[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M72VR9ZFAWM1Z9Y7H0DS7MYK":3,"skill-same:01M72VR9ZFAWM1Z9Y7H0DS7MYK":82},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":33,"commitSha":34,"skillDirectory":35,"forksCount":36,"repositoryHtmlUrl":37,"repositoryHomepageUrl":38,"ownerHtmlUrl":39,"ownerBlogUrl":40,"ownerDescription":6,"updatedAt":41,"install":42,"resources":55},"01M72VR9ZFAWM1Z9Y7H0DS7MYK","meteor-accounts",null,"Use when wiring up authentication in a Meteor 3 app. Triggers on accounts-password, accounts-base, OAuth (Google, Facebook, GitHub, Apple, Twitter, Meetup, Weibo), accounts-2fa, accounts-passwordless, ServiceConfiguration.configurations.upsertAsync, Accounts.createUserAsync, Accounts.setPasswordAsync, Accounts.forgotPassword, Accounts.resetPassword, Accounts.verifyEmail, useHttpOnlyCookies, clientStorage, Meteor.loginWithPasswordAnd2faCode, email verification. Use this skill when the user asks about signups, signins, or asks about token storage vs HttpOnly cookies.","meteor\u002Fagent-skills","meteor","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F789528?v=4","01M72VQVFCJ72XHP7ZKS3774NA","Meteor","01M72VQVG5VZ0X5VCQYM0MCK1Q",11,"MIT","https:\u002F\u002Fgithub.com\u002Fmeteor\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fmeteor-accounts\u002FSKILL.md",[],[],"2026-11-10 22:39:42",false,"---\nname: meteor-accounts\ndescription: >\n  Use when wiring up authentication in a Meteor 3 app. Triggers on\n  accounts-password, accounts-base, OAuth (Google, Facebook, GitHub, Apple,\n  Twitter, Meetup, Weibo), accounts-2fa, accounts-passwordless,\n  ServiceConfiguration.configurations.upsertAsync, Accounts.createUserAsync,\n  Accounts.setPasswordAsync, Accounts.forgotPassword, Accounts.resetPassword,\n  Accounts.verifyEmail, useHttpOnlyCookies, clientStorage,\n  Meteor.loginWithPasswordAnd2faCode, email verification. Use this skill\n  when the user asks about signups, signins, or asks about token storage\n  vs HttpOnly cookies.\nmetadata:\n  author: meteor\n  kind: knowledge\n  meteor: \">=3.0\"\n  area: auth\n  tagline: \"Wire up authentication in Meteor 3 (accounts-password, OAuth providers, 2FA, passwordless, email verification).\"\n  bundle: [\"fullstack\"]\n  docs_synced_at: \"2026-10-07\"\nlicense: MIT\n---\n\n# Meteor accounts\n\n`accounts-base` plus a flavor package (`accounts-password`,\n`accounts-google`, etc.). Meteor stores users in `Meteor.users` and ships\nthe client a resume token mapped to that document.\n\n## Decision flow\n\n1. Username + password? Add `accounts-password`.\n2. Social login? Add `accounts-base` plus the provider package (e.g.\n   `accounts-google`) and configure the service.\n3. Magic-link? Add `accounts-passwordless`.\n4. 2FA? Layer `accounts-2fa` on top of `accounts-password`.\n5. Token storage on the client? Default is Web Storage. Meteor 3.3+\n   supports an HttpOnly cookie flow; see the section below.\n\nFor a custom users collection, configure both runtimes before app reads or\nvalidators. Meteor 3.6 fixes collection setup and publication lookup; review\n[collection identity and client-write policy](references\u002Fusers-collection.md)\nbefore changing profile rules.\n\n## Username + password\n\n```javascript\n\u002F\u002F server\u002Faccounts.js\nimport { Accounts } from \"meteor\u002Faccounts-base\";\nimport { Meteor } from \"meteor\u002Fmeteor\";\n\nMeteor.startup(() => {\n  Accounts.config({\n    sendVerificationEmail: true,\n  });\n\n  Accounts.emailTemplates.siteName = \"My App\";\n  Accounts.emailTemplates.from = \"no-reply@example.com\";\n});\n```\n\nThe `from` address is required; Meteor 3.5+ logs a server warning if you\nomit it.