@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/server/mounts.d.ts

@@ -1,107 +1,193 @@
-import { AuthAuthorizationConfig, AuthRoleId } from "./types.js";
+import { AuthAuthorizationConfig, GroupConnectionDeprovisionMode, GroupConnectionPolicy } from "./types.js";
+import { AuditEventRecord, ConnectionDomainRecord, GroupConnectionDomainLookupRecord, GroupConnectionListResult, GroupConnectionRecord, ScimConfigRecord } from "./contract.js";
 import { AuthApi } from "./auth.js";
-import * as convex_server2 from "convex/server";
+import * as convex_server7 from "convex/server";
 
 //#region src/server/mounts.d.ts
 /**
- * Permission identifiers used by mounted enterprise admin APIs.
+ * Permission identifiers used by mounted group SSO admin APIs.
  *
- * These permission strings are passed to your {@link EnterpriseAuthorizer}
+ * These permission strings are passed to your {@link GroupSsoAccessHandler}
  * callback so app code can decide whether the current user may perform a
  * specific SSO or SCIM management operation.
  *
  * @example
  * ```ts
- * const authorized: EnterpriseAuthorizer = async (ctx, input) => {
+ * const access: GroupSsoAccessHandler = async (ctx, input) => {
  *   if (input.permission === "sso.connection.create") {
  *     // Only org admins may create SSO connections
  *   }
  * };
  * ```
  */
-type EnterpriseAdminPermission = "sso.connection.create" | "sso.connection.read" | "sso.connection.manage" | "sso.domain.manage" | "sso.protocol.manage" | "sso.policy.manage" | "sso.audit.read" | "sso.webhook.manage" | "scim.manage";
+type GroupSsoPermission = "sso.connection.create" | "sso.connection.read" | "sso.connection.manage" | "sso.domain.manage" | "sso.protocol.manage" | "sso.policy.manage" | "sso.audit.read" | "sso.webhook.manage" | "scim.manage";
 /**
- * Input passed to an {@link EnterpriseAuthorizer}.
+ * Input passed to a mounted Group SSO access check.
  *
  * Contains the acting user, the requested permission, and the resolved
- * enterprise/group scope for the operation being authorized.
+ * group connection/group scope for the operation being authorized.
  */
-type EnterpriseAdminAuthorizationInput = {
-  /** The signed-in user's ID performing the admin action. */userId: string; /** The {@link EnterpriseAdminPermission} being requested. */
-  permission: EnterpriseAdminPermission; /** Enterprise document ID, if the operation targets a specific enterprise. */
-  enterpriseId?: string; /** Group document ID, if explicitly provided by the caller. */
-  groupId?: string; /** Resolved group ID from the enterprise record, or `null` when no enterprise context. */
-  resolvedGroupId: string | null;
+type GroupSsoAccessInput = {
+  /** The signed-in user's ID performing the admin action. */userId: string; /** The {@link GroupSsoPermission} being requested. */
+  permission: GroupSsoPermission; /** Connection document ID, if the operation targets a specific SSO connection. */
+  connectionId?: string; /** Resolved group document ID, when the operation has group scope. */
+  groupId?: string;
 };
 /**
- * App-defined authorization hook for mounted enterprise admin APIs.
+ * App-defined access hook for mounted group SSO admin APIs.
  *
  * Return `void` (or resolve) to allow the operation, or throw to deny it.
  *
  * @param ctx - Convex context with `ctx.auth` for identity checks.
- * @param input - The {@link EnterpriseAdminAuthorizationInput} describing who is doing what.
+ * @param input - The {@link GroupSsoAccessInput} describing who is doing what.
  * @returns `void` to allow; throw to deny.
  *
  * @example
  * ```ts
- * import { EnterpriseAuthorizer } from "@robelest/convex-auth/server";
+ * import { GroupSsoAccessHandler } from "@robelest/convex-auth/server";
  *
- * const authorized: EnterpriseAuthorizer = async (ctx, input) => {
+ * const access: GroupSsoAccessHandler = async (ctx, input) => {
  *   const identity = await ctx.auth.getUserIdentity();
  *   if (!identity) throw new Error("Forbidden");
  *   // Allow all admin ops for the org owner
  * };
  * ```
  */
-type EnterpriseAuthorizer = (ctx: {
-  auth: convex_server2.Auth;
-}, input: EnterpriseAdminAuthorizationInput) => Promise<void>;
-type RoleRef<TRoleId extends string> = {
-  id: TRoleId;
-};
-type MountedEnterpriseOptions<TRoleId extends string = string> = {
-  admin?: {
-    authorized?: EnterpriseAuthorizer;
-    roles?: Array<TRoleId | RoleRef<TRoleId>>;
+type GroupSsoAccessHandler = (ctx: {
+  auth: convex_server7.Auth;
+}, input: GroupSsoAccessInput) => Promise<void>;
+/**
+ * Declarative requirement map for mounted Group SSO admin permissions.
+ *
+ * Use `require` at any subtree to define the default requirements for all
+ * descendant operations. Child entries override that inherited default when
+ * present. This lets apps describe coarse defaults with narrower overrides for
+ * specific admin operations.
+ *
+ * @typeParam TRequirement - App-defined requirement values passed back to
+ *   {@link GroupSsoResolvedAccessHandler}. These can be role refs, grant
+ *   strings, or any other policy tokens your app understands.
+ *
+ * @example
+ * ```ts
+ * const permissions: GroupSsoAccessPermissions<string> = {
+ *   sso: {
+ *     require: ["workspace.sso.read"],
+ *     connection: {
+ *       create: ["workspace.sso.manage"],
+ *       manage: ["workspace.sso.manage"],
+ *     },
+ *   },
+ *   scim: {
+ *     require: ["workspace.scim.manage"],
+ *   },
+ * };
+ * ```
+ */
+type GroupSsoAccessPermissions<TRequirement> = {
+  sso?: {
+    require?: readonly TRequirement[];
+    connection?: {
+      create?: readonly TRequirement[];
+      read?: readonly TRequirement[];
+      manage?: readonly TRequirement[];
+    };
+    domain?: {
+      manage?: readonly TRequirement[];
+    };
+    protocol?: {
+      manage?: readonly TRequirement[];
+    };
+    policy?: {
+      manage?: readonly TRequirement[];
+    };
+    audit?: {
+      read?: readonly TRequirement[];
+    };
+    webhook?: {
+      manage?: readonly TRequirement[];
+    };
+  };
+  scim?: {
+    require?: readonly TRequirement[];
+    manage?: readonly TRequirement[];
   };
 };
 /**
- * Configuration for {@link enterprise}, {@link sso}, and {@link scim}
- * mounted admin APIs.
+ * App-defined access hook for declarative mounted Group SSO permissions.
+ *
+ * The mounted API resolves the requirements for the current
+ * {@link GroupSsoPermission} from {@link GroupSsoAccessPermissions} and passes
+ * them to this callback. Throw to deny the operation, or resolve to allow it.
  *
- * @typeParam TRoleId - Role IDs that may be assigned to enterprise creators.
+ * @typeParam TRequirement - App-defined requirement values resolved from the
+ *   configured permission tree.
+ * @param ctx - Convex context with `ctx.auth` for identity checks.
+ * @param input - The normalized mounted access input.
+ * @param required - The resolved requirement values for the current operation.
+ * @returns `void` to allow; throw to deny.
