@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/component/schema.d.ts

@@ -1,5 +1,5 @@
-import * as convex_server66 from "convex/server";
-import * as convex_values695 from "convex/values";
+import * as convex_values87 from "convex/values";
+import * as convex_server81 from "convex/server";
 
 //#region src/component/schema.d.ts
 /**
@@ -9,30 +9,30 @@ import * as convex_values695 from "convex/values";
  * verification codes, PKCE verifiers, rate limits) and hierarchical group
  * management (groups, members, invites).
  */
-declare const _default: convex_server66.SchemaDefinition<{
+declare const _default: convex_server81.SchemaDefinition<{
   /**
    * Authenticated users. A user may have multiple linked accounts
    * and multiple concurrent sessions.
    */
-  User: convex_server66.TableDefinition<convex_values695.VObject<{
-    phone?: string | undefined;
-    name?: string | undefined;
+  User: convex_server81.TableDefinition<convex_values87.VObject<{
     email?: string | undefined;
-    extend?: any;
+    name?: string | undefined;
     image?: string | undefined;
+    phone?: string | undefined;
+    extend?: any;
     emailVerificationTime?: number | undefined;
     phoneVerificationTime?: number | undefined;
     isAnonymous?: boolean | undefined;
   }, {
-    name: convex_values695.VString<string | undefined, "optional">;
-    image: convex_values695.VString<string | undefined, "optional">;
-    email: convex_values695.VString<string | undefined, "optional">;
-    emailVerificationTime: convex_values695.VFloat64<number | undefined, "optional">;
-    phone: convex_values695.VString<string | undefined, "optional">;
-    phoneVerificationTime: convex_values695.VFloat64<number | undefined, "optional">;
-    isAnonymous: convex_values695.VBoolean<boolean | undefined, "optional">;
-    extend: convex_values695.VAny<any, "optional", string>;
-  }, "required", "phone" | "name" | "email" | "extend" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | `extend.${string}`>, {
+    name: convex_values87.VString<string | undefined, "optional">;
+    image: convex_values87.VString<string | undefined, "optional">;
+    email: convex_values87.VString<string | undefined, "optional">;
+    emailVerificationTime: convex_values87.VFloat64<number | undefined, "optional">;
+    phone: convex_values87.VString<string | undefined, "optional">;
+    phoneVerificationTime: convex_values87.VFloat64<number | undefined, "optional">;
+    isAnonymous: convex_values87.VBoolean<boolean | undefined, "optional">;
+    extend: convex_values87.VAny<any, "optional", string>;
+  }, "required", "email" | "name" | "image" | "phone" | "extend" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | `extend.${string}`>, {
     email: ["email", "_creationTime"];
     email_verified: ["email", "emailVerificationTime", "_creationTime"];
     phone: ["phone", "_creationTime"];
@@ -43,12 +43,12 @@ declare const _default: convex_server66.SchemaDefinition<{
    * across different devices or browsers. Sessions expire after a
    * configurable duration.
    */
-  Session: convex_server66.TableDefinition<convex_values695.VObject<{
-    userId: convex_values695.GenericId<"User">;
+  Session: convex_server81.TableDefinition<convex_values87.VObject<{
+    userId: convex_values87.GenericId<"User">;
     expirationTime: number;
   }, {
-    userId: convex_values695.VId<convex_values695.GenericId<"User">, "required">;
-    expirationTime: convex_values695.VFloat64<number, "required">;
+    userId: convex_values87.VId<convex_values87.GenericId<"User">, "required">;
+    expirationTime: convex_values87.VFloat64<number, "required">;
   }, "required", "userId" | "expirationTime">, {
     user_id: ["userId", "_creationTime"];
   }, {}, {}>;
@@ -57,23 +57,23 @@ declare const _default: convex_server66.SchemaDefinition<{
    * authentication provider (e.g. Google OAuth, email/password).
    * A user can have multiple accounts linked.
    */
-  Account: convex_server66.TableDefinition<convex_values695.VObject<{
+  Account: convex_server81.TableDefinition<convex_values87.VObject<{
+    emailVerified?: string | undefined;
     extend?: any;
     secret?: string | undefined;
-    emailVerified?: string | undefined;
     phoneVerified?: string | undefined;
-    userId: convex_values695.GenericId<"User">;
+    userId: convex_values87.GenericId<"User">;
     provider: string;
     providerAccountId: string;
   }, {
-    userId: convex_values695.VId<convex_values695.GenericId<"User">, "required">;
-    provider: convex_values695.VString<string, "required">;
-    providerAccountId: convex_values695.VString<string, "required">;
-    secret: convex_values695.VString<string | undefined, "optional">;
-    emailVerified: convex_values695.VString<string | undefined, "optional">;
-    phoneVerified: convex_values695.VString<string | undefined, "optional">;
-    extend: convex_values695.VAny<any, "optional", string>;
-  }, "required", "userId" | "extend" | "provider" | "providerAccountId" | "secret" | `extend.${string}` | "emailVerified" | "phoneVerified">, {
+    userId: convex_values87.VId<convex_values87.GenericId<"User">, "required">;
+    provider: convex_values87.VString<string, "required">;
+    providerAccountId: convex_values87.VString<string, "required">;
+    secret: convex_values87.VString<string | undefined, "optional">;
+    emailVerified: convex_values87.VString<string | undefined, "optional">;
+    phoneVerified: convex_values87.VString<string | undefined, "optional">;
+    extend: convex_values87.VAny<any, "optional", string>;
+  }, "required", "emailVerified" | "userId" | "extend" | `extend.${string}` | "provider" | "providerAccountId" | "secret" | "phoneVerified">, {
     user_id_provider: ["userId", "provider", "_creationTime"];
     provider_account_id: ["provider", "providerAccountId", "_creationTime"];
   }, {}, {}>;
@@ -85,17 +85,17 @@ declare const _default: convex_server66.SchemaDefinition<{
    * been used yet. A 10-second reuse window allows for concurrent requests.
    * Any invalid use of a token invalidates the entire chain.
    */
-  RefreshToken: convex_server66.TableDefinition<convex_values695.VObject<{
+  RefreshToken: convex_server81.TableDefinition<convex_values87.VObject<{
     firstUsedTime?: number | undefined;
-    parentRefreshTokenId?: convex_values695.GenericId<"RefreshToken"> | undefined;
-    sessionId: convex_values695.GenericId<"Session">;
+    parentRefreshTokenId?: convex_values87.GenericId<"RefreshToken"> | undefined;
     expirationTime: number;
+    sessionId: convex_values87.GenericId<"Session">;
   }, {
-    sessionId: convex_values695.VId<convex_values695.GenericId<"Session">, "required">;
-    expirationTime: convex_values695.VFloat64<number, "required">;
-    firstUsedTime: convex_values695.VFloat64<number | undefined, "optional">;
-    parentRefreshTokenId: convex_values695.VId<convex_values695.GenericId<"RefreshToken"> | undefined, "optional">;
-  }, "required", "sessionId" | "expirationTime" | "firstUsedTime" | "parentRefreshTokenId">, {
+    sessionId: convex_values87.VId<convex_values87.GenericId<"Session">, "required">;
+    expirationTime: convex_values87.VFloat64<number, "required">;
+    firstUsedTime: convex_values87.VFloat64<number | undefined, "optional">;
+    parentRefreshTokenId: convex_values87.VId<convex_values87.GenericId<"RefreshToken"> | undefined, "optional">;
+  }, "required", "expirationTime" | "sessionId" | "firstUsedTime" | "parentRefreshTokenId">, {
     session_id: ["sessionId", "_creationTime"];
     session_id_first_used: ["sessionId", "firstUsedTime", "_creationTime"];
     session_id_parent_refresh_token_id: ["sessionId", "parentRefreshTokenId", "_creationTime"];
@@ -103,23 +103,23 @@ declare const _default: convex_server66.SchemaDefinition<{
   /**
    * Verification codes for OTP tokens, magic link tokens, and OAuth codes.
    */
-  VerificationCode: convex_server66.TableDefinition<convex_values695.VObject<{
-    verifier?: string | undefined;
+  VerificationCode: convex_server81.TableDefinition<convex_values87.VObject<{
     emailVerified?: string | undefined;
     phoneVerified?: string | undefined;
+    verifier?: string | undefined;
+    expirationTime: number;
     provider: string;
-    accountId: convex_values695.GenericId<"Account">;
+    accountId: convex_values87.GenericId<"Account">;
     code: string;
-    expirationTime: number;
   }, {
-    accountId: convex_values695.VId<convex_values695.GenericId<"Account">, "required">;
-    provider: convex_values695.VString<string, "required">;
-    code: convex_values695.VString<string, "required">;
-    expirationTime: convex_values695.VFloat64<number, "required">;
-    verifier: convex_values695.VString<string | undefined, "optional">;
-    emailVerified: convex_values695.VString<string | undefined, "optional">;
-    phoneVerified: convex_values695.VString<string | undefined, "optional">;
-  }, "required", "provider" | "verifier" | "accountId" | "code" | "expirationTime" | "emailVerified" | "phoneVerified">, {
+    accountId: convex_values87.VId<convex_values87.GenericId<"Account">, "required">;
+    provider: convex_values87.VString<string, "required">;
+    code: convex_values87.VString<string, "required">;
+    expirationTime: convex_values87.VFloat64<number, "required">;
+    verifier: convex_values87.VString<string | undefined, "optional">;
+    emailVerified: convex_values87.VString<string | undefined, "optional">;
+    phoneVerified: convex_values87.VString<string | undefined, "optional">;
+  }, "required", "emailVerified" | "expirationTime" | "provider" | "phoneVerified" | "accountId" | "code" | "verifier">, {
     account_id: ["accountId", "_creationTime"];
     code: ["code", "_creationTime"];
   }, {}, {}>;
@@ -127,12 +127,12 @@ declare const _default: convex_server66.SchemaDefinition<{
    * PKCE verifiers for OAuth flows. Stores the cryptographic verifier
    * used to prove the authorization request originated from this client.
