@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/server/validators.d.ts

@@ -0,0 +1,2061 @@
+import * as convex_values5 from "convex/values";
+import { GenericId, Infer, VId, Validator, v } from "convex/values";
+import * as convex_server26 from "convex/server";
+
+//#region src/server/validators.d.ts
+/**
+ * Validators a consumer may supply for the `extend` field of each table.
+ *
+ * Passed as `defineAuth({ extend })`. Every entry is optional; a missing
+ * entry falls back to `v.any()`, preserving the untyped default.
+ */
+type AuthExtendValidators = {
+  /** Shape of `User.extend`. */User?: Validator<any, any, any>; /** Shape of `Group.extend`. */
+  Group?: Validator<any, any, any>; /** Shape of `GroupMember.extend`. */
+  GroupMember?: Validator<any, any, any>;
+};
+type ExtendFor<TExtend extends AuthExtendValidators, K extends keyof AuthExtendValidators> = TExtend[K] extends Validator<any, any, any> ? TExtend[K] : ReturnType<typeof v.any>;
+/**
+ * Build the `auth.v.*` validator namespace from the consumer's `extend`
+ * config. Each doc validator's `extend` field is rebuilt with the
+ * supplied validator so the inferred type carries the real shape.
+ *
+ * @typeParam TExtend - The consumer's per-table `extend` validators.
+ * @param extend - The `extend` map from `defineAuth` config. Defaults to
+ *   an empty object (all `extend` fields stay `v.any()`).
+ * @returns The `auth.v` namespace: `user`, `group`, `member`, `invite`,
+ *   `viewer`, `viewerWithGroups`, and the `list` page-wrapper helper.
+ *
+ * @example
+ * ```ts
+ * const av = createAuthValidators({
+ *   User: v.object({ stripeCustomerId: v.optional(v.string()) }),
+ * });
+ * // Infer<typeof av.viewer> -> User document with typed `extend`
+ * ```
+ */
+declare function createAuthValidators<TExtend extends AuthExtendValidators>(extend?: TExtend): {
+  /** Single User document validator (extend-aware). */user: convex_values5.VObject<convex_server26.Expand<{ [Property in "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)]?: Exclude<Infer<(Omit<{
+    _id: VId<GenericId<"User">, "required">;
+    _creationTime: convex_values5.VFloat64<number, "required">;
+    name: convex_values5.VString<string | undefined, "optional">;
+    firstName: convex_values5.VString<string | undefined, "optional">;
+    lastName: convex_values5.VString<string | undefined, "optional">;
+    image: convex_values5.VString<string | undefined, "optional">;
+    email: convex_values5.VString<string | undefined, "optional">;
+    emailVerificationTime: convex_values5.VFloat64<number | undefined, "optional">;
+    phone: convex_values5.VString<string | undefined, "optional">;
+    phoneVerificationTime: convex_values5.VFloat64<number | undefined, "optional">;
+    isAnonymous: convex_values5.VBoolean<boolean | undefined, "optional">;
+    lastActiveGroup: VId<GenericId<"Group"> | undefined, "optional">;
+    hasTotp: convex_values5.VBoolean<boolean | undefined, "optional">;
+    extend: convex_values5.VAny<any, "optional", string>;
+  }, "extend"> & {
+    extend: convex_values5.VOptional<ExtendFor<TExtend, "User">>;
+  })[Property]>, undefined> | undefined } & { [Property_1 in Exclude<"_creationTime", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"name", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"email", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"phone", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"firstName", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"lastName", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"image", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"emailVerificationTime", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"phoneVerificationTime", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"isAnonymous", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"lastActiveGroup", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"hasTotp", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"extend", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"_id", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)>]: Infer<(Omit<{
+    _id: VId<GenericId<"User">, "required">;
+    _creationTime: convex_values5.VFloat64<number, "required">;
+    name: convex_values5.VString<string | undefined, "optional">;
+    firstName: convex_values5.VString<string | undefined, "optional">;
+    lastName: convex_values5.VString<string | undefined, "optional">;
+    image: convex_values5.VString<string | undefined, "optional">;
+    email: convex_values5.VString<string | undefined, "optional">;
+    emailVerificationTime: convex_values5.VFloat64<number | undefined, "optional">;
+    phone: convex_values5.VString<string | undefined, "optional">;
+    phoneVerificationTime: convex_values5.VFloat64<number | undefined, "optional">;
+    isAnonymous: convex_values5.VBoolean<boolean | undefined, "optional">;
+    lastActiveGroup: VId<GenericId<"Group"> | undefined, "optional">;
+    hasTotp: convex_values5.VBoolean<boolean | undefined, "optional">;
+    extend: convex_values5.VAny<any, "optional", string>;
+  }, "extend"> & {
+    extend: convex_values5.VOptional<ExtendFor<TExtend, "User">>;
+  })[Property_1]> }>, Omit<{
+    _id: VId<GenericId<"User">, "required">;
+    _creationTime: convex_values5.VFloat64<number, "required">;
+    name: convex_values5.VString<string | undefined, "optional">;
+    firstName: convex_values5.VString<string | undefined, "optional">;
+    lastName: convex_values5.VString<string | undefined, "optional">;
+    image: convex_values5.VString<string | undefined, "optional">;
+    email: convex_values5.VString<string | undefined, "optional">;
+    emailVerificationTime: convex_values5.VFloat64<number | undefined, "optional">;
+    phone: convex_values5.VString<string | undefined, "optional">;
+    phoneVerificationTime: convex_values5.VFloat64<number | undefined, "optional">;
+    isAnonymous: convex_values5.VBoolean<boolean | undefined, "optional">;
+    lastActiveGroup: VId<GenericId<"Group"> | undefined, "optional">;
+    hasTotp: convex_values5.VBoolean<boolean | undefined, "optional">;
+    extend: convex_values5.VAny<any, "optional", string>;
+  }, "extend"> & {
+    extend: convex_values5.VOptional<ExtendFor<TExtend, "User">>;
+  }, "required", "_creationTime" | "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | "extend" | "_id" | `extend.${convex_values5.VOptional<ExtendFor<TExtend, "User">>["fieldPaths"]}`>; /** Single Group document validator (extend-aware). */
+  group: convex_values5.VObject<convex_server26.Expand<{ [Property_2 in "type" | "slug" | "parentGroupId" | "rootGroupId" | "isRoot" | "policy" | (convex_values5.VOptional<ExtendFor<TExtend, "Group">>["isOptional"] extends "optional" ? "extend" : never)]?: Exclude<Infer<(Omit<{
+    _id: VId<GenericId<"Group">, "required">;
+    _creationTime: convex_values5.VFloat64<number, "required">;
+    name: convex_values5.VString<string, "required">;
+    slug: convex_values5.VString<string | undefined, "optional">;
+    type: convex_values5.VString<string | undefined, "optional">;
+    parentGroupId: VId<GenericId<"Group"> | undefined, "optional">;
+    rootGroupId: VId<GenericId<"Group"> | undefined, "optional">;
+    isRoot: convex_values5.VBoolean<boolean | undefined, "optional">;
+    policy: convex_values5.VObject<{
+      extend?: any;
+      version: 1;
+      identity: {
+        accountLinking: {
+          oidc: "verifiedEmail" | "none" | "sameConnection";
+          saml: "verifiedEmail" | "none" | "sameConnection";
+        };
+      };
+      provisioning: {
+        user: {
+          createOnSignIn: boolean;
+          updateProfileOnLogin: "never" | "missing" | "always";
+          updateProfileFromScim: "never" | "missing" | "always";
+          authority: "scim" | "app" | "connection";
+        };
+        scimReuse: {
+          user: "none" | "externalId";
+        };
+        jit: {
+          defaultRole?: string | undefined;
+          defaultRoleIds?: string[] | undefined;
+          mode: "off" | "createUser" | "createUserAndMembership";
+        };
+        deprovision: {
+          mode: "soft" | "hard";
+        };
+        groups: {
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "ignore" | "sync";
+        };
+        roles: {
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "map" | "ignore";
+        };
+      };
+    } | undefined, {
+      version: convex_values5.VLiteral<1, "required">;
+      identity: convex_values5.VObject<{
+        accountLinking: {
+          oidc: "verifiedEmail" | "none" | "sameConnection";
+          saml: "verifiedEmail" | "none" | "sameConnection";
+        };
+      }, {
+        accountLinking: convex_values5.VObject<{
+          oidc: "verifiedEmail" | "none" | "sameConnection";
+          saml: "verifiedEmail" | "none" | "sameConnection";
+        }, {
+          oidc: convex_values5.VUnion<"verifiedEmail" | "none" | "sameConnection", [convex_values5.VLiteral<"verifiedEmail", "required">, convex_values5.VLiteral<"none", "required">, convex_values5.VLiteral<"sameConnection", "required">], "required", never>;
+          saml: convex_values5.VUnion<"verifiedEmail" | "none" | "sameConnection", [convex_values5.VLiteral<"verifiedEmail", "required">, convex_values5.VLiteral<"none", "required">, convex_values5.VLiteral<"sameConnection", "required">], "required", never>;
+        }, "required", "oidc" | "saml">;
+      }, "required", "accountLinking" | "accountLinking.oidc" | "accountLinking.saml">;
+      provisioning: convex_values5.VObject<{
+        user: {
+          createOnSignIn: boolean;
+          updateProfileOnLogin: "never" | "missing" | "always";
+          updateProfileFromScim: "never" | "missing" | "always";
+          authority: "scim" | "app" | "connection";
+        };
+        scimReuse: {
+          user: "none" | "externalId";
+        };
+        jit: {
+          defaultRole?: string | undefined;
+          defaultRoleIds?: string[] | undefined;
+          mode: "off" | "createUser" | "createUserAndMembership";
+        };
+        deprovision: {
+          mode: "soft" | "hard";
+        };
+        groups: {
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "ignore" | "sync";
+        };
+        roles: {
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "map" | "ignore";
+        };
+      }, {
+        user: convex_values5.VObject<{
+          createOnSignIn: boolean;
+          updateProfileOnLogin: "never" | "missing" | "always";
+          updateProfileFromScim: "never" | "missing" | "always";
+          authority: "scim" | "app" | "connection";
+        }, {
+          createOnSignIn: convex_values5.VBoolean<boolean, "required">;
+          updateProfileOnLogin: convex_values5.VUnion<"never" | "missing" | "always", [convex_values5.VLiteral<"never", "required">, convex_values5.VLiteral<"missing", "required">, convex_values5.VLiteral<"always", "required">], "required", never>;
+          updateProfileFromScim: convex_values5.VUnion<"never" | "missing" | "always", [convex_values5.VLiteral<"never", "required">, convex_values5.VLiteral<"missing", "required">, convex_values5.VLiteral<"always", "required">], "required", never>;
+          authority: convex_values5.VUnion<"scim" | "app" | "connection", [convex_values5.VLiteral<"app", "required">, convex_values5.VLiteral<"connection", "required">, convex_values5.VLiteral<"scim", "required">], "required", never>;
+        }, "required", "createOnSignIn" | "updateProfileOnLogin" | "updateProfileFromScim" | "authority">;
+        scimReuse: convex_values5.VObject<{
+          user: "none" | "externalId";
+        }, {
+          user: convex_values5.VUnion<"none" | "externalId", [convex_values5.VLiteral<"externalId", "required">, convex_values5.VLiteral<"none", "required">], "required", never>;
+        }, "required", "user">;
+        jit: convex_values5.VObject<{
+          defaultRole?: string | undefined;
+          defaultRoleIds?: string[] | undefined;
+          mode: "off" | "createUser" | "createUserAndMembership";
+        }, {
+          mode: convex_values5.VUnion<"off" | "createUser" | "createUserAndMembership", [convex_values5.VLiteral<"off", "required">, convex_values5.VLiteral<"createUser", "required">, convex_values5.VLiteral<"createUserAndMembership", "required">], "required", never>;
+          defaultRole: convex_values5.VString<string | undefined, "optional">;
+          defaultRoleIds: convex_values5.VArray<string[] | undefined, convex_values5.VString<string, "required">, "optional">;
+        }, "required", "mode" | "defaultRole" | "defaultRoleIds">;
+        deprovision: convex_values5.VObject<{
+          mode: "soft" | "hard";
+        }, {
+          mode: convex_values5.VUnion<"soft" | "hard", [convex_values5.VLiteral<"soft", "required">, convex_values5.VLiteral<"hard", "required">], "required", never>;
+        }, "required", "mode">;
+        groups: convex_values5.VObject<{
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "ignore" | "sync";
+        }, {
+          mode: convex_values5.VUnion<"ignore" | "sync", [convex_values5.VLiteral<"ignore", "required">, convex_values5.VLiteral<"sync", "required">], "required", never>;
+          source: convex_values5.VLiteral<"protocol", "required">;
+          mapping: convex_values5.VRecord<Record<string, string[]> | undefined, convex_values5.VString<string, "required">, convex_values5.VArray<string[], convex_values5.VString<string, "required">, "required">, "optional", string>;
+        }, "required", "source" | "mode" | "mapping" | `mapping.${string}`>;
+        roles: convex_values5.VObject<{
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "map" | "ignore";
+        }, {
+          mode: convex_values5.VUnion<"map" | "ignore", [convex_values5.VLiteral<"ignore", "required">, convex_values5.VLiteral<"map", "required">], "required", never>;
+          source: convex_values5.VLiteral<"protocol", "required">;
+          mapping: convex_values5.VRecord<Record<string, string[]> | undefined, convex_values5.VString<string, "required">, convex_values5.VArray<string[], convex_values5.VString<string, "required">, "required">, "optional", string>;
+        }, "required", "source" | "mode" | "mapping" | `mapping.${string}`>;
+      }, "required", "user" | "scimReuse" | "jit" | "deprovision" | "groups" | "roles" | "user.createOnSignIn" | "user.updateProfileOnLogin" | "user.updateProfileFromScim" | "user.authority" | "scimReuse.user" | "jit.mode" | "jit.defaultRole" | "jit.defaultRoleIds" | "deprovision.mode" | "groups.source" | "groups.mode" | "groups.mapping" | `groups.mapping.${string}` | "roles.source" | "roles.mode" | "roles.mapping" | `roles.mapping.${string}`>;
+      extend: convex_values5.VAny<any, "optional", string>;
+    }, "optional", "extend" | `extend.${string}` | "version" | "identity" | "provisioning" | "identity.accountLinking" | "identity.accountLinking.oidc" | "identity.accountLinking.saml" | "provisioning.user" | "provisioning.scimReuse" | "provisioning.jit" | "provisioning.deprovision" | "provisioning.groups" | "provisioning.roles" | "provisioning.user.createOnSignIn" | "provisioning.user.updateProfileOnLogin" | "provisioning.user.updateProfileFromScim" | "provisioning.user.authority" | "provisioning.scimReuse.user" | "provisioning.jit.mode" | "provisioning.jit.defaultRole" | "provisioning.jit.defaultRoleIds" | "provisioning.deprovision.mode" | "provisioning.groups.source" | "provisioning.groups.mode" | "provisioning.groups.mapping" | `provisioning.groups.mapping.${string}` | "provisioning.roles.source" | "provisioning.roles.mode" | "provisioning.roles.mapping" | `provisioning.roles.mapping.${string}`>;
+    extend: convex_values5.VAny<any, "optional", string>;
+  }, "extend"> & {
+    extend: convex_values5.VOptional<ExtendFor<TExtend, "Group">>;
