coreapi: use auth-go crossjuris for the cross-jurisdiction transport

[toothbrush]

https://entire.io/gh/entireio/cli/trails/1217

Why

The 421-follow + RFC 8693 exchange transport now lives in github.com/entireio/auth-go/crossjuris (entireio/auth-go#24), shared with entiredb and entire-ci. This deletes the CLI's copy. Linear: https://linear.app/entirehq/issue/COR-1441

What

• internal/coreapi/cross_juris_transport.go deleted (644 lines). newCrossJurisHTTPClient(coreURL) wires crossjuris.New with the existing User-Agent base chain, ClientID: entire-cli, and the ENTIRE_DEBUG-gated debugf as Logf.
• AllowInsecureHTTP is true only when the core URL is http loopback, so local dev keeps working and prod stays https-only.
• Mirror-request Location canonicalization stays CLI-side as an outer round tripper reading the replayed request from resp.Request.
• Tests: wiring-level cases kept, cache/TTL unit tests dropped (they live in auth-go now), one new test pins that an https core refuses an http 421 target.

Pinned to auth-go main after entireio/auth-go#24 merged (v0.5.3-0.20260902072340-78f4dc59700e, no tag planned).

Verification

go build ./..., go test -race ./internal/coreapi/..., golangci-lint run --new-from-rev=origin/main: clean. Output in the comment below.

🤖 Generated with Claude Code

---

Note

Medium Risk
Touches authentication transport for all control-plane API calls (421 redirects and token exchange), though behavior is intended to be equivalent after moving to the shared library; mis-wiring or AllowInsecureHTTP policy could affect JWT handling across regions.

Overview
Replaces the CLI’s ~644-line in-repo cross-jurisdiction transport with github.com/entireio/auth-go/crossjuris, bumping auth-go to a pinned pre-release commit until the shared library PR lands.

newCrossJurisHTTPClient(coreURL) now builds the control-plane HTTP client by stacking crossjuris.New (421 follow, RFC 8693 exchange, federation checks) on the existing User-Agent/base transport, with AllowInsecureHTTP only when the configured core is http loopback (local dev/tests). clientForTarget and NewWithBearer pass the core origin and propagate setup errors.

CLI-only behavior stays in a thin outer round tripper: mirrorLocationCanonicalizer rewrites Location on 202 from POST /api/v1/mirror-requests using the host that actually answered after a 421 follow.

Tests focus on wiring (redirect/exchange chains, off-origin rejection, User-Agent on every hop); cache/TTL unit tests were dropped in favor of auth-go, plus a new case that an https core refuses following a 421 to a plaintext loopback home.

^{Reviewed by Cursor Bugbot for commit 02abf21. Configure here.}

[toothbrush]

Verification (worktree, go1.26.6 darwin/arm64):

$ go build ./...
$ go test -race -count=1 ./internal/coreapi/...
ok  	github.com/entireio/cli/internal/coreapi	1.041s
$ golangci-lint run ./internal/coreapi/... --new-from-rev=origin/main
0 issues.

[Copilot]

🔵 Needs a closer look

It changes the core authentication transport used by all control-plane API calls and relies on behavior now residing in an external pre-release dependency, so it merits final human review despite the wiring/tests looking consistent.

Pull request overview

This PR migrates the CLI’s control-plane (coreapi) cross-jurisdiction HTTP transport (421 follow + RFC 8693 token exchange) from an in-repo implementation to the shared github.com/entireio/auth-go/crossjuris package, keeping CLI-specific behavior (mirror-request Location canonicalization and ENTIRE_DEBUG logging) in internal/coreapi.

Changes:

• Replace the deleted in-repo cross-juris transport with crossjuris.New(...), wiring it under the existing User-Agent/base transport and gating insecure HTTP only for http-loopback cores.
• Preserve CLI-only Location rewriting for POST /api/v1/mirror-requests by wrapping the shared transport with an outer round tripper that can inspect resp.Request.
• Update tests to focus on coreapi wiring/chain-shape and policy (dropping cache/TTL internals now owned by auth-go), and bump auth-go to a pinned pre-release pseudo-version.

File summaries

File	Description
internal/coreapi/cross_juris_transport.go	Deletes the previous in-repo cross-jurisdiction transport implementation.
internal/coreapi/cross_juris_client.go	Adds new transport wiring around auth-go/crossjuris plus CLI-specific Location canonicalization and debug logging.
internal/coreapi/client.go	Updates coreapi client construction to use the new newCrossJurisHTTPClient(coreURL) API and propagate setup errors.
internal/coreapi/cross_juris_client_test.go	Updates/adjusts tests to validate wiring behavior and adds a policy test ensuring https cores won’t follow plaintext 421 targets.
internal/coreapi/cross_juris_useragent_test.go	Updates constants and validates User-Agent stamping across all hops including crossjuris-synthesized requests.
go.mod	Bumps github.com/entireio/auth-go to the pinned pseudo-version containing crossjuris.
go.sum	Updates sums for the bumped auth-go version.

Review details

• Files reviewed: 6/7 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.