[object Object]

← back to Cli Printing Press

fix(cli): gofmt rendered .go output in generator emit phase (#1100)

1ca94b91e8ff917a24f996a7d89aaa89dd1a27d6 · 2026-05-11 12:26:56 -0700 · Trevin Chow

* fix(cli): gofmt rendered .go output in generator emit phase

Printed CLIs were shipping formatting-dirty: hand-aligned struct
literals and unsorted imports in templates surfaced as hundreds of
phantom diffs the first time anyone ran `gofmt -w` on a freshly
printed tree. Route every `.go` artifact through `go/format.Source`
inside `renderTemplate` before writing, with a stderr warning on parse
failure so malformed templates still surface downstream as compile
errors rather than opaque emit failures.

Closes #1080

* fix(cli): regenerate goldens to capture gofmt-clean emit

Mechanical regeneration after routing renderTemplate through
go/format.Source. 41 files touched, all changes are gofmt operations
(field alignment, import sort, inline empty maps). No semantic diffs.

Refs #1080

* test(cli): adjust assertions for gofmt-aligned generator output

The gofmt emit-phase fix realigns struct fields and map values
based on per-block widths, breaking string-literal assertions that
hard-coded a single-space prefix. Switch the affected assertions to
regex matchers that accept any whitespace between key and value so
they stay robust under future alignment changes.

Refs #1080

* fix(cli): gofmt rendered .go output in GenerateFromPlan emit path

GenerateFromPlan in plan_generate.go has its own render closure that
bypasses renderTemplate, so CLIs scaffolded from plan specs were
still shipping formatting-dirty even after the renderTemplate fix.
Apply the same buffered render -> go/format.Source -> WriteFile flow
and extend the regression test to cover the plan path.

Refs #1080

* refactor(cli): extract normalizeRendered helper for shared emit-time gofmt

Both renderTemplate (generator.go) and the GenerateFromPlan render
closure (plan_generate.go) carried duplicated trim + go/format logic.
Extract to a single normalizeRendered helper so future policy changes
(strict mode, structured logging) apply atomically. Also brings the
plan path's trailing-whitespace handling in line with the primary
path — non-.go outputs now get the same TrimRight + single trailing
newline normalization.

Refs #1080

Files touched

Diff

commit 1ca94b91e8ff917a24f996a7d89aaa89dd1a27d6
Author: Trevin Chow <trevin@trevinchow.com>
Date:   Mon May 11 12:26:56 2026 -0700

    fix(cli): gofmt rendered .go output in generator emit phase (#1100)
    
    * fix(cli): gofmt rendered .go output in generator emit phase
    
    Printed CLIs were shipping formatting-dirty: hand-aligned struct
    literals and unsorted imports in templates surfaced as hundreds of
    phantom diffs the first time anyone ran `gofmt -w` on a freshly
    printed tree. Route every `.go` artifact through `go/format.Source`
    inside `renderTemplate` before writing, with a stderr warning on parse
    failure so malformed templates still surface downstream as compile
    errors rather than opaque emit failures.
    
    Closes #1080
    
    * fix(cli): regenerate goldens to capture gofmt-clean emit
    
    Mechanical regeneration after routing renderTemplate through
    go/format.Source. 41 files touched, all changes are gofmt operations
    (field alignment, import sort, inline empty maps). No semantic diffs.
    
    Refs #1080
    
    * test(cli): adjust assertions for gofmt-aligned generator output
    
    The gofmt emit-phase fix realigns struct fields and map values
    based on per-block widths, breaking string-literal assertions that
    hard-coded a single-space prefix. Switch the affected assertions to
    regex matchers that accept any whitespace between key and value so
    they stay robust under future alignment changes.
    
    Refs #1080
    
    * fix(cli): gofmt rendered .go output in GenerateFromPlan emit path
    
    GenerateFromPlan in plan_generate.go has its own render closure that
    bypasses renderTemplate, so CLIs scaffolded from plan specs were
    still shipping formatting-dirty even after the renderTemplate fix.
    Apply the same buffered render -> go/format.Source -> WriteFile flow
    and extend the regression test to cover the plan path.
    
    Refs #1080
    
    * refactor(cli): extract normalizeRendered helper for shared emit-time gofmt
    
    Both renderTemplate (generator.go) and the GenerateFromPlan render
    closure (plan_generate.go) carried duplicated trim + go/format logic.
    Extract to a single normalizeRendered helper so future policy changes
    (strict mode, structured logging) apply atomically. Also brings the
    plan path's trailing-whitespace handling in line with the primary
    path — non-.go outputs now get the same TrimRight + single trailing
    newline normalization.
    
    Refs #1080
---
 internal/cli/generate_test.go                      |  2 +-
 internal/generator/auth_oauth_url_override_test.go | 12 +--
 internal/generator/cost_throttling_test.go         |  2 +-
 internal/generator/emit_gofmt_test.go              | 89 ++++++++++++++++++++++
 internal/generator/enum_validation_test.go         |  6 +-
 internal/generator/generator.go                    | 24 +++++-
 internal/generator/generator_test.go               | 42 +++++-----
 internal/generator/plan_generate.go                | 13 ++--
 internal/generator/templates_test.go               |  8 +-
 internal/generator/tier_routing_test.go            | 22 +++---
 .../printing-press-oauth2-cc/internal/cli/auth.go  |  2 +-
 .../internal/client/client.go                      |  7 +-
 .../internal/config/config.go                      | 24 +++---
 .../internal/cli/agent_context.go                  | 62 +++++++--------
 .../printing-press-rich-auth/internal/cli/auth.go  | 20 ++---
 .../internal/cli/doctor.go                         |  2 +-
 .../internal/cli/helpers.go                        | 25 +++---
 .../internal/config/config.go                      | 34 ++++-----
 .../printing-press-rich-auth/internal/mcp/tools.go | 59 +++++++-------
 .../cafe-bistro/cmd/cafe-bistro-pp-mcp/main.go     |  2 +-
 .../cafe-bistro/internal/types/types.go            |  5 +-
 .../printing-press-golden/internal/cli/auth.go     | 20 ++---
 .../printing-press-golden/internal/cli/doctor.go   |  2 +-
 .../printing-press-golden/internal/cli/helpers.go  | 25 +++---
 .../internal/cli/projects_create.go                | 10 ++-
 .../internal/cli/projects_list.go                  | 10 +--
 .../internal/cli/projects_tasks_list-project.go    | 14 ++--
 .../internal/cli/projects_tasks_update-project.go  | 12 +--
 .../internal/cli/promoted_public.go                |  8 +-
 .../printing-press-golden/internal/cli/root.go     | 38 ++++-----
 .../printing-press-golden/internal/cli/sync.go     | 11 ++-
 .../internal/client/client.go                      |  7 +-
 .../internal/config/config.go                      | 22 +++---
 .../printing-press-golden/internal/mcp/tools.go    | 49 ++++++------
 .../printing-press-golden/internal/types/types.go  | 29 ++++---
 .../mcp-cloudflare/internal/mcp/code_orch.go       | 26 +++----
 .../mcp-cloudflare/internal/mcp/tools.go           | 17 +++--
 .../internal/cli/stores_create.go                  | 10 ++-
 .../internal/cli/stores_find.go                    |  6 +-
 .../public-param-golden/internal/mcp/tools.go      | 11 +--
 .../internal/cli/promoted_games.go                 |  8 +-
 .../internal/cli/promoted_leagues.go               |  8 +-
 .../sync-walker-golden/internal/cli/sync.go        | 10 +--
 .../sync-walker-golden/internal/store/store.go     |  1 +
 .../tier-routing-golden/internal/cli/doctor.go     |  2 +-
 .../internal/cli/items_enterprise.go               |  6 +-
 .../tier-routing-golden/internal/cli/items_list.go |  9 +--
 .../internal/cli/items_premium.go                  |  6 +-
 .../tier-routing-golden/internal/cli/sync.go       | 13 ++--
 .../tier-routing-golden/internal/client/client.go  | 29 ++++---
 .../tier-routing-golden/internal/mcp/tools.go      | 45 +++++------
 51 files changed, 515 insertions(+), 411 deletions(-)