\n\nDo not set `forbidClientAccountCreation: true` when the client signup form\ncalls `Accounts.createUser` or `Accounts.createUserAsync`. The server rejects\nthat request with `403 Signups forbidden`. For invite-only or administrator\nprovisioning, set the option on both client and server, remove the public\nsignup UI, and call `Accounts.createUserAsync` only from trusted server code\nafter its own authorization check.\n\n```javascript\n\u002F\u002F client\u002Fsignin.js (Meteor 3.5+)\nimport { Meteor } from \"meteor\u002Fmeteor\";\nimport { Accounts } from \"meteor\u002Faccounts-base\";\n\nasync function signUp({ email, password }) {\n  await Accounts.createUserAsync({ email, password });\n}\n\nasync function signIn({ email, password }) {\n  await Meteor.loginWithPasswordAsync(email, password);\n}\n```\n\nClient `Accounts.createUser(options, callback)` also remains supported.\n`Meteor.loginWithPasswordAsync` was added in Meteor 3.5; on older 3.x use\nthe callback form of `Meteor.loginWithPassword` or wrap it in a Promise.\n\nOn the server use `await Accounts.createUserAsync(options)` and\n`await Accounts.setPasswordAsync(userId, newPassword)`.\n\n## HttpOnly cookies (Meteor 3.3+)\n\nDefault token storage is Web Storage. To move the resume token into an\nHttpOnly cookie and keep the client tab in-memory only:\n\n```javascript\n\u002F\u002F server\nMeteor.startup(() => {\n  Accounts.config({\n    clientStorage: \"none\",\n    useHttpOnlyCookies: true,\n  });\n});\n```\n\n```json\n\u002F\u002F settings.json (public; surfaces the same flags to the client)\n{\n  \"public\": {\n    \"packages\": {\n      \"accounts\": {\n        \"clientStorage\": \"none\",\n        \"useHttpOnlyCookies\": true\n      }\n    }\n  }\n}\n```\n\nAfter restart and login, `Meteor.loginToken*` no longer appears in\n`localStorage`; the browser receives an HttpOnly `meteor_login_token`\ncookie. Each tab keeps its own in-memory credentials. DDP authentication still\nreads the resume token into memory; this does not protect it from a malicious\nscript already executing in the application origin.\n\nWith `accounts-base@3.3.1` (Meteor 3.5.2), the server handles cookie endpoints\nonly when it is opted in too. A client-only setting can therefore produce an\nHTML response or 404 from later handlers. The `\u002Fset` body limit is 4096 bytes;\nlarger requests return HTTP 413. See\n[cookie endpoint troubleshooting](references\u002Fhttp-only-cookies.md) for the\nroutes, version boundary, and diagnostic checks. Meteor 3.6's\n`accounts-base@3.4.0` also requires trusted origins and valid tokens,\nuses `SameSite=Strict`, and adds a separate per-address endpoint rate limit.\nReview custom callers and cross-site entry flows before upgrading. Distinguish invalid sessions from transient or\nrate-limit responses before retrying or discarding credentials.\n\n## OAuth (Google example)\n\n```javascript\n\u002F\u002F server\u002Foauth.js\nimport { ServiceConfiguration } from \"meteor\u002Fservice-configuration\";\n\nawait ServiceConfiguration.configurations.upsertAsync(\n  { service: \"google\" },\n  {\n    $set: {\n      clientId: process.env.GOOGLE_CLIENT_ID,\n      secret: process.env.GOOGLE_CLIENT_SECRET,\n      loginStyle: \"popup\",\n    },\n  },\n);\n```\n\n```javascript\n\u002F\u002F client\nMeteor.loginWithGoogle(\n  { requestPermissions: [\"email\", \"profile\"] },\n  (err) => { if (err) console.error(err); },\n);\n```\n\n`loginStyle: \"redirect\"` for mobile or environments without\n`window.close` \u002F `window.opener`. Each provider ships its own\n`accounts-\u003Cservice>` package: `accounts-google`, `accounts-github`,\n`accounts-facebook`, `accounts-twitter`, `accounts-apple`,\n`accounts-meetup`, `accounts-weibo`.