credentialId" | "reason" | "passkeyId" | "totpId" | "keyId" | "prefix">, convex_values1839.VObject<{
+      email?: string | undefined;
+      phone?: string | undefined;
+      userId?: string | undefined;
+    }, {
+      email: convex_values1839.VString<string | undefined, "optional">;
+      phone: convex_values1839.VString<string | undefined, "optional">;
+      userId: convex_values1839.VString<string | undefined, "optional">;
+    }, "required", "email" | "phone" | "userId">, convex_values1839.VObject<{
+      name?: string | undefined;
+      userId?: string | undefined;
+      clientId?: string | undefined;
+      codeId?: string | undefined;
+      scopes?: string[] | undefined;
+      redirectUri?: string | undefined;
+      grantType?: string | undefined;
+      resource?: string | undefined;
+    }, {
+      clientId: convex_values1839.VString<string | undefined, "optional">;
+      codeId: convex_values1839.VString<string | undefined, "optional">;
+      name: convex_values1839.VString<string | undefined, "optional">;
+      scopes: convex_values1839.VArray<string[] | undefined, convex_values1839.VString<string, "required">, "optional">;
+      redirectUri: convex_values1839.VString<string | undefined, "optional">;
+      grantType: convex_values1839.VString<string | undefined, "optional">;
+      resource: convex_values1839.VString<string | undefined, "optional">;
+      userId: convex_values1839.VString<string | undefined, "optional">;
+    }, "required", "name" | "userId" | "clientId" | "codeId" | "scopes" | "redirectUri" | "grantType" | "resource">, convex_values1839.VObject<{
+      userId?: string | undefined;
+      connectionId?: string | undefined;
+      verifiedAt?: number | undefined;
+      expiresAt?: number | undefined;
+      version?: number | undefined;
+      protocol?: "oidc" | "saml" | undefined;
+      domain?: string | undefined;
+      recordName?: string | undefined;
+      errorCode?: string | undefined;
+      changed?: string[] | undefined;
+      metadataUrl?: string | undefined;
+      domains?: string[] | undefined;
+      issuer?: string | undefined;
+      discoveryUrl?: string | undefined;
+      jwksUri?: string | undefined;
+      audience?: string | string[] | undefined;
+      tokenEndpointAuthMethod?: string | undefined;
+    }, {
+      connectionId: convex_values1839.VString<string | undefined, "optional">;
+      changed: convex_values1839.VArray<string[] | undefined, convex_values1839.VString<string, "required">, "optional">;
+      userId: convex_values1839.VString<string | undefined, "optional">;
+      protocol: convex_values1839.VUnion<"oidc" | "saml" | undefined, [convex_values1839.VLiteral<"oidc", "required">, convex_values1839.VLiteral<"saml", "required">], "optional", never>;
+      domain: convex_values1839.VString<string | undefined, "optional">;
+      recordName: convex_values1839.VString<string | undefined, "optional">;
+      expiresAt: convex_values1839.VFloat64<number | undefined, "optional">;
+      verifiedAt: convex_values1839.VFloat64<number | undefined, "optional">;
+      metadataUrl: convex_values1839.VString<string | undefined, "optional">;
+      domains: convex_values1839.VArray<string[] | undefined, convex_values1839.VString<string, "required">, "optional">;
+      issuer: convex_values1839.VString<string | undefined, "optional">;
+      discoveryUrl: convex_values1839.VString<string | undefined, "optional">;
+      jwksUri: convex_values1839.VString<string | undefined, "optional">;
+      audience: convex_values1839.VUnion<string | string[] | undefined, [convex_values1839.VString<string, "required">, convex_values1839.VArray<string[], convex_values1839.VString<string, "required">, "required">], "optional", never>;
+      tokenEndpointAuthMethod: convex_values1839.VString<string | undefined, "optional">;
+      version: convex_values1839.VFloat64<number | undefined, "optional">;
+      errorCode: convex_values1839.VString<string | undefined, "optional">;
+    }, "required", "userId" | "connectionId" | "verifiedAt" | "expiresAt" | "version" | "protocol" | "domain" | "recordName" | "errorCode" | "changed" | "metadataUrl" | "domains" | "issuer" | "discoveryUrl" | "jwksUri" | "audience" | "tokenEndpointAuthMethod">, convex_values1839.VObject<{
