From 5a74fae72f66c5bb60a37e8c944f2b3f10ebb960 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 8 Sep 2026 22:58:27 +0000 Subject: [PATCH] chore: version packages --- .changeset/ecosystem-bump-api-v0-12-0.md | 31 --------- .changeset/ecosystem-bump-september.md | 36 ---------- .changeset/steady-lions-page.md | 22 ------- CHANGELOG.md | 84 ++++++++++++++++++++++++ package.json | 2 +- 5 files changed, 85 insertions(+), 90 deletions(-) delete mode 100644 .changeset/ecosystem-bump-api-v0-12-0.md delete mode 100644 .changeset/ecosystem-bump-september.md delete mode 100644 .changeset/steady-lions-page.md diff --git a/.changeset/ecosystem-bump-api-v0-12-0.md b/.changeset/ecosystem-bump-api-v0-12-0.md deleted file mode 100644 index 9ebee18..0000000 --- a/.changeset/ecosystem-bump-api-v0-12-0.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -'seamless-cli': minor ---- - -Move the scaffold onto auth API `v0.12.0`, admin dashboard `v0.6.0`, and seamless-templates `v0.13.0`. - -`v0.11.0` puts passkey enrollment behind an access session. It is a breaking change to the wire -contract: `/webAuthn/register/start` and `/webAuthn/register/finish` used to accept the ephemeral -token the API mints from an email address alone, so anyone who knew an address could enroll a -credential against that account and sign in as its owner. Both routes read the access session now, -and enrollment no longer issues a session of its own, answering `200` with the credential instead. -The same release declares and validates the window on `GET /admin/users`, and adds organization -deletion along with a paged, searchable admin organization list. `v0.12.0` ships dashboard `v0.6.0` -inside the API image, which is what that dashboard release needs: it pages and searches organizations -on the server, gains a remove action, takes a date range on Overview and Security, and grows an -Authenticator Policy section. - -The admin dashboard pin moves with it, so the standalone console (`--admin=image` and -`--admin=source`) serves the same release the API image serves at `/console`. - -The enrollment change has no safe release order, so every side of it moves here at once. Templates -`v0.13.0` carries `@seamless-auth/react` `0.12.0`, `@seamless-auth/express` `0.14.0` and -`@seamless-auth/fastify` `0.5.0` in the starters, and the conformance harness's adapters take the -same `^0.14.0` and `^0.5.0`. The adapters forward the access session the API now requires; an older -one sends what this API refuses, so a scaffold pinned to either half alone would answer `401` at -enrollment. No shipped flow loses a step, because registration proves an address with an email OTP -and verifying it issues the session before the passkey screen appears. - -The adapters also proxy `DELETE /admin/organizations/:organizationId`, and forward the query string -on `GET /admin/users` and `GET /internal/auth-events/login-stats`, which both dropped it, so the -dashboard's user search and its login statistics range now reach the API as sent. diff --git a/.changeset/ecosystem-bump-september.md b/.changeset/ecosystem-bump-september.md deleted file mode 100644 index e209775..0000000 --- a/.changeset/ecosystem-bump-september.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -'seamless-cli': minor ---- - -Move the scaffold onto the current Seamless ecosystem: auth API `v0.10.0`, admin dashboard `v0.5.0`, -and seamless-templates `v0.12.0`. - -Three releases of auth API work land together. `v0.8.0` gives WebAuthn challenges their own store -with a five-minute expiry and one-time use, so a registration and a login can be outstanding at once -instead of clobbering each other, and it adds `AUTHENTICATOR_POLICY`, which decides attachment, user -verification, attestation, and whether a synced passkey may enrol. `v0.9.0` puts the lockout policy -and the per-IP and per-identity limiters on TOTP step-up, which had none of the three, and stops -running refresh tokens through bcrypt. `v0.10.0` drops the `sessions.refreshTokenHash` column the -previous release stopped writing. - -A scaffold's compose file is built from the pinned release's `.env.example`, so a new project picks up -`AUTHENTICATOR_POLICY` along with `SESSION_IDLE_TTL`, `MAX_CONCURRENT_SESSIONS` and a commented -`TRUST_PROXY`, and `REFRESH_TOKEN_TTL` moves from `1h` to `1d`. - -The admin dashboard bump keeps the standalone console (`--admin=image` and `--admin=source`) in step -with the