@bongos/core 1.24.5 → 1.24.6

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.24.5",
-  "core_contract": "1.24.5",
-  "source_commit": "3c88fbd178c93e32bc27e47490d2ea89fd628787",
+  "core_version": "1.24.6",
+  "core_contract": "1.24.6",
+  "source_commit": "d76131851e558718f994bff2dc61d927392b2e35",
   "source_ref": "HEAD",
-  "built_at": "2026-10-30T05:11:49.262Z",
+  "built_at": "2026-10-30T05:27:20.349Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 628,
     "agent_docs_stubbed": 32,
-    "functional_verbatim": 3722,
+    "functional_verbatim": 3727,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 4383,
-  "tree_sha256": "64ec9b67115939200ddd1d5f3b89f1e941f4da2580d278b86e511986fc017c01",
+  "file_count": 4388,
+  "tree_sha256": "eb6a2ecfa756bd24aa031a917dab6182cac8e59bc49405c09287beb69ea68e40",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -327,12 +327,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "b2735326bb4b3ef29ce7684200cb45900d44442c978994166eecbfd2fff352ec"
+      "sha256": "6aa2a4269ce603ae9b21a26c16fb4a19316a4b740981067e60de4825dfc99e34"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "133a43fcfbaca89e438e23df227fad435a0ebb48a0f5e57241ca0779cdea0df5"
+      "sha256": "6de6d6f401db915703edc4068bfa650e526695542f3c547b4563f6d8d24e5fe5"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -342,17 +342,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "59158230c9f3f96fd2cd12774f374deef70a11b50c495a09035cbdef967667b5"
+      "sha256": "89e68bce31d01cececb2ab1a28766828e37281523462acda77d5c20e17106470"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "7d3aeae646fa5a13e0ddc1d7455ac5fb109275aaa35d0a524bf2bafc80874e80"
+      "sha256": "13dc1594495f2cbf4209d8b1ff77b0b7db0a3e6d33c74d8236fd62e97e356156"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "e365441cfcaec48546855c42f330d4dc358c95aabbcc4cd9a51fc11209bcf14d"
+      "sha256": "c5c8097091dba7e2471eec9b81175cf1f9458a164f7b8a4ebaf3c9476197155f"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2437,7 +2437,7 @@
     {
       "path": "docs/adr/0396-google-sign-in-a-stand-in-login-and-a-browser-approved-cli-sign-in.md",
       "mode": "0000644",
-      "sha256": "15a008d87ff72366e6e5d9e8cbe54eb6060cbb62aedbc40013147739f97d54bc"
+      "sha256": "7c13a3f082ab91435a181f8b197f1e46708cc1b24a9ad80463c74f3726280d70"
     },
     {
       "path": "docs/adr/README.md",
@@ -2447,12 +2447,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "8a5820f4be8038f02e65107f076ff694304459eda1c514903ae22c1f53a1522f"
+      "sha256": "eb2fd9c8c2cdca2d4b8b893bbc7b728d78a1846c126d2bb1d8ec77f7d5d3bd8e"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "6dbe0723050ce5d1bdd1b5af8b7235bdf1f886ffa98150fa4320756adc428964"
+      "sha256": "abc9ef4763a8701a9078fb7e8741c9680a4c34e5263ac44a06109f108896a6fa"
     },
     {
       "path": "docs/architecture.md",
@@ -2477,12 +2477,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "451e8acde051b614a3d1c788ff8e737f8b15b7c99bebbb6a0e57f0d634de7532"
+      "sha256": "9f2b88606c2a78aafc2c9ba7d000364f8afa0d72cc2d63978f629d8928bb4554"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "d0fd1935049c2ecb48aea5a9e974f1725cd56a816b86dd1891e5632ec491fa4f"
+      "sha256": "6649e2a3c4b0f51f78535cbaeb4f7a70f07363aea6460028300ba7f47258b100"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2992,7 +2992,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "9d657541cca4abb87aea4ea612e2072d025bb40dcd2aa68458322690fd9917d6"
+      "sha256": "6c408dfa0fdfdf0b6544b8845aee952ecbf85b93205d2f04293fc88653cead39"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3077,12 +3077,12 @@
     {
       "path": "docs/page-inventory.json",
       "mode": "0000644",
-      "sha256": "c01a06e925175fa20e8763e9892cc2431262b163e82a07ed7b0990e914a1d3c1"