diff --git a/internal/cli/generate_test.go b/internal/cli/generate_test.go
index 0a5492cd..9a4d4d94 100644
--- a/internal/cli/generate_test.go
+++ b/internal/cli/generate_test.go
@@ -767,7 +767,7 @@ resources:
 
 	agentContext, err := os.ReadFile(filepath.Join(outputDir, "internal", "cli", "agent_context.go"))
 	require.NoError(t, err)
-	assert.Contains(t, string(agentContext), `Reachability:  "browser_clearance_http (90% confidence)"`)
+	assert.Regexp(t, `Reachability:\s+"browser_clearance_http \(90% confidence\)"`, string(agentContext))
 }
 
 func TestGenerateCmdDoesNotRequireBrowserProofForPostOnlyClearance(t *testing.T) {
diff --git a/internal/generator/auth_oauth_url_override_test.go b/internal/generator/auth_oauth_url_override_test.go
index 887b8cc7..7601eb34 100644
--- a/internal/generator/auth_oauth_url_override_test.go
+++ b/internal/generator/auth_oauth_url_override_test.go
@@ -36,8 +36,8 @@ func TestOAuth2URLs_RuntimeOverrideEmittedForAuthCodeGrant(t *testing.T) {
 	require.NoError(t, err)
 	cfg := string(cfgSrc)
 
-	require.Contains(t, cfg, "AuthorizationURL string", "Config must expose AuthorizationURL override field")
-	require.Contains(t, cfg, "TokenURL       string", "Config must expose TokenURL override field")
+	require.Regexp(t, `\bAuthorizationURL\s+string\b`, cfg, "Config must expose AuthorizationURL override field")
+	require.Regexp(t, `\bTokenURL\s+string\b`, cfg, "Config must expose TokenURL override field")
 	require.Contains(t, cfg, `os.Getenv("OAUTH_URL_OVERRIDE_AUTHORIZATION_URL")`,
 		"Load() must read AuthorizationURL env override")
 	require.Contains(t, cfg, `os.Getenv("OAUTH_URL_OVERRIDE_TOKEN_URL")`,
@@ -85,8 +85,8 @@ func TestOAuth2URLs_RuntimeOverrideEmittedForClientCredentialsGrant(t *testing.T
 	cfgSrc, err := os.ReadFile(filepath.Join(outputDir, "internal", "config", "config.go"))
 	require.NoError(t, err)
 	cfg := string(cfgSrc)
-	require.Contains(t, cfg, "TokenURL       string")
-	require.NotContains(t, cfg, "AuthorizationURL string",
+	require.Regexp(t, `\bTokenURL\s+string\b`, cfg)
+	require.NotRegexp(t, `\bAuthorizationURL\s+string\b`, cfg,
 		"client_credentials grant has no authorization URL, so the field must not be emitted")
 	require.Contains(t, cfg, `os.Getenv("CC_URL_OVERRIDE_TOKEN_URL")`)
 
@@ -137,9 +137,9 @@ func TestOAuth2URLs_NoFieldsForBearerTokenSpec(t *testing.T) {
 	cfgSrc, err := os.ReadFile(filepath.Join(outputDir, "internal", "config", "config.go"))
 	require.NoError(t, err)
 	cfg := string(cfgSrc)
-	require.NotContains(t, cfg, "AuthorizationURL string",
+	require.NotRegexp(t, `\bAuthorizationURL\s+string\b`, cfg,
 		"plain bearer_token has no OAuth2 URLs; field must not be emitted")
-	require.NotContains(t, cfg, "TokenURL       string",
+	require.NotRegexp(t, `\bTokenURL\s+string\b`, cfg,
 		"plain bearer_token has no OAuth2 URLs; field must not be emitted")
 
 	clientSrc, err := os.ReadFile(filepath.Join(outputDir, "internal", "client", "client.go"))
diff --git a/internal/generator/cost_throttling_test.go b/internal/generator/cost_throttling_test.go
index a5d214d2..122af7fb 100644
--- a/internal/generator/cost_throttling_test.go
+++ b/internal/generator/cost_throttling_test.go
@@ -140,7 +140,7 @@ func TestGenerateCostThrottlingPrimitives(t *testing.T) {
 	clientGoBytes, err := os.ReadFile(filepath.Join(outputDir, "internal", "client", "client.go"))
 	require.NoError(t, err)
 	clientGo := string(clientGoBytes)
-	assert.Contains(t, clientGo, "Throttle     *ThrottleState",
+	assert.Contains(t, clientGo, "Throttle *ThrottleState",
 		"client.go must declare the Throttle field")
 	assert.Contains(t, clientGo, "ThrottleMode: ThrottleModeStrict",
 		"client.go must default ThrottleMode to strict in New()")
diff --git a/internal/generator/emit_gofmt_test.go b/internal/generator/emit_gofmt_test.go
new file mode 100644
index 00000000..4f2533f6
--- /dev/null
+++ b/internal/generator/emit_gofmt_test.go
@@ -0,0 +1,89 @@
+package generator
+
+import (
+	"go/format"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/mvanhorn/cli-printing-press/v4/internal/naming"
+)
+
+// TestEmittedGoFilesAreGofmtClean walks the freshly generated tree and asserts
+// every `.go` file matches `gofmt -l`. Without an emit-phase format pass,
+// hand-aligned struct literals in templates surface as hundreds of phantom
+// diffs on the first `gofmt -w` in any printed CLI.
+func TestEmittedGoFilesAreGofmtClean(t *testing.T) {
+	t.Parallel()
+
+	apiSpec := minimalSpec("gofmt-emit")
+	outputDir := filepath.Join(t.TempDir(), naming.CLI(apiSpec.Name))
+	gen := New(apiSpec, outputDir)
+	require.NoError(t, gen.Generate())
+
+	dirty := findGofmtDirtyFiles(t, outputDir)
+	require.Empty(t, dirty,
+		"generator emit phase must produce gofmt-clean Go files; dirty:\n  %s",
+		strings.Join(dirty, "\n  "))
+}
+
+// TestGenerateFromPlanGoFilesAreGofmtClean asserts the plan-based generation
+// path produces gofmt-clean output too. GenerateFromPlan has its own render
+// closure separate from Generator.Generate, so the format pass has to be
+// wired through both paths.
+func TestGenerateFromPlanGoFilesAreGofmtClean(t *testing.T) {
+	t.Parallel()
+
+	planSpec := &PlanSpec{
+		CLIName:     "gofmt-plan",
+		Description: "Plan-path gofmt regression",
+		Commands: []PlanCommand{
+			{Name: "record", Description: "Record"},
+			{Name: "screenshot", Description: "Screenshot"},
+		},
+	}
+	outputDir := filepath.Join(t.TempDir(), naming.CLI(planSpec.CLIName))
+	require.NoError(t, os.MkdirAll(outputDir, 0o755))
+	require.NoError(t, GenerateFromPlan(planSpec, outputDir))
+
+	dirty := findGofmtDirtyFiles(t, outputDir)
+	require.Empty(t, dirty,
+		"GenerateFromPlan must produce gofmt-clean Go files; dirty:\n  %s",
+		strings.Join(dirty, "\n  "))
+}
+
+func findGofmtDirtyFiles(t *testing.T, root string) []string {
+	t.Helper()
+	var dirty []string
+	require.NoError(t, filepath.WalkDir(root, func(p string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() || filepath.Ext(p) != ".go" {
+			return nil
+		}
+		src, err := os.ReadFile(p)
+		if err != nil {
+			return err
+		}
+		formatted, err := format.Source(src)
+		if err != nil {
+			// Unparseable Go would also surface as a build failure
+			// downstream; surface it here so this test catches both
+			// classes of regression at once.
+			rel, _ := filepath.Rel(root, p)
+			dirty = append(dirty, rel+" (unparseable: "+err.Error()+")")
+			return nil
+		}
+		if string(formatted) != string(src) {
+			rel, _ := filepath.Rel(root, p)
+			dirty = append(dirty, rel)
+		}
+		return nil
+	}))
+	return dirty
+}
diff --git a/internal/generator/enum_validation_test.go b/internal/generator/enum_validation_test.go
index 4362c4c2..cdf5e715 100644
--- a/internal/generator/enum_validation_test.go
+++ b/internal/generator/enum_validation_test.go
@@ -57,7 +57,7 @@ func TestEnumParamEmitsValidation(t *testing.T) {
 		"flag description must include enum values")
 
