From 129d5406af024b78785e170a59200e456326a3dd Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 14 Jul 2026 04:02:56 +0000 Subject: [PATCH] chore: version packages --- .changeset/admin-verbs.md | 14 ---- .changeset/auth-config-store.md | 11 --- .changeset/auth-docs-conformance.md | 11 --- .changeset/authenticated-http-client.md | 11 --- .changeset/config-command.md | 14 ---- .changeset/keychain-token-storage.md | 12 ---- .changeset/login-email-otp.md | 15 ---- .changeset/sessions-command.md | 12 ---- .changeset/verify-consolidated-report.md | 10 --- .changeset/whoami-logout.md | 12 ---- CHANGELOG.md | 90 ++++++++++++++++++++++++ package.json | 2 +- 12 files changed, 91 insertions(+), 123 deletions(-) delete mode 100644 .changeset/admin-verbs.md delete mode 100644 .changeset/auth-config-store.md delete mode 100644 .changeset/auth-docs-conformance.md delete mode 100644 .changeset/authenticated-http-client.md delete mode 100644 .changeset/config-command.md delete mode 100644 .changeset/keychain-token-storage.md delete mode 100644 .changeset/login-email-otp.md delete mode 100644 .changeset/sessions-command.md delete mode 100644 .changeset/verify-consolidated-report.md delete mode 100644 .changeset/whoami-logout.md diff --git a/.changeset/admin-verbs.md b/.changeset/admin-verbs.md deleted file mode 100644 index 2f07f8a..0000000 --- a/.changeset/admin-verbs.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -"seamless-cli": minor ---- - -Add admin verbs for users and organizations (requires an admin role). -`seamless users` covers `list` (with client-side `--limit`/`--offset` paging and -`--json`), `delete ` (with confirmation), `credentials ` (from the admin -user detail endpoint), and `prepare-device-replacement ` for admin-assisted -recovery. `seamless org` covers `list`, `create`, `get`, and `update`, and -`seamless org members` covers `list`, `add` (by `--user` id or `--email`, with -`--roles`/`--scopes`), `update`, and `remove` (with confirmation). Every command -surfaces a 403 as a clear permission error, and device replacement explains the -step-up requirement when the CLI session is not elevated. Accepts `--profile` -and honors `SEAMLESS_PROFILE`. diff --git a/.changeset/auth-config-store.md b/.changeset/auth-config-store.md deleted file mode 100644 index 1516757..0000000 --- a/.changeset/auth-config-store.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -"seamless-cli": minor ---- - -Add a multi-profile config store and `seamless profile` commands so the CLI can -target multiple Seamless Auth instances (self-hosted, managed tenant, local dev) -under named profiles. Profiles live in `~/.config/seamless/config.json` -(respecting `XDG_CONFIG_HOME`) and hold no secrets. New subcommands: `profile -list`, `profile add`, `profile use`, and `profile remove`. The active profile can -be selected per command with `--profile ` or the `SEAMLESS_PROFILE` -environment variable, defaulting to the `default` profile. diff --git a/.changeset/auth-docs-conformance.md b/.changeset/auth-docs-conformance.md deleted file mode 100644 index d3fff3e..0000000 --- a/.changeset/auth-docs-conformance.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -"seamless-cli": patch ---- - -Document the CLI authentication commands in the README (profiles, login, whoami, -sessions, logout, config, and the users and organizations admin verbs), including -per-platform keychain behavior and the headless `SEAMLESS_REFRESH_TOKEN` -fallback. Add a gated end-to-end test that drives the real login flow, an -authenticated call, transparent refresh, and refresh-reuse rejection against a -running instance (enabled with `SEAMLESS_E2E_URL`), plus an opt-in rate-limit -check. diff --git a/.changeset/authenticated-http-client.md b/.changeset/authenticated-http-client.md deleted file mode 100644 index 1277351..0000000 --- a/.changeset/authenticated-http-client.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -"seamless-cli": minor ---- - -Add an authenticated HTTP client that targets the active profile's instance, -attaches the Bearer access token, and transparently refreshes on expiry. On a -401 it calls `POST /refresh` with the opaque refresh token, persists the rotated -pair, and retries the original request once. A rotated or reused refresh token -clears the local session and raises a clear re-login prompt instead of a stack -trace. Non-JSON and empty response bodies are parsed defensively, and rate-limit -(429) responses are surfaced without triggering a refresh. diff --git a/.changeset/config-command.md b/.changeset/config-command.md deleted file mode 100644 index ef1579c..0000000 --- a/.changeset/config-command.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -"seamless-cli": minor ---- - -Add `seamless config`, config-as-code for an instance's system configuration -(requires an admin role). `config get [key] [--json]` reads the config from `GET -/system-config/admin`, `config set ` writes one key via `PATCH -/system-config/admin` (the value is parsed as JSON, falling back to a string, so -TTLs, arrays, booleans, and numbers all work), and `config roles` lists the -instance's roles. `config diff ` shows how a local JSON config file -differs from the instance, and `config apply ` applies the delta after a -confirmation prompt, with `--dry-run` to preview. Read-only or unknown keys in a -file are ignored on apply, and a non-admin user gets a clear permission error. -Accepts `--profile` and honors `SEAMLESS_PROFILE`. diff --git a/.changeset/keychain-token-storage.md b/.changeset/keychain-token-storage.md deleted file mode 100644 index 9608ffd..0000000 --- a/.changeset/keychain-token-storage.