    */
-  AuthVerifier: convex_server66.TableDefinition<convex_values695.VObject<{
-    sessionId?: convex_values695.GenericId<"Session"> | undefined;
+  AuthVerifier: convex_server81.TableDefinition<convex_values87.VObject<{
+    sessionId?: convex_values87.GenericId<"Session"> | undefined;
     signature?: string | undefined;
   }, {
-    sessionId: convex_values695.VId<convex_values695.GenericId<"Session"> | undefined, "optional">;
-    signature: convex_values695.VString<string | undefined, "optional">;
+    sessionId: convex_values87.VId<convex_values87.GenericId<"Session"> | undefined, "optional">;
+    signature: convex_values87.VString<string | undefined, "optional">;
   }, "required", "sessionId" | "signature">, {
     signature: ["signature", "_creationTime"];
   }, {}, {}>;
@@ -141,11 +141,11 @@ declare const _default: convex_server66.SchemaDefinition<{
    * registered authenticator (Touch ID, Face ID, security key, etc.).
    * A user can have multiple passkeys across different devices.
    */
-  Passkey: convex_server66.TableDefinition<convex_values695.VObject<{
+  Passkey: convex_server81.TableDefinition<convex_values87.VObject<{
     name?: string | undefined;
     lastUsedAt?: number | undefined;
     transports?: string[] | undefined;
-    userId: convex_values695.GenericId<"User">;
+    userId: convex_values87.GenericId<"User">;
     createdAt: number;
     credentialId: string;
     publicKey: ArrayBuffer;
@@ -154,17 +154,17 @@ declare const _default: convex_server66.SchemaDefinition<{
     deviceType: string;
     backedUp: boolean;
   }, {
-    userId: convex_values695.VId<convex_values695.GenericId<"User">, "required">; /** Base64url-encoded credential ID from the authenticator. */
-    credentialId: convex_values695.VString<string, "required">; /** Public key bytes (SEC1 uncompressed for EC, SPKI for RSA). */
-    publicKey: convex_values695.VBytes<ArrayBuffer, "required">; /** COSE algorithm identifier (-7 for ES256, -257 for RS256, -8 for EdDSA). */
-    algorithm: convex_values695.VFloat64<number, "required">; /** Signature counter for clone detection. Many authenticators return 0. */
-    counter: convex_values695.VFloat64<number, "required">; /** Authenticator transport hints (e.g. "internal", "hybrid", "usb", "ble", "nfc"). */
-    transports: convex_values695.VArray<string[] | undefined, convex_values695.VString<string, "required">, "optional">; /** Whether this is a single-device or multi-device (synced) credential. */
-    deviceType: convex_values695.VString<string, "required">; /** Whether the credential is backed up (synced passkey). */
-    backedUp: convex_values695.VBoolean<boolean, "required">; /** User-assigned friendly name (e.g. "MacBook Touch ID"). */
-    name: convex_values695.VString<string | undefined, "optional">;
-    createdAt: convex_values695.VFloat64<number, "required">;
-    lastUsedAt: convex_values695.VFloat64<number | undefined, "optional">;
+    userId: convex_values87.VId<convex_values87.GenericId<"User">, "required">; /** Base64url-encoded credential ID from the authenticator. */
+    credentialId: convex_values87.VString<string, "required">; /** Public key bytes (SEC1 uncompressed for EC, SPKI for RSA). */
+    publicKey: convex_values87.VBytes<ArrayBuffer, "required">; /** COSE algorithm identifier (-7 for ES256, -257 for RS256, -8 for EdDSA). */
+    algorithm: convex_values87.VFloat64<number, "required">; /** Signature counter for clone detection. Many authenticators return 0. */
+    counter: convex_values87.VFloat64<number, "required">; /** Authenticator transport hints (e.g. "internal", "hybrid", "usb", "ble", "nfc"). */
+    transports: convex_values87.VArray<string[] | undefined, convex_values87.VString<string, "required">, "optional">; /** Whether this is a single-device or multi-device (synced) credential. */
+    deviceType: convex_values87.VString<string, "required">; /** Whether the credential is backed up (synced passkey). */
+    backedUp: convex_values87.VBoolean<boolean, "required">; /** User-assigned friendly name (e.g. "MacBook Touch ID"). */
+    name: convex_values87.VString<string | undefined, "optional">;
+    createdAt: convex_values87.VFloat64<number, "required">;
+    lastUsedAt: convex_values87.VFloat64<number | undefined, "optional">;
   }, "required", "name" | "lastUsedAt" | "userId" | "createdAt" | "credentialId" | "publicKey" | "algorithm" | "counter" | "transports" | "deviceType" | "backedUp">, {
     user_id: ["userId", "_creationTime"];
     credential_id: ["credentialId", "_creationTime"];
@@ -178,24 +178,24 @@ declare const _default: convex_server66.SchemaDefinition<{
    * by successfully entering a code from their authenticator app.
    * Unverified enrollments are in-progress setup that can be discarded.
    */
-  TotpFactor: convex_server66.TableDefinition<convex_values695.VObject<{
+  TotpFactor: convex_server81.TableDefinition<convex_values87.VObject<{
     name?: string | undefined;
     lastUsedAt?: number | undefined;
-    userId: convex_values695.GenericId<"User">;
+    userId: convex_values87.GenericId<"User">;
     createdAt: number;
     secret: ArrayBuffer;
     digits: number;
     period: number;
     verified: boolean;
   }, {
-    userId: convex_values695.VId<convex_values695.GenericId<"User">, "required">; /** Raw TOTP secret key bytes. */
-    secret: convex_values695.VBytes<ArrayBuffer, "required">; /** Number of digits in each code (typically 6). */
-    digits: convex_values695.VFloat64<number, "required">; /** Time period in seconds for code rotation (typically 30). */
-    period: convex_values695.VFloat64<number, "required">; /** Whether setup has been confirmed with a valid code. */
-    verified: convex_values695.VBoolean<boolean, "required">; /** User-assigned friendly name (e.g. "Google Authenticator"). */
-    name: convex_values695.VString<string | undefined, "optional">;
-    createdAt: convex_values695.VFloat64<number, "required">;
-    lastUsedAt: convex_values695.VFloat64<number | undefined, "optional">;
+    userId: convex_values87.VId<convex_values87.GenericId<"User">, "required">; /** Raw TOTP secret key bytes. */
+    secret: convex_values87.VBytes<ArrayBuffer, "required">; /** Number of digits in each code (typically 6). */
+    digits: convex_values87.VFloat64<number, "required">; /** Time period in seconds for code rotation (typically 30). */
+    period: convex_values87.VFloat64<number, "required">; /** Whether setup has been confirmed with a valid code. */
+    verified: convex_values87.VBoolean<boolean, "required">; /** User-assigned friendly name (e.g. "Google Authenticator"). */
+    name: convex_values87.VString<string | undefined, "optional">;
+    createdAt: convex_values87.VFloat64<number, "required">;
+    lastUsedAt: convex_values87.VFloat64<number | undefined, "optional">;
   }, "required", "name" | "lastUsedAt" | "userId" | "createdAt" | "secret" | "digits" | "period" | "verified">, {
     user_id: ["userId", "_creationTime"];
     user_id_verified: ["userId", "verified", "_creationTime"];
@@ -205,9 +205,9 @@ declare const _default: convex_server66.SchemaDefinition<{
    * device auth session — the device polls with `deviceCode` while the
    * user authorizes via `userCode` on a secondary device.
    */
-  DeviceCode: convex_server66.TableDefinition<convex_values695.VObject<{
-    userId?: convex_values695.GenericId<"User"> | undefined;
-    sessionId?: convex_values695.GenericId<"Session"> | undefined;
+  DeviceCode: convex_server81.TableDefinition<convex_values87.VObject<{
+    userId?: convex_values87.GenericId<"User"> | undefined;
+    sessionId?: convex_values87.GenericId<"Session"> | undefined;
     lastPolledAt?: number | undefined;
     status: "pending" | "authorized" | "denied";
     expiresAt: number;
@@ -215,14 +215,14 @@ declare const _default: convex_server66.SchemaDefinition<{
     userCode: string;
     interval: number;
   }, {
-    /** High-entropy code used by the device for polling. Stored as SHA-256 hash. */deviceCodeHash: convex_values695.VString<string, "required">; /** Short human-readable code the user enters (e.g. "WDJB-MJHT"). */
-    userCode: convex_values695.VString<string, "required">; /** Expiration timestamp (ms since epoch). */
-    expiresAt: convex_values695.VFloat64<number, "required">; /** Minimum polling interval in seconds. */
-    interval: convex_values695.VFloat64<number, "required">; /** Current status of this device authorization session. */
-    status: convex_values695.VUnion<"pending" | "authorized" | "denied", [convex_values695.VLiteral<"pending", "required">, convex_values695.VLiteral<"authorized", "required">, convex_values695.VLiteral<"denied", "required">], "required", never>; /** Set when the user authorizes — links to the authorizing user. */
-    userId: convex_values695.VId<convex_values695.GenericId<"User"> | undefined, "optional">; /** Set when the user authorizes — the session created for the device. */
-    sessionId: convex_values695.VId<convex_values695.GenericId<"Session"> | undefined, "optional">; /** Timestamp of the last poll request (for slow_down enforcement). */
-    lastPolledAt: convex_values695.VFloat64<number | undefined, "optional">;
+    /** High-entropy code used by the device for polling. Stored as SHA-256 hash. */deviceCodeHash: convex_values87.VString<string, "required">; /** Short human-readable code the user enters (e.g. "WDJB-MJHT"). */
+    userCode: convex_values87.VString<string, "required">; /** Expiration timestamp (ms since epoch). */
+    expiresAt: convex_values87.VFloat64<number, "required">; /** Minimum polling interval in seconds. */
+    interval: convex_values87.VFloat64<number, "required">; /** Current status of this device authorization session. */
+    status: convex_values87.VUnion<"pending" | "authorized" | "denied", [convex_values87.VLiteral<"pending", "required">, convex_values87.VLiteral<"authorized", "required">, convex_values87.VLiteral<"denied", "required">], "required", never>; /** Set when the user authorizes — links to the authorizing user. */
+    userId: convex_values87.VId<convex_values87.GenericId<"User"> | undefined, "optional">; /** Set when the user authorizes — the session created for the device. */
+    sessionId: convex_values87.VId<convex_values87.GenericId<"Session"> | undefined, "optional">; /** Timestamp of the last poll request (for slow_down enforcement). */
+    lastPolledAt: convex_values87.VFloat64<number | undefined, "optional">;
   }, "required", "status" | "expiresAt" | "userId" | "sessionId" | "deviceCodeHash" | "userCode" | "interval" | "lastPolledAt">, {
     device_code_hash: ["deviceCodeHash", "_creationTime"];
     user_code_status: ["userCode", "status", "_creationTime"];
@@ -230,14 +230,14 @@ declare const _default: convex_server66.SchemaDefinition<{
   /**
    * Rate limit tracking for OTP and password sign-in attempts.