+  })[Property_2]>, undefined> | undefined } & { [Property_1_1 in Exclude<"_creationTime", "type" | "slug" | "parentGroupId" | "rootGroupId" | "isRoot" | "policy" | (convex_values5.VOptional<ExtendFor<TExtend, "Group">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"name", "type" | "slug" | "parentGroupId" | "rootGroupId" | "isRoot" | "policy" | (convex_values5.VOptional<ExtendFor<TExtend, "Group">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"extend", "type" | "slug" | "parentGroupId" | "rootGroupId" | "isRoot" | "policy" | (convex_values5.VOptional<ExtendFor<TExtend, "Group">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"type", "type" | "slug" | "parentGroupId" | "rootGroupId" | "isRoot" | "policy" | (convex_values5.VOptional<ExtendFor<TExtend, "Group">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"slug", "type" | "slug" | "parentGroupId" | "rootGroupId" | "isRoot" | "policy" | (convex_values5.VOptional<ExtendFor<TExtend, "Group">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"parentGroupId", "type" | "slug" | "parentGroupId" | "rootGroupId" | "isRoot" | "policy" | (convex_values5.VOptional<ExtendFor<TExtend, "Group">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"rootGroupId", "type" | "slug" | "parentGroupId" | "rootGroupId" | "isRoot" | "policy" | (convex_values5.VOptional<ExtendFor<TExtend, "Group">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"isRoot", "type" | "slug" | "parentGroupId" | "rootGroupId" | "isRoot" | "policy" | (convex_values5.VOptional<ExtendFor<TExtend, "Group">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"policy", "type" | "slug" | "parentGroupId" | "rootGroupId" | "isRoot" | "policy" | (convex_values5.VOptional<ExtendFor<TExtend, "Group">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"_id", "type" | "slug" | "parentGroupId" | "rootGroupId" | "isRoot" | "policy" | (convex_values5.VOptional<ExtendFor<TExtend, "Group">>["isOptional"] extends "optional" ? "extend" : never)>]: Infer<(Omit<{
+    _id: VId<GenericId<"Group">, "required">;
+    _creationTime: convex_values5.VFloat64<number, "required">;
+    name: convex_values5.VString<string, "required">;
+    slug: convex_values5.VString<string | undefined, "optional">;
+    type: convex_values5.VString<string | undefined, "optional">;
+    parentGroupId: VId<GenericId<"Group"> | undefined, "optional">;
+    rootGroupId: VId<GenericId<"Group"> | undefined, "optional">;
+    isRoot: convex_values5.VBoolean<boolean | undefined, "optional">;
+    policy: convex_values5.VObject<{
+      extend?: any;
+      version: 1;
+      identity: {
+        accountLinking: {
+          oidc: "verifiedEmail" | "none" | "sameConnection";
+          saml: "verifiedEmail" | "none" | "sameConnection";
+        };
+      };
+      provisioning: {
+        user: {
+          createOnSignIn: boolean;
+          updateProfileOnLogin: "never" | "missing" | "always";
+          updateProfileFromScim: "never" | "missing" | "always";
+          authority: "scim" | "app" | "connection";
+        };
+        scimReuse: {
+          user: "none" | "externalId";
+        };
+        jit: {
+          defaultRole?: string | undefined;
+          defaultRoleIds?: string[] | undefined;
+          mode: "off" | "createUser" | "createUserAndMembership";
+        };
+        deprovision: {
+          mode: "soft" | "hard";
+        };
+        groups: {
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "ignore" | "sync";
+        };
+        roles: {
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "map" | "ignore";
+        };
+      };
+    } | undefined, {
+      version: convex_values5.VLiteral<1, "required">;
+      identity: convex_values5.VObject<{
+        accountLinking: {
+          oidc: "verifiedEmail" | "none" | "sameConnection";
+          saml: "verifiedEmail" | "none" | "sameConnection";
+        };
+      }, {
+        accountLinking: convex_values5.VObject<{
+          oidc: "verifiedEmail" | "none" | "sameConnection";
+          saml: "verifiedEmail" | "none" | "sameConnection";
+        }, {
+          oidc: convex_values5.VUnion<"verifiedEmail" | "none" | "sameConnection", [convex_values5.VLiteral<"verifiedEmail", "required">, convex_values5.VLiteral<"none", "required">, convex_values5.VLiteral<"sameConnection", "required">], "required", never>;
+          saml: convex_values5.VUnion<"verifiedEmail" | "none" | "sameConnection", [convex_values5.VLiteral<"verifiedEmail", "required">, convex_values5.VLiteral<"none", "required">, convex_values5.VLiteral<"sameConnection", "required">], "required", never>;
+        }, "required", "oidc" | "saml">;
+      }, "required", "accountLinking" | "accountLinking.oidc" | "accountLinking.saml">;
+      provisioning: convex_values5.VObject<{
+        user: {
+          createOnSignIn: boolean;
+          updateProfileOnLogin: "never" | "missing" | "always";
+          updateProfileFromScim: "never" | "missing" | "always";
+          authority: "scim" | "app" | "connection";
+        };
+        scimReuse: {
+          user: "none" | "externalId";
+        };
+        jit: {
+          defaultRole?: string | undefined;
+          defaultRoleIds?: string[] | undefined;
+          mode: "off" | "createUser" | "createUserAndMembership";
+        };
+        deprovision: {
+          mode: "soft" | "hard";
+        };
+        groups: {
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "ignore" | "sync";
+        };
+        roles: {
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "map" | "ignore";
+        };
+      }, {
+        user: convex_values5.VObject<{
+          createOnSignIn: boolean;
+          updateProfileOnLogin: "never" | "missing" | "always";
+          updateProfileFromScim: "never" | "missing" | "always";
+          authority: "scim" | "app" | "connection";
+        }, {
+          createOnSignIn: convex_values5.VBoolean<boolean, "required">;
+          updateProfileOnLogin: convex_values5.VUnion<"never" | "missing" | "always", [convex_values5.VLiteral<"never", "required">, convex_values5.VLiteral<"missing", "required">, convex_values5.VLiteral<"always", "required">], "required", never>;
+          updateProfileFromScim: convex_values5.VUnion<"never" | "missing" | "always", [convex_values5.VLiteral<"never", "required">, convex_values5.VLiteral<"missing", "required">, convex_values5.VLiteral<"always", "required">], "required", never>;
+          authority: convex_values5.VUnion<"scim" | "app" | "connection", [convex_values5.VLiteral<"app", "required">, convex_values5.VLiteral<"connection", "required">, convex_values5.VLiteral<"scim", "required">], "required", never>;
+        }, "required", "createOnSignIn" | "updateProfileOnLogin" | "updateProfileFromScim" | "authority">;
+        scimReuse: convex_values5.VObject<{
+          user: "none" | "externalId";
+        }, {
+          user: convex_values5.VUnion<"none" | "externalId", [convex_values5.VLiteral<"externalId", "required">, convex_values5.VLiteral<"none", "required">], "required", never>;
+        }, "required", "user">;
+        jit: convex_values5.VObject<{
+          defaultRole?: string | undefined;
+          defaultRoleIds?: string[] | undefined;
+          mode: "off" | "createUser" | "createUserAndMembership";
+        }, {
+          mode: convex_values5.VUnion<"off" | "createUser" | "createUserAndMembership", [convex_values5.VLiteral<"off", "required">, convex_values5.VLiteral<"createUser", "required">, convex_values5.VLiteral<"createUserAndMembership", "required">], "required", never>;
+          defaultRole: convex_values5.VString<string | undefined, "optional">;
+          defaultRoleIds: convex_values5.VArray<string[] | undefined, convex_values5.VString<string, "required">, "optional">;
+        }, "required", "mode" | "defaultRole" | "defaultRoleIds">;
+        deprovision: convex_values5.VObject<{
+          mode: "soft" | "hard";
+        }, {
+          mode: convex_values5.VUnion<"soft" | "hard", [convex_values5.VLiteral<"soft", "required">, convex_values5.VLiteral<"hard", "required">], "required", never>;
+        }, "required", "mode">;
+        groups: convex_values5.VObject<{
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "ignore" | "sync";
+        }, {
+          mode: convex_values5.VUnion<"ignore" | "sync", [convex_values5.VLiteral<"ignore", "required">, convex_values5.VLiteral<"sync", "required">], "required", never>;
+          source: convex_values5.VLiteral<"protocol", "required">;
+          mapping: convex_values5.VRecord<Record<string, string[]> | undefined, convex_values5.VString<string, "required">, convex_values5.VArray<string[], convex_values5.VString<string, "required">, "required">, "optional", string>;
+        }, "required", "source" | "mode" | "mapping" | `mapping.${string}`>;
+        roles: convex_values5.VObject<{
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "map" | "ignore";
+        }, {
+          mode: convex_values5.VUnion<"map" | "ignore", [convex_values5.VLiteral<"ignore", "required">, convex_values5.VLiteral<"map", "required">], "required", never>;
+          source: convex_values5.VLiteral<"protocol", "required">;
+          mapping: convex_values5.VRecord<Record<string, string[]> | undefined, convex_values5.VString<string, "required">, convex_values5.VArray<string[], convex_values5.VString<string, "required">, "required">, "optional", string>;
+        }, "required", "source" | "mode" | "mapping" | `mapping.${string}`>;
+      }, "required", "user" | "scimReuse" | "jit" | "deprovision" | "groups" | "roles" | "user.createOnSignIn" | "user.updateProfileOnLogin" | "user.updateProfileFromScim" | "user.authority" | "scimReuse.user" | "jit.mode" | "jit.defaultRole" | "jit.defaultRoleIds" | "deprovision.mode" | "groups.source" | "groups.mode" | "groups.mapping" | `groups.mapping.${string}` | "roles.source" | "roles.mode" | "roles.mapping" | `roles.mapping.${string}`>;
+      extend: convex_values5.VAny<any, "optional", string>;
+    }, "optional", "extend" | `extend.${string}` | "version" | "identity" | "provisioning" | "identity.accountLinking" | "identity.accountLinking.oidc" | "identity.accountLinking.saml" | "provisioning.user" | "provisioning.scimReuse" | "provisioning.jit" | "provisioning.deprovision" | "provisioning.groups" | "provisioning.roles" | "provisioning.user.createOnSignIn" | "provisioning.user.updateProfileOnLogin" | "provisioning.user.updateProfileFromScim" | "provisioning.user.authority" | "provisioning.scimReuse.user" | "provisioning.jit.mode" | "provisioning.jit.defaultRole" | "provisioning.jit.defaultRoleIds" | "provisioning.deprovision.mode" | "provisioning.groups.source" | "provisioning.groups.mode" | "provisioning.groups.mapping" | `provisioning.groups.mapping.${string}` | "provisioning.roles.source" | "provisioning.roles.mode" | "provisioning.roles.mapping" | `provisioning.roles.mapping.${string}`>;
+    extend: convex_values5.VAny<any, "optional", string>;
+  }, "extend"> & {
+    extend: convex_values5.VOptional<ExtendFor<TExtend, "Group">>;
+  })[Property_1_1]> }>, Omit<{
+    _id: VId<GenericId<"Group">, "required">;
+    _creationTime: convex_values5.VFloat64<number, "required">;
+    name: convex_values5.VString<string, "required">;
+    slug: convex_values5.VString<string | undefined, "optional">;
+    type: convex_values5.VString<string | undefined, "optional">;
+    parentGroupId: VId<GenericId<"Group"> | undefined, "optional">;
+    rootGroupId: VId<GenericId<"Group"> | undefined, "optional">;
+    isRoot: convex_values5.VBoolean<boolean | undefined, "optional">;
+    policy: convex_values5.VObject<{
+      extend?: any;
+      version: 1;
+      identity: {
+        accountLinking: {
+          oidc: "verifiedEmail" | "none" | "sameConnection";
+          saml: "verifiedEmail" | "none" | "sameConnection";
+        };
+      };
+      provisioning: {
+        user: {
+          createOnSignIn: boolean;
+          updateProfileOnLogin: "never" | "missing" | "always";
+          updateProfileFromScim: "never" | "missing" | "always";
+          authority: "scim" | "app" | "connection";
+        };
+        scimReuse: {
+          user: "none" | "externalId";
+        };
+        jit: {
+          defaultRole?: string | undefined;
+          defaultRoleIds?: string[] | undefined;
+          mode: "off" | "createUser" | "createUserAndMembership";
+        };
+        deprovision: {
+          mode: "soft" | "hard";
+        };
+        groups: {
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "ignore" | "sync";
+        };
+        roles: {
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "map" | "ignore";
+        };
+      };
+    } | undefined, {
+      version: convex_values5.VLiteral<1, "required">;
+      identity: convex_values5.VObject<{
+        accountLinking: {
+          oidc: "verifiedEmail" | "none" | "sameConnection";
+          saml: "verifiedEmail" | "none" | "sameConnection";
+        };
+      }, {
+        accountLinking: convex_values5.VObject<{
+          oidc: "verifiedEmail" | "none" | "sameConnection";
+          saml: "verifiedEmail" | "none" | "sameConnection";
+        }, {
+          oidc: convex_values5.VUnion<"verifiedEmail" | "none" | "sameConnection", [convex_values5.VLiteral<"verifiedEmail", "required">, convex_values5.VLiteral<"none", "required">, convex_values5.VLiteral<"sameConnection", "required">], "required", never>;
+          saml: convex_values5.VUnion<"verifiedEmail" | "none" | "sameConnection", [convex_values5.VLiteral<"verifiedEmail", "required">, convex_values5.VLiteral<"none", "required">, convex_values5.VLiteral<"sameConnection", "required">], "required", never>;
+        }, "required", "oidc" | "saml">;
+      }, "required", "accountLinking" | "accountLinking.oidc" | "accountLinking.saml">;
+      provisioning: convex_values5.VObject<{
+        user: {
+          createOnSignIn: boolean;
+          updateProfileOnLogin: "never" | "missing" | "always";
+          updateProfileFromScim: "never" | "missing" | "always";
+          authority: "scim" | "app" | "connection";
+        };
+        scimReuse: {
+          user: "none" | "externalId";
+        };
+        jit: {
+          defaultRole?: string | undefined;
+          defaultRoleIds?: string[] | undefined;
+          mode: "off" | "createUser" | "createUserAndMembership";
+        };
+        deprovision: {
+          mode: "soft" | "hard";
+        };
+        groups: {
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "ignore" | "sync";
+        };
+        roles: {
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "map" | "ignore";
+        };
+      }, {
+        user: convex_values5.VObject<{
+          createOnSignIn: boolean;
+          updateProfileOnLogin: "never" | "missing" | "always";
+          updateProfileFromScim: "never" | "missing" | "always";
+          authority: "scim" | "app" | "connection";
+        }, {
+          createOnSignIn: convex_values5.VBoolean<boolean, "required">;
+          updateProfileOnLogin: convex_values5.VUnion<"never" | "missing" | "always", [convex_values5.VLiteral<"never", "required">, convex_values5.VLiteral<"missing", "required">, convex_values5.VLiteral<"always", "required">], "required", never>;
+          updateProfileFromScim: convex_values5.VUnion<"never" | "missing" | "always", [convex_values5.VLiteral<"never", "required">, convex_values5.VLiteral<"missing", "required">, convex_values5.VLiteral<"always", "required">], "required", never>;
+          authority: convex_values5.VUnion<"scim" | "app" | "connection", [convex_values5.VLiteral<"app", "required">, convex_values5.VLiteral<"connection", "required">, convex_values5.VLiteral<"scim", "required">], "required", never>;
+        }, "required", "createOnSignIn" | "updateProfileOnLogin" | "updateProfileFromScim" | "authority">;
+        scimReuse: convex_values5.VObject<{
+          user: "none" | "externalId";
+        }, {
+          user: convex_values5.VUnion<"none" | "externalId", [convex_values5.VLiteral<"externalId", "required">, convex_values5.VLiteral<"none", "required">], "required", never>;
+        }, "required", "user">;
+        jit: convex_values5.VObject<{
+          defaultRole?: string | undefined;
+          defaultRoleIds?: string[] | undefined;
+          mode: "off" | "createUser" | "createUserAndMembership";
+        }, {
+          mode: convex_values5.VUnion<"off" | "createUser" | "createUserAndMembership", [convex_values5.VLiteral<"off", "required">, convex_values5.VLiteral<"createUser", "required">, convex_values5.VLiteral<"createUserAndMembership", "required">], "required", never>;
+          defaultRole: convex_values5.VString<string | undefined, "optional">;
+          defaultRoleIds: convex_values5.VArray<string[] | undefined, convex_values5.VString<string, "required">, "optional">;
+        }, "required", "mode" | "defaultRole" | "defaultRoleIds">;
+        deprovision: convex_values5.VObject<{
+          mode: "soft" | "hard";
+        }, {
+          mode: convex_values5.VUnion<"soft" | "hard", [convex_values5.VLiteral<"soft", "required">, convex_values5.VLiteral<"hard", "required">], "required", never>;
+        }, "required", "mode">;
+        groups: convex_values5.VObject<{