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -"seamless-cli": minor ---- - -Store session tokens in the OS keychain (macOS Keychain, Windows Credential -Manager, Linux Secret Service) via `@napi-rs/keyring` instead of on disk. Tokens -are scoped per profile (keyed by profile name and instance URL) so multiple -instances never collide, and the refresh token, the durable secret, never -touches config or logs. `seamless profile remove` now clears the profile's -keychain entry. When no keychain is available (for example headless CI), the CLI -reads a refresh token from `SEAMLESS_REFRESH_TOKEN` if set and otherwise fails -with a clear, documented error rather than writing secrets to disk. diff --git a/.changeset/login-email-otp.md b/.changeset/login-email-otp.md deleted file mode 100644 index 1cb6ba8..0000000 --- a/.changeset/login-email-otp.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -"seamless-cli": minor ---- - -Add `seamless login`, an interactive email OTP login for the active profile's -Seamless Auth instance. It calls `POST /login` (honoring the instance's returned -`loginMethods`), triggers the code with `GET /otp/generate-login-email-otp`, -prompts for the code you paste from your inbox, and verifies it with `POST -/otp/verify-login-email-otp`. On success it stores the session in the OS keychain -and records the identity (sub, email, identifier type) on the profile. The -command caps local code retries so it does not trip the per-IP OTP limiter, -surfaces a 429 clearly, refreshes the code automatically if the 5 minute -ephemeral window lapses, and reports unreachable instances without a stack trace. -Accepts the identifier positionally or with `--identifier`, and targets a -specific profile with `--profile`. diff --git a/.changeset/sessions-command.md b/.changeset/sessions-command.md deleted file mode 100644 index eb36d1d..0000000 --- a/.changeset/sessions-command.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -"seamless-cli": minor ---- - -Add `seamless sessions` to list and revoke the logged-in user's active sessions. -`seamless sessions` (or `sessions list`) calls `GET /sessions` and renders each -session's id, device or user agent, IP, and last-used time, marking the current -session. `seamless sessions revoke ` calls `DELETE /sessions/:id`, and -`seamless sessions revoke --all` calls `DELETE /sessions`. Revoking the current -session, or all sessions, prompts for confirmation first and then clears the -local keychain tokens, since that request signs you out. Accepts `--profile` and -honors `SEAMLESS_PROFILE`. diff --git a/.changeset/verify-consolidated-report.md b/.changeset/verify-consolidated-report.md deleted file mode 100644 index 8287bff..0000000 --- a/.changeset/verify-consolidated-report.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"seamless-cli": patch ---- - -`seamless verify` now prints a consolidated summary report at the end of the run: -the seamless package versions under test (source versions for `--local`, the -declared pins for released runs), one line per conformance layer (API / adapter and -each web template) with its pass/fail status and duration, and an overall verdict. -It is printed after teardown so it stays on screen without scrolling back through -the phase output. diff --git a/.changeset/whoami-logout.md b/.changeset/whoami-logout.md deleted file mode 100644 index f109666..0000000 --- a/.changeset/whoami-logout.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -"seamless-cli": minor ---- - -Add `seamless whoami` and `seamless logout`. `whoami` calls `GET /users/me` -through the authenticated client and prints the identity (sub, email, roles) -alongside the active profile and instance URL, failing cleanly with a "not -logged in" message when there is no session. `logout` ends the current session -with `DELETE /logout` and then clears the profile's keychain tokens; `logout ---all` revokes every session for the user with `DELETE /logout/all` first. Both -commands accept `--profile` (and honor `SEAMLESS_PROFILE`) and always clear the -local tokens even if the server session was already gone. diff --git a/CHANGELOG.md b/CHANGELOG.md index 7d8b92d..3c85704 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,95 @@ # seamless-cli +## 0.6.0 + +### Minor Changes + +- d09317c: Add admin verbs for users and organizations (requires an admin role). + `seamless users` covers `list` (with client-side `--limit`/`--offset` paging and + `--json`), `delete ` (with confirmation), `credentials ` (from the admin + user detail endpoint), and `prepare-device-replacement ` for admin-assisted + recovery. `seamless org` covers `list`, `create`, `get`, and `update`, and + `seamless org members` covers `list`, `add` (by `--user` id or `--email`, with + `--roles`/`--scopes`), `update`, and `remove` (with confirmation). Every command + surfaces a 403 as a clear permission error, and device replacement explains the + step-up requirement when the CLI session is not elevated. Accepts `--profile` + and honors `SEAMLESS_PROFILE`. +- 29cef7d: Add a multi-profile config store and `seamless profile` commands so the CLI can + target multiple Seamless Auth instances (self-hosted, managed tenant, local dev) + under named profiles. Profiles live in `~/.config/seamless/config.json` + (respecting `XDG_CONFIG_HOME`) and hold no secrets. New subcommands: `profile +list`, `profile