From 04db099caa6e9fb5b70a63c05958af2dd114be44 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sun, 13 Sep 2026 02:56:51 +0000
Subject: [PATCH] Version Packages

---
 .changeset/flow-rate-limits.md | 21 ---------------------
 CHANGELOG.md                   | 22 ++++++++++++++++++++++
 package.json                   |  2 +-
 3 files changed, 23 insertions(+), 22 deletions(-)
 delete mode 100644 .changeset/flow-rate-limits.md

diff --git a/.changeset/flow-rate-limits.md b/.changeset/flow-rate-limits.md
deleted file mode 100644
index 09aadb9..0000000
--- a/.changeset/flow-rate-limits.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-'@seamless-auth/types': minor
----
-
-Add `flow_rate_limits` to the system config, and pin the Android WebAuthn origin form.
-
-`seamless-auth-api` limits how often one caller may start an OTP, magic link, or OAuth flow, on
-top of the general `rate_limit`, with constants fixed in code: 10 OTP sends and 20 magic links per
-IP per 15 minutes, 5 per address, 30 OAuth starts per IP and 10 per provider. Those are fine for a
-web audience and wrong for a mobile one, because carriers put thousands of subscribers behind one
-address. `flow_rate_limits` is an object key (`windowSeconds`, `otp.perIp`, `otp.perIdentity`,
-`magicLink.perIp`, `magicLink.perIdentity`, `oauth.perIp`, `oauth.perProvider`) whose defaults
-are exactly those constants, so a deployment that sets nothing behaves as it did, and a partial
-value fills the flows it leaves out. `FlowRateLimitsSchema`, `FlowRateLimits` and
-`DefaultFlowRateLimits` are exported; the patch schema accepts the key.
-
-`origins` gains a test and a comment for the form Android reports, `android:apk-key-hash:<base64url>`,
-which `z.url()` accepts as an opaque URL. It has to keep accepting it for native passkeys to
-verify, and nothing said so until now.
-
-Part of the mobile track, fells-code/seamless-templates#40.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9054aaf..d0ed5e2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,27 @@
 # @seamless-auth/types
 
+## 0.22.0
+
+### Minor Changes
+
+- c934d8f: Add `flow_rate_limits` to the system config, and pin the Android WebAuthn origin form.
+  
+  `seamless-auth-api` limits how often one caller may start an OTP, magic link, or OAuth flow, on
+  top of the general `rate_limit`, with constants fixed in code: 10 OTP sends and 20 magic links per
+  IP per 15 minutes, 5 per address, 30 OAuth starts per IP and 10 per provider. Those are fine for a
+  web audience and wrong for a mobile one, because carriers put thousands of subscribers behind one
+  address. `flow_rate_limits` is an object key (`windowSeconds`, `otp.perIp`, `otp.perIdentity`,
+  `magicLink.perIp`, `magicLink.perIdentity`, `oauth.perIp`, `oauth.perProvider`) whose defaults
+  are exactly those constants, so a deployment that sets nothing behaves as it did, and a partial
+  value fills the flows it leaves out. `FlowRateLimitsSchema`, `FlowRateLimits` and
+  `DefaultFlowRateLimits` are exported; the patch schema accepts the key.
+  
+  `origins` gains a test and a comment for the form Android reports, `android:apk-key-hash:<base64url>`,
+  which `z.url()` accepts as an opaque URL. It has to keep accepting it for native passkeys to
+  verify, and nothing said so until now.
+  
+  Part of the mobile track, fells-code/seamless-templates#40.
+
 ## 0.21.0
 
 ### Minor Changes
diff --git a/package.json b/package.json
index 5586ca2..029ec79 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/types",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "Shared TypeScript types and Zod schemas for SeamlessAuth.",
   "author": "Fells Code, LLC",
   "license": "AGPL-3.0-only",