\n\nFor native Google\u002FFacebook login, see\n[native token validation](references\u002Foauth-services.md#native-google-and-facebook-tokens).\n\nTo encrypt OAuth secrets at rest, add `oauth-encryption` and pass\n`oauthSecretKey` to `Accounts.config`. This seals the provider application\nsecret in `ServiceConfiguration.configurations.secret` and the supported\nprovider-specific user token fields. It does not create a generic\n`Meteor.users.services.\u003Cprovider>.secret` field. See `meteor-security`.\n\n## Email verification and reset\n\n```javascript\n\u002F\u002F client\nAccounts.forgotPassword({ email }, (err) => { ... });\n\n\u002F\u002F reset page\nAccounts.resetPassword(token, newPassword, (err) => { ... });\n\n\u002F\u002F verify email\nAccounts.verifyEmail(token, (err) => { ... });\n```\n\nCustomize the URL pattern that lands in the email:\n\n```javascript\nAccounts.urls.resetPassword = (token) =>\n  Meteor.absoluteUrl(`reset\u002F${token}`);\nAccounts.urls.verifyEmail = (token) =>\n  Meteor.absoluteUrl(`verify\u002F${token}`);\n```\n\nBoth setters accept async functions too (Meteor 3.x).\n\nCustomize the message:\n\n```javascript\nAccounts.emailTemplates.resetPassword.subject = () => \"Reset your password\";\nAccounts.emailTemplates.resetPassword.text = (user, url) =>\n  `Reset link: ${url}`;\n```\n\n## Passwordless\n\nAdd `accounts-passwordless`. Request a one-time code or link, then submit the\ncode with the same selector:\n\n```javascript\nAccounts.requestLoginTokenForUser(\n  {\n    selector: { email },\n    userData: { email },\n    options: { userCreationDisabled: false },\n  },\n  (error) => { if (error) console.error(error); },\n);\n\nMeteor.passwordlessLoginWithToken(\n  { email },\n  token,\n  (error) => { if (error) console.error(error); },\n);\n```\n\nSet `userCreationDisabled: true` for sign-in-only flows. Configure\n`tokenSequenceLength`, `loginTokenExpirationHours`, and the\n`Accounts.emailTemplates.sendLoginToken` template on the server. Treat the\ntoken-request method as an abuse-sensitive endpoint and rate-limit repeated\nrequests. With Meteor 3.6's `accounts-passwordless@3.1.2`\nand `accounts-base@3.4.0`, the complete request is validated before\nlookup\u002Fcreation and joins the default Accounts DDP rate rule. See\n[passwordless request boundaries](references\u002Fpasswordless-requests.md)\nfor custom callers, one-time completion, 2FA and earlier packages. Retain the\ndefault limiter and handle callback errors without an immediate retry loop.\n\n## 2FA\n\n`accounts-2fa` adds TOTP. The login flow:\n\n1. Client calls `Meteor.loginWithPasswordAsync(user, password)` on Meteor\n   3.5+, or the callback form of `Meteor.loginWithPassword` on older 3.x.\n2. Server rejects with `error.error === 'no-2fa-code'`.\n3. Client prompts for a code, retries with\n   `Meteor.loginWithPasswordAnd2faCode(user, password, code, cb)`.\n\n## Anti-patterns\n\n- Store the OAuth secret in `Meteor.settings.public`. The client sees\n  `public`. Put secrets at the top level of `settings.json`.\n- Build a custom password hash. `accounts-password` uses bcrypt; trust it.\n- Bypass `forbidClientAccountCreation` with a method that takes a\n  password. Same risk.\n- Run `Accounts.config({ ... })` inside a deferred path. Call it at top\n  level or in `Meteor.startup`.\n\n## See also\n\n- `references\u002Fpassword-flows.md`\n- `references\u002Foauth-services.md`\n- `references\u002Feval-cases.md`\n- For OAuth-secret encryption and CSP, see the `meteor-security` skill.