fix(types): resolve 4 tsgo errors in cli

- config-command-factory: the validations array literal triggers TS's
  discriminated-union inference because the first object has no nook
  field and the second one does. spec.validate() output then fails to
  append because it carries a pass field that neither variant accepts.
  Fix: declare an explicit Validation type so the array widens to
  checkCommandInput's full param shape.

- transport-http (x3): AuthenticatedRequest declared its auth as
  AuthInfo|undefined while the MCP transport expects AuthInfo with
  the ?: alone carrying may-be-missing semantics. Under
  exactOptionalPropertyTypes the explicit |undefined is stricter
  than the upstream signature. Drop the union.

All four errors were pre-existing; surfaced during the utils → util
rename pass.

Author: jdalton

packages/cli/src/commands/config/config-command-factory.mts

@@ -94,8 +94,18 @@ ${spec.helpExamples.map(ex => `      $ ${command} ${ex}`).join('\n')}
       const value = rest.join(' ')
       const outputKind = getOutputKind(json, markdown)
 
-      // Build validation checks.
-      const validations = [
+      // Build validation checks. The shape matches `checkCommandInput`'s
+      // param exactly so spec.validate() output (which may include
+      // `pass?`) appends cleanly without the inferred discriminated-union
+      // narrowing kicking in.
+      type Validation = {
+        test: boolean
+        message: string
+        fail: string
+        nook?: boolean | undefined
+        pass?: string | undefined
+      }
+      const validations: Validation[] = [
         {
           test: key === 'test' || isSupportedConfigKey(key),
           message: 'Config key should be the first arg',

packages/cli/src/commands/mcp/transport-http.mts

@@ -33,7 +33,12 @@ const logger = getDefaultLogger()
 const SESSION_TTL_MS = 30 * 60 * 1000
 const SESSION_REAP_INTERVAL_MS = 60_000
 
-type AuthenticatedRequest = IncomingMessage & { auth?: AuthInfo | undefined }
+// `auth?: AuthInfo` (NOT `AuthInfo | undefined`) matches the MCP
+// transport's `IncomingMessage & { auth?: AuthInfo }` parameter type.
+// Adding `| undefined` here would make the property explicitly-undefinable,
+// which trips exactOptionalPropertyTypes when handing the request to
+// transport.handleRequest().
+type AuthenticatedRequest = IncomingMessage & { auth?: AuthInfo }
 
 interface Session {
   lastActivity: number