+      userId?: string | undefined;
+      externalId?: string | undefined;
+      groupId?: string | undefined;
+      active?: boolean | undefined;
+      resourceType?: "user" | "group" | undefined;
+      scimConfigId?: string | undefined;
+      resourceId?: string | undefined;
+      operation?: string | undefined;
+    }, {
+      scimConfigId: convex_values1839.VString<string | undefined, "optional">;
+      resourceType: convex_values1839.VUnion<"user" | "group" | undefined, [convex_values1839.VLiteral<"user", "required">, convex_values1839.VLiteral<"group", "required">], "optional", never>;
+      resourceId: convex_values1839.VString<string | undefined, "optional">;
+      operation: convex_values1839.VString<string | undefined, "optional">;
+      externalId: convex_values1839.VString<string | undefined, "optional">;
+      active: convex_values1839.VBoolean<boolean | undefined, "optional">;
+      groupId: convex_values1839.VString<string | undefined, "optional">;
+      userId: convex_values1839.VString<string | undefined, "optional">;
+    }, "required", "userId" | "externalId" | "groupId" | "active" | "resourceType" | "scimConfigId" | "resourceId" | "operation">, convex_values1839.VObject<{
+      status?: number | undefined;
+      endpointId?: string | undefined;
+      deliveryId?: string | undefined;
+      sourceEventId?: string | undefined;
+      sourceEventType?: "user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed" | undefined;
+      attemptCount?: number | undefined;
+      error?: string | undefined;
+    }, {
+      endpointId: convex_values1839.VString<string | undefined, "optional">;
+      deliveryId: convex_values1839.VString<string | undefined, "optional">;
+      sourceEventId: convex_values1839.VString<string | undefined, "optional">;
+      sourceEventType: convex_values1839.VUnion<"user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed" | undefined, convex_values1839.VLiteral<"user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed", "required">[], "optional", never>;
+      attemptCount: convex_values1839.VFloat64<number | undefined, "optional">;
+      status: convex_values1839.VFloat64<number | undefined, "optional">;
+      error: convex_values1839.VString<string | undefined, "optional">;
+    }, "required", "status" | "endpointId" | "deliveryId" | "sourceEventId" | "sourceEventType" | "attemptCount" | "error">], "optional", "name" | "email" | "profile" | "phone" | "type" | "userId" | "accountId" | "provider" | "connectionId" | "providerAccountId" | "sessionId" | "credentialId" | "verifiedAt" | "status" | "expiresAt" | "version" | "externalId" | "protocol" | "groupId" | "active" | "domain" | "recordName" | "resourceType" | "errorCode" | "existingUserId" | `profile.${string}` | "method" | "reason" | "refreshTokenId" | "flow" | "passkeyId" | "totpId" | "keyId" | "prefix" | "clientId" | "codeId" | "scopes" | "redirectUri" | "grantType" | "resource" | "changed" | "metadataUrl" | "domains" | "issuer" | "discoveryUrl" | "jwksUri" | "audience" | "tokenEndpointAuthMethod" | "scimConfigId" | "resourceId" | "operation" | "endpointId" | "deliveryId" | "sourceEventId" | "sourceEventType" | "attemptCount" | "error">; /** @deprecated Retained only for stored-row compatibility. */
+    streamId: convex_values1839.VString<string | undefined, "optional">; /** @deprecated Retained only for stored-row compatibility. */
+    streamIndex: convex_values1839.VFloat64<number | undefined, "optional">;
