chore: version packages

CHANGELOG.md

@@ -1,5 +1,129 @@
 # seamless-cli
 
+## 0.11.0
+
+### Minor Changes
+
+- 3ef3b68: Add `seamless apps`, so a portal account can see what it owns without opening the dashboard.
+  `apps list` prints name, plan, status, and instance URL; `apps get <id>` adds the console URL,
+  region, owners, trial expiry, and whether a service token has been issued (masked, never the live
+  value). Both take `--json` and both require a portal session.
+
+  Applications are now read through the portal's `instanceUrl`, which is derived from the service
+  plan, rather than the stored `domain` column that goes stale when a trial is upgraded. Applications
+  that have not finished provisioning are listed instead of being silently dropped. `init` is
+  unchanged: it still reads `domain` and still considers only applications that have one.
+
+  `apps list` shows the infra id as the reference (falling back to the id before provisioning), and `apps get` accepts an id, a name, or an infra id.
+
+- 6e107cb: `init` now offers the managed path instead of assuming it. A portal session used to make managed the
+  default silently, with `--local` as the only escape and no way to learn you needed it until after the
+  template prompts. When your account has a provisioned application, `init` asks whether to connect it
+  or scaffold a local stack, with managed leading.
+
+  Whether managed is even possible is resolved before the first prompt. An account with nothing to
+  connect no longer answers two prompts and then fails: it says why and continues to a local scaffold.
+  That message now distinguishes "no applications yet" from "still provisioning", which the old
+  `NoApplicationsError` got wrong for anyone mid-provision.
+
+  A directory that already has files is no longer forced down the integrate path. `init` asks whether
+  to connect it to a managed application or scaffold in place. Scaffolding into a non-empty directory
+  was previously impossible, so a stray `README` or `.git` was enough to block a local project, and
+  every route that now reaches it confirms first: starter files overwrite anything with the same name,
+  and the confirmation defaults to no.
+
+  An unreachable control plane asks before scaffolding a local stack rather than degrading silently.
+
+  `--local` and `--app <id>` skip the new prompts, and `--app` without a session still fails rather
+  than falling back.
+
+- cc13a6b: Connecting a project to a managed application now wires up its bundled database. `init` reads the
+  application's database and writes `DATABASE_URL` into `api/.env` as
+  `postgres://USER:PASSWORD@host:port/db?sslmode=require`.
+
+  The user and password stay as literal placeholders. The control plane only returns them for
+  `?reveal=true`, which this CLI never asks for, so a live database credential never reaches the
+  developer's disk or terminal: they copy those from the dashboard. Anything printed as a connection
+  string has its userinfo masked regardless.
+
+  An application whose database is still provisioning produces a warning rather than a failure, and the
+  database is read before the service token is rotated so a missing one is never reported against a
+  project whose old token has already been invalidated. Running `init` inside an existing project adds
+  `DATABASE_URL` only when there is not one already, so a working connection string is never replaced
+  by a placeholder.
+
+  This needs the templates release that teaches the express starter to read `DATABASE_URL` and
+  negotiate TLS. Until `SEAMLESS_TEMPLATES_REF` is bumped to it, the value is computed but the pinned
+  starter does not declare the placeholder, so nothing is written.
+
+- 15b487a: `init` now asks for your email and writes it to the scaffolded auth server as `OWNER_EMAIL`. The auth
+  server grants the admin role at account creation to a signup matching that address, so the local flow
+  is `init`, `docker compose up`, register. When you are signed in to the portal, the prompt defaults to
+  that account's email.
+
+  `seamless bootstrap-admin` is removed. It existed to mint the first admin invite, which the owner
+  grant now covers, and the scaffolded stack no longer enables the bootstrap route or carries a
+  bootstrap secret. `seamless verify` keeps its own bootstrap secret for the conformance stack and is
+  unaffected.