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "ignore" | "sync";
+        }, {
+          mode: convex_values5.VUnion<"ignore" | "sync", [convex_values5.VLiteral<"ignore", "required">, convex_values5.VLiteral<"sync", "required">], "required", never>;
+          source: convex_values5.VLiteral<"protocol", "required">;
+          mapping: convex_values5.VRecord<Record<string, string[]> | undefined, convex_values5.VString<string, "required">, convex_values5.VArray<string[], convex_values5.VString<string, "required">, "required">, "optional", string>;
+        }, "required", "source" | "mode" | "mapping" | `mapping.${string}`>;
+        roles: convex_values5.VObject<{
+          mapping?: Record<string, string[]> | undefined;
+          source: "protocol";
+          mode: "map" | "ignore";
+        }, {
+          mode: convex_values5.VUnion<"map" | "ignore", [convex_values5.VLiteral<"ignore", "required">, convex_values5.VLiteral<"map", "required">], "required", never>;
+          source: convex_values5.VLiteral<"protocol", "required">;
+          mapping: convex_values5.VRecord<Record<string, string[]> | undefined, convex_values5.VString<string, "required">, convex_values5.VArray<string[], convex_values5.VString<string, "required">, "required">, "optional", string>;
+        }, "required", "source" | "mode" | "mapping" | `mapping.${string}`>;
+      }, "required", "user" | "scimReuse" | "jit" | "deprovision" | "groups" | "roles" | "user.createOnSignIn" | "user.updateProfileOnLogin" | "user.updateProfileFromScim" | "user.authority" | "scimReuse.user" | "jit.mode" | "jit.defaultRole" | "jit.defaultRoleIds" | "deprovision.mode" | "groups.source" | "groups.mode" | "groups.mapping" | `groups.mapping.${string}` | "roles.source" | "roles.mode" | "roles.mapping" | `roles.mapping.${string}`>;
+      extend: convex_values5.VAny<any, "optional", string>;
+    }, "optional", "extend" | `extend.${string}` | "version" | "identity" | "provisioning" | "identity.accountLinking" | "identity.accountLinking.oidc" | "identity.accountLinking.saml" | "provisioning.user" | "provisioning.scimReuse" | "provisioning.jit" | "provisioning.deprovision" | "provisioning.groups" | "provisioning.roles" | "provisioning.user.createOnSignIn" | "provisioning.user.updateProfileOnLogin" | "provisioning.user.updateProfileFromScim" | "provisioning.user.authority" | "provisioning.scimReuse.user" | "provisioning.jit.mode" | "provisioning.jit.defaultRole" | "provisioning.jit.defaultRoleIds" | "provisioning.deprovision.mode" | "provisioning.groups.source" | "provisioning.groups.mode" | "provisioning.groups.mapping" | `provisioning.groups.mapping.${string}` | "provisioning.roles.source" | "provisioning.roles.mode" | "provisioning.roles.mapping" | `provisioning.roles.mapping.${string}`>;
+    extend: convex_values5.VAny<any, "optional", string>;
+  }, "extend"> & {
+    extend: convex_values5.VOptional<ExtendFor<TExtend, "Group">>;
+  }, "required", "_creationTime" | "name" | "extend" | "type" | "slug" | "parentGroupId" | "rootGroupId" | "isRoot" | "policy" | "policy.extend" | `policy.extend.${string}` | "policy.version" | "policy.identity" | "policy.provisioning" | "policy.identity.accountLinking" | "policy.identity.accountLinking.oidc" | "policy.identity.accountLinking.saml" | "policy.provisioning.user" | "policy.provisioning.scimReuse" | "policy.provisioning.jit" | "policy.provisioning.deprovision" | "policy.provisioning.groups" | "policy.provisioning.roles" | "policy.provisioning.user.createOnSignIn" | "policy.provisioning.user.updateProfileOnLogin" | "policy.provisioning.user.updateProfileFromScim" | "policy.provisioning.user.authority" | "policy.provisioning.scimReuse.user" | "policy.provisioning.jit.mode" | "policy.provisioning.jit.defaultRole" | "policy.provisioning.jit.defaultRoleIds" | "policy.provisioning.deprovision.mode" | "policy.provisioning.groups.source" | "policy.provisioning.groups.mode" | "policy.provisioning.groups.mapping" | `policy.provisioning.groups.mapping.${string}` | "policy.provisioning.roles.source" | "policy.provisioning.roles.mode" | "policy.provisioning.roles.mapping" | `policy.provisioning.roles.mapping.${string}` | "_id" | `extend.${convex_values5.VOptional<ExtendFor<TExtend, "Group">>["fieldPaths"]}`>; /** Single GroupMember document validator (extend-aware). */
+  member: convex_values5.VObject<convex_server26.Expand<{ [Property_3 in "status" | "role" | "roleIds" | (convex_values5.VOptional<ExtendFor<TExtend, "GroupMember">>["isOptional"] extends "optional" ? "extend" : never)]?: Exclude<Infer<(Omit<{
+    _id: VId<GenericId<"GroupMember">, "required">;
+    _creationTime: convex_values5.VFloat64<number, "required">;
+    groupId: VId<GenericId<"Group">, "required">;
+    userId: VId<GenericId<"User">, "required">;
+    role: convex_values5.VString<string | undefined, "optional">;
+    roleIds: convex_values5.VArray<string[] | undefined, convex_values5.VString<string, "required">, "optional">;
+    status: convex_values5.VString<string | undefined, "optional">;
+    extend: convex_values5.VAny<any, "optional", string>;
+  }, "extend"> & {
+    extend: convex_values5.VOptional<ExtendFor<TExtend, "GroupMember">>;
+  })[Property_3]>, undefined> | undefined } & { [Property_1_2 in Exclude<"_creationTime", "status" | "role" | "roleIds" | (convex_values5.VOptional<ExtendFor<TExtend, "GroupMember">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"extend", "status" | "role" | "roleIds" | (convex_values5.VOptional<ExtendFor<TExtend, "GroupMember">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"userId", "status" | "role" | "roleIds" | (convex_values5.VOptional<ExtendFor<TExtend, "GroupMember">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"status", "status" | "role" | "roleIds" | (convex_values5.VOptional<ExtendFor<TExtend, "GroupMember">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"groupId", "status" | "role" | "roleIds" | (convex_values5.VOptional<ExtendFor<TExtend, "GroupMember">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"role", "status" | "role" | "roleIds" | (convex_values5.VOptional<ExtendFor<TExtend, "GroupMember">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"roleIds", "status" | "role" | "roleIds" | (convex_values5.VOptional<ExtendFor<TExtend, "GroupMember">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"_id", "status" | "role" | "roleIds" | (convex_values5.VOptional<ExtendFor<TExtend, "GroupMember">>["isOptional"] extends "optional" ? "extend" : never)>]: Infer<(Omit<{
+    _id: VId<GenericId<"GroupMember">, "required">;
+    _creationTime: convex_values5.VFloat64<number, "required">;
+    groupId: VId<GenericId<"Group">, "required">;
+    userId: VId<GenericId<"User">, "required">;
+    role: convex_values5.VString<string | undefined, "optional">;
+    roleIds: convex_values5.VArray<string[] | undefined, convex_values5.VString<string, "required">, "optional">;
+    status: convex_values5.VString<string | undefined, "optional">;
+    extend: convex_values5.VAny<any, "optional", string>;
+  }, "extend"> & {
+    extend: convex_values5.VOptional<ExtendFor<TExtend, "GroupMember">>;
+  })[Property_1_2]> }>, Omit<{
+    _id: VId<GenericId<"GroupMember">, "required">;
+    _creationTime: convex_values5.VFloat64<number, "required">;
+    groupId: VId<GenericId<"Group">, "required">;
+    userId: VId<GenericId<"User">, "required">;
+    role: convex_values5.VString<string | undefined, "optional">;
+    roleIds: convex_values5.VArray<string[] | undefined, convex_values5.VString<string, "required">, "optional">;
+    status: convex_values5.VString<string | undefined, "optional">;
+    extend: convex_values5.VAny<any, "optional", string>;
+  }, "extend"> & {
+    extend: convex_values5.VOptional<ExtendFor<TExtend, "GroupMember">>;
+  }, "required", "_creationTime" | "extend" | "userId" | "status" | "groupId" | "role" | "roleIds" | "_id" | `extend.${convex_values5.VOptional<ExtendFor<TExtend, "GroupMember">>["fieldPaths"]}`>; /** Single GroupInvite document validator. */
+  invite: convex_values5.VObject<{
+    email?: string | undefined;
+    extend?: any;
+    groupId?: GenericId<"Group"> | undefined;
+    role?: string | undefined;
+    roleIds?: string[] | undefined;
+    invitedByUserId?: GenericId<"User"> | undefined;
+    expiresTime?: number | undefined;
+    acceptedByUserId?: GenericId<"User"> | undefined;
+    acceptedTime?: number | undefined;
+    _creationTime: number;
+    status: "pending" | "accepted" | "revoked" | "expired";
+    tokenHash: string;
+    _id: GenericId<"GroupInvite">;
+  }, {
+    _id: VId<GenericId<"GroupInvite">, "required">;
+    _creationTime: convex_values5.VFloat64<number, "required">;
+    groupId: VId<GenericId<"Group"> | undefined, "optional">;
+    invitedByUserId: VId<GenericId<"User"> | undefined, "optional">;
+    email: convex_values5.VString<string | undefined, "optional">;
+    tokenHash: convex_values5.VString<string, "required">;
+    role: convex_values5.VString<string | undefined, "optional">;
+    roleIds: convex_values5.VArray<string[] | undefined, convex_values5.VString<string, "required">, "optional">;
+    status: convex_values5.VUnion<"pending" | "accepted" | "revoked" | "expired", [convex_values5.VLiteral<"pending", "required">, convex_values5.VLiteral<"accepted", "required">, convex_values5.VLiteral<"revoked", "required">, convex_values5.VLiteral<"expired", "required">], "required", never>;
+    expiresTime: convex_values5.VFloat64<number | undefined, "optional">;
+    acceptedByUserId: VId<GenericId<"User"> | undefined, "optional">;
+    acceptedTime: convex_values5.VFloat64<number | undefined, "optional">;
+    extend: convex_values5.VAny<any, "optional", string>;
+  }, "required", "_creationTime" | "email" | "extend" | `extend.${string}` | "status" | "groupId" | "role" | "roleIds" | "invitedByUserId" | "tokenHash" | "expiresTime" | "acceptedByUserId" | "acceptedTime" | "_id">; /** Single UserEmail document validator. */
+  email: convex_values5.VObject<{
+    verificationTime?: number | undefined;
+    accountId?: GenericId<"Account"> | undefined;
+    provider?: string | undefined;
+    connectionId?: GenericId<"GroupConnection"> | undefined;
+    _creationTime: number;
+    email: string;
+    userId: GenericId<"User">;
+    isPrimary: boolean;
+    source: "password" | "oauth" | "oidc" | "saml" | "scim";
+    _id: GenericId<"UserEmail">;
+  }, {
+    _id: VId<GenericId<"UserEmail">, "required">;
+    _creationTime: convex_values5.VFloat64<number, "required">;
+    userId: VId<GenericId<"User">, "required">;
+    email: convex_values5.VString<string, "required">;
+    verificationTime: convex_values5.VFloat64<number | undefined, "optional">;
+    isPrimary: convex_values5.VBoolean<boolean, "required">;
+    source: convex_values5.VUnion<"password" | "oauth" | "oidc" | "saml" | "scim", [convex_values5.VLiteral<"password", "required">, convex_values5.VLiteral<"oauth", "required">, convex_values5.VLiteral<"oidc", "required">, convex_values5.VLiteral<"saml", "required">, convex_values5.VLiteral<"scim", "required">], "required", never>;
+    accountId: VId<GenericId<"Account"> | undefined, "optional">;
+    provider: convex_values5.VString<string | undefined, "optional">;
+    connectionId: VId<GenericId<"GroupConnection"> | undefined, "optional">;
+  }, "required", "_creationTime" | "email" | "userId" | "verificationTime" | "isPrimary" | "source" | "accountId" | "provider" | "connectionId" | "_id">; /** `User | null` — for a `viewer`/current-user query. */
+  viewer: convex_values5.VUnion<convex_server26.Expand<{ [Property in "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)]?: Exclude<Infer<(Omit<{
+    _id: VId<GenericId<"User">, "required">;
+    _creationTime: convex_values5.VFloat64<number, "required">;
+    name: convex_values5.VString<string | undefined, "optional">;
+    firstName: convex_values5.VString<string | undefined, "optional">;
+    lastName: convex_values5.VString<string | undefined, "optional">;
+    image: convex_values5.VString<string | undefined, "optional">;
+    email: convex_values5.VString<string | undefined, "optional">;
+    emailVerificationTime: convex_values5.VFloat64<number | undefined, "optional">;
+    phone: convex_values5.VString<string | undefined, "optional">;
+    phoneVerificationTime: convex_values5.VFloat64<number | undefined, "optional">;
+    isAnonymous: convex_values5.VBoolean<boolean | undefined, "optional">;
+    lastActiveGroup: VId<GenericId<"Group"> | undefined, "optional">;
+    hasTotp: convex_values5.VBoolean<boolean | undefined, "optional">;
+    extend: convex_values5.VAny<any, "optional", string>;
+  }, "extend"> & {
+    extend: convex_values5.VOptional<ExtendFor<TExtend, "User">>;
+  })[Property]>, undefined> | undefined } & { [Property_1 in Exclude<"_creationTime", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"name", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"email", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"phone", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"firstName", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"lastName", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"image", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"emailVerificationTime", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"phoneVerificationTime", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"isAnonymous", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"lastActiveGroup", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"hasTotp", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"extend", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"_id", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)>]: Infer<(Omit<{
+    _id: VId<GenericId<"User">, "required">;
+    _creationTime: convex_values5.VFloat64<number, "required">;
+    name: convex_values5.VString<string | undefined, "optional">;
+    firstName: convex_values5.VString<string | undefined, "optional">;
+    lastName: convex_values5.VString<string | undefined, "optional">;
+    image: convex_values5.VString<string | undefined, "optional">;
+    email: convex_values5.VString<string | undefined, "optional">;
+    emailVerificationTime: convex_values5.VFloat64<number | undefined, "optional">;
+    phone: convex_values5.VString<string | undefined, "optional">;
+    phoneVerificationTime: convex_values5.VFloat64<number | undefined, "optional">;
+    isAnonymous: convex_values5.VBoolean<boolean | undefined, "optional">;
+    lastActiveGroup: VId<GenericId<"Group"> | undefined, "optional">;
+    hasTotp: convex_values5.VBoolean<boolean | undefined, "optional">;
+    extend: convex_values5.VAny<any, "optional", string>;
+  }, "extend"> & {
+    extend: convex_values5.VOptional<ExtendFor<TExtend, "User">>;
+  })[Property_1]> }> | null, [convex_values5.VObject<convex_server26.Expand<{ [Property in "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)]?: Exclude<Infer<(Omit<{
+    _id: VId<GenericId<"User">, "required">;
+    _creationTime: convex_values5.VFloat64<number, "required">;
+    name: convex_values5.VString<string | undefined, "optional">;
+    firstName: convex_values5.VString<string | undefined, "optional">;
+    lastName: convex_values5.VString<string | undefined, "optional">;
+    image: convex_values5.VString<string | undefined, "optional">;
+    email: convex_values5.VString<string | undefined, "optional">;
+    emailVerificationTime: convex_values5.VFloat64<number | undefined, "optional">;
+    phone: convex_values5.VString<string | undefined, "optional">;
+    phoneVerificationTime: convex_values5.VFloat64<number | undefined, "optional">;
+    isAnonymous: convex_values5.VBoolean<boolean | undefined, "optional">;
+    lastActiveGroup: VId<GenericId<"Group"> | undefined, "optional">;
+    hasTotp: convex_values5.VBoolean<boolean | undefined, "optional">;
+    extend: convex_values5.VAny<any, "optional", string>;
+  }, "extend"> & {
+    extend: convex_values5.VOptional<ExtendFor<TExtend, "User">>;