\n","# Meteor accounts\n\n`accounts-base` plus a flavor package (`accounts-password`,\n`accounts-google`, etc.). Meteor stores users in `Meteor.users` and ships\nthe client a resume token mapped to that document.\n\n## Decision flow\n\n1. Username + password? Add `accounts-password`.\n2. Social login? Add `accounts-base` plus the provider package (e.g.\n   `accounts-google`) and configure the service.\n3. Magic-link? Add `accounts-passwordless`.\n4. 2FA? Layer `accounts-2fa` on top of `accounts-password`.\n5. Token storage on the client? Default is Web Storage. Meteor 3.3+\n   supports an HttpOnly cookie flow; see the section below.\n\nFor a custom users collection, configure both runtimes before app reads or\nvalidators. Meteor 3.6 fixes collection setup and publication lookup; review\n[collection identity and client-write policy](references\u002Fusers-collection.md)\nbefore changing profile rules.\n\n## Username + password\n\n```javascript\n\u002F\u002F server\u002Faccounts.js\nimport { Accounts } from \"meteor\u002Faccounts-base\";\nimport { Meteor } from \"meteor\u002Fmeteor\";\n\nMeteor.startup(() => {\n  Accounts.config({\n    sendVerificationEmail: true,\n  });\n\n  Accounts.emailTemplates.siteName = \"My App\";\n  Accounts.emailTemplates.from = \"no-reply@example.com\";\n});\n```\n\nThe `from` address is required; Meteor 3.5+ logs a server warning if you\nomit it.\n\nDo not set `forbidClientAccountCreation: true` when the client signup form\ncalls `Accounts.createUser` or `Accounts.createUserAsync`. The server rejects\nthat request with `403 Signups forbidden`. For invite-only or administrator\nprovisioning, set the option on both client and server, remove the public\nsignup UI, and call `Accounts.createUserAsync` only from trusted server code\nafter its own authorization check.\n\n```javascript\n\u002F\u002F client\u002Fsignin.js (Meteor 3.5+)\nimport { Meteor } from \"meteor\u002Fmeteor\";\nimport { Accounts } from \"meteor\u002Faccounts-base\";\n\nasync function signUp({ email, password }) {\n  await Accounts.createUserAsync({ email, password });\n}\n\nasync function signIn({ email, password }) {\n  await Meteor.loginWithPasswordAsync(email, password);\n}\n```\n\nClient `Accounts.createUser(options, callback)` also remains supported.\n`Meteor.loginWithPasswordAsync` was added in Meteor 3.5; on older 3.x use\nthe callback form of `Meteor.loginWithPassword` or wrap it in a Promise.\n\nOn the server use `await Accounts.createUserAsync(options)` and\n`await Accounts.setPasswordAsync(userId, newPassword)`.\n\n## HttpOnly cookies (Meteor 3.3+)\n\nDefault token storage is Web Storage. To move the resume token into an\nHttpOnly cookie and keep the client tab in-memory only:\n\n```javascript\n\u002F\u002F server\nMeteor.startup(() => {\n  Accounts.config({\n    clientStorage: \"none\",\n    useHttpOnlyCookies: true,\n  });\n});\n```\n\n```json\n\u002F\u002F settings.json (public; surfaces the same flags to the client)\n{\n  \"public\": {\n    \"packages\": {\n      \"accounts\": {\n        \"clientStorage\": \"none\",\n        \"useHttpOnlyCookies\": true\n      }\n    }\n  }\n}\n```\n\nAfter restart and login, `Meteor.loginToken*` no longer appears in\n`localStorage`; the browser receives an HttpOnly `meteor_login_token`\ncookie. Each tab keeps its own in-memory credentials. DDP authentication still\nreads the resume token into memory; this does not protect it from a malicious\nscript already executing in the application origin.