From 267ae9302651b4706607c57f3f0b729d8520d8bc Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 22 Oct 2026 19:51:07 +0000 Subject: [PATCH] ci(repo): version packages --- .changeset/auth-paste-back-login.md | 5 --- .changeset/clerk-deploy-agent-friendly.md | 14 -------- .changeset/init-auth-pages-suspense.md | 5 --- .changeset/init-starter-header-suspense.md | 5 --- .changeset/ios-production-doctor.md | 5 --- .changeset/ios-starter.md | 5 --- .changeset/migrate-export.md | 5 --- .changeset/migrate-runs-undo.md | 7 ---- ...-ansi-escape-codes-in-agent-mode-output.md | 5 --- packages/cli/CHANGELOG.md | 35 +++++++++++++++++++ packages/cli/package.json | 2 +- 11 files changed, 36 insertions(+), 57 deletions(-) delete mode 100644 .changeset/auth-paste-back-login.md delete mode 100644 .changeset/clerk-deploy-agent-friendly.md delete mode 100644 .changeset/init-auth-pages-suspense.md delete mode 100644 .changeset/init-starter-header-suspense.md delete mode 100644 .changeset/ios-production-doctor.md delete mode 100644 .changeset/ios-starter.md delete mode 100644 .changeset/migrate-export.md delete mode 100644 .changeset/migrate-runs-undo.md delete mode 100644 .changeset/no-ansi-escape-codes-in-agent-mode-output.md diff --git a/.changeset/auth-paste-back-login.md b/.changeset/auth-paste-back-login.md deleted file mode 100644 index dbf4fce68f..0000000000 --- a/.changeset/auth-paste-back-login.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -Sign in from a machine without a browser: `clerk auth login` now accepts the URL your browser lands on after signing in on another device, pasted back into the terminal. diff --git a/.changeset/clerk-deploy-agent-friendly.md b/.changeset/clerk-deploy-agent-friendly.md deleted file mode 100644 index f06065e6e6..0000000000 --- a/.changeset/clerk-deploy-agent-friendly.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -"clerk": minor ---- - -Let AI agents take a Clerk application to production. - -- `clerk deploy --domain ` in agent mode creates the production instance (or resumes the existing one) without prompting and prints the deploy report. Without `--domain` it stays read-only. In the wizard, `--domain` skips the domain prompt and `--yes` skips the confirmations. -- `clerk deploy --domain` refuses a domain it can't apply: with an existing production instance on another domain it fails with `production_instance_exists`, and while Clerk hasn't returned the existing instance's domain yet it fails with the new `deploy_domain_unchecked`, in agent mode and the wizard alike. A wizard run whose typed domain loses a create race to another run's instance stops the same way, rather than carrying on into that instance's setup. -- `clerk deploy` refuses more hosting providers' domains, both in `--domain` and at the wizard's domain prompt: `*.replit.app`, `*.replit.dev`, `*.onrender.com`, `*.railway.app`, `*.emergent.host`, `*.emergentagent.com`, `*.web.app`, `*.firebaseapp.com`, `*.hosted.app`, `*.workers.dev`, `*.github.io`, `*.lovable.app`, `*.bolt.host`, and `*.base44.app`, alongside `*.vercel.app` and the others it already refused. `clerk deploy` needs a domain whose DNS records you can add. -- A 404 on the production domain's status, in `clerk deploy`, `clerk deploy status`, or the wizard's DNS polling, now fails with `deploy_instance_unresolved` instead of `not_linked` and its advice to re-link the directory. Unless the run just created the instance, the message adds that if the production instance was deleted, `clerk deploy status` reports `not_started` once Clerk stops listing it, and to run `clerk deploy --domain` then. -- The deploy report gains `oauth.setup`: for each provider missing production credentials, the redirect URI, authorized origins, fields, and the `clerk config patch` payload and command that save them. `nextAction` now names the command to run instead of handing off to a human terminal, except for Apple's private key and, when the app uses native-only Sign in with Apple, Apple web credentials, which still go through `clerk deploy` in a terminal. OAuth secrets go into a file outside the project that the user fills in and that is removed afterward. When native-only Sign in with Apple isn't ready in production, Apple is left out of `oauth.setup` so the native fix in `nextAction` isn't buried. Once Clerk's side is complete, `nextAction` says to pipe the production keys into the host's CLI without reading them, and the new `hostSetup` field holds the command for Vercel (with `host`, `label`, `shells`, and `command`), so an agent copies it verbatim from the field instead of out of the sentence. On macOS and Linux, that command and