+      "sha256": "143bc5348d7b717165493315352709bdf95bbce55f3158044fbd151d2525e296"
     },
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "9294370708bcefc1a344e8d383f5b77a0161d4e7abec6111c29995cef93391ed"
+      "sha256": "eaae3054433e68b47ef74a0fd60c6d8eaaa66e22055d91e75c7ccf75ed807019"
     },
     {
       "path": "docs/project-context.template.md",
@@ -4279,6 +4279,11 @@
       "mode": "0000644",
       "sha256": "ac98b2770c87a6c23758807b43ed74f8480e41d2b17cbdaf01b2017aac2f9b55"
     },
+    {
+      "path": "migrations/core_286_credit_log_no_spend.sql",
+      "mode": "0000644",
+      "sha256": "5b0f9d39bc66732b3bc2ad53562c8238152904a1d71790bcba9f8fae3386ccb3"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -4647,7 +4652,7 @@
     {
       "path": "modules/copy-desk/auto-close.js",
       "mode": "0000644",
-      "sha256": "413e0bd992b3db551f572c53b9e9074f59aec9700ef2dfba889d3c3edf52bcee"
+      "sha256": "5f58ac6c1791e5fd1cbab462c531a6a5c34d7cbac6346f5c9c8f24b62e2b2351"
     },
     {
       "path": "modules/copy-desk/chrome-pages.js",
@@ -4702,7 +4707,7 @@
     {
       "path": "modules/copy-desk/page-status.js",
       "mode": "0000644",
-      "sha256": "d56343c59fa538461442a279db620dd1bca9b1545e27ecf4170950c54537948e"
+      "sha256": "b3cfad9eef5ad3b5fcb270e06e8730fcb6f3635e5328f122ac2e064f082891ed"
     },
     {
       "path": "modules/copy-desk/pages.js",
@@ -4777,7 +4782,7 @@
     {
       "path": "modules/copy-desk/tests/copy_page_auto_close.mjs",
       "mode": "0000644",
-      "sha256": "963c439133ed1e4887d9d21cb657646203e7776fa57af8cd22e04a4e26aaad99"
+      "sha256": "55c2cce578d9625e791fa4ac2fd3cb43fdfcf719e1fe9b78d7f1cf010b829371"
     },
     {
       "path": "modules/copy-desk/tests/copy_page_draft.mjs",
@@ -8087,7 +8092,7 @@
     {
       "path": "modules/lifecycle/routes/claims.js",
       "mode": "0000644",
-      "sha256": "2e6b8f8281063bb584937fe469d19ff9573bc22fe4282e1b1d0c0d21e745e53b"
+      "sha256": "597ed82a59be1e0bff249770858f203f35faab055cd0a6c7fc644518686f48d8"
     },
     {
       "path": "modules/lifecycle/routes/closeness.js",
@@ -8712,7 +8717,7 @@
     {
       "path": "modules/platform-identity/account-logins.js",
       "mode": "0000644",
-      "sha256": "287ddbff0de072b9400d37d7f7caa87d6feeb96d2cf8da158839b6f979b712a2"
+      "sha256": "5213c0f4692acc47a138684f88d695476cdb663d1949124d766a65406a76ff3e"
     },
     {
       "path": "modules/platform-identity/account-visibility.js",
@@ -8999,6 +9004,11 @@
       "mode": "0000644",
       "sha256": "113da8e634c51de0ba027bbcc1438162d3f906e3cc6cd663327509a36f4500e2"
     },
+    {
+      "path": "modules/platform-identity/migrations/platform_identity_035_account_login_email_idx.sql",
+      "mode": "0000644",
+      "sha256": "91aa11c7171adbe4bc24f16572f73a6c9d37aba4132a51e9ac640bef2fb2770f"
+    },
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
@@ -9092,7 +9102,7 @@
     {
       "path": "modules/platform-identity/routes/profile.js",
       "mode": "0000644",
-      "sha256": "51df5a8c1a91ddcd03ddee932e907a6444c62443df6c0750fb8bdc1bdc402233"
+      "sha256": "4738146d5b0c733c0ff33ff34a6ebd0d2615391a8ae1d76e7686e07be990370a"
     },
     {
       "path": "modules/platform-identity/routes/projects.js",
@@ -9117,7 +9127,7 @@
     {
       "path": "modules/platform-identity/routes/sso.js",
       "mode": "0000644",
-      "sha256": "3a9e4c5ef8d99b89c7e6a35d9e8c2788705be515958f250467b8db45db9bd51b"
+      "sha256": "7f114183ad0e66820d78bf1ff1af692eb9fee77226a3215aeaba5200cadb1b7a"
     },
     {
       "path": "modules/platform-identity/scouting-authz.js",
@@ -9647,7 +9657,7 @@
     {
       "path": "modules/public-landing/public/account.html",
       "mode": "0000644",