\n\nWith `accounts-base@3.3.1` (Meteor 3.5.2), the server handles cookie endpoints\nonly when it is opted in too. A client-only setting can therefore produce an\nHTML response or 404 from later handlers. The `\u002Fset` body limit is 4096 bytes;\nlarger requests return HTTP 413. See\n[cookie endpoint troubleshooting](references\u002Fhttp-only-cookies.md) for the\nroutes, version boundary, and diagnostic checks. Meteor 3.6's\n`accounts-base@3.4.0` also requires trusted origins and valid tokens,\nuses `SameSite=Strict`, and adds a separate per-address endpoint rate limit.\nReview custom callers and cross-site entry flows before upgrading. Distinguish invalid sessions from transient or\nrate-limit responses before retrying or discarding credentials.\n\n## OAuth (Google example)\n\n```javascript\n\u002F\u002F server\u002Foauth.js\nimport { ServiceConfiguration } from \"meteor\u002Fservice-configuration\";\n\nawait ServiceConfiguration.configurations.upsertAsync(\n  { service: \"google\" },\n  {\n    $set: {\n      clientId: process.env.GOOGLE_CLIENT_ID,\n      secret: process.env.GOOGLE_CLIENT_SECRET,\n      loginStyle: \"popup\",\n    },\n  },\n);\n```\n\n```javascript\n\u002F\u002F client\nMeteor.loginWithGoogle(\n  { requestPermissions: [\"email\", \"profile\"] },\n  (err) => { if (err) console.error(err); },\n);\n```\n\n`loginStyle: \"redirect\"` for mobile or environments without\n`window.close` \u002F `window.opener`. Each provider ships its own\n`accounts-\u003Cservice>` package: `accounts-google`, `accounts-github`,\n`accounts-facebook`, `accounts-twitter`, `accounts-apple`,\n`accounts-meetup`, `accounts-weibo`.\n\nFor native Google\u002FFacebook login, see\n[native token validation](references\u002Foauth-services.md#native-google-and-facebook-tokens).\n\nTo encrypt OAuth secrets at rest, add `oauth-encryption` and pass\n`oauthSecretKey` to `Accounts.config`. This seals the provider application\nsecret in `ServiceConfiguration.configurations.secret` and the supported\nprovider-specific user token fields. It does not create a generic\n`Meteor.users.services.\u003Cprovider>.secret` field. See `meteor-security`.\n\n## Email verification and reset\n\n```javascript\n\u002F\u002F client\nAccounts.forgotPassword({ email }, (err) => { ... });\n\n\u002F\u002F reset page\nAccounts.resetPassword(token, newPassword, (err) => { ... });\n\n\u002F\u002F verify email\nAccounts.verifyEmail(token, (err) => { ... });\n```\n\nCustomize the URL pattern that lands in the email:\n\n```javascript\nAccounts.urls.resetPassword = (token) =>\n  Meteor.absoluteUrl(`reset\u002F${token}`);\nAccounts.urls.verifyEmail = (token) =>\n  Meteor.absoluteUrl(`verify\u002F${token}`);\n```\n\nBoth setters accept async functions too (Meteor 3.x).\n\nCustomize the message:\n\n```javascript\nAccounts.emailTemplates.resetPassword.subject = () => \"Reset your password\";\nAccounts.emailTemplates.resetPassword.text = (user, url) =>\n  `Reset link: ${url}`;\n```\n\n## Passwordless\n\nAdd `accounts-passwordless`. Request a one-time code or link, then submit the\ncode with the same selector:\n\n```javascript\nAccounts.requestLoginTokenForUser(\n  {\n    selector: { email },\n    userData: { email },\n    options: { userCreationDisabled: false },\n  },\n  (error) => { if (error) console.error(error); },\n);\n\nMeteor.passwordlessLoginWithToken(\n  { email },\n  token,\n  (error) => { if (error) console.error(error); },\n);\n```\n\nSet `userCreationDisabled: true` for sign-in-only flows. Configure\n`tokenSequenceLength`, `loginTokenExpirationHours`, and the\n`Accounts.emailTemplates.sendLoginToken` template on the server. Treat the\ntoken-request method as an abuse-sensitive endpoint and rate-limit repeated\nrequests. With Meteor 3.6's `accounts-passwordless@3.1.2`\nand `accounts-base@3.4.0`, the complete request is validated before\nlookup\u002Fcreation and joins the default Accounts DDP rate rule. See\n[passwordless request boundaries](references\u002Fpasswordless-requests.md)\nfor custom callers, one-time completion, 2FA and earlier packages. Retain the\ndefault limiter and handle callback errors without an immediate retry loop.