@jskit-ai/agent-docs 0.1.251 → 0.1.252

package/guide/agent/app-extras/realtime.md

@@ -46,9 +46,17 @@ rejects unauthenticated handshakes before a socket joins any broadcast room.
 Clients must disconnect and reconnect after their login identity changes so a
 new handshake establishes the current actor.
 
-When `auth.service.authenticateRequest()` is present, delivery reauthenticates
-each socket before sending and rechecks idle sockets every 30 seconds. Revoked,
-expired, or changed actors are disconnected. Authentication lookup errors fail
+When `auth.service.authenticateRequest()` is present, each publish reauthenticates
+every socket that could receive it before sending, and every socket is rechecked
+every 30 seconds. A socket could receive a publish when the audience is
+`all_clients` or `broadcast`, when it is already in a target room, or, when an
+audience contributor is registered, when a target room is a user or workspace
+room it could join on revalidation. Other sockets are not checked for that
+publish. Sockets whose authentication requests are identical, such as tabs of
+one browser, share one `authenticateRequest()` call within a publish or a
+30-second pass; nothing is reused from one publish or pass to the next. Revoked,
+expired, or changed actors are disconnected by the first publish that could
+reach them or the next 30-second check. Authentication lookup errors fail
 closed.
 
 Packages that know which scopes an actor belongs to contribute them through

package/guide/agent/app-setup/authentication.md

@@ -131,6 +131,64 @@ or compatibility adapter.
    the completed password-reset flow before releasing the updated application.
    This change does not alter identity, session or recovery-token storage.
 
+## Google, Microsoft and GitHub sign-in with local auth
+
+Local auth signs people in through Google, Microsoft and GitHub when the
+application sets each provider's client id and secret in private Env:
+
+| Provider | Env pair | Protocol and scopes |
+| --- | --- | --- |
+| Google | `AUTH_GOOGLE_CLIENT_ID`, `AUTH_GOOGLE_CLIENT_SECRET` | OpenID Connect discovery, `openid email profile` |
+| Microsoft | `AUTH_MICROSOFT_CLIENT_ID`, `AUTH_MICROSOFT_CLIENT_SECRET` | OpenID Connect discovery through the `common` endpoint, `openid email profile` |
+| GitHub | `AUTH_GITHUB_CLIENT_ID`, `AUTH_GITHUB_CLIENT_SECRET` | OAuth 2.0, `read:user user:email`, email from `GET /user/emails` |
+
+A provider appears in `oauthLogin.providers` only when both values of its pair
+are set; setting one without the other stops startup. `APP_PUBLIC_URL` is then
+required, and every provider's app registration must allow exactly
+`${APP_PUBLIC_URL}/auth/login` as its redirect address. The login page posts the
+callback to `/api/oauth/complete`, which completes the provider the attempt
+started with.
+
+Register the Microsoft app for accounts in any organizational directory and
+personal Microsoft accounts, and add the optional ID token claim `xms_edov`.
+
+Security behavior:
+
+- The authorization-code flow uses PKCE (`S256`) and `state`, plus `nonce` for
+  OpenID Connect. The attempt is stored server-side, in the file store or the
+  `auth_local_oauth_attempts` table, under the hash of a random httpOnly
+  `jskit_local_oauth_attempt` cookie (`__Host-` in production), so it completes
+  only in the starting browser and works across several servers. It is deleted
+  when used and expires after ten minutes.
+- ID tokens are verified against the provider's JWKS: signature, issuer,
+  audience, expiry and nonce.
+- Only a verified email signs in: Google's `email_verified`, GitHub's primary
+  verified address, and for Microsoft a personal account or a work or school
+  account whose token carries `xms_edov: true`. A Microsoft token without an
+  email claim is refused.
+- `returnTo` must be on the application's own origin; anything else returns to
+  `/`.
+
+A sign-in matches the provider subject first. Otherwise a verified email that
+matches an existing user signs that user in and links the provider identity,
+and a new email creates the user the way `register` does: the
+`auth.local.user.registered` hook runs and profile synchronization provisions
+the personal workspace. An account created this way has no password until
+password recovery sets one. Sessions are ordinary local sessions; provider
+tokens are discarded after sign-in.
+
+With providers configured, the `providerLinking` capability is on. The security
+status lists each provider as an `oauth:<provider>` method, where `canEnable`
+means it can be linked and `canDisable` that it can be unlinked.
+`GET /api/settings/security/oauth/:provider/start` links a provider to the
+signed-in account and `DELETE /api/settings/security/oauth/:provider` unlinks
+it. Unlinking the last sign-in method is refused, and so is linking an identity
+that already belongs to another account. The `users/account-settings` pattern's
+sign-in methods section offers both.
+
+With `@jskit-ai/auth-provider-local-db-core`, run `npm run db:migrate` to create
+the `auth_local_identities` and `auth_local_oauth_attempts` tables.
+
 ## Browser boundary
 