    */
-  RateLimit: convex_server66.TableDefinition<convex_values695.VObject<{
+  RateLimit: convex_server81.TableDefinition<convex_values87.VObject<{
     identifier: string;
     last_attempt_time: number;
     attempts_left: number;
   }, {
-    identifier: convex_values695.VString<string, "required">;
-    last_attempt_time: convex_values695.VFloat64<number, "required">;
-    attempts_left: convex_values695.VFloat64<number, "required">;
+    identifier: convex_values87.VString<string, "required">;
+    last_attempt_time: convex_values87.VFloat64<number, "required">;
+    attempts_left: convex_values87.VFloat64<number, "required">;
   }, "required", "identifier" | "last_attempt_time" | "attempts_left">, {
     by_identifier: ["identifier", "_creationTime"];
   }, {}, {}>;
@@ -246,139 +246,17 @@ declare const _default: convex_server66.SchemaDefinition<{
    * Groups can nest arbitrarily deep via `parentGroupId` for modeling
    * organizations, teams, departments, or any tree structure.
    */
-  Group: convex_server66.TableDefinition<convex_values695.VObject<{
+  Group: convex_server81.TableDefinition<convex_values87.VObject<{
     slug?: string | undefined;
     type?: string | undefined;
     extend?: any;
-    parentGroupId?: convex_values695.GenericId<"Group"> | undefined;
-    rootGroupId?: convex_values695.GenericId<"Group"> | undefined;
+    parentGroupId?: convex_values87.GenericId<"Group"> | undefined;
+    rootGroupId?: convex_values87.GenericId<"Group"> | undefined;
     isRoot?: boolean | undefined;
     tags?: {
-      value: string;
-      key: string;
-    }[] | undefined;
-    name: string;
-  }, {
-    name: convex_values695.VString<string, "required">;
-    slug: convex_values695.VString<string | undefined, "optional">;
-    type: convex_values695.VString<string | undefined, "optional">;
-    parentGroupId: convex_values695.VId<convex_values695.GenericId<"Group"> | undefined, "optional">; /** Denormalized root group ID. Self-referencing for root groups. */
-    rootGroupId: convex_values695.VId<convex_values695.GenericId<"Group"> | undefined, "optional">; /** Denormalized flag: `true` when `parentGroupId` is absent. */
-    isRoot: convex_values695.VBoolean<boolean | undefined, "optional">; /** Faceted classification tags. Normalized at write time (trimmed, lowercased). */
-    tags: convex_values695.VArray<{
-      value: string;
       key: string;
-    }[] | undefined, convex_values695.VObject<{
       value: string;
-      key: string;
-    }, {
-      key: convex_values695.VString<string, "required">;
-      value: convex_values695.VString<string, "required">;
-    }, "required", "value" | "key">, "optional">;
-    extend: convex_values695.VAny<any, "optional", string>;
-  }, "required", "name" | "slug" | "type" | "extend" | `extend.${string}` | "parentGroupId" | "rootGroupId" | "isRoot" | "tags">, {
-    slug: ["slug", "_creationTime"];
-    parent_group_id: ["parentGroupId", "_creationTime"];
-    root_group_id: ["rootGroupId", "_creationTime"];
-    is_root: ["isRoot", "_creationTime"];
-    type: ["type", "_creationTime"];
-    type_parent_group_id: ["type", "parentGroupId", "_creationTime"];
-  }, {}, {}>;
-  /**
-   * Denormalized group-tag index table for efficient tag-based filtering.
-   * Each row maps one `(key, value)` pair to a group. Kept in sync by
-   * `groupCreate`, `groupUpdate`, and `groupDelete`.
-   */
-  GroupTag: convex_server66.TableDefinition<convex_values695.VObject<{
-    value: string;
-    key: string;
-    group_id: convex_values695.GenericId<"Group">;
-  }, {
-    group_id: convex_values695.VId<convex_values695.GenericId<"Group">, "required">;
-    key: convex_values695.VString<string, "required">;
-    value: convex_values695.VString<string, "required">;
-  }, "required", "value" | "key" | "group_id">, {
-    by_group: ["group_id", "_creationTime"];
-    by_key_value: ["key", "value", "_creationTime"];
-    by_key: ["key", "_creationTime"];
-  }, {}, {}>;
-  /**
-   * Group membership. Links a user to a group with an application-defined
-   * role (e.g. "owner", "admin", "member", "viewer"). A user can be a
-   * member of multiple groups with different roles in each.
-   */
-  GroupMember: convex_server66.TableDefinition<convex_values695.VObject<{
-    status?: string | undefined;
-    extend?: any;
-    role?: string | undefined;
-    roleIds?: string[] | undefined;
-    userId: convex_values695.GenericId<"User">;
-    groupId: convex_values695.GenericId<"Group">;
-  }, {
-    groupId: convex_values695.VId<convex_values695.GenericId<"Group">, "required">;
-    userId: convex_values695.VId<convex_values695.GenericId<"User">, "required">;
-    role: convex_values695.VString<string | undefined, "optional">;
-    roleIds: convex_values695.VArray<string[] | undefined, convex_values695.VString<string, "required">, "optional">;
-    status: convex_values695.VString<string | undefined, "optional">;
-    extend: convex_values695.VAny<any, "optional", string>;
-  }, "required", "status" | "userId" | "extend" | "groupId" | `extend.${string}` | "role" | "roleIds">, {
-    group_id: ["groupId", "_creationTime"];
-    group_id_user_id: ["groupId", "userId", "_creationTime"];
-    group_id_status: ["groupId", "status", "_creationTime"];
-    user_id: ["userId", "_creationTime"];
-  }, {}, {}>;
-  /**
-   * Invitations. Tracks pending, accepted, revoked, and expired
-   * invitations. Optionally scoped to a group via `groupId`, or
-   * platform-level when `groupId` is omitted.
-   *
-   * `email` and `invitedByUserId` are optional to support CLI-generated
-   * invite links where neither is known upfront.
-   */
-  GroupInvite: convex_server66.TableDefinition<convex_values695.VObject<{
-    email?: string | undefined;
-    expiresTime?: number | undefined;
-    acceptedTime?: number | undefined;
-    extend?: any;
-    groupId?: convex_values695.GenericId<"Group"> | undefined;
-    acceptedByUserId?: convex_values695.GenericId<"User"> | undefined;
-    role?: string | undefined;
-    roleIds?: string[] | undefined;
-    invitedByUserId?: convex_values695.GenericId<"User"> | undefined;
-    status: "pending" | "accepted" | "revoked" | "expired";
-    tokenHash: string;
-  }, {
-    groupId: convex_values695.VId<convex_values695.GenericId<"Group"> | undefined, "optional">;
-    invitedByUserId: convex_values695.VId<convex_values695.GenericId<"User"> | undefined, "optional">;
-    email: convex_values695.VString<string | undefined, "optional">;
-    tokenHash: convex_values695.VString<string, "required">;
-    role: convex_values695.VString<string | undefined, "optional">;
-    roleIds: convex_values695.VArray<string[] | undefined, convex_values695.VString<string, "required">, "optional">;
-    status: convex_values695.VUnion<"pending" | "accepted" | "revoked" | "expired", [convex_values695.VLiteral<"pending", "required">, convex_values695.VLiteral<"accepted", "required">, convex_values695.VLiteral<"revoked", "required">, convex_values695.VLiteral<"expired", "required">], "required", never>;
-    expiresTime: convex_values695.VFloat64<number | undefined, "optional">;
-    acceptedByUserId: convex_values695.VId<convex_values695.GenericId<"User"> | undefined, "optional">;
-    acceptedTime: convex_values695.VFloat64<number | undefined, "optional">;
-    extend: convex_values695.VAny<any, "optional", string>;
-  }, "required", "email" | "status" | "expiresTime" | "acceptedTime" | "extend" | "groupId" | "tokenHash" | "acceptedByUserId" | `extend.${string}` | "role" | "roleIds" | "invitedByUserId">, {
-    token_hash: ["tokenHash", "_creationTime"];
-    status: ["status", "_creationTime"];
-    email_status: ["email", "status", "_creationTime"];
-    invited_by_user_id_status: ["invitedByUserId", "status", "_creationTime"];
-    group_id: ["groupId", "_creationTime"];
-    group_id_status: ["groupId", "status", "_creationTime"];
-  }, {}, {}>;
-  /**
-   * Enterprise configuration attached to a root group/organization.
-   *
-   * The `config` payload intentionally stays flexible so the headless enterprise
-   * SDK can evolve without forcing schema churn for every protocol-specific
-   * field addition.