+  }, "required", "kind" | "requestId" | "targetKind" | "category" | "actorType" | "subjectType" | "outcome" | "eventId" | "targetId" | "occurredAt" | "actorId" | "subjectId" | "errorCode" | "ip" | "userAgent" | "data" | "streamId" | "streamIndex" | "data.name" | "data.email" | "data.profile" | "data.phone" | "data.type" | "data.userId" | "data.accountId" | "data.provider" | "data.connectionId" | "data.providerAccountId" | "data.sessionId" | "data.credentialId" | "data.verifiedAt" | "data.status" | "data.expiresAt" | "data.version" | "data.externalId" | "data.protocol" | "data.groupId" | "data.active" | "data.domain" | "data.recordName" | "data.resourceType" | "data.errorCode" | "data.existingUserId" | `data.profile.${string}` | "data.method" | "data.reason" | "data.refreshTokenId" | "data.flow" | "data.passkeyId" | "data.totpId" | "data.keyId" | "data.prefix" | "data.clientId" | "data.codeId" | "data.scopes" | "data.redirectUri" | "data.grantType" | "data.resource" | "data.changed" | "data.metadataUrl" | "data.domains" | "data.issuer" | "data.discoveryUrl" | "data.jwksUri" | "data.audience" | "data.tokenEndpointAuthMethod" | "data.scimConfigId" | "data.resourceId" | "data.operation" | "data.endpointId" | "data.deliveryId" | "data.sourceEventId" | "data.sourceEventType" | "data.attemptCount" | "data.error">, {
+    target_time: ["targetKind", "targetId", "occurredAt", "_creationTime"];
+    target_kind_time: ["targetKind", "targetId", "kind", "occurredAt", "_creationTime"];
+    target_outcome_time: ["targetKind", "targetId", "outcome", "occurredAt", "_creationTime"];
+    target_kind_outcome_time: ["targetKind", "targetId", "kind", "outcome", "occurredAt", "_creationTime"];
+    event_id_target: ["eventId", "targetKind", "targetId", "_creationTime"];
+    kind_time: ["kind", "occurredAt", "_creationTime"];
+    category_time: ["category", "occurredAt", "_creationTime"];
+    outcome_time: ["outcome", "occurredAt", "_creationTime"];
+    actor_time: ["actorType", "actorId", "occurredAt", "_creationTime"];
+    subject_time: ["subjectType", "subjectId", "occurredAt", "_creationTime"];
+    request_id_time: ["requestId", "occurredAt", "_creationTime"];
+    occurred_at: ["occurredAt", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Webhook endpoints subscribed to group audit and lifecycle events.
+   */
+  GroupWebhookEndpoint: convex_server32.TableDefinition<convex_values1839.VObject<{
+    extend?: any;
+    secretCiphertext?: string | undefined;
+    secretHash?: string | undefined;
+    createdByUserId?: convex_values1839.GenericId<"User"> | undefined;
+    lastSuccessAt?: number | undefined;
+    lastFailureAt?: number | undefined;
+    connectionId: convex_values1839.GenericId<"GroupConnection">;
+    status: "active" | "disabled";
+    groupId: convex_values1839.GenericId<"Group">;
+    url: string;
+    subscriptions: string[];
+    failureCount: number;
+  }, {
+    connectionId: convex_values1839.VId<convex_values1839.GenericId<"GroupConnection">, "required">;
+    groupId: convex_values1839.VId<convex_values1839.GenericId<"Group">, "required">;
+    url: convex_values1839.VString<string, "required">;
+    status: convex_values1839.VUnion<"active" | "disabled", [convex_values1839.VLiteral<"active", "required">, convex_values1839.VLiteral<"disabled", "required">], "required", never>;
+    /**
+     * Endpoint signing secret encrypted with `AUTH_SECRET_ENCRYPTION_KEY`.
+     * Decrypted at emit time to HMAC-SHA256 each outbound payload; the
+     * dispatch action forwards the precomputed signature in
+     * `X-Auth-Signature`.
+     *
+     * Optional for the 0.1 two-phase upgrade: pre-existing rows carry the
+     * one-way `secretHash` and have no `secretCiphertext` yet. The
+     * `disableLegacyWebhookEndpoints` migration disables those rows and erases
+     * the hash; an operator must provide a new secret before re-enabling them.
+     * Tighten back to required in a later release once every live row is
+     * encrypted.
+     */
+    secretCiphertext: convex_values1839.VString<string | undefined, "optional">;
+    /**
+     * @deprecated One-way SHA-256 hash from the pre-encryption signing scheme.
+     * Retained only so pre-existing rows validate on deploy; the endpoint
+     * migration disables hash-only rows and clears this field. It cannot be
+     * converted into the original secret. Removed in a later release.
+     */
+    secretHash: convex_values1839.VString<string | undefined, "optional">;
+    /**
+     * Kept permissive (`v.array(v.string())`, not `v.array(vAuthEventKind)`) so
+     * rows holding pre-rename kind strings validate on deploy. The
+     * `renameWebhookEndpointSubscriptions` migration remaps them; re-narrow in a
+     * later release.
