@robelest/convex-auth 0.0.4-preview.28 → 0.0.4-preview.29

package/dist/component/schema.d.ts

@@ -1,5 +1,5 @@
-import * as convex_values87 from "convex/values";
-import * as convex_server81 from "convex/server";
+import * as convex_values89 from "convex/values";
+import * as convex_server83 from "convex/server";
 
 //#region src/component/schema.d.ts
 /**
@@ -9,30 +9,32 @@ import * as convex_server81 from "convex/server";
  * verification codes, PKCE verifiers, rate limits) and hierarchical group
  * management (groups, members, invites).
  */
-declare const _default: convex_server81.SchemaDefinition<{
+declare const _default: convex_server83.SchemaDefinition<{
   /**
    * Authenticated users. A user may have multiple linked accounts
    * and multiple concurrent sessions.
    */
-  User: convex_server81.TableDefinition<convex_values87.VObject<{
-    email?: string | undefined;
+  User: convex_server83.TableDefinition<convex_values89.VObject<{
     name?: string | undefined;
-    image?: string | undefined;
+    email?: string | undefined;
     phone?: string | undefined;
     extend?: any;
+    image?: string | undefined;
     emailVerificationTime?: number | undefined;
     phoneVerificationTime?: number | undefined;
     isAnonymous?: boolean | undefined;
+    hasTotp?: boolean | undefined;
   }, {
-    name: convex_values87.VString<string | undefined, "optional">;
-    image: convex_values87.VString<string | undefined, "optional">;
-    email: convex_values87.VString<string | undefined, "optional">;
-    emailVerificationTime: convex_values87.VFloat64<number | undefined, "optional">;
-    phone: convex_values87.VString<string | undefined, "optional">;
-    phoneVerificationTime: convex_values87.VFloat64<number | undefined, "optional">;
-    isAnonymous: convex_values87.VBoolean<boolean | undefined, "optional">;
-    extend: convex_values87.VAny<any, "optional", string>;
-  }, "required", "email" | "name" | "image" | "phone" | "extend" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | `extend.${string}`>, {
+    name: convex_values89.VString<string | undefined, "optional">;
+    image: convex_values89.VString<string | undefined, "optional">;
+    email: convex_values89.VString<string | undefined, "optional">;
+    emailVerificationTime: convex_values89.VFloat64<number | undefined, "optional">;
+    phone: convex_values89.VString<string | undefined, "optional">;
+    phoneVerificationTime: convex_values89.VFloat64<number | undefined, "optional">;
+    isAnonymous: convex_values89.VBoolean<boolean | undefined, "optional">;
+    hasTotp: convex_values89.VBoolean<boolean | undefined, "optional">;
+    extend: convex_values89.VAny<any, "optional", string>;
+  }, "required", "name" | "email" | "phone" | "extend" | "image" | "emailVerificationTime" | "phoneVerificationTime" | "isAnonymous" | "hasTotp" | `extend.${string}`>, {
     email: ["email", "_creationTime"];
     email_verified: ["email", "emailVerificationTime", "_creationTime"];
     phone: ["phone", "_creationTime"];
@@ -43,12 +45,12 @@ declare const _default: convex_server81.SchemaDefinition<{
    * across different devices or browsers. Sessions expire after a
    * configurable duration.
    */
-  Session: convex_server81.TableDefinition<convex_values87.VObject<{
-    userId: convex_values87.GenericId<"User">;
+  Session: convex_server83.TableDefinition<convex_values89.VObject<{
+    userId: convex_values89.GenericId<"User">;
     expirationTime: number;
   }, {
-    userId: convex_values87.VId<convex_values87.GenericId<"User">, "required">;
-    expirationTime: convex_values87.VFloat64<number, "required">;
+    userId: convex_values89.VId<convex_values89.GenericId<"User">, "required">;
+    expirationTime: convex_values89.VFloat64<number, "required">;
   }, "required", "userId" | "expirationTime">, {
     user_id: ["userId", "_creationTime"];
   }, {}, {}>;
@@ -57,23 +59,23 @@ declare const _default: convex_server81.SchemaDefinition<{
    * authentication provider (e.g. Google OAuth, email/password).
    * A user can have multiple accounts linked.
    */
-  Account: convex_server81.TableDefinition<convex_values87.VObject<{
-    emailVerified?: string | undefined;
+  Account: convex_server83.TableDefinition<convex_values89.VObject<{
     extend?: any;
     secret?: string | undefined;
+    emailVerified?: string | undefined;
     phoneVerified?: string | undefined;
-    userId: convex_values87.GenericId<"User">;
+    userId: convex_values89.GenericId<"User">;
     provider: string;
     providerAccountId: string;
   }, {
-    userId: convex_values87.VId<convex_values87.GenericId<"User">, "required">;
-    provider: convex_values87.VString<string, "required">;
-    providerAccountId: convex_values87.VString<string, "required">;
-    secret: convex_values87.VString<string | undefined, "optional">;
-    emailVerified: convex_values87.VString<string | undefined, "optional">;
-    phoneVerified: convex_values87.VString<string | undefined, "optional">;
-    extend: convex_values87.VAny<any, "optional", string>;
-  }, "required", "emailVerified" | "userId" | "extend" | `extend.${string}` | "provider" | "providerAccountId" | "secret" | "phoneVerified">, {
+    userId: convex_values89.VId<convex_values89.GenericId<"User">, "required">;
+    provider: convex_values89.VString<string, "required">;
+    providerAccountId: convex_values89.VString<string, "required">;
+    secret: convex_values89.VString<string | undefined, "optional">;
+    emailVerified: convex_values89.VString<string | undefined, "optional">;
+    phoneVerified: convex_values89.VString<string | undefined, "optional">;
+    extend: convex_values89.VAny<any, "optional", string>;
+  }, "required", "userId" | "extend" | `extend.${string}` | "provider" | "providerAccountId" | "secret" | "emailVerified" | "phoneVerified">, {
     user_id_provider: ["userId", "provider", "_creationTime"];
     provider_account_id: ["provider", "providerAccountId", "_creationTime"];
   }, {}, {}>;
@@ -85,16 +87,16 @@ declare const _default: convex_server81.SchemaDefinition<{
    * been used yet. A 10-second reuse window allows for concurrent requests.
    * Any invalid use of a token invalidates the entire chain.
    */
-  RefreshToken: convex_server81.TableDefinition<convex_values87.VObject<{
+  RefreshToken: convex_server83.TableDefinition<convex_values89.VObject<{
     firstUsedTime?: number | undefined;
-    parentRefreshTokenId?: convex_values87.GenericId<"RefreshToken"> | undefined;
+    parentRefreshTokenId?: convex_values89.GenericId<"RefreshToken"> | undefined;
     expirationTime: number;
-    sessionId: convex_values87.GenericId<"Session">;
+    sessionId: convex_values89.GenericId<"Session">;
   }, {
-    sessionId: convex_values87.VId<convex_values87.GenericId<"Session">, "required">;
-    expirationTime: convex_values87.VFloat64<number, "required">;
-    firstUsedTime: convex_values87.VFloat64<number | undefined, "optional">;
-    parentRefreshTokenId: convex_values87.VId<convex_values87.GenericId<"RefreshToken"> | undefined, "optional">;
+    sessionId: convex_values89.VId<convex_values89.GenericId<"Session">, "required">;
+    expirationTime: convex_values89.VFloat64<number, "required">;
+    firstUsedTime: convex_values89.VFloat64<number | undefined, "optional">;
+    parentRefreshTokenId: convex_values89.VId<convex_values89.GenericId<"RefreshToken"> | undefined, "optional">;
   }, "required", "expirationTime" | "sessionId" | "firstUsedTime" | "parentRefreshTokenId">, {
     session_id: ["sessionId", "_creationTime"];
     session_id_first_used: ["sessionId", "firstUsedTime", "_creationTime"];
@@ -103,23 +105,23 @@ declare const _default: convex_server81.SchemaDefinition<{
   /**
    * Verification codes for OTP tokens, magic link tokens, and OAuth codes.
    */
-  VerificationCode: convex_server81.TableDefinition<convex_values87.VObject<{
+  VerificationCode: convex_server83.TableDefinition<convex_values89.VObject<{
     emailVerified?: string | undefined;
     phoneVerified?: string | undefined;
     verifier?: string | undefined;
     expirationTime: number;
     provider: string;
-    accountId: convex_values87.GenericId<"Account">;
+    accountId: convex_values89.GenericId<"Account">;
     code: string;
   }, {
-    accountId: convex_values87.VId<convex_values87.GenericId<"Account">, "required">;
-    provider: convex_values87.VString<string, "required">;
-    code: convex_values87.VString<string, "required">;
-    expirationTime: convex_values87.VFloat64<number, "required">;
-    verifier: convex_values87.VString<string | undefined, "optional">;
-    emailVerified: convex_values87.VString<string | undefined, "optional">;
-    phoneVerified: convex_values87.VString<string | undefined, "optional">;
-  }, "required", "emailVerified" | "expirationTime" | "provider" | "phoneVerified" | "accountId" | "code" | "verifier">, {
+    accountId: convex_values89.VId<convex_values89.GenericId<"Account">, "required">;
+    provider: convex_values89.VString<string, "required">;
+    code: convex_values89.VString<string, "required">;
+    expirationTime: convex_values89.VFloat64<number, "required">;
+    verifier: convex_values89.VString<string | undefined, "optional">;
+    emailVerified: convex_values89.VString<string | undefined, "optional">;
+    phoneVerified: convex_values89.VString<string | undefined, "optional">;
+  }, "required", "expirationTime" | "provider" | "emailVerified" | "phoneVerified" | "accountId" | "code" | "verifier">, {
     account_id: ["accountId", "_creationTime"];
     code: ["code", "_creationTime"];
   }, {}, {}>;
@@ -127,12 +129,12 @@ declare const _default: convex_server81.SchemaDefinition<{
    * PKCE verifiers for OAuth flows. Stores the cryptographic verifier
    * used to prove the authorization request originated from this client.
