@jskit-ai/agent-docs 0.1.238 → 0.1.240

package/reference/autogen/PATTERN_INDEX.md

@@ -15,7 +15,7 @@ A concrete Fastify, Vue, and JSKIT application foundation for products that do n
 
 - Id: `app/minimal-foundation`
 - Keywords: `app`, `fastify`, `foundation`, `minimal`, `server`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.238`
+- Owner: `@jskit-ai/agent-docs@0.1.240`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/app/minimal-foundation/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/app/minimal-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`
@@ -26,7 +26,7 @@ A concrete JSKIT web application foundation with responsive shell navigation, se
 
 - Id: `app/shell-foundation`
 - Keywords: `app`, `foundation`, `material`, `navigation`, `placements`, `shell`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.238`
+- Owner: `@jskit-ai/agent-docs@0.1.240`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/app/shell-foundation/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/app/shell-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -37,29 +37,51 @@ Configure an assistant runtime for one application surface and expose its chat a
 
 - Id: `assistant/assistant-surface`
 - Keywords: `ai`, `assistant`, `chat`, `config`, `environment`, `page`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/assistant-runtime@0.1.232`
+- Owner: `@jskit-ai/assistant-runtime@0.1.233`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/assistant/assistant-surface/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/assistant/assistant-surface/example/)
 - Requires: `@jskit-ai/assistant-runtime`, `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`, `@jskit-ai/shell-web`
 
+## Accounts hub
+
+Run one OpenID Connect sign-in for all of an owner's apps as its own JSKIT project, with production apps approved by the owner.
+
+- Id: `auth/accounts-hub`
+- Keywords: `accounts hub`, `auth`, `authentication`, `issuer`, `master login`, `oidc`, `openid connect`, `single sign-on`, `sso`
+- Owner: `@jskit-ai/oidc-issuer-core@0.1.0`
+- Read: [PATTERN.md](../../skills/jskit/references/patterns/auth/accounts-hub/PATTERN.md)
+- Examples: [example/](../../skills/jskit/references/patterns/auth/accounts-hub/example/)
+- Requires: `@jskit-ai/oidc-issuer-core`
+
 ## Authentication surface
 
 Compose JSKIT authentication routes, views, profile controls, and public surface configuration without generated source.
 
 - Id: `auth/auth-surface`
 - Keywords: `account`, `auth`, `login`, `logout`, `password`, `placement`, `profile`, `reset`, `surface`
-- Owner: `@jskit-ai/auth-web@0.1.245`
+- Owner: `@jskit-ai/auth-web@0.1.246`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/auth/auth-surface/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/auth/auth-surface/example/)
 - Requires: `@jskit-ai/auth-core`, `@jskit-ai/auth-web`, `@jskit-ai/shell-web`
 
+## Sign in through an OIDC issuer
+
+Let people sign in with the accounts they already have in an accounts hub or another OpenID Connect issuer, instead of app-local passwords.
+
+- Id: `auth/oidc-sign-in`
+- Keywords: `accounts hub`, `auth`, `authentication`, `back-channel logout`, `dynamic client registration`, `issuer`, `master login`, `oidc`, `openid connect`, `single sign-on`, `sso`
+- Owner: `@jskit-ai/auth-provider-oidc-core@0.1.0`
+- Read: [PATTERN.md](../../skills/jskit/references/patterns/auth/oidc-sign-in/PATTERN.md)
+- Examples: [example/](../../skills/jskit/references/patterns/auth/oidc-sign-in/example/)
+- Requires: `@jskit-ai/auth-provider-oidc-core`, `@jskit-ai/auth-web`
+
 ## Supabase authentication
 
 Add Supabase authentication through normal npm composition, explicit environment values, and app-owned auth policy.
 
