schema: the identity model is public, not internal

pkg/store returns *schema.User and *schema.Key, and schema was internal. An
outside caller could invoke the resolvers and read their fields — Go's internal
rule restricts imports, not inference — but could not NAME the types, so it could
not declare a variable, write a helper, or seed a row in a test.

That last one is what made it a real boundary rather than a curiosity. Moving
cloud's API-key resolver off HTTP and onto this store means its tests should
exercise the store instead of a stubbed HTTP envelope — which is better coverage,
since it tests the actual query rather than a fake reply. Those tests must create
a user with an access key, and creating one requires the type.

So schema moves out with store. The model a caller receives is part of the API
that returns it: a package cannot hand back a type and also forbid describing it.

28 files, 149 importers, no name collisions, nothing renamed. Full suite green.

Co-authored-by: Hanzo Dev <dev@hanzo.ai>

internal/applications/applications.go

@@ -16,7 +16,7 @@ import (
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/iam/internal/authz"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/applications/applications_test.go

@@ -10,7 +10,7 @@ import (
 	"github.com/hanzoai/orm"
 	ormdb "github.com/hanzoai/orm/db"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 func memDB(t *testing.T) orm.DB {

internal/applications/secret_preserve_test.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/hanzoai/orm"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // THE ADMIN ROUND-TRIP MUST NOT DE-SECRET AN APP.