each `oauth.setup` command start with `clerk` only when the `clerk` on PATH resolves to the running binary itself, and otherwise with the running CLI's quoted absolute path (an npm or bun global install puts npm's launcher script on PATH, so it gets the binary's path), so they work when the CLI was started with `npx`. On Windows they keep `clerk`. `hostSetup` is `[]` in every other state. -- `clerk env pull --print` prints `KEY=value` lines to stdout instead of writing an env file, for sending production keys to a hosting provider. It fails without printing anything when Clerk returns no secret key. For an unclaimed accountless app, whose keys exist only on this machine, it prints the secret key alone, with a warning, when no publishable key is found locally. -- `clerk config patch` and `clerk config put` print `[REDACTED]` in place of the value of any key whose name contains `secret` or `private_key` (in any case), in the diff they show before writing and in the response they print after (dry runs included). Values under other keys are printed as before. Both refuse a payload that still holds `[REDACTED]` under such a key, naming each field, so their own output can't be saved over a real secret. Error bodies logged under `--verbose` are not redacted. -- `clerk config patch` and `clerk config put` refuse a payload that still holds an `oauth.setup` placeholder (`` under `client_secret`), naming each such field, and `clerk deploy status` no longer counts such a value as a saved credential. diff --git a/.changeset/init-auth-pages-suspense.md b/.changeset/init-auth-pages-suspense.md deleted file mode 100644 index 0667eb5c9a..0000000000 --- a/.changeset/init-auth-pages-suspense.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": patch ---- - -Wrap the sign-in and sign-up pages that `clerk init` creates for Next.js App Router apps in ``, so they no longer fail `next build` when Cache Components is enabled, as it is in new `create-next-app` projects. diff --git a/.changeset/init-starter-header-suspense.md b/.changeset/init-starter-header-suspense.md deleted file mode 100644 index 3cb3891d10..0000000000 --- a/.changeset/init-starter-header-suspense.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": patch ---- - -Wrap the auth header that `clerk init --starter` adds to Next.js App Router layouts in ``, so new apps no longer fail `next build` when Cache Components is enabled, as it is in new `create-next-app` projects. diff --git a/.changeset/ios-production-doctor.md b/.changeset/ios-production-doctor.md deleted file mode 100644 index d948fcd62b..0000000000 --- a/.changeset/ios-production-doctor.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -`clerk doctor` checks an iOS or macOS app's Release build against the production instance: that Release's Bundle ID is registered there with Native API enabled, that its entitlements list the production Associated Domain, and that it configures Clerk with the production publishable key when the key is loaded in a way that can be read without building (otherwise it reports the key as not verified). Without a production instance this is a single note. Run in an Xcode project, `clerk deploy` and `clerk deploy status` now point to `clerk doctor` for this check. diff --git a/.changeset/ios-starter.md b/.changeset/ios-starter.md deleted file mode 100644 index 9f747dd09b..0000000000 --- a/.changeset/ios-starter.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -Create a new iOS or macOS app with `clerk init --starter`: pick iOS (SwiftUI) or macOS (SwiftUI) on a Mac with Xcode, and init writes a SwiftUI Xcode project, then sets up Clerk, the sign-in screen, and native registration. Use `--framework ios` or `--framework macos` with `--name`, `--bundle-id`, and the new `--team-id` to skip the prompts. diff --git a/.changeset/migrate-export.md b/.changeset/migrate-export.md deleted file mode 100644 index df70f88daa..0000000000 --- a/.changeset/migrate-export.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -Add `clerk migrate export clerk` and `clerk migrate export supabase`, and let `clerk migrate import` take the export's run ID in place of a file and `--source`. `clerk migrate` is still experimental and needs `CLERK_EXPERIMENTAL=migrate`. diff --git a/.changeset/migrate-runs-undo.md b/.changeset/migrate-runs-undo.md deleted file mode 100644 index 2c498fb32e..0000000000 --- a/.changeset/migrate-runs-undo.