  *
  * @example
  * ```ts
- * import { enterprise, EnterpriseMountOptions } from "@robelest/convex-auth/server";
+ * const access: GroupSsoResolvedAccessHandler<string> = async (
+ *   ctx,
+ *   input,
+ *   required,
+ * ) => {
+ *   if (!input.groupId) {
+ *     throw new Error("Group scope required");
+ *   }
  *
- * const options: EnterpriseMountOptions = {
- *   admin: {
- *     authorized: async (ctx, input) => {
- *       // Verify the user has permission for `input.permission`
- *     },
- *     roles: ["admin", "owner"],
+ *   await auth.member.require(ctx, {
+ *     userId: input.userId,
+ *     groupId: input.groupId,
+ *     grants: [...required],
+ *   });
+ * };
+ * ```
+ */
+type GroupSsoResolvedAccessHandler<TRequirement> = (ctx: {
+  auth: convex_server7.Auth;
+}, input: GroupSsoAccessInput, required: readonly TRequirement[]) => Promise<void>;
+/**
+ * Configuration for {@link createAuthGroupSso}, {@link sso}, and {@link scim}
+ * mounted admin APIs.
+ *
+ * @example
+ * ```ts
+ * import { createAuthGroupSso, CreateAuthGroupSsoOptions } from "@robelest/convex-auth/server";
+ *
+ * const options: CreateAuthGroupSsoOptions<string> = {
+ *   permissions: {
+ *     sso: { require: ["workspace.sso.manage"] },
+ *     scim: { require: ["workspace.scim.manage"] },
+ *   },
+ *   access: async (_ctx, _input, _required) => {
+ *     // Verify the current user satisfies the resolved requirements.
  *   },
  * };
  * ```
  */
-type EnterpriseMountOptions<TRoleId extends string = string> = {
-  admin: {
-    authorized: EnterpriseAuthorizer;
-    roles?: Array<TRoleId | RoleRef<TRoleId>>;
-  };
+type CreateAuthGroupSsoOptions<TRequirement = unknown> = {
+  access: GroupSsoAccessHandler;
+  permissions?: undefined;
+} | {
+  permissions: GroupSsoAccessPermissions<TRequirement>;
+  access: GroupSsoResolvedAccessHandler<TRequirement>;
 };
 /**
  * Build optional public SSO management actions that apps can mount under
- * `convex/auth/sso/**` when they want client-callable enterprise APIs.
+ * `convex/auth/sso/**` when they want client-callable group SSO APIs.
  *
  * `admin` is for tenant-admin control-plane operations and should be mounted
- * with an explicit authorization policy. `client` is for end-user sign-in
+ * with an explicit access policy. `client` is for end-user sign-in
  * helpers and does not require tenant-admin authorization.
  *
  * @param auth - Auth API subset providing `group`, `member`, `sso`, and `user` namespaces.
- * @param options - Optional admin authorization config. See {@link EnterpriseMountOptions}.
+ * @param options - Optional admin access config. See {@link CreateAuthGroupSsoOptions}.
  * @typeParam TAuthorization - Optional authorization config for typed role IDs.
+ * @typeParam TRequirement - App-defined requirement values used by declarative
+ *   `permissions` configs.
  * @returns An object with `admin` (connection CRUD, OIDC/SAML protocol config, policy,
  *   audit, webhooks, domain management) and `client` (signIn, metadata) namespaces.
  *
@@ -112,9 +198,10 @@ type EnterpriseMountOptions<TRoleId extends string = string> = {
  * import { auth } from "../auth";
  *
  * const mounted = sso(auth, {
- *   admin: {
- *     authorized: async (ctx, input) => { /* check permissions *\/ },
+ *   permissions: {
+ *     sso: { require: ["workspace.sso.manage"] },
  *   },
+ *   access: async (_ctx, _input, _required) => {},
  * });
  *
  * export const createConnection = mounted.admin.connection.create;
@@ -122,114 +209,284 @@ type EnterpriseMountOptions<TRoleId extends string = string> = {
  * ```
  *
  * @see {@link scim}
- * @see {@link enterprise}
+ * @see {@link createAuthGroupSso}
  */
-declare function sso<TAuthorization extends AuthAuthorizationConfig | undefined = undefined>(auth: Pick<AuthApi<TAuthorization>, "context" | "group" | "member" | "sso">, options?: MountedEnterpriseOptions<AuthRoleId<TAuthorization>>): {
+declare function sso<TAuthorization extends AuthAuthorizationConfig | undefined = undefined, TRequirement = unknown>(auth: Pick<AuthApi<TAuthorization>, "context" | "group" | "member">, options?: CreateAuthGroupSsoOptions<TRequirement>): {
   admin: {
     connection: {
-      create: convex_server2.RegisteredMutation<"public", {
+      create: convex_server7.RegisteredMutation<"public", {
         name?: string | undefined;
         slug?: string | undefined;
         status?: "draft" | "active" | "disabled" | undefined;
-        groupId?: string | undefined;
         domain?: string | undefined;
-      }, Promise<any>>;
-      get: convex_server2.RegisteredQuery<"public", {
-        enterpriseId: string;
-      }, Promise<any>>;
-      getByGroup: convex_server2.RegisteredQuery<"public", {
+        protocol: "oidc" | "saml";
         groupId: string;
-      }, Promise<any>>;
-      getByDomain: convex_server2.RegisteredQuery<"public", {
+      }, Promise<{
+        groupId: string;
+        connectionId: string;
+      }>>;
+      get: convex_server7.RegisteredQuery<"public", {
+        connectionId: string;
+      }, Promise<GroupConnectionRecord | null>>;
+      getByDomain: convex_server7.RegisteredQuery<"public", {
         domain: string;
-      }, Promise<any>>;
-      list: convex_server2.RegisteredQuery<"public", {
+      }, Promise<GroupConnectionDomainLookupRecord | null>>;
+      list: convex_server7.RegisteredQuery<"public", {
+        limit?: number | undefined;
         where?: {
           slug?: string | undefined;
           status?: "draft" | "active" | "disabled" | undefined;
           groupId?: string | undefined;
         } | undefined;
-        limit?: number | undefined;
         cursor?: string | null | undefined;
         orderBy?: string | undefined;
         order?: "asc" | "desc" | undefined;
-      }, Promise<any>>;
-      update: convex_server2.RegisteredMutation<"public", {
-        enterpriseId: string;
+      }, Promise<GroupConnectionListResult>>;
+      update: convex_server7.RegisteredMutation<"public", {
+        connectionId: string;
         data: {
           name?: string | undefined;
           slug?: string | undefined;
           status?: "draft" | "active" | "disabled" | undefined;
         };
       }, Promise<{
-        enterpriseId: string;
+        connectionId: string;
+      }>>;
+      delete: convex_server7.RegisteredMutation<"public", {
+        connectionId: string;
+      }, Promise<{
+        connectionId: string;
+      }>>;
+      status: convex_server7.RegisteredQuery<"public", {
+        connectionId: string;
+      }, Promise<{
+        connectionId: string;
+        status: "draft" | "active" | "disabled";
+        ready: boolean;
+        domainCount: number;
+        protocols: {
+          oidc: {
+            configured: boolean;
+            ready: boolean;
+            clientId: string | null;
+            issuer: string | null;
+          };
+          saml: {
+            configured: boolean;
+            ready: boolean;
+            entityId: string | null;
+          };
+          scim: {
+            configured: boolean;
+            ready: boolean;
+            basePath: string | null;
+            deprovisionMode: GroupConnectionDeprovisionMode;
+          };
+        };
       }>>;
-      delete: convex_server2.RegisteredMutation<"public", {
-        enterpriseId: string;
-      }, Promise<any>>;
-      status: convex_server2.RegisteredQuery<"public", {
-        enterpriseId: string;
-      }, Promise<any>>;
       domain: {
-        list: convex_server2.RegisteredQuery<"public", {
-          enterpriseId: string;
-        }, Promise<any>>;
-        validate: convex_server2.RegisteredQuery<"public", {
-          enterpriseId: string;