+  })[Property]>, undefined> | undefined } & { [Property_1 in Exclude<"_creationTime", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"name", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"email", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"phone", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"firstName", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"lastName", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"image", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"emailVerificationTime", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"phoneVerificationTime", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"isAnonymous", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"lastActiveGroup", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"hasTotp", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"extend", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)> | Exclude<"_id", "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | (convex_values5.VOptional<ExtendFor<TExtend, "User">>["isOptional"] extends "optional" ? "extend" : never)>]: Infer<(Omit<{
+    _id: VId<GenericId<"User">, "required">;
+    _creationTime: convex_values5.VFloat64<number, "required">;
+    name: convex_values5.VString<string | undefined, "optional">;
+    firstName: convex_values5.VString<string | undefined, "optional">;
+    lastName: convex_values5.VString<string | undefined, "optional">;
+    image: convex_values5.VString<string | undefined, "optional">;
+    email: convex_values5.VString<string | undefined, "optional">;
+    emailVerificationTime: convex_values5.VFloat64<number | undefined, "optional">;
+    phone: convex_values5.VString<string | undefined, "optional">;
+    phoneVerificationTime: convex_values5.VFloat64<number | undefined, "optional">;
+    isAnonymous: convex_values5.VBoolean<boolean | undefined, "optional">;
+    lastActiveGroup: VId<GenericId<"Group"> | undefined, "optional">;
+    hasTotp: convex_values5.VBoolean<boolean | undefined, "optional">;
+    extend: convex_values5.VAny<any, "optional", string>;
+  }, "extend"> & {
+    extend: convex_values5.VOptional<ExtendFor<TExtend, "User">>;
+  })[Property_1]> }>, Omit<{
+    _id: VId<GenericId<"User">, "required">;
+    _creationTime: convex_values5.VFloat64<number, "required">;
+    name: convex_values5.VString<string | undefined, "optional">;
+    firstName: convex_values5.VString<string | undefined, "optional">;
+    lastName: convex_values5.VString<string | undefined, "optional">;
+    image: convex_values5.VString<string | undefined, "optional">;
+    email: convex_values5.VString<string | undefined, "optional">;
+    emailVerificationTime: convex_values5.VFloat64<number | undefined, "optional">;
+    phone: convex_values5.VString<string | undefined, "optional">;
+    phoneVerificationTime: convex_values5.VFloat64<number | undefined, "optional">;
+    isAnonymous: convex_values5.VBoolean<boolean | undefined, "optional">;
+    lastActiveGroup: VId<GenericId<"Group"> | undefined, "optional">;
+    hasTotp: convex_values5.VBoolean<boolean | undefined, "optional">;
+    extend: convex_values5.VAny<any, "optional", string>;
+  }, "extend"> & {
+    extend: convex_values5.VOptional<ExtendFor<TExtend, "User">>;
+  }, "required", "_creationTime" | "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | "extend" | "_id" | `extend.${convex_values5.VOptional<ExtendFor<TExtend, "User">>["fieldPaths"]}`>, convex_values5.VNull<null, "required">], "required", "_creationTime" | "name" | "email" | "phone" | "firstName" | "lastName" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "lastActiveGroup" | "hasTotp" | "extend" | "_id" | `extend.${convex_values5.VOptional<ExtendFor<TExtend, "User">>["fieldPaths"]}`>; /** Wrap any item validator in Convex's native pagination result shape. */
+  list: <V extends Validator<any, any, any>>(item: V) => convex_values5.VObject<{
+    splitCursor?: string | null;
+    pageStatus?: "SplitRecommended" | "SplitRequired" | null;
+    page: V["type"][];
+    continueCursor: string;
+    isDone: boolean;
+  }, {
+    page: convex_values5.VArray<V["type"][], V, "required">;
+    continueCursor: convex_values5.VString<string, "required">;
+    isDone: convex_values5.VBoolean<boolean, "required">;
+    splitCursor: convex_values5.VUnion<string | null | undefined, [convex_values5.VString<string, "required">, convex_values5.VNull<null, "required">], "optional", never>;
+    pageStatus: convex_values5.VUnion<"SplitRecommended" | "SplitRequired" | null | undefined, [convex_values5.VLiteral<"SplitRecommended", "required">, convex_values5.VLiteral<"SplitRequired", "required">, convex_values5.VNull<null, "required">], "optional", never>;
+  }, "required", "page" | "continueCursor" | "isDone" | "splitCursor" | "pageStatus">; /** Validators for the group connection admin facade. */
+  connection: {
+    protocol: convex_values5.VUnion<"oidc" | "saml", [convex_values5.VLiteral<"oidc", "required">, convex_values5.VLiteral<"saml", "required">], "required", never>;
+    doc: convex_values5.VObject<{
+      name?: string | undefined;
+      extend?: any;
+      slug?: string | undefined;
+      config?: any;
+      _creationTime: number;
+      status: "draft" | "active" | "disabled";
+      protocol: "oidc" | "saml";
+      groupId: string;
+      _id: string;
+    }, {
+      _id: convex_values5.VString<string, "required">;
+      _creationTime: convex_values5.VFloat64<number, "required">;
+      groupId: convex_values5.VString<string, "required">;
+      slug: convex_values5.VString<string | undefined, "optional">;
+      name: convex_values5.VString<string | undefined, "optional">;
+      protocol: convex_values5.VUnion<"oidc" | "saml", [convex_values5.VLiteral<"oidc", "required">, convex_values5.VLiteral<"saml", "required">], "required", never>;
+      status: convex_values5.VUnion<"draft" | "active" | "disabled", [convex_values5.VLiteral<"draft", "required">, convex_values5.VLiteral<"active", "required">, convex_values5.VLiteral<"disabled", "required">], "required", never>;
+      config: convex_values5.VAny<any, "optional", string>;
+      extend: convex_values5.VAny<any, "optional", string>;
+    }, "required", "_creationTime" | "name" | "extend" | `extend.${string}` | "status" | "slug" | "protocol" | "groupId" | "config" | `config.${string}` | "_id">;
+    lookup: convex_values5.VUnion<{
+      connection: {
+        name?: string | undefined;
+        extend?: any;
+        slug?: string | undefined;
+        config?: any;
+        _creationTime: number;
+        status: "draft" | "active" | "disabled";
+        protocol: "oidc" | "saml";
+        groupId: string;
+        _id: string;
+      } | null;
+      domain: {
+        verifiedAt?: number | undefined;
+        _creationTime: number;
+        isPrimary: boolean;
+        connectionId: string;
+        groupId: string;
+        domain: string;
+        _id: string;
+      } | null;
+    } | null, [convex_values5.VObject<{
+      connection: {
+        name?: string | undefined;
+        extend?: any;
+        slug?: string | undefined;
+        config?: any;
+        _creationTime: number;
+        status: "draft" | "active" | "disabled";
+        protocol: "oidc" | "saml";
+        groupId: string;
+        _id: string;
+      } | null;
+      domain: {
+        verifiedAt?: number | undefined;
+        _creationTime: number;
+        isPrimary: boolean;
+        connectionId: string;
+        groupId: string;
+        domain: string;
+        _id: string;
+      } | null;
+    }, {
+      connection: convex_values5.VUnion<{
+        name?: string | undefined;
+        extend?: any;
+        slug?: string | undefined;
+        config?: any;
+        _creationTime: number;
+        status: "draft" | "active" | "disabled";
+        protocol: "oidc" | "saml";
+        groupId: string;
+        _id: string;
+      } | null, [convex_values5.VObject<{
+        name?: string | undefined;
+        extend?: any;
+        slug?: string | undefined;
+        config?: any;
+        _creationTime: number;
+        status: "draft" | "active" | "disabled";
+        protocol: "oidc" | "saml";
+        groupId: string;
+        _id: string;
+      }, {
+        _id: convex_values5.VString<string, "required">;
+        _creationTime: convex_values5.VFloat64<number, "required">;
+        groupId: convex_values5.VString<string, "required">;
+        slug: convex_values5.VString<string | undefined, "optional">;
+        name: convex_values5.VString<string | undefined, "optional">;
+        protocol: convex_values5.VUnion<"oidc" | "saml", [convex_values5.VLiteral<"oidc", "required">, convex_values5.VLiteral<"saml", "required">], "required", never>;
+        status: convex_values5.VUnion<"draft" | "active" | "disabled", [convex_values5.VLiteral<"draft", "required">, convex_values5.VLiteral<"active", "required">, convex_values5.VLiteral<"disabled", "required">], "required", never>;
+        config: convex_values5.VAny<any, "optional", string>;
+        extend: convex_values5.VAny<any, "optional", string>;
+      }, "required", "_creationTime" | "name" | "extend" | `extend.${string}` | "status" | "slug" | "protocol" | "groupId" | "config" | `config.${string}` | "_id">, convex_values5.VNull<null, "required">], "required", "_creationTime" | "name" | "extend" | `extend.${string}` | "status" | "slug" | "protocol" | "groupId" | "config" | `config.${string}` | "_id">;
+      domain: convex_values5.VUnion<{
+        verifiedAt?: number | undefined;
+        _creationTime: number;
+        isPrimary: boolean;
+        connectionId: string;
+        groupId: string;
+        domain: string;
+        _id: string;
+      } | null, [convex_values5.VObject<{
+        verifiedAt?: number | undefined;
+        _creationTime: number;
+        isPrimary: boolean;
+        connectionId: string;
+        groupId: string;
+        domain: string;
+        _id: string;
+      }, {
+        _id: convex_values5.VString<string, "required">;
+        _creationTime: convex_values5.VFloat64<number, "required">;
+        connectionId: convex_values5.VString<string, "required">;
+        groupId: convex_values5.VString<string, "required">;
+        domain: convex_values5.VString<string, "required">;
+        isPrimary: convex_values5.VBoolean<boolean, "required">;
+        verifiedAt: convex_values5.VFloat64<number | undefined, "optional">;
+      }, "required", "_creationTime" | "isPrimary" | "connectionId" | "verifiedAt" | "groupId" | "domain" | "_id">, convex_values5.VNull<null, "required">], "required", "_creationTime" | "isPrimary" | "connectionId" | "verifiedAt" | "groupId" | "domain" | "_id">;
+    }, "required", "connection" | "domain" | "connection._creationTime" | "connection.name" | "connection.extend" | `connection.extend.${string}` | "connection.status" | "connection.slug" | "connection.protocol" | "connection.groupId" | "connection.config" | `connection.config.${string}` | "connection._id" | "domain._creationTime" | "domain.isPrimary" | "domain.connectionId" | "domain.verifiedAt" | "domain.groupId" | "domain.domain" | "domain._id">, convex_values5.VNull<null, "required">], "required", "connection" | "domain" | "connection._creationTime" | "connection.name" | "connection.extend" | `connection.extend.${string}` | "connection.status" | "connection.slug" | "connection.protocol" | "connection.groupId" | "connection.config" | `connection.config.${string}` | "connection._id" | "domain._creationTime" | "domain.isPrimary" | "domain.connectionId" | "domain.verifiedAt" | "domain.groupId" | "domain.domain" | "domain._id">;
+    id: convex_values5.VObject<{
+      connectionId: string;
+    }, {
+      connectionId: convex_values5.VString<string, "required">;
+    }, "required", "connectionId">;
+    created: convex_values5.VObject<{
+      connectionId: string;
+      groupId: string;
+    }, {
+      connectionId: convex_values5.VString<string, "required">;
+      groupId: convex_values5.VString<string, "required">;
+    }, "required", "connectionId" | "groupId">;
+    status: convex_values5.VObject<{
+      connectionId: string;
+      status: "draft" | "active" | "disabled";
+      ready: boolean;
+      domainCount: number;
+      protocols: {
+        oidc: {
+          clientId: string | null;
+          issuer: string | null;
+          ready: boolean;
+          configured: boolean;
+        };
+        saml: {
+          ready: boolean;
+          configured: boolean;
+          entityId: string | null;
+        };
+        scim: {
+          basePath: string | null;
+          ready: boolean;
+          configured: boolean;
+          deprovisionMode: "soft" | "hard";
+        };
+      };
+    }, {
+      connectionId: convex_values5.VString<string, "required">;
+      status: convex_values5.VUnion<"draft" | "active" | "disabled", [convex_values5.VLiteral<"draft", "required">, convex_values5.VLiteral<"active", "required">, convex_values5.VLiteral<"disabled", "required">], "required", never>;
+      ready: convex_values5.VBoolean<boolean, "required">;
+      domainCount: convex_values5.VFloat64<number, "required">;
+      protocols: convex_values5.VObject<{
+        oidc: {
+          clientId: string | null;
+          issuer: string | null;
+          ready: boolean;
+          configured: boolean;
+        };
+        saml: {
+          ready: boolean;
+          configured: boolean;
+          entityId: string | null;
+        };
+        scim: {
+          basePath: string | null;
+          ready: boolean;
+          configured: boolean;
+          deprovisionMode: "soft" | "hard";
+        };
+      }, {
+        oidc: convex_values5.VObject<{
+          clientId: string | null;
+          issuer: string | null;
+          ready: boolean;
+          configured: boolean;
+        }, {
+          configured: convex_values5.VBoolean<boolean, "required">;
+          ready: convex_values5.VBoolean<boolean, "required">;
+          clientId: convex_values5.VUnion<string | null, [convex_values5.VString<string, "required">, convex_values5.VNull<null, "required">], "required", never>;
+          issuer: convex_values5.VUnion<string | null, [convex_values5.VString<string, "required">, convex_values5.VNull<null, "required">], "required", never>;
+        }, "required", "clientId" | "issuer" | "ready" | "configured">;
+        saml: convex_values5.VObject<{
+          ready: boolean;
+          configured: boolean;
+          entityId: string | null;
+        }, {
+          configured: convex_values5.VBoolean<boolean, "required">;
+          ready: convex_values5.VBoolean<boolean, "required">;
+          entityId: convex_values5.VUnion<string | null, [convex_values5.VString<string, "required">, convex_values5.VNull<null, "required">], "required", never>;
+        }, "required", "ready" | "configured" | "entityId">;
+        scim: convex_values5.VObject<{
+          basePath: string | null;
+          ready: boolean;
+          configured: boolean;
+          deprovisionMode: "soft" | "hard";
+        }, {
+          configured: convex_values5.VBoolean<boolean, "required">;
+          ready: convex_values5.VBoolean<boolean, "required">;
+          basePath: convex_values5.VUnion<string | null, [convex_values5.VString<string, "required">, convex_values5.VNull<null, "required">], "required", never>;
+          deprovisionMode: convex_values5.VUnion<"soft" | "hard", [convex_values5.VLiteral<"soft", "required">, convex_values5.VLiteral<"hard", "required">], "required", never>;
+        }, "required", "basePath" | "ready" | "configured" | "deprovisionMode">;
+      }, "required", "oidc" | "saml" | "scim" | "oidc.clientId" | "oidc.issuer" | "oidc.ready" | "oidc.configured" | "saml.ready" | "saml.configured" | "saml.entityId" | "scim.basePath" | "scim.ready" | "scim.configured" | "scim.deprovisionMode">;
+    }, "required", "connectionId" | "status" | "ready" | "domainCount" | "protocols" | "protocols.oidc" | "protocols.saml" | "protocols.scim" | "protocols.oidc.clientId" | "protocols.oidc.issuer" | "protocols.oidc.ready" | "protocols.oidc.configured" | "protocols.saml.ready" | "protocols.saml.configured" | "protocols.saml.entityId" | "protocols.scim.basePath" | "protocols.scim.ready" | "protocols.scim.configured" | "protocols.scim.deprovisionMode">;
+    validation: convex_values5.VObject<{
+      connectionId: string;
+      ok: boolean;
+      checks: {
+        message?: string | undefined;
+        name: string;
+        ok: boolean;
+      }[];
+    }, {
+      ok: convex_values5.VBoolean<boolean, "required">;
+      connectionId: convex_values5.VString<string, "required">;
+      checks: convex_values5.VArray<{
+        message?: string | undefined;
+        name: string;
+        ok: boolean;
+      }[], convex_values5.VObject<{
+        message?: string | undefined;
+        name: string;
+        ok: boolean;
+      }, {
+        name: convex_values5.VString<string, "required">;