-      "sha256": "48a8f7fbca2bffe8a5cee038851dd1dcafd9cab096e0abd08850293fd54705d9"
+      "sha256": "717739c73bce0f261b938c587f1ebb0dc677dfffc2beb61a12f5f304317699d9"
     },
     {
       "path": "modules/public-landing/public/account.probes.json",
@@ -9657,7 +9667,7 @@
     {
       "path": "modules/public-landing/public/account.states.json",
       "mode": "0000644",
-      "sha256": "0c05a41ce426082b56f0a267a60fb04f11c99bed9fcff2fbba7aca896d1af29e"
+      "sha256": "a3551bd3b21ae558699216216ed7c4809090276fc3133befa1f5fda8104bf033"
     },
     {
       "path": "modules/public-landing/public/assets/anim/idle/frame_00.webp",
@@ -11292,7 +11302,7 @@
     {
       "path": "modules/ui-design/kit/serve.js",
       "mode": "0000644",
-      "sha256": "a50f940fc73e0ee018ce85eebb1b737c197c64722ea2c32e90559d792e76ef0b"
+      "sha256": "2e35dc760a2085435e257699eefb8c8640c2f46cf0242eb8801e8887e2e6382c"
     },
     {
       "path": "modules/ui-design/kit/tells.js",
@@ -11427,12 +11437,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c8346ef5a2a69cb674976854cd033dc1209c05caa8502d6aec943e36d1d87d61"
+      "sha256": "82aa98487b46e7fb59752d5ec7e806b0fd6c5b9084a2585daf836d9016dc68bd"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f2163c967b304cf6d707a11dfdd47960a3490c54c2530dfd245cf7f1d643ea66"
+      "sha256": "1be6fc34aee13b557f6781a1d797279282b3ac6eb28024d819f1818fdc1a9bd4"
     },
     {
       "path": "public-docs/index.html",
@@ -11452,7 +11462,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "d2dbd5bbf56312c0f5c1e00c9a73e60591fe85609e1fcb6047ec0e677e3a923a"
+      "sha256": "26a6fdb22f186250ff50160198520658b0bd77795af3c4b6afc63e35e36d1b07"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -12677,7 +12687,7 @@
     {
       "path": "scripts/bongos/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "b18f796ef910e5257bb2c59509fac600f4c983b2e0e1fd2b7c96508d7a112e97"
+      "sha256": "761091c93930535e1ec22e9c268897aeef935ca0c985aea5e194fa50e17393f6"
     },
     {
       "path": "scripts/bongos/runner-drift.js",
@@ -14837,7 +14847,7 @@
     {
       "path": "src/bongos/auth-github.js",
       "mode": "0000644",
-      "sha256": "fa9320999a0ed200a174bf8d994482e6a19e69b214170d3008d42f8dd3b5d598"
+      "sha256": "b49add7da84090e626f6812c54574073a959ab78e24e56158983c82363a571d0"
     },
     {
       "path": "src/bongos/auth-google.js",
@@ -15092,7 +15102,7 @@
     {
       "path": "src/bongos/routes.js",
       "mode": "0000644",
-      "sha256": "06a7286695be0689d2806d4ded027db28923886a0941478fe7aa818b543f2dd7"
+      "sha256": "2ca88b6cb7f879e489a8a19eac49de12e7cbc32ec9336682dc72de3a4fcd9279"
     },
     {
       "path": "src/bongos/routes/CLAUDE.md",
@@ -15112,7 +15122,12 @@
     {
       "path": "src/bongos/routes/auth-google.js",
       "mode": "0000644",
-      "sha256": "e89e9a1e8838795c565ce2e7d018af82d96c10db643a2de4c1c5c37063d67a68"
+      "sha256": "f7531eefb5d958f4924aff1e0e1bf8bf258f82cc676d7bdb0f26e6235a181ae4"
+    },
+    {
+      "path": "src/bongos/routes/auth-link.js",
+      "mode": "0000644",
+      "sha256": "9026bef41c5f079cd80720b95d5e6d376c3280f63e1ad389e99c7f5dfc67ae8f"
     },
     {
       "path": "src/bongos/routes/auth.js",
@@ -15242,7 +15257,7 @@
     {
       "path": "src/bongos/sign-in-pages.js",
       "mode": "0000644",
-      "sha256": "f2fd4a71875e75584ca0f238d289b926ff7b13127ac98646aaeb3e63940f01c7"
+      "sha256": "c8cb78f67fce5c42bbe896207d1a0d323215592a36c5d231d7f586e41479b409"
     },
     {
       "path": "src/bongos/software-update.js",
@@ -15292,7 +15307,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "db9f13a1a0bf6937f8b42578eaefe3febbc72ef8c822dbc6abca2e512b4b06db"
+      "sha256": "936890d242b9f24422e4f62d387666b34bac68a405291a02d3e22af6cc00ea38"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -15404,6 +15419,11 @@
