@robelest/convex-auth 0.0.4-preview.28 → 0.0.4-preview.29

package/dist/component/public/groups/core.js

@@ -107,6 +107,94 @@ const groupGet = query({
 	}
 });
 /**
+* Batched equivalent of {@link groupGet}. Fetches many group documents by ID
+* in a single component round-trip. Returns each group (or `null`) in the
+* same slot as the input ID; duplicates are tolerated but de-duplicated
+* internally so each `ctx.db.get` runs exactly once per distinct ID.
+*
+* Used by app-side aggregate handlers (e.g. `groups:listMyGroups`) that
+* previously fanned out one `groupGet` per item.
+*
+* @param args.groupIds - Array of group document IDs.
+* @returns Array of group documents (or `null` entries) in input order.
+*/
+const groupGetMany = query({
+	args: { groupIds: v.array(v.id("Group")) },
+	returns: v.array(v.union(vGroupDoc, v.null())),
+	handler: async (ctx, { groupIds }) => {
+		if (groupIds.length === 0) return [];
+		const unique = Array.from(new Set(groupIds));
+		const docs = await Promise.all(unique.map((id) => ctx.db.get("Group", id)));
+		const byId = new Map(unique.map((id, i) => [id, docs[i] ?? null]));
+		return groupIds.map((id) => byId.get(id) ?? null);
+	}
+});
+/**
+* Walk up the group hierarchy from `groupId` in a single component
+* round-trip and return every ancestor document. Consolidates what would
+* otherwise be D successive `groupGet` calls (one per level) when the app
+* resolver steps parent-by-parent.
+*
+* Cycle detection walks up only along `parentGroupId` links; if the chain
+* revisits a group, the traversal stops with `cycleDetected: true`. Stops
+* early with `maxDepthReached: true` when the depth limit is hit.
+*
+* @param args.groupId - Starting group id. The top of the walk.
+* @param args.maxDepth - Maximum number of ancestor levels to visit
+*   (default 32). Set to 0 to inspect only the starting group.
+* @param args.includeSelf - When `true`, include the starting group in
+*   the returned `ancestors` array. Default `false`.
+* @returns `{ ancestors, cycleDetected, maxDepthReached }` — ancestors
+*   are ordered from the immediate parent upward (or starting at
+*   `groupId` when `includeSelf` is set).
+*/
+const groupAncestors = query({
+	args: {
+		groupId: v.id("Group"),
+		maxDepth: v.optional(v.number()),
+		includeSelf: v.optional(v.boolean())
+	},
+	returns: v.object({
+		ancestors: v.array(vGroupDoc),
+		cycleDetected: v.boolean(),
+		maxDepthReached: v.boolean()
+	}),
+	handler: async (ctx, { groupId, maxDepth, includeSelf }) => {
+		const limit = Math.max(0, Math.floor(maxDepth ?? 32));
+		const visited = /* @__PURE__ */ new Set();
+		const ancestors = [];
+		let cycleDetected = false;
+		let maxDepthReached = false;
+		let current = groupId;
+		let depth = 0;
+		let first = true;
+		while (current !== void 0) {
+			if (depth > limit) {
+				maxDepthReached = true;
+				break;
+			}
+			if (visited.has(current)) {
+				cycleDetected = true;
+				break;
+			}
+			visited.add(current);
+			const doc = await ctx.db.get("Group", current);
+			if (doc === null) break;
+			if (first) {
+				first = false;
+				if (includeSelf === true) ancestors.push(doc);
+			} else ancestors.push(doc);
+			current = doc.parentGroupId;
+			depth += 1;
+		}
+		return {
+			ancestors,
+			cycleDetected,
+			maxDepthReached
+		};
+	}
+});
+/**
 * List groups with optional filtering, sorting, and pagination.
 *
 * Returns `{ items, nextCursor }`. Empty `where` returns **all** groups.
@@ -317,5 +405,5 @@ const groupDelete = mutation({
 });
 
