chore: merge main into next

CHANGELOG.md

@@ -1,3 +1,5 @@
+<<<<<<< HEAD
+=======
 ## [1.64.0](https://github.com/Doist/todoist-cli/compare/v1.63.2...v1.64.0) (2026-05-15)
 
 ### Features
@@ -16,6 +18,7 @@
 
 * forward arrayBuffer on tracked-fetch wrapper for binary attachments ([#338](https://github.com/Doist/todoist-cli/issues/338)) ([8ca5598](https://github.com/Doist/todoist-cli/commit/8ca559855c0e4d8cfa7f8ede1f6c89324f008f8d))
 
+>>>>>>> origin/main
 ## [1.63.0](https://github.com/Doist/todoist-cli/compare/v1.62.2...v1.63.0) (2026-05-12)
 
 ### Features

CODEBASE.md

@@ -124,6 +124,18 @@ New subcommand? Copy a sibling in the target group, wire it in that group's
 - **`auth-flags.ts`** — `buildReloginCommand()` (rebuilds `td auth login`
   with `--read-only` / `--additional-scopes=...` preserved)
 - **`config.ts`** — `~/.config/todoist-cli/config.json` read/write,
+<<<<<<< HEAD
+  `AuthMode`, `UpdateChannel`, `AUTH_FLAG_ORDER`
+- **`secure-store.ts`** — `@napi-rs/keyring` wrapper (OS credential manager)
+- **`auth-provider.ts`** — `createTodoistAuthProvider()`: `@doist/cli-core`
+  PKCE `AuthProvider` adapter with a Todoist-specific `validateToken`
+  (calls `getUser`, builds `auth_mode` / `auth_scope` / `auth_flags`)
+- **`auth-store.ts`** — `createTodoistTokenStore()`: cli-core
+  `TokenStore<TodoistAccount>` adapter over `auth.ts`'s multi-user primitives.
+  Also exports `toTodoistAccount` / `accountToUpsertInput` mappers (shared
+  account shape) and `getLastStorageResult()` for surfacing keyring-fallback
+  warnings after `set()`.
+=======
   `stripLegacyAuthFields`, `AuthMode`, `UpdateChannel`, `AUTH_FLAG_ORDER`.
 - **`auth-provider.ts`** — `createTodoistAuthProvider()`: cli-core PKCE
   provider with Todoist `validateToken` (builds `auth_mode` / `auth_scope` /
@@ -136,6 +148,7 @@ New subcommand? Copy a sibling in the target group, wire it in that group's
   the config file. REPLACE-not-merge `upsert`; `ensureV2` on every write.
 - **`migrate-auth.ts`** — postinstall v1 → v2 migration; thin wrapper
   around cli-core's `migrateLegacyAuth` with the Todoist callbacks.
+>>>>>>> origin/main
 - **`auth-html.ts`** — branded HTML pages for the cli-core OAuth callback
   (`renderAuthSuccessPage` / `renderAuthErrorPage`)
 - **`oauth-scopes.ts`** — opt-in OAuth scope registry, `parseScopesOption`,
@@ -167,10 +180,13 @@ New subcommand? Copy a sibling in the target group, wire it in that group's
 - **`permissions.ts`** — collaborator permission parsing
 - **`help-center.ts`** — Help Center article search/fetch
 - **`progress.ts`** — `--progress-jsonl` JSONL event writer
+<<<<<<< HEAD
+=======
 - **`local-file.ts`** — `openLocalFileAsBlob()`: file-backed `Blob` for
   multipart uploads (used by `comment add --file`, `template create
 --file`, `template import-file`). Maps fs errors to `FILE_NOT_FOUND` /
   `FILE_READ_ERROR` CliErrors.
+>>>>>>> origin/main
 - **`usage-tracking.ts`** — request/session metadata headers, CLI command
   attribution, tracked fetch wrappers
 - **`browser.ts` / `stdin.ts` / `update.ts`** — small single-purpose helpers
@@ -219,6 +235,17 @@ env `TODOIST_API_TOKEN` first, then a config-derived target user, then either
 `StoredUser.api_token` (plaintext keyring-offline fallback) or cli-core's
 `createSecureStore` for the keyring slot.
 
+<<<<<<< HEAD
+`td auth login` runs through `@doist/cli-core`'s OAuth runtime
+(`attachLoginCommand` → `runOAuthFlow`). The Todoist-local pieces live in
+`src/lib/auth-provider.ts` (PKCE provider + `validateToken`) and
+`src/lib/auth-store.ts` (multi-user `TokenStore` adapter); the command is
+attached in `src/commands/auth/login.ts`. cli-core wires the standard flags
+(`--read-only`, `--callback-port`, `--json`, `--ndjson`) and binds the local
+callback server on port `8765` with a small fallback range. Scopes are
+opt-in: `--read-only` for a read-only token,
+`--additional-scopes=app-management,backups` to broaden.
+=======
 Write/clear/list all route through `createTodoistTokenStore()`; commands never
 write the config directly. `auth logout` and `auth token view` use
 `withUserRefAware` (`commands/auth/store-wrap.ts`) to substitute the
@@ -228,6 +255,7 @@ v1 → v2 migration (`migrate-auth.ts` → cli-core's `migrateLegacyAuth`) runs
 from `postinstall.ts`. Gate is `config.config_version === CONFIG_VERSION`,
 which survives logout so a reinstall over a logged-out v2 install can't
 re-migrate a stale legacy slot.
+>>>>>>> origin/main
 
 ## Testing