From 70e1b4b61e9b36c057a67e5309aa8a5bf008784d Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 7 Sep 2026 22:01:56 +0000
Subject: [PATCH] Version Packages

---
 .changeset/quiet-otters-return.md | 28 ----------------------------
 CHANGELOG.md                      | 29 +++++++++++++++++++++++++++++
 package.json                      |  2 +-
 3 files changed, 30 insertions(+), 29 deletions(-)
 delete mode 100644 .changeset/quiet-otters-return.md

diff --git a/.changeset/quiet-otters-return.md b/.changeset/quiet-otters-return.md
deleted file mode 100644
index 45c8c6c..0000000
--- a/.changeset/quiet-otters-return.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-'@seamless-auth/types': minor
----
-
-Carry `returnTo` back out of the OAuth callback, and hold it to a scheme that can be a
-link destination.
-
-`StartOAuthLoginRequestSchema` has taken a `returnTo` since OAuth landed, and nothing ever
-gave it back. `seamless-auth-api` validated it against the configured origins and signed it
-into the state, and `seamless-auth-react` sent it, but no schema carried it to the end of the
-flow, so a client that asked to be returned somewhere had no way to learn where. It was a
-field that looked supported and did nothing.
-
-`OAuthLoginSuccessResponseSchema` now carries an optional `returnTo`. The API reads it back
-out of the signed state rather than from the callback request, so it is the value validated
-at `/start` and not one introduced at the end of the round trip. Absent when the caller asked
-for nothing, so a client falls through to its own default rather than treating absence as an
-error.
-
-Both `returnTo` fields move from `z.url()` to `RedirectTargetSchema`. `z.url()` accepts
-`javascript:alert(1)` and `data:text/html,...`, and a client navigates to whatever comes back
-out of this flow, so it is the same sink a magic link destination is. That is what
-`RedirectTargetSchema` was added for in 0.18.0, and the OAuth fields should have used it
-then.
-
-Additive for a consumer that ignores the new field. A caller that was somehow sending a
-`javascript:` or `data:` `returnTo` is now refused at the schema rather than later, which is
-the intended change.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 53c5651..a11691b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,34 @@
 # @seamless-auth/types
 
+## 0.20.0
+
+### Minor Changes
+
+- 9541d01: Carry `returnTo` back out of the OAuth callback, and hold it to a scheme that can be a
+  link destination.
+  
+  `StartOAuthLoginRequestSchema` has taken a `returnTo` since OAuth landed, and nothing ever
+  gave it back. `seamless-auth-api` validated it against the configured origins and signed it
+  into the state, and `seamless-auth-react` sent it, but no schema carried it to the end of the
+  flow, so a client that asked to be returned somewhere had no way to learn where. It was a
+  field that looked supported and did nothing.
+  
+  `OAuthLoginSuccessResponseSchema` now carries an optional `returnTo`. The API reads it back
+  out of the signed state rather than from the callback request, so it is the value validated
+  at `/start` and not one introduced at the end of the round trip. Absent when the caller asked
+  for nothing, so a client falls through to its own default rather than treating absence as an
+  error.
+  
+  Both `returnTo` fields move from `z.url()` to `RedirectTargetSchema`. `z.url()` accepts
+  `javascript:alert(1)` and `data:text/html,...`, and a client navigates to whatever comes back
+  out of this flow, so it is the same sink a magic link destination is. That is what
+  `RedirectTargetSchema` was added for in 0.18.0, and the OAuth fields should have used it
+  then.
+  
+  Additive for a consumer that ignores the new field. A caller that was somehow sending a
+  `javascript:` or `data:` `returnTo` is now refused at the schema rather than later, which is
+  the intended change.
+
 ## 0.19.0
 
 ### Minor Changes
diff --git a/package.json b/package.json
index b26cc63..c294525 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/types",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Shared TypeScript types and Zod schemas for SeamlessAuth.",
   "author": "Fells Code, LLC",
   "license": "AGPL-3.0-only",