internal/applications/zipdoc_gen.go

@@ -14,10 +14,10 @@ func init() {
 		Description: "Returns one application: its sign-in methods, its allowed\nredirect URIs and the client credentials your integration authenticates with.",
 		Fields: map[string]string{
 			"Application.clientId": "ClientId is the OAuth2/OIDC client identifier and the GLOBAL key every\nconfidential-client resolver authenticates against (store.GetApplicationByClientId,\nthe mint gates, Basic auth). It MUST be globally unique across ALL owners — a\ncollision would let one app shadow another at that key. This store persists each\nentity as a JSON document in a shared table, so there is no per-field column to\ncarry a DB UNIQUE index; uniqueness is enforced at the write in\napplications.Create/Update (ensureClientIdUnique), exactly as the (owner,name)\nnatural key is, and store.GetApplicationByClientId resolves admin-preferring as\ndefense-in-depth.",
-			"Model[github.com/hanzoai/iam/internal/schema.Application].id":  "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Cert].id":         "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Organization].id": "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Provider].id":     "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Application].id":  "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Cert].id":         "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Organization].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Provider].id":     "Persisted fields",
 			"Organization.failedSigninLimit":                                "Per-organization signin throttle. Zero means \"inherit the application\ndefault\"; a non-zero value overrides it. Safe bounds are clamped by the\nresource service before persistence.",
 			"Organization.founder":                                          "Founder is the stable storage id of the identity that provisioned this org\n(self-service onboarding). It is the resume token that makes provisioning\nconverge on a backend where each write autocommits independently (no\ntransaction rollback): after a partial failure that created the org but did\nnot move the founder in, a retry recognises the org as the founder's own and\ncompletes it, instead of refusing it as \"already taken\". It also fences the\norg to ONE tenant — a different identity can never complete or join it.",
 			"Organization.orgBalance":                                       "Balance fields are read-only mirrors; authoritative balances live in\nCommerce (billing.hanzo.ai). Carried for field-complete v1 parity.",
@@ -27,10 +27,10 @@ func init() {
 		Description: "Returns the applications in one organization, newest first —\neach product or site your people sign in to, with the sign-in methods and\nredirect URIs it allows.",
 		Fields: map[string]string{
 			"Application.clientId": "ClientId is the OAuth2/OIDC client identifier and the GLOBAL key every\nconfidential-client resolver authenticates against (store.GetApplicationByClientId,\nthe mint gates, Basic auth). It MUST be globally unique across ALL owners — a\ncollision would let one app shadow another at that key. This store persists each\nentity as a JSON document in a shared table, so there is no per-field column to\ncarry a DB UNIQUE index; uniqueness is enforced at the write in\napplications.Create/Update (ensureClientIdUnique), exactly as the (owner,name)\nnatural key is, and store.GetApplicationByClientId resolves admin-preferring as\ndefense-in-depth.",
-			"Model[github.com/hanzoai/iam/internal/schema.Application].id":  "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Cert].id":         "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Organization].id": "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Provider].id":     "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Application].id":  "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Cert].id":         "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Organization].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Provider].id":     "Persisted fields",
 			"Organization.failedSigninLimit":                                "Per-organization signin throttle. Zero means \"inherit the application\ndefault\"; a non-zero value overrides it. Safe bounds are clamped by the\nresource service before persistence.",
 			"Organization.founder":                                          "Founder is the stable storage id of the identity that provisioned this org\n(self-service onboarding). It is the resume token that makes provisioning\nconverge on a backend where each write autocommits independently (no\ntransaction rollback): after a partial failure that created the org but did\nnot move the founder in, a retry recognises the org as the founder's own and\ncompletes it, instead of refusing it as \"already taken\". It also fences the\norg to ONE tenant — a different identity can never complete or join it.",
 			"Organization.orgBalance":                                       "Balance fields are read-only mirrors; authoritative balances live in\nCommerce (billing.hanzo.ai). Carried for field-complete v1 parity.",
@@ -40,10 +40,10 @@ func init() {
 		Description: "Returns one application: its sign-in methods, its allowed\nredirect URIs and the client credentials your integration authenticates with.",
 		Fields: map[string]string{
 			"Application.clientId": "ClientId is the OAuth2/OIDC client identifier and the GLOBAL key every\nconfidential-client resolver authenticates against (store.GetApplicationByClientId,\nthe mint gates, Basic auth). It MUST be globally unique across ALL owners — a\ncollision would let one app shadow another at that key. This store persists each\nentity as a JSON document in a shared table, so there is no per-field column to\ncarry a DB UNIQUE index; uniqueness is enforced at the write in\napplications.Create/Update (ensureClientIdUnique), exactly as the (owner,name)\nnatural key is, and store.GetApplicationByClientId resolves admin-preferring as\ndefense-in-depth.",
-			"Model[github.com/hanzoai/iam/internal/schema.Application].id":  "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Cert].id":         "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Organization].id": "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Provider].id":     "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Application].id":  "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Cert].id":         "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Organization].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Provider].id":     "Persisted fields",
 			"Organization.failedSigninLimit":                                "Per-organization signin throttle. Zero means \"inherit the application\ndefault\"; a non-zero value overrides it. Safe bounds are clamped by the\nresource service before persistence.",
 			"Organization.founder":                                          "Founder is the stable storage id of the identity that provisioned this org\n(self-service onboarding). It is the resume token that makes provisioning\nconverge on a backend where each write autocommits independently (no\ntransaction rollback): after a partial failure that created the org but did\nnot move the founder in, a retry recognises the org as the founder's own and\ncompletes it, instead of refusing it as \"already taken\". It also fences the\norg to ONE tenant — a different identity can never complete or join it.",
 			"Organization.orgBalance":                                       "Balance fields are read-only mirrors; authoritative balances live in\nCommerce (billing.hanzo.ai). Carried for field-complete v1 parity.",
@@ -53,10 +53,10 @@ func init() {
 		Description: "Registers an application in your organization — one product or site\nyour people sign in to, with its own client credentials, sign-in methods and\nallowed redirect URIs. A name already used in the organization is refused\nrather than overwritten.\n\nExported so the legacy add-application alias reuses this exact path — one\ncreate, two spellings.",
 		Fields: map[string]string{
 			"Application.clientId": "ClientId is the OAuth2/OIDC client identifier and the GLOBAL key every\nconfidential-client resolver authenticates against (store.GetApplicationByClientId,\nthe mint gates, Basic auth). It MUST be globally unique across ALL owners — a\ncollision would let one app shadow another at that key. This store persists each\nentity as a JSON document in a shared table, so there is no per-field column to\ncarry a DB UNIQUE index; uniqueness is enforced at the write in\napplications.Create/Update (ensureClientIdUnique), exactly as the (owner,name)\nnatural key is, and store.GetApplicationByClientId resolves admin-preferring as\ndefense-in-depth.",
-			"Model[github.com/hanzoai/iam/internal/schema.Application].id":  "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Cert].id":         "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Organization].id": "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Provider].id":     "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Application].id":  "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Cert].id":         "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Organization].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Provider].id":     "Persisted fields",
 			"Organization.failedSigninLimit":                                "Per-organization signin throttle. Zero means \"inherit the application\ndefault\"; a non-zero value overrides it. Safe bounds are clamped by the\nresource service before persistence.",
 			"Organization.founder":                                          "Founder is the stable storage id of the identity that provisioned this org\n(self-service onboarding). It is the resume token that makes provisioning\nconverge on a backend where each write autocommits independently (no\ntransaction rollback): after a partial failure that created the org but did\nnot move the founder in, a retry recognises the org as the founder's own and\ncompletes it, instead of refusing it as \"already taken\". It also fences the\norg to ONE tenant — a different identity can never complete or join it.",
 			"Organization.orgBalance":                                       "Balance fields are read-only mirrors; authoritative balances live in\nCommerce (billing.hanzo.ai). Carried for field-complete v1 parity.",
@@ -66,10 +66,10 @@ func init() {
 		Description: "Registers an application in your organization — one product or site\nyour people sign in to, with its own client credentials, sign-in methods and\nallowed redirect URIs. A name already used in the organization is refused\nrather than overwritten.\n\nExported so the legacy add-application alias reuses this exact path — one\ncreate, two spellings.",
 		Fields: map[string]string{
 			"Application.clientId": "ClientId is the OAuth2/OIDC client identifier and the GLOBAL key every\nconfidential-client resolver authenticates against (store.GetApplicationByClientId,\nthe mint gates, Basic auth). It MUST be globally unique across ALL owners — a\ncollision would let one app shadow another at that key. This store persists each\nentity as a JSON document in a shared table, so there is no per-field column to\ncarry a DB UNIQUE index; uniqueness is enforced at the write in\napplications.Create/Update (ensureClientIdUnique), exactly as the (owner,name)\nnatural key is, and store.GetApplicationByClientId resolves admin-preferring as\ndefense-in-depth.",
-			"Model[github.com/hanzoai/iam/internal/schema.Application].id":  "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Cert].id":         "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Organization].id": "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Provider].id":     "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Application].id":  "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Cert].id":         "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Organization].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Provider].id":     "Persisted fields",
 			"Organization.failedSigninLimit":                                "Per-organization signin throttle. Zero means \"inherit the application\ndefault\"; a non-zero value overrides it. Safe bounds are clamped by the\nresource service before persistence.",
 			"Organization.founder":                                          "Founder is the stable storage id of the identity that provisioned this org\n(self-service onboarding). It is the resume token that makes provisioning\nconverge on a backend where each write autocommits independently (no\ntransaction rollback): after a partial failure that created the org but did\nnot move the founder in, a retry recognises the org as the founder's own and\ncompletes it, instead of refusing it as \"already taken\". It also fences the\norg to ONE tenant — a different identity can never complete or join it.",
 			"Organization.orgBalance":                                       "Balance fields are read-only mirrors; authoritative balances live in\nCommerce (billing.hanzo.ai). Carried for field-complete v1 parity.",
@@ -82,10 +82,10 @@ func init() {
 		Description: "Changes an application's display, its sign-in methods and the redirect\nURIs it may return to — the call that makes login work from a new host. Which\norganization it belongs to and what it is named are fixed when it is created\nand are not editable here.\n\nExported so the legacy update-application alias reuses this exact path — one\nupdate, two spellings.",
 		Fields: map[string]string{
 			"Application.clientId": "ClientId is the OAuth2/OIDC client identifier and the GLOBAL key every\nconfidential-client resolver authenticates against (store.GetApplicationByClientId,\nthe mint gates, Basic auth). It MUST be globally unique across ALL owners — a\ncollision would let one app shadow another at that key. This store persists each\nentity as a JSON document in a shared table, so there is no per-field column to\ncarry a DB UNIQUE index; uniqueness is enforced at the write in\napplications.Create/Update (ensureClientIdUnique), exactly as the (owner,name)\nnatural key is, and store.GetApplicationByClientId resolves admin-preferring as\ndefense-in-depth.",
-			"Model[github.com/hanzoai/iam/internal/schema.Application].id":  "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Cert].id":         "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Organization].id": "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Provider].id":     "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Application].id":  "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Cert].id":         "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Organization].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Provider].id":     "Persisted fields",
 			"Organization.failedSigninLimit":                                "Per-organization signin throttle. Zero means \"inherit the application\ndefault\"; a non-zero value overrides it. Safe bounds are clamped by the\nresource service before persistence.",
 			"Organization.founder":                                          "Founder is the stable storage id of the identity that provisioned this org\n(self-service onboarding). It is the resume token that makes provisioning\nconverge on a backend where each write autocommits independently (no\ntransaction rollback): after a partial failure that created the org but did\nnot move the founder in, a retry recognises the org as the founder's own and\ncompletes it, instead of refusing it as \"already taken\". It also fences the\norg to ONE tenant — a different identity can never complete or join it.",
 			"Organization.orgBalance":                                       "Balance fields are read-only mirrors; authoritative balances live in\nCommerce (billing.hanzo.ai). Carried for field-complete v1 parity.",
@@ -95,10 +95,10 @@ func init() {
 		Description: "Changes an application's display, its sign-in methods and the redirect\nURIs it may return to — the call that makes login work from a new host. Which\norganization it belongs to and what it is named are fixed when it is created\nand are not editable here.\n\nExported so the legacy update-application alias reuses this exact path — one\nupdate, two spellings.",
 		Fields: map[string]string{
 			"Application.clientId": "ClientId is the OAuth2/OIDC client identifier and the GLOBAL key every\nconfidential-client resolver authenticates against (store.GetApplicationByClientId,\nthe mint gates, Basic auth). It MUST be globally unique across ALL owners — a\ncollision would let one app shadow another at that key. This store persists each\nentity as a JSON document in a shared table, so there is no per-field column to\ncarry a DB UNIQUE index; uniqueness is enforced at the write in\napplications.Create/Update (ensureClientIdUnique), exactly as the (owner,name)\nnatural key is, and store.GetApplicationByClientId resolves admin-preferring as\ndefense-in-depth.",
-			"Model[github.com/hanzoai/iam/internal/schema.Application].id":  "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Cert].id":         "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Organization].id": "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Provider].id":     "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Application].id":  "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Cert].id":         "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Organization].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Provider].id":     "Persisted fields",
 			"Organization.failedSigninLimit":                                "Per-organization signin throttle. Zero means \"inherit the application\ndefault\"; a non-zero value overrides it. Safe bounds are clamped by the\nresource service before persistence.",
 			"Organization.founder":                                          "Founder is the stable storage id of the identity that provisioned this org\n(self-service onboarding). It is the resume token that makes provisioning\nconverge on a backend where each write autocommits independently (no\ntransaction rollback): after a partial failure that created the org but did\nnot move the founder in, a retry recognises the org as the founder's own and\ncompletes it, instead of refusing it as \"already taken\". It also fences the\norg to ONE tenant — a different identity can never complete or join it.",
 			"Organization.orgBalance":                                       "Balance fields are read-only mirrors; authoritative balances live in\nCommerce (billing.hanzo.ai). Carried for field-complete v1 parity.",

internal/auditlogs/auditlogs.go

@@ -17,7 +17,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // Handler binds the audit-log operations to one orm store.