-        }, Promise<any>>;
-        set: convex_server2.RegisteredMutation<"public", {
-          enterpriseId: string;
+        list: convex_server7.RegisteredQuery<"public", {
+          connectionId: string;
+        }, Promise<ConnectionDomainRecord[]>>;
+        status: convex_server7.RegisteredQuery<"public", {
+          connectionId: string;
+        }, Promise<{
+          connectionId: string;
+          ready: boolean;
+          primaryDomain: {
+            domainId: string;
+            domain: string;
+            isPrimary: boolean;
+            verified: boolean;
+            verifiedAt: number | null;
+          } | null;
+          trustedDomains: {
+            domainId: string;
+            domain: string;
+            isPrimary: boolean;
+            verified: boolean;
+            verifiedAt: number | null;
+          }[];
+          pendingChallenges: {
+            domain: string;
+            recordName: string;
+            expiresAt: number;
+          }[];
+          trust: {
+            domainDiscoveryReady: boolean;
+            primaryDomainVerified: boolean;
+            automaticLinkingEligible: boolean;
+          };
+          warnings: string[];
+          nextSteps: string[];
+        }>>;
+        validate: convex_server7.RegisteredQuery<"public", {
+          connectionId: string;
+        }, Promise<{
+          connectionId: string;
+          ready: boolean;
+          summary: {
+            domainCount: number;
+            primaryCount: number;
+            verifiedCount: number;
+          };
+          domains: {
+            domainId: string;
+            domain: string;
+            isPrimary: boolean;
+            verified: boolean;
+            verifiedAt: number | null;
+          }[];
+          warnings: string[];
+        }>>;
+        set: convex_server7.RegisteredMutation<"public", {
+          connectionId: string;
           domains: {
             isPrimary?: boolean | undefined;
             domain: string;
           }[];
-        }, Promise<any>>;
+        }, Promise<{
+          connectionId: string;
+          domains: Array<{
+            domainId: string;
+            domain: string;
+            isPrimary: boolean;
+            verified: boolean;
+            verifiedAt: number | null;
+          }>;
+        }>>;
         verification: {
-          request: convex_server2.RegisteredMutation<"public", {
-            enterpriseId: string;
+          request: convex_server7.RegisteredMutation<"public", {
+            connectionId: string;
+            domain: string;
+          }, Promise<{
+            connectionId: string;
+            domain: string;
+            requestedAt: number;
+            expiresAt: number;
+            challenge: {
+              recordType: "TXT";
+              recordName: string;
+              recordValue: string;
+            };
+          }>>;
+          confirm: convex_server7.RegisteredAction<"public", {
+            connectionId: string;
             domain: string;
-          }, Promise<any>>;
-          confirm: convex_server2.RegisteredAction<"public", {
-            enterpriseId: string;
+          }, Promise<{
+            connectionId: string;
             domain: string;
-          }, Promise<any>>;
+            verifiedAt?: number;
+            checks: Array<{
+              name: string;
+              ok: boolean;
+              message?: string;
+            }>;
+          }>>;
         };
       };
     };
     oidc: {
-      configure: convex_server2.RegisteredMutation<"public", {
-        scopes?: string[] | undefined;
-        issuer?: string | undefined;
-        discoveryUrl?: string | undefined;
-        clientSecret?: string | undefined;
-        authorizationParams?: Record<string, string> | undefined;
-        clockToleranceSeconds?: number | undefined;
-        strictIssuer?: boolean | undefined;
-        extraFields?: Record<string, string> | undefined;
-        enterpriseId: string;
-        clientId: string;
-      }, Promise<any>>;
-      get: convex_server2.RegisteredQuery<"public", {
-        enterpriseId: string;
-      }, Promise<any>>;
-      validate: convex_server2.RegisteredAction<"public", {
-        enterpriseId: string;
-      }, Promise<any>>;
+      configure: convex_server7.RegisteredMutation<"public", {
+        profile?: {
+          mapping?: {
+            email?: string | undefined;
+            emailVerified?: string | undefined;
+            name?: string | undefined;
+            image?: string | undefined;
+            groups?: string | undefined;
+            roles?: string | undefined;
+            subject?: string | undefined;
+          } | undefined;
+          extraFields?: Record<string, string> | undefined;
+        } | undefined;
+        request?: {
+          scopes?: string[] | undefined;
+          loginHint?: string | undefined;
+          authorizationParams?: Record<string, string> | undefined;
+        } | undefined;
+        security?: {
+          clockToleranceSeconds?: number | undefined;
+          strictIssuer?: boolean | undefined;
+        } | undefined;
+        connectionId: string;
+        discovery: {
+          issuer?: string | undefined;
+          discoveryUrl?: string | undefined;
+          jwksUri?: string | undefined;
+          audience?: string | string[] | undefined;
+        };
+        client: {
+          secret?: string | undefined;
+          authMethod?: "client_secret_post" | "client_secret_basic" | undefined;
+          id: string;
+        };
+      }, Promise<{
+        hasClientSecret: boolean;
+      }>>;
+      get: convex_server7.RegisteredQuery<"public", {
+        connectionId: string;
+      }, Promise<{
+        hasClientSecret: boolean;
+      }>>;
+      validate: convex_server7.RegisteredAction<"public", {
+        connectionId: string;
+      }, Promise<{
+        ok: boolean;
+        connectionId: string;
+        checks: {
+          name: string;
+          ok: boolean;
+          message?: string;
+        }[];
+      }>>;
+      status: convex_server7.RegisteredQuery<"public", {
+        connectionId: string;
+      }, Promise<{
+        connectionId: string;
+        configured: boolean;
+        ready: boolean;
+        config: {
+          hasClientSecret: boolean;
+        };
+        checks: {
+          name: string;
+          ok: boolean;
+          message: string | undefined;
+        }[];
+      }>>;
     };
     saml: {
-      configure: convex_server2.RegisteredAction<"public", {
+      configure: convex_server7.RegisteredAction<"public", {
+        profile?: {
+          mapping?: {
+            email?: string | undefined;
+            name?: string | undefined;
+            image?: string | undefined;
+            groups?: string | undefined;
+            roles?: string | undefined;
+            subject?: string | undefined;
+            firstName?: string | undefined;
+            lastName?: string | undefined;
+          } | undefined;
+          extraFields?: Record<string, string> | undefined;
+        } | undefined;
         domains?: string[] | undefined;
-        metadataXml?: string | undefined;
-        metadataUrl?: string | undefined;
-        signAuthnRequests?: boolean | undefined;
-        attributeMapping?: {
-          name?: string | undefined;
-          email?: string | undefined;
-          subject?: string | undefined;
-          firstName?: string | undefined;
-          lastName?: string | undefined;
+        request?: {
+          signAuthnRequests?: boolean | undefined;
+          nameIdFormat?: string | undefined;
+          forceAuthn?: boolean | undefined;
+          authnContextClassRefs?: string[] | undefined;
