feat: add OAuth login and authenticated entity events

.github/workflows/postgres-conditional.yml

@@ -7,6 +7,13 @@ on:
 permissions:
   contents: read
 
+# Multiple backend/extension feature graphs otherwise fill hosted runner disks
+# with debug information and incremental artifacts before validation finishes.
+env:
+  CARGO_PROFILE_DEV_DEBUG: "0"
+  CARGO_PROFILE_TEST_DEBUG: "0"
+  CARGO_INCREMENTAL: "0"
+
 jobs:
   conditional:
     runs-on: ubuntu-24.04
@@ -44,31 +51,64 @@ jobs:
         run: cargo nextest run -p schema-forge-backend -p schema-forge-postgres --run-ignored all --no-fail-fast
       - name: Prepare disposable HTTP namespace
         if: ${{ !cancelled() }}
-        run: psql -X -v ON_ERROR_STOP=1 -c 'CREATE SCHEMA conditional_http'
+        run: psql -X -v ON_ERROR_STOP=1 -c 'CREATE SCHEMA conditional_http; CREATE SCHEMA oauth_http; CREATE SCHEMA events_http'
       - name: Run complete runtime and schema suites
         if: ${{ !cancelled() }}
-        run: cargo nextest run -p schema-forge-acton -p schema-forge-surrealdb -p schema-forge-core -p schema-forge-dsl --features schema-forge-acton/postgres,schema-forge-acton/graphql --no-fail-fast
+        run: cargo nextest run -p schema-forge-acton -p schema-forge-surrealdb -p schema-forge-core -p schema-forge-dsl --features schema-forge-acton/postgres,schema-forge-acton/graphql,schema-forge-acton/oauth,schema-forge-acton/sse --no-fail-fast
       - name: Run HTTP authorization and concurrency cases
         if: ${{ !cancelled() }}
         env:
           SCHEMAFORGE_TEST_POSTGRES_DISPOSABLE: "1"
           SCHEMAFORGE_TEST_POSTGRES_URL: postgres://schemaforge:schemaforge-test@localhost:5432/schemaforge_test?options=-csearch_path%3Dconditional_http
-        run: cargo nextest run -p schema-forge-acton --features postgres,graphql --test conditional_entities --run-ignored only --no-fail-fast
+        run: cargo nextest run -p schema-forge-acton --features postgres,graphql,oauth,sse --test conditional_entities --run-ignored only --no-fail-fast
+      - name: Check PostgreSQL identity uniqueness
+        if: ${{ !cancelled() }}
+        env:
+          SCHEMAFORGE_TEST_POSTGRES_URL: postgres://schemaforge:schemaforge-test@localhost:5432/schemaforge_test?options=-csearch_path%3Doauth_http
+        run: cargo nextest run -p schema-forge-acton --features postgres,oauth,sse --test oauth_storage --run-ignored only --no-fail-fast
+      - name: Check PostgreSQL committed event projection
+        if: ${{ !cancelled() }}
+        env:
+          SCHEMAFORGE_TEST_POSTGRES_URL: postgres://schemaforge:schemaforge-test@localhost:5432/schemaforge_test?options=-csearch_path%3Devents_http
+        run: cargo nextest run -p schema-forge-acton --features postgres,oauth,sse --test entity_events --run-ignored only --no-fail-fast
       - name: Check CLI preparation and security behavior
         if: ${{ !cancelled() }}
-        run: cargo nextest run -p schema-forge-cli --no-default-features --features postgres --no-fail-fast
-      - name: Check SurrealDB CLI integration
+        run: cargo nextest run -p schema-forge-cli --no-default-features --features postgres,oauth,sse --no-fail-fast
+      - name: Check extension features remain opt-in
         if: ${{ !cancelled() }}
-        run: cargo nextest run -p schema-forge-cli --no-fail-fast
+        run: cargo nextest run -p schema-forge-cli -p schema-forge-acton --no-default-features --features schema-forge-cli/postgres -E 'test(export_reuses_login_response) | test(export_lists_event_stream) | test(events_route_is_absent)' --no-fail-fast
       - name: Deny runtime and backend lints
         if: ${{ !cancelled() }}
-        run: cargo clippy -p schema-forge-acton -p schema-forge-surrealdb -p schema-forge-core -p schema-forge-dsl -p schema-forge-backend -p schema-forge-postgres --features schema-forge-acton/postgres,schema-forge-acton/graphql --all-targets -- -D warnings
+        run: cargo clippy -p schema-forge-acton -p schema-forge-surrealdb -p schema-forge-core -p schema-forge-dsl -p schema-forge-backend -p schema-forge-postgres --features schema-forge-acton/postgres,schema-forge-acton/graphql,schema-forge-acton/oauth,schema-forge-acton/sse --all-targets -- -D warnings
       - name: Deny CLI lints
         if: ${{ !cancelled() }}
-        run: cargo clippy -p schema-forge-cli --no-default-features --features postgres --all-targets -- -D warnings
+        run: cargo clippy -p schema-forge-cli --no-default-features --features postgres,oauth,sse --all-targets -- -D warnings
+      - name: Report remaining runner disk
+        if: always()
+        run: df -h .
+      - name: Clean disposable HTTP namespace
+        if: always()
+        run: psql -X -v ON_ERROR_STOP=1 -c 'DROP SCHEMA IF EXISTS conditional_http CASCADE; DROP SCHEMA IF EXISTS oauth_http CASCADE; DROP SCHEMA IF EXISTS events_http CASCADE'
+
+  surrealdb:
+    name: SurrealDB runtime and CLI
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v6
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler libkrb5-dev
+      - uses: dtolnay/rust-toolchain@1.97.1
+      - uses: Swatinem/rust-cache@v2
+        with:
+          cache-on-failure: true
+      - name: Install nextest
+        run: cargo install cargo-nextest --locked
+      - name: Check SurrealDB CLI integration
+        run: cargo nextest run -p schema-forge-cli -p schema-forge-acton --features schema-forge-cli/oauth,schema-forge-cli/sse --no-fail-fast
       - name: Deny SurrealDB CLI lints
         if: ${{ !cancelled() }}
-        run: cargo clippy -p schema-forge-cli --all-targets -- -D warnings
-      - name: Clean disposable HTTP namespace
+        run: cargo clippy -p schema-forge-cli -p schema-forge-acton --features schema-forge-cli/oauth,schema-forge-cli/sse --all-targets -- -D warnings
+      - name: Report remaining runner disk
         if: always()
-        run: psql -X -v ON_ERROR_STOP=1 -c 'DROP SCHEMA IF EXISTS conditional_http CASCADE'
+        run: df -h .