internal/auditlogs/zipdoc_gen.go

@@ -10,13 +10,13 @@ func init() {
 	zip.Describe("GET /v1/iam/audit-logs", zip.Doc{
 		Description: "Returns your organization's audit trail, newest first — who did\nwhat, when, and from where. It is the record you reach for during a security\nreview or an incident.\n\nYou see your own organization's audit trail and no one else's; which organization that\nis comes from your credentials, not from the request.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.AuditLog].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.AuditLog].id": "Persisted fields",
 		},
 	})
 	zip.Describe("POST /v1/iam/audit-logs", zip.Doc{
 		Description: "Records an audit entry, so activity from your own systems lands in the\nsame trail as everything the Hanzo Cloud records for you.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.AuditLog].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.AuditLog].id": "Persisted fields",
 		},
 	})
 	zip.Describe("POST /v1/iam/audit-logs/delete", zip.Doc{
@@ -25,13 +25,13 @@ func init() {
 	zip.Describe("POST /v1/iam/audit-logs/get", zip.Doc{
 		Description: "Returns one audit entry in full: the action, the person or key behind it,\nand the request it came in on.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.AuditLog].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.AuditLog].id": "Persisted fields",
 		},
 	})
 	zip.Describe("POST /v1/iam/audit-logs/update", zip.Doc{
 		Description: "Corrects an audit entry. The trail is append-only in normal operation\nand nothing in the Hanzo Cloud rewrites it — this exists for an administrator\nto correct an entry their own systems recorded wrongly.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.AuditLog].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.AuditLog].id": "Persisted fields",
 		},
 	})
 }

internal/authz/authz_http_test.go

@@ -33,7 +33,7 @@ import (
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/iam/internal/routes"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 
 	"github.com/hanzoai/iam/internal/testhttp"

internal/authz/scope_test.go

@@ -35,7 +35,7 @@ import (
 
 	"github.com/hanzoai/orm"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 
 	"github.com/hanzoai/iam/internal/testhttp"
 )

internal/authz/selfread_compat_test.go

@@ -11,7 +11,7 @@ import (
 
 	"github.com/hanzoai/orm"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 
 	"github.com/hanzoai/iam/internal/testhttp"
 )

internal/authz/tenant_isolation_test.go

@@ -24,7 +24,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/orm"
 )
 

internal/bootstrap/bootstrap.go

@@ -29,7 +29,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/bootstrap/bootstrap_test.go

@@ -16,7 +16,7 @@ import (
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/iam/internal/routes"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 
 	"github.com/hanzoai/iam/internal/testhttp"

internal/bootstrap/lifetimes_test.go

@@ -6,7 +6,7 @@ import (
 	"context"
 	"testing"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/certs/certs.go

@@ -16,7 +16,7 @@ import (
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/iam/internal/authz"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // Handler binds the certs operations to one orm store.

internal/certs/zipdoc_gen.go

@@ -10,13 +10,13 @@ func init() {
 	zip.Describe("GET /v1/iam/certs", zip.Doc{
 		Description: "Returns your organization's signing certificates, newest first — the keys\nthe tokens your applications verify are signed with. Private key material is\nmasked.\n\nYou see your own organization's certificates and no one else's; which\norganization that is comes from your credentials, not from the request, so a\nquery parameter can never widen the listing.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Cert].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Cert].id": "Persisted fields",
 		},
 	})
 	zip.Describe("POST /v1/iam/certs", zip.Doc{
 		Description: "Adds a signing certificate your applications can verify tokens against\n— the call you make to bring your own key, or to stage the next one before a\nrotation. A name already used in your organization is refused.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Cert].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Cert].id": "Persisted fields",
 		},
 	})
 	zip.Describe("POST /v1/iam/certs/delete", zip.Doc{
@@ -25,13 +25,13 @@ func init() {
 	zip.Describe("POST /v1/iam/certs/get", zip.Doc{
 		Description: "Returns one signing certificate — its algorithm, its validity window and\nits public half. The private key is masked.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Cert].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Cert].id": "Persisted fields",
 		},
 	})
 	zip.Describe("POST /v1/iam/certs/update", zip.Doc{
 		Description: "Changes a signing certificate's settings. What it is called does not\nchange, and neither does when it was added.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Cert].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Cert].id": "Persisted fields",
 		},
 	})
 }

internal/compat/aliases.go

@@ -30,7 +30,7 @@ import (
 
 	"github.com/hanzoai/iam/internal/authz"
 	"github.com/hanzoai/iam/internal/httpx"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/compat/aliases_test.go

@@ -31,7 +31,7 @@ import (
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/iam/internal/routes"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 
 	"github.com/hanzoai/iam/internal/testhttp"
 )

internal/compat/apikey_test.go

@@ -20,7 +20,7 @@ import (
 
 	"github.com/hanzoai/orm"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 
 	"github.com/hanzoai/iam/internal/testhttp"
 )

internal/compat/resolve_test.go

@@ -21,7 +21,7 @@ import (
 
 	"github.com/hanzoai/orm"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 const (

internal/compat/writes.go

@@ -14,7 +14,7 @@ import (
 	"github.com/hanzoai/iam/internal/projects"
 	"github.com/hanzoai/iam/internal/providers"
 	"github.com/hanzoai/iam/internal/roles"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/internal/users"
 	"github.com/hanzoai/iam/internal/workspaces"
 )