+        } | undefined;
+        security?: {
+          requireSignedAssertions?: boolean | undefined;
+          requireTimestamps?: boolean | undefined;
+          clockSkewSeconds?: number | undefined;
+          weakAlgorithmHandling?: "warn" | "reject" | undefined;
+          maxMetadataSize?: number | undefined;
+          maxResponseSize?: number | undefined;
         } | undefined;
-        sp?: {
+        serviceProvider?: {
           entityId?: string | undefined;
           acsUrl?: string | undefined;
           sloUrl?: string | undefined;
@@ -240,18 +497,55 @@ declare function sso<TAuthorization extends AuthAuthorizationConfig | undefined
           encPrivateKey?: string | undefined;
           encPrivateKeyPass?: string | undefined;
         } | undefined;
-        enterpriseId: string;
-      }, Promise<any>>;
-      validate: convex_server2.RegisteredQuery<"public", {
-        enterpriseId: string;
-      }, Promise<any>>;
+        metadata: {
+          url?: string | undefined;
+          xml?: string | undefined;
+        };
+        connectionId: string;
+      }, Promise<{
+        connectionId: string;
+        groupId: string;
+      }>>;
+      validate: convex_server7.RegisteredQuery<"public", {
+        connectionId: string;
+      }, Promise<{
+        ok: boolean;
+        connectionId: string;
+        checks: {
+          name: string;
+          ok: boolean;
+          message?: string;
+        }[];
+      }>>;
+      get: convex_server7.RegisteredQuery<"public", {
+        connectionId: string;
+      }, Promise<Record<string, unknown>>>;
+      status: convex_server7.RegisteredQuery<"public", {
+        connectionId: string;
+      }, Promise<{
+        connectionId: string;
+        configured: boolean;
+        ready: boolean;
+        config: Record<string, unknown>;
+        checks: {
+          name: string;
+          ok: boolean;
+          message: string | undefined;
+        }[];
+      }>>;
+      refresh: convex_server7.RegisteredAction<"public", {
+        connectionId: string;
+      }, Promise<{
+        connectionId: string;
+        groupId: string;
+      }>>;
     };
     policy: {
-      get: convex_server2.RegisteredQuery<"public", {
-        enterpriseId: string;
-      }, Promise<any>>;
-      update: convex_server2.RegisteredMutation<"public", {
-        enterpriseId: string;
+      get: convex_server7.RegisteredQuery<"public", {
+        groupId: string;
+      }, Promise<GroupConnectionPolicy>>;
+      update: convex_server7.RegisteredMutation<"public", {
+        groupId: string;
         patch: {
           identity?: {
             accountLinking?: {
@@ -260,6 +554,12 @@ declare function sso<TAuthorization extends AuthAuthorizationConfig | undefined
             } | undefined;
           } | undefined;
           provisioning?: {
+            user?: {
+              createOnSignIn?: boolean | undefined;
+              updateProfileOnLogin?: "never" | "missing" | "always" | undefined;
+              updateProfileFromScim?: "never" | "missing" | "always" | undefined;
+              authority?: "app" | "sso" | "scim" | undefined;
+            } | undefined;
             scimReuse?: {
               user?: "none" | "externalId" | undefined;
             } | undefined;
@@ -270,86 +570,129 @@ declare function sso<TAuthorization extends AuthAuthorizationConfig | undefined
             deprovision?: {
               mode?: "soft" | "hard" | undefined;
             } | undefined;
+            groups?: {
+              mode?: "ignore" | "sync" | undefined;
+              source?: "protocol" | undefined;
+              mapping?: Record<string, string[]> | undefined;
+            } | undefined;
+            roles?: {
+              mode?: "map" | "ignore" | undefined;
+              source?: "protocol" | undefined;
+              mapping?: Record<string, string[]> | undefined;
+            } | undefined;
           } | undefined;
         };
-      }, Promise<any>>;
-      validate: convex_server2.RegisteredQuery<"public", {
-        enterpriseId: string;
-      }, Promise<any>>;
+      }, Promise<GroupConnectionPolicy>>;
+      validate: convex_server7.RegisteredQuery<"public", {
+        groupId: string;
+      }, Promise<{
+        ok: boolean;
+        groupId: string;
+        checks: {
+          name: string;
+          ok: boolean;
+          message: string;
+        }[];
+        policy?: undefined;
+      } | {
+        ok: boolean;
+        groupId: string;
+        policy: GroupConnectionPolicy;
+        checks: {
+          name: string;
+          ok: boolean;
+          message?: string;
+        }[];
+      }>>;
     };
     audit: {
-      list: convex_server2.RegisteredQuery<"public", {
-        limit?: number | undefined;
+      list: convex_server7.RegisteredQuery<"public", {
         groupId?: string | undefined;
-        enterpriseId?: string | undefined;
-      }, Promise<any>>;
+        connectionId?: string | undefined;
+        limit?: number | undefined;
+      }, Promise<AuditEventRecord[]>>;
     };
     webhook: {
       delivery: {
-        list: convex_server2.RegisteredQuery<"public", {
+        list: convex_server7.RegisteredQuery<"public", {
           limit?: number | undefined;
-          enterpriseId: string;
-        }, Promise<any>>;
+          connectionId: string;
+        }, Promise<unknown>>;
       };
       endpoint: {
-        create: convex_server2.RegisteredMutation<"public", {
+        create: convex_server7.RegisteredMutation<"public", {
           createdByUserId?: string | undefined;
           secret: string;
-          enterpriseId: string;
+          connectionId: string;
           url: string;
           subscriptions: string[];
         }, Promise<{
-          _id: any;
-          enterpriseId: string;
+          _id: string;
+          connectionId: string;
           url: string;
           subscriptions: string[];
           createdByUserId: string;
           status: string;
           failureCount: number;
         }>>;
-        list: convex_server2.RegisteredQuery<"public", {
-          enterpriseId: string;
-        }, Promise<any>>;
-        disable: convex_server2.RegisteredMutation<"public", {
+        list: convex_server7.RegisteredQuery<"public", {
+          connectionId: string;
+        }, Promise<{
+          [x: string]: unknown;
+        }[]>>;
+        disable: convex_server7.RegisteredMutation<"public", {
+          endpointId: string;
+        }, Promise<{
           endpointId: string;
-        }, Promise<any>>;
+        }>>;
       };
     };
   };
   client: {
-    signIn: convex_server2.RegisteredQuery<"public", {
+    signIn: convex_server7.RegisteredQuery<"public", {
       email?: string | undefined;
-      enterpriseId?: string | undefined;
+      connectionId?: string | undefined;
       domain?: string | undefined;
+      loginHint?: string | undefined;
       redirectTo?: string | undefined;
-    }, Promise<any>>;
-    metadata: convex_server2.RegisteredQuery<"public", {
+    }, Promise<{
+      connectionId: string;
+      protocol: "oidc" | "saml";
+      providerId: string;
+      signInPath: string;
+      callbackPath: string;
+      redirectTo?: string;
+    }>>;
+    metadata: convex_server7.RegisteredQuery<"public", {
       entityId?: string | undefined;
       acsUrl?: string | undefined;
       sloUrl?: string | undefined;
-      enterpriseId: string;
-    }, Promise<any>>;
+      connectionId: string;
+    }, Promise<string>>;
   };
 };
 /**
  * Build optional public SCIM management actions that apps can mount under
- * `convex/auth/scim/**` when they want client-callable enterprise admin APIs.
