Epic: public adoption and migration readiness

[Bccorb]

Goal

Make Seamless Auth easy for a stranger to adopt, and make it practical to move an existing organization off its current identity system onto Seamless Auth.

Why

An ecosystem review on 2026-10-05 found the engineering in good shape but adoption close to zero: almost no organic discovery, an AGPL license on the SDKs that adopters bundle into their own apps, a quickstart that fails on its first run, and no tooling for the hardest part of switching auth providers (getting the existing users across).

Tracks

1. Public adoption

Removing the reasons someone tries Seamless Auth and leaves.

2. Migration tooling

Bulk import, coexistence with the legacy identity provider during cutover, and tracked passkey re-enrollment. Passwords are never imported (there are none to import into), so every migration is an identity import followed by an enrollment campaign.

Children

Listed in the order to work them.

• chore: relicense the Seamless Auth ecosystem to Apache-2.0 #335 Relicense the ecosystem to Apache-2.0 (adoption)
• fells-code/seamless-auth-docs#44 Quickstart fails on its first run (adoption)
• Silent refresh writes an access token into the pre-auth cookie, so passkey login answers 401 seamless-auth-server#154 Silent refresh writes an access token into the pre-auth cookie (adoption, existing security bug). Fixed in fix(core): never silently refresh into a pre-auth or registration cookie seamless-auth-server#176
• feat(admin): bulk user import for migrations #336 Bulk user import (migration), shipped in v0.16.0 via feat(admin): bulk user import for migrations #340
• feat(migrate): import users from an existing identity system seamless-cli#208 seamless migrate, starting with CSV and Entra ID (migration). CSV shipped in feat(migrate): import users from a CSV export seamless-cli#214; Entra ID continues in feat(migrate): import users from Microsoft Entra ID seamless-cli#213
• feat(oauth): sign in through the legacy identity provider during migration cutover #337 Sign in through the legacy identity provider during cutover (migration). Merged; the API release is pending
• feat: track and invite passkey enrollment for imported users #338 Track and invite passkey enrollment for imported users (migration)
• fix(core): @seamless-auth/types is pinned eighteen minors behind seamless-auth-server#169 @seamless-auth/types pinned eighteen minors behind in core (adoption)
• test(conformance): cover CLI commands, bearer transport, the dashboard and types PRs seamless-cli#209 Conformance gaps: CLI commands, bearer transport, dashboard, types PRs (both)
• fells-code/seamless-auth-docs#45 One front door, topology diagram, compatibility matrix (adoption)
• chore: support Node versions beyond 24 across the ecosystem #339 Support Node versions beyond 24 (adoption)
• feat: add Seamless Auth to an existing app seamless-cli#210 Add Seamless Auth to an existing app (adoption)
• Add Next.js support seamless-auth-react#78 Next.js support (adoption, existing)

Done when

• A developer can go from the docs landing page to a working passkey login without hitting a wrong command.
• Every published package is Apache-2.0.
• An organization's users can be imported from at least a CSV and one hosted identity provider, signed in through the old provider during cutover, and tracked to full passkey enrollment.