+        ok: convex_values5.VBoolean<boolean, "required">;
+        message: convex_values5.VString<string | undefined, "optional">;
+      }, "required", "name" | "ok" | "message">, "required">;
+    }, "required", "connectionId" | "ok" | "checks">;
+    signIn: convex_values5.VObject<{
+      redirectTo?: string | undefined;
+      connectionId: string;
+      protocol: "oidc" | "saml";
+      providerId: string;
+      signInPath: string;
+      callbackPath: string;
+    }, {
+      connectionId: convex_values5.VString<string, "required">;
+      providerId: convex_values5.VString<string, "required">;
+      protocol: convex_values5.VUnion<"oidc" | "saml", [convex_values5.VLiteral<"oidc", "required">, convex_values5.VLiteral<"saml", "required">], "required", never>;
+      signInPath: convex_values5.VString<string, "required">;
+      callbackPath: convex_values5.VString<string, "required">;
+      redirectTo: convex_values5.VString<string | undefined, "optional">;
+    }, "required", "connectionId" | "protocol" | "providerId" | "signInPath" | "callbackPath" | "redirectTo">;
+    domain: {
+      doc: convex_values5.VObject<{
+        verifiedAt?: number | undefined;
+        _creationTime: number;
+        isPrimary: boolean;
+        connectionId: string;
+        groupId: string;
+        domain: string;
+        _id: string;
+      }, {
+        _id: convex_values5.VString<string, "required">;
+        _creationTime: convex_values5.VFloat64<number, "required">;
+        connectionId: convex_values5.VString<string, "required">;
+        groupId: convex_values5.VString<string, "required">;
+        domain: convex_values5.VString<string, "required">;
+        isPrimary: convex_values5.VBoolean<boolean, "required">;
+        verifiedAt: convex_values5.VFloat64<number | undefined, "optional">;
+      }, "required", "_creationTime" | "isPrimary" | "connectionId" | "verifiedAt" | "groupId" | "domain" | "_id">;
+      summary: convex_values5.VObject<{
+        isPrimary: boolean;
+        verifiedAt: number | null;
+        verified: boolean;
+        domain: string;
+        domainId: string;
+      }, {
+        domainId: convex_values5.VString<string, "required">;
+        domain: convex_values5.VString<string, "required">;
+        isPrimary: convex_values5.VBoolean<boolean, "required">;
+        verified: convex_values5.VBoolean<boolean, "required">;
+        verifiedAt: convex_values5.VUnion<number | null, [convex_values5.VFloat64<number, "required">, convex_values5.VNull<null, "required">], "required", never>;
+      }, "required", "isPrimary" | "verifiedAt" | "verified" | "domain" | "domainId">;
+      validation: convex_values5.VObject<{
+        connectionId: string;
+        domains: {
+          isPrimary: boolean;
+          verifiedAt: number | null;
+          verified: boolean;
+          domain: string;
+          domainId: string;
+        }[];
+        ready: boolean;
+        summary: {
+          domainCount: number;
+          primaryCount: number;
+          verifiedCount: number;
+        };
+        warnings: string[];
+      }, {
+        connectionId: convex_values5.VString<string, "required">;
+        ready: convex_values5.VBoolean<boolean, "required">;
+        summary: convex_values5.VObject<{
+          domainCount: number;
+          primaryCount: number;
+          verifiedCount: number;
+        }, {
+          domainCount: convex_values5.VFloat64<number, "required">;
+          primaryCount: convex_values5.VFloat64<number, "required">;
+          verifiedCount: convex_values5.VFloat64<number, "required">;
+        }, "required", "domainCount" | "primaryCount" | "verifiedCount">;
+        domains: convex_values5.VArray<{
+          isPrimary: boolean;
+          verifiedAt: number | null;
+          verified: boolean;
+          domain: string;
+          domainId: string;
+        }[], convex_values5.VObject<{
+          isPrimary: boolean;
+          verifiedAt: number | null;
+          verified: boolean;
+          domain: string;
+          domainId: string;
+        }, {
+          domainId: convex_values5.VString<string, "required">;
+          domain: convex_values5.VString<string, "required">;
+          isPrimary: convex_values5.VBoolean<boolean, "required">;
+          verified: convex_values5.VBoolean<boolean, "required">;
+          verifiedAt: convex_values5.VUnion<number | null, [convex_values5.VFloat64<number, "required">, convex_values5.VNull<null, "required">], "required", never>;
+        }, "required", "isPrimary" | "verifiedAt" | "verified" | "domain" | "domainId">, "required">;
+        warnings: convex_values5.VArray<string[], convex_values5.VString<string, "required">, "required">;
+      }, "required", "connectionId" | "domains" | "ready" | "summary" | "warnings" | "summary.domainCount" | "summary.primaryCount" | "summary.verifiedCount">;
+      upsert: convex_values5.VObject<{
+        connectionId: string;
+        domains: {
+          isPrimary: boolean;
+          verifiedAt: number | null;
+          verified: boolean;
+          domain: string;
+          domainId: string;
+        }[];
+      }, {
+        connectionId: convex_values5.VString<string, "required">;
+        domains: convex_values5.VArray<{
+          isPrimary: boolean;
+          verifiedAt: number | null;
+          verified: boolean;
+          domain: string;
+          domainId: string;
+        }[], convex_values5.VObject<{
+          isPrimary: boolean;
+          verifiedAt: number | null;
+          verified: boolean;
+          domain: string;
+          domainId: string;
+        }, {
+          domainId: convex_values5.VString<string, "required">;
+          domain: convex_values5.VString<string, "required">;
+          isPrimary: convex_values5.VBoolean<boolean, "required">;
+          verified: convex_values5.VBoolean<boolean, "required">;
+          verifiedAt: convex_values5.VUnion<number | null, [convex_values5.VFloat64<number, "required">, convex_values5.VNull<null, "required">], "required", never>;
+        }, "required", "isPrimary" | "verifiedAt" | "verified" | "domain" | "domainId">, "required">;
+      }, "required", "connectionId" | "domains">;
+      verificationRequest: convex_values5.VObject<{
+        connectionId: string;
+        expiresAt: number;
+        domain: string;
+        requestedAt: number;
+        challenge: {
+          recordName: string;
+          recordType: "TXT";
+          recordValue: string;
+        };
+      }, {
+        connectionId: convex_values5.VString<string, "required">;
+        domain: convex_values5.VString<string, "required">;
+        requestedAt: convex_values5.VFloat64<number, "required">;
+        expiresAt: convex_values5.VFloat64<number, "required">;
+        challenge: convex_values5.VObject<{
+          recordName: string;
+          recordType: "TXT";
+          recordValue: string;
+        }, {
+          recordType: convex_values5.VLiteral<"TXT", "required">;
+          recordName: convex_values5.VString<string, "required">;
+          recordValue: convex_values5.VString<string, "required">;
+        }, "required", "recordName" | "recordType" | "recordValue">;
+      }, "required", "connectionId" | "expiresAt" | "domain" | "requestedAt" | "challenge" | "challenge.recordName" | "challenge.recordType" | "challenge.recordValue">;
+      verificationConfirm: convex_values5.VObject<{
+        verifiedAt?: number | undefined;
+        connectionId: string;
+        domain: string;
+        checks: {
+          message?: string | undefined;
+          name: string;
+          ok: boolean;
+        }[];
+      }, {
+        connectionId: convex_values5.VString<string, "required">;
+        domain: convex_values5.VString<string, "required">;
+        verifiedAt: convex_values5.VFloat64<number | undefined, "optional">;
+        checks: convex_values5.VArray<{
+          message?: string | undefined;
+          name: string;
+          ok: boolean;
+        }[], convex_values5.VObject<{
+          message?: string | undefined;
+          name: string;
+          ok: boolean;
+        }, {
+          name: convex_values5.VString<string, "required">;
+          ok: convex_values5.VBoolean<boolean, "required">;
+          message: convex_values5.VString<string | undefined, "optional">;
+        }, "required", "name" | "ok" | "message">, "required">;
+      }, "required", "connectionId" | "verifiedAt" | "domain" | "checks">;
+    };
+    oidc: {
+      config: convex_values5.VObject<{
+        profile?: any;
+        security?: any;
+        enabled?: boolean | undefined;
+        discovery?: any;
+        client?: any;
+        request?: any;
+        hasClientSecret?: boolean | undefined;
+      }, {
+        enabled: convex_values5.VBoolean<boolean | undefined, "optional">;
+        discovery: convex_values5.VAny<any, "optional", string>;
+        client: convex_values5.VAny<any, "optional", string>;
+        request: convex_values5.VAny<any, "optional", string>;
+        security: convex_values5.VAny<any, "optional", string>;
+        profile: convex_values5.VAny<any, "optional", string>;
+        hasClientSecret: convex_values5.VBoolean<boolean | undefined, "optional">;
+      }, "required", "profile" | "security" | `profile.${string}` | "enabled" | "discovery" | "client" | "request" | "hasClientSecret" | `security.${string}` | `discovery.${string}` | `client.${string}` | `request.${string}`>;
+      validation: convex_values5.VObject<{
+        connectionId: string;
+        ok: boolean;
+        checks: {
+          message?: string | undefined;
+          name: string;
+          ok: boolean;
+        }[];
+      }, {
+        ok: convex_values5.VBoolean<boolean, "required">;
+        connectionId: convex_values5.VString<string, "required">;
+        checks: convex_values5.VArray<{
+          message?: string | undefined;
+          name: string;
+          ok: boolean;
+        }[], convex_values5.VObject<{
+          message?: string | undefined;
+          name: string;
+          ok: boolean;
+        }, {
+          name: convex_values5.VString<string, "required">;
+          ok: convex_values5.VBoolean<boolean, "required">;
+          message: convex_values5.VString<string | undefined, "optional">;
+        }, "required", "name" | "ok" | "message">, "required">;
+      }, "required", "connectionId" | "ok" | "checks">;
+    };
+    saml: {
+      validation: convex_values5.VObject<{
+        connectionId: string;
+        ok: boolean;
+        checks: {
+          message?: string | undefined;
+          name: string;
+          ok: boolean;
+        }[];
+      }, {
+        ok: convex_values5.VBoolean<boolean, "required">;
+        connectionId: convex_values5.VString<string, "required">;
+        checks: convex_values5.VArray<{
+          message?: string | undefined;
+          name: string;
+          ok: boolean;
+        }[], convex_values5.VObject<{
+          message?: string | undefined;
+          name: string;
+          ok: boolean;
+        }, {
+          name: convex_values5.VString<string, "required">;
+          ok: convex_values5.VBoolean<boolean, "required">;
+          message: convex_values5.VString<string | undefined, "optional">;
+        }, "required", "name" | "ok" | "message">, "required">;
+      }, "required", "connectionId" | "ok" | "checks">;
+      metadata: convex_values5.VString<string, "required">;
+    };
+    policy: {
+      config: convex_values5.VObject<{
+        extend?: any;
+        version: 1;
+        identity: {
+          accountLinking: {
+            oidc: "verifiedEmail" | "none" | "sameConnection";
+            saml: "verifiedEmail" | "none" | "sameConnection";
+          };
+        };
+        provisioning: {
+          user: {
+            createOnSignIn: boolean;
+            updateProfileOnLogin: "never" | "missing" | "always";
+            updateProfileFromScim: "never" | "missing" | "always";
+            authority: "scim" | "app" | "connection";
+          };
+          scimReuse: {
+            user: "none" | "externalId";
+          };
+          jit: {
+            defaultRole?: string | undefined;
+            defaultRoleIds?: string[] | undefined;
+            mode: "off" | "createUser" | "createUserAndMembership";
+          };
+          deprovision: {
+            mode: "soft" | "hard";
+          };
+          groups: {
+            mapping?: Record<string, string[]> | undefined;
+            source: "protocol";
+            mode: "ignore" | "sync";
+          };
+          roles: {
+            mapping?: Record<string, string[]> | undefined;
+            source: "protocol";
+            mode: "map" | "ignore";
+          };
+        };
+      }, {
+        version: convex_values5.VLiteral<1, "required">;
+        identity: convex_values5.VObject<{
+          accountLinking: {
+            oidc: "verifiedEmail" | "none" | "sameConnection";
+            saml: "verifiedEmail" | "none" | "sameConnection";
+          };
+        }, {
+          accountLinking: convex_values5.VObject<{
+            oidc: "verifiedEmail" | "none" | "sameConnection";
+            saml: "verifiedEmail" | "none" | "sameConnection";
+          }, {
+            oidc: convex_values5.VUnion<"verifiedEmail" | "none" | "sameConnection", [convex_values5.VLiteral<"verifiedEmail", "required">, convex_values5.VLiteral<"none", "required">, convex_values5.VLiteral<"sameConnection", "required">], "required", never>;
+            saml: convex_values5.VUnion<"verifiedEmail" | "none" | "sameConnection", [convex_values5.VLiteral<"verifiedEmail", "required">, convex_values5.VLiteral<"none", "required">, convex_values5.VLiteral<"sameConnection", "required">], "required", never>;
+          }, "required", "oidc" | "saml">;
+        }, "required", "accountLinking" | "accountLinking.oidc" | "accountLinking.saml">;
+        provisioning: convex_values5.VObject<{
+          user: {
+            createOnSignIn: boolean;
+            updateProfileOnLogin: "never" | "missing" | "always";
+            updateProfileFromScim: "never" | "missing" | "always";
+            authority: "scim" | "app" | "connection";
+          };
+          scimReuse: {
+            user: "none" | "externalId";
+          };
+          jit: {
+            defaultRole?: string | undefined;
+            defaultRoleIds?: string[] | undefined;
+            mode: "off" | "createUser" | "createUserAndMembership";
+          };
+          deprovision: {
+            mode: "soft" | "hard";
+          };
+          groups: {
+            mapping?: Record<string, string[]> | undefined;
+            source: "protocol";
+            mode: "ignore" | "sync";
+          };
+          roles: {
+            mapping?: Record<string, string[]> | undefined;
+            source: "protocol";
+            mode: "map" | "ignore";
+          };
+        }, {
+          user: convex_values5.VObject<{
+            createOnSignIn: boolean;
+            updateProfileOnLogin: "never" | "missing" | "always";
+            updateProfileFromScim: "never" | "missing" | "always";
+            authority: "scim" | "app" | "connection";
+          }, {
+            createOnSignIn: convex_values5.VBoolean<boolean, "required">;
+            updateProfileOnLogin: convex_values5.VUnion<"never" | "missing" | "always", [convex_values5.VLiteral<"never", "required">, convex_values5.VLiteral<"missing", "required">, convex_values5.VLiteral<"always", "required">], "required", never>;
+            updateProfileFromScim: convex_values5.VUnion<"never" | "missing" | "always", [convex_values5.VLiteral<"never", "required">, convex_values5.VLiteral<"missing", "required">, convex_values5.VLiteral<"always", "required">], "required", never>;
+            authority: convex_values5.VUnion<"scim" | "app" | "connection", [convex_values5.VLiteral<"app", "required">, convex_values5.VLiteral<"connection", "required">, convex_values5.VLiteral<"scim", "required">], "required", never>;
+          }, "required", "createOnSignIn" | "updateProfileOnLogin" | "updateProfileFromScim" | "authority">;
+          scimReuse: convex_values5.VObject<{
+            user: "none" | "externalId";
+          }, {
+            user: convex_values5.VUnion<"none" | "externalId", [convex_values5.VLiteral<"externalId", "required">, convex_values5.VLiteral<"none", "required">], "required", never>;
+          }, "required", "user">;
+          jit: convex_values5.VObject<{
+            defaultRole?: string | undefined;
+            defaultRoleIds?: string[] | undefined;
