Review follow-ups: retries, option validation, OAuth hardening, CI gates

.github/workflows/ci.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
 
 jobs:
   build-and-test:
@@ -24,5 +23,8 @@ jobs:
           cache: npm
 
       - run: npm ci
+      - run: npm run lint
+      - run: npm run format:check
+      - run: npm run typecheck
       - run: npm run build
       - run: npm test

.github/workflows/release.yml

@@ -23,12 +23,21 @@ jobs:
           cache: npm
 
       # Trusted publishing (OIDC) needs npm 11.5.1 or newer; Node 22 ships an older npm.
-      - run: npm install -g npm@latest
+      - run: npm install -g npm@11
       - run: npm --version
 
+      - name: Check that the tag matches package.json
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          version="$(node -p "require('./package.json').version")"
+          if [ "$tag" != "$version" ]; then
+            echo "Tag v$tag does not match package.json version $version" >&2
+            exit 1
+          fi
+
       - run: npm ci
+      - run: npm run check
       - run: npm run build
-      - run: npm test
 
       - name: Publish to npm
         run: npm publish --access public

.prettierignore

@@ -0,0 +1,5 @@
+build/
+coverage/
+node_modules/
+package-lock.json
+.claude/

.prettierrc

@@ -0,0 +1,4 @@
+{
+  "printWidth": 100,
+  "trailingComma": "es5"
+}

README.md

@@ -51,14 +51,14 @@ You can also create the config file manually if you already have a refresh token
 }
 ```
 
-| Field | Values | Notes |
-|---|---|---|
-| `clientId` | `amzn1.application-oa2-client.xxx` | From Amazon Ads API console |
-| `clientSecret` | string | From Amazon Ads API console |
-| `refreshToken` | `Atzr\|xxx` | Obtained via `auth login` or existing token |
-| `region` | `NA`, `EU`, `FE` | North America, Europe, Far East |
-| `sandbox` | `true` / `false` | Use the Amazon Ads test endpoint |
-| `defaultProfileId` | numeric string | Avoids needing `--profile` on every command |
+| Field              | Values                             | Notes                                       |
+| ------------------ | ---------------------------------- | ------------------------------------------- |
+| `clientId`         | `amzn1.application-oa2-client.xxx` | From Amazon Ads API console                 |
+| `clientSecret`     | string                             | From Amazon Ads API console                 |
+| `refreshToken`     | `Atzr\|xxx`                        | Obtained via `auth login` or existing token |
+| `region`           | `NA`, `EU`, `FE`                   | North America, Europe, Far East             |
+| `sandbox`          | `true` / `false`                   | Use the Amazon Ads test endpoint            |
+| `defaultProfileId` | numeric string                     | Avoids needing `--profile` on every command |
 
 Environment variables override the config file: `AMAZON_ADS_CLIENT_ID`, `AMAZON_ADS_CLIENT_SECRET`, `AMAZON_ADS_REFRESH_TOKEN`, `AMAZON_ADS_REGION`, `AMAZON_ADS_SANDBOX`, `AMAZON_ADS_PROFILE_ID`.
 
@@ -90,10 +90,10 @@ amazonads campaigns list --profile <id> --state enabled
 amazonads campaigns list --profile <id> --type sponsoredBrands
 amazonads campaigns list --profile <id> --json
 
-# Campaign performance report (async — may return a report ID if still processing)
+# Campaign performance (7-day attribution; waits for Amazon to build the report, --timeout <seconds> caps it)
 amazonads campaigns performance --profile <id> --campaign <id> --start 2024-01-01 --end 2024-01-31
 
-# Create a campaign (always created in PAUSED state)
+# Create a Sponsored Products campaign (always created in PAUSED state; --type sponsoredProducts only)
 amazonads campaigns create \
   --profile <id> \
   --name "My Campaign" \
@@ -166,6 +166,8 @@ npm run dev         # Run without building (hot-reloads on save)
 npm run build       # Compile TypeScript
 npm run watch       # Watch mode (compile only)
 npm run test        # Run tests
+npm run check       # Lint, format check, typecheck (including tests), and tests — what CI runs
+npm run format      # Format with prettier
 ```
 
 Pass CLI arguments after `--` when using `dev`:
@@ -174,7 +176,7 @@ Pass CLI arguments after `--` when using `dev`:
 npm run dev -- campaigns list --profile 1234567890
 ```
 
-Requires Node.js 18+.
+Requires Node.js 20+.
 
 ## Releasing
 

eslint.config.js

@@ -0,0 +1,16 @@
+import js from "@eslint/js";
+import tseslint from "typescript-eslint";
+
+export default tseslint.config(
+  { ignores: ["build/", "coverage/", "node_modules/", ".claude/"] },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    rules: {
+      "@typescript-eslint/no-unused-vars": [
+        "error",
+        { argsIgnorePattern: "^_", varsIgnorePattern: "^_", caughtErrors: "none" },
+      ],
+    },
+  }
+);