@robelest/convex-auth 0.0.4-preview.32 → 0.0.4-preview.34

package/dist/server/sso/webhook.js

@@ -8,7 +8,7 @@ function createGroupWebhookDomain(deps) {
 	return {
 		endpoint: {
 			get: async (ctx, endpointId) => {
-				return await getWebhookEndpoint(ctx, config.component.public, endpointId);
+				return await getWebhookEndpoint(ctx, config.component.sso, endpointId);
 			},
 			create: async (ctx, data) => {
 				const connection = await loadConnectionOrThrow(ctx, data.connectionId);
@@ -17,7 +17,7 @@ function createGroupWebhookDomain(deps) {
 					message: "Connection not found."
 				});
 				const secretHash = await sha256(data.secret);
-				const endpointId = await createWebhookEndpoint(ctx, config.component.public, {
+				const endpointId = await createWebhookEndpoint(ctx, config.component.sso, {
 					connectionId: connection._id,
 					groupId: connection.groupId,
 					url: data.url,
@@ -38,10 +38,10 @@ function createGroupWebhookDomain(deps) {
 				return { endpointId };
 			},
 			list: async (ctx, connectionId) => {
-				return await listWebhookEndpoints(ctx, config.component.public, connectionId);
+				return await listWebhookEndpoints(ctx, config.component.sso, connectionId);
 			},
 			disable: async (ctx, endpointId) => {
-				await updateWebhookEndpoint(ctx, config.component.public, {
+				await updateWebhookEndpoint(ctx, config.component.sso, {
 					endpointId,
 					data: { status: "disabled" }
 				});
@@ -53,16 +53,16 @@ function createGroupWebhookDomain(deps) {
 		},
 		delivery: {
 			list: async (ctx, data) => {
-				return await listWebhookDeliveries(ctx, config.component.public, data);
+				return await listWebhookDeliveries(ctx, config.component.sso, data);
 			},
 			listReady: async (ctx, limit) => {
-				return await listReadyWebhookDeliveries(ctx, config.component.public, {
+				return await listReadyWebhookDeliveries(ctx, config.component.sso, {
 					now: Date.now(),
 					limit
 				});
 			},
 			markDelivered: async (ctx, deliveryId, responseStatus) => {
-				await patchWebhookDelivery(ctx, config.component.public, {
+				await patchWebhookDelivery(ctx, config.component.sso, {
 					deliveryId,
 					data: {
 						status: "delivered",
@@ -73,7 +73,7 @@ function createGroupWebhookDomain(deps) {
 				});
 			},
 			markFailed: async (ctx, deliveryId, data) => {
-				await patchWebhookDelivery(ctx, config.component.public, {
+				await patchWebhookDelivery(ctx, config.component.sso, {
 					deliveryId,
 					data: {
 						status: data.retryAt ? "pending" : "failed",

package/dist/server/types.d.ts

@@ -407,10 +407,15 @@ interface SSOProviderConfig {
 /**
  * Account linking strategy for group SSO sign-in.
  *
- * - `"verifiedEmail"` — link accounts when the IdP-provided email matches a verified email on an existing user.
+ * - `"sameConnection"` (default) — only link to a user already associated
+ *   with **this** connection (via its account/externalId). Never link across
+ *   IdPs by email. This prevents cross-IdP/tenant account takeover.
+ * - `"verifiedEmail"` — link accounts when the IdP-provided email matches a
+ *   verified email on an existing user. Opt-in; only safe when every
+ *   connection that can assert this email is mutually trusted.
  * - `"none"` — never auto-link; always create a new account.
  */
-type GroupConnectionAccountLinkingPolicy = "verifiedEmail" | "none";
+type GroupConnectionAccountLinkingPolicy = "verifiedEmail" | "none" | "sameConnection";
 /**
  * Policy for reusing existing users during SCIM provisioning.
  *
@@ -743,10 +748,21 @@ interface TotpProviderConfig {
  *
  * `id` is the provider-specific account identifier (e.g. GitHub user ID).
