refactor(cli): cover gen bearer-jwt with effect lint (CLI-2410)

[7ttp]

TL;DR

brings the supabase gen bearer-jwt command under the effect lint

whats introduced?

effect lint applied to gen bearer-jwt:

• one allow list entry in .oxlintrc.effect.json, !apps/cli/src/commands/gen/bearer-jwt/**, covering all ten files
• the handler and signing key resolver yield their tagged errors directly instead of wrapping them in Effect.fail
• the try/catch blocks around the prompted JWK and the algorithm check become Effect.try, and the prompted text still parses natively so the parser's own message reaches failed to parse JWK
• the expiry parser builds its date through DateTime and the handler reads the clock through Clock, the same instants the command has always signed
• integration tests write their fixtures through FileSystem and Path instead of node:fs/promises, and cause assertions use Cause.pretty

ref:

• related: CLI-2410

[github-actions]

🤖 AI Review

The production changes appear behavior-preserving on code inspection. The merged reviews identify one confirmed test-coverage regression and one minor style inconsistency. The request for a comment on the JSON parser wrapper is refuted by the surrounding code and trusted comment convention. Tests were not run because dependencies are not installed.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	apps/cli/src/commands/gen/bearer-jwt/bearer-jwt.integration.test.ts:135	test-coverage	claude+codex	The command-wiring test uses a locally constructed gen command, so it can pass even if bearer-jwt is removed or miswired in the production genCommand.
⚪ NIT	apps/cli/src/commands/gen/bearer-jwt/bearer-jwt.integration.test.ts:1227	consistency	claude	The test mixes string-template paths for nested and telemetry directories with Path.Path joins in its file-writing helper.

Refuted findings (kept for transparency, not posted as review comments)

• apps/cli/src/commands/gen/bearer-jwt/bearer-jwt.signing-key.ts:85 (code-quality): The one-line parseJwkInput wrapper needs a comment explaining why it uses native JSON.parse.
  Refuted: The call and error mapping at lines 101-106 show why the native parser error is retained, and lines 131-135 explain the relevant JSON.parse behavior. trusted/CLAUDE.md:98-100 says to skip JSDoc on self-explanatory internal helpers.

Stats

Claude findings: 3 · Codex findings: 1 · Confirmed: 2 · Refuted: 1 · Uncertain: 0

---

Models: claude-opus-5-5 + gpt-6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

[Coly010]

Really nice cleanup - the expiry parser rewrite especially. I ran the old and new parseBearerJwtExp side by side over ~97k inputs (leap seconds, out of range offsets, fractional seconds, junk) and got zero mismatches, and every message, tag and exit code comes out the same. Lint covers all ten files with no findings too

Approving so you're not blocked, just one small ask inline

One other thing if you have a minute: the description mentions the integration tests moving onto the stateful mock layers and picking up Exit.isFailure, but I don't think either happens in this diff (Exit.isFailure was already there on develop). Since the body ends up as the squash commit, might be worth trimming so nobody goes looking for it later