+     */
+    subscriptions: convex_values1839.VArray<string[], convex_values1839.VString<string, "required">, "required">;
+    createdByUserId: convex_values1839.VId<convex_values1839.GenericId<"User"> | undefined, "optional">;
+    lastSuccessAt: convex_values1839.VFloat64<number | undefined, "optional">;
+    lastFailureAt: convex_values1839.VFloat64<number | undefined, "optional">;
+    failureCount: convex_values1839.VFloat64<number, "required">;
+    extend: convex_values1839.VAny<any, "optional", string>;
+  }, "required", "extend" | `extend.${string}` | "connectionId" | "status" | "groupId" | "url" | "secretCiphertext" | "secretHash" | "subscriptions" | "createdByUserId" | "lastSuccessAt" | "lastFailureAt" | "failureCount">, {
+    group_connection_id: ["connectionId", "_creationTime"];
+    group_id: ["groupId", "_creationTime"];
+    status: ["status", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Delivery queue for outbound group webhooks.
+   */
+  GroupWebhookDelivery: convex_server32.TableDefinition<convex_values1839.VObject<{
+    signature?: string | undefined;
+    kind?: "user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed" | undefined;
+    eventId?: string | undefined;
+    lastAttemptAt?: number | undefined;
+    lastResponseStatus?: number | undefined;
+    lastError?: string | undefined;
+    signedAt?: number | undefined;
+    eventType?: string | undefined;
+    auditEventId?: string | undefined;
+    connectionId: convex_values1839.GenericId<"GroupConnection">;
+    status: "pending" | "processing" | "delivered" | "failed";
+    endpointId: convex_values1839.GenericId<"GroupWebhookEndpoint">;
+    attemptCount: number;
+    nextAttemptAt: number;
+    payload: any;
+  }, {
+    connectionId: convex_values1839.VId<convex_values1839.GenericId<"GroupConnection">, "required">;
+    endpointId: convex_values1839.VId<convex_values1839.GenericId<"GroupWebhookEndpoint">, "required">;
+    /**
+     * `eventId`/`kind`/`signature`/`signedAt` became required after the
+     * audit→event migration. Relaxed to optional for the 0.1 two-phase upgrade
+     * so pre-existing rows (which instead carry `eventType`/`auditEventId`, and
+     * may predate `signature`/`signedAt`) validate on deploy. The
+     * `renameWebhookDeliveryKinds` migration backfills them from the legacy
+     * fields; tighten back to required in a later release.
+     */
+    eventId: convex_values1839.VString<string | undefined, "optional">;
+    kind: convex_values1839.VUnion<"user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed" | undefined, convex_values1839.VLiteral<"user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed", "required">[], "optional", never>;
+    status: convex_values1839.VUnion<"pending" | "processing" | "delivered" | "failed", [convex_values1839.VLiteral<"pending", "required">, convex_values1839.VLiteral<"processing", "required">, convex_values1839.VLiteral<"delivered", "required">, convex_values1839.VLiteral<"failed", "required">], "required", never>;
+    attemptCount: convex_values1839.VFloat64<number, "required">;
+    nextAttemptAt: convex_values1839.VFloat64<number, "required">;
+    lastAttemptAt: convex_values1839.VFloat64<number | undefined, "optional">;
+    lastResponseStatus: convex_values1839.VFloat64<number | undefined, "optional">;
+    lastError: convex_values1839.VString<string | undefined, "optional">;
+    payload: convex_values1839.VAny<any, "required", string>; /** HMAC-SHA256 hex of `${signedAt}.${body}` using the endpoint secret. */
+    signature: convex_values1839.VString<string | undefined, "optional">; /** Epoch ms used in the signature pre-image. */
+    signedAt: convex_values1839.VFloat64<number | undefined, "optional">;
+    /**
+     * @deprecated Legacy pre-`event` audit fields. `eventType` held the old
+     * audit event-type string; `auditEventId` referenced the dropped
+     * `GroupAuditEvent` table (kept as `v.string()` since that table no longer
+     * exists). Retained so pre-existing rows validate on deploy; the
+     * `renameWebhookDeliveryKinds` migration reads them to backfill
+     * `kind`/`eventId`, then clears them. Removed in a later release.
