[Bccorb]

Documents the OAuth changes released in seamless-auth-api v0.16.0.

Includes #47's commit (Choosing A Provider), because these sections extend it. If #47 merges first, that commit drops out of this diff; otherwise merging this lands both and #47 can be closed.

Account linking

• The linking table now reflects that linking to an existing account and creating a new one both require the provider to assert email_verified: true, whatever requireEmailVerified says. Already-linked identities keep signing in.
• A profile without the assertion is refused with oauth_email_not_verified, now in the debug table.
• When a verified provider email links to an account that had not proven its address (admin-created or imported), the account is marked verified and a phone verified before then is removed.

GitHub

GitHub's /user has no verification claim, so a GitHub provider (https://api.github.com/user or GitHub Enterprise Server's /api/v3/user) also reads /user/emails and uses the address GitHub lists as verified. Needs the user:email scope.

OpenID Connect and Entra ID

• New provider fields: issuer, jwksUri, externalIdSource, externalIdJsonPath.
• A full Microsoft Entra ID example: tenant endpoints, issuer and JWKS, the GUID-only tenant id, adding the xms_edov optional claim under Token configuration, and linking users imported with seamless migrate (source entra-id) by oid.
• oauth_invalid_id_token in the debug table.

Checks

npm run lint, npm run typecheck (0 errors), npm run build pass.