add`, `profile use`, and `profile remove`. The active profile can + be selected per command with `--profile ` or the `SEAMLESS_PROFILE` + environment variable, defaulting to the `default` profile. +- 4d9cc23: Add an authenticated HTTP client that targets the active profile's instance, + attaches the Bearer access token, and transparently refreshes on expiry. On a + 401 it calls `POST /refresh` with the opaque refresh token, persists the rotated + pair, and retries the original request once. A rotated or reused refresh token + clears the local session and raises a clear re-login prompt instead of a stack + trace. Non-JSON and empty response bodies are parsed defensively, and rate-limit + (429) responses are surfaced without triggering a refresh. +- f24a71d: Add `seamless config`, config-as-code for an instance's system configuration + (requires an admin role). `config get [key] [--json]` reads the config from `GET +/system-config/admin`, `config set ` writes one key via `PATCH +/system-config/admin` (the value is parsed as JSON, falling back to a string, so + TTLs, arrays, booleans, and numbers all work), and `config roles` lists the + instance's roles. `config diff ` shows how a local JSON config file + differs from the instance, and `config apply ` applies the delta after a + confirmation prompt, with `--dry-run` to preview. Read-only or unknown keys in a + file are ignored on apply, and a non-admin user gets a clear permission error. + Accepts `--profile` and honors `SEAMLESS_PROFILE`. +- 69fb8c8: Store session tokens in the OS keychain (macOS Keychain, Windows Credential + Manager, Linux Secret Service) via `@napi-rs/keyring` instead of on disk. Tokens + are scoped per profile (keyed by profile name and instance URL) so multiple + instances never collide, and the refresh token, the durable secret, never + touches config or logs. `seamless profile remove` now clears the profile's + keychain entry. When no keychain is available (for example headless CI), the CLI + reads a refresh token from `SEAMLESS_REFRESH_TOKEN` if set and otherwise fails + with a clear, documented error rather than writing secrets to disk. +- 4301da5: Add `seamless login`, an interactive email OTP login for the active profile's + Seamless Auth instance. It calls `POST /login` (honoring the instance's returned + `loginMethods`), triggers the code with `GET /otp/generate-login-email-otp`, + prompts for the code you paste from your inbox, and verifies it with `POST +/otp/verify-login-email-otp`. On success it stores the session in the OS keychain + and records the identity (sub, email, identifier type) on the profile. The + command caps local code retries so it does not trip the per-IP OTP limiter, + surfaces a 429 clearly, refreshes the code automatically if the 5 minute + ephemeral window lapses, and reports unreachable instances without a stack trace. + Accepts the identifier positionally or with `--identifier`, and targets a + specific profile with `--profile`. +- 79d076e: Add `seamless sessions` to list and revoke the logged-in user's active sessions. + `seamless sessions` (or `sessions list`) calls `GET /sessions` and renders each + session's id, device or user agent, IP, and last-used time, marking the current + session. `seamless sessions revoke ` calls `DELETE /sessions/:id`, and + `seamless sessions revoke --all` calls `DELETE /sessions`. Revoking the current + session, or all sessions, prompts for confirmation first and then clears the + local keychain tokens, since that request signs you out. Accepts `--profile` and + honors `SEAMLESS_PROFILE`. +- a9c1ef3: Add `seamless whoami` and `seamless logout`. `whoami` calls `GET /users/me` + through the authenticated client and prints the identity (sub, email, roles) + alongside the active profile and instance URL, failing cleanly with a "not + logged in" message when there is no session. `logout` ends the current session + with `DELETE /logout` and then clears the profile's keychain tokens; `logout +--all` revokes every session for the user with `DELETE /logout/all` first. Both + commands accept `--profile` (and honor `SEAMLESS_PROFILE`) and always clear the + local tokens even if the server session was already gone. + +### Patch Changes + +- f8e8cdb: Document the CLI authentication commands in the README (profiles, login, whoami, + sessions, logout, config, and the users and organizations admin verbs), including + per-platform keychain behavior and the headless `SEAMLESS_REFRESH_TOKEN` + fallback. Add a gated end-to-end test that drives the real login flow, an + authenticated call, transparent refresh, and refresh-reuse rejection against a + running instance (enabled with `SEAMLESS_E2E_URL`), plus an opt-in rate-limit + check. +- f978890: `seamless verify` now prints a consolidated summary report at the end of the run: + the seamless package versions under test (source versions for `--local`, the + declared pins for released runs), one line per conformance layer (API / adapter and + each web template) with its pass/fail status and duration, and an overall verdict. + It is printed after teardown so it stays on screen without scrolling back through + the phase output. + ## 0.5.2 ### Patch Changes diff --git a/package.json b/package.json index b067b9e..95e0407 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "seamless-cli", - "version": "0.5.2", + "version": "0.6.0", "description": "The Seamless Auth command-line interface", "homepage": "https://github.com/fells-code/seamless-cli#readme", "bugs": {