seamless-cli 0.10.2 → 0.12.1

package/dist/prompts/projectSetup.js

@@ -1,4 +1,13 @@
-import { confirm, select } from "@clack/prompts";
+import { confirm, select, text } from "@clack/prompts";
+import { orCancel } from "../core/cancel.js";
+import { requireInteractive } from "../core/tty.js";
+export const AUTH_MODES = ["docker", "local"];
+export const ADMIN_MODES = ["api", "image", "source", "none"];
+// What each question falls back to when --yes answers it. These match the
+// options labelled "(recommended)" in the prompts below, so an unattended run
+// gets the same stack a developer pressing Enter would.
+const DEFAULT_AUTH_MODE = "docker";
+const DEFAULT_ADMIN_MODE = "api";
 // Builds the framework choices for one layer (web or api) from the registry, so
 // adding a template is a registry edit, not a code change here. coming-soon
 // templates show as disabled; beta templates are selectable but labelled.
@@ -17,57 +26,45 @@ function toOptions(templates, kind) {
         disabled: t.status === "coming-soon",
     }));
 }
+// The registry lists templates in the order the prompt shows them, so the first
+// selectable one of a kind is what a developer pressing Enter would land on.
+function defaultTemplateId(templates, kind) {
+    const entry = templates.find((t) => t.kind === kind && t.status !== "coming-soon");
+    if (!entry) {
+        throw new Error(`The template registry has no selectable ${kind} templates, so --yes has nothing to choose. Run \`seamless templates list\` to see what is available.`);
+    }
+    return entry.id;
+}
 function labelFor(templates, id) {
     return templates.find((t) => t.id === id)?.label ?? id;
 }
+async function resolveTemplateId(templates, kind, preselected, message, echoLabel, assumeYes) {
+    const chosen = preselected ?? (assumeYes ? defaultTemplateId(templates, kind) : undefined);
+    if (chosen) {
+        console.log(`${echoLabel}: ${labelFor(templates, chosen)}`);
+        return chosen;
+    }
+    requireInteractive(message, `Pass --${kind}=<id> to choose one (see \`seamless templates list\`), or --yes to take the recommended template.`);
+    return orCancel(await select({ message, options: toOptions(templates, kind) }));
+}
 // Managed connect only needs the web and api templates: the auth server is the
 // developer's managed instance, so the auth-mode, Docker, and admin-dashboard
 // questions (all local-stack concerns) do not apply.
-export async function runManagedTemplatePrompts(templates, preselect = {}) {
-    let webTemplateId = preselect.webTemplateId;
-    if (webTemplateId) {
-        console.log(`Web example: ${labelFor(templates, webTemplateId)}`);
-    }
-    else {
-        webTemplateId = (await select({
-            message: "Web example",
-            options: toOptions(templates, "web"),
-        }));
-    }
-    let apiTemplateId = preselect.apiTemplateId;
-    if (apiTemplateId) {
-        console.log(`Backend: ${labelFor(templates, apiTemplateId)}`);
-    }
-    else {
-        apiTemplateId = (await select({
-            message: "Backend framework",
-            options: toOptions(templates, "api"),
-        }));
-    }
+export async function runManagedTemplatePrompts(templates, preselect = {}, assumeYes = false) {
+    const webTemplateId = await resolveTemplateId(templates, "web", preselect.webTemplateId, "Web example", "Web example", assumeYes);
+    const apiTemplateId = await resolveTemplateId(templates, "api", preselect.apiTemplateId, "Backend framework", "Backend", assumeYes);
     return { webTemplateId, apiTemplateId };
 }
-export async function runProjectSetupPrompts(templates, preselect = {}) {
-    let webTemplateId = preselect.webTemplateId;
-    if (webTemplateId) {
-        console.log(`Web example: ${labelFor(templates, webTemplateId)}`);
-    }
-    else {
-        webTemplateId = (await select({
-            message: "Web example",
-            options: toOptions(templates, "web"),
-        }));
-    }
-    let apiTemplateId = preselect.apiTemplateId;
-    if (apiTemplateId) {
-        console.log(`Backend: ${labelFor(templates, apiTemplateId)}`);
-    }
-    else {
-        apiTemplateId = (await select({
-            message: "Backend framework",
-            options: toOptions(templates, "api"),
-        }));
-    }
