chore: update version and changelog

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

seamless-auth-api@0.3.0

Minor Changes

• fe78de9: Add admin routes to manage OAuth providers at runtime without hand-editing system_config or replacing the whole config array. New endpoints under the existing SystemConfig admin surface: GET /system-config/oauth-providers (list), POST /system-config/oauth-providers (add, 409 on duplicate id), PATCH /system-config/oauth-providers/:id (update, 404 on unknown id), and DELETE /system-config/oauth-providers/:id (remove, 404 on unknown id). Each route requires an admin access token (requireAdmin('read') for the list, requireAdmin('write') for mutations), validates against OAuthProviderConfigSchema, invalidates the system-config cache after writes, and records a system_config_updated audit event. Client secrets stay out of the API surface: providers continue to reference clientSecretEnv and the routes never accept or return a raw secret. Providers remain editable through the existing PATCH /system-config/admin whole-array patch, so this is additive.
• 916a3b7: Require a validated internal service token for external delivery in all environments. canReturnExternalDelivery no longer treats a non-production NODE_ENV as sufficient, so the x-seamless-auth-delivery-mode: external header must now be accompanied by an x-seamless-service-token that passes issuer, audience, and subject validation. canReturnSensitiveDevelopmentDetails is gated the same way. Local development that cannot present a service token can set ALLOW_UNCREDENTIALED_DELIVERY_SECRETS=true, an explicit opt-in that is ignored when NODE_ENV=production.
• 0005244: Serve the admin dashboard SPA at the /console subpath on the API's own origin. Static serving is additive and gated behind SERVE_ADMIN_DASHBOARD (enabled by default): the admin API routes are registered first and keep priority, and an SPA history fallback returns the dashboard index.html for unmatched /console and /console/* navigations, with correct MIME types, long-lived immutable caching for hashed assets, and no-store on the shell. /console is used instead of /admin so the SPA namespace never overlaps the admin API under /admin/*. The Docker image builds the dashboard from a pinned git ref (the SEAMLESS_ADMIN_DASHBOARD_REF build ARG) with base path /console and copies it into the runtime image. No CORS changes are needed because the dashboard is same-origin.

Patch Changes

• 594df9b: Fix response schema handling so a controller response that fails its declared schema is no longer overwritten. Previously the API replaced the real body with a generic Response validation failed object and leaked internal Zod issues to clients. It now logs the drift server-side and returns the controller's intended response unchanged.
• ff8067d: Bind the aud claim on signed user tokens. signAccessToken, signRefreshToken, and signEphemeralToken now call .setAudience(ISSUER) in addition to .setIssuer(ISSUER). The Seamless adapter verifies signed auth responses with aud === audience, and the deployment contract requires the adopter's audience to equal its authServerUrl, which is byte-identical to this server's ISSUER. Without the claim, jose rejects every token the adapter checks, so login, registration, OAuth, OTP, magic-link, and organization-switch all fail once the adapter's audience binding ships. The claim is additive and ignored by verifiers that do not check it.