    */
-  AuthVerifier: convex_server81.TableDefinition<convex_values87.VObject<{
-    sessionId?: convex_values87.GenericId<"Session"> | undefined;
+  AuthVerifier: convex_server83.TableDefinition<convex_values89.VObject<{
+    sessionId?: convex_values89.GenericId<"Session"> | undefined;
     signature?: string | undefined;
   }, {
-    sessionId: convex_values87.VId<convex_values87.GenericId<"Session"> | undefined, "optional">;
-    signature: convex_values87.VString<string | undefined, "optional">;
+    sessionId: convex_values89.VId<convex_values89.GenericId<"Session"> | undefined, "optional">;
+    signature: convex_values89.VString<string | undefined, "optional">;
   }, "required", "sessionId" | "signature">, {
     signature: ["signature", "_creationTime"];
   }, {}, {}>;
@@ -141,11 +143,11 @@ declare const _default: convex_server81.SchemaDefinition<{
    * registered authenticator (Touch ID, Face ID, security key, etc.).
    * A user can have multiple passkeys across different devices.
    */
-  Passkey: convex_server81.TableDefinition<convex_values87.VObject<{
+  Passkey: convex_server83.TableDefinition<convex_values89.VObject<{
     name?: string | undefined;
     lastUsedAt?: number | undefined;
     transports?: string[] | undefined;
-    userId: convex_values87.GenericId<"User">;
+    userId: convex_values89.GenericId<"User">;
     createdAt: number;
     credentialId: string;
     publicKey: ArrayBuffer;
@@ -154,17 +156,17 @@ declare const _default: convex_server81.SchemaDefinition<{
     deviceType: string;
     backedUp: boolean;
   }, {
-    userId: convex_values87.VId<convex_values87.GenericId<"User">, "required">; /** Base64url-encoded credential ID from the authenticator. */
-    credentialId: convex_values87.VString<string, "required">; /** Public key bytes (SEC1 uncompressed for EC, SPKI for RSA). */
-    publicKey: convex_values87.VBytes<ArrayBuffer, "required">; /** COSE algorithm identifier (-7 for ES256, -257 for RS256, -8 for EdDSA). */
-    algorithm: convex_values87.VFloat64<number, "required">; /** Signature counter for clone detection. Many authenticators return 0. */
-    counter: convex_values87.VFloat64<number, "required">; /** Authenticator transport hints (e.g. "internal", "hybrid", "usb", "ble", "nfc"). */
-    transports: convex_values87.VArray<string[] | undefined, convex_values87.VString<string, "required">, "optional">; /** Whether this is a single-device or multi-device (synced) credential. */
-    deviceType: convex_values87.VString<string, "required">; /** Whether the credential is backed up (synced passkey). */
-    backedUp: convex_values87.VBoolean<boolean, "required">; /** User-assigned friendly name (e.g. "MacBook Touch ID"). */
-    name: convex_values87.VString<string | undefined, "optional">;
-    createdAt: convex_values87.VFloat64<number, "required">;
-    lastUsedAt: convex_values87.VFloat64<number | undefined, "optional">;
+    userId: convex_values89.VId<convex_values89.GenericId<"User">, "required">; /** Base64url-encoded credential ID from the authenticator. */
+    credentialId: convex_values89.VString<string, "required">; /** Public key bytes (SEC1 uncompressed for EC, SPKI for RSA). */
+    publicKey: convex_values89.VBytes<ArrayBuffer, "required">; /** COSE algorithm identifier (-7 for ES256, -257 for RS256, -8 for EdDSA). */
+    algorithm: convex_values89.VFloat64<number, "required">; /** Signature counter for clone detection. Many authenticators return 0. */
+    counter: convex_values89.VFloat64<number, "required">; /** Authenticator transport hints (e.g. "internal", "hybrid", "usb", "ble", "nfc"). */
+    transports: convex_values89.VArray<string[] | undefined, convex_values89.VString<string, "required">, "optional">; /** Whether this is a single-device or multi-device (synced) credential. */
+    deviceType: convex_values89.VString<string, "required">; /** Whether the credential is backed up (synced passkey). */
+    backedUp: convex_values89.VBoolean<boolean, "required">; /** User-assigned friendly name (e.g. "MacBook Touch ID"). */
+    name: convex_values89.VString<string | undefined, "optional">;
+    createdAt: convex_values89.VFloat64<number, "required">;
+    lastUsedAt: convex_values89.VFloat64<number | undefined, "optional">;
   }, "required", "name" | "lastUsedAt" | "userId" | "createdAt" | "credentialId" | "publicKey" | "algorithm" | "counter" | "transports" | "deviceType" | "backedUp">, {
     user_id: ["userId", "_creationTime"];
     credential_id: ["credentialId", "_creationTime"];
@@ -178,24 +180,24 @@ declare const _default: convex_server81.SchemaDefinition<{
    * by successfully entering a code from their authenticator app.
    * Unverified enrollments are in-progress setup that can be discarded.
    */
-  TotpFactor: convex_server81.TableDefinition<convex_values87.VObject<{
+  TotpFactor: convex_server83.TableDefinition<convex_values89.VObject<{
     name?: string | undefined;
     lastUsedAt?: number | undefined;
-    userId: convex_values87.GenericId<"User">;
+    userId: convex_values89.GenericId<"User">;
     createdAt: number;
     secret: ArrayBuffer;
     digits: number;
     period: number;
     verified: boolean;
   }, {
-    userId: convex_values87.VId<convex_values87.GenericId<"User">, "required">; /** Raw TOTP secret key bytes. */
-    secret: convex_values87.VBytes<ArrayBuffer, "required">; /** Number of digits in each code (typically 6). */
-    digits: convex_values87.VFloat64<number, "required">; /** Time period in seconds for code rotation (typically 30). */
-    period: convex_values87.VFloat64<number, "required">; /** Whether setup has been confirmed with a valid code. */
-    verified: convex_values87.VBoolean<boolean, "required">; /** User-assigned friendly name (e.g. "Google Authenticator"). */
-    name: convex_values87.VString<string | undefined, "optional">;
-    createdAt: convex_values87.VFloat64<number, "required">;
-    lastUsedAt: convex_values87.VFloat64<number | undefined, "optional">;
+    userId: convex_values89.VId<convex_values89.GenericId<"User">, "required">; /** Raw TOTP secret key bytes. */
+    secret: convex_values89.VBytes<ArrayBuffer, "required">; /** Number of digits in each code (typically 6). */
+    digits: convex_values89.VFloat64<number, "required">; /** Time period in seconds for code rotation (typically 30). */
+    period: convex_values89.VFloat64<number, "required">; /** Whether setup has been confirmed with a valid code. */
+    verified: convex_values89.VBoolean<boolean, "required">; /** User-assigned friendly name (e.g. "Google Authenticator"). */
+    name: convex_values89.VString<string | undefined, "optional">;
+    createdAt: convex_values89.VFloat64<number, "required">;
+    lastUsedAt: convex_values89.VFloat64<number | undefined, "optional">;
   }, "required", "name" | "lastUsedAt" | "userId" | "createdAt" | "secret" | "digits" | "period" | "verified">, {
     user_id: ["userId", "_creationTime"];
     user_id_verified: ["userId", "verified", "_creationTime"];
@@ -205,9 +207,9 @@ declare const _default: convex_server81.SchemaDefinition<{
    * device auth session — the device polls with `deviceCode` while the
    * user authorizes via `userCode` on a secondary device.