-    const authMode = (await select({
+export async function runProjectSetupPrompts(templates, preselect = {}, knownEmail, assumeYes = false) {
+    const webTemplateId = await resolveTemplateId(templates, "web", preselect.webTemplateId, "Web example", "Web example", assumeYes);
+    const apiTemplateId = await resolveTemplateId(templates, "api", preselect.apiTemplateId, "Backend framework", "Backend", assumeYes);
+    // Written to the auth server as OWNER_EMAIL, which grants the admin role to
+    // this address at signup. Asking here means registering in the scaffolded app
+    // is the only step between `docker compose up` and a working admin. There is
+    // no sane default for it, so --yes takes it from the flag or the portal
+    // session and otherwise refuses to guess.
+    const ownerEmail = await resolveOwnerEmail(preselect.ownerEmail ?? (assumeYes ? knownEmail : undefined), knownEmail, assumeYes);
+    const authMode = await resolveChoice(preselect.authMode, assumeYes ? DEFAULT_AUTH_MODE : undefined, "Auth server", "How would you like to run SeamlessAuth?", "--auth", AUTH_MODES, async () => orCancel(await select({
         message: "How would you like to run SeamlessAuth?",
         options: [
             {
@@ -79,8 +76,8 @@ export async function runProjectSetupPrompts(templates, preselect = {}) {
                 label: "Local dev server (advanced)",
             },
         ],
-    }));
-    const adminMode = (await select({
+    })));
+    const adminMode = await resolveChoice(preselect.adminMode, assumeYes ? DEFAULT_ADMIN_MODE : undefined, "Admin console", "How would you like to host the admin console?", "--admin", ADMIN_MODES, async () => orCancel(await select({
         message: "How would you like to host the admin console?",
         options: [
             {
@@ -101,12 +98,13 @@ export async function runProjectSetupPrompts(templates, preselect = {}) {
             },
         ],
         initialValue: "api",
-    }));
-    if (authMode === "local") {
-        const confirmDocker = await confirm({
+    })));
+    if (authMode === "local" && !assumeYes) {
+        requireInteractive("Auth server still requires Docker for full stack. Enable Docker?", "Pass --yes; Docker is enabled either way.");
+        const confirmDocker = orCancel(await confirm({
             message: "Auth server still requires Docker for full stack. Enable Docker?",
             initialValue: true,
-        });
+        }));
         if (!confirmDocker) {
             console.log("\nDocker is required for full seamless stack. Enabling automatically.\n");
         }
@@ -119,6 +117,35 @@ export async function runProjectSetupPrompts(templates, preselect = {}) {
         authMode,
         useDocker: true,
         adminMode,
+        ownerEmail: ownerEmail.trim(),
     };
 }
+// A flag answers the question outright; --yes falls back to the recommended
+// option. Either way the choice is echoed, so an unattended run still reports
+// what it picked.
+async function resolveChoice(supplied, fallback, echoLabel, question, flag, allowed, ask) {
+    const chosen = supplied ?? fallback;
+    if (chosen) {
+        console.log(`${echoLabel}: ${chosen}`);
+        return chosen;
+    }
+    requireInteractive(question, `Pass ${flag}=<${allowed.join("|")}>, or --yes to take the recommended option.`);
+    return ask();
+}
+async function resolveOwnerEmail(supplied, knownEmail, assumeYes) {
+    if (supplied) {
+        console.log(`Owner email: ${supplied}`);
+        return supplied;
+    }
+    if (assumeYes) {
+        throw new Error("--yes needs an owner email, which becomes the admin when you register. Pass --email <address>, or run `seamless login` so it can be taken from your portal session.");
+    }
+    requireInteractive("Your email (becomes the admin when you register)", "Pass --email <address>, or run `seamless login` so it can be taken from your portal session.");
+    return orCancel(await text({
+        message: "Your email (becomes the admin when you register)",
+        placeholder: knownEmail ?? "you@example.com",
+        initialValue: knownEmail ?? "",
+        validate: (value) => (value ?? "").includes("@") ? undefined : "Enter a valid email address",
+    }));
+}
 //# sourceMappingURL=projectSetup.js.map

