From 82234c61bdfae7d3d70586eb0ff391dfb8819d16 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 25 Jul 2026 17:39:42 +0000 Subject: [PATCH] chore: version packages --- .changeset/bootstrap-admin-api-url.md | 17 -- .changeset/console-hosting-choice.md | 23 --- .changeset/docs-reconcile-drift.md | 18 --- .changeset/fix-check-managed-aware.md | 17 -- .../fix-conformance-adapter-otp-post.md | 13 -- .../fix-conformance-disable-rate-limits.md | 14 -- .changeset/fix-conformance-frontend-url.md | 14 -- .changeset/fix-env-quoting.md | 14 -- .changeset/fix-managed-init-hardening.md | 18 --- .changeset/fix-verify-cookie-secret-length.md | 13 -- .changeset/scaffold-email-otp-default.md | 11 -- .changeset/scaffold-local-delivery.md | 11 -- CHANGELOG.md | 153 ++++++++++++++++++ package.json | 2 +- 14 files changed, 154 insertions(+), 184 deletions(-) delete mode 100644 .changeset/bootstrap-admin-api-url.md delete mode 100644 .changeset/console-hosting-choice.md delete mode 100644 .changeset/docs-reconcile-drift.md delete mode 100644 .changeset/fix-check-managed-aware.md delete mode 100644 .changeset/fix-conformance-adapter-otp-post.md delete mode 100644 .changeset/fix-conformance-disable-rate-limits.md delete mode 100644 .changeset/fix-conformance-frontend-url.md delete mode 100644 .changeset/fix-env-quoting.md delete mode 100644 .changeset/fix-managed-init-hardening.md delete mode 100644 .changeset/fix-verify-cookie-secret-length.md delete mode 100644 .changeset/scaffold-email-otp-default.md delete mode 100644 .changeset/scaffold-local-delivery.md diff --git a/.changeset/bootstrap-admin-api-url.md b/.changeset/bootstrap-admin-api-url.md deleted file mode 100644 index b94afe8..0000000 --- a/.changeset/bootstrap-admin-api-url.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -"seamless-cli": patch ---- - -Fix `seamless bootstrap-admin` to target the app API instead of the login profile's auth server. - -The bootstrap invite route (`/auth/internal/bootstrap/admin-invite`) and its -delivery are exposed by the app API (the SeamlessAuth server adapter), not the -auth server directly — the auth server does not serve that path. Previously -`bootstrap-admin` fell back to the active profile's `instanceUrl`, so once a -profile pointed at the auth server (as `seamless login` and the admin commands -require), bootstrap requests 404'd. - -`bootstrap-admin` now resolves its target independently of any profile: -`--api-url ` → `SEAMLESS_API_URL` → the local default `http://localhost:3000`. -The `--profile` flag is removed from this command (it no longer affects the -target; the bootstrap secret is still resolved from the local project). diff --git a/.changeset/console-hosting-choice.md b/.changeset/console-hosting-choice.md deleted file mode 100644 index a4aef22..0000000 --- a/.changeset/console-hosting-choice.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -"seamless-cli": minor ---- - -Let adopters choose how the admin console is hosted during `seamless init`. - -The old "Include Admin Dashboard?" / image-vs-source prompts are replaced by a -single question with four options: - -- **Served by your API at /console** (recommended default) — the app backend - proxies the console via the SDK's `createSeamlessConsoleProxy`, so it loads - from the API's own origin. The scaffold sets `SERVE_ADMIN_CONSOLE=true` on the - API, `SERVE_ADMIN_DASHBOARD=true` on the auth server, and adds the API origin - to the auth server's `ORIGINS` so console passkey ceremonies verify. No - separate admin container. -- **Separate container** — official image or cloned source, as before, on - `http://localhost:5174`. -- **None** — no console is scaffolded. - -Each choice pre-configures the auth-server env, the app-backend env, the Docker -Compose services, `seamless.config.json`, the success output, and `seamless -check` accordingly. Pins the auth API image to `v0.3.0` and the templates to -`v0.3.0` (which env-gate the console proxy). diff --git a/.changeset/docs-reconcile-drift.md b/.changeset/docs-reconcile-drift.md deleted file mode 100644 index b48e3d7..0000000 --- a/.changeset/docs-reconcile-drift.md +++ /dev/null @@ -1,18 +0,0 @@ ---- -"seamless-cli": patch ---- - -Reconcile documentation