    */
-  DeviceCode: convex_server81.TableDefinition<convex_values87.VObject<{
-    userId?: convex_values87.GenericId<"User"> | undefined;
-    sessionId?: convex_values87.GenericId<"Session"> | undefined;
+  DeviceCode: convex_server83.TableDefinition<convex_values89.VObject<{
+    userId?: convex_values89.GenericId<"User"> | undefined;
+    sessionId?: convex_values89.GenericId<"Session"> | undefined;
     lastPolledAt?: number | undefined;
     status: "pending" | "authorized" | "denied";
     expiresAt: number;
@@ -215,14 +217,14 @@ declare const _default: convex_server81.SchemaDefinition<{
     userCode: string;
     interval: number;
   }, {
-    /** High-entropy code used by the device for polling. Stored as SHA-256 hash. */deviceCodeHash: convex_values87.VString<string, "required">; /** Short human-readable code the user enters (e.g. "WDJB-MJHT"). */
-    userCode: convex_values87.VString<string, "required">; /** Expiration timestamp (ms since epoch). */
-    expiresAt: convex_values87.VFloat64<number, "required">; /** Minimum polling interval in seconds. */
-    interval: convex_values87.VFloat64<number, "required">; /** Current status of this device authorization session. */
-    status: convex_values87.VUnion<"pending" | "authorized" | "denied", [convex_values87.VLiteral<"pending", "required">, convex_values87.VLiteral<"authorized", "required">, convex_values87.VLiteral<"denied", "required">], "required", never>; /** Set when the user authorizes — links to the authorizing user. */
-    userId: convex_values87.VId<convex_values87.GenericId<"User"> | undefined, "optional">; /** Set when the user authorizes — the session created for the device. */
-    sessionId: convex_values87.VId<convex_values87.GenericId<"Session"> | undefined, "optional">; /** Timestamp of the last poll request (for slow_down enforcement). */
-    lastPolledAt: convex_values87.VFloat64<number | undefined, "optional">;
+    /** High-entropy code used by the device for polling. Stored as SHA-256 hash. */deviceCodeHash: convex_values89.VString<string, "required">; /** Short human-readable code the user enters (e.g. "WDJB-MJHT"). */
+    userCode: convex_values89.VString<string, "required">; /** Expiration timestamp (ms since epoch). */
+    expiresAt: convex_values89.VFloat64<number, "required">; /** Minimum polling interval in seconds. */
+    interval: convex_values89.VFloat64<number, "required">; /** Current status of this device authorization session. */
+    status: convex_values89.VUnion<"pending" | "authorized" | "denied", [convex_values89.VLiteral<"pending", "required">, convex_values89.VLiteral<"authorized", "required">, convex_values89.VLiteral<"denied", "required">], "required", never>; /** Set when the user authorizes — links to the authorizing user. */
+    userId: convex_values89.VId<convex_values89.GenericId<"User"> | undefined, "optional">; /** Set when the user authorizes — the session created for the device. */
+    sessionId: convex_values89.VId<convex_values89.GenericId<"Session"> | undefined, "optional">; /** Timestamp of the last poll request (for slow_down enforcement). */
+    lastPolledAt: convex_values89.VFloat64<number | undefined, "optional">;
   }, "required", "status" | "expiresAt" | "userId" | "sessionId" | "deviceCodeHash" | "userCode" | "interval" | "lastPolledAt">, {
     device_code_hash: ["deviceCodeHash", "_creationTime"];
     user_code_status: ["userCode", "status", "_creationTime"];
@@ -230,14 +232,14 @@ declare const _default: convex_server81.SchemaDefinition<{
   /**
    * Rate limit tracking for OTP and password sign-in attempts.
    */
-  RateLimit: convex_server81.TableDefinition<convex_values87.VObject<{
+  RateLimit: convex_server83.TableDefinition<convex_values89.VObject<{
     identifier: string;
     last_attempt_time: number;
     attempts_left: number;
   }, {
-    identifier: convex_values87.VString<string, "required">;
-    last_attempt_time: convex_values87.VFloat64<number, "required">;
-    attempts_left: convex_values87.VFloat64<number, "required">;
+    identifier: convex_values89.VString<string, "required">;
+    last_attempt_time: convex_values89.VFloat64<number, "required">;
+    attempts_left: convex_values89.VFloat64<number, "required">;
   }, "required", "identifier" | "last_attempt_time" | "attempts_left">, {
     by_identifier: ["identifier", "_creationTime"];
   }, {}, {}>;
@@ -246,12 +248,12 @@ declare const _default: convex_server81.SchemaDefinition<{
    * Groups can nest arbitrarily deep via `parentGroupId` for modeling
    * organizations, teams, departments, or any tree structure.
    */
-  Group: convex_server81.TableDefinition<convex_values87.VObject<{
+  Group: convex_server83.TableDefinition<convex_values89.VObject<{
     slug?: string | undefined;
     type?: string | undefined;
     extend?: any;
-    parentGroupId?: convex_values87.GenericId<"Group"> | undefined;
-    rootGroupId?: convex_values87.GenericId<"Group"> | undefined;
+    parentGroupId?: convex_values89.GenericId<"Group"> | undefined;
+    rootGroupId?: convex_values89.GenericId<"Group"> | undefined;
     isRoot?: boolean | undefined;
     tags?: {
       key: string;
@@ -298,23 +300,23 @@ declare const _default: convex_server81.SchemaDefinition<{
     } | undefined;
     name: string;
   }, {
-    name: convex_values87.VString<string, "required">;
-    slug: convex_values87.VString<string | undefined, "optional">;
-    type: convex_values87.VString<string | undefined, "optional">;
-    parentGroupId: convex_values87.VId<convex_values87.GenericId<"Group"> | undefined, "optional">; /** Denormalized root group ID. Self-referencing for root groups. */
-    rootGroupId: convex_values87.VId<convex_values87.GenericId<"Group"> | undefined, "optional">; /** Denormalized flag: `true` when `parentGroupId` is absent. */
-    isRoot: convex_values87.VBoolean<boolean | undefined, "optional">; /** Faceted classification tags. Normalized at write time (trimmed, lowercased). */
-    tags: convex_values87.VArray<{
+    name: convex_values89.VString<string, "required">;
+    slug: convex_values89.VString<string | undefined, "optional">;
+    type: convex_values89.VString<string | undefined, "optional">;
+    parentGroupId: convex_values89.VId<convex_values89.GenericId<"Group"> | undefined, "optional">; /** Denormalized root group ID. Self-referencing for root groups. */
+    rootGroupId: convex_values89.VId<convex_values89.GenericId<"Group"> | undefined, "optional">; /** Denormalized flag: `true` when `parentGroupId` is absent. */
+    isRoot: convex_values89.VBoolean<boolean | undefined, "optional">; /** Faceted classification tags. Normalized at write time (trimmed, lowercased). */
+    tags: convex_values89.VArray<{
       key: string;
       value: string;
-    }[] | undefined, convex_values87.VObject<{
+    }[] | undefined, convex_values89.VObject<{
       key: string;
       value: string;
     }, {
-      key: convex_values87.VString<string, "required">;
-      value: convex_values87.VString<string, "required">;
+      key: convex_values89.VString<string, "required">;
+      value: convex_values89.VString<string, "required">;
     }, "required", "key" | "value">, "optional">;
-    policy: convex_values87.VObject<{
+    policy: convex_values89.VObject<{
       extend?: any;
       version: 1;
       identity: {
@@ -353,22 +355,22 @@ declare const _default: convex_server81.SchemaDefinition<{
         };
       };
     } | undefined, {
-      version: convex_values87.VLiteral<1, "required">;
-      identity: convex_values87.VObject<{
+      version: convex_values89.VLiteral<1, "required">;
+      identity: convex_values89.VObject<{
         accountLinking: {
           oidc: "verifiedEmail" | "none";
           saml: "verifiedEmail" | "none";
         };
       }, {
-        accountLinking: convex_values87.VObject<{
+        accountLinking: convex_values89.VObject<{
           oidc: "verifiedEmail" | "none";
           saml: "verifiedEmail" | "none";
         }, {
-          oidc: convex_values87.VUnion<"verifiedEmail" | "none", [convex_values87.VLiteral<"verifiedEmail", "required">, convex_values87.VLiteral<"none", "required">], "required", never>;
-          saml: convex_values87.VUnion<"verifiedEmail" | "none", [convex_values87.VLiteral<"verifiedEmail", "required">, convex_values87.VLiteral<"none", "required">], "required", never>;
+          oidc: convex_values89.VUnion<"verifiedEmail" | "none", [convex_values89.VLiteral<"verifiedEmail", "required">, convex_values89.VLiteral<"none", "required">], "required", never>;
+          saml: convex_values89.VUnion<"verifiedEmail" | "none", [convex_values89.VLiteral<"verifiedEmail", "required">, convex_values89.VLiteral<"none", "required">], "required", never>;
         }, "required", "oidc" | "saml">;
       }, "required", "accountLinking" | "accountLinking.oidc" | "accountLinking.saml">;
-      provisioning: convex_values87.VObject<{
+      provisioning: convex_values89.VObject<{
         user: {
           createOnSignIn: boolean;
           updateProfileOnLogin: "never" | "missing" | "always";
@@ -397,58 +399,58 @@ declare const _default: convex_server81.SchemaDefinition<{
           source: "protocol";
         };
       }, {
-        user: convex_values87.VObject<{
+        user: convex_values89.VObject<{
           createOnSignIn: boolean;
           updateProfileOnLogin: "never" | "missing" | "always";
           updateProfileFromScim: "never" | "missing" | "always";
           authority: "app" | "sso" | "scim";
         }, {
-          createOnSignIn: convex_values87.VBoolean<boolean, "required">;
