From 556e18ce0efe321be0745e58074cd4301d178198 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sun, 13 Sep 2026 15:51:52 +0000 Subject: [PATCH] Version Packages --- .../client-ports-and-bearer-transport.md | 41 -------------- .changeset/client-workspace.md | 12 ----- .changeset/react-native-binding.md | 17 ------ packages/client/CHANGELOG.md | 48 +++++++++++++++++ packages/client/package.json | 2 +- packages/react-native/CHANGELOG.md | 24 +++++++++ packages/react-native/package.json | 4 +- packages/react/CHANGELOG.md | 54 +++++++++++++++++++ packages/react/package.json | 4 +- 9 files changed, 131 insertions(+), 75 deletions(-) delete mode 100644 .changeset/client-ports-and-bearer-transport.md delete mode 100644 .changeset/client-workspace.md delete mode 100644 .changeset/react-native-binding.md diff --git a/.changeset/client-ports-and-bearer-transport.md b/.changeset/client-ports-and-bearer-transport.md deleted file mode 100644 index e73f45a..0000000 --- a/.changeset/client-ports-and-bearer-transport.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -'@seamless-auth/client': minor -'@seamless-auth/react': minor ---- - -Put the platform behind ports, and add a bearer transport with token custody to the client core. - -The client spoke one contract: cookies to a server adapter at `/auth`, with the browser's WebAuthn -API and `window.location` reached directly. A native binding has none of those, so the pieces that -differ by platform are now ports a binding supplies, with the browser implementations as the -defaults. A web application configures nothing and behaves exactly as before. - -- `transport` on `createSeamlessAuthClient` (and `AuthProvider`): cookie transport is unchanged; - `{ mode: 'bearer', tokenStorage }` makes the client hold the auth API's own tokens. Every request - carries `x-seamless-auth-transport: bearer`; pre-auth routes carry the ephemeral token that - `/login` or `/registration/register` returned, kept in memory only; signed-in routes carry the - access token; the pair a sign-in returns is written through a `TokenStoragePort`; a 401 on a - signed-in route triggers one `POST /refresh` and one retry, with at most one refresh in flight - because the auth API revokes the chain on a replayed refresh token. Which routes take which - token is one table, mirroring the server adapter's, rather than an annotation at each of the - forty call sites. -- `PasskeyPort` (`isSupported`, `isPlatformAuthenticatorAvailable`, `create`, `get`) replaces the - direct SimpleWebAuthn calls at the four ceremony sites. `createBrowserPasskeyPort()` is the - default. A port reports an authenticator refusal with `PasskeyCeremonyError`, or any error with a - DOMException `name` and a string `code`, which the client turns into the same result a browser - failure gave. The PRF helpers no longer depend on SimpleWebAuthn at runtime. -- `OAuthRedirectPort` replaces `window.location.assign` in the built-in provider buttons. - `createBrowserOAuthRedirect()` is the default; a port that receives the callback itself resolves - with `code` and `state`, and the buttons finish the login on the spot. -- `TokenStoragePort` with `createMemoryTokenStorage()`. -- `client.authorizedFetch(input, init)` and `useAuthorizedFetch()`: a fetch for the application's - own API that carries the session the way the transport does (cookies, or the access token with - one refresh-and-retry on a 401). A path resolves on `apiHost`. This is what a native app uses to - call routes behind `requireAuth`. -- `createAuthSession` accepts the client options (or a ready-made `client`) and exposes the client - it drives as `session.client`. `useAuthClient()` returns that same instance rather than building a - second one, which bearer transport needs: the client holds the sign-in in flight. -- `AuthProvider` gains `transport` and `ports` props and exposes `client` and `ports` on the - context. `usePasskeySupport()` reads the passkey port. - -Tracks fells-code/seamless-auth-react#124, #125, #127 and #128. diff --git a/.changeset/client-workspace.md b/.changeset/client-workspace.md deleted file mode 100644 index 07b6236..0000000 --- a/.changeset/client-workspace.