       "mode": "0000644",
       "sha256": "41b8175653a86b79a5dae1e0be041eb4a286720cb41cbcd069afe9bc78b172ac"
     },
+    {
+      "path": "tests/account_linking.mjs",
+      "mode": "0000644",
+      "sha256": "aabe503e1a8ae00c62a72331f24d26efc8b5739704950a9c4e6b426d5593bce4"
+    },
     {
       "path": "tests/account_logins.mjs",
       "mode": "0000644",
@@ -15412,7 +15432,7 @@
     {
       "path": "tests/account_logins_db.mjs",
       "mode": "0000644",
-      "sha256": "f9c338d05c7339b5ac77055ed71370840b6186165b331ebe5e74e2dca70ee16b"
+      "sha256": "a958dbca24f8bae620c826f0bdab21441ffb9b213c9c4f0304bc9905fe9c0bb6"
     },
     {
       "path": "tests/account_privacy_flags.mjs",
@@ -16197,7 +16217,7 @@
     {
       "path": "tests/claims_batch_routes.mjs",
       "mode": "0000644",
-      "sha256": "53cdb47f665e27df47f122fc81a554827a7f971ef3fe9b735088d9c691cc18aa"
+      "sha256": "02c8680d636667472f07d3389c1056fed290fdfa61a79135cc00674070615446"
     },
     {
       "path": "tests/claims_bind_session.mjs",
@@ -16422,7 +16442,7 @@
     {
       "path": "tests/copy_desk_page_release.mjs",
       "mode": "0000644",
-      "sha256": "0107dc58b7a59c030d2ac6e45ed61b8a166804879e2c7bcdacb058d7c4bd36dd"
+      "sha256": "a8eca478657a52ef1c00837afaa757ce41dc4faf7a21ec030e1c818516706c35"
     },
     {
       "path": "tests/copy_desk_page_submit.mjs",
@@ -16442,7 +16462,7 @@
     {
       "path": "tests/copy_stuck_page_tweaks.mjs",
       "mode": "0000644",
-      "sha256": "5afcb83b32338d30c0dec85c9caecb57fd928f2129cca23701ced4517f9a1ccc"
+      "sha256": "ed093cbf72005b6417f1b2e0e11bc180540b85c3fa77e8466110c36dae0a113b"
     },
     {
       "path": "tests/core_258_box_session_claims_db.mjs",
@@ -16579,6 +16599,11 @@
       "mode": "0000644",
       "sha256": "d7c96a67f1eda974a9387a47d12bf70d7f2125ea77c1ddb313e5a3feb47ae04f"
     },
+    {
+      "path": "tests/credit_log_no_spend_db.mjs",
+      "mode": "0000644",
+      "sha256": "82cfb61e859da3ac3515fdd3e0a0df0d06ffe2a198fb640f327f46312aaa5e86"
+    },
     {
       "path": "tests/credit_log_single_writer.mjs",
       "mode": "0000644",
@@ -16902,7 +16927,7 @@
     {
       "path": "tests/effective_visibility_predicate.mjs",
       "mode": "0000644",
-      "sha256": "2bae0bc521ccff03a13484c756dbe0d0515b63fa0babd9174a645e63397f12eb"
+      "sha256": "7bd63d2a1f097fdde204803ec8b6fc0ae75843080af6d442c969ed02b7fb41dd"
     },
     {
       "path": "tests/env_knobs_neutral_prefix.mjs",
@@ -18372,7 +18397,7 @@
     {
       "path": "tests/hub_account_page.mjs",
       "mode": "0000644",
-      "sha256": "0fbcec7a0f77ff149a5b2d8486e7e239101816acdcf81bea8b54207803d400ae"
+      "sha256": "e1e282e2c1e9417f463d959435a0a287d6b6e332513bc6b8ecaf2d616f60661d"
     },
     {
       "path": "tests/hub_community_page.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 636 operations across 80 resource groups
+- 639 operations across 80 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -187,6 +187,8 @@ function createClient(opts = {}) {
       getAuthGoogleCallback: (args) => request("GET", "/auth/google/callback", { hasBody: false }, args),
       // GET /auth/google/start — rank: public — GET /auth/google/start
       getAuthGoogleStart: (args) => request("GET", "/auth/google/start", { hasBody: false }, args),
+      // GET /auth/link/github/start — rank: public — GET /auth/link/github/start
+      getAuthLinkGithubStart: (args) => request("GET", "/auth/link/github/start", { hasBody: false }, args),
       // POST /auth/logout — rank: any-builder — POST /auth/logout
       postAuthLogout: (args) => request("POST", "/auth/logout", { hasBody: true }, args),
       // POST /auth/revoke — rank: archon — POST /auth/revoke
@@ -197,6 +199,8 @@ function createClient(opts = {}) {
