0.5.0 requires an unpublished adapter: magic-link POST needs @seamless-auth/express 0.9.0

[Bccorb]

Summary

The pending 0.5.0 release requires an adapter that does not exist on npm yet. If 0.5.0 ships, or is tested, against the current published adapter, magic-link login returns 404.

The mismatch

• main carries fix(client)!: request magic links over POST (02c99f3, closes requestMagicLink must use POST after the express adapter drops GET /magic-link #93). requestMagicLink() now calls POST /auth/magic-link, and the changeset states it requires @seamless-auth/express 0.9.0 or later.
• The adapter change that serves the POST route is fix(express)!: ... drop GET state changes (seamless-auth-server PR fix(client)!: request OTP generation over POST #103), which is merged but not published.
• npm's latest @seamless-auth/express is 0.8.0, which still serves GET /magic-link and has no POST route.

So against any currently installable adapter, POST /auth/magic-link 404s and magic-link sign-in is broken.

Impact

• Blocks the 0.5.0 release: publishing the SDK before the adapter leaves every adopter's magic-link flow broken until they can install an adapter that does not exist yet.
• Blocks end-to-end testing: a local or CI run against 0.8.0 will show magic-link failing for a reason unrelated to the code under test.

What needs to happen

1. Publish @seamless-auth/express 0.9.0 (or whatever version includes PR fix(client)!: request OTP generation over POST #103) first, or at minimum in the same release window.
2. Only then publish @seamless-auth/react 0.5.0.
3. For local testing before the adapter is published, run against the adapter's #103 branch rather than 0.8.0.

Broader point

This is the second SDK change in this cycle to hard-depend on a specific adapter version (the WebAuthn casing coupling was the first). It is worth documenting the SDK-to-adapter version compatibility somewhere adopters can see it, for example a compatibility table in the README or RELEASES.md, so a version skew surfaces as a documented requirement rather than a 404.

Related

• requestMagicLink must use POST after the express adapter drops GET /magic-link #93 (SDK POST change, closed)
• seamless-auth-server#103 (adapter POST route, merged, unpublished)

[Bccorb]

Related: #101 tracks the same adapter-version-lockstep concern for the OTP CSRF fix, since that change also spans the SDK and the Express adapter.