[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@seamless-auth/types@0.30.0

Minor Changes

• 9f1b524: Schemas for the v0.20 recovery and staged policy work in seamless-auth-api.

  • Recovery codes: RecoveryCodeSchema, RecoveryCodesStatusSchema, RecoveryCodesGeneratedSchema, RecoveryCodeRedeemRequestSchema.
  • Self-service account recovery: AccountRecoveryStartRequestSchema, AccountRecoveryVerifyRequestSchema, AccountRecoveryStatusSchema, AccountRecoveryCancelRequestSchema and friends.
  • RecoverySessionResponseSchema for the restricted session a recovery issues (recovery: true, nextStep: 'enroll_passkey'). Session responses gain an optional recovery flag.
  • Staged policy: POLICY_KEYS, PolicyDocumentSchema, PolicyVersionSchema, PolicyDraftSchema, PolicyStateResponseSchema, publish, rollback and versions schemas, and PolicyDryRunRequestSchema / PolicyDryRunResponseSchema.
  • System config gains recovery_codes (on by default) and account_recovery (off by default, 24h delay, 1h to 30d), both patchable. PublicSystemConfigResponseSchema gains optional recoveryCodes and accountRecovery.
  • New auth event types for recovery codes, account recovery, break-glass sign-in and policy changes.

  All additions are optional or defaulted, so existing payloads still parse.

• 96136fc: OAuth provider config holds the rules the auth server enforces since 0.19.4 (GHSA-qx82-28gf-w744), so the dashboard and CLI refuse a bad provider before the API does.

  • clientSecretEnv must be an env var name ending in _CLIENT_SECRET (new OAuthClientSecretEnvSchema).
  • authorizationUrl, tokenUrl, userInfoUrl and jwksUri must use http or https. z.url() alone accepted any scheme, including javascript:. The server still requires https in production.

  Breaking for a stored provider that names another env var or uses another scheme: it now fails OAuthProviderConfigSchema, as it already fails on API 0.19.4.