 //#endregion
-export { groupCreate, groupDelete, groupGet, groupList, groupUpdate };
+export { groupAncestors, groupCreate, groupDelete, groupGet, groupGetMany, groupList, groupUpdate };
 //# sourceMappingURL=core.js.map

package/dist/component/public/groups/members.js

@@ -196,6 +196,44 @@ const memberGetByGroupAndUser = query({
 	}
 });
 /**
+* Batched equivalent of {@link memberGetByGroupAndUser}. Resolves many
+* `(groupId, userId)` pairs for the same user in a single component
+* round-trip. Used by app-side handlers (e.g. `groups:getDashboard`) that
+* need to inspect the current user's membership across every root group
+* they can see.
+*
+* Each `groupId` is resolved using the `group_id_user_id` index; missing
+* memberships come back as `null` in the same slot order as the input.
+*
+* @param args.userId - The user whose memberships to look up.
+* @param args.groupIds - One or more groups to resolve. Order is preserved;
+*   duplicates tolerated (but de-duplicated internally so the DB only sees
+*   each pair once).
+* @returns Array of member documents or `null` entries, in `groupIds` order.
+*
+* @example
+* ```ts
+* const members = await ctx.runQuery(
+*   components.auth.groups.memberGetByGroupAndUserMany,
+*   { userId: viewerId, groupIds: rootGroupIds },
+* );
+* ```
+*/
+const memberGetByGroupAndUserMany = query({
+	args: {
+		userId: v.id("User"),
+		groupIds: v.array(v.id("Group"))
+	},
+	returns: v.array(v.union(vGroupMemberDoc, v.null())),
+	handler: async (ctx, { userId, groupIds }) => {
+		if (groupIds.length === 0) return [];
+		const unique = Array.from(new Set(groupIds));
+		const docs = await Promise.all(unique.map((groupId) => ctx.db.query("GroupMember").withIndex("group_id_user_id", (q) => q.eq("groupId", groupId).eq("userId", userId)).unique()));
+		const byGroupId = new Map(unique.map((id, i) => [id, docs[i] ?? null]));
+		return groupIds.map((id) => byGroupId.get(id) ?? null);
+	}
+});
+/**
 * Resolve a user's membership by walking the group hierarchy from the
 * requested group up to the root. Returns the first matching membership
 * found, enabling inherited (ancestor-level) access checks.
@@ -351,5 +389,5 @@ const memberUpdate = mutation({
 });
 
 //#endregion
-export { memberAdd, memberGet, memberGetByGroupAndUser, memberList, memberRemove, memberResolve, memberUpdate };
+export { memberAdd, memberGet, memberGetByGroupAndUser, memberGetByGroupAndUserMany, memberList, memberRemove, memberResolve, memberUpdate };
 //# sourceMappingURL=members.js.map

package/dist/component/public/identity/accounts.js

@@ -1,6 +1,6 @@
 import { vAccountDoc } from "../../model.js";
 import { mutation, query } from "../../functions.js";
-import { v } from "convex/values";
+import { ConvexError, v } from "convex/values";
 