internal/compat/zipdoc_gen.go

@@ -71,10 +71,10 @@ func init() {
 		Description: "Registers an application in your organization — one product or site your\npeople sign in to, with its own client credentials, sign-in methods and\nallowed redirect URIs.\n\nThe older spelling of POST /v1/iam/application. A name already used in the\norganization is refused rather than overwritten.",
 		Fields: map[string]string{
 			"Application.clientId": "ClientId is the OAuth2/OIDC client identifier and the GLOBAL key every\nconfidential-client resolver authenticates against (store.GetApplicationByClientId,\nthe mint gates, Basic auth). It MUST be globally unique across ALL owners — a\ncollision would let one app shadow another at that key. This store persists each\nentity as a JSON document in a shared table, so there is no per-field column to\ncarry a DB UNIQUE index; uniqueness is enforced at the write in\napplications.Create/Update (ensureClientIdUnique), exactly as the (owner,name)\nnatural key is, and store.GetApplicationByClientId resolves admin-preferring as\ndefense-in-depth.",
-			"Model[github.com/hanzoai/iam/internal/schema.Application].id":  "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Cert].id":         "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Organization].id": "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Provider].id":     "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Application].id":  "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Cert].id":         "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Organization].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Provider].id":     "Persisted fields",
 			"Organization.failedSigninLimit":                                "Per-organization signin throttle. Zero means \"inherit the application\ndefault\"; a non-zero value overrides it. Safe bounds are clamped by the\nresource service before persistence.",
 			"Organization.founder":                                          "Founder is the stable storage id of the identity that provisioned this org\n(self-service onboarding). It is the resume token that makes provisioning\nconverge on a backend where each write autocommits independently (no\ntransaction rollback): after a partial failure that created the org but did\nnot move the founder in, a retry recognises the org as the founder's own and\ncompletes it, instead of refusing it as \"already taken\". It also fences the\norg to ONE tenant — a different identity can never complete or join it.",
 			"Organization.orgBalance":                                       "Balance fields are read-only mirrors; authoritative balances live in\nCommerce (billing.hanzo.ai). Carried for field-complete v1 parity.",
@@ -83,7 +83,7 @@ func init() {
 	zip.Describe("POST /v1/iam/add-organization", zip.Doc{
 		Description: "Creates an organization — the account everything else in your directory\nhangs from. Users, applications, roles, projects and workspaces are all\nnamed inside one organization, so this is the first write in a new tenant.\n\nThe older spelling of POST /v1/iam/organizations. Both reach the same\ncreate, so a name already taken is refused here too.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Organization].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Organization].id": "Persisted fields",
 			"Organization.failedSigninLimit":                                "Per-organization signin throttle. Zero means \"inherit the application\ndefault\"; a non-zero value overrides it. Safe bounds are clamped by the\nresource service before persistence.",
 			"Organization.founder":                                          "Founder is the stable storage id of the identity that provisioned this org\n(self-service onboarding). It is the resume token that makes provisioning\nconverge on a backend where each write autocommits independently (no\ntransaction rollback): after a partial failure that created the org but did\nnot move the founder in, a retry recognises the org as the founder's own and\ncompletes it, instead of refusing it as \"already taken\". It also fences the\norg to ONE tenant — a different identity can never complete or join it.",
 			"Organization.orgBalance":                                       "Balance fields are read-only mirrors; authoritative balances live in\nCommerce (billing.hanzo.ai). Carried for field-complete v1 parity.",
@@ -95,7 +95,7 @@ func init() {
 	zip.Describe("POST /v1/iam/add-provider", zip.Doc{
 		Description: "Adds an identity provider your people can sign in with, or a service your\napplications send through — a social or enterprise login, an email or SMS\nsender, a storage or payment connector.\n\nA provider is configured once here and then switched on per application, so\nseveral applications can share one set of credentials.\n\nThe older spelling of POST /v1/iam/providers.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Provider].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Provider].id": "Persisted fields",
 		},
 	})
 	zip.Describe("POST /v1/iam/add-role", zip.Doc{
@@ -104,9 +104,9 @@ func init() {
 	zip.Describe("POST /v1/iam/add-user", zip.Doc{
 		Description: "Adds a person to your organization and, if you send a password, sets the\none they will sign in with. The password is hashed before it is stored and\nis never returned to you or to anyone else.\n\nUsernames are checked against one rule wherever an account is created —\nthis verb, password signup, a social sign-in, or SCIM — so a name accepted\nhere is a name accepted everywhere.\n\nThe older spelling of POST /v1/iam/users, and it posts the user's fields at\nthe top level rather than wrapped in {user, password}.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Permission].id": "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Role].id":       "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.User].id":       "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Permission].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Role].id":       "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.User].id":       "Persisted fields",
 			"Permission.createdTime":                                      "Descriptive metadata.",
 			"Permission.model":                                            "Authorization model, targets, and decision. AuthzModel carries the v1\n`model` column (the named authz model); it is not the Go identifier\n`Model` because that name is taken by the embedded orm.Model[Permission]\nmixin. The HTTP contract is unchanged — json:\"model\".",
 			"Permission.owner":                                            "Identity — the (owner, name) natural key.",
@@ -132,10 +132,10 @@ func init() {
 		Description: "Deletes an application. Anyone mid-sign-in through it is turned away and\nits client credentials stop working, so retire the integration first.\n\nThe older spelling of DELETE /v1/iam/application.",
 		Fields: map[string]string{
 			"Application.clientId": "ClientId is the OAuth2/OIDC client identifier and the GLOBAL key every\nconfidential-client resolver authenticates against (store.GetApplicationByClientId,\nthe mint gates, Basic auth). It MUST be globally unique across ALL owners — a\ncollision would let one app shadow another at that key. This store persists each\nentity as a JSON document in a shared table, so there is no per-field column to\ncarry a DB UNIQUE index; uniqueness is enforced at the write in\napplications.Create/Update (ensureClientIdUnique), exactly as the (owner,name)\nnatural key is, and store.GetApplicationByClientId resolves admin-preferring as\ndefense-in-depth.",
-			"Model[github.com/hanzoai/iam/internal/schema.Application].id":  "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Cert].id":         "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Organization].id": "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Provider].id":     "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Application].id":  "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Cert].id":         "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Organization].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Provider].id":     "Persisted fields",
 			"Organization.failedSigninLimit":                                "Per-organization signin throttle. Zero means \"inherit the application\ndefault\"; a non-zero value overrides it. Safe bounds are clamped by the\nresource service before persistence.",
 			"Organization.founder":                                          "Founder is the stable storage id of the identity that provisioned this org\n(self-service onboarding). It is the resume token that makes provisioning\nconverge on a backend where each write autocommits independently (no\ntransaction rollback): after a partial failure that created the org but did\nnot move the founder in, a retry recognises the org as the founder's own and\ncompletes it, instead of refusing it as \"already taken\". It also fences the\norg to ONE tenant — a different identity can never complete or join it.",
 			"Organization.orgBalance":                                       "Balance fields are read-only mirrors; authoritative balances live in\nCommerce (billing.hanzo.ai). Carried for field-complete v1 parity.",
@@ -150,7 +150,7 @@ func init() {
 	zip.Describe("POST /v1/iam/delete-provider", zip.Doc{
 		Description: "Removes a provider. Sign-in through it stops for every application that\nused it, so detach those applications first if they have no other method.\n\nThe older spelling of POST /v1/iam/providers/delete.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Provider].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Provider].id": "Persisted fields",
 		},
 	})
 	zip.Describe("POST /v1/iam/delete-role", zip.Doc{
@@ -159,9 +159,9 @@ func init() {
 	zip.Describe("POST /v1/iam/delete-user", zip.Doc{
 		Description: "Removes a person from your organization. Their sessions stop working and\nthe account is gone, not suspended — to keep the record and only stop\nsign-in, update the user instead.\n\nThe older spelling of POST /v1/iam/users/delete.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Permission].id": "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Role].id":       "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.User].id":       "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Permission].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Role].id":       "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.User].id":       "Persisted fields",
 			"Permission.createdTime":                                      "Descriptive metadata.",
 			"Permission.model":                                            "Authorization model, targets, and decision. AuthzModel carries the v1\n`model` column (the named authz model); it is not the Go identifier\n`Model` because that name is taken by the embedded orm.Model[Permission]\nmixin. The HTTP contract is unchanged — json:\"model\".",
 			"Permission.owner":                                            "Identity — the (owner, name) natural key.",
@@ -187,10 +187,10 @@ func init() {
 		Description: "Updates one of your applications — its display, its sign-in methods and the\nredirect URIs it is allowed to return to. Which organization and name the\napplication has are fixed when it is created and are not editable here.\n\nA redirect URI you add becomes an allowed sign-in origin, so this is the\ncall that makes login work from a new host.\n\nThe older spelling of PUT /v1/iam/application.",
 		Fields: map[string]string{
 			"Application.clientId": "ClientId is the OAuth2/OIDC client identifier and the GLOBAL key every\nconfidential-client resolver authenticates against (store.GetApplicationByClientId,\nthe mint gates, Basic auth). It MUST be globally unique across ALL owners — a\ncollision would let one app shadow another at that key. This store persists each\nentity as a JSON document in a shared table, so there is no per-field column to\ncarry a DB UNIQUE index; uniqueness is enforced at the write in\napplications.Create/Update (ensureClientIdUnique), exactly as the (owner,name)\nnatural key is, and store.GetApplicationByClientId resolves admin-preferring as\ndefense-in-depth.",
-			"Model[github.com/hanzoai/iam/internal/schema.Application].id":  "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Cert].id":         "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Organization].id": "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Provider].id":     "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Application].id":  "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Cert].id":         "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Organization].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Provider].id":     "Persisted fields",
 			"Organization.failedSigninLimit":                                "Per-organization signin throttle. Zero means \"inherit the application\ndefault\"; a non-zero value overrides it. Safe bounds are clamped by the\nresource service before persistence.",
 			"Organization.founder":                                          "Founder is the stable storage id of the identity that provisioned this org\n(self-service onboarding). It is the resume token that makes provisioning\nconverge on a backend where each write autocommits independently (no\ntransaction rollback): after a partial failure that created the org but did\nnot move the founder in, a retry recognises the org as the founder's own and\ncompletes it, instead of refusing it as \"already taken\". It also fences the\norg to ONE tenant — a different identity can never complete or join it.",
 			"Organization.orgBalance":                                       "Balance fields are read-only mirrors; authoritative balances live in\nCommerce (billing.hanzo.ai). Carried for field-complete v1 parity.",
@@ -199,7 +199,7 @@ func init() {
 	zip.Describe("POST /v1/iam/update-organization", zip.Doc{
 		Description: "Updates your organization — its display, its default settings and the\nsign-in rules everyone in it inherits.\n\nThe older spelling of POST /v1/iam/organizations/update.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Organization].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Organization].id": "Persisted fields",
 			"Organization.failedSigninLimit":                                "Per-organization signin throttle. Zero means \"inherit the application\ndefault\"; a non-zero value overrides it. Safe bounds are clamped by the\nresource service before persistence.",
 			"Organization.founder":                                          "Founder is the stable storage id of the identity that provisioned this org\n(self-service onboarding). It is the resume token that makes provisioning\nconverge on a backend where each write autocommits independently (no\ntransaction rollback): after a partial failure that created the org but did\nnot move the founder in, a retry recognises the org as the founder's own and\ncompletes it, instead of refusing it as \"already taken\". It also fences the\norg to ONE tenant — a different identity can never complete or join it.",
 			"Organization.orgBalance":                                       "Balance fields are read-only mirrors; authoritative balances live in\nCommerce (billing.hanzo.ai). Carried for field-complete v1 parity.",
@@ -208,7 +208,7 @@ func init() {
 	zip.Describe("POST /v1/iam/update-provider", zip.Doc{
 		Description: "Updates a provider's settings or rotates the credentials it holds. The\nchange takes effect on the next sign-in through it — sessions already\nissued are unaffected.\n\nThe older spelling of POST /v1/iam/providers/update.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Provider].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Provider].id": "Persisted fields",
 		},
 	})
 	zip.Describe("POST /v1/iam/update-role", zip.Doc{
@@ -217,9 +217,9 @@ func init() {
 	zip.Describe("POST /v1/iam/update-user", zip.Doc{
 		Description: "Updates one of your users' profile, roles or credentials. Send a password\nto reset it; leave it out and the current one stands.\n\nThe older spelling of POST /v1/iam/users/update, with the user's fields at\nthe top level rather than wrapped in {user, password}.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Permission].id": "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.Role].id":       "Persisted fields",
-			"Model[github.com/hanzoai/iam/internal/schema.User].id":       "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Permission].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Role].id":       "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.User].id":       "Persisted fields",
 			"Permission.createdTime":                                      "Descriptive metadata.",
 			"Permission.model":                                            "Authorization model, targets, and decision. AuthzModel carries the v1\n`model` column (the named authz model); it is not the Go identifier\n`Model` because that name is taken by the embedded orm.Model[Permission]\nmixin. The HTTP contract is unchanged — json:\"model\".",
 			"Permission.owner":                                            "Identity — the (owner, name) natural key.",