 `@jskit-ai/auth-web` owns the normal auth views, guard runtime, sign-out flow,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/agent-docs",
-  "version": "0.1.251",
+  "version": "0.1.252",
   "description": "Distributed JSKIT agent references, prompts, guides, and generated reference maps.",
   "type": "module",
   "files": [

package/patterns/minimal-foundation/example/package.json

@@ -48,7 +48,7 @@
   },
   "devDependencies": {
     "@jskit-ai/config-eslint": "0.1.241",
-    "@jskit-ai/jskit-catalog": "0.2.3",
+    "@jskit-ai/jskit-catalog": "0.2.4",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/patterns/shell-foundation/example/package.json

@@ -50,7 +50,7 @@
   },
   "devDependencies": {
     "@jskit-ai/config-eslint": "0.1.241",
-    "@jskit-ai/jskit-catalog": "0.2.3",
+    "@jskit-ai/jskit-catalog": "0.2.4",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/reference/autogen/PATTERN_INDEX.md

@@ -15,7 +15,7 @@ A concrete Fastify, Vue, and JSKIT application foundation for products that do n
 
 - Id: `app/minimal-foundation`
 - Keywords: `app`, `fastify`, `foundation`, `minimal`, `server`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.251`
+- Owner: `@jskit-ai/agent-docs@0.1.252`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/app/minimal-foundation/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/app/minimal-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`
@@ -26,7 +26,7 @@ A concrete JSKIT web application foundation with responsive shell navigation, se
 
 - Id: `app/shell-foundation`
 - Keywords: `app`, `foundation`, `material`, `navigation`, `placements`, `shell`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.251`
+- Owner: `@jskit-ai/agent-docs@0.1.252`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/app/shell-foundation/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/app/shell-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -37,7 +37,7 @@ Configure an assistant runtime for one application surface and expose its chat a
 
 - Id: `assistant/assistant-surface`
 - Keywords: `ai`, `assistant`, `chat`, `config`, `environment`, `page`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/assistant-runtime@0.2.3`
+- Owner: `@jskit-ai/assistant-runtime@0.2.4`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/assistant/assistant-surface/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/assistant/assistant-surface/example/)
 - Requires: `@jskit-ai/assistant-runtime`, `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`, `@jskit-ai/shell-web`
@@ -48,7 +48,7 @@ Run one OpenID Connect sign-in for all of an owner's apps as its own JSKIT proje
 
 - Id: `auth/accounts-hub`
 - Keywords: `accounts hub`, `auth`, `authentication`, `issuer`, `master login`, `oidc`, `openid connect`, `single sign-on`, `sso`
-- Owner: `@jskit-ai/oidc-issuer-core@0.1.6`
+- Owner: `@jskit-ai/oidc-issuer-core@0.1.7`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/auth/accounts-hub/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/auth/accounts-hub/example/)
 - Requires: `@jskit-ai/oidc-issuer-core`
@@ -70,7 +70,7 @@ Let people sign in with the accounts they already have in an accounts hub or ano
 
 - Id: `auth/oidc-sign-in`
 - Keywords: `accounts hub`, `auth`, `authentication`, `back-channel logout`, `dynamic client registration`, `issuer`, `master login`, `oidc`, `openid connect`, `single sign-on`, `sso`
-- Owner: `@jskit-ai/auth-provider-oidc-core@0.2.1`
+- Owner: `@jskit-ai/auth-provider-oidc-core@0.2.2`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/auth/oidc-sign-in/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/auth/oidc-sign-in/example/)
 - Requires: `@jskit-ai/auth-provider-oidc-core`, `@jskit-ai/auth-web`
@@ -246,7 +246,7 @@ Add a protected administration surface, settings shell, and semantic navigation
 