 - Id: `auth/supabase-auth`
 - Keywords: `auth`, `authentication`, `oauth`, `sessions`, `supabase`
-- Owner: `@jskit-ai/auth-provider-supabase-core@0.1.241`
+- Owner: `@jskit-ai/auth-provider-supabase-core@0.1.242`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/auth/supabase-auth/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/auth/supabase-auth/example/)
 - Requires: `@jskit-ai/auth-provider-supabase-core`
@@ -70,7 +92,7 @@ Resolve an administrator environment key or an individual user's grant, then use
 
 - Id: `connectors/ai-connections`
 - Keywords: `ai`, `api-key`, `cli`, `environment`, `free`, `models`, `ownership`, `zai`, `zen`
-- Owner: `@jskit-ai/connectors-catalog@0.1.62`
+- Owner: `@jskit-ai/connectors-catalog@0.1.63`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/ai-connections/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/ai-connections/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -81,7 +103,7 @@ Compose provider operations, authorization and encrypted file storage from a CLI
 
 - Id: `connectors/api-key-connection`
 - Keywords: `api-key`, `clay`, `cli`, `clickhouse`, `connectors`, `dbt`, `files`, `firecrawl`, `granola`, `integrations`, `metrics`, `prestashop`, `resend`, `semantic-layer`, `semrush`, `x-twitter`
-- Owner: `@jskit-ai/connectors-catalog@0.1.62`
+- Owner: `@jskit-ai/connectors-catalog@0.1.63`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/api-key-connection/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/api-key-connection/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -92,7 +114,7 @@ Compose token-based MCP discovery and explicitly authorized tool calls using the
 
 - Id: `connectors/assistant-mcp`
 - Keywords: `assistant`, `cli`, `connectors`, `files`, `integrations`, `mcp`, `n8n`, `sanity`
-- Owner: `@jskit-ai/connectors-catalog@0.1.62`
+- Owner: `@jskit-ai/connectors-catalog@0.1.63`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/assistant-mcp/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/assistant-mcp/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -103,7 +125,7 @@ Configure assistant OAuth clients, then compose existing state, encrypted file g
 
 - Id: `connectors/assistant-mcp-oauth`
 - Keywords: `amplitude`, `assistant`, `atlassian`, `canva`, `cli`, `client metadata`, `confidence`, `connectors`, `figma`, `files`, `granola`, `hex`, `mcp`, `miro`, `oauth`
-- Owner: `@jskit-ai/connectors-catalog@0.1.62`
+- Owner: `@jskit-ai/connectors-catalog@0.1.63`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/assistant-mcp-oauth/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/assistant-mcp-oauth/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -114,7 +136,7 @@ Compose signed AWS operations, file configuration and application authorization
 
 - Id: `connectors/aws-storage-queries`
 - Keywords: `athena`, `aws`, `cli`, `connectors`, `files`, `iam`, `queries`, `s3`, `storage`, `sts`
-- Owner: `@jskit-ai/connectors-catalog@0.1.62`
+- Owner: `@jskit-ai/connectors-catalog@0.1.63`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/aws-storage-queries/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/aws-storage-queries/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -125,7 +147,7 @@ Compose reusable connection libraries with portable configuration, application o
 
 - Id: `connectors/calendar-cli`
 - Keywords: `calendar`, `cli`, `connectors`, `google`, `integrations`, `oauth`, `permissions`
-- Owner: `@jskit-ai/connector-google-calendar@0.1.61`
+- Owner: `@jskit-ai/connector-google-calendar@0.1.62`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/calendar-cli/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/calendar-cli/example/)
 - Requires: `@jskit-ai/connector-google-calendar`, `@jskit-ai/connectors-core`, `@jskit-ai/database-runtime-mysql`
@@ -136,7 +158,7 @@ Compose the shared connector runtime for event delivery while leaving workflow c
 
 - Id: `connectors/event-delivery`
 - Keywords: `cli`, `connectors`, `events`, `files`, `inngest`, `integrations`, `workflows`
-- Owner: `@jskit-ai/connectors-catalog@0.1.62`
+- Owner: `@jskit-ai/connectors-catalog@0.1.63`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/event-delivery/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/event-delivery/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -147,7 +169,7 @@ Wire service-account grants, file storage, explicit message actions and public b
 
