[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

seamless-cli@0.28.0

Minor Changes

• 5e62f4a: seamless profile login signs in through the OpenID Provider, which brings passkey sign-in to the CLI. It opens the system browser with a loopback redirect, and --device uses the device grant for a machine with no browser. Either way the CLI exchanges the sign-in for a first-party session of its own at POST /sessions/exchange and stores that in the OS keychain, keeping no token from the provider. Needs auth server v0.23 and the provider edge.

  The CLI reads the provider from oidcProvider on GET /system-config/public when the instance advertises it. On one that does not, pass --oidc-issuer and --client-id once, to seamless profile login or seamless profile add. Flags win over what the profile saved, and that wins over the advertisement, so an instance that stops advertising cannot downgrade a profile. With no provider anywhere the email code stays, and --email-code asks for it.

  Every provider sign-in prints the issuer it uses. The CLI asks before using an advertised issuer on another origin than the instance, and without a terminal it stops and asks for the flags. It reads the advertisement only over https or on loopback, so an instance on plain http needs the flags.

  Every sign-in now checks the OS keychain before it starts, including seamless login and the email code, and fails early on a machine with none, rather than after a browser approval or an emailed code.

  seamless clients create and update gain --session-exchange and --no-session-exchange, and get shows the setting.

  A browser session can step up with a passkey as well as the authenticator app. A device session uses the authenticator app only, and needs a step-up before admin and organization commands, reads included.

Patch Changes

• 3aea9df: The adapter conformance suite covers permission guards, under the pending contract permission-guards. It holds a reference app's new /api/permissions routes to one behavior: exact matching, any-of and all-of, organization scope bound to the route, removal from an organization reaching the guard at the next token, and the live read when a token omits its permissions. The cases are skipped unless a run opts in with SEAMLESS_VERIFY_CONTRACTS, because they need the auth API at v0.23. The Express and Fastify reference apps add the routes only when the installed adapter has requirePermission.