+ * `convex/auth/group/**` when they want client-callable group SSO admin APIs.
  *
- * @param auth - Auth API subset providing `scim`, `sso`, and `user` namespaces.
- * @param options - Optional admin authorization config. See {@link EnterpriseMountOptions}.
+ * @param auth - Auth API subset providing `group` and `context` namespaces.
+ * @param options - Optional admin access config. See {@link CreateAuthGroupSsoOptions}.
  * @typeParam TAuthorization - Optional authorization config for typed role IDs.
+ * @typeParam TRequirement - App-defined requirement values used by declarative
+ *   `permissions` configs.
  * @returns An object with `admin.configure`, `admin.get`, and `admin.validate` actions.
  *
  * @example
  * ```ts
- * // convex/auth/scim.ts
+ * // convex/auth/group.ts
  * import { scim } from "@robelest/convex-auth/server";
  * import { auth } from "../auth";
  *
  * const mounted = scim(auth, {
- *   admin: {
- *     authorized: async (ctx, input) => { /* check permissions *\/ },
+ *   permissions: {
+ *     scim: { require: ["workspace.scim.manage"] },
  *   },
+ *   access: async (_ctx, _input, _required) => {},
  * });
  *
  * export const configure = mounted.admin.configure;
@@ -358,48 +701,157 @@ declare function sso<TAuthorization extends AuthAuthorizationConfig | undefined
  * ```
  *
  * @see {@link sso}
- * @see {@link enterprise}
+ * @see {@link createAuthGroupSso}
  */
-declare function scim<TAuthorization extends AuthAuthorizationConfig | undefined = undefined>(auth: Pick<AuthApi<TAuthorization>, "context" | "scim" | "sso">, options?: MountedEnterpriseOptions<AuthRoleId<TAuthorization>>): {
+declare function scim<TAuthorization extends AuthAuthorizationConfig | undefined = undefined, TRequirement = unknown>(auth: Pick<AuthApi<TAuthorization>, "context" | "group">, options?: CreateAuthGroupSsoOptions<TRequirement>): {
   admin: {
-    configure: convex_server2.RegisteredMutation<"public", {
+    configure: convex_server7.RegisteredMutation<"public", {
+      profile?: {
+        mapping?: {
+          email?: string | undefined;
+          name?: string | undefined;
+          phone?: string | undefined;
+          externalId?: string | undefined;
+          groups?: string | undefined;
+          roles?: string | undefined;
+          active?: string | undefined;
+          subject?: string | undefined;
+          firstName?: string | undefined;
+          lastName?: string | undefined;
+        } | undefined;
+        extraFields?: Record<string, string> | undefined;
+      } | undefined;
       status?: "draft" | "active" | "disabled" | undefined;
-      basePath?: string | undefined;
-      enterpriseId: string;
-    }, Promise<any>>;
-    get: convex_server2.RegisteredQuery<"public", {
-      enterpriseId: string;
-    }, Promise<any>>;
-    validate: convex_server2.RegisteredQuery<"public", {
-      enterpriseId: string;
-    }, Promise<any>>;
+      security?: {
+        maxRequestSize?: number | undefined;
+      } | undefined;
+      connectionId: string;
+    }, Promise<{
+      connectionId: string;
+      configId: string;
+      basePath: string;
+      token: string;
+    }>>;
+    get: convex_server7.RegisteredQuery<"public", {
+      connectionId: string;
+    }, Promise<{
+      security: {
+        maxRequestSize?: number;
+      } | undefined;
+      profile: {
+        mapping?: {
+          subject?: string;
+          externalId?: string;
+          email?: string;
+          firstName?: string;
+          lastName?: string;
+          name?: string;
+          phone?: string;
+          active?: string;
+          groups?: string;
+          roles?: string;
+        };
+        extraFields?: Record<string, string>;
+      } | undefined;
+      _id: string;
+      _creationTime: number;
+      connectionId: string;
+      groupId: string;
+      status: string;
+      basePath: string;
+      tokenHash: string;
+      lastRotatedAt?: number;
+      extend?: unknown;
+    } | null>>;
+    status: convex_server7.RegisteredQuery<"public", {
+      connectionId: string;
+    }, Promise<{
+      connectionId: string;
+      configured: boolean;
+      ready: boolean;
+      config: ScimConfigRecord | null;
+      checks: {
+        name: string;
+        ok: boolean;
+        message?: string;
+      }[] | {
+        name: string;
+        ok: boolean;
+        message: string;
+      }[];
+      capabilities: {
+        users: boolean;
+        groups: boolean;
+        patch: boolean;
+        put: boolean;
+        filters: string[];
+        bulk: boolean;
+        etag: boolean;
+      } | undefined;
+    }>>;
+    validate: convex_server7.RegisteredQuery<"public", {
+      connectionId: string;
+    }, Promise<{
+      ok: boolean;
+      connectionId: string;
+      checks: {
+        name: string;
+        ok: boolean;
+        message: string;
+      }[];
+      basePath?: undefined;
+      deprovisionMode?: undefined;
+      capabilities?: undefined;
+    } | {
+      ok: boolean;
+      connectionId: string;
+      basePath: string;
+      deprovisionMode: GroupConnectionDeprovisionMode;
+      capabilities: {
+        users: boolean;
+        groups: boolean;
+        patch: boolean;
+        put: boolean;
+        filters: string[];
+        bulk: boolean;
+        etag: boolean;
+      };
+      checks: {
+        name: string;
+        ok: boolean;
+        message?: string;
+      }[];
+    }>>;
   };
 };
 /**
- * Build a flat mounted enterprise API surface for app-owned Convex exports.
+ * Build a flat mounted group SSO API surface for app-owned Convex exports.
  *
  * Combines {@link sso} and {@link scim} into a single flat object with
  * all SSO connection, protocol, policy, audit, webhook, and SCIM
- * management functions plus end-user sign-in helpers. The `authorized`
- * callback is required for all admin operations.
+ * management functions plus end-user sign-in helpers. The `access`
+ * config is required for all admin operations.
  *
- * @param auth - Auth API subset providing `group`, `member`, `scim`, `sso`, and `user` namespaces.
- * @param options - Required {@link EnterpriseMountOptions} with an `admin.authorized` callback.
+ * @param auth - Auth API subset providing `group`, `member`, and `context` namespaces.
+ * @param options - Required {@link CreateAuthGroupSsoOptions} with an `access` policy.
  * @typeParam TAuthorization - Optional authorization config for typed role IDs.
- * @returns A flat object with all enterprise management functions (e.g. `createConnection`,
+ * @typeParam TRequirement - App-defined requirement values used by declarative
+ *   `permissions` configs.
+ * @returns A flat object with all group connection management functions (e.g. `createConnection`,
  *   `configureOidc`, `configureScim`, `signIn`, etc.).