+            mode: "off" | "createUser" | "createUserAndMembership";
+          }, {
+            mode: convex_values5.VUnion<"off" | "createUser" | "createUserAndMembership", [convex_values5.VLiteral<"off", "required">, convex_values5.VLiteral<"createUser", "required">, convex_values5.VLiteral<"createUserAndMembership", "required">], "required", never>;
+            defaultRole: convex_values5.VString<string | undefined, "optional">;
+            defaultRoleIds: convex_values5.VArray<string[] | undefined, convex_values5.VString<string, "required">, "optional">;
+          }, "required", "mode" | "defaultRole" | "defaultRoleIds">;
+          deprovision: convex_values5.VObject<{
+            mode: "soft" | "hard";
+          }, {
+            mode: convex_values5.VUnion<"soft" | "hard", [convex_values5.VLiteral<"soft", "required">, convex_values5.VLiteral<"hard", "required">], "required", never>;
+          }, "required", "mode">;
+          groups: convex_values5.VObject<{
+            mapping?: Record<string, string[]> | undefined;
+            source: "protocol";
+            mode: "ignore" | "sync";
+          }, {
+            mode: convex_values5.VUnion<"ignore" | "sync", [convex_values5.VLiteral<"ignore", "required">, convex_values5.VLiteral<"sync", "required">], "required", never>;
+            source: convex_values5.VLiteral<"protocol", "required">;
+            mapping: convex_values5.VRecord<Record<string, string[]> | undefined, convex_values5.VString<string, "required">, convex_values5.VArray<string[], convex_values5.VString<string, "required">, "required">, "optional", string>;
+          }, "required", "source" | "mode" | "mapping" | `mapping.${string}`>;
+          roles: convex_values5.VObject<{
+            mapping?: Record<string, string[]> | undefined;
+            source: "protocol";
+            mode: "map" | "ignore";
+          }, {
+            mode: convex_values5.VUnion<"map" | "ignore", [convex_values5.VLiteral<"ignore", "required">, convex_values5.VLiteral<"map", "required">], "required", never>;
+            source: convex_values5.VLiteral<"protocol", "required">;
+            mapping: convex_values5.VRecord<Record<string, string[]> | undefined, convex_values5.VString<string, "required">, convex_values5.VArray<string[], convex_values5.VString<string, "required">, "required">, "optional", string>;
+          }, "required", "source" | "mode" | "mapping" | `mapping.${string}`>;
+        }, "required", "user" | "scimReuse" | "jit" | "deprovision" | "groups" | "roles" | "user.createOnSignIn" | "user.updateProfileOnLogin" | "user.updateProfileFromScim" | "user.authority" | "scimReuse.user" | "jit.mode" | "jit.defaultRole" | "jit.defaultRoleIds" | "deprovision.mode" | "groups.source" | "groups.mode" | "groups.mapping" | `groups.mapping.${string}` | "roles.source" | "roles.mode" | "roles.mapping" | `roles.mapping.${string}`>;
+        extend: convex_values5.VAny<any, "optional", string>;
+      }, "required", "extend" | `extend.${string}` | "version" | "identity" | "provisioning" | "identity.accountLinking" | "identity.accountLinking.oidc" | "identity.accountLinking.saml" | "provisioning.user" | "provisioning.scimReuse" | "provisioning.jit" | "provisioning.deprovision" | "provisioning.groups" | "provisioning.roles" | "provisioning.user.createOnSignIn" | "provisioning.user.updateProfileOnLogin" | "provisioning.user.updateProfileFromScim" | "provisioning.user.authority" | "provisioning.scimReuse.user" | "provisioning.jit.mode" | "provisioning.jit.defaultRole" | "provisioning.jit.defaultRoleIds" | "provisioning.deprovision.mode" | "provisioning.groups.source" | "provisioning.groups.mode" | "provisioning.groups.mapping" | `provisioning.groups.mapping.${string}` | "provisioning.roles.source" | "provisioning.roles.mode" | "provisioning.roles.mapping" | `provisioning.roles.mapping.${string}`>;
+      validation: convex_values5.VObject<{
+        policy?: {
+          extend?: any;
+          version: 1;
+          identity: {
+            accountLinking: {
+              oidc: "verifiedEmail" | "none" | "sameConnection";
+              saml: "verifiedEmail" | "none" | "sameConnection";
+            };
+          };
+          provisioning: {
+            user: {
+              createOnSignIn: boolean;
+              updateProfileOnLogin: "never" | "missing" | "always";
+              updateProfileFromScim: "never" | "missing" | "always";
+              authority: "scim" | "app" | "connection";
+            };
+            scimReuse: {
+              user: "none" | "externalId";
+            };
+            jit: {
+              defaultRole?: string | undefined;
+              defaultRoleIds?: string[] | undefined;
+              mode: "off" | "createUser" | "createUserAndMembership";
+            };
+            deprovision: {
+              mode: "soft" | "hard";
+            };
+            groups: {
+              mapping?: Record<string, string[]> | undefined;
+              source: "protocol";
+              mode: "ignore" | "sync";
+            };
+            roles: {
+              mapping?: Record<string, string[]> | undefined;
+              source: "protocol";
+              mode: "map" | "ignore";
+            };
+          };
+        } | undefined;
+        groupId: string;
+        ok: boolean;
+        checks: {
+          message?: string | undefined;
+          name: string;
+          ok: boolean;
+        }[];
+      }, {
+        ok: convex_values5.VBoolean<boolean, "required">;
+        groupId: convex_values5.VString<string, "required">;
+        policy: convex_values5.VObject<{
+          extend?: any;
+          version: 1;
+          identity: {
+            accountLinking: {
+              oidc: "verifiedEmail" | "none" | "sameConnection";
+              saml: "verifiedEmail" | "none" | "sameConnection";
+            };
+          };
+          provisioning: {
+            user: {
+              createOnSignIn: boolean;
+              updateProfileOnLogin: "never" | "missing" | "always";
+              updateProfileFromScim: "never" | "missing" | "always";
+              authority: "scim" | "app" | "connection";
+            };
+            scimReuse: {
+              user: "none" | "externalId";
+            };
+            jit: {
+              defaultRole?: string | undefined;
+              defaultRoleIds?: string[] | undefined;
+              mode: "off" | "createUser" | "createUserAndMembership";
+            };
+            deprovision: {
+              mode: "soft" | "hard";
+            };
+            groups: {
+              mapping?: Record<string, string[]> | undefined;
+              source: "protocol";
+              mode: "ignore" | "sync";
+            };
+            roles: {
+              mapping?: Record<string, string[]> | undefined;
+              source: "protocol";
+              mode: "map" | "ignore";
+            };
+          };
+        } | undefined, {
+          version: convex_values5.VLiteral<1, "required">;
+          identity: convex_values5.VObject<{
+            accountLinking: {
+              oidc: "verifiedEmail" | "none" | "sameConnection";
+              saml: "verifiedEmail" | "none" | "sameConnection";
+            };
+          }, {
+            accountLinking: convex_values5.VObject<{
+              oidc: "verifiedEmail" | "none" | "sameConnection";
+              saml: "verifiedEmail" | "none" | "sameConnection";
+            }, {
+              oidc: convex_values5.VUnion<"verifiedEmail" | "none" | "sameConnection", [convex_values5.VLiteral<"verifiedEmail", "required">, convex_values5.VLiteral<"none", "required">, convex_values5.VLiteral<"sameConnection", "required">], "required", never>;
+              saml: convex_values5.VUnion<"verifiedEmail" | "none" | "sameConnection", [convex_values5.VLiteral<"verifiedEmail", "required">, convex_values5.VLiteral<"none", "required">, convex_values5.VLiteral<"sameConnection", "required">], "required", never>;
+            }, "required", "oidc" | "saml">;
+          }, "required", "accountLinking" | "accountLinking.oidc" | "accountLinking.saml">;
+          provisioning: convex_values5.VObject<{
+            user: {
+              createOnSignIn: boolean;
+              updateProfileOnLogin: "never" | "missing" | "always";
+              updateProfileFromScim: "never" | "missing" | "always";
+              authority: "scim" | "app" | "connection";
+            };
+            scimReuse: {
+              user: "none" | "externalId";
+            };
+            jit: {
+              defaultRole?: string | undefined;
+              defaultRoleIds?: string[] | undefined;
+              mode: "off" | "createUser" | "createUserAndMembership";
+            };
+            deprovision: {
+              mode: "soft" | "hard";
+            };
+            groups: {
+              mapping?: Record<string, string[]> | undefined;
+              source: "protocol";
+              mode: "ignore" | "sync";
+            };
+            roles: {
+              mapping?: Record<string, string[]> | undefined;
+              source: "protocol";
+              mode: "map" | "ignore";
+            };
+          }, {
+            user: convex_values5.VObject<{
+              createOnSignIn: boolean;
+              updateProfileOnLogin: "never" | "missing" | "always";
+              updateProfileFromScim: "never" | "missing" | "always";
+              authority: "scim" | "app" | "connection";
+            }, {
+              createOnSignIn: convex_values5.VBoolean<boolean, "required">;
+              updateProfileOnLogin: convex_values5.VUnion<"never" | "missing" | "always", [convex_values5.VLiteral<"never", "required">, convex_values5.VLiteral<"missing", "required">, convex_values5.VLiteral<"always", "required">], "required", never>;
+              updateProfileFromScim: convex_values5.VUnion<"never" | "missing" | "always", [convex_values5.VLiteral<"never", "required">, convex_values5.VLiteral<"missing", "required">, convex_values5.VLiteral<"always", "required">], "required", never>;
+              authority: convex_values5.VUnion<"scim" | "app" | "connection", [convex_values5.VLiteral<"app", "required">, convex_values5.VLiteral<"connection", "required">, convex_values5.VLiteral<"scim", "required">], "required", never>;
+            }, "required", "createOnSignIn" | "updateProfileOnLogin" | "updateProfileFromScim" | "authority">;
+            scimReuse: convex_values5.VObject<{
+              user: "none" | "externalId";
+            }, {
+              user: convex_values5.VUnion<"none" | "externalId", [convex_values5.VLiteral<"externalId", "required">, convex_values5.VLiteral<"none", "required">], "required", never>;
+            }, "required", "user">;
+            jit: convex_values5.VObject<{
+              defaultRole?: string | undefined;
+              defaultRoleIds?: string[] | undefined;
+              mode: "off" | "createUser" | "createUserAndMembership";
+            }, {
+              mode: convex_values5.VUnion<"off" | "createUser" | "createUserAndMembership", [convex_values5.VLiteral<"off", "required">, convex_values5.VLiteral<"createUser", "required">, convex_values5.VLiteral<"createUserAndMembership", "required">], "required", never>;
+              defaultRole: convex_values5.VString<string | undefined, "optional">;
+              defaultRoleIds: convex_values5.VArray<string[] | undefined, convex_values5.VString<string, "required">, "optional">;
+            }, "required", "mode" | "defaultRole" | "defaultRoleIds">;
+            deprovision: convex_values5.VObject<{
+              mode: "soft" | "hard";
+            }, {
+              mode: convex_values5.VUnion<"soft" | "hard", [convex_values5.VLiteral<"soft", "required">, convex_values5.VLiteral<"hard", "required">], "required", never>;
+            }, "required", "mode">;
+            groups: convex_values5.VObject<{
+              mapping?: Record<string, string[]> | undefined;
+              source: "protocol";
+              mode: "ignore" | "sync";
+            }, {
+              mode: convex_values5.VUnion<"ignore" | "sync", [convex_values5.VLiteral<"ignore", "required">, convex_values5.VLiteral<"sync", "required">], "required", never>;
+              source: convex_values5.VLiteral<"protocol", "required">;
+              mapping: convex_values5.VRecord<Record<string, string[]> | undefined, convex_values5.VString<string, "required">, convex_values5.VArray<string[], convex_values5.VString<string, "required">, "required">, "optional", string>;
+            }, "required", "source" | "mode" | "mapping" | `mapping.${string}`>;
+            roles: convex_values5.VObject<{
+              mapping?: Record<string, string[]> | undefined;
+              source: "protocol";
+              mode: "map" | "ignore";
+            }, {
+              mode: convex_values5.VUnion<"map" | "ignore", [convex_values5.VLiteral<"ignore", "required">, convex_values5.VLiteral<"map", "required">], "required", never>;
+              source: convex_values5.VLiteral<"protocol", "required">;
+              mapping: convex_values5.VRecord<Record<string, string[]> | undefined, convex_values5.VString<string, "required">, convex_values5.VArray<string[], convex_values5.VString<string, "required">, "required">, "optional", string>;
+            }, "required", "source" | "mode" | "mapping" | `mapping.${string}`>;
+          }, "required", "user" | "scimReuse" | "jit" | "deprovision" | "groups" | "roles" | "user.createOnSignIn" | "user.updateProfileOnLogin" | "user.updateProfileFromScim" | "user.authority" | "scimReuse.user" | "jit.mode" | "jit.defaultRole" | "jit.defaultRoleIds" | "deprovision.mode" | "groups.source" | "groups.mode" | "groups.mapping" | `groups.mapping.${string}` | "roles.source" | "roles.mode" | "roles.mapping" | `roles.mapping.${string}`>;
+          extend: convex_values5.VAny<any, "optional", string>;
+        }, "optional", "extend" | `extend.${string}` | "version" | "identity" | "provisioning" | "identity.accountLinking" | "identity.accountLinking.oidc" | "identity.accountLinking.saml" | "provisioning.user" | "provisioning.scimReuse" | "provisioning.jit" | "provisioning.deprovision" | "provisioning.groups" | "provisioning.roles" | "provisioning.user.createOnSignIn" | "provisioning.user.updateProfileOnLogin" | "provisioning.user.updateProfileFromScim" | "provisioning.user.authority" | "provisioning.scimReuse.user" | "provisioning.jit.mode" | "provisioning.jit.defaultRole" | "provisioning.jit.defaultRoleIds" | "provisioning.deprovision.mode" | "provisioning.groups.source" | "provisioning.groups.mode" | "provisioning.groups.mapping" | `provisioning.groups.mapping.${string}` | "provisioning.roles.source" | "provisioning.roles.mode" | "provisioning.roles.mapping" | `provisioning.roles.mapping.${string}`>;
+        checks: convex_values5.VArray<{
+          message?: string | undefined;
+          name: string;
+          ok: boolean;
+        }[], convex_values5.VObject<{
+          message?: string | undefined;
+          name: string;
+          ok: boolean;
+        }, {
+          name: convex_values5.VString<string, "required">;
+          ok: convex_values5.VBoolean<boolean, "required">;
+          message: convex_values5.VString<string | undefined, "optional">;
+        }, "required", "name" | "ok" | "message">, "required">;
+      }, "required", "policy" | "policy.extend" | `policy.extend.${string}` | "policy.version" | "policy.identity" | "policy.provisioning" | "policy.identity.accountLinking" | "policy.identity.accountLinking.oidc" | "policy.identity.accountLinking.saml" | "policy.provisioning.user" | "policy.provisioning.scimReuse" | "policy.provisioning.jit" | "policy.provisioning.deprovision" | "policy.provisioning.groups" | "policy.provisioning.roles" | "policy.provisioning.user.createOnSignIn" | "policy.provisioning.user.updateProfileOnLogin" | "policy.provisioning.user.updateProfileFromScim" | "policy.provisioning.user.authority" | "policy.provisioning.scimReuse.user" | "policy.provisioning.jit.mode" | "policy.provisioning.jit.defaultRole" | "policy.provisioning.jit.defaultRoleIds" | "policy.provisioning.deprovision.mode" | "policy.provisioning.groups.source" | "policy.provisioning.groups.mode" | "policy.provisioning.groups.mapping" | `policy.provisioning.groups.mapping.${string}` | "policy.provisioning.roles.source" | "policy.provisioning.roles.mode" | "policy.provisioning.roles.mapping" | `policy.provisioning.roles.mapping.${string}` | "groupId" | "ok" | "checks">;