 //#region src/component/public/identity/accounts.ts
 /**
@@ -187,9 +187,28 @@ const accountPatch = mutation({
 * ```
 */
 const accountDelete = mutation({
-	args: { accountId: v.id("Account") },
+	args: {
+		accountId: v.id("Account"),
+		requireOtherAccount: v.optional(v.boolean())
+	},
 	returns: v.null(),
-	handler: async (ctx, { accountId }) => {
+	handler: async (ctx, { accountId, requireOtherAccount }) => {
+		if (requireOtherAccount === true) {
+			const doc = await ctx.db.get("Account", accountId);
+			if (doc === null) throw new ConvexError({
+				code: "ACCOUNT_NOT_FOUND",
+				message: "Account not found."
+			});
+			let otherFound = false;
+			for await (const sibling of ctx.db.query("Account").withIndex("user_id_provider", (q) => q.eq("userId", doc.userId))) if (sibling._id !== accountId) {
+				otherFound = true;
+				break;
+			}
+			if (!otherFound) throw new ConvexError({
+				code: "INVALID_PARAMETERS",
+				message: "The provided parameters are invalid."
+			});
+		}
 		await ctx.db.delete("Account", accountId);
 		return null;
 	}

package/dist/component/public/identity/users.js

@@ -1,6 +1,6 @@
 import { vPaginated, vUserDoc } from "../../model.js";
 import { mutation, query } from "../../functions.js";
-import { v } from "convex/values";
+import { ConvexError, v } from "convex/values";
 
 //#region src/component/public/identity/users.ts
 /**
@@ -111,6 +111,42 @@ const userGetById = query({
 	}
 });
 /**
+* Fetch many user documents by ID in a single component round-trip.
+*
+* Equivalent to calling {@link userGetById} for each ID in parallel from the
+* app side, but collapses what would be `N` cross-component RPCs into one.
+* Returns the documents in the same order as the input IDs; missing users
+* appear as `null`. Input is de-duplicated internally so passing the same
+* ID twice costs exactly one `ctx.db.get`.
+*
+* Hot paths like `groups:getDashboard` (member summaries) and
+* `issues:projectIssues` (assignee/creator lookups) previously fanned out
+* N `userGetById` calls — this helper is the batched replacement.
+*
+* @param args.userIds - Array of user document IDs (order preserved, duplicates tolerated).
+* @returns Array of user documents or `null` entries, in the same order as `args.userIds`.
+*
+* @example
+* ```ts
+* const users = await ctx.runQuery(
+*   component.identity.users.userGetMany,
+*   { userIds: memberIds },
+* );
+* const byId = new Map(users.filter(u => u !== null).map(u => [u!._id, u!]));
+* ```
+*/
+const userGetMany = query({
+	args: { userIds: v.array(v.id("User")) },
+	returns: v.array(v.union(vUserDoc, v.null())),
+	handler: async (ctx, { userIds }) => {
+		if (userIds.length === 0) return [];
+		const unique = Array.from(new Set(userIds));
+		const docs = await Promise.all(unique.map((id) => ctx.db.get("User", id)));
+		const byId = new Map(unique.map((id, i) => [id, docs[i] ?? null]));
+		return userIds.map((id) => byId.get(id) ?? null);
+	}
+});
+/**
 * Find a user by their verified email address.
 *
 * Queries the `User` table using the `email_verified` index to locate users
@@ -298,14 +334,52 @@ const userPatch = mutation({
 * ```
 */
 const userDelete = mutation({
-	args: { userId: v.id("User") },
+	args: {
+		userId: v.id("User"),
+		cascade: v.optional(v.boolean())
+	},
 	returns: v.null(),
-	handler: async (ctx, { userId }) => {
-		if (await ctx.db.get("User", userId) !== null) await ctx.db.delete("User", userId);
+	handler: async (ctx, { userId, cascade }) => {
+		if (await ctx.db.get("User", userId) === null) return null;
+		if (cascade !== true) {
+			const [session, account, key, member, passkey, totp] = await Promise.all([
+				ctx.db.query("Session").withIndex("user_id", (q) => q.eq("userId", userId)).first(),
+				ctx.db.query("Account").withIndex("user_id_provider", (q) => q.eq("userId", userId)).first(),
+				ctx.db.query("ApiKey").withIndex("user_id", (q) => q.eq("userId", userId)).first(),
+				ctx.db.query("GroupMember").withIndex("user_id", (q) => q.eq("userId", userId)).first(),
+				ctx.db.query("Passkey").withIndex("user_id", (q) => q.eq("userId", userId)).first(),
+				ctx.db.query("TotpFactor").withIndex("user_id", (q) => q.eq("userId", userId)).first()
+			]);
+			if (session !== null || account !== null || key !== null || member !== null || passkey !== null || totp !== null) throw new ConvexError({
+				code: "INVALID_PARAMETERS",
+				message: "The provided parameters are invalid."
+			});
+		}
+		if (cascade === true) {
+			const [sessions, accounts, keys, members, passkeys, totps] = await Promise.all([
+				ctx.db.query("Session").withIndex("user_id", (q) => q.eq("userId", userId)).collect(),
+				ctx.db.query("Account").withIndex("user_id_provider", (q) => q.eq("userId", userId)).collect(),
+				ctx.db.query("ApiKey").withIndex("user_id", (q) => q.eq("userId", userId)).collect(),
+				ctx.db.query("GroupMember").withIndex("user_id", (q) => q.eq("userId", userId)).collect(),
+				ctx.db.query("Passkey").withIndex("user_id", (q) => q.eq("userId", userId)).collect(),
+				ctx.db.query("TotpFactor").withIndex("user_id", (q) => q.eq("userId", userId)).collect()
+			]);
+			const refreshTokens = sessions.length > 0 ? (await Promise.all(sessions.map((s) => ctx.db.query("RefreshToken").withIndex("session_id", (q) => q.eq("sessionId", s._id)).collect()))).flat() : [];
+			await Promise.all([
+				...sessions.map((s) => ctx.db.delete("Session", s._id)),
+				...refreshTokens.map((r) => ctx.db.delete("RefreshToken", r._id)),
+				...accounts.map((a) => ctx.db.delete("Account", a._id)),
+				...keys.map((k) => ctx.db.delete("ApiKey", k._id)),
+				...members.map((m) => ctx.db.delete("GroupMember", m._id)),
+				...passkeys.map((p) => ctx.db.delete("Passkey", p._id)),
+				...totps.map((t) => ctx.db.delete("TotpFactor", t._id))
+			]);
+		}
+		await ctx.db.delete("User", userId);
 		return null;
 	}
 });
 