+
+  The grant applies at signup only, so changing `OWNER_EMAIL` after an account exists promotes nobody.
+  The success output and the README both say so.
+
+- 6deafb1: `seamless login` now signs in to the Seamless portal instead of the active profile's instance, and
+  no longer needs a profile to exist first. The portal session is stored beside the profile map in
+  `config.json` and is the only session `init` uses to connect a managed application, so a session
+  for a local or self-hosted instance no longer sends its token to the control plane.
+
+  Instance login moves to `seamless profile login [name]`, which signs in without changing the active
+  profile. `seamless login --profile <name>` keeps working for one more minor version and prints a
+  pointer to the new command. `whoami` and `logout` default to the portal session and take
+  `--profile <name>` to target an instance.
+
+  Set `SEAMLESS_PORTAL_AUTH_URL` to point the portal login at a different auth host.
+
+- f08c21a: Scaffolding now requires `init`. An unrecognized command reports itself and exits instead of being
+  treated as a project name, so `seamless verfy` no longer silently creates a directory called
+  `verfy` and drops into the interactive scaffold. The error names `seamless init <name>` for anyone
+  who was using the old shortcut.
+
+  Ctrl-C is handled everywhere. Clack answers an interrupted prompt with a symbol, which several
+  prompts cast straight to a string; that surfaced as a `TypeError` mid-scaffold, or as "Selected
+  template Symbol(...) is not in the registry". Every prompt in init, the OAuth setup, the managed
+  application picker, and `bootstrap-admin` now cancels cleanly and exits 130.
+
+  `init` no longer leaves a project directory behind. Any failure or cancellation after the directory
+  is created removes it, including a Ctrl-C during a download or a git clone, so a retry is not
+  blocked by "Directory already exists". Only a directory the command itself created is ever removed,
+  never an existing one and never the working directory.
+
+  Declining the service token rotation prompt, or cancelling the application picker, now cancels the
+  whole command rather than returning quietly part-way through.
+
+### Patch Changes
+
+- bf857b1: Update the seamless auth api image to v0.5.0.
+- f725752: Generated compose files now publish every port on `127.0.0.1` instead of all interfaces. A scaffolded
+  stack was reachable from any machine on the same network, which mattered most for the auth server:
+  it is configured with `ALLOW_UNCREDENTIALED_DELIVERY_SECRETS=true` so `seamless login --local` can
+  read OTP codes from the response, and that opt-in is honored before any service-token check. Anyone
+  on the LAN could request a code for any user of the stack and read it. Postgres was exposed on the
+  same terms, with the fixed credentials the compose file ships.
+
+  Local development is unchanged: the browser, the CLI, and inter-container traffic all still work.
+
+- ffe4331: Update the conformance harness for the removal of the admin bootstrap invite flow in
+  seamless-auth-api. The verify stack now sets `OWNER_EMAIL` instead of
+  `SEAMLESS_BOOTSTRAP_ENABLED`/`SEAMLESS_BOOTSTRAP_SECRET`, and the first-admin spec registers the
+  owner address and asserts the admin role is granted at signup.
+- 2d898e2: Fix conformance project routing when the checkout path contains a directory named with an `api/`
+  segment. Playwright applies a `testMatch` regex to the absolute file path, so the `api` project's
+  pattern also claimed every adapter and react spec, running browser tests in a project with no
+  `baseURL`. Each project now scopes itself with `testDir` instead.
+- c2e4e1b: Scaffold from seamless-templates v0.5.0, which teaches the express starter to read `DATABASE_URL` and
+  negotiate TLS when the connection string carries `sslmode=require`. This is what turns on the managed
+  bundled database wiring: the CLI already computed the connection string, but the pinned v0.4.0
+  starter did not declare the placeholder, so nothing was written.
+
 ## 0.10.2
 
 ### Patch Changes

package.json

@@ -1,6 +1,6 @@
 {
   "name": "seamless-cli",
-  "version": "0.10.2",
+  "version": "0.11.0",
   "description": "The Seamless Auth command-line interface",
   "homepage": "https://github.com/fells-code/seamless-cli#readme",
   "bugs": {