package/dist/prompts/projectSetup.js.map

@@ -1 +1 @@
-{"version":3,"file":"projectSetup.js","sourceRoot":"","sources":["../../src/prompts/projectSetup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAajD,gFAAgF;AAChF,4EAA4E;AAC5E,0EAA0E;AAC1E,SAAS,SAAS,CAAC,SAA0B,EAAE,IAAkB;IAC/D,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,aAAa,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,KAAK,EAAE,CAAC,CAAC,EAAE;QACX,KAAK,EACH,CAAC,CAAC,MAAM,KAAK,aAAa;YACxB,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,gBAAgB;YAC5B,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM;gBACnB,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS;gBACrB,CAAC,CAAC,CAAC,CAAC,KAAK;QACf,QAAQ,EAAE,CAAC,CAAC,MAAM,KAAK,aAAa;KACrC,CAAC,CAAC,CAAC;AACN,CAAC;AAOD,SAAS,QAAQ,CAAC,SAA0B,EAAE,EAAU;IACtD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;AACzD,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,qDAAqD;AACrD,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,SAA0B,EAC1B,YAAuB,EAAE;IAEzB,IAAI,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC;IAC5C,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,aAAa,GAAG,CAAC,MAAM,MAAM,CAAC;YAC5B,OAAO,EAAE,aAAa;YACtB,OAAO,EAAE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC;SACrC,CAAC,CAAW,CAAC;IAChB,CAAC;IAED,IAAI,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC;IAC5C,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,aAAa,GAAG,CAAC,MAAM,MAAM,CAAC;YAC5B,OAAO,EAAE,mBAAmB;YAC5B,OAAO,EAAE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC;SACrC,CAAC,CAAW,CAAC;IAChB,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAA0B,EAC1B,YAAuB,EAAE;IAEzB,IAAI,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC;IAC5C,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,aAAa,GAAG,CAAC,MAAM,MAAM,CAAC;YAC5B,OAAO,EAAE,aAAa;YACtB,OAAO,EAAE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC;SACrC,CAAC,CAAW,CAAC;IAChB,CAAC;IAED,IAAI,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC;IAC5C,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,aAAa,GAAG,CAAC,MAAM,MAAM,CAAC;YAC5B,OAAO,EAAE,mBAAmB;YAC5B,OAAO,EAAE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC;SACrC,CAAC,CAAW,CAAC;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC;QAC7B,OAAO,EAAE,yCAAyC;QAClD,OAAO,EAAE;YACP;gBACE,KAAK,EAAE,QAAQ;gBACf,KAAK,EAAE,gCAAgC;aACxC;YACD;gBACE,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,6BAA6B;aACrC;SACF;KACF,CAAC,CAAa,CAAC;IAEhB,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC;QAC9B,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE;YACP;gBACE,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,8CAA8C;aACtD;YACD;gBACE,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,4CAA4C;aACpD;YACD;gBACE,KAAK,EAAE,QAAQ;gBACf,KAAK,EAAE,kDAAkD;aAC1D;YACD;gBACE,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,iCAAiC;aACzC;SACF;QACD,YAAY,EAAE,KAAK;KACpB,CAAC,CAAc,CAAC;IAEjB,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC;YAClC,OAAO,EACL,kEAAkE;YACpE,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CACT,yEAAyE,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,EAAE,IAAI;QACT,aAAa;QAEb,GAAG,EAAE,IAAI;QACT,aAAa;QAEb,QAAQ;QACR,SAAS,EAAE,IAAI;QAEf,SAAS;KACV,CAAC;AACJ,CAAC"}
+{"version":3,"file":"projectSetup.js","sourceRoot":"","sources":["../../src/prompts/projectSetup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAOpD,MAAM,CAAC,MAAM,UAAU,GAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC1D,MAAM,CAAC,MAAM,WAAW,GAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAE3E,0EAA0E;AAC1E,8EAA8E;AAC9E,wDAAwD;AACxD,MAAM,iBAAiB,GAAa,QAAQ,CAAC;AAC7C,MAAM,kBAAkB,GAAc,KAAK,CAAC;AAQ5C,gFAAgF;AAChF,4EAA4E;AAC5E,0EAA0E;AAC1E,SAAS,SAAS,CAAC,SAA0B,EAAE,IAAkB;IAC/D,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,aAAa,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,KAAK,EAAE,CAAC,CAAC,EAAE;QACX,KAAK,EACH,CAAC,CAAC,MAAM,KAAK,aAAa;YACxB,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,gBAAgB;YAC5B,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM;gBACnB,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS;gBACrB,CAAC,CAAC,CAAC,CAAC,KAAK;QACf,QAAQ,EAAE,CAAC,CAAC,MAAM,KAAK,aAAa;KACrC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,gFAAgF;AAChF,6EAA6E;AAC7E,SAAS,iBAAiB,CACxB,SAA0B,EAC1B,IAAkB;IAElB,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa,CACrD,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,2CAA2C,IAAI,uGAAuG,CACvJ,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,EAAE,CAAC;AAClB,CAAC;AAaD,SAAS,QAAQ,CAAC,SAA0B,EAAE,EAAU;IACtD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,SAA0B,EAC1B,IAAkB,EAClB,WAA+B,EAC/B,OAAe,EACf,SAAiB,EACjB,SAAkB;IAElB,MAAM,MAAM,GACV,WAAW,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE9E,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,KAAK,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kBAAkB,CAChB,OAAO,EACP,UAAU,IAAI,mGAAmG,CAClH,CAAC;IAEF,OAAO,QAAQ,CACb,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CACrD,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,qDAAqD;AACrD,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,SAA0B,EAC1B,YAAuB,EAAE,EACzB,SAAS,GAAG,KAAK;IAEjB,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,SAAS,EACT,KAAK,EACL,SAAS,CAAC,aAAa,EACvB,aAAa,EACb,aAAa,EACb,SAAS,CACV,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,SAAS,EACT,KAAK,EACL,SAAS,CAAC,aAAa,EACvB,mBAAmB,EACnB,SAAS,EACT,SAAS,CACV,CAAC;IAEF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAA0B,EAC1B,YAAuB,EAAE,EACzB,UAAmB,EACnB,SAAS,GAAG,KAAK;IAEjB,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,SAAS,EACT,KAAK,EACL,SAAS,CAAC,aAAa,EACvB,aAAa,EACb,aAAa,EACb,SAAS,CACV,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,SAAS,EACT,KAAK,EACL,SAAS,CAAC,aAAa,EACvB,mBAAmB,EACnB,SAAS,EACT,SAAS,CACV,CAAC;IAEF,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,wEAAwE;IACxE,0CAA0C;IAC1C,MAAM,UAAU,GAAG,MAAM,iBAAiB,CACxC,SAAS,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,EAC5D,UAAU,EACV,SAAS,CACV,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAClC,SAAS,CAAC,QAAQ,EAClB,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,EACzC,aAAa,EACb,yCAAyC,EACzC,QAAQ,EACR,UAAU,EACV,KAAK,IAAI,EAAE,CACT,QAAQ,CACN,MAAM,MAAM,CAAC;QACX,OAAO,EAAE,yCAAyC;QAClD,OAAO,EAAE;YACP;gBACE,KAAK,EAAE,QAAQ;gBACf,KAAK,EAAE,gCAAgC;aACxC;YACD;gBACE,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,6BAA6B;aACrC;SACF;KACF,CAAC,CACS,CAChB,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,aAAa,CACnC,SAAS,CAAC,SAAS,EACnB,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,EAC1C,eAAe,EACf,+CAA+C,EAC/C,SAAS,EACT,WAAW,EACX,KAAK,IAAI,EAAE,CACT,QAAQ,CACN,MAAM,MAAM,CAAC;QACX,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE;YACP;gBACE,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,8CAA8C;aACtD;YACD;gBACE,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,4CAA4C;aACpD;YACD;gBACE,KAAK,EAAE,QAAQ;gBACf,KAAK,EAAE,kDAAkD;aAC1D;YACD;gBACE,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,iCAAiC;aACzC;SACF;QACD,YAAY,EAAE,KAAK;KACpB,CAAC,CACU,CACjB,CAAC;IAEF,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,kBAAkB,CAChB,kEAAkE,EAClE,2CAA2C,CAC5C,CAAC;QACF,MAAM,aAAa,GAAG,QAAQ,CAC5B,MAAM,OAAO,CAAC;YACZ,OAAO,EACL,kEAAkE;YACpE,YAAY,EAAE,IAAI;SACnB,CAAC,CACH,CAAC;QAEF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CACT,yEAAyE,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,EAAE,IAAI;QACT,aAAa;QAEb,GAAG,EAAE,IAAI;QACT,aAAa;QAEb,QAAQ;QACR,SAAS,EAAE,IAAI;QAEf,SAAS;QACT,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE;KAC9B,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,8EAA8E;AAC9E,kBAAkB;AAClB,KAAK,UAAU,aAAa,CAC1B,QAAuB,EACvB,QAAuB,EACvB,SAAiB,EACjB,QAAgB,EAChB,IAAY,EACZ,OAAqB,EACrB,GAAqB;IAErB,MAAM,MAAM,GAAG,QAAQ,IAAI,QAAQ,CAAC;IACpC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,KAAK,MAAM,EAAE,CAAC,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kBAAkB,CAChB,QAAQ,EACR,QAAQ,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,6CAA6C,CAChF,CAAC;IAEF,OAAO,GAAG,EAAE,CAAC;AACf,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,QAA4B,EAC5B,UAA8B,EAC9B,SAAkB;IAElB,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,EAAE,CAAC,CAAC;QACxC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,qKAAqK,CACtK,CAAC;IACJ,CAAC;IAED,kBAAkB,CAChB,kDAAkD,EAClD,8FAA8F,CAC/F,CAAC;IAEF,OAAO,QAAQ,CACb,MAAM,IAAI,CAAC;QACT,OAAO,EAAE,kDAAkD;QAC3D,WAAW,EAAE,UAAU,IAAI,iBAAiB;QAC5C,YAAY,EAAE,UAAU,IAAI,EAAE;QAC9B,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,6BAA6B;KAC1E,CAAC,CACO,CAAC;AACd,CAAC"}