 - Id: `connectors/firebase-messaging`
 - Keywords: `cli`, `connectors`, `fcm`, `files`, `firebase`, `integrations`, `jwt`, `notifications`, `push`, `service-account`, `vapid`
-- Owner: `@jskit-ai/connectors-catalog@0.1.62`
+- Owner: `@jskit-ai/connectors-catalog@0.1.63`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/firebase-messaging/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/firebase-messaging/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -158,7 +180,7 @@ Compose reviewed Search campaigns with project-owned Google OAuth and portable s
 
 - Id: `connectors/google-ads-search`
 - Keywords: `ads`, `campaigns`, `cli`, `connectors`, `conversion`, `google`, `search`
-- Owner: `@jskit-ai/connectors-catalog@0.1.62`
+- Owner: `@jskit-ai/connectors-catalog@0.1.63`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/google-ads-search/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/google-ads-search/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -169,7 +191,7 @@ Compose provider consent, verification and encrypted file persistence from an ap
 
 - Id: `connectors/oauth-connection`
 - Keywords: `accounting`, `assistant permissions`, `books`, `cli`, `client credentials`, `connectors`, `consent`, `crm`, `databricks`, `developer token`, `fabric`, `files`, `gaql`, `google ads`, `graphql`, `integrations`, `linkedin`, `microsoft`, `oauth`, `powerpoint`, `salesforce`, `service principal`, `shopify`, `soql`, `staffing`, `tiktok`, `twitch`, `wave`, `word`, `wordpress`, `workday`, `xero`, `zoho`
-- Owner: `@jskit-ai/connectors-catalog@0.1.62`
+- Owner: `@jskit-ai/connectors-catalog@0.1.63`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/oauth-connection/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/oauth-connection/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -180,7 +202,7 @@ Compose a sequential catalogue batch and preserve partial success for applicatio
 
 - Id: `connectors/paddle-catalogue`
 - Keywords: `batch`, `paddle`, `payments`, `prices`, `products`
-- Owner: `@jskit-ai/connectors-catalog@0.1.62`
+- Owner: `@jskit-ai/connectors-catalog@0.1.63`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/paddle-catalogue/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/paddle-catalogue/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -191,7 +213,7 @@ Resolve a publishable image key deliberately and use the shared URL library in a
 
 - Id: `connectors/public-image`
 - Keywords: `cli`, `connectors`, `files`, `images`, `integrations`, `logo-dev`, `public-key`
-- Owner: `@jskit-ai/connectors-catalog@0.1.62`
+- Owner: `@jskit-ai/connectors-catalog@0.1.63`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/public-image/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/public-image/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -202,7 +224,7 @@ Compose file configuration, Redshift Data API operations and application query o
 
 - Id: `connectors/redshift-queries`
 - Keywords: `aws`, `cli`, `connectors`, `files`, `iam`, `provisioned`, `redshift`, `serverless`, `sql`, `warehouse`
-- Owner: `@jskit-ai/connectors-catalog@0.1.62`
+- Owner: `@jskit-ai/connectors-catalog@0.1.63`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/redshift-queries/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/redshift-queries/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -213,7 +235,7 @@ Use the shared scanner runtime from a CLI or a host worker with portable configu
 
 - Id: `connectors/source-scanning`
 - Keywords: `cancellation`, `cli`, `connectors`, `integrations`, `scanning`, `security`, `source`, `wiz`, `worker`
-- Owner: `@jskit-ai/connectors-catalog@0.1.62`
+- Owner: `@jskit-ai/connectors-catalog@0.1.63`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/connectors/source-scanning/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/connectors/source-scanning/example/)
 - Requires: `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`
@@ -224,7 +246,7 @@ Add a protected administration surface, settings shell, and semantic navigation
 
