From e78e8171746cb26144bc9728b7dbcf038745b38b Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sun, 13 Sep 2026 19:24:55 +0000
Subject: [PATCH] chore: update version and changelog

---
 .changeset/flow-rate-limits.md | 23 -----------------------
 CHANGELOG.md                   | 24 ++++++++++++++++++++++++
 package.json                   |  2 +-
 3 files changed, 25 insertions(+), 24 deletions(-)
 delete mode 100644 .changeset/flow-rate-limits.md

diff --git a/.changeset/flow-rate-limits.md b/.changeset/flow-rate-limits.md
deleted file mode 100644
index 9900b88..0000000
--- a/.changeset/flow-rate-limits.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-'seamless-auth-api': minor
----
-
-Read the per-flow rate limits from system config, and document what a native client needs.
-
-The OTP, magic link and OAuth limiters carried their values as constants: 10 OTP sends and 20
-magic links per IP per 15 minutes, 5 per address, 30 OAuth starts per IP and 10 per provider.
-Those suit a web audience and refuse a mobile one, because carriers put thousands of
-subscribers behind one IPv4 address. The six limiters now read `flow_rate_limits` from system
-config (`FLOW_RATE_LIMITS` from the environment on first boot), an object whose defaults are
-exactly those constants, so an instance that sets nothing behaves as it did. A changed limit
-applies on the next request; a changed `windowSeconds` builds a fresh limiter for that window.
-`perIdentity` values guard the address and rarely need changing; `perIp` values are what a
-deployment serving a native app raises.
-
-`@seamless-auth/types` moves to 0.22.0, which adds the key, and `openapi.json` and the generated
-types pick it up on the system config routes.
-
-Docs gain a "Native and mobile clients" section in `api-contract.md` (RP ID and origins for iOS
-and Android, magic link and OAuth destinations, the tenant-wide session lifetime, refresh reuse
-detection, authenticator policy), a "Flow rate limits" section in `configuration.md`, and the
-client SDK packages in `ecosystem.md`.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ebceb58..810e2a4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,29 @@
 # seamless-auth-api
 
+## 0.14.0
+
+### Minor Changes
+
+- 5bf51ca: Read the per-flow rate limits from system config, and document what a native client needs.
+
+  The OTP, magic link and OAuth limiters carried their values as constants: 10 OTP sends and 20
+  magic links per IP per 15 minutes, 5 per address, 30 OAuth starts per IP and 10 per provider.
+  Those suit a web audience and refuse a mobile one, because carriers put thousands of
+  subscribers behind one IPv4 address. The six limiters now read `flow_rate_limits` from system
+  config (`FLOW_RATE_LIMITS` from the environment on first boot), an object whose defaults are
+  exactly those constants, so an instance that sets nothing behaves as it did. A changed limit
+  applies on the next request; a changed `windowSeconds` builds a fresh limiter for that window.
+  `perIdentity` values guard the address and rarely need changing; `perIp` values are what a
+  deployment serving a native app raises.
+
+  `@seamless-auth/types` moves to 0.22.0, which adds the key, and `openapi.json` and the generated
+  types pick it up on the system config routes.
+
+  Docs gain a "Native and mobile clients" section in `api-contract.md` (RP ID and origins for iOS
+  and Android, magic link and OAuth destinations, the tenant-wide session lifetime, refresh reuse
+  detection, authenticator policy), a "Flow rate limits" section in `configuration.md`, and the
+  client SDK packages in `ecosystem.md`.
+
 ## 0.13.2
 
 ### Patch Changes
diff --git a/package.json b/package.json
index 37b2ec2..85a58d1 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "seamless-auth-api",
-  "version": "0.13.2",
+  "version": "0.14.0",
   "description": "Seamless Auth API - A web application server for supporting a Seamless Auth server instance.",
   "main": "index.js",
   "type": "module",