+     */
+    eventType: convex_values1839.VString<string | undefined, "optional">;
+    auditEventId: convex_values1839.VString<string | undefined, "optional">;
+  }, "required", "connectionId" | "signature" | "status" | "kind" | "eventId" | "endpointId" | "attemptCount" | "nextAttemptAt" | "lastAttemptAt" | "lastResponseStatus" | "lastError" | "payload" | "signedAt" | "eventType" | "auditEventId" | `payload.${string}`>, {
+    group_connection_id: ["connectionId", "_creationTime"];
+    status_next_attempt_at: ["status", "nextAttemptAt", "_creationTime"];
+    status_signed_at: ["status", "signedAt", "_creationTime"];
+    endpoint_id_status: ["endpointId", "status", "_creationTime"];
+    event_id: ["eventId", "_creationTime"];
+    event_id_endpoint_id: ["eventId", "endpointId", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * API keys for programmatic access. Each key links a user to a set of
+   * scoped permissions and optional per-key rate limiting.
+   *
+   * The raw key is never stored — only a SHA-256 hash. A short prefix
+   * (e.g. "sk_abc1...") is kept for display in admin interfaces.
+   *
+   * Keys support:
+   * - **Scoped permissions**: resource:action pairs (e.g. users:read)
+   * - **Per-key rate limiting**: token-bucket with configurable window
+   * - **Expiration**: optional TTL
+   * - **Soft revocation**: `revoked` flag preserves audit trail
+   */
+  ApiKey: convex_server32.TableDefinition<convex_values1839.VObject<{
+    extend?: any;
+    lastUsedAt?: number | undefined;
+    expiresAt?: number | undefined;
+    rateLimit?: {
+      maxRequests: number;
+      windowMs: number;
+    } | undefined;
+    rateLimitState?: {
+      attemptsLeft: number;
+      lastAttemptTime: number;
+    } | undefined;
+    metadata?: any;
+    name: string;
+    userId: convex_values1839.GenericId<"User">;
+    createdAt: number;
+    revoked: boolean;
+    prefix: string;
+    scopes: {
+      resource: string;
+      actions: string[];
+    }[];
+    hashedKey: string;
+  }, {
+    userId: convex_values1839.VId<convex_values1839.GenericId<"User">, "required">; /** First chars of the key for display (e.g. "sk_abc1..."). */
+    prefix: convex_values1839.VString<string, "required">; /** SHA-256 hex hash of the full raw key. */
+    hashedKey: convex_values1839.VString<string, "required">; /** User-assigned name (e.g. "CI Pipeline", "Production API"). */
+    name: convex_values1839.VString<string, "required">; /** Scoped permissions: [{ resource: "users", actions: ["read", "list"] }]. */
+    scopes: convex_values1839.VArray<{
+      resource: string;
+      actions: string[];
+    }[], convex_values1839.VObject<{
+      resource: string;
+      actions: string[];
+    }, {
+      resource: convex_values1839.VString<string, "required">;
+      actions: convex_values1839.VArray<string[], convex_values1839.VString<string, "required">, "required">;
+    }, "required", "resource" | "actions">, "required">; /** Optional per-key rate limit configuration. */
+    rateLimit: convex_values1839.VObject<{
+      maxRequests: number;
+      windowMs: number;
+    } | undefined, {
+      maxRequests: convex_values1839.VFloat64<number, "required">;
+      windowMs: convex_values1839.VFloat64<number, "required">;
+    }, "optional", "maxRequests" | "windowMs">; /** Rate limit state tracking (token-bucket). */
+    rateLimitState: convex_values1839.VObject<{
+      attemptsLeft: number;
+      lastAttemptTime: number;
+    } | undefined, {
+      attemptsLeft: convex_values1839.VFloat64<number, "required">;
+      lastAttemptTime: convex_values1839.VFloat64<number, "required">;
+    }, "optional", "attemptsLeft" | "lastAttemptTime">; /** Expiration timestamp. Null/undefined = never expires. */
+    expiresAt: convex_values1839.VFloat64<number | undefined, "optional">;
+    lastUsedAt: convex_values1839.VFloat64<number | undefined, "optional">;
+    createdAt: convex_values1839.VFloat64<number, "required">; /** Soft-revoke flag. Revoked keys are kept for audit trail. */
+    revoked: convex_values1839.VBoolean<boolean, "required">; /** Arbitrary app-specific metadata attached to the key. */
+    extend: convex_values1839.VAny<any, "optional", string>;
+    /**
+     * @deprecated Renamed to `extend`. Retained so pre-existing rows validate on
+     * deploy; the `backfillApiKeyExtend` migration copies it into `extend` (when
+     * `extend` is unset) and clears this. Removed in a later release.