 	// Runtime validation block emitted.
-	require.Contains(t, code, `allowedStatus := []string{ "active", "archived", "pending" }`,
+	require.Contains(t, code, `allowedStatus := []string{"active", "archived", "pending"}`,
 		"runtime validation must declare the allowed set")
 	require.Contains(t, code, `warning: --%s %q not in allowed set %v`,
 		"runtime validation must warn on unknown value")
@@ -135,8 +135,8 @@ func TestMultipleEnumParamsDoNotCollide(t *testing.T) {
 	code := string(src)
 
 	// Each enum param gets its own uniquely-named locals.
-	require.Contains(t, code, `allowedStatus := []string{ "active", "archived" }`)
-	require.Contains(t, code, `allowedKind := []string{ "alpha", "beta" }`)
+	require.Contains(t, code, `allowedStatus := []string{"active", "archived"}`)
+	require.Contains(t, code, `allowedKind := []string{"alpha", "beta"}`)
 	require.Contains(t, code, `validStatus := false`)
 	require.Contains(t, code, `validKind := false`)
 }
diff --git a/internal/generator/generator.go b/internal/generator/generator.go
index 684f5421..d50291ca 100644
--- a/internal/generator/generator.go
+++ b/internal/generator/generator.go
@@ -5,6 +5,7 @@ import (
 	"embed"
 	"encoding/json"
 	"fmt"
+	"go/format"
 	"net/url"
 	"os"
 	"path"
@@ -2704,9 +2705,28 @@ func (g *Generator) renderTemplate(tmplName, outPath string, data any) error {
 		return err
 	}
 
-	rendered := bytes.TrimRight(buf.Bytes(), " \t\r\n")
+	return os.WriteFile(fullPath, normalizeRendered(buf.Bytes(), outPath), 0o644)
+}
+
+// normalizeRendered prepares template-rendered bytes for disk: trims trailing
+// whitespace and re-appends a single newline, then runs go/format.Source on
+// `.go` outputs so printed CLIs ship formatting-clean. Template authors
+// hand-align struct fields inconsistently, and without this pass every fresh
+// print surfaces hundreds of phantom diffs on the first `gofmt -w`. Falls
+// through with a stderr warning rather than fail-hard so a malformed template
+// surfaces as a compile error downstream instead of an opaque emit failure.
+func normalizeRendered(raw []byte, outPath string) []byte {
+	rendered := bytes.TrimRight(raw, " \t\r\n")
 	rendered = append(rendered, '\n')
-	return os.WriteFile(fullPath, rendered, 0o644)
+	if filepath.Ext(outPath) != ".go" {
+		return rendered
+	}
+	formatted, err := format.Source(rendered)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "WARNING: gofmt failed for %s: %v\n", outPath, err)
+		return rendered
+	}
+	return formatted
 }
 
 func validateRenderedArtifact(outPath, content string) error {
diff --git a/internal/generator/generator_test.go b/internal/generator/generator_test.go
index 7dec700a..a66e3a65 100644
--- a/internal/generator/generator_test.go
+++ b/internal/generator/generator_test.go
@@ -266,9 +266,11 @@ func TestGenerateDedupesResourceRegistryMapEntries(t *testing.T) {
 	syncSrc, err := os.ReadFile(filepath.Join(outputDir, "internal", "cli", "sync.go"))
 	require.NoError(t, err)
 
-	assert.Equal(t, 1, strings.Count(string(storeSrc), `"contacts": "id",`), "store.go should emit one ID override per resource")
-	assert.Equal(t, 1, strings.Count(string(syncSrc), `"contacts": "id",`), "sync.go should emit one ID override per resource")
-	assert.Equal(t, 1, strings.Count(string(syncSrc), `"contacts": true,`), "sync.go should emit one critical flag per resource")
+	contactsIDRE := regexp.MustCompile(`"contacts":\s+"id",`)
+	contactsCriticalRE := regexp.MustCompile(`"contacts":\s+true,`)
+	assert.Len(t, contactsIDRE.FindAllStringIndex(string(storeSrc), -1), 1, "store.go should emit one ID override per resource")
+	assert.Len(t, contactsIDRE.FindAllStringIndex(string(syncSrc), -1), 1, "sync.go should emit one ID override per resource")
+	assert.Len(t, contactsCriticalRE.FindAllStringIndex(string(syncSrc), -1), 1, "sync.go should emit one critical flag per resource")
 	runGoCommand(t, outputDir, "test", "./internal/cli", "./internal/store")
 }
 