internal/cors/cors.go

@@ -33,7 +33,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // browserPaths are the endpoints a browser-side OIDC client must reach

internal/e2e/journey_test.go

@@ -35,7 +35,7 @@ import (
 
 	"github.com/hanzoai/iam/internal/oidc"
 	"github.com/hanzoai/iam/internal/routes"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 
 	"github.com/hanzoai/iam/internal/testhttp"
 )

internal/featurestore/featurestore.go

@@ -13,7 +13,7 @@ import (
 	"github.com/hanzoai/orm"
 
 	"github.com/hanzoai/iam/feature"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 	"github.com/hanzoai/iam/internal/users"
 	"github.com/hanzoai/iam/pkg/model"

internal/invitations/invitations.go

@@ -16,7 +16,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // Handler binds the invitations operations to one orm store.

internal/invitations/zipdoc_gen.go

@@ -10,13 +10,13 @@ func init() {
 	zip.Describe("GET /v1/iam/invitations", zip.Doc{
 		Description: "Returns your organization's invitations, newest first — who has\nbeen asked to join, on what terms, and how many seats each invitation still\nhas left.\n\nYou see your own organization's invitations and no one else's; which organization that\nis comes from your credentials, not from the request.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Invitation].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Invitation].id": "Persisted fields",
 		},
 	})
 	zip.Describe("POST /v1/iam/invitations", zip.Doc{
 		Description: "Issues an invitation to join your organization — the code or link a new\nmember redeems, with the role they arrive holding and the date it stops\nworking. A name already used in the organization is refused.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Invitation].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Invitation].id": "Persisted fields",
 		},
 	})
 	zip.Describe("POST /v1/iam/invitations/delete", zip.Doc{
@@ -25,13 +25,13 @@ func init() {
 	zip.Describe("POST /v1/iam/invitations/get", zip.Doc{
 		Description: "Returns one invitation: who it is for, what it grants on acceptance, and\nwhen it expires.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Invitation].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Invitation].id": "Persisted fields",
 		},
 	})
 	zip.Describe("POST /v1/iam/invitations/update", zip.Doc{
 		Description: "Changes an invitation's terms — the role it grants, how many may redeem\nit, or when it expires. What it is called does not change.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Invitation].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Invitation].id": "Persisted fields",
 		},
 	})
 }

internal/keys/keys.go

@@ -22,7 +22,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 //go:generate go run github.com/zap-proto/zip/cmd/zipdoc