+     */
+    metadata: convex_values1839.VAny<any, "optional", string>;
+  }, "required", "name" | "extend" | `extend.${string}` | "userId" | "createdAt" | "lastUsedAt" | "expiresAt" | "revoked" | "prefix" | "scopes" | "hashedKey" | "rateLimit" | "rateLimitState" | "metadata" | "rateLimit.maxRequests" | "rateLimit.windowMs" | "rateLimitState.attemptsLeft" | "rateLimitState.lastAttemptTime" | `metadata.${string}`>, {
+    user_id: ["userId", "_creationTime"];
+    hashed_key: ["hashedKey", "_creationTime"];
+  }, {}, {}>;
+  OAuthClient: convex_server32.TableDefinition<convex_values1839.VObject<{
+    extend?: any;
+    tokenEndpointAuthMethod?: "none" | "client_secret_basic" | "client_secret_post" | undefined;
+    clientSecretHash?: string | undefined;
+    registrationAccessTokenHash?: string | undefined;
+    createdBy?: convex_values1839.GenericId<"User"> | undefined;
+    revokedAt?: number | undefined;
+    name: string;
+    revoked: boolean;
+    clientId: string;
+    scopes: string[];
+    redirectUris: string[];
+    grantTypes: string[];
+  }, {
+    clientId: convex_values1839.VString<string, "required">;
+    clientSecretHash: convex_values1839.VString<string | undefined, "optional">;
+    name: convex_values1839.VString<string, "required">;
+    redirectUris: convex_values1839.VArray<string[], convex_values1839.VString<string, "required">, "required">;
+    scopes: convex_values1839.VArray<string[], convex_values1839.VString<string, "required">, "required">;
+    grantTypes: convex_values1839.VArray<string[], convex_values1839.VString<string, "required">, "required">;
+    /** RFC 7591 token-endpoint auth method; `none` = public client. Optional
+     *  so pre-existing rows validate before the backfill migration runs. */
+    tokenEndpointAuthMethod: convex_values1839.VUnion<"none" | "client_secret_basic" | "client_secret_post" | undefined, [convex_values1839.VLiteral<"client_secret_basic", "required">, convex_values1839.VLiteral<"client_secret_post", "required">, convex_values1839.VLiteral<"none", "required">], "optional", never>; /** SHA-256 of the RFC 7592 registration access token (management bearer). */
+    registrationAccessTokenHash: convex_values1839.VString<string | undefined, "optional">;
+    createdBy: convex_values1839.VId<convex_values1839.GenericId<"User"> | undefined, "optional">;
+    revoked: convex_values1839.VBoolean<boolean, "required">; /** Set when revoked; optional until the compatibility backfill runs. */
+    revokedAt: convex_values1839.VFloat64<number | undefined, "optional">;
+    extend: convex_values1839.VAny<any, "optional", string>;
+  }, "required", "name" | "extend" | `extend.${string}` | "revoked" | "clientId" | "scopes" | "tokenEndpointAuthMethod" | "clientSecretHash" | "redirectUris" | "grantTypes" | "registrationAccessTokenHash" | "createdBy" | "revokedAt">, {
+    client_id: ["clientId", "_creationTime"];
+    created_by: ["createdBy", "_creationTime"];
+    created_by_revoked: ["createdBy", "revoked", "_creationTime"];
+    revoked: ["revoked", "_creationTime"];
+    revoked_at: ["revoked", "revokedAt", "_creationTime"];
+  }, {}, {}>;
+  OAuthCode: convex_server32.TableDefinition<convex_values1839.VObject<{
+    resource?: string | undefined;
+    usedAt?: number | undefined;
+    userId: convex_values1839.GenericId<"User">;
+    expiresAt: number;
+    clientId: string;
+    scopes: string[];
+    redirectUri: string;
+    codeHash: string;
+    codeChallenge: string;
+  }, {
+    codeHash: convex_values1839.VString<string, "required">;