  */
+interface ProfileEmail {
+  email: string;
+  primary?: boolean;
+  verified?: boolean;
+}
 interface OAuthProfile {
   id: string;
   name?: string;
   email?: string;
+  /**
+   * All emails the provider reported (e.g. GitHub `/user/emails`). When
+   * present, every entry is recorded; `email` remains the primary for
+   * back-compat. Single-email providers omit this.
+   */
+  emails?: ProfileEmail[];
   image?: string;
   /** Additional claims from the ID token or userinfo endpoint. */
   [key: string]: unknown;
@@ -914,8 +930,7 @@ type AuthServerHelpers = {
   totp: {
     /**
      * Delete a TOTP factor by ID and fire the `totpRemoved` lifecycle
-     * event. If this was the user's last verified factor, the
-     * `User.hasTotp` flag is cleared as part of the same mutation.
+     * event.
      */
     delete: (ctx: GenericActionCtx<GenericDataModel>, args: AuthDeleteTotpArgs) => Promise<{
       totpId: GenericId<"TotpFactor">;
@@ -1013,7 +1028,7 @@ interface OAuthMaterializedConfig {
    * Account-linking policy for OAuth identities. Defaults to verified email linking.
    * @readonly
    */
-  readonly accountLinking?: "verifiedEmail" | "none";
+  readonly accountLinking?: "verifiedEmail" | "none" | "sameConnection";
 }
 /**
  * Device authorization provider config (RFC 8628).
@@ -1142,124 +1157,170 @@ interface CorsConfig {
  * Component function references required by core auth runtime.
  */
 type AuthComponentApi = {
-  public: {
-    userGetById: FunctionReference<"query", "internal">;
-    userList: FunctionReference<"query", "internal">;
-    userFindByVerifiedEmail: FunctionReference<"query", "internal">;
-    userFindByVerifiedPhone: FunctionReference<"query", "internal">;
-    userInsert: FunctionReference<"mutation", "internal">;
-    userUpsert: FunctionReference<"mutation", "internal">;
-    userPatch: FunctionReference<"mutation", "internal">;
-    userDelete: FunctionReference<"mutation", "internal">;
-    accountGet: FunctionReference<"query", "internal">;
-    accountGetById: FunctionReference<"query", "internal">;
-    accountInsert: FunctionReference<"mutation", "internal">;
-    accountListByUser: FunctionReference<"query", "internal">;
-    accountPatch: FunctionReference<"mutation", "internal">;
-    accountDelete: FunctionReference<"mutation", "internal">;
-    sessionCreate: FunctionReference<"mutation", "internal">;
-    sessionGetById: FunctionReference<"query", "internal">;
-    sessionDelete: FunctionReference<"mutation", "internal">;
-    sessionListByUser: FunctionReference<"query", "internal">;
-    verifierCreate: FunctionReference<"mutation", "internal">;
-    verifierGetById: FunctionReference<"query", "internal">;
-    verifierGetBySignature: FunctionReference<"query", "internal">;
-    verifierPatch: FunctionReference<"mutation", "internal">;
-    verifierDelete: FunctionReference<"mutation", "internal">;
-    verificationCodeGetByAccountId: FunctionReference<"query", "internal">;
-    verificationCodeGetByCode: FunctionReference<"query", "internal">;
-    verificationCodeCreate: FunctionReference<"mutation", "internal">;
-    verificationCodeDelete: FunctionReference<"mutation", "internal">;
-    refreshTokenCreate: FunctionReference<"mutation", "internal">;
-    refreshTokenGetById: FunctionReference<"query", "internal">;
-    refreshTokenPatch: FunctionReference<"mutation", "internal">;
-    refreshTokenGetChildren: FunctionReference<"query", "internal">;
-    refreshTokenListBySession: FunctionReference<"query", "internal">;
-    refreshTokenDeleteAll: FunctionReference<"mutation", "internal">;
-    refreshTokenGetActive: FunctionReference<"query", "internal">;
-    rateLimitGet: FunctionReference<"query", "internal">;
-    rateLimitCreate: FunctionReference<"mutation", "internal">;
-    rateLimitPatch: FunctionReference<"mutation", "internal">;