 - Id: `console/console-surface`
 - Keywords: `admin`, `console`, `navigation`, `owner`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/console-web@0.1.213`
+- Owner: `@jskit-ai/console-web@0.1.214`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/console/console-surface/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/console/console-surface/example/)
 - Requires: `@jskit-ai/console-core`, `@jskit-ai/console-web`, `@jskit-ai/shell-web`
@@ -235,7 +257,7 @@ Build a routed CRUD user interface as thin application pages over JSKIT's shared
 
 - Id: `crud/crud-screen-set`
 - Keywords: `actions`, `add`, `crud`, `delete`, `edit`, `filters`, `list`, `material`, `routes`, `view`, `vue`
-- Owner: `@jskit-ai/http-web@0.1.90`
+- Owner: `@jskit-ai/http-web@0.1.91`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/crud/crud-screen-set/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/crud/crud-screen-set/example/)
 - Requires: `@jskit-ai/http-web`, `@jskit-ai/resource-crud-core`
@@ -246,7 +268,7 @@ Build a complete application-owned CRUD server package from a migration, resourc
 
 - Id: `crud/json-api-resource-package`
 - Keywords: `actions`, `crud`, `database`, `json-api`, `migration`, `permissions`, `provider`, `repository`, `routes`, `service`
-- Owner: `@jskit-ai/crud-core@0.1.255`
+- Owner: `@jskit-ai/crud-core@0.1.256`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/crud/json-api-resource-package/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/crud/json-api-resource-package/example/)
 - Requires: `@jskit-ai/crud-core`, `@jskit-ai/resource-crud-core`
@@ -257,7 +279,7 @@ Define an authenticated application resource whose records belong to the current
 
 - Id: `crud/resource-contract`
 - Keywords: `authenticated`, `crud`, `database`, `owner-scoped`, `resource`, `user`
-- Owner: `@jskit-ai/resource-crud-core@0.1.186`
+- Owner: `@jskit-ai/resource-crud-core@0.1.187`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/crud/resource-contract/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/crud/resource-contract/example/)
 - Requires: `@jskit-ai/resource-crud-core`
@@ -268,7 +290,7 @@ Configure a JSKIT application for MySQL with a fixed driver, ordinary environmen
 
 - Id: `database/mysql-application`
 - Keywords: `database`, `knex`, `mariadb`, `migrations`, `mysql`, `mysql2`
-- Owner: `@jskit-ai/database-runtime-mysql@0.1.242`
+- Owner: `@jskit-ai/database-runtime-mysql@0.1.243`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/database/mysql-application/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/database/mysql-application/example/)
 - Requires: `@jskit-ai/database-runtime-mysql`
@@ -279,7 +301,7 @@ Configure a JSKIT application for PostgreSQL with a fixed driver, ordinary envir
 
 - Id: `database/postgres-application`
 - Keywords: `database`, `knex`, `migrations`, `pg`, `postgres`, `postgresql`
-- Owner: `@jskit-ai/database-runtime-postgres@0.1.241`
+- Owner: `@jskit-ai/database-runtime-postgres@0.1.242`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/database/postgres-application/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/database/postgres-application/example/)
 - Requires: `@jskit-ai/database-runtime-postgres`
@@ -290,7 +312,7 @@ Wrap a JSKIT web application in a Capacitor Android shell using native Capacitor
 
 - Id: `mobile/android-application`
 - Keywords: `android`, `capacitor`, `device`, `mobile`, `native`, `shell`, `webview`
-- Owner: `@jskit-ai/mobile-capacitor@0.1.180`
+- Owner: `@jskit-ai/mobile-capacitor@0.1.181`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/mobile/android-application/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/mobile/android-application/example/)
 - Requires: `@capacitor/android`, `@capacitor/app`, `@capacitor/cli`, `@jskit-ai/mobile-capacitor`
@@ -301,7 +323,7 @@ Add JSKIT realtime events with an optional Redis backplane and an explicit shell
 