package/dist/testSetup.js

@@ -0,0 +1,9 @@
+import { beforeEach } from "vitest";
+// Prompts refuse to run without a TTY on stdin (see core/tty.ts), and vitest has
+// none, so every test that exercises a prompt would otherwise fail on the guard
+// rather than on what it is testing. Tests that want the no-terminal behavior
+// set isTTY back to false in their own beforeEach, which runs after this one.
+beforeEach(() => {
+    process.stdin.isTTY = true;
+});
+//# sourceMappingURL=testSetup.js.map

package/dist/testSetup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testSetup.js","sourceRoot":"","sources":["../src/testSetup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,iFAAiF;AACjF,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,UAAU,CAAC,GAAG,EAAE;IACd,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;AAC7B,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "seamless-cli",
-  "version": "0.10.2",
+  "version": "0.12.1",
   "description": "The Seamless Auth command-line interface",
   "homepage": "https://github.com/fells-code/seamless-cli#readme",
   "bugs": {

package/verify/adapter-app/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "description": "Minimal adopter backend for the conformance harness — real @seamless-auth/express with a capture transport.",
   "dependencies": {
-    "@seamless-auth/express": "^0.9.0",
+    "@seamless-auth/express": "^0.12.1",
     "cookie-parser": "^1.4.6",
     "cors": "^2.8.5",
     "express": "^5.1.0"

package/verify/adapter-fastify-app/Dockerfile

@@ -0,0 +1,14 @@
+FROM node:24-alpine
+WORKDIR /app
+RUN apk add --no-cache curl
+COPY package.json ./
+RUN npm install
+# --local mode: install locally-built @seamless-auth/* tarballs over the registry
+# versions. vendor/ is empty in --released mode, so this is a no-op there.
+COPY vendor/ ./vendor/
+RUN if ls ./vendor/*.tgz >/dev/null 2>&1; then \
+      npm install ./vendor/seamless-auth-core-*.tgz ./vendor/seamless-auth-fastify-*.tgz; \
+    fi
+COPY server.mjs ./
+EXPOSE 3001
+CMD ["node", "server.mjs"]

package/verify/adapter-fastify-app/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "seamless-verify-adapter-fastify",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "description": "Minimal adopter backend for the conformance harness — real @seamless-auth/fastify with a capture transport.",
+  "dependencies": {
+    "@fastify/cors": "^11.0.1",
+    "@seamless-auth/fastify": "^0.3.1",
+    "fastify": "^5.2.0"
+  }
+}

package/verify/adapter-fastify-app/server.mjs

@@ -0,0 +1,64 @@
+import cors from "@fastify/cors";
+import Fastify from "fastify";
+import seamlessAuth from "@seamless-auth/fastify";
+
+// The Fastify twin of adapter-app/server.mjs. Same routes, same env contract,
+// same capture transport: the point of this service is that a spec cannot tell
+// which adapter answered it, so any difference in behaviour is a real one.
+//
+// The adapter strips OTP/magic-link secrets before responding to the browser, so
+// the conformance harness can't read codes from responses. These handlers receive
+// the raw delivery payloads and stash them for the harness to read via /__captured.
+const captured = new Map();
+const ok = (channel) => ({ accepted: true, provider: "capture", channel });
+
+const handlers = {
+  async sendOtpEmail({ to, token }) {
+    captured.set(to, { token: String(token) });
+    return ok("email");
+  },
+  async sendOtpSms({ to, token }) {
+    captured.set(to, { token: String(token) });
+    return ok("sms");
+  },
+  async sendMagicLinkEmail({ to, token, magicLinkUrl }) {
+    captured.set(to, { token, magicLinkUrl });
+    return ok("email");
+  },
+  async sendBootstrapInviteEmail({ to, token, inviteUrl }) {
+    captured.set(to, { token, inviteUrl });
+    return ok("email");
+  },
+};
+
+const app = Fastify();
+
+// The React app (browser) calls the adapter cross-origin with credentials, so
+// CORS must echo its origin and allow cookies. WEB_ORIGIN is the React app host.
+await app.register(cors, {
+  origin: process.env.WEB_ORIGIN ?? "http://localhost:5173",
+  credentials: true,
+});
+
+app.get("/", async () => ({ ok: true }));
+app.get("/__captured/:email", async (req) => captured.get(req.params.email) ?? null);
+
+// Registered under a prefix, which is how the plugin scopes its cookie and origin
+// hooks. @fastify/cookie comes with the plugin, so it is not registered here.
+// There is no `issuer` option on this adapter (the Express one takes one); the
+// audience is what both check the API's tokens against.
+await app.register(seamlessAuth, {
+  prefix: "/auth",
+  authServerUrl: process.env.AUTH_SERVER_URL,
+  cookieSecret: process.env.COOKIE_SIGNING_KEY,
+  serviceSecret: process.env.API_SERVICE_TOKEN,
+  audience: process.env.AUTH_SERVER_URL,
+  jwksKid: process.env.JWKS_KID,
+  messaging: { handlers, defaults: { appName: "Seamless Verify" } },
+});
+
+const port = Number(process.env.PORT ?? 3001);
+// 0.0.0.0, not the Fastify default of localhost: the port is published out of the
+// container, and a listener bound to loopback inside it is unreachable from the host.
+await app.listen({ port, host: "0.0.0.0" });
+console.log(`verify fastify adapter listening on :${port}`);