-    rateLimitDelete: FunctionReference<"mutation", "internal">;
-    groupCreate: FunctionReference<"mutation", "internal">;
-    groupGet: FunctionReference<"query", "internal">;
-    groupList: FunctionReference<"query", "internal">;
-    groupUpdate: FunctionReference<"mutation", "internal">;
-    groupDelete: FunctionReference<"mutation", "internal">;
-    memberAdd: FunctionReference<"mutation", "internal">;
-    memberGet: FunctionReference<"query", "internal">;
-    memberList: FunctionReference<"query", "internal">;
-    memberGetByGroupAndUser: FunctionReference<"query", "internal">;
-    memberRemove: FunctionReference<"mutation", "internal">;
-    memberUpdate: FunctionReference<"mutation", "internal">;
-    inviteCreate: FunctionReference<"mutation", "internal">;
-    inviteGet: FunctionReference<"query", "internal">;
-    inviteGetByTokenHash: FunctionReference<"query", "internal">;
-    inviteList: FunctionReference<"query", "internal">;
-    inviteAccept: FunctionReference<"mutation", "internal">;
-    inviteAcceptByToken: FunctionReference<"mutation", "internal">;
-    inviteRevoke: FunctionReference<"mutation", "internal">;
-    keyInsert: FunctionReference<"mutation", "internal">;
-    keyGetByHashedKey: FunctionReference<"query", "internal">;
-    keyGetById: FunctionReference<"query", "internal">;
-    keyList: FunctionReference<"query", "internal">;
-    keyPatch: FunctionReference<"mutation", "internal">;
-    keyDelete: FunctionReference<"mutation", "internal">;
-    passkeyInsert: FunctionReference<"mutation", "internal">;
-    passkeyGetById: FunctionReference<"query", "internal">;
-    passkeyGetByCredentialId: FunctionReference<"query", "internal">;
-    passkeyListByUserId: FunctionReference<"query", "internal">;
-    passkeyUpdateCounter: FunctionReference<"mutation", "internal">;
-    passkeyUpdateMeta: FunctionReference<"mutation", "internal">;
-    passkeyDelete: FunctionReference<"mutation", "internal">;
-    totpInsert: FunctionReference<"mutation", "internal", any, any>;
-    totpGetVerifiedByUserId: FunctionReference<"query", "internal", any, any>;
-    totpListByUserId: FunctionReference<"query", "internal", any, any>;
-    totpGetById: FunctionReference<"query", "internal", any, any>;
-    totpMarkVerified: FunctionReference<"mutation", "internal", any, any>;
-    totpUpdateLastUsed: FunctionReference<"mutation", "internal", any, any>;
-    totpDelete: FunctionReference<"mutation", "internal", any, any>;
-    deviceInsert: FunctionReference<"mutation", "internal", any, any>;
-    deviceGetByCodeHash: FunctionReference<"query", "internal", any, any>;
-    deviceGetByUserCode: FunctionReference<"query", "internal", any, any>;
-    deviceAuthorize: FunctionReference<"mutation", "internal", any, any>;
-    deviceUpdateLastPolled: FunctionReference<"mutation", "internal", any, any>;
-    deviceDelete: FunctionReference<"mutation", "internal", any, any>;
-    groupConnectionCreate: FunctionReference<"mutation", "internal", any, any>;
-    groupConnectionGet: FunctionReference<"query", "internal", any, any>;
-    groupConnectionGetByDomain: FunctionReference<"query", "internal", any, any>;
-    groupConnectionList: FunctionReference<"query", "internal", any, any>;
-    groupConnectionUpdate: FunctionReference<"mutation", "internal", any, any>;
-    groupConnectionDelete: FunctionReference<"mutation", "internal", any, any>;
-    groupConnectionDomainAdd: FunctionReference<"mutation", "internal", any, any>;
-    groupConnectionDomainList: FunctionReference<"query", "internal", any, any>;
-    groupConnectionDomainDelete: FunctionReference<"mutation", "internal", any, any>;
-    groupConnectionDomainVerificationGet: FunctionReference<"query", "internal", any, any>;
-    groupConnectionDomainVerificationUpsert: FunctionReference<"mutation", "internal", any, any>;
-    groupConnectionDomainVerificationDelete: FunctionReference<"mutation", "internal", any, any>;