+    };
+    scim: {
+      config: convex_values5.VObject<{
+        profile?: any;
+        extend?: any;
+        lastRotatedAt?: number | undefined;
+        security?: any;
+        _creationTime: number;
+        connectionId: string;
+        status: "draft" | "active" | "disabled";
+        groupId: string;
+        basePath: string;
+        _id: string;
+        hasToken: boolean;
+      }, {
+        _id: convex_values5.VString<string, "required">;
+        _creationTime: convex_values5.VFloat64<number, "required">;
+        connectionId: convex_values5.VString<string, "required">;
+        groupId: convex_values5.VString<string, "required">;
+        status: convex_values5.VUnion<"draft" | "active" | "disabled", [convex_values5.VLiteral<"draft", "required">, convex_values5.VLiteral<"active", "required">, convex_values5.VLiteral<"disabled", "required">], "required", never>;
+        basePath: convex_values5.VString<string, "required">;
+        lastRotatedAt: convex_values5.VFloat64<number | undefined, "optional">;
+        extend: convex_values5.VAny<any, "optional", string>;
+        hasToken: convex_values5.VBoolean<boolean, "required">;
+        security: convex_values5.VAny<any, "optional", string>;
+        profile: convex_values5.VAny<any, "optional", string>;
+      }, "required", "_creationTime" | "profile" | "extend" | `extend.${string}` | "connectionId" | "status" | "groupId" | "basePath" | "lastRotatedAt" | "security" | `profile.${string}` | "_id" | `security.${string}` | "hasToken">;
+      upsert: convex_values5.VObject<{
+        connectionId: string;
+        token: string;
+        basePath: string;
+        configId: string;
+      }, {
+        connectionId: convex_values5.VString<string, "required">;
+        configId: convex_values5.VString<string, "required">;
+        basePath: convex_values5.VString<string, "required">;
+        token: convex_values5.VString<string, "required">;
+      }, "required", "connectionId" | "token" | "basePath" | "configId">;
+      validation: convex_values5.VObject<{
+        basePath?: string | undefined;
+        deprovisionMode?: "soft" | "hard" | undefined;
+        capabilities?: {
+          groups: boolean;
+          users: boolean;
+          patch: boolean;
+          put: boolean;
+          filters: string[];
+          bulk: boolean;
+          etag: boolean;
+        } | undefined;
+        connectionId: string;
+        ok: boolean;
+        checks: {
+          message?: string | undefined;
+          name: string;
+          ok: boolean;
+        }[];
+      }, {
+        ok: convex_values5.VBoolean<boolean, "required">;
+        connectionId: convex_values5.VString<string, "required">;
+        basePath: convex_values5.VString<string | undefined, "optional">;
+        deprovisionMode: convex_values5.VUnion<"soft" | "hard" | undefined, [convex_values5.VLiteral<"soft", "required">, convex_values5.VLiteral<"hard", "required">], "optional", never>;
+        capabilities: convex_values5.VObject<{
+          groups: boolean;
+          users: boolean;
+          patch: boolean;
+          put: boolean;
+          filters: string[];
+          bulk: boolean;
+          etag: boolean;
+        } | undefined, {
+          users: convex_values5.VBoolean<boolean, "required">;
+          groups: convex_values5.VBoolean<boolean, "required">;
+          patch: convex_values5.VBoolean<boolean, "required">;
+          put: convex_values5.VBoolean<boolean, "required">;
+          filters: convex_values5.VArray<string[], convex_values5.VString<string, "required">, "required">;
+          bulk: convex_values5.VBoolean<boolean, "required">;
+          etag: convex_values5.VBoolean<boolean, "required">;
+        }, "optional", "groups" | "users" | "patch" | "put" | "filters" | "bulk" | "etag">;
+        checks: convex_values5.VArray<{
+          message?: string | undefined;
+          name: string;
+          ok: boolean;
+        }[], convex_values5.VObject<{
+          message?: string | undefined;
+          name: string;
+          ok: boolean;
+        }, {
+          name: convex_values5.VString<string, "required">;
+          ok: convex_values5.VBoolean<boolean, "required">;
+          message: convex_values5.VString<string | undefined, "optional">;
+        }, "required", "name" | "ok" | "message">, "required">;
+      }, "required", "connectionId" | "basePath" | "deprovisionMode" | "ok" | "checks" | "capabilities" | "capabilities.groups" | "capabilities.users" | "capabilities.patch" | "capabilities.put" | "capabilities.filters" | "capabilities.bulk" | "capabilities.etag">;
+    };
+    audit: {
+      event: convex_values5.VObject<{
+        requestId?: string | undefined;
+        actorId?: string | undefined;
+        subjectId?: string | undefined;
+        errorCode?: string | undefined;
+        ip?: string | undefined;
+        data?: {
+          profile?: Record<string, any> | undefined;
+          type?: string | undefined;
+          provider?: string | undefined;
+          existingUserId?: string | undefined;
+        } | {
+          method?: string | undefined;
+          provider: string;
+        } | {
+          userId?: string | undefined;
+          sessionId?: string | undefined;
+          reason?: string | undefined;
+          refreshTokenId?: string | undefined;
+          flow?: "reset" | "change" | undefined;
+        } | {
+          accountId?: string | undefined;
+          provider?: string | undefined;
+          providerAccountId?: string | undefined;
+        } | {
+          name?: string | undefined;
+          credentialId?: string | undefined;
+          reason?: string | undefined;
+          passkeyId?: string | undefined;
+          totpId?: string | undefined;
+          keyId?: string | undefined;
+          prefix?: string | undefined;
+        } | {
+          email?: string | undefined;
+          phone?: string | undefined;
+          userId?: string | undefined;
+        } | {
+          name?: string | undefined;
+          userId?: string | undefined;
+          clientId?: string | undefined;
+          codeId?: string | undefined;
+          scopes?: string[] | undefined;
+          redirectUri?: string | undefined;
+          grantType?: string | undefined;
+          resource?: string | undefined;
+        } | {
+          userId?: string | undefined;
+          connectionId?: string | undefined;
+          verifiedAt?: number | undefined;
+          expiresAt?: number | undefined;
+          version?: number | undefined;
+          protocol?: "oidc" | "saml" | undefined;
+          domain?: string | undefined;
+          recordName?: string | undefined;
+          errorCode?: string | undefined;
+          changed?: string[] | undefined;
+          metadataUrl?: string | undefined;
+          domains?: string[] | undefined;
+          issuer?: string | undefined;
+          discoveryUrl?: string | undefined;
+          jwksUri?: string | undefined;
+          audience?: string | string[] | undefined;
+          tokenEndpointAuthMethod?: string | undefined;
+        } | {
+          userId?: string | undefined;
+          externalId?: string | undefined;
+          groupId?: string | undefined;
+          active?: boolean | undefined;
+          resourceType?: "user" | "group" | undefined;
+          scimConfigId?: string | undefined;
+          resourceId?: string | undefined;
+          operation?: string | undefined;
+        } | {
+          status?: number | undefined;
+          endpointId?: string | undefined;
+          deliveryId?: string | undefined;
+          sourceEventId?: string | undefined;
+          sourceEventType?: "user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed" | undefined;
+          attemptCount?: number | undefined;
+          error?: string | undefined;
+        } | undefined;
+        _creationTime: number;
+        kind: "user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed";
+        targetKind: "user" | "connection" | "group" | "session" | "api_key" | "oauth_client" | "global";
+        category: "email" | "phone" | "password" | "oauth" | "scim" | "user" | "connection" | "session" | "account" | "passkey" | "totp" | "api_key" | "webhook" | "security";
+        actorType: "scim" | "user" | "api_key" | "webhook" | "oauth_client" | "system" | "anonymous";
+        subjectType: "email" | "phone" | "user" | "connection" | "group" | "session" | "account" | "passkey" | "totp" | "api_key" | "oauth_client" | "system" | "oauth_code" | "scim_identity" | "webhook_endpoint" | "webhook_delivery";
+        outcome: "success" | "failure";
+        eventId: string;
+        targetId: string;
+        occurredAt: number;
+        _id: string;
+      }, {
+        _id: convex_values5.VString<string, "required">;
+        _creationTime: convex_values5.VFloat64<number, "required">;
+        eventId: convex_values5.VString<string, "required">;
+        targetKind: convex_values5.VUnion<"user" | "connection" | "group" | "session" | "api_key" | "oauth_client" | "global", [convex_values5.VLiteral<"user", "required">, convex_values5.VLiteral<"session", "required">, convex_values5.VLiteral<"group", "required">, convex_values5.VLiteral<"connection", "required">, convex_values5.VLiteral<"oauth_client", "required">, convex_values5.VLiteral<"api_key", "required">, convex_values5.VLiteral<"global", "required">], "required", never>;
+        targetId: convex_values5.VString<string, "required">;
+        kind: convex_values5.VUnion<"user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed", convex_values5.VLiteral<"user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed", "required">[], "required", never>;
+        category: convex_values5.VUnion<"email" | "phone" | "password" | "oauth" | "scim" | "user" | "connection" | "session" | "account" | "passkey" | "totp" | "api_key" | "webhook" | "security", convex_values5.VLiteral<"email" | "phone" | "password" | "oauth" | "scim" | "user" | "connection" | "session" | "account" | "passkey" | "totp" | "api_key" | "webhook" | "security", "required">[], "required", never>;
+        occurredAt: convex_values5.VFloat64<number, "required">;
+        actorType: convex_values5.VUnion<"scim" | "user" | "api_key" | "webhook" | "oauth_client" | "system" | "anonymous", [convex_values5.VLiteral<"user", "required">, convex_values5.VLiteral<"system", "required">, convex_values5.VLiteral<"scim", "required">, convex_values5.VLiteral<"api_key", "required">, convex_values5.VLiteral<"oauth_client", "required">, convex_values5.VLiteral<"webhook", "required">, convex_values5.VLiteral<"anonymous", "required">], "required", never>;
+        actorId: convex_values5.VString<string | undefined, "optional">;
+        subjectType: convex_values5.VUnion<"email" | "phone" | "user" | "connection" | "group" | "session" | "account" | "passkey" | "totp" | "api_key" | "oauth_client" | "system" | "oauth_code" | "scim_identity" | "webhook_endpoint" | "webhook_delivery", [convex_values5.VLiteral<"user", "required">, convex_values5.VLiteral<"session", "required">, convex_values5.VLiteral<"account", "required">, convex_values5.VLiteral<"passkey", "required">, convex_values5.VLiteral<"totp", "required">, convex_values5.VLiteral<"email", "required">, convex_values5.VLiteral<"phone", "required">, convex_values5.VLiteral<"api_key", "required">, convex_values5.VLiteral<"oauth_client", "required">, convex_values5.VLiteral<"oauth_code", "required">, convex_values5.VLiteral<"group", "required">, convex_values5.VLiteral<"connection", "required">, convex_values5.VLiteral<"scim_identity", "required">, convex_values5.VLiteral<"webhook_endpoint", "required">, convex_values5.VLiteral<"webhook_delivery", "required">, convex_values5.VLiteral<"system", "required">], "required", never>;
+        subjectId: convex_values5.VString<string | undefined, "optional">;
+        outcome: convex_values5.VUnion<"success" | "failure", [convex_values5.VLiteral<"success", "required">, convex_values5.VLiteral<"failure", "required">], "required", never>;
+        errorCode: convex_values5.VString<string | undefined, "optional">;
+        requestId: convex_values5.VString<string | undefined, "optional">;
+        ip: convex_values5.VString<string | undefined, "optional">;
+        data: convex_values5.VUnion<{
+          profile?: Record<string, any> | undefined;
+          type?: string | undefined;
+          provider?: string | undefined;
+          existingUserId?: string | undefined;
+        } | {
+          method?: string | undefined;
+          provider: string;
+        } | {
+          userId?: string | undefined;
+          sessionId?: string | undefined;
+          reason?: string | undefined;
+          refreshTokenId?: string | undefined;
+          flow?: "reset" | "change" | undefined;
+        } | {
+          accountId?: string | undefined;
+          provider?: string | undefined;
+          providerAccountId?: string | undefined;
+        } | {
+          name?: string | undefined;
+          credentialId?: string | undefined;
+          reason?: string | undefined;
+          passkeyId?: string | undefined;
+          totpId?: string | undefined;
+          keyId?: string | undefined;
+          prefix?: string | undefined;
+        } | {
+          email?: string | undefined;
+          phone?: string | undefined;
+          userId?: string | undefined;
+        } | {
+          name?: string | undefined;
+          userId?: string | undefined;
+          clientId?: string | undefined;
+          codeId?: string | undefined;
+          scopes?: string[] | undefined;
+          redirectUri?: string | undefined;
+          grantType?: string | undefined;
+          resource?: string | undefined;
+        } | {
+          userId?: string | undefined;
+          connectionId?: string | undefined;
+          verifiedAt?: number | undefined;
+          expiresAt?: number | undefined;
+          version?: number | undefined;
+          protocol?: "oidc" | "saml" | undefined;
+          domain?: string | undefined;
+          recordName?: string | undefined;
+          errorCode?: string | undefined;
+          changed?: string[] | undefined;
+          metadataUrl?: string | undefined;
+          domains?: string[] | undefined;
+          issuer?: string | undefined;
+          discoveryUrl?: string | undefined;
+          jwksUri?: string | undefined;
+          audience?: string | string[] | undefined;
+          tokenEndpointAuthMethod?: string | undefined;
+        } | {
+          userId?: string | undefined;
+          externalId?: string | undefined;
+          groupId?: string | undefined;
+          active?: boolean | undefined;
+          resourceType?: "user" | "group" | undefined;
+          scimConfigId?: string | undefined;
+          resourceId?: string | undefined;
+          operation?: string | undefined;
+        } | {
+          status?: number | undefined;
+          endpointId?: string | undefined;
+          deliveryId?: string | undefined;
+          sourceEventId?: string | undefined;
+          sourceEventType?: "user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed" | undefined;
+          attemptCount?: number | undefined;
+          error?: string | undefined;
+        } | undefined, [convex_values5.VObject<{
+          profile?: Record<string, any> | undefined;
+          type?: string | undefined;
+          provider?: string | undefined;
+          existingUserId?: string | undefined;
+        }, {
+          type: convex_values5.VString<string | undefined, "optional">;
+          provider: convex_values5.VString<string | undefined, "optional">;
+          profile: convex_values5.VRecord<Record<string, any> | undefined, convex_values5.VString<string, "required">, convex_values5.VAny<any, "required", string>, "optional", string>;
+          existingUserId: convex_values5.VString<string | undefined, "optional">;
+        }, "required", "profile" | "type" | "provider" | "existingUserId" | `profile.${string}`>, convex_values5.VObject<{
+          method?: string | undefined;
+          provider: string;
+        }, {
+          provider: convex_values5.VString<string, "required">;
+          method: convex_values5.VString<string | undefined, "optional">;
+        }, "required", "provider" | "method">, convex_values5.VObject<{
+          userId?: string | undefined;
+          sessionId?: string | undefined;
+          reason?: string | undefined;
+          refreshTokenId?: string | undefined;