\n\n## 2FA\n\n`accounts-2fa` adds TOTP. The login flow:\n\n1. Client calls `Meteor.loginWithPasswordAsync(user, password)` on Meteor\n   3.5+, or the callback form of `Meteor.loginWithPassword` on older 3.x.\n2. Server rejects with `error.error === 'no-2fa-code'`.\n3. Client prompts for a code, retries with\n   `Meteor.loginWithPasswordAnd2faCode(user, password, code, cb)`.\n\n## Anti-patterns\n\n- Store the OAuth secret in `Meteor.settings.public`. The client sees\n  `public`. Put secrets at the top level of `settings.json`.\n- Build a custom password hash. `accounts-password` uses bcrypt; trust it.\n- Bypass `forbidClientAccountCreation` with a method that takes a\n  password. Same risk.\n- Run `Accounts.config({ ... })` inside a deferred path. Call it at top\n  level or in `Meteor.startup`.\n\n## See also\n\n- `references\u002Fpassword-flows.md`\n- `references\u002Foauth-services.md`\n- `references\u002Feval-cases.md`\n- For OAuth-secret encryption and CSP, see the `meteor-security` skill.\n",{"name":5,"license":15,"metadata":24,"description":32},{"area":25,"kind":26,"author":9,"bundle":27,"meteor":29,"tagline":30,"docs_synced_at":31},"auth","knowledge",[28],"fullstack",">=3.0","Wire up authentication in Meteor 3 (accounts-password, OAuth providers, 2FA, passwordless, email verification).","2026-10-07","Use when wiring up authentication in a Meteor 3 app. Triggers on accounts-password, accounts-base, OAuth (Google, Facebook, GitHub, Apple, Twitter, Meetup, Weibo), accounts-2fa, accounts-passwordless, ServiceConfiguration.configurations.upsertAsync, Accounts.createUserAsync, Accounts.setPasswordAsync, Accounts.forgotPassword, Accounts.resetPassword, Accounts.verifyEmail, useHttpOnlyCookies, clientStorage, Meteor.loginWithPasswordAnd2faCode, email verification. Use this skill when the user asks about signups, signins, or asks about token storage vs HttpOnly cookies.\n","main","0b022e17f4fcd7753440de79bd512603cf832de3","skills\u002Fmeteor-accounts",3,"https:\u002F\u002Fgithub.com\u002Fmeteor\u002Fagent-skills","https:\u002F\u002Fdocs.meteor.com\u002F","https:\u002F\u002Fgithub.com\u002Fmeteor","https:\u002F\u002Fmeteor.com\u002F","2026-11-12 03:34:42",{"source":8,"skillName":5,"commands":43,"prompt":53,"zipAvailable":54},[44,47,50],{"tool":45,"command":46},"npx","npx skills add meteor\u002Fagent-skills --skill meteor-accounts",{"tool":48,"command":49},"bunx","bunx skills add meteor\u002Fagent-skills --skill meteor-accounts",{"tool":51,"command":52},"pnpm","pnpm dlx skills add meteor\u002Fagent-skills --skill meteor-accounts","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmeteor\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fmeteor-accounts\u002FSKILL.md",true,[56,62,66,70,74,78],{"path":57,"resourceType":58,"resourceTypeDesc":59,"sizeBytes":60,"sourceHtmlUrl":61},"references\u002Feval-cases.md","REFERENCE","参考文档",17784,"https:\u002F\u002Fgithub.com\u002Fmeteor\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fmeteor-accounts\u002Freferences\u002Feval-cases.md",{"path":63,"resourceType":58,"resourceTypeDesc":59,"sizeBytes":64,"sourceHtmlUrl":65},"references\u002Fhttp-only-cookies.md",6539,"https:\u002F\u002