package/verify/adapter-fastify-app/vendor/.gitignore

@@ -0,0 +1,3 @@
+*.tgz
+!.gitkeep
+!.gitignore

package/verify/docker-compose.cache.yml

@@ -0,0 +1,43 @@
+# Build cache for CI, layered over docker-compose.verify.yml via
+# SEAMLESS_VERIFY_COMPOSE_OVERRIDE. Kept out of the base file because `type=gha` needs the
+# Actions cache credentials and is an error anywhere else, so a developer running
+# `seamless verify` locally must not pick it up.
+#
+# Every image here is rebuilt from scratch on every CI run today, and the Dockerfiles are
+# already ordered for this: each installs dependencies from a lockfile before copying
+# source, so the expensive layer survives a source change and only a lockfile change
+# invalidates it.
+#
+# Scopes are per service. One shared scope would have each build overwrite the last, and
+# they would take turns missing.
+services:
+  auth-api:
+    build:
+      cache_from:
+        - type=gha,scope=verify-auth-api
+      cache_to:
+        - type=gha,mode=max,scope=verify-auth-api
+
+  adapter:
+    build:
+      cache_from:
+        - type=gha,scope=verify-adapter
+      cache_to:
+        - type=gha,mode=max,scope=verify-adapter
+
+  adapter-fastify:
+    build:
+      cache_from:
+        - type=gha,scope=verify-adapter-fastify
+      cache_to:
+        - type=gha,mode=max,scope=verify-adapter-fastify
+
+  # The react service is built once per web template against different source, so its
+  # scope carries the template id. Sharing one scope across templates would mean each
+  # template evicting the previous one's cache on every run.
+  react:
+    build:
+      cache_from:
+        - type=gha,scope=verify-react-${SEAMLESS_VERIFY_TEMPLATE_ID:-default}
+      cache_to:
+        - type=gha,mode=max,scope=verify-react-${SEAMLESS_VERIFY_TEMPLATE_ID:-default}

package/verify/docker-compose.verify.yml

@@ -9,13 +9,16 @@
 #   SEAMLESS_ADAPTER_DIR  absolute path to the express adapter source
 #   API_SERVICE_TOKEN     shared secret between API and adapter
 #   JWKS_KID              key id the adapter expects (must match the API's active kid)
-#   SEAMLESS_BOOTSTRAP_SECRET  bearer secret for POST /bootstrap/admin-invite
+#   OWNER_EMAIL           tenant owner; this email gets the admin role at signup
 
 name: seamless-verify
 
 services:
   postgres:
-    image: postgres:16
+    # Matches POSTGRES_IMAGE in src/core/images.ts, so the harness runs the same
+    # major a fresh scaffold gets. Every run starts with `down -v`, so the volume
+    # is always new and a major bump needs no migration here.
+    image: postgres:18
     environment:
       POSTGRES_USER: seamless
       POSTGRES_PASSWORD: seamless
@@ -72,8 +75,9 @@ services:
       DB_PASSWORD: seamless
       DB_NAME: seamless_auth
       API_SERVICE_TOKEN: ${API_SERVICE_TOKEN}
-      SEAMLESS_BOOTSTRAP_ENABLED: 'true'
-      SEAMLESS_BOOTSTRAP_SECRET: ${SEAMLESS_BOOTSTRAP_SECRET}
+      # The first admin comes from the OWNER_EMAIL grant at signup, so the
+      # harness can assert admin promotion without a separate invite flow.
+      OWNER_EMAIL: ${OWNER_EMAIL}
       # OAuth: a single "mock" provider backed by the harness's in-process OIDC.
       # authorizationUrl is browser/harness-visible (localhost); token/userInfo are
       # called server-side from the container, so they go via host.docker.internal.
@@ -116,6 +120,32 @@ services:
       timeout: 3s
       retries: 20
 
+  # The same adopter backend on Fastify, so the cookie path is conformance-tested
+  # for both adapters rather than only the one the harness happens to be written
+  # against. Identical env contract and capture transport; only the framework and
+  # the published port differ, which is what makes a failure here attributable.
+  adapter-fastify:
+    build:
+      context: ./adapter-fastify-app
+    ports:
+      - '3001:3001'
+    environment:
+      PORT: '3001'
+      AUTH_SERVER_URL: http://auth-api:5312
+      APP_ORIGIN: http://localhost:3001
+      WEB_ORIGIN: http://localhost:5173
+      API_SERVICE_TOKEN: ${API_SERVICE_TOKEN}
+      COOKIE_SIGNING_KEY: ${API_SERVICE_TOKEN}
+      JWKS_KID: ${JWKS_KID}
+    depends_on:
+      auth-api:
+        condition: service_healthy
+    healthcheck:
+      test: ['CMD', 'curl', '-fsS', 'http://localhost:3001/']
+      interval: 3s
+      timeout: 3s
+      retries: 20
+
   # React starter app (built SPA on nginx), pointed at the adapter so the React
   # SDK's `${apiHost}/auth/*` calls hit the adapter's mount. Browser-visible URL,
   # so API_URL is the host-mapped adapter (localhost:3000), not the compose host.

