chore: adopt changesets for versioning and releases

.changeset/README.md

@@ -0,0 +1,8 @@
+# Changesets
+
+Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works
+with multi-package repos, or single-package repos to help you version and publish your code. You can
+find the full documentation for it [in our repository](https://github.com/changesets/changesets).
+
+We have a quick list of common questions to get you started engaging with this project in
+[our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md).

.changeset/config.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.4/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "snapshot": {
+    "useCalculatedVersion": true,
+    "prereleaseTemplate": "{tag}.{datetime}"
+  },
+  "ignore": []
+}

.changeset/seamless-verify-harness.md

@@ -0,0 +1,14 @@
+---
+"seamless-cli": minor
+---
+
+Add `seamless verify`, a one-command cross-package auth conformance harness. It stands up the
+auth API, the Express adapter, and the React starter, then runs a matrix of flows (register,
+email and phone OTP, magic-link, passkey register and login, OAuth, TOTP, step-up, refresh,
+sessions, logout, organizations, admin bootstrap, and JWKS) across the api, adapter, and
+browser layers, and prints a pass/fail grid alongside JUnit and HTML reports.
+
+Supports `--local` (build the `@seamless-auth/*` packages from source for pre-publish contract
+testing) and a released mode against the published packages, plus filters like `--api-only`,
+`--no-react`, `--filter`, and `--keep-up`. Ships a reusable GitHub workflow so a change in any
+ecosystem repo runs the matrix against the others.

.github/workflows/release.yml

@@ -1,40 +1,60 @@
-name: Publish to npm
+name: Release
 
 on:
   push:
-    tags:
-      - "v*.*.*"
+    branches:
+      - main
+  workflow_dispatch:
 
 permissions:
-  contents: read
+  contents: write
+  pull-requests: write
+  id-token: write
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
-  publish:
+  release:
+    if: github.repository == 'fells-code/seamless-cli'
+    name: Version or publish
     runs-on: ubuntu-latest
+    env:
+      HUSKY: 0
 
     steps:
-      - name: Checkout
+      - name: Checkout repo
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
-      - name: Use Node.js
+      - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: 20
-          registry-url: https://registry.npmjs.org
+          cache: npm
+          registry-url: https://registry.npmjs.org/
 
       - name: Install dependencies
         run: npm ci
 
-      - name: Verify tag matches package version
-        run: |
-          TAG_VERSION=${GITHUB_REF#refs/tags/v}
-          PKG_VERSION=$(node -p "require('./package.json').version")
-          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
-            echo "Tag version ($TAG_VERSION) does not match package.json version ($PKG_VERSION)"
-            exit 1
-          fi
-
-      - name: Publish to npm
-        run: npm publish
+      - name: Build
+        run: npm run build
+
+      # On a push to main: open or update the "Version packages" PR when changesets
+      # are pending; once that PR merges (versions bumped, changesets consumed),
+      # publish the package to npm.
+      - name: Version or publish
+        uses: changesets/action@v1
+        with:
+          version: npm run version-packages
+          publish: npm run release:stable
+          title: 'chore: version packages'
+          commit: 'chore: version packages'
+          createGithubReleases: true
         env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true