.github/workflows/release.yml

@@ -126,7 +126,7 @@ jobs:
           # Points rust-embed at the verified console bundle (build.rs re-exports
           # it for the `#[folder = "$SCHEMAFORGE_CONSOLE_DIST"]` interpolation).
           SCHEMAFORGE_CONSOLE_DIST: ${{ github.workspace }}/console-dist
-        run: cargo build --locked --release --package schema-forge-cli --no-default-features --features ${{ matrix.backend }},embedded-console
+        run: cargo build --locked --release --package schema-forge-cli --no-default-features --features ${{ matrix.backend }},embedded-console,oauth,sse
 
       - name: Sign and verify Windows binary (Sigstore keyless)
         if: runner.os == 'Windows'

CHANGELOG.md

@@ -7,6 +7,31 @@ is pre-1.0; breaking changes bump the **minor** version per
 
 ## [Unreleased]
 
+## [0.48.0] - 2026-10-05
+
+### Added
+
+- Opt-in authenticated entity SSE streams with canonical GET projection, Cedar
+  and tenant authorization, equality filters, bounded nonblocking delivery,
+  per-user connection limits, keep-alives, live membership revocation, and
+  process-local commit ordering. Supported release binaries include OAuth and
+  SSE support; both remain disabled until configured.
+- Opt-in OAuth login with audited GitHub, Google, and custom OIDC providers,
+  verified email, signed invitations, durable unique identity links, and a
+  single-use 60-second frontend exchange code. OAuth-created accounts leave
+  the existing optional, hidden `password_hash` null and can set a first
+  password through the existing authorized endpoint.
+- Shared login completion preserves tenant membership requirements, principal
+  claim projection, login timestamps, and PASETO refresh behavior across password
+  and OAuth sign-in. `/auth/me` lists linked provider identities.
+
+### Fixed
+
+- Render every line of multiline hook intent as a Rust doc comment, preserving
+  paragraphs and trimming outer blank lines so generated handlers compile.
+- Verify that generated hook services, the CLI, and the runtime share the same
+  acton-service dependency version.
+
 - Upgrade acton-service to 0.45.0 across the runtime, backends, CLI, and generated
   hook services. Preserve configured listener binds supplied with canonical
   `ACTON_SERVICE__BIND` environment variables.
@@ -18,6 +43,21 @@ is pre-1.0; breaking changes bump the **minor** version per
   can be configured separately, and governor reports actual remaining capacity
   with `Retry-After` on rate-limit responses instead of `X-RateLimit-Reset`.
 
+### Migration
+
+- Existing password accounts keep their hashes. Startup seeds the shared
+  `OAuthIdentity` system schema; provision it through the normal schema migration
+  path before enabling OAuth on an existing deployment. OAuth account/invite
+  changes span multiple storage operations; provider/subject uniqueness prevents
+  duplicate linking, while an interrupted signup can require administrator repair.
+- Library users should update acton to 0.46.0, backend to 0.20.0, PostgreSQL and
+  SurrealDB adapters to 0.15.0, and MSSQL to 0.7.0. Core remains compatible at
+  0.19.2. Align directly imported acton-service `Claims` with 0.45.0 and update
+  Rust `SchemaForgeSettings` and `MeResponse` struct literals for their new fields.
+- OAuth and events remain disabled until configured. Release binaries include
+  both features. SSE is process-local, has no replay/outbox, and requires clients
+  to refetch on reconnect. Use canonical `ACTON_SERVICE__...` environment names.
+
 ## [0.46.1] - 2026-09-25
 
 This release includes the changes prepared for v0.46.0. The v0.46.0 source tag