-    groupConnectionDomainVerify: FunctionReference<"mutation", "internal", any, any>;
-    groupConnectionSecretUpsert: FunctionReference<"mutation", "internal", any, any>;
-    groupConnectionSecretGet: FunctionReference<"query", "internal", any, any>;
-    groupConnectionSecretDelete: FunctionReference<"mutation", "internal", any, any>;
-    groupConnectionScimConfigUpsert: FunctionReference<"mutation", "internal", any, any>;
-    groupConnectionScimConfigGetByGroupConnection: FunctionReference<"query", "internal", any, any>;
-    groupConnectionScimConfigGetByTokenHash: FunctionReference<"query", "internal", any, any>;
-    groupConnectionScimIdentityGet: FunctionReference<"query", "internal", any, any>;
-    groupConnectionScimIdentityGetByUser: FunctionReference<"query", "internal", any, any>;
-    groupConnectionScimIdentityGetByGroupConnectionAndUser: FunctionReference<"query", "internal", any, any>;
-    groupConnectionScimIdentityGetByMappedGroup: FunctionReference<"query", "internal", any, any>;
-    groupConnectionScimIdentityListByGroupConnection: FunctionReference<"query", "internal", any, any>;
-    groupConnectionScimIdentityUpsert: FunctionReference<"mutation", "internal", any, any>;
-    groupConnectionScimIdentityDelete: FunctionReference<"mutation", "internal", any, any>;
-    groupAuditEventCreate: FunctionReference<"mutation", "internal", any, any>;
-    groupAuditEventList: FunctionReference<"query", "internal", any, any>;
-    groupWebhookEndpointCreate: FunctionReference<"mutation", "internal", any, any>;
-    groupWebhookEndpointList: FunctionReference<"query", "internal", any, any>;
-    groupWebhookEndpointGet: FunctionReference<"query", "internal", any, any>;
-    groupWebhookEndpointUpdate: FunctionReference<"mutation", "internal", any, any>;
-    groupWebhookDeliveryEnqueue: FunctionReference<"mutation", "internal", any, any>;
-    groupWebhookDeliveryListReady: FunctionReference<"query", "internal", any, any>;
-    groupWebhookDeliveryPatch: FunctionReference<"mutation", "internal", any, any>;
+  user: {
+    get: FunctionReference<"query", "internal">;
+    list: FunctionReference<"query", "internal">;
+    create: FunctionReference<"mutation", "internal">;
+    upsert: FunctionReference<"mutation", "internal">;
+    update: FunctionReference<"mutation", "internal">;
+    delete: FunctionReference<"mutation", "internal">;
+    email: {
+      list: FunctionReference<"query", "internal">;
+      owner: FunctionReference<"query", "internal">;
+      upsert: FunctionReference<"mutation", "internal">;
+      setPrimary: FunctionReference<"mutation", "internal">;
+      delete: FunctionReference<"mutation", "internal">;
+    };
+    key: {
+      get: FunctionReference<"query", "internal">;
+      list: FunctionReference<"query", "internal">;
+      create: FunctionReference<"mutation", "internal">;
+      update: FunctionReference<"mutation", "internal">;
+      delete: FunctionReference<"mutation", "internal">;
+    };
+  };
+  account: {
+    get: FunctionReference<"query", "internal">;
+    list: FunctionReference<"query", "internal">;
+    create: FunctionReference<"mutation", "internal">;
+    update: FunctionReference<"mutation", "internal">;
+    delete: FunctionReference<"mutation", "internal">;
+  };
+  session: {
+    get: FunctionReference<"query", "internal">;
+    list: FunctionReference<"query", "internal">;
+    create: FunctionReference<"mutation", "internal">;
+    issue: FunctionReference<"mutation", "internal">;
+    delete: FunctionReference<"mutation", "internal">;
+  };
+  token: {
+    refresh: {
+      get: FunctionReference<"query", "internal">;
+      list: FunctionReference<"query", "internal">;
+      listChildren: FunctionReference<"query", "internal">;
+      create: FunctionReference<"mutation", "internal">;