@@ -754,7 +756,7 @@ func TestGenerateBearerRefreshDoctorCommand(t *testing.T) {
 	configGo, err := os.ReadFile(filepath.Join(outputDir, "internal", "config", "config.go"))
 	require.NoError(t, err)
 	configContent := string(configGo)
-	assert.Contains(t, configContent, "BearerTokenRefreshedAt time.Time")
+	assert.Regexp(t, `\bBearerTokenRefreshedAt\s+time\.Time\b`, configContent)
 	assert.Contains(t, configContent, "func (c *Config) SaveBearerToken(")
 	assert.Contains(t, configContent, `c.AuthSource = "bearer_refresh"`)
 	assert.Contains(t, configContent, "c.RefreshbearerPublicBearer = \"\"")
@@ -2997,7 +2999,7 @@ func TestSyncDiscriminatorDispatchRoutesMixedItemsToTypedTables(t *testing.T) {
 	syncSrc, err := os.ReadFile(filepath.Join(outputDir, "internal", "cli", "sync.go"))
 	require.NoError(t, err)
 	src := string(syncSrc)
-	assert.Contains(t, src, `"workspace": "workspaces"`)
+	assert.Regexp(t, `"workspace":\s+"workspaces"`, src)
 	assert.Contains(t, src, `upsertResourceBatch(db, resource, items)`)
 
 	inlineTest := fmt.Sprintf(`package cli
@@ -3785,9 +3787,9 @@ func TestGeneratedExport_ValidatesResourceArgument(t *testing.T) {
 	exportGo, err := os.ReadFile(filepath.Join(outputDir, "internal", "cli", "export.go"))
 	require.NoError(t, err)
 	exportContent := string(exportGo)
-	assert.Contains(t, exportContent, `"items": true`)
-	assert.Contains(t, exportContent, `"stories": true`)
-	assert.Contains(t, exportContent, `"users": true`)
+	assert.Regexp(t, `"items":\s+true`, exportContent)
+	assert.Regexp(t, `"stories":\s+true`, exportContent)
+	assert.Regexp(t, `"users":\s+true`, exportContent)
 	assert.Contains(t, exportContent, `unknown resource %q; valid: %s`)
 
 	runGoCommandRequired(t, outputDir, "build", "-o", "./testexport-pp-cli", "./cmd/testexport-pp-cli")
@@ -4393,8 +4395,8 @@ func TestGeneratedOutput_PromotedCommandKeepsSubresourceParents(t *testing.T) {
 
 	cardsSrc, err := os.ReadFile(filepath.Join(outputDir, "internal", "cli", "account_cards_get-account.go"))
 	require.NoError(t, err)
-	assert.Contains(t, string(cardsSrc), `Example: "  promsub-pp-cli account cards get-account `)
-	assert.NotContains(t, string(cardsSrc), `Example: "  promsub-pp-cli account get-account `)
+	assert.Regexp(t, `Example:\s+"  promsub-pp-cli account cards get-account `, string(cardsSrc))
+	assert.NotRegexp(t, `Example:\s+"  promsub-pp-cli account get-account `, string(cardsSrc))
 }
 
 func TestExampleLineUsesRenderedCommandAndFlagNames(t *testing.T) {
@@ -4643,10 +4645,10 @@ func TestGeneratedOutput_AgentMoneyWorkflowPaymentPlan(t *testing.T) {
 	require.NoError(t, err)
 	workflowSrc := string(workflowGo)
 	assert.Contains(t, workflowSrc, "func newWorkflowPaymentPlanCmd(flags *rootFlags) *cobra.Command")
-	assert.Contains(t, workflowSrc, `Use:   "payment-plan"`)
+	assert.Regexp(t, `Use:\s+"payment-plan"`, workflowSrc)
 	assert.Contains(t, workflowSrc, `base = []string{"treasury-pp-cli", "account", "transactions", "create"}`)
-	assert.Contains(t, workflowSrc, `"dry_run_command": append(append([]string{}, base...), "--dry-run", "--agent")`)
-	assert.Contains(t, workflowSrc, `"execute_command": append([]string{}, base...)`)
+	assert.Regexp(t, `"dry_run_command":\s+append\(append\(\[\]string\{\}, base\.\.\.\), "--dry-run", "--agent"\)`, workflowSrc)
+	assert.Regexp(t, `"execute_command":\s+append\(\[\]string\{\}, base\.\.\.\)`, workflowSrc)
 
 	runGoCommand(t, outputDir, "mod", "tidy")
 	runGoCommand(t, outputDir, "build", "./...")
@@ -7376,9 +7378,9 @@ func TestGenerateSyncIncludesSiblingListResources(t *testing.T) {
 	syncGo, err := os.ReadFile(filepath.Join(outputDir, "internal", "cli", "sync.go"))
 	require.NoError(t, err)
 	syncContent := string(syncGo)
-	assert.Contains(t, syncContent, `"portfolio": "/portfolio/fills"`)
-	assert.Contains(t, syncContent, `"portfolio-orders": "/portfolio/orders"`)
-	assert.Contains(t, syncContent, `"portfolio-settlements": "/portfolio/settlements"`)
+	assert.Regexp(t, `"portfolio":\s+"/portfolio/fills"`, syncContent)
+	assert.Regexp(t, `"portfolio-orders":\s+"/portfolio/orders"`, syncContent)
+	assert.Regexp(t, `"portfolio-settlements":\s+"/portfolio/settlements"`, syncContent)
 }
 
 func TestGenerateGraphQLCompiles(t *testing.T) {
@@ -7633,9 +7635,9 @@ func TestGenerateEndpointTemplateVarsRuntimeSubstitution(t *testing.T) {
 	urlGo := string(urlGoBytes)
 	assert.Contains(t, urlGo, "func buildURL(",
 		"url.go must define the buildURL helper")
-	assert.Contains(t, urlGo, `"shop": "SHOPIFY_SHOP"`,
+	assert.Regexp(t, `"shop":\s+"SHOPIFY_SHOP"`, urlGo,
 		"templateVarEnvNames must wire {shop} to SHOPIFY_SHOP")
-	assert.Contains(t, urlGo, `"api_version": "SHOPIFY_API_VERSION"`,
+	assert.Regexp(t, `"api_version":\s+"SHOPIFY_API_VERSION"`, urlGo,
 		"templateVarEnvNames must wire {api_version} to SHOPIFY_API_VERSION")
 
 	// config.go must populate Config.TemplateVars from env at Load() time.
@@ -8216,7 +8218,7 @@ func TestGenerateResourceBaseURLOverrideRoutesAgentDispatchSurfaces(t *testing.T
 
 	codeOrch, err := os.ReadFile(filepath.Join(outputDir, "internal", "mcp", "code_orch.go"))
 	require.NoError(t, err)
-	assert.Contains(t, string(codeOrch), `Path:    "https://geocoding-api.example.com/v1/search"`,
+	assert.Regexp(t, `Path:\s+"https://geocoding-api\.example\.com/v1/search"`, string(codeOrch),
 		"code-orchestration execute must use the effective resource override URL")
 
 	intents, err := os.ReadFile(filepath.Join(outputDir, "internal", "mcp", "intents.go"))
@@ -8569,7 +8571,7 @@ func TestGeneratePublicParamNamesInPromotedExamples(t *testing.T) {
 	require.NoError(t, New(apiSpec, outputDir).Generate())
 
 	promotedSource := readGeneratedFile(t, outputDir, "internal", "cli", "promoted_checkout.go")
-	assert.Contains(t, promotedSource, `Example: "  promoted-public-params-pp-cli checkout --store-code example-value"`)
+	assert.Regexp(t, `Example:\s+"  promoted-public-params-pp-cli checkout --store-code example-value"`, promotedSource)
 }
 