 - Id: `realtime/realtime-application`
 - Keywords: `realtime`, `redis`, `socket.io`, `sockets`, `status`, `websocket`
-- Owner: `@jskit-ai/realtime@0.1.242`
+- Owner: `@jskit-ai/realtime@0.1.243`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/realtime/realtime-application/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/realtime/realtime-application/example/)
 - Requires: `@jskit-ai/realtime`, `@jskit-ai/shell-web`
@@ -312,7 +334,7 @@ Compose application-owned Google Publisher Tag delivery with the generic rewarde
 
 - Id: `rewards/google-rewarded`
 - Keywords: `ads`, `google`, `publisher tag`, `rewarded`, `unlock`
-- Owner: `@jskit-ai/rewarded-web@0.1.181`
+- Owner: `@jskit-ai/rewarded-web@0.1.182`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/rewards/google-rewarded/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/rewards/google-rewarded/example/)
 - Requires: `@jskit-ai/rewarded-web`
@@ -323,7 +345,7 @@ Define a server feature through explicit capabilities and first-class actions, a
 
 - Id: `server/feature-package`
 - Keywords: `actions`, `feature`, `json-rest`, `knex`, `orchestration`, `package`, `provider`, `repository`, `routes`, `server`
-- Owner: `@jskit-ai/agent-docs@0.1.238`
+- Owner: `@jskit-ai/agent-docs@0.1.240`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/server/feature-package/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/server/feature-package/example/)
 - Requires: `@jskit-ai/kernel`
@@ -334,7 +356,7 @@ Compose the JSKIT responsive shell, semantic placements, settings navigation, an
 
 - Id: `shell/application-shell`
 - Keywords: `adaptive`, `app`, `layout`, `navigation`, `placement`, `responsive`, `settings`, `shell`
-- Owner: `@jskit-ai/shell-web@0.1.249`
+- Owner: `@jskit-ai/shell-web@0.1.250`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/shell/application-shell/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/shell/application-shell/example/)
 - Requires: `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -345,7 +367,7 @@ Add product routes and shell extensions through file routing, semantic placement
 
 - Id: `ui/page-and-placement`
 - Keywords: `component`, `navigation`, `outlet`, `page`, `placement`, `routes`, `section`, `shell`, `subpages`, `vue`
-- Owner: `@jskit-ai/shell-web@0.1.249`
+- Owner: `@jskit-ai/shell-web@0.1.250`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/ui/page-and-placement/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/ui/page-and-placement/example/)
 - Requires: `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -356,7 +378,7 @@ Compose an account settings route and profile, preference, and notification sect
 
 - Id: `users/account-settings`
 - Keywords: `account`, `notifications`, `preferences`, `profile`, `settings`, `user`, `vue`
-- Owner: `@jskit-ai/users-web@0.1.263`
+- Owner: `@jskit-ai/users-web@0.1.264`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/users/account-settings/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/users/account-settings/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/users-core`, `@jskit-ai/users-web`
@@ -367,7 +389,7 @@ Expose user administration and workspace-scoped member operations through app-ow
 
 - Id: `users/user-administration-server`
 - Keywords: `account`, `admin`, `member`, `repository`, `resource`, `routes`, `service`, `user`, `workspace`
-- Owner: `@jskit-ai/users-core@0.1.257`
+- Owner: `@jskit-ai/users-core@0.1.258`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/users/user-administration-server/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/users/user-administration-server/example/)
 - Requires: `@jskit-ai/crud-core`, `@jskit-ai/users-core`
@@ -378,7 +400,7 @@ Configure roles, workspace access policy, invitations, and app-owned invitation
 
 - Id: `workspaces/workspace-server`
 - Keywords: `access`, `invite`, `membership`, `multitenancy`, `policy`, `role`, `tenancy`, `workspace`
-- Owner: `@jskit-ai/workspaces-core@0.1.222`
+- Owner: `@jskit-ai/workspaces-core@0.1.223`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/workspaces/workspace-server/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/workspaces/workspace-server/example/)
 - Requires: `@jskit-ai/users-core`, `@jskit-ai/workspaces-core`
@@ -389,7 +411,7 @@ Compose workspace selection, invitation, member administration, settings, and re
 