+      update: FunctionReference<"mutation", "internal">;
+      delete: FunctionReference<"mutation", "internal">;
+      exchange: FunctionReference<"mutation", "internal">;
+    };
+    verification: {
+      get: FunctionReference<"query", "internal">;
+      create: FunctionReference<"mutation", "internal">;
+      delete: FunctionReference<"mutation", "internal">;
+    };
+    pkce: {
+      get: FunctionReference<"query", "internal">;
+      create: FunctionReference<"mutation", "internal">;
+      update: FunctionReference<"mutation", "internal">;
+      delete: FunctionReference<"mutation", "internal">;
+    };
+  };
+  rateLimit: {
+    get: FunctionReference<"query", "internal">;
+    create: FunctionReference<"mutation", "internal">;
+    update: FunctionReference<"mutation", "internal">;
+    delete: FunctionReference<"mutation", "internal">;
+  };
+  group: {
+    get: FunctionReference<"query", "internal">;
+    ancestors: FunctionReference<"query", "internal">;
+    list: FunctionReference<"query", "internal">;
+    create: FunctionReference<"mutation", "internal">;
+    update: FunctionReference<"mutation", "internal">;
+    delete: FunctionReference<"mutation", "internal">;
+    member: {
+      get: FunctionReference<"query", "internal">;
+      list: FunctionReference<"query", "internal">;
+      create: FunctionReference<"mutation", "internal">;
+      update: FunctionReference<"mutation", "internal">;
+      delete: FunctionReference<"mutation", "internal">;
+      resolve: FunctionReference<"query", "internal">;
+    };
+    invite: {
+      get: FunctionReference<"query", "internal">;
+      list: FunctionReference<"query", "internal">;
+      create: FunctionReference<"mutation", "internal">;
+      accept: FunctionReference<"mutation", "internal">;
+      redeem: FunctionReference<"mutation", "internal">;
+      revoke: FunctionReference<"mutation", "internal">;
+    };
+  };
+  factor: {
+    passkey: {
+      get: FunctionReference<"query", "internal">;
+      list: FunctionReference<"query", "internal">;
+      create: FunctionReference<"mutation", "internal">;
+      update: FunctionReference<"mutation", "internal">;
+      delete: FunctionReference<"mutation", "internal">;
+    };
+    totp: {
+      get: FunctionReference<"query", "internal">;
+      list: FunctionReference<"query", "internal">;
+      create: FunctionReference<"mutation", "internal">;
+      update: FunctionReference<"mutation", "internal">;
+      delete: FunctionReference<"mutation", "internal">;
+    };
+    device: {
+      get: FunctionReference<"query", "internal">;
+      create: FunctionReference<"mutation", "internal">;
+      authorize: FunctionReference<"mutation", "internal">;
+      update: FunctionReference<"mutation", "internal">;
+      delete: FunctionReference<"mutation", "internal">;
+    };
+  };
+  sso: {
+    connection: {
+      get: FunctionReference<"query", "internal">;
+      list: FunctionReference<"query", "internal">;
+      create: FunctionReference<"mutation", "internal">;
+      update: FunctionReference<"mutation", "internal">;
+      delete: FunctionReference<"mutation", "internal">;
+      domain: {
+        list: FunctionReference<"query", "internal">;
+        create: FunctionReference<"mutation", "internal">;
+        delete: FunctionReference<"mutation", "internal">;
+        verify: FunctionReference<"mutation", "internal">;
+        verification: {
+          get: FunctionReference<"query", "internal">;
+          upsert: FunctionReference<"mutation", "internal">;
+          delete: FunctionReference<"mutation", "internal">;
+        };
+      };
+      secret: {
+        get: FunctionReference<"query", "internal">;
+        upsert: FunctionReference<"mutation", "internal">;
+        delete: FunctionReference<"mutation", "internal">;
+      };
+      scim: {
+        config: {
+          get: FunctionReference<"query", "internal">;
