From 3c9222036cc0c5a5f8c450d571cd6db698db808e Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sun, 30 Aug 2026 12:39:03 +0000
Subject: [PATCH] Version Packages

---
 .changeset/brave-wolves-shout.md | 29 -----------------------------
 CHANGELOG.md                     | 30 ++++++++++++++++++++++++++++++
 package.json                     |  2 +-
 3 files changed, 31 insertions(+), 30 deletions(-)
 delete mode 100644 .changeset/brave-wolves-shout.md

diff --git a/.changeset/brave-wolves-shout.md b/.changeset/brave-wolves-shout.md
deleted file mode 100644
index 369d529..0000000
--- a/.changeset/brave-wolves-shout.md
+++ /dev/null
@@ -1,29 +0,0 @@
----
-'@seamless-auth/types': minor
----
-
-Let a deployment refuse synced passkeys and restrict authenticator models.
-
-`AuthenticatorPolicySchema` gains three fields:
-
-- `syncedPasskeys`, `allow` or `block`, **defaulting to `block`**
-- `aaguidAllowList`, empty by default
-- `aaguidDenyList`, empty by default
-
-**`syncedPasskeys` defaults to `block`, which is a behaviour change.** A
-multi-device credential is synced by a platform password manager, so its private
-key exists somewhere outside the authenticator that created it. That is what a
-consumer wants and what an organisation issuing its own authenticators does not,
-and this package now takes the stricter position by default. A deployment that
-wants platform passkeys sets `syncedPasskeys: 'allow'`.
-
-The judgement is made on backup eligibility rather than current backup state: a
-credential that _can_ leave the device is the exposure, whether or not it
-already has.
-
-The AAGUID lists restrict which authenticator models may register. They need
-`attestation: 'direct'` to mean anything, because an authenticator that was never
-asked to identify itself reports no usable AAGUID.
-
-The whole-object default for `authenticator_policy` is now derived from the field
-defaults rather than restated alongside them, so the two cannot drift.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f06272e..f3cdfed 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,35 @@
 # @seamless-auth/types
 
+## 0.15.0
+
+### Minor Changes
+
+- 0857223: Let a deployment refuse synced passkeys and restrict authenticator models.
+
+  `AuthenticatorPolicySchema` gains three fields:
+
+  - `syncedPasskeys`, `allow` or `block`, **defaulting to `block`**
+  - `aaguidAllowList`, empty by default
+  - `aaguidDenyList`, empty by default
+
+  **`syncedPasskeys` defaults to `block`, which is a behaviour change.** A
+  multi-device credential is synced by a platform password manager, so its private
+  key exists somewhere outside the authenticator that created it. That is what a
+  consumer wants and what an organisation issuing its own authenticators does not,
+  and this package now takes the stricter position by default. A deployment that
+  wants platform passkeys sets `syncedPasskeys: 'allow'`.
+
+  The judgement is made on backup eligibility rather than current backup state: a
+  credential that _can_ leave the device is the exposure, whether or not it
+  already has.
+
+  The AAGUID lists restrict which authenticator models may register. They need
+  `attestation: 'direct'` to mean anything, because an authenticator that was never
+  asked to identify itself reports no usable AAGUID.
+
+  The whole-object default for `authenticator_policy` is now derived from the field
+  defaults rather than restated alongside them, so the two cannot drift.
+
 ## 0.14.0
 
 ### Minor Changes
diff --git a/package.json b/package.json
index a1db5c4..b139a9d 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/types",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Shared TypeScript types and Zod schemas for SeamlessAuth.",
   "author": "Fells Code, LLC",
   "license": "AGPL-3.0-only",