-   */
-  Enterprise: convex_server66.TableDefinition<convex_values695.VObject<{
-    name?: string | undefined;
-    slug?: string | undefined;
-    extend?: any;
-    config?: any;
+    }[] | undefined;
     policy?: {
       extend?: any;
       version: 1;
@@ -389,6 +267,12 @@ declare const _default: convex_server66.SchemaDefinition<{
         };
       };
       provisioning: {
+        user: {
+          createOnSignIn: boolean;
+          updateProfileOnLogin: "never" | "missing" | "always";
+          updateProfileFromScim: "never" | "missing" | "always";
+          authority: "app" | "sso" | "scim";
+        };
         scimReuse: {
           user: "none" | "externalId";
         };
@@ -400,16 +284,37 @@ declare const _default: convex_server66.SchemaDefinition<{
         deprovision: {
           mode: "soft" | "hard";
         };
+        groups: {
+          mapping?: Record<string, string[]> | undefined;
+          mode: "ignore" | "sync";
+          source: "protocol";
+        };
+        roles: {
+          mapping?: Record<string, string[]> | undefined;
+          mode: "map" | "ignore";
+          source: "protocol";
+        };
       };
     } | undefined;
-    status: "draft" | "active" | "disabled";
-    groupId: convex_values695.GenericId<"Group">;
+    name: string;
   }, {
-    groupId: convex_values695.VId<convex_values695.GenericId<"Group">, "required">;
-    slug: convex_values695.VString<string | undefined, "optional">;
-    name: convex_values695.VString<string | undefined, "optional">;
-    status: convex_values695.VUnion<"draft" | "active" | "disabled", [convex_values695.VLiteral<"draft", "required">, convex_values695.VLiteral<"active", "required">, convex_values695.VLiteral<"disabled", "required">], "required", never>;
-    policy: convex_values695.VObject<{
+    name: convex_values87.VString<string, "required">;
+    slug: convex_values87.VString<string | undefined, "optional">;
+    type: convex_values87.VString<string | undefined, "optional">;
+    parentGroupId: convex_values87.VId<convex_values87.GenericId<"Group"> | undefined, "optional">; /** Denormalized root group ID. Self-referencing for root groups. */
+    rootGroupId: convex_values87.VId<convex_values87.GenericId<"Group"> | undefined, "optional">; /** Denormalized flag: `true` when `parentGroupId` is absent. */
+    isRoot: convex_values87.VBoolean<boolean | undefined, "optional">; /** Faceted classification tags. Normalized at write time (trimmed, lowercased). */
+    tags: convex_values87.VArray<{
+      key: string;
+      value: string;
+    }[] | undefined, convex_values87.VObject<{
+      key: string;
+      value: string;
+    }, {
+      key: convex_values87.VString<string, "required">;
+      value: convex_values87.VString<string, "required">;
+    }, "required", "key" | "value">, "optional">;
+    policy: convex_values87.VObject<{
       extend?: any;
       version: 1;
       identity: {
@@ -419,6 +324,12 @@ declare const _default: convex_server66.SchemaDefinition<{
         };
       };
       provisioning: {
+        user: {
+          createOnSignIn: boolean;
+          updateProfileOnLogin: "never" | "missing" | "always";
+          updateProfileFromScim: "never" | "missing" | "always";
+          authority: "app" | "sso" | "scim";
+        };
         scimReuse: {
           user: "none" | "externalId";
         };
@@ -430,24 +341,40 @@ declare const _default: convex_server66.SchemaDefinition<{
         deprovision: {
           mode: "soft" | "hard";
         };
+        groups: {
+          mapping?: Record<string, string[]> | undefined;
+          mode: "ignore" | "sync";
+          source: "protocol";
+        };
+        roles: {
+          mapping?: Record<string, string[]> | undefined;
+          mode: "map" | "ignore";
+          source: "protocol";
+        };
       };
     } | undefined, {
-      version: convex_values695.VLiteral<1, "required">;
-      identity: convex_values695.VObject<{
+      version: convex_values87.VLiteral<1, "required">;
+      identity: convex_values87.VObject<{
         accountLinking: {
           oidc: "verifiedEmail" | "none";
           saml: "verifiedEmail" | "none";
         };
       }, {
-        accountLinking: convex_values695.VObject<{
+        accountLinking: convex_values87.VObject<{
           oidc: "verifiedEmail" | "none";
           saml: "verifiedEmail" | "none";
         }, {
-          oidc: convex_values695.VUnion<"verifiedEmail" | "none", [convex_values695.VLiteral<"verifiedEmail", "required">, convex_values695.VLiteral<"none", "required">], "required", never>;
-          saml: convex_values695.VUnion<"verifiedEmail" | "none", [convex_values695.VLiteral<"verifiedEmail", "required">, convex_values695.VLiteral<"none", "required">], "required", never>;
+          oidc: convex_values87.VUnion<"verifiedEmail" | "none", [convex_values87.VLiteral<"verifiedEmail", "required">, convex_values87.VLiteral<"none", "required">], "required", never>;
+          saml: convex_values87.VUnion<"verifiedEmail" | "none", [convex_values87.VLiteral<"verifiedEmail", "required">, convex_values87.VLiteral<"none", "required">], "required", never>;
         }, "required", "oidc" | "saml">;
       }, "required", "accountLinking" | "accountLinking.oidc" | "accountLinking.saml">;
-      provisioning: convex_values695.VObject<{
+      provisioning: convex_values87.VObject<{
+        user: {
+          createOnSignIn: boolean;
+          updateProfileOnLogin: "never" | "missing" | "always";
+          updateProfileFromScim: "never" | "missing" | "always";
+          authority: "app" | "sso" | "scim";
+        };
         scimReuse: {
           user: "none" | "externalId";
         };
@@ -459,125 +386,277 @@ declare const _default: convex_server66.SchemaDefinition<{
         deprovision: {
           mode: "soft" | "hard";
         };
+        groups: {
+          mapping?: Record<string, string[]> | undefined;
+          mode: "ignore" | "sync";
+          source: "protocol";
+        };
+        roles: {
+          mapping?: Record<string, string[]> | undefined;
+          mode: "map" | "ignore";
+          source: "protocol";
+        };
       }, {
-        scimReuse: convex_values695.VObject<{
+        user: convex_values87.VObject<{
+          createOnSignIn: boolean;
+          updateProfileOnLogin: "never" | "missing" | "always";
+          updateProfileFromScim: "never" | "missing" | "always";
+          authority: "app" | "sso" | "scim";
+        }, {
+          createOnSignIn: convex_values87.VBoolean<boolean, "required">;
+          updateProfileOnLogin: convex_values87.VUnion<"never" | "missing" | "always", [convex_values87.VLiteral<"never", "required">, convex_values87.VLiteral<"missing", "required">, convex_values87.VLiteral<"always", "required">], "required", never>;
+          updateProfileFromScim: convex_values87.VUnion<"never" | "missing" | "always", [convex_values87.VLiteral<"never", "required">, convex_values87.VLiteral<"missing", "required">, convex_values87.VLiteral<"always", "required">], "required", never>;
+          authority: convex_values87.VUnion<"app" | "sso" | "scim", [convex_values87.VLiteral<"app", "required">, convex_values87.VLiteral<"sso", "required">, convex_values87.VLiteral<"scim", "required">], "required", never>;
+        }, "required", "createOnSignIn" | "updateProfileOnLogin" | "updateProfileFromScim" | "authority">;
+        scimReuse: convex_values87.VObject<{
           user: "none" | "externalId";
         }, {
-          user: convex_values695.VUnion<"none" | "externalId", [convex_values695.VLiteral<"externalId", "required">, convex_values695.VLiteral<"none", "required">], "required", never>;
+          user: convex_values87.VUnion<"none" | "externalId", [convex_values87.VLiteral<"externalId", "required">, convex_values87.VLiteral<"none", "required">], "required", never>;
         }, "required", "user">;
-        jit: convex_values695.VObject<{
+        jit: convex_values87.VObject<{
           defaultRole?: string | undefined;
           defaultRoleIds?: string[] | undefined;
           mode: "off" | "createUser" | "createUserAndMembership";
         }, {
-          mode: convex_values695.VUnion<"off" | "createUser" | "createUserAndMembership", [convex_values695.VLiteral<"off", "required">, convex_values695.VLiteral<"createUser", "required">, convex_values695.VLiteral<"createUserAndMembership", "required">], "required", never>;
-          defaultRole: convex_values695.VString<string | undefined, "optional">;
-          defaultRoleIds: convex_values695.VArray<string[] | undefined, convex_values695.VString<string, "required">, "optional">;
+          mode: convex_values87.VUnion<"off" | "createUser" | "createUserAndMembership", [convex_values87.VLiteral<"off", "required">, convex_values87.VLiteral<"createUser", "required">, convex_values87.VLiteral<"createUserAndMembership", "required">], "required", never>;
+          defaultRole: convex_values87.VString<string | undefined, "optional">;
+          defaultRoleIds: convex_values87.VArray<string[] | undefined, convex_values87.VString<string, "required">, "optional">;
         }, "required", "mode" | "defaultRole" | "defaultRoleIds">;
-        deprovision: convex_values695.VObject<{
+        deprovision: convex_values87.VObject<{
           mode: "soft" | "hard";
         }, {
-          mode: convex_values695.VUnion<"soft" | "hard", [convex_values695.VLiteral<"soft", "required">, convex_values695.VLiteral<"hard", "required">], "required", never>;
+          mode: convex_values87.VUnion<"soft" | "hard", [convex_values87.VLiteral<"soft", "required">, convex_values87.VLiteral<"hard", "required">], "required", never>;
         }, "required", "mode">;
-      }, "required", "scimReuse" | "jit" | "deprovision" | "scimReuse.user" | "jit.mode" | "jit.defaultRole" | "jit.defaultRoleIds" | "deprovision.mode">;
-      extend: convex_values695.VAny<any, "optional", string>;
-    }, "optional", "extend" | `extend.${string}` | "version" | "identity" | "provisioning" | "identity.accountLinking" | "identity.accountLinking.oidc" | "identity.accountLinking.saml" | "provisioning.scimReuse" | "provisioning.jit" | "provisioning.deprovision" | "provisioning.scimReuse.user" | "provisioning.jit.mode" | "provisioning.jit.defaultRole" | "provisioning.jit.defaultRoleIds" | "provisioning.deprovision.mode">;
-    config: convex_values695.VAny<any, "optional", string>;
-    extend: convex_values695.VAny<any, "optional", string>;
-  }, "required", "name" | "slug" | "status" | "extend" | "config" | "groupId" | `extend.${string}` | "policy" | `config.${string}` | "policy.extend" | `policy.extend.${string}` | "policy.version" | "policy.identity" | "policy.provisioning" | "policy.identity.accountLinking" | "policy.identity.accountLinking.oidc" | "policy.identity.accountLinking.saml" | "policy.provisioning.scimReuse" | "policy.provisioning.jit" | "policy.provisioning.deprovision" | "policy.provisioning.scimReuse.user" | "policy.provisioning.jit.mode" | "policy.provisioning.jit.defaultRole" | "policy.provisioning.jit.defaultRoleIds" | "policy.provisioning.deprovision.mode">, {