+          upsert: FunctionReference<"mutation", "internal">;
+        };
+        identity: {
+          get: FunctionReference<"query", "internal">;
+          list: FunctionReference<"query", "internal">;
+          upsert: FunctionReference<"mutation", "internal">;
+          delete: FunctionReference<"mutation", "internal">;
+        };
+      };
+    };
+    audit: {
+      list: FunctionReference<"query", "internal">;
+      create: FunctionReference<"mutation", "internal">;
+    };
+    webhook: {
+      endpoint: {
+        get: FunctionReference<"query", "internal">;
+        list: FunctionReference<"query", "internal">;
+        create: FunctionReference<"mutation", "internal">;
+        update: FunctionReference<"mutation", "internal">;
+      };
+      delivery: {
+        list: FunctionReference<"query", "internal">;
+        create: FunctionReference<"mutation", "internal">;
+        update: FunctionReference<"mutation", "internal">;
+      };
+    };
   };
 };
 /**
@@ -1286,5 +1347,5 @@ type SessionTokenIdentityClaims = {
 };
 type KeyDoc = Infer<typeof vApiKeyDoc>;
 //#endregion
-export { AfterCtx, AuthAuthorizationConfig, AuthCallbackContext, AuthCallbackProfile, AuthCallbacks, AuthEvent, AuthGrant, AuthProviderConfig, AuthRoleId, BeforeCtx, BeforeEvent, BeforeResult, ConvexAuthConfig, ConvexAuthMaterializedConfig, ConvexCredentialsConfig, CorsConfig, DeviceProviderConfig, Doc, EmailConfig, EmailUserConfig, GenericActionCtxWithAuthConfig, GenericDoc, GroupConnectionPolicy, GroupConnectionPolicyPatch, HasDeviceProvider, HasPasskeyProvider, HasSSO, HasTotpProvider, HttpKeyContext, KeyDoc, KeyScope, OAuthMaterializedConfig, OAuthProfile, OAuthTokens, OIDCClaimMapping, PasskeyProviderConfig, PhoneConfig, PhoneUserConfig, SSOProviderConfig, ScopeChecker, SessionTokenIdentityClaims, TotpProviderConfig, UserOrderBy, UserWhere };
+export { AfterCtx, AuthAuthorizationConfig, AuthCallbackContext, AuthCallbackProfile, AuthCallbacks, AuthDataModel, AuthEvent, AuthGrant, AuthProviderConfig, AuthRoleId, BeforeCtx, BeforeEvent, BeforeResult, ConvexAuthConfig, ConvexAuthMaterializedConfig, ConvexCredentialsConfig, CorsConfig, DeviceProviderConfig, Doc, EmailConfig, EmailUserConfig, GenericActionCtxWithAuthConfig, GenericDoc, GroupConnectionPolicy, GroupConnectionPolicyPatch, HasDeviceProvider, HasPasskeyProvider, HasSSO, HasTotpProvider, HttpKeyContext, KeyDoc, KeyScope, OAuthMaterializedConfig, OAuthProfile, OAuthTokens, OIDCClaimMapping, PasskeyProviderConfig, PhoneConfig, PhoneUserConfig, SSOProviderConfig, ScopeChecker, SessionTokenIdentityClaims, TotpProviderConfig, UserOrderBy, UserWhere };
 //# sourceMappingURL=types.d.ts.map

package/dist/server/types.js

@@ -1,77 +1,82 @@
 //#region src/server/types.ts
 async function queryUserById(ctx, userId) {
-	return await ctx.runQuery(ctx.auth.config.component.public.userGetById, { userId });
+	return await ctx.runQuery(ctx.auth.config.component.user.get, { id: userId });
 }
 async function queryUserByVerifiedEmail(ctx, email) {
-	return await ctx.runQuery(ctx.auth.config.component.public.userFindByVerifiedEmail, { email });
+	return await ctx.runQuery(ctx.auth.config.component.user.get, { verifiedEmail: email });
 }
 async function queryVerifierById(ctx, verifierId) {
-	return await ctx.runQuery(ctx.auth.config.component.public.verifierGetById, { verifierId });
+	return await ctx.runQuery(ctx.auth.config.component.token.pkce.get, { id: verifierId });
 }
 async function mutateVerifierDelete(ctx, verifierId) {
-	await ctx.runMutation(ctx.auth.config.component.public.verifierDelete, { verifierId });
+	await ctx.runMutation(ctx.auth.config.component.token.pkce.delete, { verifierId });
 }
 async function queryTotpById(ctx, totpId) {
-	return await ctx.runQuery(ctx.auth.config.component.public.totpGetById, { totpId });
+	return await ctx.runQuery(ctx.auth.config.component.factor.totp.get, { id: totpId });