 - Id: `workspaces/workspace-surfaces`
 - Keywords: `admin`, `invite`, `member`, `navigation`, `settings`, `surface`, `switcher`, `workspace`
-- Owner: `@jskit-ai/workspaces-web@0.1.224`
+- Owner: `@jskit-ai/workspaces-web@0.1.225`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/workspaces/workspace-surfaces/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/workspaces/workspace-surfaces/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/workspaces-core`, `@jskit-ai/workspaces-web`

package/reference/autogen/README.md

@@ -19,6 +19,7 @@ AI-first source patterns are indexed in `PATTERN_INDEX.md`.
 - [auth-core](/packages/agent-docs/reference/autogen/packages/auth-core.md)
 - [auth-provider-local-core](/packages/agent-docs/reference/autogen/packages/auth-provider-local-core.md)
 - [auth-provider-local-db-core](/packages/agent-docs/reference/autogen/packages/auth-provider-local-db-core.md)
+- [auth-provider-oidc-core](/packages/agent-docs/reference/autogen/packages/auth-provider-oidc-core.md)
 - [auth-provider-supabase-core](/packages/agent-docs/reference/autogen/packages/auth-provider-supabase-core.md)
 - [auth-web](/packages/agent-docs/reference/autogen/packages/auth-web.md)
 - [connector-google-calendar](/packages/agent-docs/reference/autogen/packages/connector-google-calendar.md)
@@ -36,6 +37,7 @@ AI-first source patterns are indexed in `PATTERN_INDEX.md`.
 - [json-rest-api-core](/packages/agent-docs/reference/autogen/packages/json-rest-api-core.md)
 - [kernel](/packages/agent-docs/reference/autogen/packages/kernel.md)
 - [mobile-capacitor](/packages/agent-docs/reference/autogen/packages/mobile-capacitor.md)
+- [oidc-issuer-core](/packages/agent-docs/reference/autogen/packages/oidc-issuer-core.md)
 - [payments-core](/packages/agent-docs/reference/autogen/packages/payments-core.md)
 - [payments-web](/packages/agent-docs/reference/autogen/packages/payments-web.md)
 - [realtime](/packages/agent-docs/reference/autogen/packages/realtime.md)

package/reference/autogen/packages/auth-core.md

@@ -197,6 +197,7 @@ Exports
 
 ### `src/server/utils.js`
 Exports
+- `hostOnlyCookieName(name, secure)`
 - `normalizeEmail(value)`
 - `normalizeOAuthIntent(value, { fallback = "login" } = {})`
 - `normalizeReturnToPath(value, { fallback = "/", allowedOrigins = [] } = {})`