 - Id: `console/console-surface`
 - Keywords: `admin`, `console`, `navigation`, `owner`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/console-web@0.1.221`
+- Owner: `@jskit-ai/console-web@0.1.222`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/console/console-surface/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/console/console-surface/example/)
 - Requires: `@jskit-ai/console-core`, `@jskit-ai/console-web`, `@jskit-ai/shell-web`
@@ -257,7 +257,7 @@ Build a routed CRUD user interface as thin application pages over JSKIT's shared
 
 - Id: `crud/crud-screen-set`
 - Keywords: `actions`, `add`, `crud`, `delete`, `edit`, `filters`, `list`, `material`, `routes`, `view`, `vue`
-- Owner: `@jskit-ai/http-web@0.2.2`
+- Owner: `@jskit-ai/http-web@0.2.3`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/crud/crud-screen-set/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/crud/crud-screen-set/example/)
 - Requires: `@jskit-ai/http-web`, `@jskit-ai/resource-crud-core`
@@ -323,7 +323,7 @@ Add JSKIT realtime events with an optional Redis backplane and an explicit shell
 
 - Id: `realtime/realtime-application`
 - Keywords: `realtime`, `redis`, `socket.io`, `sockets`, `status`, `websocket`
-- Owner: `@jskit-ai/realtime@0.2.1`
+- Owner: `@jskit-ai/realtime@0.2.2`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/realtime/realtime-application/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/realtime/realtime-application/example/)
 - Requires: `@jskit-ai/realtime`, `@jskit-ai/shell-web`
@@ -334,7 +334,7 @@ Compose application-owned Google Publisher Tag delivery with the generic rewarde
 
 - Id: `rewards/google-rewarded`
 - Keywords: `ads`, `google`, `publisher tag`, `rewarded`, `unlock`
-- Owner: `@jskit-ai/rewarded-web@0.2.1`
+- Owner: `@jskit-ai/rewarded-web@0.2.2`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/rewards/google-rewarded/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/rewards/google-rewarded/example/)
 - Requires: `@jskit-ai/rewarded-web`
@@ -345,7 +345,7 @@ Define a server feature through explicit capabilities and first-class actions, a
 
 - Id: `server/feature-package`
 - Keywords: `actions`, `feature`, `json-rest`, `knex`, `orchestration`, `package`, `provider`, `repository`, `routes`, `server`
-- Owner: `@jskit-ai/agent-docs@0.1.251`
+- Owner: `@jskit-ai/agent-docs@0.1.252`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/server/feature-package/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/server/feature-package/example/)
 - Requires: `@jskit-ai/kernel`
@@ -374,11 +374,11 @@ Add product routes and shell extensions through file routing, semantic placement
 
 ## Account settings surface
 
-Compose an account settings route and profile, preference, and notification sections from JSKIT user web components.
+Compose an account settings route and profile, preference, notification, and sign-in method sections from JSKIT user web components.
 
 - Id: `users/account-settings`
-- Keywords: `account`, `notifications`, `preferences`, `profile`, `settings`, `user`, `vue`
-- Owner: `@jskit-ai/users-web@0.2.2`
+- Keywords: `account`, `link provider`, `notifications`, `oauth`, `preferences`, `profile`, `settings`, `sign-in methods`, `user`, `vue`
+- Owner: `@jskit-ai/users-web@0.2.3`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/users/account-settings/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/users/account-settings/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/users-core`, `@jskit-ai/users-web`
@@ -389,7 +389,7 @@ Expose user administration and workspace-scoped member operations through app-ow
 
 - Id: `users/user-administration-server`
 - Keywords: `account`, `admin`, `member`, `repository`, `resource`, `routes`, `service`, `user`, `workspace`
-- Owner: `@jskit-ai/users-core@0.2.1`
+- Owner: `@jskit-ai/users-core@0.2.2`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/users/user-administration-server/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/users/user-administration-server/example/)
 - Requires: `@jskit-ai/crud-core`, `@jskit-ai/users-core`
@@ -400,7 +400,7 @@ Configure roles, workspace access policy, invitations, and app-owned invitation
 
 - Id: `workspaces/workspace-server`
 - Keywords: `access`, `invite`, `membership`, `multitenancy`, `policy`, `role`, `tenancy`, `workspace`
-- Owner: `@jskit-ai/workspaces-core@0.2.1`
+- Owner: `@jskit-ai/workspaces-core@0.2.2`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/workspaces/workspace-server/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/workspaces/workspace-server/example/)
 - Requires: `@jskit-ai/users-core`, `@jskit-ai/workspaces-core`
@@ -411,7 +411,7 @@ Compose workspace selection, invitation, member administration, settings, and re
 