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -'@seamless-auth/client': minor -'@seamless-auth/react': patch ---- - -Split the framework-agnostic core into `@seamless-auth/client`, and make this repository an npm workspace that publishes both packages. - -`@seamless-auth/react` was one package holding two layers: the headless client, session store, and result types that any binding needs, and the React provider, hooks, and screens on top. A React Native binding is next, and it must share the first layer rather than copy it, since the session state machine is the worst place for two implementations to drift (#64). - -`@seamless-auth/client` now carries `createSeamlessAuthClient`, `createAuthSession`, `SessionStoragePort` and its implementations, `createFetchWithAuth`, the error and result types, the PRF helpers, role matching, and the wire type aliases. `@seamless-auth/react` depends on it and re-exports the same public surface it did before, so an application installing `@seamless-auth/react` sees no change in what it imports or how it behaves. - -Packaging only: no runtime behaviour changes in either package. diff --git a/.changeset/react-native-binding.md b/.changeset/react-native-binding.md deleted file mode 100644 index 0ba8f0d..0000000 --- a/.changeset/react-native-binding.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -'@seamless-auth/react-native': minor ---- - -First release of `@seamless-auth/react-native`, the headless React Native binding. - -An `AuthProvider` over the shared session store, always on bearer transport; `useAuth`, -`useAuthClient`, `useLoginMethods` and `usePasskeySupport`; and the native ports: -`createSecureStoreTokenStorage` (expo-secure-store), `createNativePasskeyPort` -(react-native-passkeys, mapping native failures onto the DOMException names the client's error -readers understand), `createWebBrowserOAuthRedirect` (expo-web-browser auth session, resolving the -callback's `code` and `state`), and `describeDevice` for passkey metadata. Each port takes its -native module as a parameter, so an app installs only what it uses and Metro never resolves a -module it did not. - -No screens: the app brings its own, the same way a web app that skips `AuthRoutes` does. The flows, -session state, and token custody come from `@seamless-auth/client`. diff --git a/packages/client/CHANGELOG.md b/packages/client/CHANGELOG.md index 1e85d34..0b9e4e1 100644 --- a/packages/client/CHANGELOG.md +++ b/packages/client/CHANGELOG.md @@ -1 +1,49 @@ # @seamless-auth/client + +## 0.1.0 + +### Minor Changes + +- 93a35b7: Put the platform behind ports, and add a bearer transport with token custody to the client core. + + The client spoke one contract: cookies to a server adapter at `/auth`, with the browser's WebAuthn + API and `window.location` reached directly. A native binding has none of those, so the pieces that + differ by platform are now ports a binding supplies, with the browser implementations as the + defaults. A web application configures nothing and behaves exactly as before. + - `transport` on `createSeamlessAuthClient` (and `AuthProvider`): cookie transport is unchanged; + `{ mode: 'bearer', tokenStorage }` makes the client hold the auth API's own tokens. Every request + carries `x-seamless-auth-transport: bearer`; pre-auth routes carry the ephemeral token that + `/login` or `/registration/register` returned, kept in memory only; signed-in routes carry the + access token; the pair a sign-in returns is written through a `TokenStoragePort`; a 401 on a + signed-in route triggers one `POST /refresh` and one retry, with at most one refresh in flight + because the auth API revokes the chain on a replayed refresh token. Which routes take which + token is one table, mirroring the server adapter's, rather than an annotation at each of the + forty call sites. + - `PasskeyPort` (`isSupported`, `isPlatformAuthenticatorAvailable`, `create`, `get`) replaces the + direct SimpleWebAuthn calls at the four ceremony sites. `createBrowserPasskeyPort()` is the + default. A port reports an authenticator refusal with `PasskeyCeremonyError`, or any error with a + DOMException `name` and a string `code`, which the client turns into the same result a browser + failure gave. The PRF helpers no longer depend on SimpleWebAuthn at runtime. + - `OAuthRedirectPort` replaces `window.location.assign` in the built-in provider buttons. + `createBrowserOAuthRedirect()` is the default; a port that receives the callback itself resolves + with `code` and `state`, and the buttons finish the login on the spot. + - `TokenStoragePort` with `createMemoryTokenStorage()`. + - `client.authorizedFetch(input, init)` and `useAuthorizedFetch()`: a fetch for the application's + own API that carries the session the way the transport does (cookies, or the access token with + one refresh-and-retry on a 401). A path