package/verify/harness/api/loginEnumeration.spec.ts

@@ -0,0 +1,139 @@
+import { expect, test } from '../lib/fixtures';
+import { registerAndVerifyEmail } from '../lib/flows';
+
+// `POST /login` answers the same way for an identifier with an account and one without,
+// and the endpoints that accept the resulting pre-auth token do too. The API has its own
+// unit coverage for this; what only this harness can check is that the guarantee survives
+// a real instance, with real signing keys and the real login policy in place.
+//
+// The specific failures worth catching are the ones where a decoy responder reproduces
+// the success path and forgets a refusal, since that is the shape every regression here
+// has taken so far.
+
+const UNKNOWN = () => `nobody-${Date.now()}-${Math.random().toString(36).slice(2)}@example.com`;
+
+async function startLogin(ctx: Parameters<typeof registerAndVerifyEmail>[0], identifier: string) {
+  const res = await ctx.post('/login', { data: { identifier } });
+  return { status: res.status(), body: await res.json() };
+}
+
+test.describe('login enumeration (api)', () => {
+  test('an unknown identifier is answered in the same shape as a real one', async ({
+    actor,
+  }) => {
+    await registerAndVerifyEmail(actor.ctx, actor.email);
+
+    const real = await startLogin(actor.ctx, actor.email);
+    const unknown = await startLogin(actor.ctx, UNKNOWN());
+
+    expect(unknown.status).toBe(200);
+    expect(unknown.status).toBe(real.status);
+    // `sub` and `token` differ between them exactly as they differ between two real
+    // accounts, so the comparison is over everything else.
+    expect(Object.keys(unknown.body).sort()).toEqual(Object.keys(real.body).sort());
+    expect(unknown.body.identifierType).toBe(real.body.identifierType);
+    expect(unknown.body.ttl).toBe(real.body.ttl);
+    expect(typeof unknown.body.token).toBe('string');
+    // Deliberately not `loginMethods`. That list is filtered by what an account can do,
+    // and a decoy's capabilities are derived per identifier, so any one decoy and any
+    // one account can legitimately differ. What has to hold is the next test.
+  });
+
+  test('a real account\'s method list is one a decoy can also produce', async ({ actor }) => {
+    // The guarantee is not that two given answers match, it is that a given answer does
+    // not identify an account. A decoy that always claimed everything would make any
+    // narrower list proof of existence, so the decoy's passkey and phone are derived per
+    // identifier and a narrow list has to be reachable without an account behind it.
+    await registerAndVerifyEmail(actor.ctx, actor.email);
+    const real = await startLogin(actor.ctx, actor.email);
+    const target = JSON.stringify(real.body.loginMethods);
+
+    const seen = new Set<string>();
+    for (let i = 0; i < 40; i += 1) {
+      const { body } = await startLogin(actor.ctx, UNKNOWN());
+      seen.add(JSON.stringify(body.loginMethods));
+    }
+
+    // Each decoy draws two independent bits, so this account's exact list comes up about
+    // a quarter of the time; over 40 identifiers, missing it entirely is a 1-in-100,000
+    // event rather than a flake worth retrying.
+    expect(seen.has(target), `no decoy offered ${target}; saw ${[...seen].join(' | ')}`).toBe(
+      true,
+    );
+    expect(seen.size).toBeGreaterThan(1);
+  });
+
+  test('the same unknown identifier keeps the same subject', async ({ actor }) => {
+    const identifier = UNKNOWN();
+
+    const first = await startLogin(actor.ctx, identifier);
+    const second = await startLogin(actor.ctx, identifier);
+    const other = await startLogin(actor.ctx, UNKNOWN());
+
+    // A real identifier resolves to the same row every time and to a different one from
+    // anyone else's. A subject that rerolled, or that collided, would be the oracle again
+    // one request later.
+    expect(second.body.sub).toBe(first.body.sub);
+    expect(other.body.sub).not.toBe(first.body.sub);
+    // The offered methods have to be stable for the same reason: a list that changed
+    // between attempts would separate a decoy from an account on its own.
+    expect(second.body.loginMethods).toEqual(first.body.loginMethods);
+  });
+
+  test('an unknown identifier gets an OTP send that reports success and sends nothing', async ({
+    actor,
+  }) => {
+    const { body } = await startLogin(actor.ctx, UNKNOWN());
+
+    const res = await actor.ctx.get('/otp/generate-login-email-otp', {
+      headers: { Authorization: `Bearer ${body.token}` },
+    });
+
+    expect(res.status()).toBe(200);
+    expect((await res.json()).message).toBe('success');
+  });
+
+  test('a decoy OTP verify fails the way a wrong code fails', async ({ actor }) => {
+    const { body } = await startLogin(actor.ctx, UNKNOWN());
+
+    const res = await actor.ctx.post('/otp/verify-login-email-otp', {
+      headers: { Authorization: `Bearer ${body.token}` },
+      data: { verificationToken: 'ZZZZZZ' },
+    });
+
+    expect(res.status()).toBe(401);
+  });
+
+  test('a credential id that cannot exist is refused for real and unknown alike', async ({
+    actor,
+  }) => {
+    // The sharpest oracle this surface had. `/webauthn/login/start` filters the account's
+    // credentials by the requested id and refuses when none survive, so an id no
+    // credential can hold is refused by every real account. A decoy that answered with a
+    // challenge anyway was identifiable in two requests, whatever the policy.
+    await registerAndVerifyEmail(actor.ctx, actor.email);
+
+    const real = await startLogin(actor.ctx, actor.email);
+    const unknown = await startLogin(actor.ctx, UNKNOWN());
+
+    const ask = (token: string) =>
+      actor.ctx.post('/webauthn/login/start', {
+        headers: { Authorization: `Bearer ${token}` },
+        data: { credentialId: 'not-a-real-credential-id' },
+      });
+
+    const realRes = await ask(real.body.token);
+    const unknownRes = await ask(unknown.body.token);
+
+    expect(unknownRes.status()).toBe(realRes.status());
+    expect(await unknownRes.text()).toBe(await realRes.text());
+  });
+
+  test('a malformed identifier is still rejected', async ({ actor }) => {
+    // Not an enumeration signal: it does not depend on whether an account exists, and
+    // answering 200 here would leave a caller with no way to learn it typed nonsense.
+    const { status } = await startLogin(actor.ctx, 'not-an-identifier');
+
+    expect(status).toBe(400);
+  });
+});