+          flow?: "reset" | "change" | undefined;
+        }, {
+          userId: convex_values5.VString<string | undefined, "optional">;
+          reason: convex_values5.VString<string | undefined, "optional">;
+          sessionId: convex_values5.VString<string | undefined, "optional">;
+          refreshTokenId: convex_values5.VString<string | undefined, "optional">;
+          flow: convex_values5.VUnion<"reset" | "change" | undefined, [convex_values5.VLiteral<"reset", "required">, convex_values5.VLiteral<"change", "required">], "optional", never>;
+        }, "required", "userId" | "sessionId" | "reason" | "refreshTokenId" | "flow">, convex_values5.VObject<{
+          accountId?: string | undefined;
+          provider?: string | undefined;
+          providerAccountId?: string | undefined;
+        }, {
+          provider: convex_values5.VString<string | undefined, "optional">;
+          providerAccountId: convex_values5.VString<string | undefined, "optional">;
+          accountId: convex_values5.VString<string | undefined, "optional">;
+        }, "required", "accountId" | "provider" | "providerAccountId">, convex_values5.VObject<{
+          name?: string | undefined;
+          credentialId?: string | undefined;
+          reason?: string | undefined;
+          passkeyId?: string | undefined;
+          totpId?: string | undefined;
+          keyId?: string | undefined;
+          prefix?: string | undefined;
+        }, {
+          passkeyId: convex_values5.VString<string | undefined, "optional">;
+          credentialId: convex_values5.VString<string | undefined, "optional">;
+          totpId: convex_values5.VString<string | undefined, "optional">;
+          keyId: convex_values5.VString<string | undefined, "optional">;
+          name: convex_values5.VString<string | undefined, "optional">;
+          prefix: convex_values5.VString<string | undefined, "optional">;
+          reason: convex_values5.VString<string | undefined, "optional">;
+        }, "required", "name" | "credentialId" | "reason" | "passkeyId" | "totpId" | "keyId" | "prefix">, convex_values5.VObject<{
+          email?: string | undefined;
+          phone?: string | undefined;
+          userId?: string | undefined;
+        }, {
+          email: convex_values5.VString<string | undefined, "optional">;
+          phone: convex_values5.VString<string | undefined, "optional">;
+          userId: convex_values5.VString<string | undefined, "optional">;
+        }, "required", "email" | "phone" | "userId">, convex_values5.VObject<{
+          name?: string | undefined;
+          userId?: string | undefined;
+          clientId?: string | undefined;
+          codeId?: string | undefined;
+          scopes?: string[] | undefined;
+          redirectUri?: string | undefined;
+          grantType?: string | undefined;
+          resource?: string | undefined;
+        }, {
+          clientId: convex_values5.VString<string | undefined, "optional">;
+          codeId: convex_values5.VString<string | undefined, "optional">;
+          name: convex_values5.VString<string | undefined, "optional">;
+          scopes: convex_values5.VArray<string[] | undefined, convex_values5.VString<string, "required">, "optional">;
+          redirectUri: convex_values5.VString<string | undefined, "optional">;
+          grantType: convex_values5.VString<string | undefined, "optional">;
+          resource: convex_values5.VString<string | undefined, "optional">;
+          userId: convex_values5.VString<string | undefined, "optional">;
+        }, "required", "name" | "userId" | "clientId" | "codeId" | "scopes" | "redirectUri" | "grantType" | "resource">, convex_values5.VObject<{
+          userId?: string | undefined;
+          connectionId?: string | undefined;
+          verifiedAt?: number | undefined;
+          expiresAt?: number | undefined;
+          version?: number | undefined;
+          protocol?: "oidc" | "saml" | undefined;
+          domain?: string | undefined;
+          recordName?: string | undefined;
+          errorCode?: string | undefined;
+          changed?: string[] | undefined;
+          metadataUrl?: string | undefined;
+          domains?: string[] | undefined;
+          issuer?: string | undefined;
+          discoveryUrl?: string | undefined;
+          jwksUri?: string | undefined;
+          audience?: string | string[] | undefined;
+          tokenEndpointAuthMethod?: string | undefined;
+        }, {
+          connectionId: convex_values5.VString<string | undefined, "optional">;
+          changed: convex_values5.VArray<string[] | undefined, convex_values5.VString<string, "required">, "optional">;
+          userId: convex_values5.VString<string | undefined, "optional">;
+          protocol: convex_values5.VUnion<"oidc" | "saml" | undefined, [convex_values5.VLiteral<"oidc", "required">, convex_values5.VLiteral<"saml", "required">], "optional", never>;
+          domain: convex_values5.VString<string | undefined, "optional">;
+          recordName: convex_values5.VString<string | undefined, "optional">;
+          expiresAt: convex_values5.VFloat64<number | undefined, "optional">;
+          verifiedAt: convex_values5.VFloat64<number | undefined, "optional">;
+          metadataUrl: convex_values5.VString<string | undefined, "optional">;
+          domains: convex_values5.VArray<string[] | undefined, convex_values5.VString<string, "required">, "optional">;
+          issuer: convex_values5.VString<string | undefined, "optional">;
+          discoveryUrl: convex_values5.VString<string | undefined, "optional">;
+          jwksUri: convex_values5.VString<string | undefined, "optional">;
+          audience: convex_values5.VUnion<string | string[] | undefined, [convex_values5.VString<string, "required">, convex_values5.VArray<string[], convex_values5.VString<string, "required">, "required">], "optional", never>;
+          tokenEndpointAuthMethod: convex_values5.VString<string | undefined, "optional">;
+          version: convex_values5.VFloat64<number | undefined, "optional">;
+          errorCode: convex_values5.VString<string | undefined, "optional">;
+        }, "required", "userId" | "connectionId" | "verifiedAt" | "expiresAt" | "version" | "protocol" | "domain" | "recordName" | "errorCode" | "changed" | "metadataUrl" | "domains" | "issuer" | "discoveryUrl" | "jwksUri" | "audience" | "tokenEndpointAuthMethod">, convex_values5.VObject<{
+          userId?: string | undefined;
+          externalId?: string | undefined;
+          groupId?: string | undefined;
+          active?: boolean | undefined;
+          resourceType?: "user" | "group" | undefined;
+          scimConfigId?: string | undefined;
+          resourceId?: string | undefined;
+          operation?: string | undefined;
+        }, {
+          scimConfigId: convex_values5.VString<string | undefined, "optional">;
+          resourceType: convex_values5.VUnion<"user" | "group" | undefined, [convex_values5.VLiteral<"user", "required">, convex_values5.VLiteral<"group", "required">], "optional", never>;
+          resourceId: convex_values5.VString<string | undefined, "optional">;
+          operation: convex_values5.VString<string | undefined, "optional">;
+          externalId: convex_values5.VString<string | undefined, "optional">;
+          active: convex_values5.VBoolean<boolean | undefined, "optional">;
+          groupId: convex_values5.VString<string | undefined, "optional">;
+          userId: convex_values5.VString<string | undefined, "optional">;
+        }, "required", "userId" | "externalId" | "groupId" | "active" | "resourceType" | "scimConfigId" | "resourceId" | "operation">, convex_values5.VObject<{
+          status?: number | undefined;
+          endpointId?: string | undefined;
+          deliveryId?: string | undefined;
+          sourceEventId?: string | undefined;
+          sourceEventType?: "user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed" | undefined;
+          attemptCount?: number | undefined;
+          error?: string | undefined;
+        }, {
+          endpointId: convex_values5.VString<string | undefined, "optional">;
+          deliveryId: convex_values5.VString<string | undefined, "optional">;
+          sourceEventId: convex_values5.VString<string | undefined, "optional">;
+          sourceEventType: convex_values5.VUnion<"user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed" | undefined, convex_values5.VLiteral<"user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed", "required">[], "optional", never>;
+          attemptCount: convex_values5.VFloat64<number | undefined, "optional">;
+          status: convex_values5.VFloat64<number | undefined, "optional">;
+          error: convex_values5.VString<string | undefined, "optional">;
+        }, "required", "status" | "endpointId" | "deliveryId" | "sourceEventId" | "sourceEventType" | "attemptCount" | "error">], "optional", "name" | "email" | "profile" | "phone" | "type" | "userId" | "accountId" | "provider" | "connectionId" | "providerAccountId" | "sessionId" | "credentialId" | "verifiedAt" | "status" | "expiresAt" | "version" | "externalId" | "protocol" | "groupId" | "active" | "domain" | "recordName" | "resourceType" | "errorCode" | "existingUserId" | `profile.${string}` | "method" | "reason" | "refreshTokenId" | "flow" | "passkeyId" | "totpId" | "keyId" | "prefix" | "clientId" | "codeId" | "scopes" | "redirectUri" | "grantType" | "resource" | "changed" | "metadataUrl" | "domains" | "issuer" | "discoveryUrl" | "jwksUri" | "audience" | "tokenEndpointAuthMethod" | "scimConfigId" | "resourceId" | "operation" | "endpointId" | "deliveryId" | "sourceEventId" | "sourceEventType" | "attemptCount" | "error">;
+      }, "required", "_creationTime" | "kind" | "requestId" | "targetKind" | "category" | "actorType" | "subjectType" | "outcome" | "eventId" | "targetId" | "occurredAt" | "actorId" | "subjectId" | "errorCode" | "ip" | "data" | "data.name" | "data.email" | "data.profile" | "data.phone" | "data.type" | "data.userId" | "data.accountId" | "data.provider" | "data.connectionId" | "data.providerAccountId" | "data.sessionId" | "data.credentialId" | "data.verifiedAt" | "data.status" | "data.expiresAt" | "data.version" | "data.externalId" | "data.protocol" | "data.groupId" | "data.active" | "data.domain" | "data.recordName" | "data.resourceType" | "data.errorCode" | "data.existingUserId" | `data.profile.${string}` | "data.method" | "data.reason" | "data.refreshTokenId" | "data.flow" | "data.passkeyId" | "data.totpId" | "data.keyId" | "data.prefix" | "data.clientId" | "data.codeId" | "data.scopes" | "data.redirectUri" | "data.grantType" | "data.resource" | "data.changed" | "data.metadataUrl" | "data.domains" | "data.issuer" | "data.discoveryUrl" | "data.jwksUri" | "data.audience" | "data.tokenEndpointAuthMethod" | "data.scimConfigId" | "data.resourceId" | "data.operation" | "data.endpointId" | "data.deliveryId" | "data.sourceEventId" | "data.sourceEventType" | "data.attemptCount" | "data.error" | "_id">;
+    };
+    webhook: {
+      endpoint: convex_values5.VObject<{
+        extend?: any;
+        createdByUserId?: string | undefined;
+        lastSuccessAt?: number | undefined;
+        lastFailureAt?: number | undefined;
+        _creationTime: number;
+        connectionId: string;
+        status: "active" | "disabled";
+        groupId: string;
+        url: string;
+        subscriptions: ("user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed")[];
+        failureCount: number;
+        _id: string;
+        hasSecret: boolean;
+      }, {
+        _id: convex_values5.VString<string, "required">;
+        _creationTime: convex_values5.VFloat64<number, "required">;
+        connectionId: convex_values5.VString<string, "required">;
+        groupId: convex_values5.VString<string, "required">;
+        url: convex_values5.VString<string, "required">;
+        status: convex_values5.VUnion<"active" | "disabled", [convex_values5.VLiteral<"active", "required">, convex_values5.VLiteral<"disabled", "required">], "required", never>;
+        subscriptions: convex_values5.VArray<("user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed")[], convex_values5.VUnion<"user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed", convex_values5.VLiteral<"user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed", "required">[], "required", never>, "required">;
+        createdByUserId: convex_values5.VString<string | undefined, "optional">;
+        lastSuccessAt: convex_values5.VFloat64<number | undefined, "optional">;
+        lastFailureAt: convex_values5.VFloat64<number | undefined, "optional">;
+        failureCount: convex_values5.VFloat64<number, "required">;
+        extend: convex_values5.VAny<any, "optional", string>;
+        hasSecret: convex_values5.VBoolean<boolean, "required">;
+      }, "required", "_creationTime" | "extend" | `extend.${string}` | "connectionId" | "status" | "groupId" | "url" | "subscriptions" | "createdByUserId" | "lastSuccessAt" | "lastFailureAt" | "failureCount" | "_id" | "hasSecret">;
+      delivery: convex_values5.VObject<{
+        lastAttemptAt?: number | undefined;
+        lastResponseStatus?: number | undefined;
+        lastError?: string | undefined;
+        _creationTime: number;
+        connectionId: string;
+        status: "pending" | "processing" | "delivered" | "failed";
+        kind: "user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed";
+        eventId: string;
+        endpointId: string;
+        attemptCount: number;
+        nextAttemptAt: number;
+        signedAt: number;
+        _id: string;
+      }, {
+        _id: convex_values5.VString<string, "required">;
+        _creationTime: convex_values5.VFloat64<number, "required">;
+        connectionId: convex_values5.VString<string, "required">;
+        endpointId: convex_values5.VString<string, "required">;
+        eventId: convex_values5.VString<string, "required">;
+        kind: convex_values5.VUnion<"user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed", convex_values5.VLiteral<"user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed", "required">[], "required", never>;
+        status: convex_values5.VUnion<"pending" | "processing" | "delivered" | "failed", [convex_values5.VLiteral<"pending", "required">, convex_values5.VLiteral<"processing", "required">, convex_values5.VLiteral<"delivered", "required">, convex_values5.VLiteral<"failed", "required">], "required", never>;
+        attemptCount: convex_values5.VFloat64<number, "required">;
+        nextAttemptAt: convex_values5.VFloat64<number, "required">;
+        lastAttemptAt: convex_values5.VFloat64<number | undefined, "optional">;
+        lastResponseStatus: convex_values5.VFloat64<number | undefined, "optional">;
+        lastError: convex_values5.VString<string | undefined, "optional">;
+        signedAt: convex_values5.VFloat64<number, "required">;
+      }, "required", "_creationTime" | "connectionId" | "status" | "kind" | "eventId" | "endpointId" | "attemptCount" | "nextAttemptAt" | "lastAttemptAt" | "lastResponseStatus" | "lastError" | "signedAt" | "_id">;
+      disabled: convex_values5.VObject<{
+        endpointId: string;
+      }, {
+        endpointId: convex_values5.VString<string, "required">;
+      }, "required", "endpointId">;
+    };
+  };
+};
+/**
+ * The `auth.v` namespace type, parameterized by the consumer's `extend`.
+ *
+ * @typeParam TExtend - The consumer's per-table `extend` validators.
+ */
+type AuthValidators<TExtend extends AuthExtendValidators = {}> = ReturnType<typeof createAuthValidators<TExtend>>;
+/**
+ * Inferred current-user document type (extend-aware).
+ *
+ * @typeParam TExtend - The consumer's per-table `extend` validators.
+ */
+type Viewer<TExtend extends AuthExtendValidators = {}> = Infer<AuthValidators<TExtend>["user"]>;
+/**
+ * Inferred Group document type (extend-aware).
+ *
+ * @typeParam TExtend - The consumer's per-table `extend` validators.
+ */
+type Group<TExtend extends AuthExtendValidators = {}> = Infer<AuthValidators<TExtend>["group"]>;
+/**
+ * Inferred GroupMember document type (extend-aware).
+ *
+ * @typeParam TExtend - The consumer's per-table `extend` validators.
+ */
+type Membership<TExtend extends AuthExtendValidators = {}> = Infer<AuthValidators<TExtend>["member"]>;
+//#endregion
+export { AuthExtendValidators, AuthValidators, Group, Membership, Viewer, createAuthValidators };
+//# sourceMappingURL=validators.d.ts.map