refactor(auth): adopt cli-core 0.16 keyring TokenStore

[scottlovegrove]

Summary

What gets deleted

• src/lib/secure-store.ts — replaced by cli-core's createSecureStore / SecureStoreUnavailableError
• The multi-account write path inside src/lib/auth.ts (upsertUser, clearApiToken, removeUserById, setDefaultUserId, loadTokenForStoredUser, ensureV2Shape, stripLegacyAuthFields, buildFallbackWarning, buildConfigCleanupWarning) — cli-core's createKeyringTokenStore owns this surface now
• src/lib/auth.ts resolveLegacyToken + clearLegacyToken — the v1 fallback for unmigrated installs (see "Behavioural changes" below)
• src/commands/auth/token-view.ts — replaced by cli-core's attachTokenViewCommand
• Unused users.ts exports (getDefaultUser, getEffectiveDefaultUser, FindUserResult, UserRef)
• ~14 paranoid / cli-core-covered tests across auth.test.ts, auth-store.test.ts (whole file), user-records.test.ts, migrate-auth.test.ts, and commands/auth/auth.test.ts (token-view + legacy-fallback cases)

What gets added

• src/lib/user-records.ts — UserRecordStore<TodoistAccount> adapter cli-core's createKeyringTokenStore reads/writes through. REPLACE-not-merge upsert; every write runs through ensureV2 (stamps config_version, strips legacy fields). Array manipulation delegates to users.ts.
• src/lib/migrate-auth.ts rewrite — thin wrapper around cli-core's migrateLegacyAuth supplying the Todoist-specific callbacks (/api/v1/user identifyAccount, loadLegacyPlaintextToken, cleanupLegacyConfig). One-way gate is config.config_version === CONFIG_VERSION, which survives logout so a reinstall over a logged-out v2 install can't re-migrate a stale legacy slot.
• src/commands/auth/store-wrap.ts (withUserRefAware) — shared wrap that substitutes getRequestedUserRef() into active/clear and turns ref-misses into UserNotFoundError. Used by both auth logout and auth token view because index.ts strips --user from argv before commander runs.
• src/lib/config.ts stripLegacyAuthFields — single source of truth for the v1 fields scrubbed on every v2 write.
• Adapter-level tests in user-records.test.ts (REPLACE-not-merge, ensureV2, default-pointer cleanup on remove) and migrate-auth.test.ts (the consumer callbacks + toLocalResult translation).

Behavioural changes

• Dropped the v1 read + clear fallback. A user on an unmigrated v1 install whose postinstall never ran (offline first-run only) now has to run td auth login again instead of staying authenticated. Acceptable one-time UX cost — anyone who's seen ≥ one release with postinstall migration is already on v2.
• td auth token no longer prints "Updated stored token for ..." vs "Saved token for ...". cli-core's TokenStore.set is void, so the verb distinction is dropped. Always prints "Saved token for <email>".
• td user use no-such-user exits with ACCOUNT_NOT_FOUND (cli-core's code) instead of USER_NOT_FOUND. Same UX; different code string.

File map

File	Status	Role
src/lib/secure-store.ts	deleted	replaced by @doist/cli-core/auth.createSecureStore
src/commands/auth/token-view.ts	deleted	replaced by @doist/cli-core/auth.attachTokenViewCommand
src/lib/auth.ts	gutted (320 → ~165 LOC)	read-side only: resolveActiveUser, getApiToken, probeApiToken, getAuthMetadata, listStoredUsers, NoTokenError
src/lib/auth-store.ts	rewritten	createTodoistTokenStore() + shared SERVICE_NAME / LEGACY_ACCOUNT / accountForUser constants + toTodoistAccount
src/lib/migrate-auth.ts	rewritten	cli-core wrapper
src/lib/user-records.ts	new	UserRecordStore<TodoistAccount> adapter
src/commands/auth/store-wrap.ts	new	shared --user injection wrap
src/commands/auth/logout.ts	rewritten	wraps the store with withUserRefAware
src/lib/users.ts	slimmed	drops 4 unused exports
src/commands/user/{use,remove}.ts	slimmed	route directly through the store
CODEBASE.md	updated	auth-storage section rewritten

Test plan

• npm run type-check, npm test (1564/1564), npm run check — all clean
• Manual smoke on Linux with libsecret available: td auth login writes to user-<id> keyring slot, td auth logout removes it
• Manual smoke on WSL without D-Bus: fallback warning on stderr, users[0].api_token set in config
• Manual smoke v1 → v2 migration: hand-craft a v1 config ({ "api_token": "...", "auth_mode": "read-write" }), confirm postinstall migrates it and sets config_version: 2
• Manual smoke td auth logout --user <ref>: ensure the explicit ref is honoured (regression covered by the review fixup)

🤖 Generated with Claude Code

[doistbot]

This PR effectively transitions the CLI's auth and token storage to the new @doist/cli-core primitives, drastically reducing local boilerplate and centralizing our keyring interactions. The architectural simplification is a great improvement for long-term maintainability, cleanly aligning our storage mechanisms with the core library. A few adjustments are needed to finalize the implementation, including restoring user-specific targeting and legacy cleanup during logout, resolving some logic duplication around user records and account shapes, filling test coverage gaps for the new adapter, and updating the codebase documentation to reflect the structural changes.

_{Share Feedback • Review Logs}

[scottlovegrove]

@doistbot /review

[doistbot]

This update successfully transitions our authentication setup to the new @doist/cli-core keyring primitives, replacing complex local implementations with a much cleaner adapter pattern. Shrinking this custom auth surface significantly improves long-term maintainability and standardizes our credential management. There are just a few details to refine before merging, primarily around preserving the environment variable short-circuit, avoiding crashes from offline keyring checks, safely wrapping the store instance without losing prototype methods, consolidating user-reference matching, and expanding test coverage to capture JSON outputs, migration gates, and specific flag interactions.

_{Share Feedback • Review Logs}