chore: version packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

seamless-cli@0.11.0

Minor Changes

• 3ef3b68: Add seamless apps, so a portal account can see what it owns without opening the dashboard.
  apps list prints name, plan, status, and instance URL; apps get <id> adds the console URL,
  region, owners, trial expiry, and whether a service token has been issued (masked, never the live
  value). Both take --json and both require a portal session.

  Applications are now read through the portal's instanceUrl, which is derived from the service
  plan, rather than the stored domain column that goes stale when a trial is upgraded. Applications
  that have not finished provisioning are listed instead of being silently dropped. init is
  unchanged: it still reads domain and still considers only applications that have one.

  apps list shows the infra id as the reference (falling back to the id before provisioning), and apps get accepts an id, a name, or an infra id.

• 6e107cb: init now offers the managed path instead of assuming it. A portal session used to make managed the
  default silently, with --local as the only escape and no way to learn you needed it until after the
  template prompts. When your account has a provisioned application, init asks whether to connect it
  or scaffold a local stack, with managed leading.

  Whether managed is even possible is resolved before the first prompt. An account with nothing to
  connect no longer answers two prompts and then fails: it says why and continues to a local scaffold.
  That message now distinguishes "no applications yet" from "still provisioning", which the old
  NoApplicationsError got wrong for anyone mid-provision.

  A directory that already has files is no longer forced down the integrate path. init asks whether
  to connect it to a managed application or scaffold in place. Scaffolding into a non-empty directory
  was previously impossible, so a stray README or .git was enough to block a local project, and
  every route that now reaches it confirms first: starter files overwrite anything with the same name,
  and the confirmation defaults to no.

  An unreachable control plane asks before scaffolding a local stack rather than degrading silently.

  --local and --app <id> skip the new prompts, and --app without a session still fails rather
  than falling back.

• cc13a6b: Connecting a project to a managed application now wires up its bundled database. init reads the
  application's database and writes DATABASE_URL into api/.env as
  postgres://USER:PASSWORD@host:port/db?sslmode=require.

  The user and password stay as literal placeholders. The control plane only returns them for
  ?reveal=true, which this CLI never asks for, so a live database credential never reaches the
  developer's disk or terminal: they copy those from the dashboard. Anything printed as a connection
  string has its userinfo masked regardless.

  An application whose database is still provisioning produces a warning rather than a failure, and the
  database is read before the service token is rotated so a missing one is never reported against a
  project whose old token has already been invalidated. Running init inside an existing project adds
  DATABASE_URL only when there is not one already, so a working connection string is never replaced
  by a placeholder.

  This needs the templates release that teaches the express starter to read DATABASE_URL and
  negotiate TLS. Until SEAMLESS_TEMPLATES_REF is bumped to it, the value is computed but the pinned
  starter does not declare the placeholder, so nothing is written.

• 15b487a: init now asks for your email and writes it to the scaffolded auth server as OWNER_EMAIL. The auth
  server grants the admin role at account creation to a signup matching that address, so the local flow
  is init, docker compose up, register. When you are signed in to the portal, the prompt defaults to
  that account's email.

  seamless bootstrap-admin is removed. It existed to mint the first admin invite, which the owner
  grant now covers, and the scaffolded stack no longer enables the bootstrap route or carries a
  bootstrap secret. seamless verify keeps its own bootstrap secret for the conformance stack and is
  unaffected.

  The grant applies at signup only, so changing OWNER_EMAIL after an account exists promotes nobody.
  The success output and the README both say so.

• 6deafb1: seamless login now signs in to the Seamless portal instead of the active profile's instance, and
  no longer needs a profile to exist first. The portal session is stored beside the profile map in
  config.json and is the only session init uses to connect a managed application, so a session
  for a local or self-hosted instance no longer sends its token to the control plane.

  Instance login moves to seamless profile login [name], which signs in without changing the active
  profile. seamless login --profile <name> keeps working for one more minor version and prints a
  pointer to the new command. whoami and logout default to the portal session and take
  --profile <name> to target an instance.

  Set SEAMLESS_PORTAL_AUTH_URL to point the portal login at a different auth host.

• f08c21a: Scaffolding now requires init. An unrecognized command reports itself and exits instead of being
  treated as a project name, so seamless verfy no longer silently creates a directory called
  verfy and drops into the interactive scaffold. The error names seamless init <name> for anyone
  who was using the old shortcut.

  Ctrl-C is handled everywhere. Clack answers an interrupted prompt with a symbol, which several
  prompts cast straight to a string; that surfaced as a TypeError mid-scaffold, or as "Selected
  template Symbol(...) is not in the registry". Every prompt in init, the OAuth setup, the managed
  application picker, and bootstrap-admin now cancels cleanly and exits 130.

  init no longer leaves a project directory behind. Any failure or cancellation after the directory
  is created removes it, including a Ctrl-C during a download or a git clone, so a retry is not
  blocked by "Directory already exists". Only a directory the command itself created is ever removed,
  never an existing one and never the working directory.

  Declining the service token rotation prompt, or cancelling the application picker, now cancels the
  whole command rather than returning quietly part-way through.

Patch Changes

• bf857b1: Update the seamless auth api image to v0.5.0.

• f725752: Generated compose files now publish every port on 127.0.0.1 instead of all interfaces. A scaffolded
  stack was reachable from any machine on the same network, which mattered most for the auth server:
  it is configured with ALLOW_UNCREDENTIALED_DELIVERY_SECRETS=true so seamless login --local can
  read OTP codes from the response, and that opt-in is honored before any service-token check. Anyone
  on the LAN could request a code for any user of the stack and read it. Postgres was exposed on the
  same terms, with the fixed credentials the compose file ships.

  Local development is unchanged: the browser, the CLI, and inter-container traffic all still work.

• ffe4331: Update the conformance harness for the removal of the admin bootstrap invite flow in
  seamless-auth-api. The verify stack now sets OWNER_EMAIL instead of
  SEAMLESS_BOOTSTRAP_ENABLED/SEAMLESS_BOOTSTRAP_SECRET, and the first-admin spec registers the
  owner address and asserts the admin role is granted at signup.

• 2d898e2: Fix conformance project routing when the checkout path contains a directory named with an api/
  segment. Playwright applies a testMatch regex to the absolute file path, so the api project's
  pattern also claimed every adapter and react spec, running browser tests in a project with no
  baseURL. Each project now scopes itself with testDir instead.

• c2e4e1b: Scaffold from seamless-templates v0.5.0, which teaches the express starter to read DATABASE_URL and
  negotiate TLS when the connection string carries sslmode=require. This is what turns on the managed
  bundled database wiring: the CLI already computed the connection string, but the pinned v0.4.0
  starter did not declare the placeholder, so nothing was written.