package/reference/autogen/packages/auth-provider-oidc-core.md

@@ -0,0 +1,144 @@
+# packages/auth-provider-oidc-core
+
+Generated by `npm run agent-docs:build`.
+Do not edit manually.
+
+Generated inventory for `packages/auth-provider-oidc-core`.
+Use this on demand; do not load the full index at startup.
+
+## Scope
+- Source: `packages/auth-provider-oidc-core/**/*{.js,.mjs,.cjs,.vue}`
+- Excludes: `test/`, `tests/`, `__tests__/`, `*.test.*`, `*.spec.*`, `*.vitest.*`, `node_modules/`, `dist/`, `coverage/`, `docs/`, `.vitepress/cache/`, `.vitepress/dist/`
+
+## Sections
+
+### src
+
+### `src/server/lib/backchannelLogout.js`
+Exports
+- `BACKCHANNEL_LOGOUT_EVENT`
+- `BackchannelLogoutError`
+- `createBackchannelLogout({ config, store, issuer, fetchImpl = null, now = Date.now })`
+
+### `src/server/lib/config.js`
+Exports
+- `isLoopbackHostname(hostname)`
+- `resolveOidcConfig({ env = {}, appRoot = process.cwd() } = {})`
+Local functions
+- `text(value)`
+- `parseAddress(value, name)`
+- `resolveAppName(appRoot)`
+- `resolveSessionSecret(env, { appRoot, isProduction })`
+
+### `src/server/lib/index.js`
+Exports
+- `createBackchannelLogout`
+- `resolveOidcConfig`
+- `createIssuerClient`
+- `registrationMetadata`
+- `adoptOidcAccounts`
+- `exportLocalAccounts`
+- `createOidcAuthService`
+- `createOidcStore`
+
+### `src/server/lib/issuer.js`
+Exports
+- `createIssuerClient({ config, store, logger = null, fetchImpl = null, now = Date.now })`
+- `registrationMetadata(origin, appName)`
+Local functions
+- `unreachable(error, logger)`
+
+### `src/server/lib/localAccounts.js`
+Exports
+- `adoptOidcAccounts({ knex, file, apply = false })`
+- `exportLocalAccounts({ knex, out })`
+Local functions
+- `isTruthy(value)`
+- `readExportedIds(file)`
+
+### `src/server/lib/routes.js`
+Exports
+- `registerOidcRoutes(fastify, { authService, backchannelLogout })`
+Local functions
+- `parseForm(_request, body, done)`
+- `isCrossSiteNavigation(request)`
+
+### `src/server/lib/service.js`
+Exports
+- `SESSION_COOKIE`
+- `createOidcAuthService({ config, store, issuer, profileProjector = null, logger = null, now = Date.now })`
+Local functions
+- `sha256(value)`
+- `cookiesOf(request)`
+- `firstHeader(value)`
+- `isLoopbackPeer(request)`
+- `unauthenticated(clearSession = false)`
+- `displayNameFrom(claims, email)`
+- `buildProfile(identity)`
+- `buildResult(identity, { session = null, appProfile = null } = {})`
+
+### `src/server/lib/store.js`
+Exports
+- `TABLES`
+- `createOidcStore({ knex, now = Date.now })`
+Local functions
+- `toDate(value)`
+- `isExpired(value, now)`
+- `mapClient(row)`
+- `mapSession(row)`
+- `isDuplicateError(error)`
+
+### `src/server/lib/transactionCookie.js`
+Exports
+- `TRANSACTION_COOKIE`
+- `createTransactionSealer({ secret, now = Date.now })`
+- `transactionCookieOptions(secure, maxAge = TRANSACTION_TTL_SECONDS)`
+Local functions
+- `transactionKey(secret)`
+
+### `src/server/providers/AuthOidcProvider.js`
+Exports
+- `AuthOidcProvider`
+
+### `src/shared/index.js`
+Exports
+- `AUTH_OIDC_BACKCHANNEL_LOGOUT_PATH`
+- `AUTH_OIDC_DEFAULT_LABEL`
+- `AUTH_OIDC_LOGOUT_PATH`
+- `AUTH_OIDC_PROVIDER_ID`
+- `AUTH_OIDC_REDIRECT_PATH`
+
+### bin
+
+### `bin/jskit-oidc-sign-in.js`
+Exports
+- None
+Local functions
+- `appKnex()`
+- `sameAddress(left, right)`
+- `main(argv)`
+
+### migrations
+
+### `migrations/auth_oidc_initial.cjs`
+Exports
+- None
+
+### test-support
+
+### `test-support/harness.js`
+Exports
+- `APP_ORIGIN`
+- `createRelyingParty({ issuer, env = {}, fetchImpl = null, now = Date.now } = {})`
+- `requestAt(origin = APP_ORIGIN, cookies = {})`
+- `signInAtIssuer(rp, { origin = APP_ORIGIN, returnTo = "/home" } = {})`
+Local functions
+- `createDatabase()`
+- `createProfileProjector(knex)`
+
+### `test-support/mockIssuer.js`
+Exports
+- `ACCOUNT`
+- `REGISTRATION_TOKEN`
+- `followAuthorization(url, { redirectPrefix })`
+- `startMockIssuer({ blocked = false, account = ACCOUNT, staticClients = [] } = {})`