-          updateProfileOnLogin: convex_values87.VUnion<"never" | "missing" | "always", [convex_values87.VLiteral<"never", "required">, convex_values87.VLiteral<"missing", "required">, convex_values87.VLiteral<"always", "required">], "required", never>;
-          updateProfileFromScim: convex_values87.VUnion<"never" | "missing" | "always", [convex_values87.VLiteral<"never", "required">, convex_values87.VLiteral<"missing", "required">, convex_values87.VLiteral<"always", "required">], "required", never>;
-          authority: convex_values87.VUnion<"app" | "sso" | "scim", [convex_values87.VLiteral<"app", "required">, convex_values87.VLiteral<"sso", "required">, convex_values87.VLiteral<"scim", "required">], "required", never>;
+          createOnSignIn: convex_values89.VBoolean<boolean, "required">;
+          updateProfileOnLogin: convex_values89.VUnion<"never" | "missing" | "always", [convex_values89.VLiteral<"never", "required">, convex_values89.VLiteral<"missing", "required">, convex_values89.VLiteral<"always", "required">], "required", never>;
+          updateProfileFromScim: convex_values89.VUnion<"never" | "missing" | "always", [convex_values89.VLiteral<"never", "required">, convex_values89.VLiteral<"missing", "required">, convex_values89.VLiteral<"always", "required">], "required", never>;
+          authority: convex_values89.VUnion<"app" | "sso" | "scim", [convex_values89.VLiteral<"app", "required">, convex_values89.VLiteral<"sso", "required">, convex_values89.VLiteral<"scim", "required">], "required", never>;
         }, "required", "createOnSignIn" | "updateProfileOnLogin" | "updateProfileFromScim" | "authority">;
-        scimReuse: convex_values87.VObject<{
+        scimReuse: convex_values89.VObject<{
           user: "none" | "externalId";
         }, {
-          user: convex_values87.VUnion<"none" | "externalId", [convex_values87.VLiteral<"externalId", "required">, convex_values87.VLiteral<"none", "required">], "required", never>;
+          user: convex_values89.VUnion<"none" | "externalId", [convex_values89.VLiteral<"externalId", "required">, convex_values89.VLiteral<"none", "required">], "required", never>;
         }, "required", "user">;
-        jit: convex_values87.VObject<{
+        jit: convex_values89.VObject<{
           defaultRole?: string | undefined;
           defaultRoleIds?: string[] | undefined;
           mode: "off" | "createUser" | "createUserAndMembership";
         }, {
-          mode: convex_values87.VUnion<"off" | "createUser" | "createUserAndMembership", [convex_values87.VLiteral<"off", "required">, convex_values87.VLiteral<"createUser", "required">, convex_values87.VLiteral<"createUserAndMembership", "required">], "required", never>;
-          defaultRole: convex_values87.VString<string | undefined, "optional">;
-          defaultRoleIds: convex_values87.VArray<string[] | undefined, convex_values87.VString<string, "required">, "optional">;
+          mode: convex_values89.VUnion<"off" | "createUser" | "createUserAndMembership", [convex_values89.VLiteral<"off", "required">, convex_values89.VLiteral<"createUser", "required">, convex_values89.VLiteral<"createUserAndMembership", "required">], "required", never>;
+          defaultRole: convex_values89.VString<string | undefined, "optional">;
+          defaultRoleIds: convex_values89.VArray<string[] | undefined, convex_values89.VString<string, "required">, "optional">;
         }, "required", "mode" | "defaultRole" | "defaultRoleIds">;
-        deprovision: convex_values87.VObject<{
+        deprovision: convex_values89.VObject<{
           mode: "soft" | "hard";
         }, {
-          mode: convex_values87.VUnion<"soft" | "hard", [convex_values87.VLiteral<"soft", "required">, convex_values87.VLiteral<"hard", "required">], "required", never>;
+          mode: convex_values89.VUnion<"soft" | "hard", [convex_values89.VLiteral<"soft", "required">, convex_values89.VLiteral<"hard", "required">], "required", never>;
         }, "required", "mode">;
-        groups: convex_values87.VObject<{
+        groups: convex_values89.VObject<{
           mapping?: Record<string, string[]> | undefined;
           mode: "ignore" | "sync";
           source: "protocol";
         }, {
-          mode: convex_values87.VUnion<"ignore" | "sync", [convex_values87.VLiteral<"ignore", "required">, convex_values87.VLiteral<"sync", "required">], "required", never>;
-          source: convex_values87.VLiteral<"protocol", "required">;
-          mapping: convex_values87.VRecord<Record<string, string[]> | undefined, convex_values87.VString<string, "required">, convex_values87.VArray<string[], convex_values87.VString<string, "required">, "required">, "optional", string>;
+          mode: convex_values89.VUnion<"ignore" | "sync", [convex_values89.VLiteral<"ignore", "required">, convex_values89.VLiteral<"sync", "required">], "required", never>;
+          source: convex_values89.VLiteral<"protocol", "required">;
+          mapping: convex_values89.VRecord<Record<string, string[]> | undefined, convex_values89.VString<string, "required">, convex_values89.VArray<string[], convex_values89.VString<string, "required">, "required">, "optional", string>;
         }, "required", "mode" | "source" | "mapping" | `mapping.${string}`>;
-        roles: convex_values87.VObject<{
+        roles: convex_values89.VObject<{
           mapping?: Record<string, string[]> | undefined;
           mode: "map" | "ignore";
           source: "protocol";
         }, {
-          mode: convex_values87.VUnion<"map" | "ignore", [convex_values87.VLiteral<"ignore", "required">, convex_values87.VLiteral<"map", "required">], "required", never>;
-          source: convex_values87.VLiteral<"protocol", "required">;
-          mapping: convex_values87.VRecord<Record<string, string[]> | undefined, convex_values87.VString<string, "required">, convex_values87.VArray<string[], convex_values87.VString<string, "required">, "required">, "optional", string>;
+          mode: convex_values89.VUnion<"map" | "ignore", [convex_values89.VLiteral<"ignore", "required">, convex_values89.VLiteral<"map", "required">], "required", never>;
+          source: convex_values89.VLiteral<"protocol", "required">;
+          mapping: convex_values89.VRecord<Record<string, string[]> | undefined, convex_values89.VString<string, "required">, convex_values89.VArray<string[], convex_values89.VString<string, "required">, "required">, "optional", string>;
         }, "required", "mode" | "source" | "mapping" | `mapping.${string}`>;
       }, "required", "user" | "scimReuse" | "jit" | "deprovision" | "groups" | "roles" | "user.createOnSignIn" | "user.updateProfileOnLogin" | "user.updateProfileFromScim" | "user.authority" | "scimReuse.user" | "jit.mode" | "jit.defaultRole" | "jit.defaultRoleIds" | "deprovision.mode" | "groups.mode" | "groups.source" | "groups.mapping" | `groups.mapping.${string}` | "roles.mode" | "roles.source" | "roles.mapping" | `roles.mapping.${string}`>;
-      extend: convex_values87.VAny<any, "optional", string>;
+      extend: convex_values89.VAny<any, "optional", string>;
     }, "optional", "extend" | `extend.${string}` | "version" | "identity" | "provisioning" | "identity.accountLinking" | "identity.accountLinking.oidc" | "identity.accountLinking.saml" | "provisioning.user" | "provisioning.scimReuse" | "provisioning.jit" | "provisioning.deprovision" | "provisioning.groups" | "provisioning.roles" | "provisioning.user.createOnSignIn" | "provisioning.user.updateProfileOnLogin" | "provisioning.user.updateProfileFromScim" | "provisioning.user.authority" | "provisioning.scimReuse.user" | "provisioning.jit.mode" | "provisioning.jit.defaultRole" | "provisioning.jit.defaultRoleIds" | "provisioning.deprovision.mode" | "provisioning.groups.mode" | "provisioning.groups.source" | "provisioning.groups.mapping" | `provisioning.groups.mapping.${string}` | "provisioning.roles.mode" | "provisioning.roles.source" | "provisioning.roles.mapping" | `provisioning.roles.mapping.${string}`>;
-    extend: convex_values87.VAny<any, "optional", string>;
+    extend: convex_values89.VAny<any, "optional", string>;
   }, "required", "name" | "slug" | "type" | "extend" | `extend.${string}` | "parentGroupId" | "rootGroupId" | "isRoot" | "tags" | "policy" | "policy.extend" | `policy.extend.${string}` | "policy.version" | "policy.identity" | "policy.provisioning" | "policy.identity.accountLinking" | "policy.identity.accountLinking.oidc" | "policy.identity.accountLinking.saml" | "policy.provisioning.user" | "policy.provisioning.scimReuse" | "policy.provisioning.jit" | "policy.provisioning.deprovision" | "policy.provisioning.groups" | "policy.provisioning.roles" | "policy.provisioning.user.createOnSignIn" | "policy.provisioning.user.updateProfileOnLogin" | "policy.provisioning.user.updateProfileFromScim" | "policy.provisioning.user.authority" | "policy.provisioning.scimReuse.user" | "policy.provisioning.jit.mode" | "policy.provisioning.jit.defaultRole" | "policy.provisioning.jit.defaultRoleIds" | "policy.provisioning.deprovision.mode" | "policy.provisioning.groups.mode" | "policy.provisioning.groups.source" | "policy.provisioning.groups.mapping" | `policy.provisioning.groups.mapping.${string}` | "policy.provisioning.roles.mode" | "policy.provisioning.roles.source" | "policy.provisioning.roles.mapping" | `policy.provisioning.roles.mapping.${string}`>, {
     slug: ["slug", "_creationTime"];
     parent_group_id: ["parentGroupId", "_creationTime"];
@@ -462,14 +464,14 @@ declare const _default: convex_server81.SchemaDefinition<{
    * Each row maps one `(key, value)` pair to a group. Kept in sync by
    * `groupCreate`, `groupUpdate`, and `groupDelete`.
