feat(auth): project safe credential output

[Windsor Nguyễn (windsornguyen)]

Note

Authorship: AI-assisted.

Summary

Project public auth results and safe errors without serializing private causes.

Public CLI activation follows in a later layer. Hosted authentication requires a compatible server deployment.

Changes

• src/auth/output-errors.ts
• src/auth/output.ts
• tests/auth/command-fixtures.ts
• tests/auth/commands-errors.test.ts
• tests/auth/output.test.ts

Verification

Verified at 41ec1f1d582dac51ae2c524084f19d38ccab5b03 against its immediate parent.

• All four type-check scopes and the source build passed.
• All 111 discovered TypeScript and native-JavaScript tests passed.
• The macOS native keyring test wrote, read, and deleted a disposable entry.
• Source/build public-content scans and the actual package archive check passed.
• The installed preview passed all 25 feedback tests.
• Frozen pnpm 10.34.5 installation passed.

Scope

Human-written additions + deletions: 477.

Depends on #95. Retains #60: valid automatic retry keys.

The layer keeps its boundary implementation and direct contract tests together. Command activation and unrelated integrations remain separate.

Review focus

Credential rejection must stop its selected path. Keep token persistence, revocation, safe output, and caller identity consistent with the tested contract.

Documentation

Authentication contract at this head.

Reviewers

• Primary: AgentWings
• Domain: annyzhou