 // TestGenerateMCPCodeOrchKeywordsHasStopwordFilter proves the keyword
diff --git a/internal/generator/plan_generate.go b/internal/generator/plan_generate.go
index 28e91ea6..17c1de2d 100644
--- a/internal/generator/plan_generate.go
+++ b/internal/generator/plan_generate.go
@@ -1,6 +1,7 @@
 package generator
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"os"
@@ -99,16 +100,12 @@ func GenerateFromPlan(planSpec *PlanSpec, outputDir string) error {
 		if err != nil {
 			return fmt.Errorf("parsing template %s: %w", tmplName, err)
 		}
-		fullPath := filepath.Join(outputDir, outPath)
-		f, err := os.Create(fullPath)
-		if err != nil {
-			return fmt.Errorf("creating %s: %w", fullPath, err)
-		}
-		defer func() { _ = f.Close() }()
-		if err := tmpl.Execute(f, data); err != nil {
+		var buf bytes.Buffer
+		if err := tmpl.Execute(&buf, data); err != nil {
 			return fmt.Errorf("executing template %s: %w", tmplName, err)
 		}
-		return nil
+		fullPath := filepath.Join(outputDir, outPath)
+		return os.WriteFile(fullPath, normalizeRendered(buf.Bytes(), outPath), 0o644)
 	}
 
 	// Partition commands into top-level and subcommands
diff --git a/internal/generator/templates_test.go b/internal/generator/templates_test.go
index f2fefd0a..cd491382 100644
--- a/internal/generator/templates_test.go
+++ b/internal/generator/templates_test.go
@@ -99,8 +99,8 @@ func TestMCPContextOmitsHarvestedAuthEnvVars(t *testing.T) {
 	require.NoError(t, err)
 	content := string(mcpSrc)
 
-	require.Contains(t, content, `"name": "MCP_AUTH_TOKEN"`)
-	require.Contains(t, content, `"name": "MCP_AUTH_CLIENT_ID"`)
+	require.Regexp(t, `"name":\s+"MCP_AUTH_TOKEN"`, content)
+	require.Regexp(t, `"name":\s+"MCP_AUTH_CLIENT_ID"`, content)
 	require.NotContains(t, content, "MCP_AUTH_COOKIES")
 }
 
@@ -124,8 +124,8 @@ func TestAgentContextOmitsHarvestedAuthEnvVars(t *testing.T) {
 	require.NoError(t, err)
 	content := string(agentContextSrc)
 
-	require.Contains(t, content, `Name:      "AGENT_CONTEXT_TOKEN"`)
-	require.Contains(t, content, `Name:      "AGENT_CONTEXT_CLIENT_ID"`)
+	require.Regexp(t, `Name:\s+"AGENT_CONTEXT_TOKEN"`, content)
+	require.Regexp(t, `Name:\s+"AGENT_CONTEXT_CLIENT_ID"`, content)
 	require.NotContains(t, content, "AGENT_CONTEXT_COOKIES")
 }
 
diff --git a/internal/generator/tier_routing_test.go b/internal/generator/tier_routing_test.go
index 4d633f81..522f0af5 100644
--- a/internal/generator/tier_routing_test.go
+++ b/internal/generator/tier_routing_test.go
@@ -83,15 +83,15 @@ func TestTierRoutingEmitsTierAwareClientAndCommands(t *testing.T) {
 	require.NoError(t, New(apiSpec, outputDir).Generate())
 
 	clientSrc := readGeneratedFile(t, outputDir, "internal", "client", "client.go")
-	require.Contains(t, clientSrc, "requestTier string")
-	require.Contains(t, clientSrc, "limiters    map[string]*cliutil.AdaptiveLimiter")
+	require.Regexp(t, `\brequestTier\s+string\b`, clientSrc)
+	require.Regexp(t, `\blimiters\s+map\[string\]\*cliutil\.AdaptiveLimiter\b`, clientSrc)
 	require.Contains(t, clientSrc, "next.limiter = c.limiterForTier(tier)")
-	require.Contains(t, clientSrc, `"paid": cliutil.NewAdaptiveLimiter(rateLimit)`)
+	require.Regexp(t, `"paid":\s+cliutil\.NewAdaptiveLimiter\(rateLimit\)`, clientSrc)
 	require.Contains(t, clientSrc, `case "free":`)
 	require.Contains(t, clientSrc, `case "paid":`)
 	require.Contains(t, clientSrc, `return strings.TrimRight("https://paid.api.example.com", "/")`)
 	require.Contains(t, clientSrc, `os.Getenv("TIERED_PAID_KEY")`)
-	require.Contains(t, clientSrc, `"access_token": tierValue0`)
+	require.Regexp(t, `"access_token":\s+tierValue0`, clientSrc)
 	require.Contains(t, clientSrc, `q.Set(authInfo.Name, authHeader)`)
 	require.Contains(t, clientSrc, `key += "|base_url=" + c.BaseURL`)
 	require.Contains(t, clientSrc, `key += "|tier=" + c.requestTier + "|tier_base_url=" + c.baseURLForRequest()`)
@@ -106,17 +106,17 @@ func TestTierRoutingEmitsTierAwareClientAndCommands(t *testing.T) {
 	require.Contains(t, mcpSrc, `makeAPIHandler("GET", "/items/premium", "paid"`)
 	require.Contains(t, mcpSrc, `c = c.WithTier(tier)`)
 	require.Contains(t, mcpSrc, `"tier_routing": map[string]any`)
-	require.Contains(t, mcpSrc, `"items_premium": "paid"`)
+	require.Regexp(t, `"items_premium":\s+"paid"`, mcpSrc)
 
 	intentsSrc := readGeneratedFile(t, outputDir, "internal", "mcp", "intents.go")
-	require.Contains(t, intentsSrc, `tier   string`)
+	require.Regexp(t, `\btier\s+string\b`, intentsSrc)
 	require.Contains(t, intentsSrc, `"items.premium": {method: "GET", path: "/items/premium", tier: "paid"}`)
 	require.Contains(t, intentsSrc, `c = c.WithTier(ep.tier)`)
 
 	syncSrc := readGeneratedFile(t, outputDir, "internal", "cli", "sync.go")
 	require.Contains(t, syncSrc, `func syncClientForResource(c *client.Client, resource string) *client.Client`)
-	require.Contains(t, syncSrc, `"items": "free"`)
-	require.Contains(t, syncSrc, `"comments": "paid"`)
+	require.Regexp(t, `"items":\s+"free"`, syncSrc)
+	require.Regexp(t, `"comments":\s+"paid"`, syncSrc)
 