    */
-  GroupTag: convex_server81.TableDefinition<convex_values87.VObject<{
+  GroupTag: convex_server83.TableDefinition<convex_values89.VObject<{
     key: string;
     value: string;
-    group_id: convex_values87.GenericId<"Group">;
+    group_id: convex_values89.GenericId<"Group">;
   }, {
-    group_id: convex_values87.VId<convex_values87.GenericId<"Group">, "required">;
-    key: convex_values87.VString<string, "required">;
-    value: convex_values87.VString<string, "required">;
+    group_id: convex_values89.VId<convex_values89.GenericId<"Group">, "required">;
+    key: convex_values89.VString<string, "required">;
+    value: convex_values89.VString<string, "required">;
   }, "required", "key" | "value" | "group_id">, {
     by_group: ["group_id", "_creationTime"];
     by_key_value: ["key", "value", "_creationTime"];
@@ -480,20 +482,20 @@ declare const _default: convex_server81.SchemaDefinition<{
    * role (e.g. "owner", "admin", "member", "viewer"). A user can be a
    * member of multiple groups with different roles in each.
    */
-  GroupMember: convex_server81.TableDefinition<convex_values87.VObject<{
+  GroupMember: convex_server83.TableDefinition<convex_values89.VObject<{
     status?: string | undefined;
     extend?: any;
     role?: string | undefined;
     roleIds?: string[] | undefined;
-    userId: convex_values87.GenericId<"User">;
-    groupId: convex_values87.GenericId<"Group">;
+    userId: convex_values89.GenericId<"User">;
+    groupId: convex_values89.GenericId<"Group">;
   }, {
-    groupId: convex_values87.VId<convex_values87.GenericId<"Group">, "required">;
-    userId: convex_values87.VId<convex_values87.GenericId<"User">, "required">;
-    role: convex_values87.VString<string | undefined, "optional">;
-    roleIds: convex_values87.VArray<string[] | undefined, convex_values87.VString<string, "required">, "optional">;
-    status: convex_values87.VString<string | undefined, "optional">;
-    extend: convex_values87.VAny<any, "optional", string>;
+    groupId: convex_values89.VId<convex_values89.GenericId<"Group">, "required">;
+    userId: convex_values89.VId<convex_values89.GenericId<"User">, "required">;
+    role: convex_values89.VString<string | undefined, "optional">;
+    roleIds: convex_values89.VArray<string[] | undefined, convex_values89.VString<string, "required">, "optional">;
+    status: convex_values89.VString<string | undefined, "optional">;
+    extend: convex_values89.VAny<any, "optional", string>;
   }, "required", "status" | "userId" | "extend" | `extend.${string}` | "groupId" | "role" | "roleIds">, {
     group_id: ["groupId", "_creationTime"];
     group_id_user_id: ["groupId", "userId", "_creationTime"];
@@ -508,30 +510,30 @@ declare const _default: convex_server81.SchemaDefinition<{
    * `email` and `invitedByUserId` are optional to support CLI-generated
    * invite links where neither is known upfront.
    */
-  GroupInvite: convex_server81.TableDefinition<convex_values87.VObject<{
+  GroupInvite: convex_server83.TableDefinition<convex_values89.VObject<{
     email?: string | undefined;
     expiresTime?: number | undefined;
     acceptedTime?: number | undefined;
     extend?: any;
-    groupId?: convex_values87.GenericId<"Group"> | undefined;
+    groupId?: convex_values89.GenericId<"Group"> | undefined;
     role?: string | undefined;
     roleIds?: string[] | undefined;
-    invitedByUserId?: convex_values87.GenericId<"User"> | undefined;
-    acceptedByUserId?: convex_values87.GenericId<"User"> | undefined;
+    invitedByUserId?: convex_values89.GenericId<"User"> | undefined;
+    acceptedByUserId?: convex_values89.GenericId<"User"> | undefined;
     status: "pending" | "accepted" | "revoked" | "expired";
     tokenHash: string;
   }, {
-    groupId: convex_values87.VId<convex_values87.GenericId<"Group"> | undefined, "optional">;
-    invitedByUserId: convex_values87.VId<convex_values87.GenericId<"User"> | undefined, "optional">;
-    email: convex_values87.VString<string | undefined, "optional">;
-    tokenHash: convex_values87.VString<string, "required">;
-    role: convex_values87.VString<string | undefined, "optional">;
-    roleIds: convex_values87.VArray<string[] | undefined, convex_values87.VString<string, "required">, "optional">;
-    status: convex_values87.VUnion<"pending" | "accepted" | "revoked" | "expired", [convex_values87.VLiteral<"pending", "required">, convex_values87.VLiteral<"accepted", "required">, convex_values87.VLiteral<"revoked", "required">, convex_values87.VLiteral<"expired", "required">], "required", never>;
-    expiresTime: convex_values87.VFloat64<number | undefined, "optional">;
-    acceptedByUserId: convex_values87.VId<convex_values87.GenericId<"User"> | undefined, "optional">;
-    acceptedTime: convex_values87.VFloat64<number | undefined, "optional">;
-    extend: convex_values87.VAny<any, "optional", string>;
+    groupId: convex_values89.VId<convex_values89.GenericId<"Group"> | undefined, "optional">;
+    invitedByUserId: convex_values89.VId<convex_values89.GenericId<"User"> | undefined, "optional">;
+    email: convex_values89.VString<string | undefined, "optional">;
+    tokenHash: convex_values89.VString<string, "required">;
+    role: convex_values89.VString<string | undefined, "optional">;
+    roleIds: convex_values89.VArray<string[] | undefined, convex_values89.VString<string, "required">, "optional">;
+    status: convex_values89.VUnion<"pending" | "accepted" | "revoked" | "expired", [convex_values89.VLiteral<"pending", "required">, convex_values89.VLiteral<"accepted", "required">, convex_values89.VLiteral<"revoked", "required">, convex_values89.VLiteral<"expired", "required">], "required", never>;
+    expiresTime: convex_values89.VFloat64<number | undefined, "optional">;
+    acceptedByUserId: convex_values89.VId<convex_values89.GenericId<"User"> | undefined, "optional">;
+    acceptedTime: convex_values89.VFloat64<number | undefined, "optional">;
+    extend: convex_values89.VAny<any, "optional", string>;
   }, "required", "email" | "status" | "expiresTime" | "acceptedTime" | "extend" | `extend.${string}` | "groupId" | "role" | "roleIds" | "invitedByUserId" | "tokenHash" | "acceptedByUserId">, {
     token_hash: ["tokenHash", "_creationTime"];
     status: ["status", "_creationTime"];
@@ -547,42 +549,44 @@ declare const _default: convex_server81.SchemaDefinition<{
    * SDK can evolve without forcing schema churn for every protocol-specific
    * field addition.
    */
-  GroupConnection: convex_server81.TableDefinition<convex_values87.VObject<{
+  GroupConnection: convex_server83.TableDefinition<convex_values89.VObject<{
     name?: string | undefined;
     slug?: string | undefined;
     extend?: any;
     config?: any;
     status: "draft" | "active" | "disabled";
     protocol: "oidc" | "saml";
-    groupId: convex_values87.GenericId<"Group">;
+    groupId: convex_values89.GenericId<"Group">;
   }, {
-    groupId: convex_values87.VId<convex_values87.GenericId<"Group">, "required">;
-    slug: convex_values87.VString<string | undefined, "optional">;
-    name: convex_values87.VString<string | undefined, "optional">;
-    protocol: convex_values87.VUnion<"oidc" | "saml", [convex_values87.VLiteral<"oidc", "required">, convex_values87.VLiteral<"saml", "required">], "required", never>;
-    status: convex_values87.VUnion<"draft" | "active" | "disabled", [convex_values87.VLiteral<"draft", "required">, convex_values87.VLiteral<"active", "required">, convex_values87.VLiteral<"disabled", "required">], "required", never>;
-    config: convex_values87.VAny<any, "optional", string>;
-    extend: convex_values87.VAny<any, "optional", string>;
+    groupId: convex_values89.VId<convex_values89.GenericId<"Group">, "required">;
+    slug: convex_values89.VString<string | undefined, "optional">;
+    name: convex_values89.VString<string | undefined, "optional">;
+    protocol: convex_values89.VUnion<"oidc" | "saml", [convex_values89.VLiteral<"oidc", "required">, convex_values89.VLiteral<"saml", "required">], "required", never>;
+    status: convex_values89.VUnion<"draft" | "active" | "disabled", [convex_values89.VLiteral<"draft", "required">, convex_values89.VLiteral<"active", "required">, convex_values89.VLiteral<"disabled", "required">], "required", never>;
+    config: convex_values89.VAny<any, "optional", string>;
+    extend: convex_values89.VAny<any, "optional", string>;
   }, "required", "name" | "slug" | "status" | "extend" | `extend.${string}` | "protocol" | "groupId" | "config" | `config.${string}`>, {
     group_id: ["groupId", "_creationTime"];
     slug: ["slug", "_creationTime"];
     status: ["status", "_creationTime"];
+    group_id_status: ["groupId", "status", "_creationTime"];
+    group_id_slug: ["groupId", "slug", "_creationTime"];
   }, {}, {}>;
   /**
    * Verified or pending domains linked to an group connection record.
