Update @cipherstash/stack to @cipherstash/auth 0.41 (Result-returning API)

[coderdan]

Summary

@cipherstash/stack (and the stash CLI + @cipherstash/wizard) were pinned to @cipherstash/auth 0.40.0. Bump to 0.41.0 and migrate to its new API.

Breaking change in @cipherstash/auth 0.41

Every fallible auth operation now returns a @byteslice/result Result<T, AuthFailure> ({ data } on success, { failure } on error) instead of throwing. Affected surface:

• Strategy construction: AccessKeyStrategy.create, OidcFederationStrategy.create, AutoStrategy.detect, DeviceSessionStrategy.fromProfile
• getToken()
• Device-code flow: beginDeviceCodeFlow, DeviceCodeResult.pollForToken, DeviceCodeResult.openInBrowser, bindClientDevice

The AuthError type was renamed to AuthFailure — a discriminated union keyed by type ("NOT_AUTHENTICATED", "WORKSPACE_MISMATCH", …) that replaces the old error.code string. Consumers now branch on if (result.failure) / failure.type rather than try/catch.

Changes required

@cipherstash/stack (breaking type surface — minor)

• Public re-export AuthError → AuthFailure (packages/stack/src/index.ts)
• Unwrap the Result from AccessKeyStrategy.create in the WASM-inline resolveStrategy (packages/stack/src/wasm-inline.ts); a construction failure now throws a descriptive [encryption] error naming the AuthFailure.type

stash (CLI) (patch)

• stash auth login device-code flow + bindClientDevice (packages/cli/src/commands/auth/login.ts)
• init existing-auth check (packages/cli/src/commands/init/steps/authenticate.ts)

@cipherstash/wizard (patch)

• Gateway token acquisition (packages/wizard/src/agent/fetch-prompt.ts)
• Agent access-token helper (packages/wizard/src/agent/interface.ts)
• Credential prerequisite check — error.code → failure.type (packages/wizard/src/lib/prerequisites.ts)

Catalog + tests

• Bump @cipherstash/auth + 6 per-platform bindings 0.40.0 → 0.41.0 in pnpm-workspace.yaml and root package.json; update lockfile
• Update auth mocks/stubs to the Result shape (packages/stack/__tests__/wasm-inline-{strategy,new-client}.test.ts, helpers/stub-auth-wasm-inline.ts, packages/wizard/src/__tests__/prerequisites.test.ts)
• Changeset added (.changeset/stack-auth-0-41-result-api.md)

Verification

• turbo build green for @cipherstash/stack, stash, @cipherstash/wizard
• stash tests 334/334, @cipherstash/wizard 140/140, stack offline auth tests 40/40
• Remaining stack integration-test failures require a live ZeroKMS workspace profile (~/.cipherstash/...) and are unrelated to this change

Work is on branch chore/bump-auth-0.41.