 }
 async function queryTotpVerifiedByUserId(ctx, userId) {
-	return await ctx.runQuery(ctx.auth.config.component.public.totpGetVerifiedByUserId, { userId });
+	return await ctx.runQuery(ctx.auth.config.component.factor.totp.get, { verifiedForUserId: userId });
 }
 async function mutateTotpInsert(ctx, args) {
-	return await ctx.runMutation(ctx.auth.config.component.public.totpInsert, args);
+	return await ctx.runMutation(ctx.auth.config.component.factor.totp.create, args);
 }
 async function mutateTotpMarkVerified(ctx, totpId, lastUsedAt) {
-	await ctx.runMutation(ctx.auth.config.component.public.totpMarkVerified, {
+	await ctx.runMutation(ctx.auth.config.component.factor.totp.update, {
 		totpId,
-		lastUsedAt
+		data: {
+			verified: true,
+			lastUsedAt
+		}
 	});
 }
 async function mutateTotpUpdateLastUsed(ctx, totpId, lastUsedAt) {
-	await ctx.runMutation(ctx.auth.config.component.public.totpUpdateLastUsed, {
+	await ctx.runMutation(ctx.auth.config.component.factor.totp.update, {
 		totpId,
-		lastUsedAt
+		data: { lastUsedAt }
 	});
 }
 async function queryPasskeysByUserId(ctx, userId) {
-	return await ctx.runQuery(ctx.auth.config.component.public.passkeyListByUserId, { userId });
+	return await ctx.runQuery(ctx.auth.config.component.factor.passkey.list, { userId });
 }
 async function queryPasskeyByCredentialId(ctx, credentialId) {
-	return await ctx.runQuery(ctx.auth.config.component.public.passkeyGetByCredentialId, { credentialId });
+	return await ctx.runQuery(ctx.auth.config.component.factor.passkey.get, { credentialId });
 }
 async function mutatePasskeyInsert(ctx, args) {
-	return await ctx.runMutation(ctx.auth.config.component.public.passkeyInsert, args);
+	return await ctx.runMutation(ctx.auth.config.component.factor.passkey.create, args);
 }
 async function mutatePasskeyUpdateCounter(ctx, passkeyId, counter, lastUsedAt) {
-	await ctx.runMutation(ctx.auth.config.component.public.passkeyUpdateCounter, {
+	await ctx.runMutation(ctx.auth.config.component.factor.passkey.update, {
 		passkeyId,
-		counter,
-		lastUsedAt
+		data: {
+			counter,
+			lastUsedAt
+		}
 	});
 }
 async function mutateDeviceInsert(ctx, args) {
-	return await ctx.runMutation(ctx.auth.config.component.public.deviceInsert, args);
+	return await ctx.runMutation(ctx.auth.config.component.factor.device.create, args);
 }
 async function queryDeviceByCodeHash(ctx, deviceCodeHash) {
-	return await ctx.runQuery(ctx.auth.config.component.public.deviceGetByCodeHash, { deviceCodeHash });
+	return await ctx.runQuery(ctx.auth.config.component.factor.device.get, { deviceCodeHash });
 }
 async function queryDeviceByUserCode(ctx, userCode) {
-	return await ctx.runQuery(ctx.auth.config.component.public.deviceGetByUserCode, { userCode });
+	return await ctx.runQuery(ctx.auth.config.component.factor.device.get, { userCode });
 }
 async function mutateDeviceAuthorize(ctx, deviceId, userId, sessionId) {
-	await ctx.runMutation(ctx.auth.config.component.public.deviceAuthorize, {
+	await ctx.runMutation(ctx.auth.config.component.factor.device.authorize, {
 		deviceId,
 		userId,
 		sessionId
 	});
 }
 async function mutateDeviceUpdateLastPolled(ctx, deviceId, lastPolledAt) {
-	await ctx.runMutation(ctx.auth.config.component.public.deviceUpdateLastPolled, {
+	await ctx.runMutation(ctx.auth.config.component.factor.device.update, {
 		deviceId,
-		lastPolledAt
+		data: { lastPolledAt }
 	});
 }
 async function mutateDeviceDelete(ctx, deviceId) {
-	await ctx.runMutation(ctx.auth.config.component.public.deviceDelete, { deviceId });
+	await ctx.runMutation(ctx.auth.config.component.factor.device.delete, { deviceId });
 }
 
 //#endregion

package/dist/server/users.js

@@ -67,6 +67,51 @@ async function checkAllowLink(args, config, userId) {
 		userId
 	}) !== false;
 }
+/**
+* Persist the emails this sign-in asserts onto the resolved user.