with actual behavior. - -- README: correct the Node requirement (24, per `.nvmrc`/`engines`, not 18); - update `bootstrap-admin` docs to the `--api-url` → `SEAMLESS_API_URL` → - `http://localhost:3000` resolution (the removed `--profile` flag and - auth-server-profile wording are gone). -- AGENTS.md: drop the `npm run typecheck`/`lint`/`format:check` commands that - don't exist (there is no lint/format tooling yet); note the `--filter=` - (`=` form) for `verify`; list the instance-management commands; remove the stale - top-level `templates/` reference (templates live in the `seamless-templates` - monorepo). -- `package.json`: drop the dead `templates` entry from `files`. - -Closes #94. diff --git a/.changeset/fix-check-managed-aware.md b/.changeset/fix-check-managed-aware.md deleted file mode 100644 index cc805c4..0000000 --- a/.changeset/fix-check-managed-aware.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -"seamless-cli": patch ---- - -Make `seamless check` managed-aware and resilient to partial config. - -`checkCompose` dereferenced `config.docker.composeFile`, which is `null` for -managed projects, so `seamless check` crashed with a `TypeError` on any managed -scaffold. `check` now branches on `services.auth.mode === "managed"`: it validates -the remote instance's `/health/status` and skips the Docker/compose/container -checks (which don't apply remotely). It also wraps `JSON.parse` and guards missing -service entries so a malformed or partial `seamless.config.json` prints a friendly -message instead of a stack trace. The local console health check is derived from -`services.admin.mode` (image/source → :5174, api → :3000/console, none/hosted → -skipped). - -Closes #78. diff --git a/.changeset/fix-conformance-adapter-otp-post.md b/.changeset/fix-conformance-adapter-otp-post.md deleted file mode 100644 index 60491f0..0000000 --- a/.changeset/fix-conformance-adapter-otp-post.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -"seamless-cli": patch ---- - -Fix the conformance adapter flows to match the SDK's POST OTP/magic-link routes. - -`@seamless-auth/express` now serves OTP generate routes (and `/magic-link`) over -POST, but the harness adapter flows still called them with GET, so every adapter -spec failed at `generate-email-otp -> 404` once the stack came up. The adapter -flows now POST `/auth/otp/generate-email-otp`, `/auth/otp/generate-login-email-otp`, -and `/auth/magic-link`. - -Closes #111. diff --git a/.changeset/fix-conformance-disable-rate-limits.md b/.changeset/fix-conformance-disable-rate-limits.md deleted file mode 100644 index 439c550..0000000 --- a/.changeset/fix-conformance-disable-rate-limits.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -"seamless-cli": patch ---- - -Disable auth rate limits in the conformance stack. - -The conformance suite drives many OTP/registration/magic-link flows from a single -IP and trips auth-api's dedicated per-IP limiters (which `RATE_LIMIT` doesn't -tune), so the adapter layer failed with 429s once the stack came up. The verify -compose now sets `DISABLE_AUTH_RATE_LIMITS=true` on the auth-api service — a -dev-only flag (ignored under `NODE_ENV=production`) added in seamless-auth-api. - -Requires seamless-auth-api with `DISABLE_AUTH_RATE_LIMITS` support; conformance -builds it from source, so no release is needed. diff --git a/.changeset/fix-conformance-frontend-url.md b/.changeset/fix-conformance-frontend-url.md deleted file mode 100644 index 4cd869d..0000000 --- a/.changeset/fix-conformance-frontend-url.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -"seamless-cli": patch ---- - -Fix the conformance stack and surface container logs on failure. - -auth-api 0.3.0 requires `FRONTEND_URL` at startup (a required system config), which -the verify compose never set — so the auth-api container exited on boot and every -`conformance` run (here and in sibling repos calling the reusable workflow) aborted -with a bare "docker failed" before any layer ran. `verify/docker-compose.verify.yml` -now sets `FRONTEND_URL`, and `seamless verify` dumps recent container logs on a -setup failure so a container that exits on startup is diagnosable instead of hidden. - -Closes #107. diff --git a/.changeset/fix-env-quoting.md b/.changeset/fix-env-quoting.md deleted file mode 100644 index 7c35b31..0000000 --- a/.changeset/fix-env-quoting.