 - Id: `workspaces/workspace-surfaces`
 - Keywords: `admin`, `invite`, `member`, `navigation`, `settings`, `surface`, `switcher`, `workspace`
-- Owner: `@jskit-ai/workspaces-web@0.2.2`
+- Owner: `@jskit-ai/workspaces-web@0.2.3`
 - Read: [PATTERN.md](../../skills/jskit/references/patterns/workspaces/workspace-surfaces/PATTERN.md)
 - Examples: [example/](../../skills/jskit/references/patterns/workspaces/workspace-surfaces/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/workspaces-core`, `@jskit-ai/workspaces-web`

package/reference/autogen/packages/auth-provider-local-core.md

@@ -28,6 +28,10 @@ Local functions
 - `serializeSessions(sessions)`
 - `parseRecovery(content)`
 - `serializeRecovery(records)`
+- `parseIdentities(content)`
+- `serializeIdentities(identities)`
+- `parseOAuthAttempts(content)`
+- `serializeOAuthAttempts(attempts)`
 - `readText(filePath)`
 - `writeAtomic(filePath, content)`
 - `encodeJournalContent(content)`
@@ -53,6 +57,15 @@ Exports
 - `normalizePasswordStrategy`
 - `verifyPassword`
 
+### `src/server/lib/oauth.js`
+Exports
+- `createOAuthClients({ logger = null } = {})`
+- `resolveOAuthProviders(env = {})`
+Local functions
+- `signInError(statusCode, message, { code, provider = null })`
+- `unverifiedSignIn()`
+- `displayNameFrom(source = {})`
+
 ### `src/server/lib/passwords.js`
 Exports
 - `hashPassword(password)`
@@ -83,6 +96,7 @@ Local functions
 - `isDevAuthSession(session)`
 - `isAuthenticatingSession(session)`
 - `normalizeDisplayName(value, email)`
+- `hasPassword(user)`
 - `createId(prefix)`
 - `safeRequestCookies(request)`
 - `unauthenticatedAuthResult(clearSession = false)`
@@ -120,4 +134,19 @@ Exports
 Local functions
 - `resolveStoreDir(env, appRoot)`
 - `resolveSessionSecret(env, { storeDir, isProduction })`
-- `resolveAppPublicUrl(env, { recoverySender })`
+- `resolveAppPublicUrl(env, { recoverySender, oauthProviders })`
+
+### test-support
+
+### `test-support/oauthHarness.js`
+Exports
+- `APP_URL`
+- `ATTEMPT_COOKIE`
+- `approveAtProvider(service, { provider = "google", returnTo = "/home", cookies = {}, link = false } = {})`
+- `createService({ backend, oauthProviders, profileProjector = null })`
+- `oidcProviderEntry(issuer, { id = "google", label = "Google" } = {})`
+- `sessionCookies(session)`
+- `startFakeGitHub({ user = { id: 4242, login: "ada", name: "Ada Lovelace" }, emails } = {})`
+- `startOidcProvider({ account } = {})`
+Local functions
+- `readBody(req)`

package/reference/autogen/packages/auth-provider-local-db-core.md

@@ -29,6 +29,8 @@ Local functions
 - `mapUser(row)`
 - `mapSession(row)`
 - `mapRecovery(row)`
+- `mapIdentity(row)`
+- `mapOAuthAttempt(row)`
 - `userInsert(input = {})`
 - `sessionInsert(input = {})`
 - `recoveryInsert(input = {})`
@@ -48,3 +50,7 @@ Exports
 ### `migrations/auth_local_db_initial.cjs`
 Exports
 - None
+
+### `migrations/auth_local_db_oauth.cjs`
+Exports
+- None