+        groups: convex_values87.VObject<{
+          mapping?: Record<string, string[]> | undefined;
+          mode: "ignore" | "sync";
+          source: "protocol";
+        }, {
+          mode: convex_values87.VUnion<"ignore" | "sync", [convex_values87.VLiteral<"ignore", "required">, convex_values87.VLiteral<"sync", "required">], "required", never>;
+          source: convex_values87.VLiteral<"protocol", "required">;
+          mapping: convex_values87.VRecord<Record<string, string[]> | undefined, convex_values87.VString<string, "required">, convex_values87.VArray<string[], convex_values87.VString<string, "required">, "required">, "optional", string>;
+        }, "required", "mode" | "source" | "mapping" | `mapping.${string}`>;
+        roles: convex_values87.VObject<{
+          mapping?: Record<string, string[]> | undefined;
+          mode: "map" | "ignore";
+          source: "protocol";
+        }, {
+          mode: convex_values87.VUnion<"map" | "ignore", [convex_values87.VLiteral<"ignore", "required">, convex_values87.VLiteral<"map", "required">], "required", never>;
+          source: convex_values87.VLiteral<"protocol", "required">;
+          mapping: convex_values87.VRecord<Record<string, string[]> | undefined, convex_values87.VString<string, "required">, convex_values87.VArray<string[], convex_values87.VString<string, "required">, "required">, "optional", string>;
+        }, "required", "mode" | "source" | "mapping" | `mapping.${string}`>;
+      }, "required", "user" | "scimReuse" | "jit" | "deprovision" | "groups" | "roles" | "user.createOnSignIn" | "user.updateProfileOnLogin" | "user.updateProfileFromScim" | "user.authority" | "scimReuse.user" | "jit.mode" | "jit.defaultRole" | "jit.defaultRoleIds" | "deprovision.mode" | "groups.mode" | "groups.source" | "groups.mapping" | `groups.mapping.${string}` | "roles.mode" | "roles.source" | "roles.mapping" | `roles.mapping.${string}`>;
+      extend: convex_values87.VAny<any, "optional", string>;
+    }, "optional", "extend" | `extend.${string}` | "version" | "identity" | "provisioning" | "identity.accountLinking" | "identity.accountLinking.oidc" | "identity.accountLinking.saml" | "provisioning.user" | "provisioning.scimReuse" | "provisioning.jit" | "provisioning.deprovision" | "provisioning.groups" | "provisioning.roles" | "provisioning.user.createOnSignIn" | "provisioning.user.updateProfileOnLogin" | "provisioning.user.updateProfileFromScim" | "provisioning.user.authority" | "provisioning.scimReuse.user" | "provisioning.jit.mode" | "provisioning.jit.defaultRole" | "provisioning.jit.defaultRoleIds" | "provisioning.deprovision.mode" | "provisioning.groups.mode" | "provisioning.groups.source" | "provisioning.groups.mapping" | `provisioning.groups.mapping.${string}` | "provisioning.roles.mode" | "provisioning.roles.source" | "provisioning.roles.mapping" | `provisioning.roles.mapping.${string}`>;
+    extend: convex_values87.VAny<any, "optional", string>;
+  }, "required", "name" | "slug" | "type" | "extend" | `extend.${string}` | "parentGroupId" | "rootGroupId" | "isRoot" | "tags" | "policy" | "policy.extend" | `policy.extend.${string}` | "policy.version" | "policy.identity" | "policy.provisioning" | "policy.identity.accountLinking" | "policy.identity.accountLinking.oidc" | "policy.identity.accountLinking.saml" | "policy.provisioning.user" | "policy.provisioning.scimReuse" | "policy.provisioning.jit" | "policy.provisioning.deprovision" | "policy.provisioning.groups" | "policy.provisioning.roles" | "policy.provisioning.user.createOnSignIn" | "policy.provisioning.user.updateProfileOnLogin" | "policy.provisioning.user.updateProfileFromScim" | "policy.provisioning.user.authority" | "policy.provisioning.scimReuse.user" | "policy.provisioning.jit.mode" | "policy.provisioning.jit.defaultRole" | "policy.provisioning.jit.defaultRoleIds" | "policy.provisioning.deprovision.mode" | "policy.provisioning.groups.mode" | "policy.provisioning.groups.source" | "policy.provisioning.groups.mapping" | `policy.provisioning.groups.mapping.${string}` | "policy.provisioning.roles.mode" | "policy.provisioning.roles.source" | "policy.provisioning.roles.mapping" | `policy.provisioning.roles.mapping.${string}`>, {
+    slug: ["slug", "_creationTime"];
+    parent_group_id: ["parentGroupId", "_creationTime"];
+    root_group_id: ["rootGroupId", "_creationTime"];
+    is_root: ["isRoot", "_creationTime"];
+    type: ["type", "_creationTime"];
+    type_parent_group_id: ["type", "parentGroupId", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Denormalized group-tag index table for efficient tag-based filtering.
+   * Each row maps one `(key, value)` pair to a group. Kept in sync by
+   * `groupCreate`, `groupUpdate`, and `groupDelete`.
+   */
+  GroupTag: convex_server81.TableDefinition<convex_values87.VObject<{
+    key: string;
+    value: string;
+    group_id: convex_values87.GenericId<"Group">;
+  }, {
+    group_id: convex_values87.VId<convex_values87.GenericId<"Group">, "required">;
+    key: convex_values87.VString<string, "required">;
+    value: convex_values87.VString<string, "required">;
+  }, "required", "key" | "value" | "group_id">, {
+    by_group: ["group_id", "_creationTime"];
+    by_key_value: ["key", "value", "_creationTime"];
+    by_key: ["key", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Group membership. Links a user to a group with an application-defined
+   * role (e.g. "owner", "admin", "member", "viewer"). A user can be a
+   * member of multiple groups with different roles in each.
+   */
+  GroupMember: convex_server81.TableDefinition<convex_values87.VObject<{
+    status?: string | undefined;
+    extend?: any;
+    role?: string | undefined;
+    roleIds?: string[] | undefined;
+    userId: convex_values87.GenericId<"User">;
+    groupId: convex_values87.GenericId<"Group">;
+  }, {
+    groupId: convex_values87.VId<convex_values87.GenericId<"Group">, "required">;
+    userId: convex_values87.VId<convex_values87.GenericId<"User">, "required">;
+    role: convex_values87.VString<string | undefined, "optional">;
+    roleIds: convex_values87.VArray<string[] | undefined, convex_values87.VString<string, "required">, "optional">;
+    status: convex_values87.VString<string | undefined, "optional">;
+    extend: convex_values87.VAny<any, "optional", string>;
+  }, "required", "status" | "userId" | "extend" | `extend.${string}` | "groupId" | "role" | "roleIds">, {
+    group_id: ["groupId", "_creationTime"];
+    group_id_user_id: ["groupId", "userId", "_creationTime"];
+    group_id_status: ["groupId", "status", "_creationTime"];
+    user_id: ["userId", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Invitations. Tracks pending, accepted, revoked, and expired
+   * invitations. Optionally scoped to a group via `groupId`, or
+   * platform-level when `groupId` is omitted.
+   *
+   * `email` and `invitedByUserId` are optional to support CLI-generated
+   * invite links where neither is known upfront.
+   */
+  GroupInvite: convex_server81.TableDefinition<convex_values87.VObject<{
+    email?: string | undefined;
+    expiresTime?: number | undefined;
+    acceptedTime?: number | undefined;
+    extend?: any;
+    groupId?: convex_values87.GenericId<"Group"> | undefined;
+    role?: string | undefined;
+    roleIds?: string[] | undefined;
+    invitedByUserId?: convex_values87.GenericId<"User"> | undefined;
+    acceptedByUserId?: convex_values87.GenericId<"User"> | undefined;
+    status: "pending" | "accepted" | "revoked" | "expired";
+    tokenHash: string;
+  }, {
+    groupId: convex_values87.VId<convex_values87.GenericId<"Group"> | undefined, "optional">;
+    invitedByUserId: convex_values87.VId<convex_values87.GenericId<"User"> | undefined, "optional">;
+    email: convex_values87.VString<string | undefined, "optional">;
+    tokenHash: convex_values87.VString<string, "required">;
+    role: convex_values87.VString<string | undefined, "optional">;
+    roleIds: convex_values87.VArray<string[] | undefined, convex_values87.VString<string, "required">, "optional">;
+    status: convex_values87.VUnion<"pending" | "accepted" | "revoked" | "expired", [convex_values87.VLiteral<"pending", "required">, convex_values87.VLiteral<"accepted", "required">, convex_values87.VLiteral<"revoked", "required">, convex_values87.VLiteral<"expired", "required">], "required", never>;
+    expiresTime: convex_values87.VFloat64<number | undefined, "optional">;
+    acceptedByUserId: convex_values87.VId<convex_values87.GenericId<"User"> | undefined, "optional">;
+    acceptedTime: convex_values87.VFloat64<number | undefined, "optional">;
+    extend: convex_values87.VAny<any, "optional", string>;
+  }, "required", "email" | "status" | "expiresTime" | "acceptedTime" | "extend" | `extend.${string}` | "groupId" | "role" | "roleIds" | "invitedByUserId" | "tokenHash" | "acceptedByUserId">, {
+    token_hash: ["tokenHash", "_creationTime"];
+    status: ["status", "_creationTime"];
+    email_status: ["email", "status", "_creationTime"];
+    invited_by_user_id_status: ["invitedByUserId", "status", "_creationTime"];
+    group_id: ["groupId", "_creationTime"];
+    group_id_status: ["groupId", "status", "_creationTime"];
+  }, {}, {}>;
+  /**
+   * Group Connection configuration attached to a root group/organization.
+   *
+   * The `config` payload intentionally stays flexible so the headless group connection
+   * SDK can evolve without forcing schema churn for every protocol-specific
+   * field addition.
+   */
+  GroupConnection: convex_server81.TableDefinition<convex_values87.VObject<{
+    name?: string | undefined;
+    slug?: string | undefined;
+    extend?: any;
+    config?: any;
+    status: "draft" | "active" | "disabled";
+    protocol: "oidc" | "saml";
+    groupId: convex_values87.GenericId<"Group">;
+  }, {
+    groupId: convex_values87.VId<convex_values87.GenericId<"Group">, "required">;
+    slug: convex_values87.VString<string | undefined, "optional">;
+    name: convex_values87.VString<string | undefined, "optional">;
+    protocol: convex_values87.VUnion<"oidc" | "saml", [convex_values87.VLiteral<"oidc", "required">, convex_values87.VLiteral<"saml", "required">], "required", never>;
+    status: convex_values87.VUnion<"draft" | "active" | "disabled", [convex_values87.VLiteral<"draft", "required">, convex_values87.VLiteral<"active", "required">, convex_values87.VLiteral<"disabled", "required">], "required", never>;
+    config: convex_values87.VAny<any, "optional", string>;
+    extend: convex_values87.VAny<any, "optional", string>;
+  }, "required", "name" | "slug" | "status" | "extend" | `extend.${string}` | "protocol" | "groupId" | "config" | `config.${string}`>, {
     group_id: ["groupId", "_creationTime"];
     slug: ["slug", "_creationTime"];
     status: ["status", "_creationTime"];
   }, {}, {}>;
   /**
-   * Verified or pending domains linked to an enterprise record.