 //#endregion
-export { userDelete, userFindByVerifiedEmail, userFindByVerifiedPhone, userGetById, userInsert, userList, userPatch, userUpsert };
+export { userDelete, userFindByVerifiedEmail, userFindByVerifiedPhone, userGetById, userGetMany, userInsert, userList, userPatch, userUpsert };
 //# sourceMappingURL=users.js.map

package/dist/component/public/sso/audit.js

@@ -1,6 +1,6 @@
 import { vAuditActorType, vAuditStatus, vGroupAuditEventDoc } from "../../model.js";
 import { mutation, query } from "../../functions.js";
-import { v } from "convex/values";
+import { ConvexError, v } from "convex/values";
 
 //#region src/component/public/sso/audit.ts
 /**
@@ -99,7 +99,10 @@ const groupAuditEventList = query({
 		const limit = Math.min(Math.max(args.limit ?? 50, 1), 100);
 		if (args.connectionId !== void 0) return await ctx.db.query("GroupAuditEvent").withIndex("group_connection_id_occurred_at", (idx) => idx.eq("connectionId", args.connectionId)).order("desc").take(limit);
 		if (args.groupId !== void 0) return await ctx.db.query("GroupAuditEvent").withIndex("group_id_occurred_at", (idx) => idx.eq("groupId", args.groupId)).order("desc").take(limit);
-		return await ctx.db.query("GroupAuditEvent").order("desc").take(limit);
+		throw new ConvexError({
+			code: "INVALID_PARAMETERS",
+			message: "groupAuditEventList requires either `connectionId` or `groupId` to scope the query. Passing neither would walk the entire audit log."
+		});
 	}
 });
 