internal/keys/keys_test.go

@@ -11,7 +11,7 @@ import (
 	"github.com/hanzoai/orm"
 	ormdb "github.com/hanzoai/orm/db"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 func memDB(t *testing.T) orm.DB {

internal/keys/zipdoc_gen.go

@@ -17,7 +17,7 @@ func init() {
 			"Key.owner":       "Owner is the tenant that holds the key; Name is unique within Owner.",
 			"Key.scope":       "Scope is the key's ACCESS CLASS, orthogonal to Type (which names the bound\nprincipal). Empty (the default, \"secret\") is a full key: a pk- publishable\nhalf AND a confidential sk- half, the sk- authenticating a server-side reader.\nKeyScopePublish is a WRITE-ONLY publishable key — a pk- half only, no secret —\nthat resolves to just an ORG (never a principal) at the ingest door and is safe\nto ship in client JS. A missing value on an existing row reads as the default,\nso every pre-Scope key is a secret key unchanged.",
 			"Key.type":        "Type is the scope the key is bound to — \"Organization\", \"Application\",\n\"User\", or \"General\" — and Organization / Application / User name the\nconcrete principal for whichever scope Type selects.",
-			"Model[github.com/hanzoai/iam/internal/schema.Key].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Key].id": "Persisted fields",
 		},
 	})
 	zip.Describe("GET /v1/iam/keys/get", zip.Doc{
@@ -30,7 +30,7 @@ func init() {
 			"Key.owner":       "Owner is the tenant that holds the key; Name is unique within Owner.",
 			"Key.scope":       "Scope is the key's ACCESS CLASS, orthogonal to Type (which names the bound\nprincipal). Empty (the default, \"secret\") is a full key: a pk- publishable\nhalf AND a confidential sk- half, the sk- authenticating a server-side reader.\nKeyScopePublish is a WRITE-ONLY publishable key — a pk- half only, no secret —\nthat resolves to just an ORG (never a principal) at the ingest door and is safe\nto ship in client JS. A missing value on an existing row reads as the default,\nso every pre-Scope key is a secret key unchanged.",
 			"Key.type":        "Type is the scope the key is bound to — \"Organization\", \"Application\",\n\"User\", or \"General\" — and Organization / Application / User name the\nconcrete principal for whichever scope Type selects.",
-			"Model[github.com/hanzoai/iam/internal/schema.Key].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Key].id": "Persisted fields",
 		},
 	})
 	zip.Describe("POST /v1/iam/keys", zip.Doc{
@@ -43,7 +43,7 @@ func init() {
 			"Key.owner":       "Owner is the tenant that holds the key; Name is unique within Owner.",
 			"Key.scope":       "Scope is the key's ACCESS CLASS, orthogonal to Type (which names the bound\nprincipal). Empty (the default, \"secret\") is a full key: a pk- publishable\nhalf AND a confidential sk- half, the sk- authenticating a server-side reader.\nKeyScopePublish is a WRITE-ONLY publishable key — a pk- half only, no secret —\nthat resolves to just an ORG (never a principal) at the ingest door and is safe\nto ship in client JS. A missing value on an existing row reads as the default,\nso every pre-Scope key is a secret key unchanged.",
 			"Key.type":        "Type is the scope the key is bound to — \"Organization\", \"Application\",\n\"User\", or \"General\" — and Organization / Application / User name the\nconcrete principal for whichever scope Type selects.",
-			"Model[github.com/hanzoai/iam/internal/schema.Key].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Key].id": "Persisted fields",
 		},
 	})
 	zip.Describe("POST /v1/iam/keys/delete", zip.Doc{
@@ -59,7 +59,7 @@ func init() {
 			"Key.owner":       "Owner is the tenant that holds the key; Name is unique within Owner.",
 			"Key.scope":       "Scope is the key's ACCESS CLASS, orthogonal to Type (which names the bound\nprincipal). Empty (the default, \"secret\") is a full key: a pk- publishable\nhalf AND a confidential sk- half, the sk- authenticating a server-side reader.\nKeyScopePublish is a WRITE-ONLY publishable key — a pk- half only, no secret —\nthat resolves to just an ORG (never a principal) at the ingest door and is safe\nto ship in client JS. A missing value on an existing row reads as the default,\nso every pre-Scope key is a secret key unchanged.",
 			"Key.type":        "Type is the scope the key is bound to — \"Organization\", \"Application\",\n\"User\", or \"General\" — and Organization / Application / User name the\nconcrete principal for whichever scope Type selects.",
-			"Model[github.com/hanzoai/iam/internal/schema.Key].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Key].id": "Persisted fields",
 		},
 	})
 }

internal/memberships/memberships.go

@@ -24,7 +24,7 @@ import (
 
 	"github.com/hanzoai/iam/internal/authz"
 	"github.com/hanzoai/iam/internal/httpx"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/memberships/memberships_test.go

@@ -32,7 +32,7 @@ import (
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/iam/internal/routes"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 
 	"github.com/hanzoai/iam/internal/testhttp"

internal/mfa/factor/factor.go

@@ -13,7 +13,7 @@ import (
 	"github.com/pquerna/otp/totp"
 	"golang.org/x/crypto/bcrypt"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/mfa/mfa_test.go

@@ -31,7 +31,7 @@ import (
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/iam/internal/routes"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 
 	"github.com/hanzoai/iam/internal/testhttp"

internal/oidc/authorize.go

@@ -9,7 +9,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/certkey.go

@@ -15,7 +15,7 @@ import (
 
 	"github.com/luxfi/crypto/pq/mldsa/mldsa65"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // certkey resolves the PUBLIC half of a signing Cert and encodes it as a JWK.

internal/oidc/challenge.go

@@ -11,7 +11,7 @@ import (
 	fiber "github.com/zap-proto/fiber/v3"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // The login-challenge lifecycle: the ONE primitive for a sign-in that has proven

internal/oidc/challenge_test.go

@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/code.go

@@ -9,7 +9,7 @@ import (
 	"errors"
 	"time"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // Authorization-code lifecycle over the Token entity. A code is a short-lived,

internal/oidc/code_test.go

@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 func testApp() *schema.Application {

internal/oidc/consent.go

@@ -9,7 +9,7 @@ import (
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/iam/internal/httpx"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/device.go

@@ -13,7 +13,7 @@ import (
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/iam/internal/httpx"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/device_test.go

@@ -12,7 +12,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/federation.go

@@ -17,7 +17,7 @@ import (
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/iam/internal/mfa/factor"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 	"github.com/hanzoai/iam/internal/users"
 )

internal/oidc/federation_idp.go

@@ -24,7 +24,7 @@ import (
 
 	"github.com/golang-jwt/jwt/v5"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // The Relying-Party side of federation: iam as an OIDC/OAuth2 CLIENT of an

internal/oidc/federation_test.go

@@ -20,7 +20,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/federation_unlink.go

@@ -9,7 +9,7 @@ import (
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/iam/internal/httpx"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/federation_unlink_test.go

