feat(cli): add device authorization login

[miguel-heygen]

Summary

hyperframes auth login --device now supports attended SSH and remote-terminal sign-in without copying an API key or exposing a loopback callback. Plain browser login remains unchanged and remote/headless detection points users to the explicit device command instead of switching authentication modes silently.

Security and persistence

• Device login refuses CI and non-TTY execution; unattended automation continues to use API keys or workload credentials.
• The CLI prints only the verification URI and human code, delays the first poll, honors authorization_pending / slow_down, and caps polling at 30 minutes.
• Device endpoint responses are size-bounded, timing fields are parsed strictly, and only HTTPS or loopback HTTP verification URLs are accepted.
• Newly minted tokens are verified against /v3/users/me before disk persistence and both access and refresh tokens are revoked on verification or write failure.
• Verified tokens and identity metadata land in one atomic credential-file rename while preserving co-located API keys and unknown fields owned by other CLI versions.

Test plan

• Focused auth suite — 51 passed
• CLI TypeScript typecheck — passed
• Repository lint and contract checks — passed

The comparative pre-commit analyzer could not allocate its temporary worktree because the host disk was full; its underlying lint/typecheck checks were run directly and passed.

End-to-end DEV certification is pending the unmerged EF endpoint and Pacific consent UI.

---

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
hyperframes	🟢 Ready	View Preview	Jul 28, 2026, 4:15 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
hyperframes	🟡 Building	–	Jul 28, 2026, 4:15 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.