chore: move the scaffold onto the current ecosystem and offer Fastify

.changeset/ecosystem-bump-july.md

@@ -0,0 +1,53 @@
+---
+"seamless-cli": minor
+---
+
+Move the scaffold onto the current Seamless ecosystem: auth API `v0.7.1`, admin dashboard `v0.4.0`,
+and seamless-templates `v0.8.1` (which carries `@seamless-auth/react` `^0.8.0` in both React
+starters, `@seamless-auth/express` `^0.12.0` in the Express starter, and `@seamless-auth/fastify`
+`^0.3.1` in the Fastify starter).
+
+A scaffolded project can now finish registration without a passkey. Registration used to end on a
+screen with a single control, leaving anyone who did not want a passkey, or whose device could not
+make one, with no way forward. The starters offer a skip when the instance has another login method
+enabled, and say so plainly when it does not. That reads from `GET /system-config/public`, a new
+unauthenticated route on the auth server that returns the configured login methods, so the sign-in
+screens can offer what an instance actually has enabled instead of a hardcoded guess. The API, the
+adapters, and the web templates all had to move together for it to work, which is why this bumps
+them as a set.
+
+Registration against a scaffolded Fastify API used to fail with a 500 and
+`TypeError: option maxAge is invalid: 300`. The auth server sent the registration response's `ttl`
+as the string `"300"`, and the Fastify adapter handed it to a cookie library that requires an
+integer. The Express starter never showed this, because its adapter multiplies the value into
+milliseconds and so coerced the string on the way past. It is fixed from both ends:
+`@seamless-auth/core` `0.12.1` parses the lifetime before it reaches an adapter and rejects anything
+that is not a positive whole number of seconds, and auth API `v0.7.1` sends the value as a number.
+
+`seamless init` now offers Fastify as a backend, listed as "Fastify (beta)" beside Express. It
+serves the same surface as the Express starter on the same environment contract, including the
+admin console at `/console` behind `SERVE_ADMIN_CONSOLE`. Two boot-time fixes land with it: an empty
+`PORT=` in `.env` now falls back to 3000 rather than binding a random free port, and `pino-pretty`
+moves to a runtime dependency so an install without dev dependencies boots. Both Express and Fastify
+starters ship `.env.example` secret placeholders long enough to clear the adapter's 32 character
+minimum, so the documented `cp .env.example .env && npm run dev` path boots. A project from
+`seamless init` was already unaffected, because the CLI fills `COOKIE_SIGNING_KEY` itself.
+
+Both React starters gain a protected `/session` route that shows the issued claims, roles,
+organization context, step-up freshness, and registered passkeys, so the first authenticated screen
+reads as an app rather than a `JSON.stringify` dump. Missing configuration now stops a scaffolded
+project with a message naming the variable instead of surfacing later as a 500, and the Express
+starter reports every configuration problem at once.
+
+The auth API drops the admin bootstrap invite flow in favor of the `OWNER_EMAIL` grant the CLI
+already writes, so the generated `.env` no longer carries `SEAMLESS_BOOTSTRAP_ENABLED`,
+`SEAMLESS_BOOTSTRAP_SECRET`, or `SEAMLESS_AUTH_DEBUG_SECRETS`. `AVAILABLE_ROLES` now offers
+`admin:read` and `admin:write` alongside bare `admin`, and assigning a role the instance does not
+list is rejected rather than silently doing nothing. Postgres TLS is configurable through `DB_SSL`,
+`DB_SSL_CA`, and `DB_SSL_REJECT_UNAUTHORIZED`, and `DB_URI` is accepted as a `DATABASE_URL` alias.
+
+The conformance harness adapter moves to `@seamless-auth/express` `^0.12.0`, which is also what
+proxies the new public system-config route. The breaking change in `0.11.0` splits `error` into
+`errorCode` and `errorBody` on the handler result types, which only affects code importing handlers
+from `@seamless-auth/core` directly; the adapter uses `createSeamlessAuthServer`, so it needed no
+source change.

README.md

@@ -134,6 +134,7 @@ ID           KIND  FRAMEWORK  FLAGS                   STATUS
 react-vite   web   react      --basic, --react-vite   stable
 react-oauth  web   react      --oauth, --react-oauth  stable
 express      api   express    --express               stable
+fastify      api   fastify    --fastify               beta
 ```
 
 Every template answers to `--<id>`; some also declare a shorter `--<alias>`, and the two are
@@ -201,7 +202,7 @@ Depending on your selections, the CLI generates a project like this:
 my-app/
 ├─ auth/        # Seamless Auth server (optional)
 ├─ web/         # React web application (optional)
-├─ api/         # Express API server (optional)
+├─ api/         # Express or Fastify API server (optional)
 ├─ docker-compose.yml (optional)
 └─ README.md
 ```

src/core/images.ts

@@ -1,10 +1,10 @@
 export const POSTGRES_IMAGE = "postgres:17";
 
-export const SEAMLESS_AUTH_API_VERSION = "v0.5.0";
+export const SEAMLESS_AUTH_API_VERSION = "v0.7.1";
 
 export const SEAMLESS_AUTH_API_IMAGE = `ghcr.io/fells-code/seamless-auth-api:${SEAMLESS_AUTH_API_VERSION}`;
 
-export const SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION = "v0.3.0";
+export const SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION = "v0.4.0";
 
 export const SEAMLESS_AUTH_ADMIN_DASHBOARD_IMAGE = `ghcr.io/fells-code/seamless-auth-admin-dashboard:${SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION}`;
 
@@ -13,4 +13,4 @@ export const SEAMLESS_AUTH_ADMIN_DASHBOARD_IMAGE = `ghcr.io/fells-code/seamless-
 // SEAMLESS_TEMPLATES_REF, or point at a local checkout with SEAMLESS_TEMPLATES_DIR.
 export const SEAMLESS_TEMPLATES_REPO = "fells-code/seamless-templates";
 
-export const SEAMLESS_TEMPLATES_REF = "v0.5.0";
+export const SEAMLESS_TEMPLATES_REF = "v0.8.1";

verify/adapter-app/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "description": "Minimal adopter backend for the conformance harness — real @seamless-auth/express with a capture transport.",
   "dependencies": {
-    "@seamless-auth/express": "^0.9.0",
+    "@seamless-auth/express": "^0.12.1",
     "cookie-parser": "^1.4.6",
     "cors": "^2.8.5",
     "express": "^5.1.0"