package/verify/harness/api/ownerAdmin.spec.ts

@@ -0,0 +1,24 @@
+import { OWNER_EMAIL } from '../lib/env';
+import { expect, test } from '../lib/fixtures';
+import { registerEmail, requestEmailOtp, verifyEmailOtp } from '../lib/flows';
+
+test.describe('owner admin (api)', () => {
+  // The owner address is fixed in the stack's OWNER_EMAIL before boot, so this
+  // spec registers that exact email rather than the actor fixture's random one.
+  test('registering the owner email grants the admin role at signup', async ({ actor }) => {
+    const ephemeral = await registerEmail(actor.ctx, OWNER_EMAIL);
+    const code = await requestEmailOtp(actor.ctx, ephemeral);
+
+    const res = await verifyEmailOtp(actor.ctx, ephemeral, code);
+    expect(res.ok(), `verify-email-otp -> ${res.status()} ${await res.text()}`).toBeTruthy();
+
+    const body = await res.json();
+    expect(body.token, 'session access token').toBeTruthy();
+
+    const roles = (body.roles ?? []) as string[];
+    expect(
+      roles.includes('admin'),
+      `owner signup grants the admin role (got ${JSON.stringify(roles)})`,
+    ).toBeTruthy();
+  });
+});

package/verify/harness/global-setup.ts

@@ -1,6 +1,6 @@
 import { request as playwrightRequest } from '@playwright/test';
 
-import { ADAPTER_URL, API_URL, MOCK_OIDC_PORT, REACT_URL } from './lib/env';
+import { ADAPTER_URL, API_URL, FASTIFY_ADAPTER_URL, MOCK_OIDC_PORT, REACT_URL } from './lib/env';
 import { startMockOidc } from './mock-oidc';
 
 async function waitForHealth(url: string, name: string, timeoutMs = 120_000): Promise<void> {
@@ -39,6 +39,9 @@ export default async function globalSetup(): Promise<void> {
   if (process.env.SEAMLESS_VERIFY_ADAPTER === '1') {
     await waitForHealth(`${ADAPTER_URL}/`, 'adapter');
   }
+  if (process.env.SEAMLESS_VERIFY_ADAPTER_FASTIFY === '1') {
+    await waitForHealth(`${FASTIFY_ADAPTER_URL}/`, 'adapter-fastify');
+  }
   if (process.env.SEAMLESS_VERIFY_REACT === '1') {
     await waitForHealth(`${REACT_URL}/health`, 'react');
   }

package/verify/harness/lib/client.ts

@@ -24,9 +24,13 @@ export async function newApiActor(prefix = 'verify'): Promise<Actor> {
   return { email: uniqueEmail(prefix), ctx, dispose: () => ctx.dispose() };
 }
 
-// A browser-like actor for the cookie path: a context bound to the adapter that
+// A browser-like actor for the cookie path: a context bound to an adapter that
 // persists cookies across requests (the adapter handles service tokens internally).
-export async function newAdapterActor(prefix = 'verify'): Promise<Actor> {
-  const ctx = await playwrightRequest.newContext({ baseURL: ADAPTER_URL });
+// `baseURL` selects which adapter, so the same specs drive Express and Fastify.
+export async function newAdapterActor(
+  baseURL: string = ADAPTER_URL,
+  prefix = 'verify',
+): Promise<Actor> {
+  const ctx = await playwrightRequest.newContext({ baseURL });
   return { email: uniqueEmail(prefix), ctx, dispose: () => ctx.dispose() };
 }