 	doctorSrc := readGeneratedFile(t, outputDir, "internal", "cli", "doctor.go")
 	require.Contains(t, doctorSrc, `report["tier_env_vars"] = tierEnvStatus`)
@@ -159,9 +159,9 @@ func TestTierRoutingEmitsTierAwareClientAndCommands(t *testing.T) {
 	codeOutputDir := filepath.Join(t.TempDir(), "tiered-code-pp-cli")
 	require.NoError(t, New(codeSpec, codeOutputDir).Generate())
 	codeOrchSrc := readGeneratedFile(t, codeOutputDir, "internal", "mcp", "code_orch.go")
-	require.Contains(t, codeOrchSrc, `Tier        string`)
-	require.Contains(t, codeOrchSrc, `Tier:    "paid"`)
-	require.Contains(t, codeOrchSrc, `"tier":        r.ep.Tier`)
+	require.Regexp(t, `\bTier\s+string\b`, codeOrchSrc)
+	require.Regexp(t, `Tier:\s+"paid"`, codeOrchSrc)
+	require.Regexp(t, `"tier":\s+r\.ep\.Tier`, codeOrchSrc)
 	require.Contains(t, codeOrchSrc, `c = c.WithTier(ep.Tier)`)
 }
 
diff --git a/testdata/golden/expected/generate-golden-api-oauth2-cc/printing-press-oauth2-cc/internal/cli/auth.go b/testdata/golden/expected/generate-golden-api-oauth2-cc/printing-press-oauth2-cc/internal/cli/auth.go
index b41ee7e3..84e90080 100644
--- a/testdata/golden/expected/generate-golden-api-oauth2-cc/printing-press-oauth2-cc/internal/cli/auth.go
+++ b/testdata/golden/expected/generate-golden-api-oauth2-cc/printing-press-oauth2-cc/internal/cli/auth.go
@@ -13,9 +13,9 @@ import (
 	"strings"
 	"time"
 
+	"github.com/spf13/cobra"
 	"printing-press-oauth2-pp-cli/internal/cliutil"
 	"printing-press-oauth2-pp-cli/internal/config"
-	"github.com/spf13/cobra"
 )
 
 // OAuth2 client_credentials grant: 2-legged server-to-server flow.
diff --git a/testdata/golden/expected/generate-golden-api-oauth2-cc/printing-press-oauth2-cc/internal/client/client.go b/testdata/golden/expected/generate-golden-api-oauth2-cc/printing-press-oauth2-cc/internal/client/client.go
index 42d9f144..adf20abe 100644
--- a/testdata/golden/expected/generate-golden-api-oauth2-cc/printing-press-oauth2-cc/internal/client/client.go
+++ b/testdata/golden/expected/generate-golden-api-oauth2-cc/printing-press-oauth2-cc/internal/client/client.go
@@ -15,12 +15,12 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
+	"printing-press-oauth2-pp-cli/internal/cliutil"
+	"printing-press-oauth2-pp-cli/internal/config"
 	"sort"
 	"strings"
 	"sync"
 	"time"
-	"printing-press-oauth2-pp-cli/internal/cliutil"
-	"printing-press-oauth2-pp-cli/internal/config"
 )
 
 type Client struct {
@@ -37,8 +37,6 @@ type Client struct {
 	ccMu *sync.Mutex
 }
 
-
-
 // APIError carries HTTP status information for structured exit codes.
 type APIError struct {
 	Method     string
@@ -556,7 +554,6 @@ func sanitizeJSONResponse(body []byte) []byte {
 	return body
 }
 
-
 // maskToken redacts all but the last 4 characters of a token for safe display.
 func maskToken(token string) string {
 	if token == "" {
diff --git a/testdata/golden/expected/generate-golden-api-oauth2-cc/printing-press-oauth2-cc/internal/config/config.go b/testdata/golden/expected/generate-golden-api-oauth2-cc/printing-press-oauth2-cc/internal/config/config.go
index 17959b2c..552a9037 100644
--- a/testdata/golden/expected/generate-golden-api-oauth2-cc/printing-press-oauth2-cc/internal/config/config.go
+++ b/testdata/golden/expected/generate-golden-api-oauth2-cc/printing-press-oauth2-cc/internal/config/config.go
@@ -14,20 +14,20 @@ import (
 )
 
 type Config struct {
-	BaseURL        string `toml:"base_url"`
-	AuthHeaderVal  string `toml:"auth_header"`
-	Headers        map[string]string `toml:"headers,omitempty"`
-	AuthSource     string `toml:"-"`
-	AccessToken    string `toml:"access_token"`
-	RefreshToken   string `toml:"refresh_token"`
-	TokenExpiry    time.Time `toml:"token_expiry"`
-	ClientID       string `toml:"client_id"`
-	ClientSecret   string `toml:"client_secret"`
+	BaseURL       string            `toml:"base_url"`
+	AuthHeaderVal string            `toml:"auth_header"`
+	Headers       map[string]string `toml:"headers,omitempty"`
+	AuthSource    string            `toml:"-"`
+	AccessToken   string            `toml:"access_token"`
+	RefreshToken  string            `toml:"refresh_token"`
+	TokenExpiry   time.Time         `toml:"token_expiry"`
+	ClientID      string            `toml:"client_id"`
+	ClientSecret  string            `toml:"client_secret"`
 	// TokenURL overrides the spec-baked OAuth2 token endpoint. Same fallback
 	// pattern as AuthorizationURL.
-	TokenURL       string `toml:"token_url,omitempty"`
-	Path           string `toml:"-"`
-	PrintingPressOauth2ClientId string `toml:"press_oauth2_client_id"`
+	TokenURL                        string `toml:"token_url,omitempty"`
+	Path                            string `toml:"-"`
+	PrintingPressOauth2ClientId     string `toml:"press_oauth2_client_id"`
 	PrintingPressOauth2ClientSecret string `toml:"press_oauth2_client_secret"`
 }
 
diff --git a/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/cli/agent_context.go b/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/cli/agent_context.go
index 733a2943..41000a38 100644
--- a/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/cli/agent_context.go
+++ b/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/cli/agent_context.go
@@ -22,13 +22,13 @@ const agentContextSchemaVersion = "3"
 // (2026-04-13 Wrangler post): agents can introspect the live CLI without
 // parsing --help or reading source.
 type agentContext struct {
-	SchemaVersion               string                `json:"schema_version"`
-	CLI                         agentContextCLI       `json:"cli"`
-	Auth                        agentContextAuth      `json:"auth"`
-	Discovery                   *agentContextDiscovery `json:"discovery,omitempty"`
-	Commands                    []agentContextCommand `json:"commands"`
-	AvailableProfiles           []string              `json:"available_profiles"`
-	FeedbackEndpointConfigured  bool                  `json:"feedback_endpoint_configured"`
+	SchemaVersion              string                 `json:"schema_version"`
+	CLI                        agentContextCLI        `json:"cli"`
+	Auth                       agentContextAuth       `json:"auth"`
+	Discovery                  *agentContextDiscovery `json:"discovery,omitempty"`
+	Commands                   []agentContextCommand  `json:"commands"`
+	AvailableProfiles          []string               `json:"available_profiles"`
+	FeedbackEndpointConfigured bool                   `json:"feedback_endpoint_configured"`
 }
 