package/dist/component/public/sso/core.js

@@ -168,12 +168,12 @@ const groupConnectionList = query({
 		const limit = Math.min(Math.max(args.limit ?? 50, 1), 100);
 		const order = args.order ?? "desc";
 		let q;
-		if (where.groupId !== void 0) q = ctx.db.query("GroupConnection").withIndex("group_id", (idx) => idx.eq("groupId", where.groupId));
+		if (where.groupId !== void 0 && where.status !== void 0) q = ctx.db.query("GroupConnection").withIndex("group_id_status", (idx) => idx.eq("groupId", where.groupId).eq("status", where.status));
+		else if (where.groupId !== void 0 && where.slug !== void 0) q = ctx.db.query("GroupConnection").withIndex("group_id_slug", (idx) => idx.eq("groupId", where.groupId).eq("slug", where.slug));
+		else if (where.groupId !== void 0) q = ctx.db.query("GroupConnection").withIndex("group_id", (idx) => idx.eq("groupId", where.groupId));
 		else if (where.slug !== void 0) q = ctx.db.query("GroupConnection").withIndex("slug", (idx) => idx.eq("slug", where.slug));
 		else if (where.status !== void 0) q = ctx.db.query("GroupConnection").withIndex("status", (idx) => idx.eq("status", where.status));
 		else q = ctx.db.query("GroupConnection");
-		if (where.groupId !== void 0 && where.slug !== void 0) q = q.filter((f) => f.eq(f.field("slug"), where.slug));
-		if (where.status !== void 0 && where.groupId === void 0) {} else if (where.status !== void 0) q = q.filter((f) => f.eq(f.field("status"), where.status));
 		q = q.order(order);
 		const all = await q.collect();
 		let startIdx = 0;

