Bccorb · Oct 17, 2026 · Oct 13, 2026
diff --git a/.changeset/core-jsonwebtoken-types.md b/.changeset/core-jsonwebtoken-types.md
diff --git a/.changeset/express-nodenext-declarations.md b/.changeset/express-nodenext-declarations.md
diff --git a/.changeset/express-request-types.md b/.changeset/express-request-types.md
diff --git a/.changeset/fastify-nodenext-declarations.md b/.changeset/fastify-nodenext-declarations.md
diff --git a/.changeset/fastify-request-types.md b/.changeset/fastify-request-types.md
diff --git a/.changeset/nextjs-nodenext-declarations.md b/.changeset/nextjs-nodenext-declarations.md
diff --git a/.changeset/seamless-service-token-env.md b/.changeset/seamless-service-token-env.md
diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @seamless-auth/core
 
+## 0.20.1
+
+### Patch Changes
+
+- 8ff942d: Depend on `@types/jsonwebtoken` at runtime instead of as a dev dependency. The published declarations import `JwtPayload` from `jsonwebtoken` (for example in `verifyCookieJwt`), so consumers without their own copy got `TS7016` under `skipLibCheck: false` and an `any` payload type otherwise.
+
 ## 0.20.0
 
 ### Minor Changes

diff --git a/packages/core/package.json b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@seamless-auth/core",
-    "version": "0.20.0",
+    "version": "0.20.1",
     "description": "Framework-agnostic core authentication logic for SeamlessAuth",
     "keywords": [
         "authentication",

diff --git a/packages/express/CHANGELOG.md b/packages/express/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @seamless-auth/express
 
+## 0.20.1
+
+### Patch Changes
+
+- 8ff942d: Publish declarations that resolve under `moduleResolution: "NodeNext"` and `"Node16"`. Relative imports in the shipped `.d.ts` files now carry explicit `.js` extensions. Consumers on NodeNext previously could not resolve them, so the exported functions typed as `any` (hidden by `skipLibCheck`). Runtime output is unchanged.
+- f0d50f7: Ship the `Express.Request` augmentation. `req.user` (set by `requireAuth`) and `req.cookiePayload` (set by `createEnsureCookiesMiddleware`) now typecheck in a consumer that imports the package, without declaring the augmentation itself. It previously lived in an ambient `.d.ts` that tsc never copied into `dist`.
+- dd5c0e5: The README examples read the service secret from `SEAMLESS_SERVICE_TOKEN` instead of `SERVICE_SECRET`. The auth server still reads `API_SERVICE_TOKEN`; both hold the same value. The adapters read no environment variables, so nothing changes at runtime.
+- Updated dependencies [8ff942d]
+  - @seamless-auth/core@0.20.1
+
 ## 0.20.0
 
 ### Minor Changes

diff --git a/packages/express/package.json b/packages/express/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/express",
-  "version": "0.20.0",
+  "version": "0.20.1",
   "description": "Express adapter for Seamless Auth passwordless authentication",
   "keywords": [
     "authentication",

diff --git a/packages/fastify/CHANGELOG.md b/packages/fastify/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @seamless-auth/fastify
 
+## 0.11.2
+
+### Patch Changes
+
+- 8ff942d: Publish declarations that resolve under `moduleResolution: "NodeNext"` and `"Node16"`. Relative imports in the shipped `.d.ts` files now carry explicit `.js` extensions. Consumers on NodeNext previously could not resolve them, so the exported functions typed as `any` (hidden by `skipLibCheck`). Runtime output is unchanged.
+- f0d50f7: Load the `FastifyRequest` augmentation (`request.user`, `request.cookiePayload`) from the package entry through an import that resolves under `moduleResolution: "NodeNext"`. Consumers on NodeNext previously lost it because the entry reached it only through an extensionless relative import.
+- dd5c0e5: The README examples read the service secret from `SEAMLESS_SERVICE_TOKEN` instead of `SERVICE_SECRET`. The auth server still reads `API_SERVICE_TOKEN`; both hold the same value. The adapters read no environment variables, so nothing changes at runtime.
+- Updated dependencies [8ff942d]
+  - @seamless-auth/core@0.20.1
+
 ## 0.11.1
 
 ### Patch Changes

diff --git a/packages/fastify/package.json b/packages/fastify/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/fastify",
-  "version": "0.11.1",
+  "version": "0.11.2",
   "description": "Fastify adapter for Seamless Auth passwordless authentication",
   "keywords": [
     "authentication",

diff --git a/packages/nextjs/CHANGELOG.md b/packages/nextjs/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @seamless-auth/nextjs
 
+## 0.4.1
+
+### Patch Changes
+
+- 8ff942d: Publish declarations that resolve under `moduleResolution: "NodeNext"` and `"Node16"`. Relative imports in the shipped `.d.ts` files now carry explicit `.js` extensions. Consumers on NodeNext previously could not resolve them, so the exported functions typed as `any` (hidden by `skipLibCheck`). Runtime output is unchanged.
+- dd5c0e5: The README examples read the service secret from `SEAMLESS_SERVICE_TOKEN` instead of `SERVICE_SECRET`. The auth server still reads `API_SERVICE_TOKEN`; both hold the same value. The adapters read no environment variables, so nothing changes at runtime.
+- Updated dependencies [8ff942d]
+  - @seamless-auth/core@0.20.1
+
 ## 0.4.0
 
 ### Minor Changes

diff --git a/packages/nextjs/package.json b/packages/nextjs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/nextjs",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Next.js App Router adapter for Seamless Auth passwordless authentication",
   "keywords": [
     "authentication",