       getAuthWebAdmissionStatus: (args) => request("GET", "/auth/web/admission-status", { hasBody: false }, args),
       // GET /auth/web/callback — rank: public — GET /auth/web/callback
       getAuthWebCallback: (args) => request("GET", "/auth/web/callback", { hasBody: false }, args),
+      // GET /auth/web/callback/link — rank: public — GET /auth/web/callback/link
+      getAuthWebCallbackLink: (args) => request("GET", "/auth/web/callback/link", { hasBody: false }, args),
       // GET /auth/web/handoff — rank: public — GET /auth/web/handoff
       getAuthWebHandoff: (args) => request("GET", "/auth/web/handoff", { hasBody: false }, args),
       // GET /auth/web/start — rank: public — GET /auth/web/start
@@ -855,6 +859,8 @@ function createClient(opts = {}) {
       postMeSessionsRevokeAll: (args) => request("POST", "/me/sessions/revoke-all", { hasBody: true }, args),
       // GET /me/sign-in-methods — rank: any-builder — GET /me/sign-in-methods
       getMeSignInMethods: (args) => request("GET", "/me/sign-in-methods", { hasBody: false }, args),
+      // DELETE /me/sign-in-methods/{provider} — rank: any-builder — DELETE /me/sign-in-methods/:provider
+      deleteMeSignInMethodsProvider: (args) => request("DELETE", "/me/sign-in-methods/{provider}", { hasBody: false }, args),
       // GET /me/skill-prefs — rank: any-builder — GET /me/skill-prefs
       getMeSkillPrefs: (args) => request("GET", "/me/skill-prefs", { hasBody: false }, args),
       // PATCH /me/skill-prefs — rank: any-builder — PATCH /me/skill-prefs

package/clients/bongos-client/index.cjs

@@ -186,6 +186,8 @@ function createClient(opts = {}) {
       getAuthGoogleCallback: (args) => request("GET", "/auth/google/callback", { hasBody: false }, args),
       // GET /auth/google/start — rank: public — GET /auth/google/start
       getAuthGoogleStart: (args) => request("GET", "/auth/google/start", { hasBody: false }, args),
+      // GET /auth/link/github/start — rank: public — GET /auth/link/github/start
+      getAuthLinkGithubStart: (args) => request("GET", "/auth/link/github/start", { hasBody: false }, args),
       // POST /auth/logout — rank: any-builder — POST /auth/logout
       postAuthLogout: (args) => request("POST", "/auth/logout", { hasBody: true }, args),
       // POST /auth/revoke — rank: archon — POST /auth/revoke
@@ -196,6 +198,8 @@ function createClient(opts = {}) {
       getAuthWebAdmissionStatus: (args) => request("GET", "/auth/web/admission-status", { hasBody: false }, args),
       // GET /auth/web/callback — rank: public — GET /auth/web/callback
       getAuthWebCallback: (args) => request("GET", "/auth/web/callback", { hasBody: false }, args),
+      // GET /auth/web/callback/link — rank: public — GET /auth/web/callback/link
+      getAuthWebCallbackLink: (args) => request("GET", "/auth/web/callback/link", { hasBody: false }, args),
       // GET /auth/web/handoff — rank: public — GET /auth/web/handoff
       getAuthWebHandoff: (args) => request("GET", "/auth/web/handoff", { hasBody: false }, args),
       // GET /auth/web/start — rank: public — GET /auth/web/start
@@ -854,6 +858,8 @@ function createClient(opts = {}) {
       postMeSessionsRevokeAll: (args) => request("POST", "/me/sessions/revoke-all", { hasBody: true }, args),
       // GET /me/sign-in-methods — rank: any-builder — GET /me/sign-in-methods
       getMeSignInMethods: (args) => request("GET", "/me/sign-in-methods", { hasBody: false }, args),
+      // DELETE /me/sign-in-methods/{provider} — rank: any-builder — DELETE /me/sign-in-methods/:provider
+      deleteMeSignInMethodsProvider: (args) => request("DELETE", "/me/sign-in-methods/{provider}", { hasBody: false }, args),
       // GET /me/skill-prefs — rank: any-builder — GET /me/skill-prefs