+*
+* The profile's primary email is recorded as the primary `UserEmail`
+* row; any provider-reported secondaries (e.g. GitHub `/user/emails`)
+* are recorded non-primary, each keeping its own verified state.
+* Provenance (`source`, `provider`, `connectionId`) is captured so SSO
+* linking can stay connection-scoped.
+*
+* @param db - The component-backed auth DB facade.
+* @param userId - The resolved (created or linked) user.
+* @param args - The create-or-update args (provider, accountExtend, emails).
+* @param profile - The provisioned profile (already destructured).
+* @param emailVerified - Whether the primary email is verified.
+*/
+async function recordOwnedEmails(db, userId, args, profile, emailVerified) {
+	const identity = args.accountExtend?.identity;
+	const protocol = typeof identity?.protocol === "string" ? identity.protocol : void 0;
+	const source = protocol === "saml" ? "saml" : protocol === "oidc" ? "oidc" : args.provider.type === "oauth" ? "oauth" : "password";
+	const provider = typeof args.provider.id === "string" ? args.provider.id : void 0;
+	const connectionId = typeof identity?.connectionId === "string" ? identity.connectionId : void 0;
+	const primaryEmail = typeof profile.email === "string" ? profile.email.toLowerCase() : null;
+	if (primaryEmail !== null) await db.emails.upsert({
+		userId,
+		email: primaryEmail,
+		verified: emailVerified,
+		isPrimary: true,
+		source,
+		provider,
+		connectionId
+	});
+	for (const entry of args.emails ?? []) {
+		const addr = entry.email.toLowerCase();
+		if (addr === primaryEmail) continue;
+		await db.emails.upsert({
+			userId,
+			email: addr,
+			verified: entry.verified === true,
+			isPrimary: false,
+			source,
+			provider,
+			connectionId
+		});
+	}
+}
 async function updateExistingUser(db, userId, userData, source, provisioningUser) {
 	const currentUser = await db.users.getById(userId);
 	const mode = effectiveUserUpdateMode(source, provisioningUser);
@@ -109,8 +154,9 @@ async function defaultCreateOrUpdateUser(ctx, existingSessionId, existingAccount
 	const { provider, profile: { id: _profileId, emailVerified: profileEmailVerified, phoneVerified: profilePhoneVerified, ...profile } } = args;
 	const emailVerified = profileEmailVerified ?? (provider.type === "oauth" && provider.accountLinking !== "none");
 	const phoneVerified = profilePhoneVerified ?? false;
-	const shouldLinkViaEmail = args.shouldLinkViaEmail || emailVerified || provider.type === "email";
-	const shouldLinkViaPhone = args.shouldLinkViaPhone || phoneVerified || provider.type === "phone";
+	const connectionScopedLinking = provider.type === "oauth" && provider.accountLinking === "sameConnection";
+	const shouldLinkViaEmail = !connectionScopedLinking && (args.shouldLinkViaEmail || emailVerified || provider.type === "email");
+	const shouldLinkViaPhone = !connectionScopedLinking && (args.shouldLinkViaPhone || phoneVerified || provider.type === "phone");
 	let userId = existingUserId ?? existingUserIdOverride;
 	if (existingUserId === null) {
 		userId = await resolveUserIdByLinking(ctx, args, profile, shouldLinkViaEmail, shouldLinkViaPhone, existingUserIdOverride, config);
@@ -130,6 +176,7 @@ async function defaultCreateOrUpdateUser(ctx, existingSessionId, existingAccount
 		});
 		userId = await db.users.insert(userData);
 	}
+	await recordOwnedEmails(db, userId, args, profile, emailVerified === true);
 	const after = config.callbacks?.after;
 	if (after !== void 0) {
 		log(LOG_LEVELS.DEBUG, "Calling `after` callback for user lifecycle event");