  *
  * @example
  * ```ts
- * // convex/auth/enterprise.ts
- * import { enterprise } from "@robelest/convex-auth/server";
+ * // convex/auth/group.ts
+ * import { createAuthGroupSso } from "@robelest/convex-auth/server";
  * import { auth } from "../auth";
  *
- * const api = enterprise(auth, {
- *   admin: {
- *     authorized: async (ctx, input) => { /* check permissions *\/ },
- *     roles: ["admin"],
+ * const api = createAuthGroupSso(auth, {
+ *   permissions: {
+ *     sso: { require: ["workspace.sso.manage"] },
+ *     scim: { require: ["workspace.scim.manage"] },
  *   },
+ *   access: async (_ctx, _input, _required) => {},
  * });
  *
  * export const createConnection = api.createConnection;
@@ -410,102 +862,272 @@ declare function scim<TAuthorization extends AuthAuthorizationConfig | undefined
  * @see {@link sso}
  * @see {@link scim}
  */
-declare function enterprise<TAuthorization extends AuthAuthorizationConfig | undefined = undefined>(auth: Pick<AuthApi<TAuthorization>, "context" | "group" | "member" | "scim" | "sso">, options: EnterpriseMountOptions<AuthRoleId<TAuthorization>>): {
-  createConnection: convex_server2.RegisteredMutation<"public", {
+declare function createAuthGroupSso<TAuthorization extends AuthAuthorizationConfig | undefined = undefined, TRequirement = unknown>(auth: Pick<AuthApi<TAuthorization>, "context" | "group" | "member">, options: CreateAuthGroupSsoOptions<TRequirement>): {
+  createConnection: convex_server7.RegisteredMutation<"public", {
     name?: string | undefined;
     slug?: string | undefined;
     status?: "draft" | "active" | "disabled" | undefined;
-    groupId?: string | undefined;
     domain?: string | undefined;
-  }, Promise<any>>;
-  getConnection: convex_server2.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  getConnectionByGroup: convex_server2.RegisteredQuery<"public", {
+    protocol: "oidc" | "saml";
     groupId: string;
-  }, Promise<any>>;
-  getConnectionByDomain: convex_server2.RegisteredQuery<"public", {
+  }, Promise<{
+    groupId: string;
+    connectionId: string;
+  }>>;
+  getConnection: convex_server7.RegisteredQuery<"public", {
+    connectionId: string;
+  }, Promise<GroupConnectionRecord | null>>;
+  getConnectionByDomain: convex_server7.RegisteredQuery<"public", {
     domain: string;
-  }, Promise<any>>;
-  listConnections: convex_server2.RegisteredQuery<"public", {
+  }, Promise<GroupConnectionDomainLookupRecord | null>>;
+  listConnections: convex_server7.RegisteredQuery<"public", {
+    limit?: number | undefined;
     where?: {
       slug?: string | undefined;
       status?: "draft" | "active" | "disabled" | undefined;
       groupId?: string | undefined;
     } | undefined;
-    limit?: number | undefined;
     cursor?: string | null | undefined;
     orderBy?: string | undefined;
     order?: "asc" | "desc" | undefined;
-  }, Promise<any>>;
-  updateConnection: convex_server2.RegisteredMutation<"public", {
-    enterpriseId: string;
+  }, Promise<GroupConnectionListResult>>;
+  updateConnection: convex_server7.RegisteredMutation<"public", {
+    connectionId: string;
     data: {
       name?: string | undefined;
       slug?: string | undefined;
       status?: "draft" | "active" | "disabled" | undefined;
     };
   }, Promise<{
-    enterpriseId: string;
+    connectionId: string;
+  }>>;
+  deleteConnection: convex_server7.RegisteredMutation<"public", {
+    connectionId: string;
+  }, Promise<{
+    connectionId: string;
+  }>>;
+  getConnectionStatus: convex_server7.RegisteredQuery<"public", {
+    connectionId: string;
+  }, Promise<{
+    connectionId: string;
+    status: "draft" | "active" | "disabled";
+    ready: boolean;
+    domainCount: number;
+    protocols: {
+      oidc: {
+        configured: boolean;
+        ready: boolean;
+        clientId: string | null;
+        issuer: string | null;
+      };
+      saml: {
+        configured: boolean;
+        ready: boolean;
+        entityId: string | null;
+      };
+      scim: {
+        configured: boolean;
+        ready: boolean;
+        basePath: string | null;
+        deprovisionMode: GroupConnectionDeprovisionMode;
+      };
+    };
+  }>>;
+  listDomains: convex_server7.RegisteredQuery<"public", {
+    connectionId: string;
+  }, Promise<ConnectionDomainRecord[]>>;
+  getDomainStatus: convex_server7.RegisteredQuery<"public", {
+    connectionId: string;
+  }, Promise<{
+    connectionId: string;
+    ready: boolean;
+    primaryDomain: {
+      domainId: string;
+      domain: string;
+      isPrimary: boolean;
+      verified: boolean;
+      verifiedAt: number | null;
+    } | null;
+    trustedDomains: {
+      domainId: string;
+      domain: string;
+      isPrimary: boolean;
+      verified: boolean;
+      verifiedAt: number | null;
+    }[];
+    pendingChallenges: {
+      domain: string;
+      recordName: string;
+      expiresAt: number;
+    }[];
+    trust: {
+      domainDiscoveryReady: boolean;
+      primaryDomainVerified: boolean;
+      automaticLinkingEligible: boolean;
+    };
+    warnings: string[];
+    nextSteps: string[];
+  }>>;
+  validateDomains: convex_server7.RegisteredQuery<"public", {
+    connectionId: string;
+  }, Promise<{
+    connectionId: string;
+    ready: boolean;
+    summary: {
+      domainCount: number;
+      primaryCount: number;
+      verifiedCount: number;
+    };
+    domains: {
+      domainId: string;
+      domain: string;
+      isPrimary: boolean;
+      verified: boolean;
+      verifiedAt: number | null;
+    }[];
+    warnings: string[];
   }>>;
-  deleteConnection: convex_server2.RegisteredMutation<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  getConnectionStatus: convex_server2.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  listDomains: convex_server2.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  validateDomains: convex_server2.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  setDomains: convex_server2.RegisteredMutation<"public", {
-    enterpriseId: string;
+  setDomains: convex_server7.RegisteredMutation<"public", {
+    connectionId: string;
     domains: {
       isPrimary?: boolean | undefined;
       domain: string;
     }[];
-  }, Promise<any>>;
-  requestDomainVerification: convex_server2.RegisteredMutation<"public", {
-    enterpriseId: string;
+  }, Promise<{
+    connectionId: string;
+    domains: Array<{
+      domainId: string;
+      domain: string;
+      isPrimary: boolean;
+      verified: boolean;
+      verifiedAt: number | null;
+    }>;
+  }>>;
+  requestDomainVerification: convex_server7.RegisteredMutation<"public", {
+    connectionId: string;
+    domain: string;
+  }, Promise<{
+    connectionId: string;
+    domain: string;
+    requestedAt: number;
+    expiresAt: number;
+    challenge: {
+      recordType: "TXT";
+      recordName: string;
+      recordValue: string;
+    };
+  }>>;
+  confirmDomainVerification: convex_server7.RegisteredAction<"public", {
+    connectionId: string;
     domain: string;
-  }, Promise<any>>;
-  confirmDomainVerification: convex_server2.RegisteredAction<"public", {
-    enterpriseId: string;