one the API image now serves at `/console`, since `v0.10.0` embeds dashboard `v0.5.0` itself. -That release names the acting administrator separately from the subject in the events table, and -collects identity proofing before preparing a device replacement, which is what the API already -records and requires. - -Templates `v0.12.0` moves the starters onto `@seamless-auth/react` `0.11.0`, `@seamless-auth/express` -`0.13.0` and `@seamless-auth/fastify` `0.4.0`. All three are 0.x minors, so the caret ranges the -starters carried could never have resolved to them and a scaffolded project stayed on the older -versions however long ago they were pinned. It also carries per-application auth cookie names read -from `AUTH_COOKIE_PREFIX`, so two Seamless apps on one host stop overwriting each other's session. The -manifest contract is unchanged, so nothing in `init` moves with it. - -The conformance harness's adapters follow the same SDKs the starters now install: -`@seamless-auth/express` `^0.13.0` and `@seamless-auth/fastify` `^0.4.0`. Both stop repeating the -access and refresh tokens in the body of the response that sets them as `httpOnly` cookies, and both -forward a magic link's `redirectUri` to the API. diff --git a/.changeset/steady-lions-page.md b/.changeset/steady-lions-page.md deleted file mode 100644 index 65a7df9..0000000 --- a/.changeset/steady-lions-page.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -"seamless-cli": minor ---- - -Match the list windows the auth API now enforces, and let `org list` page. - -The API validates the window on its admin list routes: `limit` is 1 to 100 and -`offset` is 0 or more. The CLI checked both flags against one range with a floor -of zero, which was right for `--offset` and wrong for `--limit`, so -`users list --limit 0` and `users list --limit 500` were sent and came back as a -400 naming neither the flag nor the bound. Each flag is checked against its own -range now, and the message says which one was wrong and what it accepts. - -`--limit 0` is therefore an error rather than a request for nothing. Asking the -server for zero rows and reporting "No users." said there were none when the CLI -had not looked, which is worse than saying the flag is out of range. - -`org list` gains `--limit`, `--offset` and `--search`. It sent no window at all, -so once the API started defaulting to 50 it printed the first 50 organizations -and then a count of every organization, claiming rows it had not shown. It now -reports where the page sits, the way `users list` already did, and `--search` -matches the name and slug server-side. diff --git a/CHANGELOG.md b/CHANGELOG.md index ed1b42a..5e74e94 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,89 @@ # seamless-cli +## 0.14.0 + +### Minor Changes + +- af41ba4: Move the scaffold onto auth API `v0.12.0`, admin dashboard `v0.6.0`, and seamless-templates `v0.13.0`. + + `v0.11.0` puts passkey enrollment behind an access session. It is a breaking change to the wire + contract: `/webAuthn/register/start` and `/webAuthn/register/finish` used to accept the ephemeral + token the API mints from an email address alone, so anyone who knew an address could enroll a + credential against that account and sign in as its owner. Both routes read the access session now, + and enrollment no longer issues a session of its own, answering `200` with the credential instead. + The same release declares and validates the window on `GET /admin/users`, and adds organization + deletion along with a paged, searchable admin organization list. `v0.12.0` ships dashboard `v0.6.0` + inside the API image, which is what that dashboard release needs: it pages and searches organizations + on the server, gains a remove action, takes a date range on Overview and Security, and grows an + Authenticator Policy section. + + The admin dashboard pin moves with it, so the standalone console (`--admin=image` and + `--admin=source`) serves the same release the API image serves at `/console`. + + The enrollment change has no safe release order, so every side of it moves here at once. Templates + `v0.13.0` carries `@seamless-auth/react` `0.12.0`, `@seamless-auth/express` `0.14.0` and + `@seamless-auth/fastify` `0.5.0` in the starters, and the conformance harness's adapters take the + same `^0.14.0` and `^0.5.0`. The adapters forward the access session the API now requires; an older + one sends what this API refuses, so a scaffold