    */
-  GroupConnectionDomain: convex_server81.TableDefinition<convex_values87.VObject<{
+  GroupConnectionDomain: convex_server83.TableDefinition<convex_values89.VObject<{
     verifiedAt?: number | undefined;
-    groupId: convex_values87.GenericId<"Group">;
-    connectionId: convex_values87.GenericId<"GroupConnection">;
+    groupId: convex_values89.GenericId<"Group">;
+    connectionId: convex_values89.GenericId<"GroupConnection">;
     domain: string;
     isPrimary: boolean;
   }, {
-    connectionId: convex_values87.VId<convex_values87.GenericId<"GroupConnection">, "required">;
-    groupId: convex_values87.VId<convex_values87.GenericId<"Group">, "required">;
-    domain: convex_values87.VString<string, "required">;
-    isPrimary: convex_values87.VBoolean<boolean, "required">;
-    verifiedAt: convex_values87.VFloat64<number | undefined, "optional">;
+    connectionId: convex_values89.VId<convex_values89.GenericId<"GroupConnection">, "required">;
+    groupId: convex_values89.VId<convex_values89.GenericId<"Group">, "required">;
+    domain: convex_values89.VString<string, "required">;
+    isPrimary: convex_values89.VBoolean<boolean, "required">;
+    verifiedAt: convex_values89.VFloat64<number | undefined, "optional">;
   }, "required", "groupId" | "connectionId" | "domain" | "isPrimary" | "verifiedAt">, {
     connection_id: ["connectionId", "_creationTime"];
     group_id: ["groupId", "_creationTime"];
@@ -591,26 +595,26 @@ declare const _default: convex_server81.SchemaDefinition<{
   /**
    * Pending DNS TXT verification challenges for group connection domains.
    */
-  GroupConnectionDomainVerification: convex_server81.TableDefinition<convex_values87.VObject<{
+  GroupConnectionDomainVerification: convex_server83.TableDefinition<convex_values89.VObject<{
     expiresAt: number;
-    groupId: convex_values87.GenericId<"Group">;
+    groupId: convex_values89.GenericId<"Group">;
     tokenHash: string;
-    connectionId: convex_values87.GenericId<"GroupConnection">;
+    connectionId: convex_values89.GenericId<"GroupConnection">;
     domain: string;
-    domainId: convex_values87.GenericId<"GroupConnectionDomain">;
+    domainId: convex_values89.GenericId<"GroupConnectionDomain">;
     recordName: string;
     token: string;
     requestedAt: number;
   }, {
-    connectionId: convex_values87.VId<convex_values87.GenericId<"GroupConnection">, "required">;
-    groupId: convex_values87.VId<convex_values87.GenericId<"Group">, "required">;
-    domainId: convex_values87.VId<convex_values87.GenericId<"GroupConnectionDomain">, "required">;
-    domain: convex_values87.VString<string, "required">;
-    recordName: convex_values87.VString<string, "required">;
-    token: convex_values87.VString<string, "required">;
-    tokenHash: convex_values87.VString<string, "required">;
-    requestedAt: convex_values87.VFloat64<number, "required">;
-    expiresAt: convex_values87.VFloat64<number, "required">;
+    connectionId: convex_values89.VId<convex_values89.GenericId<"GroupConnection">, "required">;
+    groupId: convex_values89.VId<convex_values89.GenericId<"Group">, "required">;
+    domainId: convex_values89.VId<convex_values89.GenericId<"GroupConnectionDomain">, "required">;
+    domain: convex_values89.VString<string, "required">;
+    recordName: convex_values89.VString<string, "required">;
+    token: convex_values89.VString<string, "required">;
+    tokenHash: convex_values89.VString<string, "required">;
+    requestedAt: convex_values89.VFloat64<number, "required">;
+    expiresAt: convex_values89.VFloat64<number, "required">;
   }, "required", "expiresAt" | "groupId" | "tokenHash" | "connectionId" | "domain" | "domainId" | "recordName" | "token" | "requestedAt">, {
     connection_id: ["connectionId", "_creationTime"];
     domain_id: ["domainId", "_creationTime"];
@@ -619,18 +623,18 @@ declare const _default: convex_server81.SchemaDefinition<{
   /**
    * Encrypted group connection secrets stored separately from protocol config.
    */
-  GroupConnectionSecret: convex_server81.TableDefinition<convex_values87.VObject<{
-    groupId: convex_values87.GenericId<"Group">;
-    connectionId: convex_values87.GenericId<"GroupConnection">;
+  GroupConnectionSecret: convex_server83.TableDefinition<convex_values89.VObject<{
+    groupId: convex_values89.GenericId<"Group">;
+    connectionId: convex_values89.GenericId<"GroupConnection">;
     ciphertext: string;
     updatedAt: number;
     kind: "oidc_client_secret";
   }, {
-    connectionId: convex_values87.VId<convex_values87.GenericId<"GroupConnection">, "required">;
-    groupId: convex_values87.VId<convex_values87.GenericId<"Group">, "required">;
-    kind: convex_values87.VUnion<"oidc_client_secret", [convex_values87.VLiteral<"oidc_client_secret", "required">], "required", never>;
-    ciphertext: convex_values87.VString<string, "required">;
-    updatedAt: convex_values87.VFloat64<number, "required">;
+    connectionId: convex_values89.VId<convex_values89.GenericId<"GroupConnection">, "required">;
+    groupId: convex_values89.VId<convex_values89.GenericId<"Group">, "required">;
+    kind: convex_values89.VUnion<"oidc_client_secret", [convex_values89.VLiteral<"oidc_client_secret", "required">], "required", never>;
+    ciphertext: convex_values89.VString<string, "required">;
+    updatedAt: convex_values89.VFloat64<number, "required">;
   }, "required", "groupId" | "connectionId" | "ciphertext" | "updatedAt" | "kind">, {
     connection_id: ["connectionId", "_creationTime"];
     connection_id_kind: ["connectionId", "kind", "_creationTime"];
@@ -639,22 +643,22 @@ declare const _default: convex_server81.SchemaDefinition<{
   /**
    * SCIM configuration for an group connection tenant.
    */
-  GroupConnectionScimConfig: convex_server81.TableDefinition<convex_values87.VObject<{
+  GroupConnectionScimConfig: convex_server83.TableDefinition<convex_values89.VObject<{
     extend?: any;
     lastRotatedAt?: number | undefined;
     status: "draft" | "active" | "disabled";
-    groupId: convex_values87.GenericId<"Group">;
+    groupId: convex_values89.GenericId<"Group">;
     tokenHash: string;
-    connectionId: convex_values87.GenericId<"GroupConnection">;
+    connectionId: convex_values89.GenericId<"GroupConnection">;
     basePath: string;
   }, {
-    connectionId: convex_values87.VId<convex_values87.GenericId<"GroupConnection">, "required">;
-    groupId: convex_values87.VId<convex_values87.GenericId<"Group">, "required">;
-    status: convex_values87.VUnion<"draft" | "active" | "disabled", [convex_values87.VLiteral<"draft", "required">, convex_values87.VLiteral<"active", "required">, convex_values87.VLiteral<"disabled", "required">], "required", never>;
-    basePath: convex_values87.VString<string, "required">;
-    tokenHash: convex_values87.VString<string, "required">;
-    lastRotatedAt: convex_values87.VFloat64<number | undefined, "optional">;
-    extend: convex_values87.VAny<any, "optional", string>;
+    connectionId: convex_values89.VId<convex_values89.GenericId<"GroupConnection">, "required">;
+    groupId: convex_values89.VId<convex_values89.GenericId<"Group">, "required">;
+    status: convex_values89.VUnion<"draft" | "active" | "disabled", [convex_values89.VLiteral<"draft", "required">, convex_values89.VLiteral<"active", "required">, convex_values89.VLiteral<"disabled", "required">], "required", never>;
+    basePath: convex_values89.VString<string, "required">;
+    tokenHash: convex_values89.VString<string, "required">;
+    lastRotatedAt: convex_values89.VFloat64<number | undefined, "optional">;
+    extend: convex_values89.VAny<any, "optional", string>;
   }, "required", "status" | "extend" | `extend.${string}` | "groupId" | "tokenHash" | "connectionId" | "basePath" | "lastRotatedAt">, {
     group_connection_id: ["connectionId", "_creationTime"];
     group_id: ["groupId", "_creationTime"];
@@ -664,26 +668,26 @@ declare const _default: convex_server81.SchemaDefinition<{
   /**
    * External SCIM identities mapped into local users/groups.
