test(auth): verify session lifecycle invariants

[Windsor Nguyễn (windsornguyen)]

Note

Authorship: AI-assisted.

Summary

Verify offline status, identity binding, revocation, and cleanup failures.

Public CLI activation follows in a later layer. Hosted authentication requires a compatible server deployment.

Changes

• src/auth/README.md
• tests/auth/workflow-access.test.ts
• tests/auth/workflow-logout.test.ts

Verification

Verified at 15020c88088bce1460b6b704567ecfe7b21b0483 against its immediate parent.

• All four type-check scopes and the source build passed.
• All 63 discovered TypeScript and native-JavaScript tests passed.
• The macOS native keyring test wrote, read, and deleted a disposable entry.
• Source/build public-content scans and the actual package archive check passed.
• The installed preview passed all 25 feedback tests.
• Frozen pnpm 10.34.5 installation passed.

Scope

Human-written additions + deletions: 249.

Depends on #86. Retains #60: valid automatic retry keys.

The layer keeps its boundary implementation and direct contract tests together. Command activation and unrelated integrations remain separate.

Review focus

Credential rejection must stop its selected path. Keep token persistence, revocation, safe output, and caller identity consistent with the tested contract.

Documentation

Authentication contract at this head.

Reviewers

• Primary: AgentWings
• Domain: annyzhou