+   * Verified or pending domains linked to an group connection record.
    */
-  EnterpriseDomain: convex_server66.TableDefinition<convex_values695.VObject<{
+  GroupConnectionDomain: convex_server81.TableDefinition<convex_values87.VObject<{
     verifiedAt?: number | undefined;
-    groupId: convex_values695.GenericId<"Group">;
-    enterpriseId: convex_values695.GenericId<"Enterprise">;
+    groupId: convex_values87.GenericId<"Group">;
+    connectionId: convex_values87.GenericId<"GroupConnection">;
     domain: string;
     isPrimary: boolean;
   }, {
-    enterpriseId: convex_values695.VId<convex_values695.GenericId<"Enterprise">, "required">;
-    groupId: convex_values695.VId<convex_values695.GenericId<"Group">, "required">;
-    domain: convex_values695.VString<string, "required">;
-    isPrimary: convex_values695.VBoolean<boolean, "required">;
-    verifiedAt: convex_values695.VFloat64<number | undefined, "optional">;
-  }, "required", "groupId" | "enterpriseId" | "domain" | "isPrimary" | "verifiedAt">, {
-    enterprise_id: ["enterpriseId", "_creationTime"];
+    connectionId: convex_values87.VId<convex_values87.GenericId<"GroupConnection">, "required">;
+    groupId: convex_values87.VId<convex_values87.GenericId<"Group">, "required">;
+    domain: convex_values87.VString<string, "required">;
+    isPrimary: convex_values87.VBoolean<boolean, "required">;
+    verifiedAt: convex_values87.VFloat64<number | undefined, "optional">;
+  }, "required", "groupId" | "connectionId" | "domain" | "isPrimary" | "verifiedAt">, {
+    connection_id: ["connectionId", "_creationTime"];
     group_id: ["groupId", "_creationTime"];
     domain: ["domain", "_creationTime"];
   }, {}, {}>;
   /**
-   * Pending DNS TXT verification challenges for enterprise domains.
+   * Pending DNS TXT verification challenges for group connection domains.
    */
-  EnterpriseDomainVerification: convex_server66.TableDefinition<convex_values695.VObject<{
+  GroupConnectionDomainVerification: convex_server81.TableDefinition<convex_values87.VObject<{
     expiresAt: number;
-    groupId: convex_values695.GenericId<"Group">;
+    groupId: convex_values87.GenericId<"Group">;
     tokenHash: string;
-    enterpriseId: convex_values695.GenericId<"Enterprise">;
+    connectionId: convex_values87.GenericId<"GroupConnection">;
     domain: string;
-    domainId: convex_values695.GenericId<"EnterpriseDomain">;
+    domainId: convex_values87.GenericId<"GroupConnectionDomain">;
     recordName: string;
     token: string;
     requestedAt: number;
   }, {
-    enterpriseId: convex_values695.VId<convex_values695.GenericId<"Enterprise">, "required">;
-    groupId: convex_values695.VId<convex_values695.GenericId<"Group">, "required">;
-    domainId: convex_values695.VId<convex_values695.GenericId<"EnterpriseDomain">, "required">;
-    domain: convex_values695.VString<string, "required">;
-    recordName: convex_values695.VString<string, "required">;
-    token: convex_values695.VString<string, "required">;
-    tokenHash: convex_values695.VString<string, "required">;
-    requestedAt: convex_values695.VFloat64<number, "required">;
-    expiresAt: convex_values695.VFloat64<number, "required">;
-  }, "required", "expiresAt" | "groupId" | "tokenHash" | "enterpriseId" | "domain" | "domainId" | "recordName" | "token" | "requestedAt">, {
-    enterprise_id: ["enterpriseId", "_creationTime"];
+    connectionId: convex_values87.VId<convex_values87.GenericId<"GroupConnection">, "required">;
+    groupId: convex_values87.VId<convex_values87.GenericId<"Group">, "required">;
+    domainId: convex_values87.VId<convex_values87.GenericId<"GroupConnectionDomain">, "required">;
+    domain: convex_values87.VString<string, "required">;
+    recordName: convex_values87.VString<string, "required">;
+    token: convex_values87.VString<string, "required">;
+    tokenHash: convex_values87.VString<string, "required">;
+    requestedAt: convex_values87.VFloat64<number, "required">;
+    expiresAt: convex_values87.VFloat64<number, "required">;
+  }, "required", "expiresAt" | "groupId" | "tokenHash" | "connectionId" | "domain" | "domainId" | "recordName" | "token" | "requestedAt">, {
+    connection_id: ["connectionId", "_creationTime"];
     domain_id: ["domainId", "_creationTime"];
     token_hash: ["tokenHash", "_creationTime"];
   }, {}, {}>;
   /**
-   * Encrypted enterprise secrets stored separately from protocol config.
+   * Encrypted group connection secrets stored separately from protocol config.
    */
-  EnterpriseSecret: convex_server66.TableDefinition<convex_values695.VObject<{
-    groupId: convex_values695.GenericId<"Group">;
-    kind: "oidc_client_secret";
-    enterpriseId: convex_values695.GenericId<"Enterprise">;
+  GroupConnectionSecret: convex_server81.TableDefinition<convex_values87.VObject<{
+    groupId: convex_values87.GenericId<"Group">;
+    connectionId: convex_values87.GenericId<"GroupConnection">;
     ciphertext: string;
     updatedAt: number;
+    kind: "oidc_client_secret";
   }, {
-    enterpriseId: convex_values695.VId<convex_values695.GenericId<"Enterprise">, "required">;
-    groupId: convex_values695.VId<convex_values695.GenericId<"Group">, "required">;
-    kind: convex_values695.VUnion<"oidc_client_secret", [convex_values695.VLiteral<"oidc_client_secret", "required">], "required", never>;
-    ciphertext: convex_values695.VString<string, "required">;
-    updatedAt: convex_values695.VFloat64<number, "required">;
-  }, "required", "groupId" | "kind" | "enterpriseId" | "ciphertext" | "updatedAt">, {
-    enterprise_id: ["enterpriseId", "_creationTime"];
-    enterprise_id_kind: ["enterpriseId", "kind", "_creationTime"];
+    connectionId: convex_values87.VId<convex_values87.GenericId<"GroupConnection">, "required">;
+    groupId: convex_values87.VId<convex_values87.GenericId<"Group">, "required">;
+    kind: convex_values87.VUnion<"oidc_client_secret", [convex_values87.VLiteral<"oidc_client_secret", "required">], "required", never>;
+    ciphertext: convex_values87.VString<string, "required">;
+    updatedAt: convex_values87.VFloat64<number, "required">;
+  }, "required", "groupId" | "connectionId" | "ciphertext" | "updatedAt" | "kind">, {
+    connection_id: ["connectionId", "_creationTime"];
+    connection_id_kind: ["connectionId", "kind", "_creationTime"];
     group_id: ["groupId", "_creationTime"];
   }, {}, {}>;
   /**
-   * SCIM configuration for an enterprise tenant.
+   * SCIM configuration for an group connection tenant.
    */
-  EnterpriseScimConfig: convex_server66.TableDefinition<convex_values695.VObject<{
+  GroupConnectionScimConfig: convex_server81.TableDefinition<convex_values87.VObject<{
     extend?: any;
     lastRotatedAt?: number | undefined;
     status: "draft" | "active" | "disabled";
-    groupId: convex_values695.GenericId<"Group">;
+    groupId: convex_values87.GenericId<"Group">;
     tokenHash: string;
-    enterpriseId: convex_values695.GenericId<"Enterprise">;
+    connectionId: convex_values87.GenericId<"GroupConnection">;
     basePath: string;
   }, {
-    enterpriseId: convex_values695.VId<convex_values695.GenericId<"Enterprise">, "required">;
-    groupId: convex_values695.VId<convex_values695.GenericId<"Group">, "required">;
-    status: convex_values695.VUnion<"draft" | "active" | "disabled", [convex_values695.VLiteral<"draft", "required">, convex_values695.VLiteral<"active", "required">, convex_values695.VLiteral<"disabled", "required">], "required", never>;
-    basePath: convex_values695.VString<string, "required">;
-    tokenHash: convex_values695.VString<string, "required">;
-    lastRotatedAt: convex_values695.VFloat64<number | undefined, "optional">;
-    extend: convex_values695.VAny<any, "optional", string>;
-  }, "required", "status" | "extend" | "groupId" | "tokenHash" | `extend.${string}` | "enterpriseId" | "basePath" | "lastRotatedAt">, {
-    enterprise_id: ["enterpriseId", "_creationTime"];
+    connectionId: convex_values87.VId<convex_values87.GenericId<"GroupConnection">, "required">;
+    groupId: convex_values87.VId<convex_values87.GenericId<"Group">, "required">;
+    status: convex_values87.VUnion<"draft" | "active" | "disabled", [convex_values87.VLiteral<"draft", "required">, convex_values87.VLiteral<"active", "required">, convex_values87.VLiteral<"disabled", "required">], "required", never>;
+    basePath: convex_values87.VString<string, "required">;
+    tokenHash: convex_values87.VString<string, "required">;
+    lastRotatedAt: convex_values87.VFloat64<number | undefined, "optional">;
+    extend: convex_values87.VAny<any, "optional", string>;
+  }, "required", "status" | "extend" | `extend.${string}` | "groupId" | "tokenHash" | "connectionId" | "basePath" | "lastRotatedAt">, {
+    group_connection_id: ["connectionId", "_creationTime"];
     group_id: ["groupId", "_creationTime"];
     token_hash: ["tokenHash", "_creationTime"];
     status: ["status", "_creationTime"];
@@ -585,129 +664,129 @@ declare const _default: convex_server66.SchemaDefinition<{
   /**
    * External SCIM identities mapped into local users/groups.