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -"seamless-cli": patch ---- - -Quote generated `.env` values that a dotenv parser would otherwise misread. - -`writeEnv` wrote bare `KEY=value`, so a value containing `#`, whitespace, quotes, -a backslash, or a newline (e.g. a managed `API_SERVICE_TOKEN` or a pasted OAuth -secret) produced a `.env` that dotenv truncates or mis-parses. Values that need -it are now double-quoted and escaped, and `parseEnv`/`parseEnvString` unquote on -read so the CLI round-trips its own output. Simple values (tokens, URLs, hex -secrets) are still written bare. - -Closes #81. diff --git a/.changeset/fix-managed-init-hardening.md b/.changeset/fix-managed-init-hardening.md deleted file mode 100644 index ee1acd6..0000000 --- a/.changeset/fix-managed-init-hardening.md +++ /dev/null @@ -1,18 +0,0 @@ ---- -"seamless-cli": patch ---- - -Harden the managed `init` flow. - -- **Explicit managed intent no longer silently scaffolds local.** When `--app` is - given but there is no usable session (expired or control plane unreachable), - `init` now fails with an actionable message instead of quietly scaffolding a - self-hosted project and ignoring the flag. Without `--app`, a missing session or - an unreachable control plane falls back to local with a clear warning (rather - than aborting on transient network errors, as it previously did for non-reauth - failures). Closes #79. -- **Service-token rotation is now recoverable.** Rotation invalidates the app's - previous token, so it runs after templates are copied (the likeliest failure - point), and every step after it is guarded: if scaffolding fails post-rotation, - the freshly issued token is printed so a deployed app can be re-wired instead of - left bricked. The same guard covers `integrateExistingProject`. Closes #80. diff --git a/.changeset/fix-verify-cookie-secret-length.md b/.changeset/fix-verify-cookie-secret-length.md deleted file mode 100644 index 02fd0aa..0000000 --- a/.changeset/fix-verify-cookie-secret-length.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -"seamless-cli": patch ---- - -Fix the conformance adapter crash: the dev service token was too short. - -`seamless verify` defaulted `API_SERVICE_TOKEN` to a 24-char constant, which the -adapter reuses as its cookie secret; a newer `@seamless-auth/express` rejects a -cookieSecret shorter than 32, so the adapter container exited and conformance -failed after the stack came up. The dev service token and bootstrap secret -defaults are now >=32 characters. - -Closes #109. diff --git a/.changeset/scaffold-email-otp-default.md b/.changeset/scaffold-email-otp-default.md deleted file mode 100644 index eb72c54..0000000 --- a/.changeset/scaffold-email-otp-default.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -"seamless-cli": minor ---- - -Enable `email_otp` in the scaffolded auth server's default login methods. - -The auth server's own default (`passkey,magic_link`) has no method the CLI can -drive without a browser authenticator, so `seamless login` could not sign in to -a freshly scaffolded local stack. `buildAuthEnv` now appends `email_otp` to -`LOGIN_METHODS` (composing with the OAuth method when providers are configured), -so email-OTP login works out of the box. diff --git a/.changeset/scaffold-local-delivery.md b/.changeset/scaffold-local-delivery.md deleted file mode 100644 index 7605454..0000000 --- a/.changeset/scaffold-local-delivery.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -"seamless-cli": minor ---- - -Enable `ALLOW_UNCREDENTIALED_DELIVERY_SECRETS=true` in the scaffolded auth server env. - -Companion to the `email_otp` default: with it set, `seamless login --local` -reads the OTP straight from the auth server's response instead of needing a mail -provider, so signing in to a freshly scaffolded local stack works end to end. -It's a dev-only escape hatch — the auth server ignores it under a production -`NODE_ENV`, and the scaffold runs as development. diff --git a/CHANGELOG.md b/CHANGELOG.md index 5b9bc9c..472df67 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,158 @@ # seamless-cli +## 0.10.0 + +### Minor Changes + +- 46ed8dd: Let adopters choose how the admin console is hosted during `seamless init`. + + The old "Include Admin Dashboard?" / image-vs-source prompts are replaced by a + single question with four options: + + - **Served by your API at /console** (recommended default) — the app backend + proxies the console via the SDK's `createSeamlessConsoleProxy`, so it loads + from the API's own origin. The scaffold sets `SERVE_ADMIN_CONSOLE=true` on the + API, `SERVE_ADMIN_DASHBOARD=true` on the auth server, and adds the API origin + to the auth server's `ORIGINS` so console passkey ceremonies verify. No + separate admin container. + - **Separate container** — official image or cloned source, as before, on + `http://localhost:5174`. + - **None** — no console is scaffolded. + + Each choice pre-configures the auth-server env, the app-backend env, the Docker + Compose services, `seamless.config.json`, the success output, and `seamless +check` accordingly. Pins the auth API image to `v0.3.0` and the templates to + `v0.3.0` (which env-gate the console proxy). + +- e612a10: Enable `email_otp` in the scaffolded auth server's default login methods. + + The auth server's own default (`passkey,magic_link`) has no method the CLI can + drive without a browser authenticator, so `seamless login` could not sign in to + a freshly scaffolded local stack. `buildAuthEnv` now appends `email_otp` to + `LOGIN_METHODS` (composing with the OAuth method when providers are configured), + so email-OTP login works out of the box. + +- 7fbaff0: Enable `ALLOW_UNCREDENTIALED_DELIVERY_SECRETS=true` in the scaffolded auth server env. + + Companion to the `email_otp` default: with it set, `seamless login --local` + reads the OTP straight from the auth server's response instead of needing a mail + provider, so signing in to a freshly scaffolded local stack works end to end. + It's a dev-only escape hatch — the auth server ignores it under a production + `NODE_ENV`, and the scaffold runs as development. + +### Patch Changes + +- 2e27156: Fix `seamless bootstrap-admin` to target the app API instead of the login profile's auth server. + + The bootstrap invite route (`/auth/internal/bootstrap/admin-invite`) and its + delivery are exposed by the app API (the SeamlessAuth server adapter), not the + auth server directly — the auth server does not serve that path. Previously + `bootstrap-admin` fell back to the active profile's `instanceUrl`, so once a + profile pointed at the auth server (as `seamless login` and the admin commands + require), bootstrap requests 404'd. + + `bootstrap-admin` now resolves its target independently of any profile: + `--api-url ` → `SEAMLESS_API_URL` → the local default `http://localhost:3000`. + The `--profile` flag is removed from this command (it no longer affects the + target; the bootstrap secret is still resolved from the local project). + +- 3dbdc61: Reconcile documentation with actual behavior. + + - README: correct the Node requirement (24, per `.nvmrc`/`engines`, not 18); + update `bootstrap-admin` docs to the `--api-url` → `SEAMLESS_API_URL` → + `http://localhost:3000` resolution (the removed `--profile` flag and + auth-server-profile wording are gone). + - AGENTS.md: drop the `npm run typecheck`/`lint`/`format:check` commands that + don't exist (there is no lint/format tooling yet); note the `--filter=` + (`=` form) for `verify`; list the instance-management commands; remove the stale + top-level `templates/` reference (templates live in the `seamless-templates` + monorepo). + - `package.json`: drop the dead `templates` entry from `files`. + + Closes #94. + +- e81a07d: Make `seamless check` managed-aware and resilient to partial config. + + `checkCompose` dereferenced `config.docker.composeFile`, which is `null` for + managed projects, so `seamless check` crashed with a `TypeError` on any managed + scaffold. `check` now branches on `services.auth.mode === "managed"`: it validates + the remote instance's `/health/status` and skips the Docker/compose/container + checks (which don't apply remotely). It also wraps `JSON.parse` and guards missing + service entries so a malformed or partial `seamless.config.json` prints