+    userId: convex_values1839.VId<convex_values1839.GenericId<"User">, "required">;
+    clientId: convex_values1839.VString<string, "required">;
+    redirectUri: convex_values1839.VString<string, "required">;
+    scopes: convex_values1839.VArray<string[], convex_values1839.VString<string, "required">, "required">;
+    codeChallenge: convex_values1839.VString<string, "required">;
+    resource: convex_values1839.VString<string | undefined, "optional">;
+    expiresAt: convex_values1839.VFloat64<number, "required">;
+    usedAt: convex_values1839.VFloat64<number | undefined, "optional">;
+  }, "required", "userId" | "expiresAt" | "clientId" | "scopes" | "redirectUri" | "resource" | "codeHash" | "codeChallenge" | "usedAt">, {
+    code_hash: ["codeHash", "_creationTime"];
+    user_id: ["userId", "_creationTime"];
+    expires_at: ["expiresAt", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Root record for a refresh-token rotation chain (one per code exchange).
+   * Carries the identity/authorization shared by every token in the chain;
+   * setting `revokedAt` kills the whole chain in O(1) (reuse-detection / sign-out)
+   * — token lookups reject a revoked or missing grant before the bounded,
+   * scheduled token-row cleanup runs. Mirrors `Session` for OAuth refresh.
+   */
+  OAuthRefreshGrant: convex_server32.TableDefinition<convex_values1839.VObject<{
+    resource?: string | undefined;
+    revokedAt?: number | undefined;
+    userId: convex_values1839.GenericId<"User">;
+    expiresAt: number;
+    clientId: string;
+    scopes: string[];
+  }, {
+    clientId: convex_values1839.VString<string, "required">;
+    userId: convex_values1839.VId<convex_values1839.GenericId<"User">, "required">;
+    scopes: convex_values1839.VArray<string[], convex_values1839.VString<string, "required">, "required">;
+    resource: convex_values1839.VString<string | undefined, "optional">;
+    expiresAt: convex_values1839.VFloat64<number, "required">;
+    revokedAt: convex_values1839.VFloat64<number | undefined, "optional">;
+  }, "required", "userId" | "expiresAt" | "clientId" | "scopes" | "resource" | "revokedAt">, {
+    expires_at: ["expiresAt", "_creationTime"];
+    revoked_at: ["revokedAt", "_creationTime"];
+  }, {}, {}>;
+  OAuthRefreshToken: convex_server32.TableDefinition<convex_values1839.VObject<{
+    firstUsedTime?: number | undefined;
+    grantId?: convex_values1839.GenericId<"OAuthRefreshGrant"> | undefined;
+    parentTokenId?: convex_values1839.GenericId<"OAuthRefreshToken"> | undefined;
+    expiresAt: number;
+    tokenHash: string;
+  }, {
+    tokenHash: convex_values1839.VString<string, "required">;
+    grantId: convex_values1839.VId<convex_values1839.GenericId<"OAuthRefreshGrant"> | undefined, "optional">;
+    expiresAt: convex_values1839.VFloat64<number, "required">;
+    firstUsedTime: convex_values1839.VFloat64<number | undefined, "optional">;
+    parentTokenId: convex_values1839.VId<convex_values1839.GenericId<"OAuthRefreshToken"> | undefined, "optional">;
+  }, "required", "firstUsedTime" | "expiresAt" | "tokenHash" | "grantId" | "parentTokenId">, {
+    token_hash: ["tokenHash", "_creationTime"];
+    grant_id: ["grantId", "_creationTime"];
+    grant_id_first_used: ["grantId", "firstUsedTime", "_creationTime"];
+    grant_id_parent_token_id_first_used: ["grantId", "parentTokenId", "firstUsedTime", "_creationTime"];
+    expires_at: ["expiresAt", "_creationTime"];
+  }, {}, {}>;
+}, true>;
+//#endregion
+export { _default };
+//# sourceMappingURL=schema.d.ts.map