chore: version packages

CHANGELOG.md

@@ -1,5 +1,158 @@
 # seamless-cli
 
+## 0.10.0
+
+### Minor Changes
+
+- 46ed8dd: Let adopters choose how the admin console is hosted during `seamless init`.
+
+  The old "Include Admin Dashboard?" / image-vs-source prompts are replaced by a
+  single question with four options:
+
+  - **Served by your API at /console** (recommended default) — the app backend
+    proxies the console via the SDK's `createSeamlessConsoleProxy`, so it loads
+    from the API's own origin. The scaffold sets `SERVE_ADMIN_CONSOLE=true` on the
+    API, `SERVE_ADMIN_DASHBOARD=true` on the auth server, and adds the API origin
+    to the auth server's `ORIGINS` so console passkey ceremonies verify. No
+    separate admin container.
+  - **Separate container** — official image or cloned source, as before, on
+    `http://localhost:5174`.
+  - **None** — no console is scaffolded.
+
+  Each choice pre-configures the auth-server env, the app-backend env, the Docker
+  Compose services, `seamless.config.json`, the success output, and `seamless
+check` accordingly. Pins the auth API image to `v0.3.0` and the templates to
+  `v0.3.0` (which env-gate the console proxy).
+
+- e612a10: Enable `email_otp` in the scaffolded auth server's default login methods.
+
+  The auth server's own default (`passkey,magic_link`) has no method the CLI can
+  drive without a browser authenticator, so `seamless login` could not sign in to
+  a freshly scaffolded local stack. `buildAuthEnv` now appends `email_otp` to
+  `LOGIN_METHODS` (composing with the OAuth method when providers are configured),
+  so email-OTP login works out of the box.
+
+- 7fbaff0: Enable `ALLOW_UNCREDENTIALED_DELIVERY_SECRETS=true` in the scaffolded auth server env.
+
+  Companion to the `email_otp` default: with it set, `seamless login --local`
+  reads the OTP straight from the auth server's response instead of needing a mail
+  provider, so signing in to a freshly scaffolded local stack works end to end.
+  It's a dev-only escape hatch — the auth server ignores it under a production
+  `NODE_ENV`, and the scaffold runs as development.
+
+### Patch Changes
+
+- 2e27156: Fix `seamless bootstrap-admin` to target the app API instead of the login profile's auth server.
+
+  The bootstrap invite route (`/auth/internal/bootstrap/admin-invite`) and its
+  delivery are exposed by the app API (the SeamlessAuth server adapter), not the
+  auth server directly — the auth server does not serve that path. Previously
+  `bootstrap-admin` fell back to the active profile's `instanceUrl`, so once a
+  profile pointed at the auth server (as `seamless login` and the admin commands
+  require), bootstrap requests 404'd.
+
+  `bootstrap-admin` now resolves its target independently of any profile:
+  `--api-url <url>` → `SEAMLESS_API_URL` → the local default `http://localhost:3000`.
+  The `--profile` flag is removed from this command (it no longer affects the
+  target; the bootstrap secret is still resolved from the local project).
+
+- 3dbdc61: Reconcile documentation with actual behavior.
+
+  - README: correct the Node requirement (24, per `.nvmrc`/`engines`, not 18);
+    update `bootstrap-admin` docs to the `--api-url` → `SEAMLESS_API_URL` →
+    `http://localhost:3000` resolution (the removed `--profile` flag and
+    auth-server-profile wording are gone).
+  - AGENTS.md: drop the `npm run typecheck`/`lint`/`format:check` commands that
+    don't exist (there is no lint/format tooling yet); note the `--filter=<flow>`
+    (`=` form) for `verify`; list the instance-management commands; remove the stale
+    top-level `templates/` reference (templates live in the `seamless-templates`
+    monorepo).
+  - `package.json`: drop the dead `templates` entry from `files`.
+
+  Closes #94.
+
+- e81a07d: Make `seamless check` managed-aware and resilient to partial config.
+
+  `checkCompose` dereferenced `config.docker.composeFile`, which is `null` for
+  managed projects, so `seamless check` crashed with a `TypeError` on any managed
+  scaffold. `check` now branches on `services.auth.mode === "managed"`: it validates
+  the remote instance's `/health/status` and skips the Docker/compose/container
+  checks (which don't apply remotely). It also wraps `JSON.parse` and guards missing