@@ -9,7 +9,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // Unlink self-authenticates (session cookie / bearer) on the public OIDC surface,

internal/oidc/federation_username_test.go

@@ -7,7 +7,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 	"github.com/hanzoai/iam/internal/users"
 )

internal/oidc/frontdoor.go

@@ -9,7 +9,7 @@ import (
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/iam/internal/httpx"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/frontdoor_e2e_test.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/getaccount_test.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // getAccountReq drives GET the account endpoint with an optional bearer,

internal/oidc/harness_test.go

@@ -19,7 +19,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 
 	"github.com/hanzoai/iam/internal/testhttp"
 )

internal/oidc/issuetoken.go

@@ -14,7 +14,7 @@ import (
 
 	"github.com/hanzoai/iam/internal/httpx"
 	"github.com/hanzoai/iam/internal/keys"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/issuetoken_redteam_test.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/hanzoai/orm"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // Red-team helpers + the field-preservation guard for the on-behalf-of primitives.

internal/oidc/issuetoken_test.go

@@ -13,7 +13,7 @@ import (
 
 	"github.com/hanzoai/orm"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 	"github.com/hanzoai/iam/internal/users"
 )

internal/oidc/jwks.go

@@ -11,7 +11,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/jwks_test.go

@@ -12,7 +12,7 @@ import (
 
 	"github.com/hanzoai/orm"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // seedMLDSACert creates an ML-DSA-65 signing cert (raw base64 private key).

internal/oidc/jwt.go

@@ -14,7 +14,7 @@ import (
 
 	"github.com/golang-jwt/jwt/v5"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // JWT token signing. The signing algorithm is a property of the signing Cert's

internal/oidc/jwt_test.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/golang-jwt/jwt/v5"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // testKey is a small (fast) RSA key — fine for tests; production uses the Cert.

internal/oidc/linkedaccounts.go

@@ -10,7 +10,7 @@ import (
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/iam/internal/httpx"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/login.go

@@ -10,7 +10,7 @@ import (
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/iam/internal/httpx"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/internal/sessions"
 	"github.com/hanzoai/iam/pkg/store"
 	"github.com/hanzoai/iam/internal/users"

internal/oidc/login_mfa_test.go

@@ -14,7 +14,7 @@ import (
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/iam/internal/mfa/factor"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // The MFA gate at login, driven through the REAL registered router. The contract is

internal/oidc/login_resolve_test.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/hanzoai/orm"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // USERNAME RESOLUTION PARITY. the legacy surface resolves a login identifier by NAME before

internal/oidc/login_tenant_test.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/hanzoai/orm"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // seedUserInOrg creates a bcrypt-credentialed user in an arbitrary org.

internal/oidc/login_test.go

@@ -11,7 +11,7 @@ import (
 
 	"github.com/hanzoai/orm"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/logout.go

@@ -10,7 +10,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/mfa_gate.go

@@ -12,7 +12,7 @@ import (
 
 	"github.com/hanzoai/iam/internal/httpx"
 	"github.com/hanzoai/iam/internal/mfa/factor"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/mint.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/hanzoai/orm"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/mint_ownerpin_test.go

@@ -6,7 +6,7 @@ import (
 	"net/url"
 	"testing"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // The mint owner-pin, unit-level: mintAllowed / adminMintAllowed require the resolved

internal/oidc/mldsa.go

@@ -11,7 +11,7 @@ import (
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/luxfi/crypto/pq/mldsa/mldsa65"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // ML-DSA-65 (FIPS 204, NIST security level 3) as a first-class JWT signing

internal/oidc/onboard_founder_test.go

@@ -13,7 +13,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/orgs_claim_test.go

@@ -15,7 +15,7 @@ import (
 	"net/url"
 	"testing"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/password_grant_test.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/hanzoai/orm"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // forbidUser flips an already-seeded user to revoked (IsForbidden), keeping its

internal/oidc/password_persist_test.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/hanzoai/orm"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 	"github.com/hanzoai/iam/internal/users"
 )

internal/oidc/preferences.go

@@ -10,7 +10,7 @@ import (
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/iam/internal/httpx"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/provision.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/hanzoai/iam/internal/cred"
 	"github.com/hanzoai/iam/internal/keys"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/provision_endpoint_test.go

@@ -16,7 +16,7 @@ import (
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/iam/internal/routes"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 
 	"github.com/hanzoai/iam/internal/testhttp"
 )

internal/oidc/provision_test.go

@@ -11,7 +11,7 @@ import (
 
 	"github.com/hanzoai/orm"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/refresh.go

@@ -10,7 +10,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/sendverificationcode.go

@@ -15,7 +15,7 @@ import (
 
 	"github.com/hanzoai/iam/internal/cred"
 	"github.com/hanzoai/iam/internal/httpx"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/signing_test.go

@@ -19,7 +19,7 @@ import (
 
 	"github.com/hanzoai/orm"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // NewSignerFromCert picks the algorithm from the key type — RSA→RS256,

internal/oidc/signup.go

@@ -14,7 +14,7 @@ import (
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/iam/internal/httpx"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 	"github.com/hanzoai/iam/internal/users"
 )

internal/oidc/signup_reserved_test.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/hanzoai/orm"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/signup_test.go

@@ -9,7 +9,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 	"github.com/hanzoai/iam/internal/users"
 )

internal/oidc/sub_continuity_test.go

@@ -11,7 +11,7 @@ import (
 
 	"github.com/hanzoai/orm"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // SUB CONTINUITY (cutover parity). A migrated user carries the v1 the legacy surface UUID in

internal/oidc/token.go

@@ -18,7 +18,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 	"github.com/hanzoai/iam/internal/users"
 )

internal/oidc/token_e2e_test.go

@@ -15,7 +15,7 @@ import (
 	"github.com/hanzoai/orm"
 	ormdb "github.com/hanzoai/orm/db"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/token_exchange.go

@@ -8,7 +8,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/token_exchange_test.go

@@ -11,7 +11,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/token_principal_test.go

@@ -11,7 +11,7 @@ import (
 	"github.com/hanzoai/orm"
 	"golang.org/x/crypto/bcrypt"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // seedZ is the account the live bug was reproduced on: username "z", display

internal/oidc/ttl_test.go

@@ -6,7 +6,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // The contract every declared refresh lifetime exists for: with

internal/oidc/user.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/hanzoai/orm"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/user_test.go

@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 	"github.com/hanzoai/iam/internal/users"
 )

internal/oidc/userinfo.go

@@ -7,7 +7,7 @@ import (
 	"github.com/zap-proto/zip"
 
 	"github.com/hanzoai/iam/internal/httpx"
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/oidc/userinfo_test.go

@@ -12,7 +12,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 	"github.com/hanzoai/iam/pkg/store"
 )
 

internal/organizations/organizations.go

@@ -14,7 +14,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 const orgBase = "/v1/iam/organizations"