       getMeSkillPrefs: (args) => request("GET", "/me/skill-prefs", { hasBody: false }, args),
       // PATCH /me/skill-prefs — rank: any-builder — PATCH /me/skill-prefs

package/clients/bongos-client/index.d.ts

@@ -19,6 +19,7 @@ export interface DeleteGuildsSlugMembershipResponse { outcome: unknown }
 export interface DeleteGuildsSlugResponse { outcome: unknown }
 export interface DeleteInboxIdSparkResponse { idea: unknown; sparked: boolean; unchanged: boolean }
 export interface DeleteMeFilterViewsIdResponse { page: unknown; views: unknown }
+export interface DeleteMeSignInMethodsProviderResponse { ok: boolean }
 export interface DeleteMemoryFileResponse { deleted: boolean; builder_id: unknown; path: unknown }
 export interface DeleteNotesIdResponse { ok: boolean }
 export interface DeleteProvisioningInstancesIdEnvManifestVarIdResponse { ok: boolean; removed: boolean; message: unknown }
@@ -806,6 +807,8 @@ export interface BongosClient {
     getAuthGoogleCallback(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /auth/google/start — rank: public */
     getAuthGoogleStart(args?: RequestArgs): Promise<ApiResponse>;
+    /** GET /auth/link/github/start — rank: public */
+    getAuthLinkGithubStart(args?: RequestArgs): Promise<ApiResponse>;
     /** POST /auth/logout — rank: any-builder */
     postAuthLogout(args?: RequestArgs): Promise<PostAuthLogoutResponse>;
     /** POST /auth/revoke — rank: archon */
@@ -816,6 +819,8 @@ export interface BongosClient {
     getAuthWebAdmissionStatus(args?: RequestArgs): Promise<GetAuthWebAdmissionStatusResponse>;
     /** GET /auth/web/callback — rank: public */
     getAuthWebCallback(args?: RequestArgs): Promise<ApiResponse>;
+    /** GET /auth/web/callback/link — rank: public */
+    getAuthWebCallbackLink(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /auth/web/handoff — rank: public */
     getAuthWebHandoff(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /auth/web/start — rank: public */
@@ -1474,6 +1479,8 @@ export interface BongosClient {
     postMeSessionsRevokeAll(args?: RequestArgs): Promise<PostMeSessionsRevokeAllResponse>;
     /** GET /me/sign-in-methods — rank: any-builder */
     getMeSignInMethods(args?: RequestArgs): Promise<GetMeSignInMethodsResponse>;
+    /** DELETE /me/sign-in-methods/{provider} — rank: any-builder */
+    deleteMeSignInMethodsProvider(args?: RequestArgs): Promise<DeleteMeSignInMethodsProviderResponse>;
     /** GET /me/skill-prefs — rank: any-builder */
     getMeSkillPrefs(args?: RequestArgs): Promise<GetMeSkillPrefsResponse>;
     /** PATCH /me/skill-prefs — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -183,6 +183,8 @@ export function createClient(opts = {}) {
       getAuthGoogleCallback: (args) => request("GET", "/auth/google/callback", { hasBody: false }, args),
       // GET /auth/google/start — rank: public — GET /auth/google/start
       getAuthGoogleStart: (args) => request("GET", "/auth/google/start", { hasBody: false }, args),
+      // GET /auth/link/github/start — rank: public — GET /auth/link/github/start
+      getAuthLinkGithubStart: (args) => request("GET", "/auth/link/github/start", { hasBody: false }, args),
       // POST /auth/logout — rank: any-builder — POST /auth/logout
       postAuthLogout: (args) => request("POST", "/auth/logout", { hasBody: true }, args),
       // POST /auth/revoke — rank: archon — POST /auth/revoke
@@ -193,6 +195,8 @@ export function createClient(opts = {}) {
       getAuthWebAdmissionStatus: (args) => request("GET", "/auth/web/admission-status", { hasBody: false }, args),
       // GET /auth/web/callback — rank: public — GET /auth/web/callback
       getAuthWebCallback: (args) => request("GET", "/auth/web/callback", { hasBody: false }, args),
+      // GET /auth/web/callback/link — rank: public — GET /auth/web/callback/link