resolves on `apiHost`. This is what a native app uses to + call routes behind `requireAuth`. + - `createAuthSession` accepts the client options (or a ready-made `client`) and exposes the client + it drives as `session.client`. `useAuthClient()` returns that same instance rather than building a + second one, which bearer transport needs: the client holds the sign-in in flight. + - `AuthProvider` gains `transport` and `ports` props and exposes `client` and `ports` on the + context. `usePasskeySupport()` reads the passkey port. + + Tracks fells-code/seamless-auth-react#124, #125, #127 and #128. + +- f8f0dfe: Split the framework-agnostic core into `@seamless-auth/client`, and make this repository an npm workspace that publishes both packages. + + `@seamless-auth/react` was one package holding two layers: the headless client, session store, and result types that any binding needs, and the React provider, hooks, and screens on top. A React Native binding is next, and it must share the first layer rather than copy it, since the session state machine is the worst place for two implementations to drift (#64). + + `@seamless-auth/client` now carries `createSeamlessAuthClient`, `createAuthSession`, `SessionStoragePort` and its implementations, `createFetchWithAuth`, the error and result types, the PRF helpers, role matching, and the wire type aliases. `@seamless-auth/react` depends on it and re-exports the same public surface it did before, so an application installing `@seamless-auth/react` sees no change in what it imports or how it behaves. + + Packaging only: no runtime behaviour changes in either package. diff --git a/packages/client/package.json b/packages/client/package.json index 651f91a..0f8861f 100644 --- a/packages/client/package.json +++ b/packages/client/package.json @@ -1,6 +1,6 @@ { "name": "@seamless-auth/client", - "version": "0.0.0", + "version": "0.1.0", "description": "Framework-agnostic client core for Seamless Auth: the HTTP client, session store, and result types the framework bindings share.", "type": "module", "exports": { diff --git a/packages/react-native/CHANGELOG.md b/packages/react-native/CHANGELOG.md index bae621e..ff63e14 100644 --- a/packages/react-native/CHANGELOG.md +++ b/packages/react-native/CHANGELOG.md @@ -1 +1,25 @@ # @seamless-auth/react-native + +## 0.1.0 + +### Minor Changes + +- 280ceee: First release of `@seamless-auth/react-native`, the headless React Native binding. + + An `AuthProvider` over the shared session store, always on bearer transport; `useAuth`, + `useAuthClient`, `useLoginMethods` and `usePasskeySupport`; and the native ports: + `createSecureStoreTokenStorage` (expo-secure-store), `createNativePasskeyPort` + (react-native-passkeys, mapping native failures onto the DOMException names the client's error + readers understand), `createWebBrowserOAuthRedirect` (expo-web-browser auth session, resolving the + callback's `code` and `state`), and `describeDevice` for passkey metadata. Each port takes its + native module as a parameter, so an app installs only what it uses and Metro never resolves a + module it did not. + + No screens: the app brings its own, the same way a web app that skips `AuthRoutes` does. The flows, + session state, and token custody come from `@seamless-auth/client`. + +### Patch Changes + +- Updated dependencies [93a35b7] +- Updated dependencies [f8f0dfe] + - @seamless-auth/client@0.1.0 diff --git a/packages/react-native/package.json b/packages/react-native/package.json index 61c1f5d..4a04219 100644 --- a/packages/react-native/package.json +++ b/packages/react-native/package.json @@ -1,6 +1,6 @@ { "name": "@seamless-auth/react-native", - "version": "0.0.0", + "version": "0.1.0", "description": "Headless React Native binding for Seamless Auth: provider, hooks, and the native ports for passkeys, secure token storage, and in-app browser OAuth.", "type": "module", "exports": { @@ -45,7 +45,7 @@ "react": "^18.0.0 || ^19.0.0" }, "dependencies": { - "@seamless-auth/client": "^0.0.0", + "@seamless-auth/client": "^0.1.0", "@seamless-auth/types": "^0.20.0" }, "sideEffects": false diff --git a/packages/react/CHANGELOG.md b/packages/react/CHANGELOG.md index 8606864..02b839d 100644 --- a/packages/react/CHANGELOG.md +++ b/packages/react/CHANGELOG.md @@ -1,5 +1,59 @@ # @seamless-auth/react +## 0.13.0 + +### Minor Changes + +- 93a35b7: Put the platform behind ports, and add a bearer transport with token custody to the client core. + + The client spoke one contract: cookies to a server adapter at `/auth`, with