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"clerk": minor ---- - -Add `clerk migrate runs` and `clerk migrate undo`, and let a re-run of `clerk migrate import` continue where a stopped one left off. `clerk migrate` is still experimental and needs `CLERK_EXPERIMENTAL=migrate`. - -Every user an import creates now carries `clerkMigrateRun` (the run's ID) in its `private_metadata`, replacing any value the source had under that key. A re-run reads it to adopt a user whose create was cut off. Nothing removes it afterwards, and your backend can read it. diff --git a/.changeset/no-ansi-escape-codes-in-agent-mode-output.md b/.changeset/no-ansi-escape-codes-in-agent-mode-output.md deleted file mode 100644 index 232c3d003b..0000000000 --- a/.changeset/no-ansi-escape-codes-in-agent-mode-output.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": patch ---- - -Print plain text without terminal color codes in agent mode, so AI agents no longer see escape sequences in command output when they run without `--json`. Pass `--mode human` or set `CLERK_MODE=human` to keep colors. Status messages now also honor `NO_COLOR`. diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index cd6ed5207b..74517954b7 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,5 +1,40 @@ # clerk +## 4.1.0 + +### Minor Changes + +- Sign in from a machine without a browser: `clerk auth login` now accepts the URL your browser lands on after signing in on another device, pasted back into the terminal. ([#513](https://github.com/clerk/cli/pull/513)) by [@wyattjoh](https://github.com/wyattjoh) + +- Let AI agents take a Clerk application to production. ([#550](https://github.com/clerk/cli/pull/550)) by [@shane-kercheval](https://github.com/shane-kercheval) + + - `clerk deploy --domain ` in agent mode creates the production instance (or resumes the existing one) without prompting and prints the deploy report. Without `--domain` it stays read-only. In the wizard, `--domain` skips the domain prompt and `--yes` skips the confirmations. + - `clerk deploy --domain` refuses a domain it can't apply: with an existing production instance on another domain it fails with `production_instance_exists`, and while Clerk hasn't returned the existing instance's domain yet it fails with the new `deploy_domain_unchecked`, in agent mode and the wizard alike. A wizard run whose typed domain loses a create race to another run's instance stops the same way, rather than carrying on into that instance's setup. + - `clerk deploy` refuses more hosting providers' domains, both in `--domain` and at the wizard's domain prompt: `*.replit.app`, `*.replit.dev`, `*.onrender.com`, `*.railway.app`, `*.emergent.host`, `*.emergentagent.com`, `*.web.app`, `*.firebaseapp.com`, `*.hosted.app`, `*.workers.dev`, `*.github.io`, `*.lovable.app`, `*.bolt.host`, and `*.base44.app`, alongside `*.vercel.app` and the others it already refused. `clerk deploy` needs a domain whose DNS records you can add. + - A 404 on the production domain's status, in `clerk deploy`, `clerk deploy status`, or the wizard's DNS polling, now fails with `deploy_instance_unresolved` instead of `not_linked` and its advice to re-link the directory. Unless the run just created the instance, the message adds that if the production instance was deleted, `clerk deploy status` reports `not_started` once Clerk stops listing it, and to run `clerk deploy --domain` then. + - The deploy report gains `oauth.setup`: for each provider missing production credentials, the redirect URI, authorized origins, fields, and the `clerk config patch` payload and command that save them. `nextAction` now names the command to run instead of handing off to a human terminal, except for Apple's private key and, when the app uses native-only Sign in with Apple, Apple web credentials, which still go through `clerk deploy` in a terminal. OAuth secrets go into a file outside the project that the user fills in and that is removed afterward. When native-only Sign in with Apple isn't ready in production, Apple is left out of `oauth.setup` so the native fix in `nextAction` isn't buried. Once Clerk's side is complete, `nextAction` says to pipe the production keys into the host's CLI without reading them, and the new `hostSetup` field holds the command for Vercel (with `host`, `label`, `shells`, and `command`), so an agent copies it verbatim from the field instead of out of the sentence. On macOS and Linux, that command and each `oauth.setup` command start with `clerk` only when the `clerk` on PATH resolves to the running binary itself, and otherwise with the running CLI's quoted absolute path (an npm or bun global install puts npm's launcher script on PATH, so it gets the binary's path), so they work when the CLI was started with `npx`. On Windows they keep `clerk`. `hostSetup` is `[]` in every other state. + - `clerk env pull --print` prints `KEY=value` lines to stdout instead of writing an env file, for sending production keys to a hosting provider. It fails without printing anything when Clerk returns no secret key. For an unclaimed accountless app, whose keys exist only on this machine, it prints the secret key alone, with a warning, when no publishable key is found locally. + - `clerk config patch` and `clerk config put` print `[REDACTED]` in place of the value of any key whose name contains `secret` or `private_key` (in any case), in the diff they show before writing and in the response they print after (dry runs included). Values under other keys are printed as before. Both refuse a payload that still holds `[REDACTED]` under such a key, naming each field, so their own output can't be saved over a real secret. Error bodies logged under `--verbose` are not redacted. + - `clerk config patch` and `clerk config put` refuse a payload that still holds an `oauth.setup` placeholder (`` under `client_secret`), naming each such field, and `clerk deploy status` no longer counts such a value as a saved credential. + +- `clerk doctor` checks an iOS or macOS app's Release build against the production instance: that Release's Bundle ID is registered there with Native API enabled, that its entitlements list the production Associated Domain, and that it configures Clerk with the production publishable key when the key is loaded in a way that can be read without building (otherwise it reports the key as not verified). Without a production instance this is a single note. Run in an Xcode project, `clerk deploy` and `clerk deploy status` now point to `clerk doctor` for this check. ([#548](https://github.com/clerk/cli/pull/548)) by [@seanperez29](https://github.com/seanperez29) + +- Create a new iOS or macOS app with `clerk init --starter`: pick iOS (SwiftUI) or macOS (SwiftUI) on a Mac with Xcode, and init writes a SwiftUI Xcode project, then sets up Clerk, the sign-in screen, and native registration. Use `--framework ios` or `--framework macos` with `--name`, `--bundle-id`, and the new `--team-id` to skip the prompts. ([#547](https://github.com/clerk/cli/pull/547)) by [@seanperez29](https://github.com/seanperez29) + +- Add `clerk migrate export clerk` and `clerk migrate export supabase`, and let `clerk migrate import` take the export's run ID in place of a file and `--source`. `clerk migrate` is still experimental and needs `CLERK_EXPERIMENTAL=migrate`. ([#524](https://github.com/clerk/cli/pull/524)) by [@royanger](https://github.com/royanger) + +- Add `clerk migrate runs` and `clerk migrate undo`, and let a re-run of `clerk migrate import` continue where a stopped one left off. `clerk migrate` is still experimental and needs `CLERK_EXPERIMENTAL=migrate`. ([#515](https://github.com/clerk/cli/pull/515)) by [@royanger](https://github.com/royanger) + + Every user an import creates now carries `clerkMigrateRun` (the run's ID) in its `private_metadata`, replacing any value the source had under that key. A re-run reads it to adopt a user whose create was cut off. Nothing removes it afterwards, and your backend can read it. + +### Patch Changes + +- Wrap the sign-in and sign-up pages that `clerk init` creates for Next.js App Router apps in ``, so they no longer fail `next build` when Cache Components is enabled, as it is in new `create-next-app` projects. ([#560](https://github.com/clerk/cli/pull/560)) by [@manovotny](https://github.com/manovotny) + +- Wrap the auth header that `clerk init --starter` adds to Next.js App Router layouts in ``, so new apps no longer fail `next build` when Cache Components is enabled, as it is in new `create-next-app` projects. ([#567](https://github.com/clerk/cli/pull/567)) by [@manovotny](https://github.com/manovotny) + +- Print plain text without terminal color codes in agent mode, so AI agents no longer see escape sequences in command output when they run without `--json`. Pass `--mode human` or set `CLERK_MODE=human` to keep colors. Status messages now also honor `NO_COLOR`. ([#534](https://github.com/clerk/cli/pull/534)) by [@royanger](https://github.com/royanger) + ## 4.0.0 ### Major Changes diff --git a/packages/cli/package.json b/packages/cli/package.json index bef0f69aab..fbed4f8562 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "clerk", - "version": "4.0.0", + "version": "4.1.0", "private": true, "description": "The official Clerk CLI. Add authentication to your app with npx -y clerk@latest init (Next.js, React Router, Astro, Nuxt, TanStack Start, Expo, and more). No Clerk account needed to start. Manage users, instances, keys, and deploys from the terminal or a coding agent.", "keywords": [