    */
-  EnterpriseScimIdentity: convex_server66.TableDefinition<convex_values695.VObject<{
-    userId?: convex_values695.GenericId<"User"> | undefined;
+  GroupConnectionScimIdentity: convex_server81.TableDefinition<convex_values87.VObject<{
+    userId?: convex_values87.GenericId<"User"> | undefined;
     active?: boolean | undefined;
-    mappedGroupId?: convex_values695.GenericId<"Group"> | undefined;
+    mappedGroupId?: convex_values87.GenericId<"Group"> | undefined;
     lastProvisionedAt?: number | undefined;
     raw?: any;
-    groupId: convex_values695.GenericId<"Group">;
     externalId: string;
-    enterpriseId: convex_values695.GenericId<"Enterprise">;
+    groupId: convex_values87.GenericId<"Group">;
+    connectionId: convex_values87.GenericId<"GroupConnection">;
     resourceType: "user" | "group";
   }, {
-    enterpriseId: convex_values695.VId<convex_values695.GenericId<"Enterprise">, "required">;
-    groupId: convex_values695.VId<convex_values695.GenericId<"Group">, "required">;
-    resourceType: convex_values695.VUnion<"user" | "group", [convex_values695.VLiteral<"user", "required">, convex_values695.VLiteral<"group", "required">], "required", never>;
-    externalId: convex_values695.VString<string, "required">;
-    userId: convex_values695.VId<convex_values695.GenericId<"User"> | undefined, "optional">;
-    mappedGroupId: convex_values695.VId<convex_values695.GenericId<"Group"> | undefined, "optional">;
-    lastProvisionedAt: convex_values695.VFloat64<number | undefined, "optional">;
-    active: convex_values695.VBoolean<boolean | undefined, "optional">;
-    raw: convex_values695.VAny<any, "optional", string>;
-  }, "required", "userId" | "groupId" | "active" | "externalId" | "enterpriseId" | "resourceType" | "mappedGroupId" | "lastProvisionedAt" | "raw" | `raw.${string}`>, {
-    enterprise_id: ["enterpriseId", "_creationTime"];
+    connectionId: convex_values87.VId<convex_values87.GenericId<"GroupConnection">, "required">;
+    groupId: convex_values87.VId<convex_values87.GenericId<"Group">, "required">;
+    resourceType: convex_values87.VUnion<"user" | "group", [convex_values87.VLiteral<"user", "required">, convex_values87.VLiteral<"group", "required">], "required", never>;
+    externalId: convex_values87.VString<string, "required">;
+    userId: convex_values87.VId<convex_values87.GenericId<"User"> | undefined, "optional">;
+    mappedGroupId: convex_values87.VId<convex_values87.GenericId<"Group"> | undefined, "optional">;
+    lastProvisionedAt: convex_values87.VFloat64<number | undefined, "optional">;
+    active: convex_values87.VBoolean<boolean | undefined, "optional">;
+    raw: convex_values87.VAny<any, "optional", string>;
+  }, "required", "userId" | "externalId" | "groupId" | "active" | "connectionId" | "resourceType" | "mappedGroupId" | "lastProvisionedAt" | "raw" | `raw.${string}`>, {
+    group_connection_id: ["connectionId", "_creationTime"];
     group_id: ["groupId", "_creationTime"];
-    enterprise_id_resource_type_external_id: ["enterpriseId", "resourceType", "externalId", "_creationTime"];
-    enterprise_id_user_id: ["enterpriseId", "userId", "_creationTime"];
+    group_connection_id_resource_type_external_id: ["connectionId", "resourceType", "externalId", "_creationTime"];
+    group_connection_id_user_id: ["connectionId", "userId", "_creationTime"];
     user_id: ["userId", "_creationTime"];
     mapped_group_id: ["mappedGroupId", "_creationTime"];
   }, {}, {}>;
   /**
-   * Immutable audit trail for enterprise operations.
+   * Immutable audit trail for group connection operations.
    */
-  EnterpriseAuditEvent: convex_server66.TableDefinition<convex_values695.VObject<{
+  GroupAuditEvent: convex_server81.TableDefinition<convex_values87.VObject<{
     metadata?: any;
+    connectionId?: convex_values87.GenericId<"GroupConnection"> | undefined;
     actorId?: string | undefined;
     subjectId?: string | undefined;
     requestId?: string | undefined;
     ip?: string | undefined;
     status: "success" | "failure";
-    groupId: convex_values695.GenericId<"Group">;
-    enterpriseId: convex_values695.GenericId<"Enterprise">;
-    actorType: "user" | "system" | "scim" | "api_key" | "webhook";
+    groupId: convex_values87.GenericId<"Group">;
+    actorType: "user" | "scim" | "system" | "api_key" | "webhook";
     eventType: string;
     subjectType: string;
     occurredAt: number;
   }, {
-    enterpriseId: convex_values695.VId<convex_values695.GenericId<"Enterprise">, "required">;
-    groupId: convex_values695.VId<convex_values695.GenericId<"Group">, "required">;
-    eventType: convex_values695.VString<string, "required">;
-    actorType: convex_values695.VUnion<"user" | "system" | "scim" | "api_key" | "webhook", [convex_values695.VLiteral<"user", "required">, convex_values695.VLiteral<"system", "required">, convex_values695.VLiteral<"scim", "required">, convex_values695.VLiteral<"api_key", "required">, convex_values695.VLiteral<"webhook", "required">], "required", never>;
-    actorId: convex_values695.VString<string | undefined, "optional">;
-    subjectType: convex_values695.VString<string, "required">;
-    subjectId: convex_values695.VString<string | undefined, "optional">;
-    status: convex_values695.VUnion<"success" | "failure", [convex_values695.VLiteral<"success", "required">, convex_values695.VLiteral<"failure", "required">], "required", never>;
-    occurredAt: convex_values695.VFloat64<number, "required">;
-    requestId: convex_values695.VString<string | undefined, "optional">;
-    ip: convex_values695.VString<string | undefined, "optional">;
-    metadata: convex_values695.VAny<any, "optional", string>;
-  }, "required", "status" | "metadata" | `metadata.${string}` | "groupId" | "enterpriseId" | "actorType" | "eventType" | "actorId" | "subjectType" | "subjectId" | "occurredAt" | "requestId" | "ip">, {
-    enterprise_id_occurred_at: ["enterpriseId", "occurredAt", "_creationTime"];
+    connectionId: convex_values87.VId<convex_values87.GenericId<"GroupConnection"> | undefined, "optional">;
+    groupId: convex_values87.VId<convex_values87.GenericId<"Group">, "required">;
+    eventType: convex_values87.VString<string, "required">;
+    actorType: convex_values87.VUnion<"user" | "scim" | "system" | "api_key" | "webhook", [convex_values87.VLiteral<"user", "required">, convex_values87.VLiteral<"system", "required">, convex_values87.VLiteral<"scim", "required">, convex_values87.VLiteral<"api_key", "required">, convex_values87.VLiteral<"webhook", "required">], "required", never>;
+    actorId: convex_values87.VString<string | undefined, "optional">;
+    subjectType: convex_values87.VString<string, "required">;
+    subjectId: convex_values87.VString<string | undefined, "optional">;
+    status: convex_values87.VUnion<"success" | "failure", [convex_values87.VLiteral<"success", "required">, convex_values87.VLiteral<"failure", "required">], "required", never>;
+    occurredAt: convex_values87.VFloat64<number, "required">;
+    requestId: convex_values87.VString<string | undefined, "optional">;
+    ip: convex_values87.VString<string | undefined, "optional">;
+    metadata: convex_values87.VAny<any, "optional", string>;
+  }, "required", "status" | "metadata" | `metadata.${string}` | "groupId" | "connectionId" | "actorType" | "eventType" | "actorId" | "subjectType" | "subjectId" | "occurredAt" | "requestId" | "ip">, {
+    group_connection_id_occurred_at: ["connectionId", "occurredAt", "_creationTime"];
     group_id_occurred_at: ["groupId", "occurredAt", "_creationTime"];
     event_type_occurred_at: ["eventType", "occurredAt", "_creationTime"];
   }, {}, {}>;
   /**
-   * Webhook endpoints subscribed to enterprise audit and lifecycle events.
+   * Webhook endpoints subscribed to group audit and lifecycle events.
    */
-  EnterpriseWebhookEndpoint: convex_server66.TableDefinition<convex_values695.VObject<{
+  GroupWebhookEndpoint: convex_server81.TableDefinition<convex_values87.VObject<{
     extend?: any;
-    createdByUserId?: convex_values695.GenericId<"User"> | undefined;
+    createdByUserId?: convex_values87.GenericId<"User"> | undefined;
     lastSuccessAt?: number | undefined;
     lastFailureAt?: number | undefined;
     status: "active" | "disabled";
-    groupId: convex_values695.GenericId<"Group">;
-    enterpriseId: convex_values695.GenericId<"Enterprise">;
+    groupId: convex_values87.GenericId<"Group">;
+    connectionId: convex_values87.GenericId<"GroupConnection">;
     url: string;
     secretHash: string;
     subscriptions: string[];
     failureCount: number;
   }, {
-    enterpriseId: convex_values695.VId<convex_values695.GenericId<"Enterprise">, "required">;
-    groupId: convex_values695.VId<convex_values695.GenericId<"Group">, "required">;
-    url: convex_values695.VString<string, "required">;
-    status: convex_values695.VUnion<"active" | "disabled", [convex_values695.VLiteral<"active", "required">, convex_values695.VLiteral<"disabled", "required">], "required", never>;
-    secretHash: convex_values695.VString<string, "required">;
-    subscriptions: convex_values695.VArray<string[], convex_values695.VString<string, "required">, "required">;
-    createdByUserId: convex_values695.VId<convex_values695.GenericId<"User"> | undefined, "optional">;
-    lastSuccessAt: convex_values695.VFloat64<number | undefined, "optional">;
-    lastFailureAt: convex_values695.VFloat64<number | undefined, "optional">;
-    failureCount: convex_values695.VFloat64<number, "required">;
-    extend: convex_values695.VAny<any, "optional", string>;
-  }, "required", "status" | "extend" | "groupId" | `extend.${string}` | "enterpriseId" | "url" | "secretHash" | "subscriptions" | "createdByUserId" | "lastSuccessAt" | "lastFailureAt" | "failureCount">, {
-    enterprise_id: ["enterpriseId", "_creationTime"];
+    connectionId: convex_values87.VId<convex_values87.GenericId<"GroupConnection">, "required">;
+    groupId: convex_values87.VId<convex_values87.GenericId<"Group">, "required">;
+    url: convex_values87.VString<string, "required">;
+    status: convex_values87.VUnion<"active" | "disabled", [convex_values87.VLiteral<"active", "required">, convex_values87.VLiteral<"disabled", "required">], "required", never>;
+    secretHash: convex_values87.VString<string, "required">;
+    subscriptions: convex_values87.VArray<string[], convex_values87.VString<string, "required">, "required">;
+    createdByUserId: convex_values87.VId<convex_values87.GenericId<"User"> | undefined, "optional">;
+    lastSuccessAt: convex_values87.VFloat64<number | undefined, "optional">;
+    lastFailureAt: convex_values87.VFloat64<number | undefined, "optional">;
+    failureCount: convex_values87.VFloat64<number, "required">;
+    extend: convex_values87.VAny<any, "optional", string>;
+  }, "required", "status" | "extend" | `extend.${string}` | "groupId" | "connectionId" | "url" | "secretHash" | "subscriptions" | "createdByUserId" | "lastSuccessAt" | "lastFailureAt" | "failureCount">, {
+    group_connection_id: ["connectionId", "_creationTime"];
     group_id: ["groupId", "_creationTime"];
     status: ["status", "_creationTime"];
   }, {}, {}>;
   /**
-   * Delivery queue for outbound enterprise webhooks.
