chore: bump to auth API v0.12.0, dashboard v0.6.0, templates v0.13.0

.changeset/ecosystem-bump-api-v0-12-0.md

@@ -0,0 +1,31 @@
+---
+'seamless-cli': minor
+---
+
+Move the scaffold onto auth API `v0.12.0`, admin dashboard `v0.6.0`, and seamless-templates `v0.13.0`.
+
+`v0.11.0` puts passkey enrollment behind an access session. It is a breaking change to the wire
+contract: `/webAuthn/register/start` and `/webAuthn/register/finish` used to accept the ephemeral
+token the API mints from an email address alone, so anyone who knew an address could enroll a
+credential against that account and sign in as its owner. Both routes read the access session now,
+and enrollment no longer issues a session of its own, answering `200` with the credential instead.
+The same release declares and validates the window on `GET /admin/users`, and adds organization
+deletion along with a paged, searchable admin organization list. `v0.12.0` ships dashboard `v0.6.0`
+inside the API image, which is what that dashboard release needs: it pages and searches organizations
+on the server, gains a remove action, takes a date range on Overview and Security, and grows an
+Authenticator Policy section.
+
+The admin dashboard pin moves with it, so the standalone console (`--admin=image` and
+`--admin=source`) serves the same release the API image serves at `/console`.
+
+The enrollment change has no safe release order, so every side of it moves here at once. Templates
+`v0.13.0` carries `@seamless-auth/react` `0.12.0`, `@seamless-auth/express` `0.14.0` and
+`@seamless-auth/fastify` `0.5.0` in the starters, and the conformance harness's adapters take the
+same `^0.14.0` and `^0.5.0`. The adapters forward the access session the API now requires; an older
+one sends what this API refuses, so a scaffold pinned to either half alone would answer `401` at
+enrollment. No shipped flow loses a step, because registration proves an address with an email OTP
+and verifying it issues the session before the passkey screen appears.
+
+The adapters also proxy `DELETE /admin/organizations/:organizationId`, and forward the query string
+on `GET /admin/users` and `GET /internal/auth-events/login-stats`, which both dropped it, so the
+dashboard's user search and its login statistics range now reach the API as sent.

src/core/images.ts

@@ -3,11 +3,11 @@
 // scaffolded with, and never has its data directory pulled out from under it.
 export const POSTGRES_IMAGE = "postgres:18";
 
-export const SEAMLESS_AUTH_API_VERSION = "v0.10.0";
+export const SEAMLESS_AUTH_API_VERSION = "v0.12.0";
 
 export const SEAMLESS_AUTH_API_IMAGE = `ghcr.io/fells-code/seamless-auth-api:${SEAMLESS_AUTH_API_VERSION}`;
 
-export const SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION = "v0.5.0";
+export const SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION = "v0.6.0";
 
 export const SEAMLESS_AUTH_ADMIN_DASHBOARD_IMAGE = `ghcr.io/fells-code/seamless-auth-admin-dashboard:${SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION}`;
 
@@ -25,4 +25,4 @@ export const SEAMLESS_AUTH_ADMIN_DASHBOARD_REF = SEAMLESS_AUTH_ADMIN_DASHBOARD_V
 // SEAMLESS_TEMPLATES_REF, or point at a local checkout with SEAMLESS_TEMPLATES_DIR.
 export const SEAMLESS_TEMPLATES_REPO = "fells-code/seamless-templates";
 
-export const SEAMLESS_TEMPLATES_REF = "v0.12.0";
+export const SEAMLESS_TEMPLATES_REF = "v0.13.0";

verify/adapter-app/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "description": "Minimal adopter backend for the conformance harness — real @seamless-auth/express with a capture transport.",
   "dependencies": {
-    "@seamless-auth/express": "^0.13.0",
+    "@seamless-auth/express": "^0.14.0",
     "cookie-parser": "^1.4.6",
     "cors": "^2.8.5",
     "express": "^5.1.0"

verify/adapter-fastify-app/package.json

@@ -6,7 +6,7 @@
   "description": "Minimal adopter backend for the conformance harness — real @seamless-auth/fastify with a capture transport.",
   "dependencies": {
     "@fastify/cors": "^11.0.1",
-    "@seamless-auth/fastify": "^0.4.0",
+    "@seamless-auth/fastify": "^0.5.0",
     "fastify": "^5.2.0"
   }
 }