feat(types)!: adopt @seamless-auth/types for the wire contract

[Bccorb]

Closes #115. Closes #116.

@seamless-auth/types 0.2.0 publishes the auth API's schemas, so the SDK's hand-written request and response types can stop being a parallel copy. Credential.lastUsedAt is the proof that the copy had already drifted: it was typed Date | null while the API serializes an ISO string, so adopter code calling .getTime() typechecked and then threw. That is #116, and it resolves here.

Decisions

Types-only. Imported with import type, so the package's Zod dependency never reaches the browser bundle. Verified: dist/index.js contains zero references to zod or the package. The one place that wanted a runtime import is the OAuth code list, which is now a compile-time Record<OAuthErrorCode, true> in src/client/errors.ts. It fails to build if the upstream union gains or loses a member, which is what the runtime Set was there to guard against.

The SDK keeps its own export names. Adopters still import Credential and User from @seamless-auth/react; those names are aliases now rather than declarations.

Session material stays unexposed. LoginStartResult and OrganizationSwitchResult Omit the token, subject, and session id the API returns, preserving the existing decision that sessions are carried by cookies and adopters never handle raw tokens. Aliasing them wholesale would have advertised token handling as part of the public API.

Breaking at the type level

No runtime behavior changes, but several types are now accurate, so adopter code that relied on the old ones will not compile:

• Credential.lastUsedAt is string | null | undefined, and createdAt is now present
• Credential.deviceType, friendlyName, platform, browser, and deviceInfo are optional
• User.phone is string | null, User.roles is required, and lastLogin is carried
• Organization timestamps are string rather than string | Date

Versioned as a minor per the 0.x convention in this repo, with a changeset spelling out each change and the new Date(...) workaround.

Verification

tests/wireTypes.test.ts pins these shapes at compile time, since npm run typecheck covers tests/. The @ts-expect-error guards are the real check: if lastUsedAt reverts to Date, the directive becomes unused and the build fails. I confirmed that mechanism fires rather than passing vacuously.

Left local, deliberately

The PRF helpers and SeamlessAuthResult are SDK concerns rather than wire contracts. Separately, five shapes have upstream schemas but no exported type alias (OAuthProvidersResponse, CredentialUpdateResponse, and the three organization envelope responses), so those stay declared here. Worth a follow-up on the types repo to export them.

Validation

npm run lint, npm run typecheck, npm run format:check, npm test -- --runInBand (268 passing across 31 suites), npm run build, and npm run check-npm-build all pass.

[Bccorb]

Filed the follow-up for the missing type aliases: fells-code/seamless-auth-types#10. Once those ship, OAuthProvidersResult, CredentialUpdateResult, and the three organization envelope results can drop their local declarations too.