the browser's WebAuthn + API and `window.location` reached directly. A native binding has none of those, so the pieces that + differ by platform are now ports a binding supplies, with the browser implementations as the + defaults. A web application configures nothing and behaves exactly as before. + - `transport` on `createSeamlessAuthClient` (and `AuthProvider`): cookie transport is unchanged; + `{ mode: 'bearer', tokenStorage }` makes the client hold the auth API's own tokens. Every request + carries `x-seamless-auth-transport: bearer`; pre-auth routes carry the ephemeral token that + `/login` or `/registration/register` returned, kept in memory only; signed-in routes carry the + access token; the pair a sign-in returns is written through a `TokenStoragePort`; a 401 on a + signed-in route triggers one `POST /refresh` and one retry, with at most one refresh in flight + because the auth API revokes the chain on a replayed refresh token. Which routes take which + token is one table, mirroring the server adapter's, rather than an annotation at each of the + forty call sites. + - `PasskeyPort` (`isSupported`, `isPlatformAuthenticatorAvailable`, `create`, `get`) replaces the + direct SimpleWebAuthn calls at the four ceremony sites. `createBrowserPasskeyPort()` is the + default. A port reports an authenticator refusal with `PasskeyCeremonyError`, or any error with a + DOMException `name` and a string `code`, which the client turns into the same result a browser + failure gave. The PRF helpers no longer depend on SimpleWebAuthn at runtime. + - `OAuthRedirectPort` replaces `window.location.assign` in the built-in provider buttons. + `createBrowserOAuthRedirect()` is the default; a port that receives the callback itself resolves + with `code` and `state`, and the buttons finish the login on the spot. + - `TokenStoragePort` with `createMemoryTokenStorage()`. + - `client.authorizedFetch(input, init)` and `useAuthorizedFetch()`: a fetch for the application's + own API that carries the session the way the transport does (cookies, or the access token with + one refresh-and-retry on a 401). A path resolves on `apiHost`. This is what a native app uses to + call routes behind `requireAuth`. + - `createAuthSession` accepts the client options (or a ready-made `client`) and exposes the client + it drives as `session.client`. `useAuthClient()` returns that same instance rather than building a + second one, which bearer transport needs: the client holds the sign-in in flight. + - `AuthProvider` gains `transport` and `ports` props and exposes `client` and `ports` on the + context. `usePasskeySupport()` reads the passkey port. + + Tracks fells-code/seamless-auth-react#124, #125, #127 and #128. + +### Patch Changes + +- f8f0dfe: Split the framework-agnostic core into `@seamless-auth/client`, and make this repository an npm workspace that publishes both packages. + + `@seamless-auth/react` was one package holding two layers: the headless client, session store, and result types that any binding needs, and the React provider, hooks, and screens on top. A React Native binding is next, and it must share the first layer rather than copy it, since the session state machine is the worst place for two implementations to drift (#64). + + `@seamless-auth/client` now carries `createSeamlessAuthClient`, `createAuthSession`, `SessionStoragePort` and its implementations, `createFetchWithAuth`, the error and result types, the PRF helpers, role matching, and the wire type aliases. `@seamless-auth/react` depends on it and re-exports the same public surface it did before, so an application installing `@seamless-auth/react` sees no change in what it imports or how it behaves. + + Packaging only: no runtime behaviour changes in either package. + +- Updated dependencies [93a35b7] +- Updated dependencies [f8f0dfe] + - @seamless-auth/client@0.1.0 + ## 0.12.0 ### Minor Changes diff --git a/packages/react/package.json b/packages/react/package.json index 729dbbb..55ff720 100644 --- a/packages/react/package.json +++ b/packages/react/package.json @@ -1,6 +1,6 @@ { "name": "@seamless-auth/react", - "version": "0.12.0", + "version": "0.13.0", "description": "A drop-in authentication solution for modern React applications.", "type": "module", "exports": { @@ -47,7 +47,7 @@ "react-router-dom": "^6.4.0 || ^7.15.1" }, "dependencies": { - "@seamless-auth/client": "^0.0.0", + "@seamless-auth/client": "^0.1.0", "@seamless-auth/types": "^0.20.0", "@simplewebauthn/browser": "^13.1.0", "libphonenumber-js": "^1.12.7"