    */
-  GroupConnectionScimIdentity: convex_server81.TableDefinition<convex_values87.VObject<{
-    userId?: convex_values87.GenericId<"User"> | undefined;
+  GroupConnectionScimIdentity: convex_server83.TableDefinition<convex_values89.VObject<{
+    userId?: convex_values89.GenericId<"User"> | undefined;
     active?: boolean | undefined;
-    mappedGroupId?: convex_values87.GenericId<"Group"> | undefined;
+    mappedGroupId?: convex_values89.GenericId<"Group"> | undefined;
     lastProvisionedAt?: number | undefined;
     raw?: any;
     externalId: string;
-    groupId: convex_values87.GenericId<"Group">;
-    connectionId: convex_values87.GenericId<"GroupConnection">;
+    groupId: convex_values89.GenericId<"Group">;
+    connectionId: convex_values89.GenericId<"GroupConnection">;
     resourceType: "user" | "group";
   }, {
-    connectionId: convex_values87.VId<convex_values87.GenericId<"GroupConnection">, "required">;
-    groupId: convex_values87.VId<convex_values87.GenericId<"Group">, "required">;
-    resourceType: convex_values87.VUnion<"user" | "group", [convex_values87.VLiteral<"user", "required">, convex_values87.VLiteral<"group", "required">], "required", never>;
-    externalId: convex_values87.VString<string, "required">;
-    userId: convex_values87.VId<convex_values87.GenericId<"User"> | undefined, "optional">;
-    mappedGroupId: convex_values87.VId<convex_values87.GenericId<"Group"> | undefined, "optional">;
-    lastProvisionedAt: convex_values87.VFloat64<number | undefined, "optional">;
-    active: convex_values87.VBoolean<boolean | undefined, "optional">;
-    raw: convex_values87.VAny<any, "optional", string>;
+    connectionId: convex_values89.VId<convex_values89.GenericId<"GroupConnection">, "required">;
+    groupId: convex_values89.VId<convex_values89.GenericId<"Group">, "required">;
+    resourceType: convex_values89.VUnion<"user" | "group", [convex_values89.VLiteral<"user", "required">, convex_values89.VLiteral<"group", "required">], "required", never>;
+    externalId: convex_values89.VString<string, "required">;
+    userId: convex_values89.VId<convex_values89.GenericId<"User"> | undefined, "optional">;
+    mappedGroupId: convex_values89.VId<convex_values89.GenericId<"Group"> | undefined, "optional">;
+    lastProvisionedAt: convex_values89.VFloat64<number | undefined, "optional">;
+    active: convex_values89.VBoolean<boolean | undefined, "optional">;
+    raw: convex_values89.VAny<any, "optional", string>;
   }, "required", "userId" | "externalId" | "groupId" | "active" | "connectionId" | "resourceType" | "mappedGroupId" | "lastProvisionedAt" | "raw" | `raw.${string}`>, {
     group_connection_id: ["connectionId", "_creationTime"];
     group_id: ["groupId", "_creationTime"];
@@ -695,32 +699,32 @@ declare const _default: convex_server81.SchemaDefinition<{
   /**
    * Immutable audit trail for group connection operations.
    */
-  GroupAuditEvent: convex_server81.TableDefinition<convex_values87.VObject<{
+  GroupAuditEvent: convex_server83.TableDefinition<convex_values89.VObject<{
     metadata?: any;
-    connectionId?: convex_values87.GenericId<"GroupConnection"> | undefined;
+    connectionId?: convex_values89.GenericId<"GroupConnection"> | undefined;
     actorId?: string | undefined;
     subjectId?: string | undefined;
     requestId?: string | undefined;
     ip?: string | undefined;
     status: "success" | "failure";
-    groupId: convex_values87.GenericId<"Group">;
+    groupId: convex_values89.GenericId<"Group">;
     actorType: "user" | "scim" | "system" | "api_key" | "webhook";
     eventType: string;
     subjectType: string;
     occurredAt: number;
   }, {
-    connectionId: convex_values87.VId<convex_values87.GenericId<"GroupConnection"> | undefined, "optional">;
-    groupId: convex_values87.VId<convex_values87.GenericId<"Group">, "required">;
-    eventType: convex_values87.VString<string, "required">;
-    actorType: convex_values87.VUnion<"user" | "scim" | "system" | "api_key" | "webhook", [convex_values87.VLiteral<"user", "required">, convex_values87.VLiteral<"system", "required">, convex_values87.VLiteral<"scim", "required">, convex_values87.VLiteral<"api_key", "required">, convex_values87.VLiteral<"webhook", "required">], "required", never>;
-    actorId: convex_values87.VString<string | undefined, "optional">;
-    subjectType: convex_values87.VString<string, "required">;
-    subjectId: convex_values87.VString<string | undefined, "optional">;
-    status: convex_values87.VUnion<"success" | "failure", [convex_values87.VLiteral<"success", "required">, convex_values87.VLiteral<"failure", "required">], "required", never>;
-    occurredAt: convex_values87.VFloat64<number, "required">;
-    requestId: convex_values87.VString<string | undefined, "optional">;
-    ip: convex_values87.VString<string | undefined, "optional">;
-    metadata: convex_values87.VAny<any, "optional", string>;
+    connectionId: convex_values89.VId<convex_values89.GenericId<"GroupConnection"> | undefined, "optional">;
+    groupId: convex_values89.VId<convex_values89.GenericId<"Group">, "required">;
+    eventType: convex_values89.VString<string, "required">;
+    actorType: convex_values89.VUnion<"user" | "scim" | "system" | "api_key" | "webhook", [convex_values89.VLiteral<"user", "required">, convex_values89.VLiteral<"system", "required">, convex_values89.VLiteral<"scim", "required">, convex_values89.VLiteral<"api_key", "required">, convex_values89.VLiteral<"webhook", "required">], "required", never>;
+    actorId: convex_values89.VString<string | undefined, "optional">;
+    subjectType: convex_values89.VString<string, "required">;
+    subjectId: convex_values89.VString<string | undefined, "optional">;
+    status: convex_values89.VUnion<"success" | "failure", [convex_values89.VLiteral<"success", "required">, convex_values89.VLiteral<"failure", "required">], "required", never>;
+    occurredAt: convex_values89.VFloat64<number, "required">;
+    requestId: convex_values89.VString<string | undefined, "optional">;
+    ip: convex_values89.VString<string | undefined, "optional">;
+    metadata: convex_values89.VAny<any, "optional", string>;
   }, "required", "status" | "metadata" | `metadata.${string}` | "groupId" | "connectionId" | "actorType" | "eventType" | "actorId" | "subjectType" | "subjectId" | "occurredAt" | "requestId" | "ip">, {
     group_connection_id_occurred_at: ["connectionId", "occurredAt", "_creationTime"];
     group_id_occurred_at: ["groupId", "occurredAt", "_creationTime"];
@@ -729,30 +733,30 @@ declare const _default: convex_server81.SchemaDefinition<{
   /**
    * Webhook endpoints subscribed to group audit and lifecycle events.
    */
-  GroupWebhookEndpoint: convex_server81.TableDefinition<convex_values87.VObject<{
+  GroupWebhookEndpoint: convex_server83.TableDefinition<convex_values89.VObject<{
     extend?: any;
-    createdByUserId?: convex_values87.GenericId<"User"> | undefined;
+    createdByUserId?: convex_values89.GenericId<"User"> | undefined;
     lastSuccessAt?: number | undefined;
     lastFailureAt?: number | undefined;
     status: "active" | "disabled";
-    groupId: convex_values87.GenericId<"Group">;
-    connectionId: convex_values87.GenericId<"GroupConnection">;
+    groupId: convex_values89.GenericId<"Group">;
+    connectionId: convex_values89.GenericId<"GroupConnection">;
     url: string;
     secretHash: string;
     subscriptions: string[];
     failureCount: number;
   }, {
-    connectionId: convex_values87.VId<convex_values87.GenericId<"GroupConnection">, "required">;
-    groupId: convex_values87.VId<convex_values87.GenericId<"Group">, "required">;
-    url: convex_values87.VString<string, "required">;
-    status: convex_values87.VUnion<"active" | "disabled", [convex_values87.VLiteral<"active", "required">, convex_values87.VLiteral<"disabled", "required">], "required", never>;
-    secretHash: convex_values87.VString<string, "required">;
-    subscriptions: convex_values87.VArray<string[], convex_values87.VString<string, "required">, "required">;
-    createdByUserId: convex_values87.VId<convex_values87.GenericId<"User"> | undefined, "optional">;
-    lastSuccessAt: convex_values87.VFloat64<number | undefined, "optional">;
-    lastFailureAt: convex_values87.VFloat64<number | undefined, "optional">;
-    failureCount: convex_values87.VFloat64<number, "required">;
-    extend: convex_values87.VAny<any, "optional", string>;
+    connectionId: convex_values89.VId<convex_values89.GenericId<"GroupConnection">, "required">;
+    groupId: convex_values89.VId<convex_values89.GenericId<"Group">, "required">;
+    url: convex_values89.VString<string, "required">;
+    status: convex_values89.VUnion<"active" | "disabled", [convex_values89.VLiteral<"active", "required">, convex_values89.VLiteral<"disabled", "required">], "required", never>;
+    secretHash: convex_values89.VString<string, "required">;
+    subscriptions: convex_values89.VArray<string[], convex_values89.VString<string, "required">, "required">;
+    createdByUserId: convex_values89.VId<convex_values89.GenericId<"User"> | undefined, "optional">;
+    lastSuccessAt: convex_values89.VFloat64<number | undefined, "optional">;
+    lastFailureAt: convex_values89.VFloat64<number | undefined, "optional">;
+    failureCount: convex_values89.VFloat64<number, "required">;
+    extend: convex_values89.VAny<any, "optional", string>;
   }, "required", "status" | "extend" | `extend.${string}` | "groupId" | "connectionId" | "url" | "secretHash" | "subscriptions" | "createdByUserId" | "lastSuccessAt" | "lastFailureAt" | "failureCount">, {
     group_connection_id: ["connectionId", "_creationTime"];
     group_id: ["groupId", "_creationTime"];
@@ -761,30 +765,30 @@ declare const _default: convex_server81.SchemaDefinition<{
   /**
    * Delivery queue for outbound group webhooks.