package/reference/autogen/packages/realtime.md

@@ -57,7 +57,7 @@ Exports
 - `createAudienceContributors()`
 - `createSocketRequest(socket)`
 - `realtimeAuthenticationRequired(authService = null)`
-- `revalidateSocket({ socket, authService, audiences = null, request })`
+- `revalidateSocket({ socket, authService, audiences = null, request, authenticateRequest })`
 - `registerSocketAudienceBootstrap({ io, logger, authService = null, audiences = null })`
 - `resolveAudienceTargets(audience, event, { database = null, logger })`
 Local functions
@@ -68,11 +68,12 @@ Local functions
 - `resolveScopeWorkspaceId(scope = {})`
 - `resolveScopeUserId(scope = {})`
 - `roomForScope(scope = {})`
+- `isScopeRoom(room)`
 - `applyAudiencePreset(preset, { event, rooms, flags, logger })`
 - `addAudienceRooms(selection, state)`
 - `collectUserIds(rows)`
 - `parseCookieHeader(value = "")`
-- `resolveSocketActor(authService, socket, request = createSocketRequest(socket))`
+- `resolveSocketActor(authService, socket, request = createSocketRequest(socket), authenticateRequest = (value) => authService.authenticateRequest(value))`
 - `authenticationRequiredError()`
 - `rememberSocketActorId(socket, actorId)`
 - `registerRequiredSocketAuthentication({ io, logger, authService })`
@@ -83,6 +84,7 @@ Exports
 - `createRealtimeDelivery({ io, database = null, logger, authService = null, audiences = null })`
 Local functions
 - `publicRealtimePayload(event)`
+- `createSharedAuthentication(authService)`
 
 ### `src/server/RealtimeProvider.js`
 Exports

package/reference/autogen/packages/users-web.md

@@ -143,6 +143,10 @@ Exports
 Exports
 - None
 
+### `patterns/account-settings/example/src/components/account/settings/AccountSettingsSignInMethodsSection.vue`
+Exports
+- None
+
 ### `patterns/account-settings/example/src/pages/account/index.vue`
 Exports
 - None

package/skills/jskit/references/pattern-index.md

@@ -15,7 +15,7 @@ A concrete Fastify, Vue, and JSKIT application foundation for products that do n
 
 - Id: `app/minimal-foundation`
 - Keywords: `app`, `fastify`, `foundation`, `minimal`, `server`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.251`
+- Owner: `@jskit-ai/agent-docs@0.1.252`
 - Read: [PATTERN.md](patterns/app/minimal-foundation/PATTERN.md)
 - Examples: [example/](patterns/app/minimal-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`
@@ -26,7 +26,7 @@ A concrete JSKIT web application foundation with responsive shell navigation, se
 
 - Id: `app/shell-foundation`
 - Keywords: `app`, `foundation`, `material`, `navigation`, `placements`, `shell`, `vite`, `vue`
-- Owner: `@jskit-ai/agent-docs@0.1.251`
+- Owner: `@jskit-ai/agent-docs@0.1.252`
 - Read: [PATTERN.md](patterns/app/shell-foundation/PATTERN.md)
 - Examples: [example/](patterns/app/shell-foundation/example/)
 - Requires: `@jskit-ai/http-runtime`, `@jskit-ai/kernel`, `@jskit-ai/shell-web`
@@ -37,7 +37,7 @@ Configure an assistant runtime for one application surface and expose its chat a
 
 - Id: `assistant/assistant-surface`
 - Keywords: `ai`, `assistant`, `chat`, `config`, `environment`, `page`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/assistant-runtime@0.2.3`
+- Owner: `@jskit-ai/assistant-runtime@0.2.4`
 - Read: [PATTERN.md](patterns/assistant/assistant-surface/PATTERN.md)
 - Examples: [example/](patterns/assistant/assistant-surface/example/)
 - Requires: `@jskit-ai/assistant-runtime`, `@jskit-ai/connectors-catalog`, `@jskit-ai/connectors-core`, `@jskit-ai/shell-web`
@@ -48,7 +48,7 @@ Run one OpenID Connect sign-in for all of an owner's apps as its own JSKIT proje
 
 - Id: `auth/accounts-hub`
 - Keywords: `accounts hub`, `auth`, `authentication`, `issuer`, `master login`, `oidc`, `openid connect`, `single sign-on`, `sso`
-- Owner: `@jskit-ai/oidc-issuer-core@0.1.6`
+- Owner: `@jskit-ai/oidc-issuer-core@0.1.7`
 - Read: [PATTERN.md](patterns/auth/accounts-hub/PATTERN.md)
 - Examples: [example/](patterns/auth/accounts-hub/example/)
 - Requires: `@jskit-ai/oidc-issuer-core`
@@ -70,7 +70,7 @@ Let people sign in with the accounts they already have in an accounts hub or ano
 