 type agentContextCLI struct {
@@ -105,45 +105,45 @@ reading source. Schema is versioned via schema_version.`,
 func buildAgentContext(rootCmd *cobra.Command) agentContext {
 	envVars := []agentContextAuthEnvVar{
 		{
-			Name:      "RICH_AUTH_API_KEY",
-			Kind:      "per_call",
-			Required:  true,
-			Sensitive: true,
+			Name:        "RICH_AUTH_API_KEY",
+			Kind:        "per_call",
+			Required:    true,
+			Sensitive:   true,
 			Description: "Set to your API credential.",
 		},
 		{
-			Name:      "RICH_AUTH_CLIENT_ID",
-			Kind:      "auth_flow_input",
-			Required:  false,
-			Sensitive: false,
+			Name:        "RICH_AUTH_CLIENT_ID",
+			Kind:        "auth_flow_input",
+			Required:    false,
+			Sensitive:   false,
 			Description: "OAuth application client identifier.",
 		},
 		{
-			Name:      "RICH_AUTH_CLIENT_SECRET",
-			Kind:      "auth_flow_input",
-			Required:  false,
-			Sensitive: true,
+			Name:        "RICH_AUTH_CLIENT_SECRET",
+			Kind:        "auth_flow_input",
+			Required:    false,
+			Sensitive:   true,
 			Description: "Set during initial auth setup.",
 		},
 		{
-			Name:      "RICH_AUTH_OPTIONAL_TOKEN",
-			Kind:      "per_call",
-			Required:  false,
-			Sensitive: true,
+			Name:        "RICH_AUTH_OPTIONAL_TOKEN",
+			Kind:        "per_call",
+			Required:    false,
+			Sensitive:   true,
 			Description: "Set to your API credential.",
 		},
 		{
-			Name:      "RICH_AUTH_BOT_TOKEN",
-			Kind:      "per_call",
-			Required:  false,
-			Sensitive: true,
+			Name:        "RICH_AUTH_BOT_TOKEN",
+			Kind:        "per_call",
+			Required:    false,
+			Sensitive:   true,
 			Description: "Set to your API credential.",
 		},
 		{
-			Name:      "RICH_AUTH_USER_TOKEN",
-			Kind:      "per_call",
-			Required:  false,
-			Sensitive: true,
+			Name:        "RICH_AUTH_USER_TOKEN",
+			Kind:        "per_call",
+			Required:    false,
+			Sensitive:   true,
 			Description: "Set to your API credential.",
 		},
 	}
diff --git a/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/cli/auth.go b/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/cli/auth.go
index 6e4c71a6..08fb4068 100644
--- a/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/cli/auth.go
+++ b/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/cli/auth.go
@@ -5,9 +5,9 @@ package cli
 
 import (
 	"fmt"
+	"github.com/spf13/cobra"
 	"os"
 	"printing-press-rich-pp-cli/internal/config"
-	"github.com/spf13/cobra"
 )
 
 func newAuthCmd(flags *rootFlags) *cobra.Command {
@@ -30,8 +30,8 @@ func newAuthCmd(flags *rootFlags) *cobra.Command {
 func newAuthSetupCmd(_ *rootFlags) *cobra.Command {
 	var launch bool
 	cmd := &cobra.Command{
-		Use:   "setup",
-		Short: "Print steps for obtaining a credential (use --launch to open the URL)",
+		Use:     "setup",
+		Short:   "Print steps for obtaining a credential (use --launch to open the URL)",
 		Example: "  printing-press-rich-pp-cli auth setup\n  printing-press-rich-pp-cli auth setup --launch",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			w := cmd.OutOrStdout()
@@ -56,8 +56,8 @@ func newAuthSetupCmd(_ *rootFlags) *cobra.Command {
 
 func newAuthStatusCmd(flags *rootFlags) *cobra.Command {
 	return &cobra.Command{
-		Use:   "status",
-		Short: "Show authentication status",
+		Use:     "status",
+		Short:   "Show authentication status",
 		Example: "  printing-press-rich-pp-cli auth status",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			cfg, err := config.Load(flags.configPath)
@@ -108,10 +108,10 @@ func newAuthStatusCmd(flags *rootFlags) *cobra.Command {
 
 func newAuthSetTokenCmd(flags *rootFlags) *cobra.Command {
 	return &cobra.Command{
-		Use:   "set-token <token>",
-		Short: "Save an API token to the config file",
+		Use:     "set-token <token>",
+		Short:   "Save an API token to the config file",
 		Example: "  printing-press-rich-pp-cli auth set-token YOUR_TOKEN_HERE",
-		Args:  cobra.ExactArgs(1),
+		Args:    cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			cfg, err := config.Load(flags.configPath)
 			if err != nil {
@@ -148,8 +148,8 @@ func newAuthSetTokenCmd(flags *rootFlags) *cobra.Command {
 
 func newAuthLogoutCmd(flags *rootFlags) *cobra.Command {
 	return &cobra.Command{
-		Use:   "logout",
-		Short: "Clear stored credentials",
+		Use:     "logout",
+		Short:   "Clear stored credentials",
 		Example: "  printing-press-rich-pp-cli auth logout",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			cfg, err := config.Load(flags.configPath)
diff --git a/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/cli/doctor.go b/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/cli/doctor.go
index aa98206a..4698fc28 100644
--- a/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/cli/doctor.go
+++ b/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/cli/doctor.go
@@ -13,10 +13,10 @@ import (
 	"strings"
 	"time"
 
+	"github.com/spf13/cobra"
 	"printing-press-rich-pp-cli/internal/client"
 	"printing-press-rich-pp-cli/internal/config"
 	"printing-press-rich-pp-cli/internal/store"
-	"github.com/spf13/cobra"
 )
 
 // looksLikeDoctorInterstitial reports whether the response body matches a known
diff --git a/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/cli/helpers.go b/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/cli/helpers.go
index 3fb2cf3a..9fec80c6 100644
--- a/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/cli/helpers.go
+++ b/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/cli/helpers.go
@@ -8,19 +8,19 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
 	"io"
 	"os"
 	"path/filepath"
+	"printing-press-rich-pp-cli/internal/client"
+	"printing-press-rich-pp-cli/internal/cliutil"
 	"regexp"
 	"sort"
 	"strings"
 	"text/tabwriter"
 	"time"
 	"unicode"
-	"printing-press-rich-pp-cli/internal/cliutil"
-	"printing-press-rich-pp-cli/internal/client"
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
 )
 
 var As = errors.As
@@ -94,11 +94,11 @@ type cliError struct {
 func (e *cliError) Error() string { return e.err.Error() }
 func (e *cliError) Unwrap() error { return e.err }
 
-func usageErr(err error) error    { return &cliError{code: 2, err: err} }
-func notFoundErr(err error) error { return &cliError{code: 3, err: err} }
-func authErr(err error) error     { return &cliError{code: 4, err: err} }
-func apiErr(err error) error      { return &cliError{code: 5, err: err} }
-func configErr(err error) error   { return &cliError{code: 10, err: err} }
+func usageErr(err error) error     { return &cliError{code: 2, err: err} }
+func notFoundErr(err error) error  { return &cliError{code: 3, err: err} }
+func authErr(err error) error      { return &cliError{code: 4, err: err} }
+func apiErr(err error) error       { return &cliError{code: 5, err: err} }
+func configErr(err error) error    { return &cliError{code: 10, err: err} }
 func rateLimitErr(err error) error { return &cliError{code: 7, err: err} }
 