+  }, Promise<{
+    connectionId: string;
     domain: string;
-  }, Promise<any>>;
-  configureOidc: convex_server2.RegisteredMutation<"public", {
-    scopes?: string[] | undefined;
-    issuer?: string | undefined;
-    discoveryUrl?: string | undefined;
-    clientSecret?: string | undefined;
-    authorizationParams?: Record<string, string> | undefined;
-    clockToleranceSeconds?: number | undefined;
-    strictIssuer?: boolean | undefined;
-    extraFields?: Record<string, string> | undefined;
-    enterpriseId: string;
-    clientId: string;
-  }, Promise<any>>;
-  getOidc: convex_server2.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  validateOidc: convex_server2.RegisteredAction<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  configureSaml: convex_server2.RegisteredAction<"public", {
+    verifiedAt?: number;
+    checks: Array<{
+      name: string;
+      ok: boolean;
+      message?: string;
+    }>;
+  }>>;
+  configureOidc: convex_server7.RegisteredMutation<"public", {
+    profile?: {
+      mapping?: {
+        email?: string | undefined;
+        emailVerified?: string | undefined;
+        name?: string | undefined;
+        image?: string | undefined;
+        groups?: string | undefined;
+        roles?: string | undefined;
+        subject?: string | undefined;
+      } | undefined;
+      extraFields?: Record<string, string> | undefined;
+    } | undefined;
+    request?: {
+      scopes?: string[] | undefined;
+      loginHint?: string | undefined;
+      authorizationParams?: Record<string, string> | undefined;
+    } | undefined;
+    security?: {
+      clockToleranceSeconds?: number | undefined;
+      strictIssuer?: boolean | undefined;
+    } | undefined;
+    connectionId: string;
+    discovery: {
+      issuer?: string | undefined;
+      discoveryUrl?: string | undefined;
+      jwksUri?: string | undefined;
+      audience?: string | string[] | undefined;
+    };
+    client: {
+      secret?: string | undefined;
+      authMethod?: "client_secret_post" | "client_secret_basic" | undefined;
+      id: string;
+    };
+  }, Promise<{
+    hasClientSecret: boolean;
+  }>>;
+  getOidc: convex_server7.RegisteredQuery<"public", {
+    connectionId: string;
+  }, Promise<{
+    hasClientSecret: boolean;
+  }>>;
+  getOidcStatus: convex_server7.RegisteredQuery<"public", {
+    connectionId: string;
+  }, Promise<{
+    connectionId: string;
+    configured: boolean;
+    ready: boolean;
+    config: {
+      hasClientSecret: boolean;
+    };
+    checks: {
+      name: string;
+      ok: boolean;
+      message: string | undefined;
+    }[];
+  }>>;
+  validateOidc: convex_server7.RegisteredAction<"public", {
+    connectionId: string;
+  }, Promise<{
+    ok: boolean;
+    connectionId: string;
+    checks: {
+      name: string;
+      ok: boolean;
+      message?: string;
+    }[];
+  }>>;
+  configureSaml: convex_server7.RegisteredAction<"public", {
+    profile?: {
+      mapping?: {
+        email?: string | undefined;
+        name?: string | undefined;
+        image?: string | undefined;
+        groups?: string | undefined;
+        roles?: string | undefined;
+        subject?: string | undefined;
+        firstName?: string | undefined;
+        lastName?: string | undefined;
+      } | undefined;
+      extraFields?: Record<string, string> | undefined;
+    } | undefined;
     domains?: string[] | undefined;
-    metadataXml?: string | undefined;
-    metadataUrl?: string | undefined;
-    signAuthnRequests?: boolean | undefined;
-    attributeMapping?: {
-      name?: string | undefined;
-      email?: string | undefined;
-      subject?: string | undefined;
-      firstName?: string | undefined;
-      lastName?: string | undefined;
+    request?: {
+      signAuthnRequests?: boolean | undefined;
+      nameIdFormat?: string | undefined;
+      forceAuthn?: boolean | undefined;
+      authnContextClassRefs?: string[] | undefined;
     } | undefined;
-    sp?: {
+    security?: {
+      requireSignedAssertions?: boolean | undefined;
+      requireTimestamps?: boolean | undefined;
+      clockSkewSeconds?: number | undefined;
+      weakAlgorithmHandling?: "warn" | "reject" | undefined;
+      maxMetadataSize?: number | undefined;
+      maxResponseSize?: number | undefined;
+    } | undefined;
+    serviceProvider?: {
       entityId?: string | undefined;
       acsUrl?: string | undefined;
       sloUrl?: string | undefined;
@@ -516,16 +1138,53 @@ declare function enterprise<TAuthorization extends AuthAuthorizationConfig | und
       encPrivateKey?: string | undefined;
       encPrivateKeyPass?: string | undefined;
     } | undefined;
-    enterpriseId: string;
-  }, Promise<any>>;
-  validateSaml: convex_server2.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  getPolicy: convex_server2.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  updatePolicy: convex_server2.RegisteredMutation<"public", {
-    enterpriseId: string;
+    metadata: {
+      url?: string | undefined;
+      xml?: string | undefined;
+    };
+    connectionId: string;
+  }, Promise<{
+    connectionId: string;
+    groupId: string;
+  }>>;
+  getSaml: convex_server7.RegisteredQuery<"public", {
+    connectionId: string;
+  }, Promise<Record<string, unknown>>>;
+  getSamlStatus: convex_server7.RegisteredQuery<"public", {
+    connectionId: string;
+  }, Promise<{
+    connectionId: string;
+    configured: boolean;
+    ready: boolean;
+    config: Record<string, unknown>;
+    checks: {
+      name: string;
+      ok: boolean;
+      message: string | undefined;
+    }[];
+  }>>;
+  validateSaml: convex_server7.RegisteredQuery<"public", {
+    connectionId: string;
+  }, Promise<{
+    ok: boolean;
+    connectionId: string;
+    checks: {
+      name: string;
+      ok: boolean;
+      message?: string;
+    }[];
+  }>>;
+  refreshSaml: convex_server7.RegisteredAction<"public", {
+    connectionId: string;
+  }, Promise<{
+    connectionId: string;
+    groupId: string;
+  }>>;
+  getPolicy: convex_server7.RegisteredQuery<"public", {
+    groupId: string;
+  }, Promise<GroupConnectionPolicy>>;
+  updatePolicy: convex_server7.RegisteredMutation<"public", {
+    groupId: string;
     patch: {
       identity?: {
         accountLinking?: {
@@ -534,6 +1193,12 @@ declare function enterprise<TAuthorization extends AuthAuthorizationConfig | und
         } | undefined;
       } | undefined;
       provisioning?: {
+        user?: {
+          createOnSignIn?: boolean | undefined;
+          updateProfileOnLogin?: "never" | "missing" | "always" | undefined;
+          updateProfileFromScim?: "never" | "missing" | "always" | undefined;
+          authority?: "app" | "sso" | "scim" | undefined;
+        } | undefined;
         scimReuse?: {
           user?: "none" | "externalId" | undefined;
         } | undefined;
@@ -544,66 +1209,212 @@ declare function enterprise<TAuthorization extends AuthAuthorizationConfig | und
         deprovision?: {
           mode?: "soft" | "hard" | undefined;
         } | undefined;
+        groups?: {
+          mode?: "ignore" | "sync" | undefined;