+   * Delivery queue for outbound group webhooks.
    */
-  EnterpriseWebhookDelivery: convex_server66.TableDefinition<convex_values695.VObject<{
-    auditEventId?: convex_values695.GenericId<"EnterpriseAuditEvent"> | undefined;
+  GroupWebhookDelivery: convex_server81.TableDefinition<convex_values87.VObject<{
+    auditEventId?: convex_values87.GenericId<"GroupAuditEvent"> | undefined;
     lastAttemptAt?: number | undefined;
     lastResponseStatus?: number | undefined;
     lastError?: string | undefined;
     status: "pending" | "processing" | "delivered" | "failed";
-    enterpriseId: convex_values695.GenericId<"Enterprise">;
+    connectionId: convex_values87.GenericId<"GroupConnection">;
     eventType: string;
-    endpointId: convex_values695.GenericId<"EnterpriseWebhookEndpoint">;
+    endpointId: convex_values87.GenericId<"GroupWebhookEndpoint">;
     attemptCount: number;
     nextAttemptAt: number;
     payload: any;
   }, {
-    enterpriseId: convex_values695.VId<convex_values695.GenericId<"Enterprise">, "required">;
-    endpointId: convex_values695.VId<convex_values695.GenericId<"EnterpriseWebhookEndpoint">, "required">;
-    auditEventId: convex_values695.VId<convex_values695.GenericId<"EnterpriseAuditEvent"> | undefined, "optional">;
-    eventType: convex_values695.VString<string, "required">;
-    status: convex_values695.VUnion<"pending" | "processing" | "delivered" | "failed", [convex_values695.VLiteral<"pending", "required">, convex_values695.VLiteral<"processing", "required">, convex_values695.VLiteral<"delivered", "required">, convex_values695.VLiteral<"failed", "required">], "required", never>;
-    attemptCount: convex_values695.VFloat64<number, "required">;
-    nextAttemptAt: convex_values695.VFloat64<number, "required">;
-    lastAttemptAt: convex_values695.VFloat64<number | undefined, "optional">;
-    lastResponseStatus: convex_values695.VFloat64<number | undefined, "optional">;
-    lastError: convex_values695.VString<string | undefined, "optional">;
-    payload: convex_values695.VAny<any, "required", string>;
-  }, "required", "status" | "enterpriseId" | "eventType" | "endpointId" | "auditEventId" | "attemptCount" | "nextAttemptAt" | "lastAttemptAt" | "lastResponseStatus" | "lastError" | "payload" | `payload.${string}`>, {
-    enterprise_id: ["enterpriseId", "_creationTime"];
+    connectionId: convex_values87.VId<convex_values87.GenericId<"GroupConnection">, "required">;
+    endpointId: convex_values87.VId<convex_values87.GenericId<"GroupWebhookEndpoint">, "required">;
+    auditEventId: convex_values87.VId<convex_values87.GenericId<"GroupAuditEvent"> | undefined, "optional">;
+    eventType: convex_values87.VString<string, "required">;
+    status: convex_values87.VUnion<"pending" | "processing" | "delivered" | "failed", [convex_values87.VLiteral<"pending", "required">, convex_values87.VLiteral<"processing", "required">, convex_values87.VLiteral<"delivered", "required">, convex_values87.VLiteral<"failed", "required">], "required", never>;
+    attemptCount: convex_values87.VFloat64<number, "required">;
+    nextAttemptAt: convex_values87.VFloat64<number, "required">;
+    lastAttemptAt: convex_values87.VFloat64<number | undefined, "optional">;
+    lastResponseStatus: convex_values87.VFloat64<number | undefined, "optional">;
+    lastError: convex_values87.VString<string | undefined, "optional">;
+    payload: convex_values87.VAny<any, "required", string>;
+  }, "required", "status" | "connectionId" | "eventType" | "endpointId" | "auditEventId" | "attemptCount" | "nextAttemptAt" | "lastAttemptAt" | "lastResponseStatus" | "lastError" | "payload" | `payload.${string}`>, {
+    group_connection_id: ["connectionId", "_creationTime"];
     status_next_attempt_at: ["status", "nextAttemptAt", "_creationTime"];
     endpoint_id_status: ["endpointId", "status", "_creationTime"];
     audit_event_id: ["auditEventId", "_creationTime"];
@@ -725,7 +804,7 @@ declare const _default: convex_server66.SchemaDefinition<{
    * - **Expiration**: optional TTL
    * - **Soft revocation**: `revoked` flag preserves audit trail
    */
-  ApiKey: convex_server66.TableDefinition<convex_values695.VObject<{
+  ApiKey: convex_server81.TableDefinition<convex_values87.VObject<{
     lastUsedAt?: number | undefined;
     expiresAt?: number | undefined;
     rateLimit?: {
@@ -739,7 +818,7 @@ declare const _default: convex_server66.SchemaDefinition<{
     metadata?: any;
     name: string;
     revoked: boolean;
-    userId: convex_values695.GenericId<"User">;
+    userId: convex_values87.GenericId<"User">;
     prefix: string;
     hashedKey: string;
     scopes: {
@@ -748,39 +827,39 @@ declare const _default: convex_server66.SchemaDefinition<{
     }[];
     createdAt: number;
   }, {
-    userId: convex_values695.VId<convex_values695.GenericId<"User">, "required">; /** First chars of the key for display (e.g. "sk_abc1..."). */
-    prefix: convex_values695.VString<string, "required">; /** SHA-256 hex hash of the full raw key. */
-    hashedKey: convex_values695.VString<string, "required">; /** User-assigned name (e.g. "CI Pipeline", "Production API"). */
-    name: convex_values695.VString<string, "required">; /** Scoped permissions: [{ resource: "users", actions: ["read", "list"] }]. */
-    scopes: convex_values695.VArray<{
+    userId: convex_values87.VId<convex_values87.GenericId<"User">, "required">; /** First chars of the key for display (e.g. "sk_abc1..."). */
+    prefix: convex_values87.VString<string, "required">; /** SHA-256 hex hash of the full raw key. */
+    hashedKey: convex_values87.VString<string, "required">; /** User-assigned name (e.g. "CI Pipeline", "Production API"). */
+    name: convex_values87.VString<string, "required">; /** Scoped permissions: [{ resource: "users", actions: ["read", "list"] }]. */
+    scopes: convex_values87.VArray<{
       resource: string;
       actions: string[];
-    }[], convex_values695.VObject<{
+    }[], convex_values87.VObject<{
       resource: string;
       actions: string[];
     }, {
-      resource: convex_values695.VString<string, "required">;
-      actions: convex_values695.VArray<string[], convex_values695.VString<string, "required">, "required">;
+      resource: convex_values87.VString<string, "required">;
+      actions: convex_values87.VArray<string[], convex_values87.VString<string, "required">, "required">;
     }, "required", "resource" | "actions">, "required">; /** Optional per-key rate limit configuration. */
-    rateLimit: convex_values695.VObject<{
+    rateLimit: convex_values87.VObject<{
       maxRequests: number;
       windowMs: number;
     } | undefined, {
-      maxRequests: convex_values695.VFloat64<number, "required">;
-      windowMs: convex_values695.VFloat64<number, "required">;
+      maxRequests: convex_values87.VFloat64<number, "required">;
+      windowMs: convex_values87.VFloat64<number, "required">;
     }, "optional", "maxRequests" | "windowMs">; /** Rate limit state tracking (token-bucket). */
-    rateLimitState: convex_values695.VObject<{
+    rateLimitState: convex_values87.VObject<{
       attemptsLeft: number;
       lastAttemptTime: number;
     } | undefined, {
-      attemptsLeft: convex_values695.VFloat64<number, "required">;
-      lastAttemptTime: convex_values695.VFloat64<number, "required">;
+      attemptsLeft: convex_values87.VFloat64<number, "required">;
+      lastAttemptTime: convex_values87.VFloat64<number, "required">;
     }, "optional", "attemptsLeft" | "lastAttemptTime">; /** Expiration timestamp. Null/undefined = never expires. */
-    expiresAt: convex_values695.VFloat64<number | undefined, "optional">;
-    lastUsedAt: convex_values695.VFloat64<number | undefined, "optional">;
-    createdAt: convex_values695.VFloat64<number, "required">; /** Soft-revoke flag. Revoked keys are kept for audit trail. */
-    revoked: convex_values695.VBoolean<boolean, "required">; /** Arbitrary app-specific metadata attached to the key. */
-    metadata: convex_values695.VAny<any, "optional", string>;
+    expiresAt: convex_values87.VFloat64<number | undefined, "optional">;
+    lastUsedAt: convex_values87.VFloat64<number | undefined, "optional">;
+    createdAt: convex_values87.VFloat64<number, "required">; /** Soft-revoke flag. Revoked keys are kept for audit trail. */
+    revoked: convex_values87.VBoolean<boolean, "required">; /** Arbitrary app-specific metadata attached to the key. */
+    metadata: convex_values87.VAny<any, "optional", string>;
   }, "required", "name" | "revoked" | "lastUsedAt" | "expiresAt" | "userId" | "prefix" | "hashedKey" | "scopes" | "rateLimit" | "rateLimitState" | "createdAt" | "metadata" | "rateLimit.maxRequests" | "rateLimit.windowMs" | "rateLimitState.attemptsLeft" | "rateLimitState.lastAttemptTime" | `metadata.${string}`>, {
     user_id: ["userId", "_creationTime"];
     hashed_key: ["hashedKey", "_creationTime"];