Fgithub.com\u002Fmeteor\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fmeteor-accounts\u002Freferences\u002Fhttp-only-cookies.md",{"path":67,"resourceType":58,"resourceTypeDesc":59,"sizeBytes":68,"sourceHtmlUrl":69},"references\u002Foauth-services.md",6318,"https:\u002F\u002Fgithub.com\u002Fmeteor\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fmeteor-accounts\u002Freferences\u002Foauth-services.md",{"path":71,"resourceType":58,"resourceTypeDesc":59,"sizeBytes":72,"sourceHtmlUrl":73},"references\u002Fpassword-flows.md",2973,"https:\u002F\u002Fgithub.com\u002Fmeteor\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fmeteor-accounts\u002Freferences\u002Fpassword-flows.md",{"path":75,"resourceType":58,"resourceTypeDesc":59,"sizeBytes":76,"sourceHtmlUrl":77},"references\u002Fpasswordless-requests.md",5405,"https:\u002F\u002Fgithub.com\u002Fmeteor\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fmeteor-accounts\u002Freferences\u002Fpasswordless-requests.md",{"path":79,"resourceType":58,"resourceTypeDesc":59,"sizeBytes":80,"sourceHtmlUrl":81},"references\u002Fusers-collection.md",2478,"https:\u002F\u002Fgithub.com\u002Fmeteor\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fmeteor-accounts\u002Freferences\u002Fusers-collection.md",[83,90,97,104,111,118],{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":19},"01M72VTT678CAVGTRHSCCZMNSN","migrate-to-rspack","Use when migrating an existing Meteor app to Rspack (Meteor 3.4+), or upgrading Rspack 1 to 2 on Meteor 3.6. Triggers on nested imports, mainModule entry points, server-only apps, replacing fourseven:scss \u002F meteor\u002Fless \u002F coffeescript \u002F jorgenvatle:vite \u002F zodern:melte with loaders, Svelte\u002FTypeScript preprocessing or Lingui SWC plugin failures after upgrade, CommonJS default-import interop, module.exports in client graphs, Node built-ins in browser code, _build \u002F build-assets \u002F build-chunks, .meteorignore hiding handoff files, dynamic chunks under ROOT_URL, meteor.modules for CSS\u002FHTML, resolve.symlinks or resolve.alias migration, automatic dependency updates and immutable CI\u002FDocker builds. Use this skill when the user asks about migration compatibility or a build plugin's Rspack replacement. For new-app setup and rspack.config.js helpers, use meteor-modern-build-stack instead.","https:\u002F\u002Fgithub.com\u002Fmeteor\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fmigrate-to-rspack\u002FSKILL.md",[],[],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":96,"publishedAt":19},"01M72VTMKP4FEEE8KPTBW0TS0Y","migrate-to-meteor-3","Use when migrating a Meteor 2.x application to Meteor 3.x. Triggers on callAsync, *Async Mongo, removed Fibers, implicit-global ReferenceError, lost Blaze reactivity, a publish function returning a Promise, a scheduler dropping a Promise, a read API receiving update modifiers, async allow\u002Fdeny, an Iron Router controller not running, \"Method stub took too long\", Atmosphere resolution, Express 5 WebApp handlers, lost async context, rawCollection callbacks, TypeScript declaration failures during upgrades, useTracker, and useSubscribe. Use this skill when the user asks about upgrading Meteor, async caller propagation, iterators with await, or replacing and forking packages. Standalone declarations and type-checking belong to meteor-typescript.","https:\u002F\u002Fgithub.com\u002Fmeteor\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fmigrate-to-meteor-3\u002FSKILL.md",[],[],{"skillNo":98,"name":99,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":19},"01M72VTEG9AB229C97SRKZ2FFG","meteor-typescript","Use