+          source?: "protocol" | undefined;
+          mapping?: Record<string, string[]> | undefined;
+        } | undefined;
+        roles?: {
+          mode?: "map" | "ignore" | undefined;
+          source?: "protocol" | undefined;
+          mapping?: Record<string, string[]> | undefined;
+        } | undefined;
       } | undefined;
     };
-  }, Promise<any>>;
-  validatePolicy: convex_server2.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  listAudit: convex_server2.RegisteredQuery<"public", {
-    limit?: number | undefined;
+  }, Promise<GroupConnectionPolicy>>;
+  validatePolicy: convex_server7.RegisteredQuery<"public", {
+    groupId: string;
+  }, Promise<{
+    ok: boolean;
+    groupId: string;
+    checks: {
+      name: string;
+      ok: boolean;
+      message: string;
+    }[];
+    policy?: undefined;
+  } | {
+    ok: boolean;
+    groupId: string;
+    policy: GroupConnectionPolicy;
+    checks: {
+      name: string;
+      ok: boolean;
+      message?: string;
+    }[];
+  }>>;
+  listAudit: convex_server7.RegisteredQuery<"public", {
     groupId?: string | undefined;
-    enterpriseId?: string | undefined;
-  }, Promise<any>>;
-  createWebhookEndpoint: convex_server2.RegisteredMutation<"public", {
+    connectionId?: string | undefined;
+    limit?: number | undefined;
+  }, Promise<AuditEventRecord[]>>;
+  createWebhookEndpoint: convex_server7.RegisteredMutation<"public", {
     createdByUserId?: string | undefined;
     secret: string;
-    enterpriseId: string;
+    connectionId: string;
     url: string;
     subscriptions: string[];
   }, Promise<{
-    _id: any;
-    enterpriseId: string;
+    _id: string;
+    connectionId: string;
     url: string;
     subscriptions: string[];
     createdByUserId: string;
     status: string;
     failureCount: number;
   }>>;
-  listWebhookEndpoints: convex_server2.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  listWebhookDeliveries: convex_server2.RegisteredQuery<"public", {
+  listWebhookEndpoints: convex_server7.RegisteredQuery<"public", {
+    connectionId: string;
+  }, Promise<{
+    [x: string]: unknown;
+  }[]>>;
+  listWebhookDeliveries: convex_server7.RegisteredQuery<"public", {
     limit?: number | undefined;
-    enterpriseId: string;
-  }, Promise<any>>;
-  disableWebhookEndpoint: convex_server2.RegisteredMutation<"public", {
+    connectionId: string;
+  }, Promise<unknown>>;
+  disableWebhookEndpoint: convex_server7.RegisteredMutation<"public", {
     endpointId: string;
-  }, Promise<any>>;
-  configureScim: convex_server2.RegisteredMutation<"public", {
+  }, Promise<{
+    endpointId: string;
+  }>>;
+  configureScim: convex_server7.RegisteredMutation<"public", {
+    profile?: {
+      mapping?: {
+        email?: string | undefined;
+        name?: string | undefined;
+        phone?: string | undefined;
+        externalId?: string | undefined;
+        groups?: string | undefined;
+        roles?: string | undefined;
+        active?: string | undefined;
+        subject?: string | undefined;
+        firstName?: string | undefined;
+        lastName?: string | undefined;
+      } | undefined;
+      extraFields?: Record<string, string> | undefined;
+    } | undefined;
     status?: "draft" | "active" | "disabled" | undefined;
-    basePath?: string | undefined;
-    enterpriseId: string;
-  }, Promise<any>>;
-  getScim: convex_server2.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  validateScim: convex_server2.RegisteredQuery<"public", {
-    enterpriseId: string;
-  }, Promise<any>>;
-  signIn: convex_server2.RegisteredQuery<"public", {
+    security?: {
+      maxRequestSize?: number | undefined;
+    } | undefined;
+    connectionId: string;
+  }, Promise<{
+    connectionId: string;
+    configId: string;
+    basePath: string;
+    token: string;
+  }>>;
+  getScim: convex_server7.RegisteredQuery<"public", {
+    connectionId: string;
+  }, Promise<{
+    security: {
+      maxRequestSize?: number;
+    } | undefined;
+    profile: {
+      mapping?: {
+        subject?: string;
+        externalId?: string;
+        email?: string;
+        firstName?: string;
+        lastName?: string;
+        name?: string;
+        phone?: string;
+        active?: string;
+        groups?: string;
+        roles?: string;
+      };
+      extraFields?: Record<string, string>;
+    } | undefined;
+    _id: string;
+    _creationTime: number;
+    connectionId: string;
+    groupId: string;
+    status: string;
+    basePath: string;
+    tokenHash: string;
+    lastRotatedAt?: number;
+    extend?: unknown;
+  } | null>>;
+  getScimStatus: convex_server7.RegisteredQuery<"public", {
+    connectionId: string;
+  }, Promise<{
+    connectionId: string;
+    configured: boolean;
+    ready: boolean;
+    config: ScimConfigRecord | null;
+    checks: {
+      name: string;
+      ok: boolean;
+      message?: string;
+    }[] | {
+      name: string;
+      ok: boolean;
+      message: string;
+    }[];
+    capabilities: {
+      users: boolean;
+      groups: boolean;
+      patch: boolean;
+      put: boolean;
+      filters: string[];
+      bulk: boolean;
+      etag: boolean;
+    } | undefined;
+  }>>;
+  validateScim: convex_server7.RegisteredQuery<"public", {
+    connectionId: string;
+  }, Promise<{
+    ok: boolean;
+    connectionId: string;
+    checks: {
+      name: string;
+      ok: boolean;
+      message: string;
+    }[];
+    basePath?: undefined;
+    deprovisionMode?: undefined;
+    capabilities?: undefined;
+  } | {
+    ok: boolean;
+    connectionId: string;
+    basePath: string;
+    deprovisionMode: GroupConnectionDeprovisionMode;
+    capabilities: {
+      users: boolean;
+      groups: boolean;
+      patch: boolean;
+      put: boolean;
+      filters: string[];
+      bulk: boolean;
+      etag: boolean;
+    };
+    checks: {
+      name: string;
+      ok: boolean;
+      message?: string;
+    }[];
+  }>>;
+  signIn: convex_server7.RegisteredQuery<"public", {
     email?: string | undefined;
-    enterpriseId?: string | undefined;
+    connectionId?: string | undefined;
     domain?: string | undefined;
+    loginHint?: string | undefined;
     redirectTo?: string | undefined;
-  }, Promise<any>>;
-  metadata: convex_server2.RegisteredQuery<"public", {
+  }, Promise<{
+    connectionId: string;
+    protocol: "oidc" | "saml";
+    providerId: string;
+    signInPath: string;
+    callbackPath: string;
+    redirectTo?: string;
+  }>>;
+  metadata: convex_server7.RegisteredQuery<"public", {
     entityId?: string | undefined;
     acsUrl?: string | undefined;
     sloUrl?: string | undefined;
-    enterpriseId: string;
-  }, Promise<any>>;
+    connectionId: string;
+  }, Promise<string>>;
 };
 //#endregion
-export { EnterpriseAdminAuthorizationInput, EnterpriseAdminPermission, EnterpriseAuthorizer, EnterpriseMountOptions, enterprise, scim, sso };
+export { CreateAuthGroupSsoOptions, GroupSsoAccessHandler, GroupSsoAccessInput, GroupSsoAccessPermissions, GroupSsoPermission, GroupSsoResolvedAccessHandler, createAuthGroupSso, scim, sso };
 //# sourceMappingURL=mounts.d.ts.map