+      getAuthWebCallbackLink: (args) => request("GET", "/auth/web/callback/link", { hasBody: false }, args),
       // GET /auth/web/handoff — rank: public — GET /auth/web/handoff
       getAuthWebHandoff: (args) => request("GET", "/auth/web/handoff", { hasBody: false }, args),
       // GET /auth/web/start — rank: public — GET /auth/web/start
@@ -851,6 +855,8 @@ export function createClient(opts = {}) {
       postMeSessionsRevokeAll: (args) => request("POST", "/me/sessions/revoke-all", { hasBody: true }, args),
       // GET /me/sign-in-methods — rank: any-builder — GET /me/sign-in-methods
       getMeSignInMethods: (args) => request("GET", "/me/sign-in-methods", { hasBody: false }, args),
+      // DELETE /me/sign-in-methods/{provider} — rank: any-builder — DELETE /me/sign-in-methods/:provider
+      deleteMeSignInMethodsProvider: (args) => request("DELETE", "/me/sign-in-methods/{provider}", { hasBody: false }, args),
       // GET /me/skill-prefs — rank: any-builder — GET /me/skill-prefs
       getMeSkillPrefs: (args) => request("GET", "/me/skill-prefs", { hasBody: false }, args),
       // PATCH /me/skill-prefs — rank: any-builder — PATCH /me/skill-prefs

package/docs/adr/0396-google-sign-in-a-stand-in-login-and-a-browser-approved-cli-sign-in.md

@@ -50,3 +50,11 @@ Decision 8's two refusals are lifted, without ever sending a minted key to a cor
 - **People read the handle.** The hall's admission queue shows `ana`, not `~ana`.
 
 Credits, ranks and community pages needed no change: the hub's check-in and rollup already take a negative key. Still open: a hall's command-line sign-in (`/sso/device/*`) is GitHub's device flow, so a Google-only person signs in to a hall in the browser; engineering work still needs GitHub (task 1004997).
+
+## Amendment — linking GitHub and Google, both ways (task 1004995)
+
+- **A link is a sign-in with the other account, made while signed in.** Link Google rides the Google sign-in with a flag in the host-only state cookie (Google matches redirect URIs exactly). Link GitHub uses its own callback, `/auth/web/callback/link`, a subdirectory of the registered GitHub callback, which GitHub accepts, so the owner's GitHub app needs no change. Both answers land on `/account#aWaysIn`.
+- **Never a merge.** A way in that already reaches another person, or a GitHub account with its own builder row here, is refused and the page says so: "That GitHub account already has its own account here, so it was not linked." Both accounts may hold credits and history, and joining them is not the server's decision.
+- **Removing.** Never the last way in. And never GitHub from an account born with it: that account's key is its GitHub id, so a GitHub sign-in would still reach it and the removal would be a lie. A person who joined with Google may remove a linked GitHub, and then shows their stand-in again from their next sign-in.
+- **Every GitHub sign-in on the hub finds the person first** (the ADR 0393 carry-over, closed): the web and device sign-ins ask the hub who the GitHub id reaches and use that key. A project's command-line sign-in (`/sso/device/poll`) cannot tell whether the project takes a minted key, so for a GitHub account linked to someone who joined with Google it says to sign in in the browser.
+- **Matching emails suggest, never join.** This amends decision 3's "emails are never looked up" in one place only: on a first Google sign-in, if another account's GitHub way in shows the address Google verified, the person is offered "Sign in with GitHub" (then link Google from the account page) or "Make a new account with Google". Only the provider's name crosses; no account is named or joined. The hub keeps the GitHub address it sees at sign-in (GitHub's public address) for this alone.