 - Id: `auth/oidc-sign-in`
 - Keywords: `accounts hub`, `auth`, `authentication`, `back-channel logout`, `dynamic client registration`, `issuer`, `master login`, `oidc`, `openid connect`, `single sign-on`, `sso`
-- Owner: `@jskit-ai/auth-provider-oidc-core@0.2.1`
+- Owner: `@jskit-ai/auth-provider-oidc-core@0.2.2`
 - Read: [PATTERN.md](patterns/auth/oidc-sign-in/PATTERN.md)
 - Examples: [example/](patterns/auth/oidc-sign-in/example/)
 - Requires: `@jskit-ai/auth-provider-oidc-core`, `@jskit-ai/auth-web`
@@ -246,7 +246,7 @@ Add a protected administration surface, settings shell, and semantic navigation
 
 - Id: `console/console-surface`
 - Keywords: `admin`, `console`, `navigation`, `owner`, `placement`, `settings`, `surface`
-- Owner: `@jskit-ai/console-web@0.1.221`
+- Owner: `@jskit-ai/console-web@0.1.222`
 - Read: [PATTERN.md](patterns/console/console-surface/PATTERN.md)
 - Examples: [example/](patterns/console/console-surface/example/)
 - Requires: `@jskit-ai/console-core`, `@jskit-ai/console-web`, `@jskit-ai/shell-web`
@@ -257,7 +257,7 @@ Build a routed CRUD user interface as thin application pages over JSKIT's shared
 
 - Id: `crud/crud-screen-set`
 - Keywords: `actions`, `add`, `crud`, `delete`, `edit`, `filters`, `list`, `material`, `routes`, `view`, `vue`
-- Owner: `@jskit-ai/http-web@0.2.2`
+- Owner: `@jskit-ai/http-web@0.2.3`
 - Read: [PATTERN.md](patterns/crud/crud-screen-set/PATTERN.md)
 - Examples: [example/](patterns/crud/crud-screen-set/example/)
 - Requires: `@jskit-ai/http-web`, `@jskit-ai/resource-crud-core`
@@ -323,7 +323,7 @@ Add JSKIT realtime events with an optional Redis backplane and an explicit shell
 
 - Id: `realtime/realtime-application`
 - Keywords: `realtime`, `redis`, `socket.io`, `sockets`, `status`, `websocket`
-- Owner: `@jskit-ai/realtime@0.2.1`
+- Owner: `@jskit-ai/realtime@0.2.2`
 - Read: [PATTERN.md](patterns/realtime/realtime-application/PATTERN.md)
 - Examples: [example/](patterns/realtime/realtime-application/example/)
 - Requires: `@jskit-ai/realtime`, `@jskit-ai/shell-web`
@@ -334,7 +334,7 @@ Compose application-owned Google Publisher Tag delivery with the generic rewarde
 
 - Id: `rewards/google-rewarded`
 - Keywords: `ads`, `google`, `publisher tag`, `rewarded`, `unlock`
-- Owner: `@jskit-ai/rewarded-web@0.2.1`
+- Owner: `@jskit-ai/rewarded-web@0.2.2`
 - Read: [PATTERN.md](patterns/rewards/google-rewarded/PATTERN.md)
 - Examples: [example/](patterns/rewards/google-rewarded/example/)
 - Requires: `@jskit-ai/rewarded-web`
@@ -345,7 +345,7 @@ Define a server feature through explicit capabilities and first-class actions, a
 
 - Id: `server/feature-package`
 - Keywords: `actions`, `feature`, `json-rest`, `knex`, `orchestration`, `package`, `provider`, `repository`, `routes`, `server`
-- Owner: `@jskit-ai/agent-docs@0.1.251`
+- Owner: `@jskit-ai/agent-docs@0.1.252`
 - Read: [PATTERN.md](patterns/server/feature-package/PATTERN.md)
 - Examples: [example/](patterns/server/feature-package/example/)
 - Requires: `@jskit-ai/kernel`
@@ -374,11 +374,11 @@ Add product routes and shell extensions through file routing, semantic placement
 
 ## Account settings surface
 
-Compose an account settings route and profile, preference, and notification sections from JSKIT user web components.
+Compose an account settings route and profile, preference, notification, and sign-in method sections from JSKIT user web components.
 