+  service entries so a malformed or partial `seamless.config.json` prints a friendly
+  message instead of a stack trace. The local console health check is derived from
+  `services.admin.mode` (image/source → :5174, api → :3000/console, none/hosted →
+  skipped).
+
+  Closes #78.
+
+- c4a0f93: Fix the conformance adapter flows to match the SDK's POST OTP/magic-link routes.
+
+  `@seamless-auth/express` now serves OTP generate routes (and `/magic-link`) over
+  POST, but the harness adapter flows still called them with GET, so every adapter
+  spec failed at `generate-email-otp -> 404` once the stack came up. The adapter
+  flows now POST `/auth/otp/generate-email-otp`, `/auth/otp/generate-login-email-otp`,
+  and `/auth/magic-link`.
+
+  Closes #111.
+
+- 545aafc: Disable auth rate limits in the conformance stack.
+
+  The conformance suite drives many OTP/registration/magic-link flows from a single
+  IP and trips auth-api's dedicated per-IP limiters (which `RATE_LIMIT` doesn't
+  tune), so the adapter layer failed with 429s once the stack came up. The verify
+  compose now sets `DISABLE_AUTH_RATE_LIMITS=true` on the auth-api service — a
+  dev-only flag (ignored under `NODE_ENV=production`) added in seamless-auth-api.
+
+  Requires seamless-auth-api with `DISABLE_AUTH_RATE_LIMITS` support; conformance
+  builds it from source, so no release is needed.
+
+- f7e5b5d: Fix the conformance stack and surface container logs on failure.
+
+  auth-api 0.3.0 requires `FRONTEND_URL` at startup (a required system config), which
+  the verify compose never set — so the auth-api container exited on boot and every
+  `conformance` run (here and in sibling repos calling the reusable workflow) aborted
+  with a bare "docker failed" before any layer ran. `verify/docker-compose.verify.yml`
+  now sets `FRONTEND_URL`, and `seamless verify` dumps recent container logs on a
+  setup failure so a container that exits on startup is diagnosable instead of hidden.
+
+  Closes #107.
+
+- 54f1f02: Quote generated `.env` values that a dotenv parser would otherwise misread.
+
+  `writeEnv` wrote bare `KEY=value`, so a value containing `#`, whitespace, quotes,
+  a backslash, or a newline (e.g. a managed `API_SERVICE_TOKEN` or a pasted OAuth
+  secret) produced a `.env` that dotenv truncates or mis-parses. Values that need
+  it are now double-quoted and escaped, and `parseEnv`/`parseEnvString` unquote on
+  read so the CLI round-trips its own output. Simple values (tokens, URLs, hex
+  secrets) are still written bare.
+
+  Closes #81.
+
+- 943d13d: Harden the managed `init` flow.
+
+  - **Explicit managed intent no longer silently scaffolds local.** When `--app` is
+    given but there is no usable session (expired or control plane unreachable),
+    `init` now fails with an actionable message instead of quietly scaffolding a
+    self-hosted project and ignoring the flag. Without `--app`, a missing session or
+    an unreachable control plane falls back to local with a clear warning (rather
+    than aborting on transient network errors, as it previously did for non-reauth
+    failures). Closes #79.
+  - **Service-token rotation is now recoverable.** Rotation invalidates the app's
+    previous token, so it runs after templates are copied (the likeliest failure
+    point), and every step after it is guarded: if scaffolding fails post-rotation,
+    the freshly issued token is printed so a deployed app can be re-wired instead of
+    left bricked. The same guard covers `integrateExistingProject`. Closes #80.
+
+- 9eaaf0e: Fix the conformance adapter crash: the dev service token was too short.
+
+  `seamless verify` defaulted `API_SERVICE_TOKEN` to a 24-char constant, which the
+  adapter reuses as its cookie secret; a newer `@seamless-auth/express` rejects a
+  cookieSecret shorter than 32, so the adapter container exited and conformance
+  failed after the stack came up. The dev service token and bootstrap secret
+  defaults are now >=32 characters.
+
+  Closes #109.
+
 ## 0.9.0
 
 ### Minor Changes

package.json

@@ -1,6 +1,6 @@
 {
   "name": "seamless-cli",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "The Seamless Auth command-line interface",
   "homepage": "https://github.com/fells-code/seamless-cli#readme",
   "bugs": {