internal/organizations/zipdoc_gen.go

@@ -10,7 +10,7 @@ func init() {
 	zip.Describe("GET /v1/iam/organizations", zip.Doc{
 		Description: "Returns the organizations you can see, newest first. Narrow it to one\nparent account, and set a limit and offset to page through the rest.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Organization].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Organization].id": "Persisted fields",
 			"Organization.failedSigninLimit":                                "Per-organization signin throttle. Zero means \"inherit the application\ndefault\"; a non-zero value overrides it. Safe bounds are clamped by the\nresource service before persistence.",
 			"Organization.founder":                                          "Founder is the stable storage id of the identity that provisioned this org\n(self-service onboarding). It is the resume token that makes provisioning\nconverge on a backend where each write autocommits independently (no\ntransaction rollback): after a partial failure that created the org but did\nnot move the founder in, a retry recognises the org as the founder's own and\ncompletes it, instead of refusing it as \"already taken\". It also fences the\norg to ONE tenant — a different identity can never complete or join it.",
 			"Organization.orgBalance":                                       "Balance fields are read-only mirrors; authoritative balances live in\nCommerce (billing.hanzo.ai). Carried for field-complete v1 parity.",
@@ -19,7 +19,7 @@ func init() {
 	zip.Describe("GET /v1/iam/organizations/get", zip.Doc{
 		Description: "Returns one organization: its display, its defaults and the sign-in rules\neveryone in it inherits.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Organization].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Organization].id": "Persisted fields",
 			"Organization.failedSigninLimit":                                "Per-organization signin throttle. Zero means \"inherit the application\ndefault\"; a non-zero value overrides it. Safe bounds are clamped by the\nresource service before persistence.",
 			"Organization.founder":                                          "Founder is the stable storage id of the identity that provisioned this org\n(self-service onboarding). It is the resume token that makes provisioning\nconverge on a backend where each write autocommits independently (no\ntransaction rollback): after a partial failure that created the org but did\nnot move the founder in, a retry recognises the org as the founder's own and\ncompletes it, instead of refusing it as \"already taken\". It also fences the\norg to ONE tenant — a different identity can never complete or join it.",
 			"Organization.orgBalance":                                       "Balance fields are read-only mirrors; authoritative balances live in\nCommerce (billing.hanzo.ai). Carried for field-complete v1 parity.",
@@ -28,7 +28,7 @@ func init() {
 	zip.Describe("POST /v1/iam/organizations", zip.Doc{
 		Description: "Makes a new organization — the account your users, applications, roles,\nprojects and workspaces are all named inside. It is the first write in a new\ntenant, and a name already in use is refused rather than taken over.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Organization].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Organization].id": "Persisted fields",
 			"Organization.failedSigninLimit":                                "Per-organization signin throttle. Zero means \"inherit the application\ndefault\"; a non-zero value overrides it. Safe bounds are clamped by the\nresource service before persistence.",
 			"Organization.founder":                                          "Founder is the stable storage id of the identity that provisioned this org\n(self-service onboarding). It is the resume token that makes provisioning\nconverge on a backend where each write autocommits independently (no\ntransaction rollback): after a partial failure that created the org but did\nnot move the founder in, a retry recognises the org as the founder's own and\ncompletes it, instead of refusing it as \"already taken\". It also fences the\norg to ONE tenant — a different identity can never complete or join it.",
 			"Organization.orgBalance":                                       "Balance fields are read-only mirrors; authoritative balances live in\nCommerce (billing.hanzo.ai). Carried for field-complete v1 parity.",
@@ -40,7 +40,7 @@ func init() {
 	zip.Describe("POST /v1/iam/organizations/update", zip.Doc{
 		Description: "Changes an organization's display, its defaults and the sign-in rules\neveryone in it inherits. Which organization it is does not change, and neither\ndoes when it was created.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Organization].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Organization].id": "Persisted fields",
 			"Organization.failedSigninLimit":                                "Per-organization signin throttle. Zero means \"inherit the application\ndefault\"; a non-zero value overrides it. Safe bounds are clamped by the\nresource service before persistence.",
 			"Organization.founder":                                          "Founder is the stable storage id of the identity that provisioned this org\n(self-service onboarding). It is the resume token that makes provisioning\nconverge on a backend where each write autocommits independently (no\ntransaction rollback): after a partial failure that created the org but did\nnot move the founder in, a retry recognises the org as the founder's own and\ncompletes it, instead of refusing it as \"already taken\". It also fences the\norg to ONE tenant — a different identity can never complete or join it.",
 			"Organization.orgBalance":                                       "Balance fields are read-only mirrors; authoritative balances live in\nCommerce (billing.hanzo.ai). Carried for field-complete v1 parity.",

internal/permission/permission.go

@@ -14,7 +14,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // Handlers holds the storage handle shared by every permission handler.

internal/permission/zipdoc_gen.go

@@ -10,7 +10,7 @@ func init() {
 	zip.Describe("GET /v1/iam/permissions", zip.Doc{
 		Description: "Returns the permissions in one organization, newest first — each one a\ngrant saying which people or roles may do what, and to which resources.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Permission].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Permission].id": "Persisted fields",
 			"Permission.createdTime": "Descriptive metadata.",
 			"Permission.model":       "Authorization model, targets, and decision. AuthzModel carries the v1\n`model` column (the named authz model); it is not the Go identifier\n`Model` because that name is taken by the embedded orm.Model[Permission]\nmixin. The HTTP contract is unchanged — json:\"model\".",
 			"Permission.owner":       "Identity — the (owner, name) natural key.",
@@ -21,7 +21,7 @@ func init() {
 	zip.Describe("GET /v1/iam/permissions/get", zip.Doc{
 		Description: "Returns one permission: who it grants to, what it allows, and the\nresources it covers.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Permission].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Permission].id": "Persisted fields",
 			"Permission.createdTime": "Descriptive metadata.",
 			"Permission.model":       "Authorization model, targets, and decision. AuthzModel carries the v1\n`model` column (the named authz model); it is not the Go identifier\n`Model` because that name is taken by the embedded orm.Model[Permission]\nmixin. The HTTP contract is unchanged — json:\"model\".",
 			"Permission.owner":       "Identity — the (owner, name) natural key.",
@@ -32,7 +32,7 @@ func init() {
 	zip.Describe("POST /v1/iam/permissions", zip.Doc{
 		Description: "Grants a permission — the call that gives a person or a role the ability to\ndo something. Adding refuses to overwrite a grant that already exists, so\nwidening an existing one is an update, never an accident.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Permission].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Permission].id": "Persisted fields",
 			"Permission.createdTime": "Descriptive metadata.",
 			"Permission.model":       "Authorization model, targets, and decision. AuthzModel carries the v1\n`model` column (the named authz model); it is not the Go identifier\n`Model` because that name is taken by the embedded orm.Model[Permission]\nmixin. The HTTP contract is unchanged — json:\"model\".",
 			"Permission.owner":       "Identity — the (owner, name) natural key.",
@@ -46,7 +46,7 @@ func init() {
 	zip.Describe("POST /v1/iam/permissions/update", zip.Doc{
 		Description: "Changes who a permission grants to, what it allows, or the resources it\ncovers. Access changes as soon as the write lands. What the permission is\ncalled does not change, and neither does when it was created.",
 		Fields: map[string]string{
-			"Model[github.com/hanzoai/iam/internal/schema.Permission].id": "Persisted fields",
+			"Model[github.com/hanzoai/iam/pkg/schema.Permission].id": "Persisted fields",
 			"Permission.createdTime": "Descriptive metadata.",
 			"Permission.model":       "Authorization model, targets, and decision. AuthzModel carries the v1\n`model` column (the named authz model); it is not the Go identifier\n`Model` because that name is taken by the embedded orm.Model[Permission]\nmixin. The HTTP contract is unchanged — json:\"model\".",
 			"Permission.owner":       "Identity — the (owner, name) natural key.",

internal/projects/projects.go

@@ -18,7 +18,7 @@ import (
 	"github.com/hanzoai/orm"
 	"github.com/zap-proto/zip"
 
-	"github.com/hanzoai/iam/internal/schema"
+	"github.com/hanzoai/iam/pkg/schema"
 )
 
 // Handler binds the projects operations to one orm store.