 - Id: `users/account-settings`
-- Keywords: `account`, `notifications`, `preferences`, `profile`, `settings`, `user`, `vue`
-- Owner: `@jskit-ai/users-web@0.2.2`
+- Keywords: `account`, `link provider`, `notifications`, `oauth`, `preferences`, `profile`, `settings`, `sign-in methods`, `user`, `vue`
+- Owner: `@jskit-ai/users-web@0.2.3`
 - Read: [PATTERN.md](patterns/users/account-settings/PATTERN.md)
 - Examples: [example/](patterns/users/account-settings/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/users-core`, `@jskit-ai/users-web`
@@ -389,7 +389,7 @@ Expose user administration and workspace-scoped member operations through app-ow
 
 - Id: `users/user-administration-server`
 - Keywords: `account`, `admin`, `member`, `repository`, `resource`, `routes`, `service`, `user`, `workspace`
-- Owner: `@jskit-ai/users-core@0.2.1`
+- Owner: `@jskit-ai/users-core@0.2.2`
 - Read: [PATTERN.md](patterns/users/user-administration-server/PATTERN.md)
 - Examples: [example/](patterns/users/user-administration-server/example/)
 - Requires: `@jskit-ai/crud-core`, `@jskit-ai/users-core`
@@ -400,7 +400,7 @@ Configure roles, workspace access policy, invitations, and app-owned invitation
 
 - Id: `workspaces/workspace-server`
 - Keywords: `access`, `invite`, `membership`, `multitenancy`, `policy`, `role`, `tenancy`, `workspace`
-- Owner: `@jskit-ai/workspaces-core@0.2.1`
+- Owner: `@jskit-ai/workspaces-core@0.2.2`
 - Read: [PATTERN.md](patterns/workspaces/workspace-server/PATTERN.md)
 - Examples: [example/](patterns/workspaces/workspace-server/example/)
 - Requires: `@jskit-ai/users-core`, `@jskit-ai/workspaces-core`
@@ -411,7 +411,7 @@ Compose workspace selection, invitation, member administration, settings, and re
 
 - Id: `workspaces/workspace-surfaces`
 - Keywords: `admin`, `invite`, `member`, `navigation`, `settings`, `surface`, `switcher`, `workspace`
-- Owner: `@jskit-ai/workspaces-web@0.2.2`
+- Owner: `@jskit-ai/workspaces-web@0.2.3`
 - Read: [PATTERN.md](patterns/workspaces/workspace-surfaces/PATTERN.md)
 - Examples: [example/](patterns/workspaces/workspace-surfaces/example/)
 - Requires: `@jskit-ai/shell-web`, `@jskit-ai/workspaces-core`, `@jskit-ai/workspaces-web`

package/skills/jskit/references/patterns/app/minimal-foundation/example/package.json

@@ -48,7 +48,7 @@
   },
   "devDependencies": {
     "@jskit-ai/config-eslint": "0.1.241",
-    "@jskit-ai/jskit-catalog": "0.2.3",
+    "@jskit-ai/jskit-catalog": "0.2.4",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/skills/jskit/references/patterns/app/shell-foundation/example/package.json

@@ -50,7 +50,7 @@
   },
   "devDependencies": {
     "@jskit-ai/config-eslint": "0.1.241",
-    "@jskit-ai/jskit-catalog": "0.2.3",
+    "@jskit-ai/jskit-catalog": "0.2.4",
     "@playwright/test": "1.61.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "eslint": "^10.8.0",

package/skills/jskit/references/patterns/auth/accounts-hub/example/package.json

@@ -3,6 +3,6 @@
   "type": "module",
   "dependencies": {
     "@jskit-ai/database-runtime-mysql": "0.1.248",
-    "@jskit-ai/oidc-issuer-core": "0.1.6"
+    "@jskit-ai/oidc-issuer-core": "0.1.7"
   }
 }

package/skills/jskit/references/patterns/auth/oidc-sign-in/example/package.json

@@ -2,7 +2,7 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "@jskit-ai/auth-provider-oidc-core": "0.2.1",
+    "@jskit-ai/auth-provider-oidc-core": "0.2.2",
     "@jskit-ai/auth-web": "0.2.1"
   }
 }

package/skills/jskit/references/patterns/realtime/realtime-application/example/package.json