    */
-  GroupWebhookDelivery: convex_server81.TableDefinition<convex_values87.VObject<{
-    auditEventId?: convex_values87.GenericId<"GroupAuditEvent"> | undefined;
+  GroupWebhookDelivery: convex_server83.TableDefinition<convex_values89.VObject<{
+    auditEventId?: convex_values89.GenericId<"GroupAuditEvent"> | undefined;
     lastAttemptAt?: number | undefined;
     lastResponseStatus?: number | undefined;
     lastError?: string | undefined;
     status: "pending" | "processing" | "delivered" | "failed";
-    connectionId: convex_values87.GenericId<"GroupConnection">;
+    connectionId: convex_values89.GenericId<"GroupConnection">;
     eventType: string;
-    endpointId: convex_values87.GenericId<"GroupWebhookEndpoint">;
+    endpointId: convex_values89.GenericId<"GroupWebhookEndpoint">;
     attemptCount: number;
     nextAttemptAt: number;
     payload: any;
   }, {
-    connectionId: convex_values87.VId<convex_values87.GenericId<"GroupConnection">, "required">;
-    endpointId: convex_values87.VId<convex_values87.GenericId<"GroupWebhookEndpoint">, "required">;
-    auditEventId: convex_values87.VId<convex_values87.GenericId<"GroupAuditEvent"> | undefined, "optional">;
-    eventType: convex_values87.VString<string, "required">;
-    status: convex_values87.VUnion<"pending" | "processing" | "delivered" | "failed", [convex_values87.VLiteral<"pending", "required">, convex_values87.VLiteral<"processing", "required">, convex_values87.VLiteral<"delivered", "required">, convex_values87.VLiteral<"failed", "required">], "required", never>;
-    attemptCount: convex_values87.VFloat64<number, "required">;
-    nextAttemptAt: convex_values87.VFloat64<number, "required">;
-    lastAttemptAt: convex_values87.VFloat64<number | undefined, "optional">;
-    lastResponseStatus: convex_values87.VFloat64<number | undefined, "optional">;
-    lastError: convex_values87.VString<string | undefined, "optional">;
-    payload: convex_values87.VAny<any, "required", string>;
+    connectionId: convex_values89.VId<convex_values89.GenericId<"GroupConnection">, "required">;
+    endpointId: convex_values89.VId<convex_values89.GenericId<"GroupWebhookEndpoint">, "required">;
+    auditEventId: convex_values89.VId<convex_values89.GenericId<"GroupAuditEvent"> | undefined, "optional">;
+    eventType: convex_values89.VString<string, "required">;
+    status: convex_values89.VUnion<"pending" | "processing" | "delivered" | "failed", [convex_values89.VLiteral<"pending", "required">, convex_values89.VLiteral<"processing", "required">, convex_values89.VLiteral<"delivered", "required">, convex_values89.VLiteral<"failed", "required">], "required", never>;
+    attemptCount: convex_values89.VFloat64<number, "required">;
+    nextAttemptAt: convex_values89.VFloat64<number, "required">;
+    lastAttemptAt: convex_values89.VFloat64<number | undefined, "optional">;
+    lastResponseStatus: convex_values89.VFloat64<number | undefined, "optional">;
+    lastError: convex_values89.VString<string | undefined, "optional">;
+    payload: convex_values89.VAny<any, "required", string>;
   }, "required", "status" | "connectionId" | "eventType" | "endpointId" | "auditEventId" | "attemptCount" | "nextAttemptAt" | "lastAttemptAt" | "lastResponseStatus" | "lastError" | "payload" | `payload.${string}`>, {
     group_connection_id: ["connectionId", "_creationTime"];
     status_next_attempt_at: ["status", "nextAttemptAt", "_creationTime"];
@@ -804,7 +808,7 @@ declare const _default: convex_server81.SchemaDefinition<{
    * - **Expiration**: optional TTL
    * - **Soft revocation**: `revoked` flag preserves audit trail
    */
-  ApiKey: convex_server81.TableDefinition<convex_values87.VObject<{
+  ApiKey: convex_server83.TableDefinition<convex_values89.VObject<{
     lastUsedAt?: number | undefined;
     expiresAt?: number | undefined;
     rateLimit?: {
@@ -818,7 +822,7 @@ declare const _default: convex_server81.SchemaDefinition<{
     metadata?: any;
     name: string;
     revoked: boolean;
-    userId: convex_values87.GenericId<"User">;
+    userId: convex_values89.GenericId<"User">;
     prefix: string;
     hashedKey: string;
     scopes: {
@@ -827,39 +831,39 @@ declare const _default: convex_server81.SchemaDefinition<{
     }[];
     createdAt: number;
   }, {
-    userId: convex_values87.VId<convex_values87.GenericId<"User">, "required">; /** First chars of the key for display (e.g. "sk_abc1..."). */
-    prefix: convex_values87.VString<string, "required">; /** SHA-256 hex hash of the full raw key. */
-    hashedKey: convex_values87.VString<string, "required">; /** User-assigned name (e.g. "CI Pipeline", "Production API"). */
-    name: convex_values87.VString<string, "required">; /** Scoped permissions: [{ resource: "users", actions: ["read", "list"] }]. */
-    scopes: convex_values87.VArray<{
+    userId: convex_values89.VId<convex_values89.GenericId<"User">, "required">; /** First chars of the key for display (e.g. "sk_abc1..."). */
+    prefix: convex_values89.VString<string, "required">; /** SHA-256 hex hash of the full raw key. */
+    hashedKey: convex_values89.VString<string, "required">; /** User-assigned name (e.g. "CI Pipeline", "Production API"). */
+    name: convex_values89.VString<string, "required">; /** Scoped permissions: [{ resource: "users", actions: ["read", "list"] }]. */
+    scopes: convex_values89.VArray<{
       resource: string;
       actions: string[];
-    }[], convex_values87.VObject<{
+    }[], convex_values89.VObject<{
       resource: string;
       actions: string[];
     }, {
-      resource: convex_values87.VString<string, "required">;
-      actions: convex_values87.VArray<string[], convex_values87.VString<string, "required">, "required">;
+      resource: convex_values89.VString<string, "required">;
+      actions: convex_values89.VArray<string[], convex_values89.VString<string, "required">, "required">;
     }, "required", "resource" | "actions">, "required">; /** Optional per-key rate limit configuration. */
-    rateLimit: convex_values87.VObject<{
+    rateLimit: convex_values89.VObject<{
       maxRequests: number;
       windowMs: number;
     } | undefined, {
-      maxRequests: convex_values87.VFloat64<number, "required">;
-      windowMs: convex_values87.VFloat64<number, "required">;
+      maxRequests: convex_values89.VFloat64<number, "required">;
+      windowMs: convex_values89.VFloat64<number, "required">;
     }, "optional", "maxRequests" | "windowMs">; /** Rate limit state tracking (token-bucket). */
-    rateLimitState: convex_values87.VObject<{
+    rateLimitState: convex_values89.VObject<{
       attemptsLeft: number;
       lastAttemptTime: number;
     } | undefined, {
-      attemptsLeft: convex_values87.VFloat64<number, "required">;
-      lastAttemptTime: convex_values87.VFloat64<number, "required">;
+      attemptsLeft: convex_values89.VFloat64<number, "required">;
+      lastAttemptTime: convex_values89.VFloat64<number, "required">;
     }, "optional", "attemptsLeft" | "lastAttemptTime">; /** Expiration timestamp. Null/undefined = never expires. */
-    expiresAt: convex_values87.VFloat64<number | undefined, "optional">;
-    lastUsedAt: convex_values87.VFloat64<number | undefined, "optional">;
-    createdAt: convex_values87.VFloat64<number, "required">; /** Soft-revoke flag. Revoked keys are kept for audit trail. */
-    revoked: convex_values87.VBoolean<boolean, "required">; /** Arbitrary app-specific metadata attached to the key. */
-    metadata: convex_values87.VAny<any, "optional", string>;
+    expiresAt: convex_values89.VFloat64<number | undefined, "optional">;
+    lastUsedAt: convex_values89.VFloat64<number | undefined, "optional">;
+    createdAt: convex_values89.VFloat64<number, "required">; /** Soft-revoke flag. Revoked keys are kept for audit trail. */
+    revoked: convex_values89.VBoolean<boolean, "required">; /** Arbitrary app-specific metadata attached to the key. */
+    metadata: convex_values89.VAny<any, "optional", string>;
   }, "required", "name" | "revoked" | "lastUsedAt" | "expiresAt" | "userId" | "prefix" | "hashedKey" | "scopes" | "rateLimit" | "rateLimitState" | "createdAt" | "metadata" | "rateLimit.maxRequests" | "rateLimit.windowMs" | "rateLimitState.attemptsLeft" | "rateLimitState.lastAttemptTime" | `metadata.${string}`>, {
     user_id: ["userId", "_creationTime"];
     hashed_key: ["hashedKey", "_creationTime"];