package/dist/component/public/sso/domains.js

@@ -83,10 +83,14 @@ const groupConnectionDomainAdd = mutation({
 * ```
 */
 const groupConnectionDomainList = query({
-	args: { connectionId: v.id("GroupConnection") },
+	args: {
+		connectionId: v.id("GroupConnection"),
+		limit: v.optional(v.number())
+	},
 	returns: v.array(vGroupConnectionDomainDoc),
-	handler: async (ctx, { connectionId }) => {
-		return await ctx.db.query("GroupConnectionDomain").withIndex("connection_id", (idx) => idx.eq("connectionId", connectionId)).collect();
+	handler: async (ctx, { connectionId, limit }) => {
+		const bounded = Math.min(Math.max(limit ?? 100, 1), 500);
+		return await ctx.db.query("GroupConnectionDomain").withIndex("connection_id", (idx) => idx.eq("connectionId", connectionId)).take(bounded);
 	}
 });
 /**

package/dist/component/public/sso/scim.js

@@ -201,6 +201,41 @@ const groupConnectionScimIdentityGetByGroupConnectionAndUser = query({
 	}
 });
 /**
+* Batched variant of
+* {@link groupConnectionScimIdentityGetByGroupConnectionAndUser}. Resolves
+* SCIM identities for many users under the same connection in a single
+* component round-trip.
+*
+* Used by large SCIM syncs that previously walked the user list one at a
+* time — a 1000-user import was 1000 lookups. With this helper it's one.
+*
+* @param args.connectionId - The ID of the connection to scope to.
+* @param args.userIds - One or more user ids to look up. Duplicates are
+*   tolerated.
+* @returns Array of `{ userId, identity }` pairs in the input order; when
+*   a user has no SCIM identity under this connection, `identity` is `null`.
+*/
+const groupConnectionScimIdentityGetByGroupConnectionAndUsers = query({
+	args: {
+		connectionId: v.id("GroupConnection"),
+		userIds: v.array(v.id("User"))
+	},
+	returns: v.array(v.object({
+		userId: v.id("User"),
+		identity: v.union(vGroupConnectionScimIdentityDoc, v.null())
+	})),
+	handler: async (ctx, { connectionId, userIds }) => {
+		if (userIds.length === 0) return [];
+		const unique = Array.from(new Set(userIds));
+		const docs = await Promise.all(unique.map((userId) => ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_user_id", (idx) => idx.eq("connectionId", connectionId).eq("userId", userId)).first()));
+		const byUserId = new Map(unique.map((id, i) => [id, docs[i] ?? null]));
+		return userIds.map((userId) => ({
+			userId,
+			identity: byUserId.get(userId) ?? null
+		}));
+	}
+});
+/**
 * Retrieve the SCIM identity that is mapped to a specific group.
 *
 * Looks up a SCIM identity by its `mappedGroupId` field. This is used when
@@ -340,5 +375,5 @@ const groupConnectionScimIdentityDelete = mutation({
 });
 
 //#endregion
-export { groupConnectionScimConfigGetByGroupConnection, groupConnectionScimConfigGetByTokenHash, groupConnectionScimConfigUpsert, groupConnectionScimIdentityDelete, groupConnectionScimIdentityGet, groupConnectionScimIdentityGetByGroupConnectionAndUser, groupConnectionScimIdentityGetByMappedGroup, groupConnectionScimIdentityGetByUser, groupConnectionScimIdentityListByGroupConnection, groupConnectionScimIdentityUpsert };
+export { groupConnectionScimConfigGetByGroupConnection, groupConnectionScimConfigGetByTokenHash, groupConnectionScimConfigUpsert, groupConnectionScimIdentityDelete, groupConnectionScimIdentityGet, groupConnectionScimIdentityGetByGroupConnectionAndUser, groupConnectionScimIdentityGetByGroupConnectionAndUsers, groupConnectionScimIdentityGetByMappedGroup, groupConnectionScimIdentityGetByUser, groupConnectionScimIdentityListByGroupConnection, groupConnectionScimIdentityUpsert };
 //# sourceMappingURL=scim.js.map

package/dist/component/public.js

@@ -3,20 +3,20 @@ import { deviceAuthorize, deviceDelete, deviceGetByCodeHash, deviceGetByUserCode
 import { groupAuditEventCreate, groupAuditEventList } from "./public/sso/audit.js";
 import { groupConnectionCreate, groupConnectionDelete, groupConnectionGet, groupConnectionGetByDomain, groupConnectionList, groupConnectionUpdate } from "./public/sso/core.js";
 import { groupConnectionDomainAdd, groupConnectionDomainDelete, groupConnectionDomainList, groupConnectionDomainVerificationDelete, groupConnectionDomainVerificationGet, groupConnectionDomainVerificationUpsert, groupConnectionDomainVerify } from "./public/sso/domains.js";