a friendly + message instead of a stack trace. The local console health check is derived from + `services.admin.mode` (image/source → :5174, api → :3000/console, none/hosted → + skipped). + + Closes #78. + +- c4a0f93: Fix the conformance adapter flows to match the SDK's POST OTP/magic-link routes. + + `@seamless-auth/express` now serves OTP generate routes (and `/magic-link`) over + POST, but the harness adapter flows still called them with GET, so every adapter + spec failed at `generate-email-otp -> 404` once the stack came up. The adapter + flows now POST `/auth/otp/generate-email-otp`, `/auth/otp/generate-login-email-otp`, + and `/auth/magic-link`. + + Closes #111. + +- 545aafc: Disable auth rate limits in the conformance stack. + + The conformance suite drives many OTP/registration/magic-link flows from a single + IP and trips auth-api's dedicated per-IP limiters (which `RATE_LIMIT` doesn't + tune), so the adapter layer failed with 429s once the stack came up. The verify + compose now sets `DISABLE_AUTH_RATE_LIMITS=true` on the auth-api service — a + dev-only flag (ignored under `NODE_ENV=production`) added in seamless-auth-api. + + Requires seamless-auth-api with `DISABLE_AUTH_RATE_LIMITS` support; conformance + builds it from source, so no release is needed. + +- f7e5b5d: Fix the conformance stack and surface container logs on failure. + + auth-api 0.3.0 requires `FRONTEND_URL` at startup (a required system config), which + the verify compose never set — so the auth-api container exited on boot and every + `conformance` run (here and in sibling repos calling the reusable workflow) aborted + with a bare "docker failed" before any layer ran. `verify/docker-compose.verify.yml` + now sets `FRONTEND_URL`, and `seamless verify` dumps recent container logs on a + setup failure so a container that exits on startup is diagnosable instead of hidden. + + Closes #107. + +- 54f1f02: Quote generated `.env` values that a dotenv parser would otherwise misread. + + `writeEnv` wrote bare `KEY=value`, so a value containing `#`, whitespace, quotes, + a backslash, or a newline (e.g. a managed `API_SERVICE_TOKEN` or a pasted OAuth + secret) produced a `.env` that dotenv truncates or mis-parses. Values that need + it are now double-quoted and escaped, and `parseEnv`/`parseEnvString` unquote on + read so the CLI round-trips its own output. Simple values (tokens, URLs, hex + secrets) are still written bare. + + Closes #81. + +- 943d13d: Harden the managed `init` flow. + + - **Explicit managed intent no longer silently scaffolds local.** When `--app` is + given but there is no usable session (expired or control plane unreachable), + `init` now fails with an actionable message instead of quietly scaffolding a + self-hosted project and ignoring the flag. Without `--app`, a missing session or + an unreachable control plane falls back to local with a clear warning (rather + than aborting on transient network errors, as it previously did for non-reauth + failures). Closes #79. + - **Service-token rotation is now recoverable.** Rotation invalidates the app's + previous token, so it runs after templates are copied (the likeliest failure + point), and every step after it is guarded: if scaffolding fails post-rotation, + the freshly issued token is printed so a deployed app can be re-wired instead of + left bricked. The same guard covers `integrateExistingProject`. Closes #80. + +- 9eaaf0e: Fix the conformance adapter crash: the dev service token was too short. + + `seamless verify` defaulted `API_SERVICE_TOKEN` to a 24-char constant, which the + adapter reuses as its cookie secret; a newer `@seamless-auth/express` rejects a + cookieSecret shorter than 32, so the adapter container exited and conformance + failed after the stack came up. The dev service token and bootstrap secret + defaults are now >=32 characters. + + Closes #109. + ## 0.9.0 ### Minor Changes diff --git a/package.json b/package.json index a0bcf63..7fd8aed 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "seamless-cli", - "version": "0.9.0", + "version": "0.10.0", "description": "The Seamless Auth command-line interface", "homepage": "https://github.com/fells-code/seamless-cli#readme", "bugs": {