@@ -2,7 +2,7 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "@jskit-ai/realtime": "0.2.1",
+    "@jskit-ai/realtime": "0.2.2",
     "@jskit-ai/shell-web": "0.2.1"
   }
 }

package/skills/jskit/references/patterns/users/account-settings/PATTERN.md

@@ -1,8 +1,8 @@
 ---
 id: users/account-settings
 title: Account settings surface
-summary: Compose an account settings route and profile, preference, and notification sections from JSKIT user web components.
-keywords: account, notifications, preferences, profile, settings, user, vue
+summary: Compose an account settings route and profile, preference, notification, and sign-in method sections from JSKIT user web components.
+keywords: account, notifications, preferences, profile, settings, sign-in methods, oauth, link provider, user, vue
 requires: @jskit-ai/users-core, @jskit-ai/users-web, @jskit-ai/shell-web
 ---
 
@@ -38,6 +38,15 @@ app's language; the app does, for example
 `watch(useAccountLocale(), (code) => { if (code) i18n.global.locale.value = code; }, { immediate: true })`.
 Section titles may be plain text, a message key or `{ key, fallback }`.
 
+`runtime.signInMethods.methods` lists the auth provider's OAuth sign-in
+methods as `{ provider, label, linked, canLink, canUnlink }`, read from the
+settings security status. `link(provider)` leaves for the provider through
+`GET /api/settings/security/oauth/:provider/start` and comes back to the current
+page; `unlink(provider)` sends `DELETE /api/settings/security/oauth/:provider`
+and reports the result with the standard toast. `canUnlink` is false for the
+account's only sign-in method. Add this section only when the selected auth
+provider offers provider linking (`providerLinking` in its capabilities).
+
 ## Invariants
 
 - Sections use JSKIT account settings APIs rather than direct HTTP helpers.
@@ -51,7 +60,7 @@ Section titles may be plain text, a message key or `{ key, fallback }`.
 
 ## Example files
 
-`example/` contains an account route and three concrete settings sections.
+`example/` contains an account route and four concrete settings sections.
 Adapt their fields and copy while retaining the shared account runtime.
 
 ## Variation points

package/skills/jskit/references/patterns/users/account-settings/example/src/components/account/settings/AccountSettingsSignInMethodsSection.vue

@@ -0,0 +1,67 @@
+<script setup>
+const props = defineProps({
+  runtime: {
+    type: Object,
+    required: true
+  }
+});
+
+const signInMethods = props.runtime.signInMethods;
+</script>
+
+<template>
+  <v-sheet rounded="lg" border class="account-settings-section">
+    <v-list lines="two" class="py-0">
+      <v-list-item
+        v-for="method in signInMethods.methods.value"
+        :key="method.provider"
+        :title="method.label"
+        :subtitle="method.linked ? 'Linked' : 'Not linked'"
+      >
+        <template #append>
+          <v-btn
+            v-if="method.linked"
+            variant="text"
+            color="error"
+            :loading="signInMethods.unlinkingProvider.value === method.provider"
+            :disabled="!method.canUnlink || signInMethods.isRefreshing.value"
+            @click="signInMethods.unlink(method.provider)"
+          >
+            Unlink
+          </v-btn>
+          <v-btn
+            v-else
+            variant="tonal"
+            color="primary"
+            :disabled="!method.canLink || signInMethods.isRefreshing.value"
+            @click="signInMethods.link(method.provider)"
+          >
+            Link
+          </v-btn>
+        </template>
+      </v-list-item>
+    </v-list>
+    <p
+      v-if="signInMethods.methods.value.some((method) => method.linked && !method.canUnlink)"
+      class="account-settings-section__hint text-body-2 text-medium-emphasis mb-0"
+    >
+      Your only sign-in method can't be unlinked. Set a password or link another provider first.
+    </p>
+  </v-sheet>
+</template>
+
+<style scoped>
+.account-settings-section {
+  overflow: hidden;
+}
+
+.account-settings-section__hint {
+  padding: 0 1rem 1rem;
+}
+
+@media (max-width: 640px) {
+  .account-settings-section :deep(.v-btn) {
+    min-height: 48px;
+  }
+}
+</style>

package/skills/jskit/references/patterns/users/user-administration-server/example/packages/users-workspace/package.json

@@ -11,7 +11,7 @@
   "dependencies": {
     "@jskit-ai/crud-core": "0.2.1",
     "@jskit-ai/resource-crud-core": "0.1.192",
-    "@jskit-ai/workspaces-core": "0.2.1"
+    "@jskit-ai/workspaces-core": "0.2.2"
   },
   "jskit": {
     "kind": "runtime",