-import { groupConnectionScimConfigGetByGroupConnection, groupConnectionScimConfigGetByTokenHash, groupConnectionScimConfigUpsert, groupConnectionScimIdentityDelete, groupConnectionScimIdentityGet, groupConnectionScimIdentityGetByGroupConnectionAndUser, groupConnectionScimIdentityGetByMappedGroup, groupConnectionScimIdentityGetByUser, groupConnectionScimIdentityListByGroupConnection, groupConnectionScimIdentityUpsert } from "./public/sso/scim.js";
+import { groupConnectionScimConfigGetByGroupConnection, groupConnectionScimConfigGetByTokenHash, groupConnectionScimConfigUpsert, groupConnectionScimIdentityDelete, groupConnectionScimIdentityGet, groupConnectionScimIdentityGetByGroupConnectionAndUser, groupConnectionScimIdentityGetByGroupConnectionAndUsers, groupConnectionScimIdentityGetByMappedGroup, groupConnectionScimIdentityGetByUser, groupConnectionScimIdentityListByGroupConnection, groupConnectionScimIdentityUpsert } from "./public/sso/scim.js";
 import { groupConnectionSecretDelete, groupConnectionSecretGet, groupConnectionSecretUpsert } from "./public/sso/secrets.js";
 import { groupWebhookDeliveryEnqueue, groupWebhookDeliveryList, groupWebhookDeliveryListReady, groupWebhookDeliveryPatch, groupWebhookEndpointCreate, groupWebhookEndpointGet, groupWebhookEndpointList, groupWebhookEndpointUpdate } from "./public/sso/webhooks.js";
-import { groupCreate, groupDelete, groupGet, groupList, groupUpdate } from "./public/groups/core.js";
+import { groupAncestors, groupCreate, groupDelete, groupGet, groupGetMany, groupList, groupUpdate } from "./public/groups/core.js";
 import { inviteAccept, inviteAcceptByToken, inviteCreate, inviteGet, inviteGetByTokenHash, inviteList, inviteRevoke } from "./public/groups/invites.js";
-import { memberAdd, memberGet, memberGetByGroupAndUser, memberList, memberRemove, memberResolve, memberUpdate } from "./public/groups/members.js";
+import { memberAdd, memberGet, memberGetByGroupAndUser, memberGetByGroupAndUserMany, memberList, memberRemove, memberResolve, memberUpdate } from "./public/groups/members.js";
 import { keyDelete, keyGetByHashedKey, keyGetById, keyInsert, keyList, keyPatch } from "./public/security/keys.js";
 import { passkeyDelete, passkeyGetByCredentialId, passkeyInsert, passkeyListByUserId, passkeyUpdateCounter, passkeyUpdateMeta } from "./public/factors/passkeys.js";
 import { rateLimitCreate, rateLimitDelete, rateLimitGet, rateLimitPatch } from "./public/security/limits.js";
 import { refreshTokenCreate, refreshTokenDeleteAll, refreshTokenExchange, refreshTokenGetActive, refreshTokenGetById, refreshTokenGetChildren, refreshTokenListBySession, refreshTokenPatch } from "./public/identity/tokens.js";
 import { sessionCreate, sessionDelete, sessionGetById, sessionIssue, sessionList, sessionListByUser } from "./public/identity/sessions.js";
 import { totpDelete, totpGetById, totpGetVerifiedByUserId, totpInsert, totpListByUserId, totpMarkVerified, totpUpdateLastUsed } from "./public/factors/totp.js";
-import { userDelete, userFindByVerifiedEmail, userFindByVerifiedPhone, userGetById, userInsert, userList, userPatch, userUpsert } from "./public/identity/users.js";
+import { userDelete, userFindByVerifiedEmail, userFindByVerifiedPhone, userGetById, userGetMany, userInsert, userList, userPatch, userUpsert } from "./public/identity/users.js";
 import { verificationCodeCreate, verificationCodeDelete, verificationCodeGetByAccountId, verificationCodeGetByCode } from "./public/identity/codes.js";
 import { verifierCreate, verifierDelete, verifierGetById, verifierGetBySignature, verifierPatch } from "./public/identity/verifiers.js";
 
-export { accountDelete, accountGet, accountGetById, accountInsert, accountListByUser, accountPatch, deviceAuthorize, deviceDelete, deviceGetByCodeHash, deviceGetByUserCode, deviceInsert, deviceUpdateLastPolled, groupAuditEventCreate, groupAuditEventList, groupConnectionCreate, groupConnectionDelete, groupConnectionDomainAdd, groupConnectionDomainDelete, groupConnectionDomainList, groupConnectionDomainVerificationDelete, groupConnectionDomainVerificationGet, groupConnectionDomainVerificationUpsert, groupConnectionDomainVerify, groupConnectionGet, groupConnectionGetByDomain, groupConnectionList, groupConnectionScimConfigGetByGroupConnection, groupConnectionScimConfigGetByTokenHash, groupConnectionScimConfigUpsert, groupConnectionScimIdentityDelete, groupConnectionScimIdentityGet, groupConnectionScimIdentityGetByGroupConnectionAndUser, groupConnectionScimIdentityGetByMappedGroup, groupConnectionScimIdentityGetByUser, groupConnectionScimIdentityListByGroupConnection, groupConnectionScimIdentityUpsert, groupConnectionSecretDelete, groupConnectionSecretGet, groupConnectionSecretUpsert, groupConnectionUpdate, groupCreate, groupDelete, groupGet, groupList, groupUpdate, groupWebhookDeliveryEnqueue, groupWebhookDeliveryList, groupWebhookDeliveryListReady, groupWebhookDeliveryPatch, groupWebhookEndpointCreate, groupWebhookEndpointGet, groupWebhookEndpointList, groupWebhookEndpointUpdate, inviteAccept, inviteAcceptByToken, inviteCreate, inviteGet, inviteGetByTokenHash, inviteList, inviteRevoke, keyDelete, keyGetByHashedKey, keyGetById, keyInsert, keyList, keyPatch, memberAdd, memberGet, memberGetByGroupAndUser, memberList, memberRemove, memberResolve, memberUpdate, passkeyDelete, passkeyGetByCredentialId, passkeyInsert, passkeyListByUserId, passkeyUpdateCounter, passkeyUpdateMeta, rateLimitCreate, rateLimitDelete, rateLimitGet, rateLimitPatch, refreshTokenCreate, refreshTokenDeleteAll, refreshTokenExchange, refreshTokenGetActive, refreshTokenGetById, refreshTokenGetChildren, refreshTokenListBySession, refreshTokenPatch, sessionCreate, sessionDelete, sessionGetById, sessionIssue, sessionList, sessionListByUser, totpDelete, totpGetById, totpGetVerifiedByUserId, totpInsert, totpListByUserId, totpMarkVerified, totpUpdateLastUsed, userDelete, userFindByVerifiedEmail, userFindByVerifiedPhone, userGetById, userInsert, userList, userPatch, userUpsert, verificationCodeCreate, verificationCodeDelete, verificationCodeGetByAccountId, verificationCodeGetByCode, verifierCreate, verifierDelete, verifierGetById, verifierGetBySignature, verifierPatch };
+export { accountDelete, accountGet, accountGetById, accountInsert, accountListByUser, accountPatch, deviceAuthorize, deviceDelete, deviceGetByCodeHash, deviceGetByUserCode, deviceInsert, deviceUpdateLastPolled, groupAncestors, groupAuditEventCreate, groupAuditEventList, groupConnectionCreate, groupConnectionDelete, groupConnectionDomainAdd, groupConnectionDomainDelete, groupConnectionDomainList, groupConnectionDomainVerificationDelete, groupConnectionDomainVerificationGet, groupConnectionDomainVerificationUpsert, groupConnectionDomainVerify, groupConnectionGet, groupConnectionGetByDomain, groupConnectionList, groupConnectionScimConfigGetByGroupConnection, groupConnectionScimConfigGetByTokenHash, groupConnectionScimConfigUpsert, groupConnectionScimIdentityDelete, groupConnectionScimIdentityGet, groupConnectionScimIdentityGetByGroupConnectionAndUser, groupConnectionScimIdentityGetByGroupConnectionAndUsers, groupConnectionScimIdentityGetByMappedGroup, groupConnectionScimIdentityGetByUser, groupConnectionScimIdentityListByGroupConnection, groupConnectionScimIdentityUpsert, groupConnectionSecretDelete, groupConnectionSecretGet, groupConnectionSecretUpsert, groupConnectionUpdate, groupCreate, groupDelete, groupGet, groupGetMany, groupList, groupUpdate, groupWebhookDeliveryEnqueue, groupWebhookDeliveryList, groupWebhookDeliveryListReady, groupWebhookDeliveryPatch, groupWebhookEndpointCreate, groupWebhookEndpointGet, groupWebhookEndpointList, groupWebhookEndpointUpdate, inviteAccept, inviteAcceptByToken, inviteCreate, inviteGet, inviteGetByTokenHash, inviteList, inviteRevoke, keyDelete, keyGetByHashedKey, keyGetById, keyInsert, keyList, keyPatch, memberAdd, memberGet, memberGetByGroupAndUser, memberGetByGroupAndUserMany, memberList, memberRemove, memberResolve, memberUpdate, passkeyDelete, passkeyGetByCredentialId, passkeyInsert, passkeyListByUserId, passkeyUpdateCounter, passkeyUpdateMeta, rateLimitCreate, rateLimitDelete, rateLimitGet, rateLimitPatch, refreshTokenCreate, refreshTokenDeleteAll, refreshTokenExchange, refreshTokenGetActive, refreshTokenGetById, refreshTokenGetChildren, refreshTokenListBySession, refreshTokenPatch, sessionCreate, sessionDelete, sessionGetById, sessionIssue, sessionList, sessionListByUser, totpDelete, totpGetById, totpGetVerifiedByUserId, totpInsert, totpListByUserId, totpMarkVerified, totpUpdateLastUsed, userDelete, userFindByVerifiedEmail, userFindByVerifiedPhone, userGetById, userGetMany, userInsert, userList, userPatch, userUpsert, verificationCodeCreate, verificationCodeDelete, verificationCodeGetByAccountId, verificationCodeGetByCode, verifierCreate, verifierDelete, verifierGetById, verifierGetBySignature, verifierPatch };