From c99c759f6bba887d92c497041c389722fd76ff3e Mon Sep 17 00:00:00 2001 From: Brandon Corbett Date: Sat, 12 Sep 2026 18:03:00 -0700 Subject: [PATCH] chore: bump to auth API v0.13.1, dashboard v0.7.0 and templates v0.14.0 SEAMLESS_AUTH_API_VERSION v0.12.0 to v0.13.1, SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION v0.6.0 to v0.7.0, SEAMLESS_TEMPLATES_REF v0.13.0 to v0.14.0, and the conformance harness adapters to @seamless-auth/express ^0.15.0 and @seamless-auth/fastify ^0.6.0. API 0.13.0 records a deployment id, device class, mail provider, owner flag and attempt id on every audit row and adds the funnel and sign-ins metrics routes; 0.13.1 is the same server on a release image that applies Debian security updates, since 0.13.0 never published one. Dashboard 0.7.0 reads both routes on its Overview, so the standalone console pin moves with the API image, which serves the same dashboard at /console. Templates 0.14.0 carries the adapters that forward the browser user agent, which the device class depends on; its manifest contract and registry are byte-identical to 0.13.0. --- .changeset/ecosystem-bump-api-v0-13-1.md | 31 ++++++++++++++++++++++++ src/core/images.ts | 6 ++--- verify/adapter-app/package.json | 2 +- verify/adapter-fastify-app/package.json | 2 +- 4 files changed, 36 insertions(+), 5 deletions(-) create mode 100644 .changeset/ecosystem-bump-api-v0-13-1.md diff --git a/.changeset/ecosystem-bump-api-v0-13-1.md b/.changeset/ecosystem-bump-api-v0-13-1.md new file mode 100644 index 0000000..97575e4 --- /dev/null +++ b/.changeset/ecosystem-bump-api-v0-13-1.md @@ -0,0 +1,31 @@ +--- +'seamless-cli': minor +--- + +Move the scaffold onto auth API `v0.13.1`, admin dashboard `v0.7.0`, and seamless-templates `v0.14.0`. + +`v0.13.0` instruments the auth path. Every `auth_events` row now carries a deployment id, a device +class folded from the user agent, the subject's mail provider (a provider name, never the domain), +an owner flag, and the attempt the row belongs to (the ephemeral token's new `jti`). `GET +/internal/metrics/funnel` reports time to registration, time to login and passkey adoption, and +`GET /internal/metrics/sign-ins` reports sign-in outcomes per method, device class, mail provider +and owner flag, with where attempts stop. The same release ships dashboard `v0.7.0` inside the API +image, which is what that dashboard release needs: its Overview gains a Passwordless Funnel section +and a Sign-in Outcomes section that read those two routes. `v0.13.1` is the same server on a +release image that applies Debian security updates at build time, since `v0.13.0` never published an +image (its scan failed on a base-image `pcre2` finding). + +The admin dashboard pin moves with it, so the standalone console (`--admin=image` and +`--admin=source`) serves the same release the API image serves at `/console`. Against an older API +the two new Overview sections report themselves unavailable in place and the rest of the screen is +unaffected. + +Templates `v0.14.0` carries `@seamless-auth/express` `0.15.0` and `@seamless-auth/fastify` `0.6.0` +in the API starters, and the conformance harness's adapters take the same `^0.15.0` and `^0.6.0`. +Those adapters forward the browser's user agent to the API as `x-seamless-client-user-agent` +beside the client address they already forward, and pass the sign-ins route through. The adapter is +the only client the API sees, so a project on the older adapters has every audit row recorded as the +adapter's own user agent and its breakdown by device reads `unknown`; the other dimensions do not +depend on it. Nothing else in the starters moves: the manifest contract and the registry are +byte-identical to `v0.13.0`, and the React starters stay on `@seamless-auth/react` `0.12.0`, since +the token claim the API added is one the client never reads. diff --git a/src/core/images.ts b/src/core/images.ts index 43e0e5e..8c1a58b 100644 --- a/src/core/images.ts +++ b/src/core/images.ts @@ -3,11 +3,11 @@ // scaffolded with, and never has its data directory pulled out from under it. export const POSTGRES_IMAGE = "postgres:18"; -export const SEAMLESS_AUTH_API_VERSION = "v0.12.0"; +export const SEAMLESS_AUTH_API_VERSION = "v0.13.1"; export const SEAMLESS_AUTH_API_IMAGE = `ghcr.io/fells-code/seamless-auth-api:${SEAMLESS_AUTH_API_VERSION}`; -export const SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION = "v0.6.0"; +export const SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION = "v0.7.0"; export const SEAMLESS_AUTH_ADMIN_DASHBOARD_IMAGE = `ghcr.io/fells-code/seamless-auth-admin-dashboard:${SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION}`; @@ -25,4 +25,4 @@ export const SEAMLESS_AUTH_ADMIN_DASHBOARD_REF = SEAMLESS_AUTH_ADMIN_DASHBOARD_V // SEAMLESS_TEMPLATES_REF, or point at a local checkout with SEAMLESS_TEMPLATES_DIR. export const SEAMLESS_TEMPLATES_REPO = "fells-code/seamless-templates"; -export const SEAMLESS_TEMPLATES_REF = "v0.13.0"; +export const SEAMLESS_TEMPLATES_REF = "v0.14.0"; diff --git a/verify/adapter-app/package.json b/verify/adapter-app/package.json index 2a543cf..6f6652e 100644 --- a/verify/adapter-app/package.json +++ b/verify/adapter-app/package.json @@ -5,7 +5,7 @@ "type": "module", "description": "Minimal adopter backend for the conformance harness — real @seamless-auth/express with a capture transport.", "dependencies": { - "@seamless-auth/express": "^0.14.0", + "@seamless-auth/express": "^0.15.0", "cookie-parser": "^1.4.6", "cors": "^2.8.5", "express": "^5.1.0" diff --git a/verify/adapter-fastify-app/package.json b/verify/adapter-fastify-app/package.json index 10aae80..66a72b7 100644 --- a/verify/adapter-fastify-app/package.json +++ b/verify/adapter-fastify-app/package.json @@ -6,7 +6,7 @@ "description": "Minimal adopter backend for the conformance harness — real @seamless-auth/fastify with a capture transport.", "dependencies": { "@fastify/cors": "^11.0.1", - "@seamless-auth/fastify": "^0.5.0", + "@seamless-auth/fastify": "^0.6.0", "fastify": "^5.2.0" } }