package/reference/autogen/packages/auth-web.md

@@ -88,6 +88,8 @@ Exports
 - `AuthProfileMenuLinkItem`
 - `useAuthStore`
 - `useAuthGuardRuntime`
+- `completeOAuthPopupSignIn`
+- `createPopupOAuthLaunchClient`
 - `completeOAuthCallbackFromCurrentLocation`
 - `completeOAuthCallbackFromUrl`
 - `readOAuthCallbackParamsFromUrl`
@@ -191,6 +193,20 @@ Exports
 - `stripPasswordRecoveryCallbackParamsFromLocation()`
 - `stripPasswordRecoveryCallbackParamsFromUrl(url = "")`
 
+### `src/client/runtime/popupOAuthLaunchClient.js`
+Exports
+- `OAUTH_POPUP_BLOCKED_MESSAGE`
+- `OAUTH_POPUP_MESSAGE_TYPE`
+- `completeOAuthPopupSignIn(win = browserWindow())`
+- `createPopupOAuthLaunchClient({ window: win = browserWindow(), fallback = createBrowserOAuthLaunchClient(), onComplete = null } = {})`
+- `isFramedWindow(win)`
+Local functions
+- `browserWindow()`
+- `storageOf(win)`
+- `popupFeatures(win, width = 520, height = 680)`
+- `openChannel(win)`
+- `sameOriginOpener(win)`
+
 ### `src/client/runtime/useLoginView.js`
 Exports
 - `useLoginView()`

package/reference/autogen/packages/kernel.md

@@ -265,6 +265,7 @@ Exports
 - `resolveAllowedOriginsFromSurfaceDefinitions(surfaceDefinitions = {}, { seedOrigins = [] } = {})`
 - `resolveAllowedOriginsFromPlacementContext(contextValue = null, { includeWindowOrigin = true } = {})`
 Local functions
+- `staysOnSameOrigin(path)`
 - `appendNormalizedOrigin(origins, value)`
 - `normalizeBlockedPathnames(blockedPathnames = [])`
 
@@ -536,6 +537,7 @@ Exports
 - `registerMobileLaunchRouting`
 - `resolveClientBootstrapDebugEnabled`
 - `createShellRouter`
+- `shellScrollBehavior`
 - `bootstrapClientShellApp`
 - `createComponentInteractionEmitter`
 
@@ -588,12 +590,15 @@ Local functions
 
 ### `client/shellBootstrap.js`
 Exports
+- `shellScrollBehavior(to, from, savedPosition)`
 - `resolveClientBootstrapDebugEnabled({ env = {}, debugEnabled = undefined, debugEnvKey = "VITE_JSKIT_CLIENT_DEBUG" } = {})`
 - `createClientBootstrapLogger({ env = {}, logger = console, debugEnabled = undefined, debugEnvKey = "VITE_JSKIT_CLIENT_DEBUG" } = {})`
-- `createSurfaceShellRouter({ createRouter, history, routes = [], surfaceRuntime, surfaceMode, fallbackRoute = null, notFoundComponent = null, guard = false } = {})`
+- `createSurfaceShellRouter({ createRouter, history, routes = [], surfaceRuntime, surfaceMode, fallbackRoute = null, notFoundComponent = null, guard = false, scrollBehavior = shellScrollBehavior } = {})`
 - `bootstrapClientShellApp({ createApp, rootComponent, appConfig = {}, appPlugins = [], pinia = null, queryClient = null, router, bootClientModules, surfaceRuntime, surfaceMode, env = {}, fallbackRoute = null, logger = console, createBootstrapLogger = null, debugEnabled = undefined, debugEnvKey = "VITE_JSKIT_CLIENT_DEBUG", debugMessage = "Client modules bootstrapped before router install.", onAfterModulesBootstrapped = null, onAfterRouterReady = null, mountSelector = "#app" } = {})`
 Local functions
 - `installAppPlugins(app, appPlugins = [])`
+- `isSurfaceRootRecord(record)`
+- `staysOnSamePage(to, from)`
 
 ### `client/shellRouting.js`
 Exports