when setting up or repairing Meteor application declarations, TypeScript configuration, JavaScript IntelliSense, or local and CI type-checking. Triggers on meteor types, meteor\u002F* imports resolving to any, missing declarations, duplicate Meteor identifiers, zodern:types, @types\u002Fmeteor, .meteor\u002Ftypes, tsconfig.json, jsconfig.json, and tsc --noEmit in a Meteor app. Use this skill when choosing or migrating declaration providers without changing the app's runtime or bundler. For a Meteor 2-to-3 runtime migration use migrate-to-meteor-3 first; for SWC\u002FRspack compilation use meteor-modern-build-stack or migrate-to-rspack. General TypeScript language questions and Atmosphere declaration publishing are outside this app scope.","https:\u002F\u002Fgithub.com\u002Fmeteor\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fmeteor-typescript\u002FSKILL.md",[],[],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":110,"publishedAt":19},"01M72VT9PART27QBM306JC3PGN","meteor-testing","Use when setting up, designing, writing, or repairing tests and test harnesses in a Meteor 3 app. Triggers on meteortesting:mocha, --driver-package, TEST_WATCH, TEST_BROWSER_DRIVER, MOCHA_GREP, meteor.testModule, focused tests, .only, Meteor.server.method_handlers, Meteor.server.publish_handlers, DDP.connect, --full-app integration mode, sinon, async test signatures, Playwright\u002FCypress E2E. Use this skill when the user asks about test runners, asks about testing publications, or asks about Jest vs Mocha in Meteor. For a failing, hanging, or flaky test whose failing layer or root cause is unknown, use meteor-debugging before changing the test or app.","https:\u002F\u002Fgithub.com\u002Fmeteor\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fmeteor-testing\u002FSKILL.md",[],[],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":117,"publishedAt":19},"01M72VT4X6FMW8YDG4GNR8FKNJ","meteor-security","Use when auditing or hardening a Meteor 3 application. Triggers on missing check() on method arguments, missing this.userId guards on publications, browser-policy CSP, DDPRateLimiter rules, oauth-encryption via Accounts.config oauthSecretKey, audit-argument-checks, allow\u002Fdeny legacy patterns, BrowserPolicy.content.disallowInlineScripts, BrowserPolicy.framing.disallow. Use this skill when the user asks about hardening, asks about a security review, or asks about CSP for a third-party script (Stripe, Google Maps, fonts).","https:\u002F\u002Fgithub.com\u002Fmeteor\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fmeteor-security\u002FSKILL.md",[],[],{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":19},"01M72VSY34AX3TF3AF68E5M4K9","meteor-react","Use when building or debugging React interfaces in Meteor 3: meteor create --react, createRoot, JSX or TSX entry points, Rspack React detection, Fast Refresh, react-meteor-data, useTracker, useSubscribe, useFind, withTracker, Suspense, and Tracker.withComputation. Triggers on isLoading being treated as a boolean, useFind receiving fetch(), stale closure inputs, duplicate tracker side effects, unstable Suspense keys, lost reactivity after await, state reset after refresh, or React tests leaking computations. Use this skill when the user asks about a React skeleton, React Compiler, React-specific rspack.config rules, reactive data hooks, or classic versus Suspense integration. Route general bundler configuration to meteor-modern-build-stack and Meteor 2 upgrades to migrate-to-meteor-3.","https:\u002F\u002Fgithub.com\u002Fmeteor\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fmeteor-react\u002FSKILL.md",[],[]]