pinned to either half alone would answer `401` at + enrollment. No shipped flow loses a step, because registration proves an address with an email OTP + and verifying it issues the session before the passkey screen appears. + + The adapters also proxy `DELETE /admin/organizations/:organizationId`, and forward the query string + on `GET /admin/users` and `GET /internal/auth-events/login-stats`, which both dropped it, so the + dashboard's user search and its login statistics range now reach the API as sent. + +- 206e3cd: Move the scaffold onto the current Seamless ecosystem: auth API `v0.10.0`, admin dashboard `v0.5.0`, + and seamless-templates `v0.12.0`. + + Three releases of auth API work land together. `v0.8.0` gives WebAuthn challenges their own store + with a five-minute expiry and one-time use, so a registration and a login can be outstanding at once + instead of clobbering each other, and it adds `AUTHENTICATOR_POLICY`, which decides attachment, user + verification, attestation, and whether a synced passkey may enrol. `v0.9.0` puts the lockout policy + and the per-IP and per-identity limiters on TOTP step-up, which had none of the three, and stops + running refresh tokens through bcrypt. `v0.10.0` drops the `sessions.refreshTokenHash` column the + previous release stopped writing. + + A scaffold's compose file is built from the pinned release's `.env.example`, so a new project picks up + `AUTHENTICATOR_POLICY` along with `SESSION_IDLE_TTL`, `MAX_CONCURRENT_SESSIONS` and a commented + `TRUST_PROXY`, and `REFRESH_TOKEN_TTL` moves from `1h` to `1d`. + + The admin dashboard bump keeps the standalone console (`--admin=image` and `--admin=source`) in step + with the one the API image now serves at `/console`, since `v0.10.0` embeds dashboard `v0.5.0` itself. + That release names the acting administrator separately from the subject in the events table, and + collects identity proofing before preparing a device replacement, which is what the API already + records and requires. + + Templates `v0.12.0` moves the starters onto `@seamless-auth/react` `0.11.0`, `@seamless-auth/express` + `0.13.0` and `@seamless-auth/fastify` `0.4.0`. All three are 0.x minors, so the caret ranges the + starters carried could never have resolved to them and a scaffolded project stayed on the older + versions however long ago they were pinned. It also carries per-application auth cookie names read + from `AUTH_COOKIE_PREFIX`, so two Seamless apps on one host stop overwriting each other's session. The + manifest contract is unchanged, so nothing in `init` moves with it. + + The conformance harness's adapters follow the same SDKs the starters now install: + `@seamless-auth/express` `^0.13.0` and `@seamless-auth/fastify` `^0.4.0`. Both stop repeating the + access and refresh tokens in the body of the response that sets them as `httpOnly` cookies, and both + forward a magic link's `redirectUri` to the API. + +- ec85b59: Match the list windows the auth API now enforces, and let `org list` page. + + The API validates the window on its admin list routes: `limit` is 1 to 100 and + `offset` is 0 or more. The CLI checked both flags against one range with a floor + of zero, which was right for `--offset` and wrong for `--limit`, so + `users list --limit 0` and `users list --limit 500` were sent and came back as a + 400 naming neither the flag nor the bound. Each flag is checked against its own + range now, and the message says which one was wrong and what it accepts. + + `--limit 0` is therefore an error rather than a request for nothing. Asking the + server for zero rows and reporting "No users." said there were none when the CLI + had not looked, which is worse than saying the flag is out of range. + + `org list` gains `--limit`, `--offset` and `--search`. It sent no window at all, + so once the API started defaulting to 50 it printed the first 50 organizations + and then a count of every organization, claiming rows it had not shown. It now + reports where the page sits, the way `users list` already did, and `--search` + matches the name and slug server-side. + ## 0.13.0 ### Minor Changes diff --git a/package.json b/package.json index c47fdf8..e620acc 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "seamless-cli", - "version": "0.13.0", + "version": "0.14.0", "description": "The Seamless Auth command-line interface", "homepage": "https://github.com/fells-code/seamless-cli#readme", "bugs": {