 // dryRunOK reports whether the command should short-circuit without doing any
@@ -1181,12 +1181,13 @@ func findField(obj map[string]any, names ...string) string {
 	}
 	return ""
 }
+
 // DataProvenance describes where data came from and when it was last synced.
 type DataProvenance struct {
 	Source       string     `json:"source"`                  // "live" or "local"
-	SyncedAt    *time.Time `json:"synced_at,omitempty"`     // when local data was last synced
-	Reason      string     `json:"reason,omitempty"`        // why local was used: "user_requested", "api_unreachable", "no_search_endpoint"
-	ResourceType string    `json:"resource_type,omitempty"` // which resource type was queried
+	SyncedAt     *time.Time `json:"synced_at,omitempty"`     // when local data was last synced
+	Reason       string     `json:"reason,omitempty"`        // why local was used: "user_requested", "api_unreachable", "no_search_endpoint"
+	ResourceType string     `json:"resource_type,omitempty"` // which resource type was queried
 	Freshness    any        `json:"freshness,omitempty"`     // optional machine-owned freshness metadata for covered command paths
 }
 
diff --git a/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/config/config.go b/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/config/config.go
index 33fb8aaa..fdffe031 100644
--- a/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/config/config.go
+++ b/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/config/config.go
@@ -14,23 +14,23 @@ import (
 )
 
 type Config struct {
-	BaseURL        string `toml:"base_url"`
-	AuthHeaderVal  string `toml:"auth_header"`
-	Headers        map[string]string `toml:"headers,omitempty"`
-	AuthSource     string `toml:"-"`
-	AccessToken    string `toml:"access_token"`
-	RefreshToken   string `toml:"refresh_token"`
-	TokenExpiry    time.Time `toml:"token_expiry"`
-	ClientID       string `toml:"client_id"`
-	ClientSecret   string `toml:"client_secret"`
-	Path           string `toml:"-"`
-	RichAuthApiKey string `toml:"auth_api_key"`
-	RichAuthClientId string `toml:"auth_client_id"`
-	RichAuthClientSecret string `toml:"auth_client_secret"`
-	RichAuthSessionCookie string `toml:"auth_session_cookie"`
-	RichAuthOptionalToken string `toml:"auth_optional_token"`
-	RichAuthBotToken string `toml:"auth_bot_token"`
-	RichAuthUserToken string `toml:"auth_user_token"`
+	BaseURL               string            `toml:"base_url"`
+	AuthHeaderVal         string            `toml:"auth_header"`
+	Headers               map[string]string `toml:"headers,omitempty"`
+	AuthSource            string            `toml:"-"`
+	AccessToken           string            `toml:"access_token"`
+	RefreshToken          string            `toml:"refresh_token"`
+	TokenExpiry           time.Time         `toml:"token_expiry"`
+	ClientID              string            `toml:"client_id"`
+	ClientSecret          string            `toml:"client_secret"`
+	Path                  string            `toml:"-"`
+	RichAuthApiKey        string            `toml:"auth_api_key"`
+	RichAuthClientId      string            `toml:"auth_client_id"`
+	RichAuthClientSecret  string            `toml:"auth_client_secret"`
+	RichAuthSessionCookie string            `toml:"auth_session_cookie"`
+	RichAuthOptionalToken string            `toml:"auth_optional_token"`
+	RichAuthBotToken      string            `toml:"auth_bot_token"`
+	RichAuthUserToken     string            `toml:"auth_user_token"`
 }
 
 func Load(configPath string) (*Config, error) {
diff --git a/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/mcp/tools.go b/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/mcp/tools.go
index 3ff3fb22..31e90ab3 100644
--- a/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/mcp/tools.go
+++ b/testdata/golden/expected/generate-golden-api-rich-auth/printing-press-rich-auth/internal/mcp/tools.go
@@ -15,8 +15,8 @@ import (
 	mcplib "github.com/mark3labs/mcp-go/mcp"
 	"github.com/mark3labs/mcp-go/server"
 	"printing-press-rich-pp-cli/internal/cli"
-	"printing-press-rich-pp-cli/internal/cliutil"
 	"printing-press-rich-pp-cli/internal/client"
+	"printing-press-rich-pp-cli/internal/cliutil"
 	"printing-press-rich-pp-cli/internal/config"
 	"printing-press-rich-pp-cli/internal/mcp/cobratree"
 	"printing-press-rich-pp-cli/internal/store"
@@ -31,7 +31,7 @@ func RegisterTools(s *server.MCPServer) {
 			mcplib.WithDestructiveHintAnnotation(false),
 			mcplib.WithOpenWorldHintAnnotation(true),
 		),
-		makeAPIHandler("GET", "/items", []mcpParamBinding{ }, []string{ }),
+		makeAPIHandler("GET", "/items", []mcpParamBinding{}, []string{}),
 	)
 	// SQL tool — ad-hoc analysis on synced data without API calls
 	s.AddTool(
@@ -218,6 +218,7 @@ func dbPath() string {
 	home, _ := os.UserHomeDir()
 	return filepath.Join(home, ".local", "share", "printing-press-rich-pp-cli", "data.db")
 }
+
 // Note: MCP tools use their own dbPath() because they are in a separate package (main, not cli).
 // The CLI's defaultDBPath() in the cli package uses the same canonical path.
 
@@ -330,55 +331,55 @@ func handleContext(_ context.Context, _ mcplib.CallToolRequest) (*mcplib.CallToo
 			"type": "api_key",
 			"env_vars": []map[string]any{
 				{
-					"name": "RICH_AUTH_API_KEY",
-					"kind": "per_call",
-					"required": true,
-					"sensitive": true,
+					"name":        "RICH_AUTH_API_KEY",
+					"kind":        "per_call",
+					"required":    true,
+					"sensitive":   true,
 					"description": "Set to your API credential.",
 				},
 				{
-					"name": "RICH_AUTH_CLIENT_ID",
-					"kind": "auth_flow_input",
-					"required": false,
-					"sensitive": false,
+					"name":        "RICH_AUTH_CLIENT_ID",
+					"kind":        "auth_flow_input",
+					"required":    false,
+					"sensitive":   false,
 					"description": "OAuth application client identifier.",
 				},
 				{
-					"name": "RICH_AUTH_CLIENT_SECRET",
-					"kind": "auth_flow_input",
-					"required": false,
-					"sensitive": true,
+					"name":        "RICH_AUTH_CLIENT_SECRET",
+					"kind":        "auth_flow_input",
+					"required":    false,
+					"sensitive":   true,
 					"description": "Set during initial auth setup.",
 				},
 				{
-					"name": "RICH_AUTH_OPTIONAL_TOKEN",
-					"kind": "per_call",
-					"required": false,
-					"sensitive": true,
+					"name":        "RICH_AUTH_OPTIONAL_TOKEN",
+					"kind":        "per_call",
+					"required":    false,
+					"sensitive":   true,
 					"description": "Set to your API credential.",
 				},
 				{
-					"name": "RICH_AUTH_BOT_TOKEN",
-					"kind": "per_call",
-					"required": false,
-					"sensitive": true,
+					"name":        "RICH_AUTH_BOT_TOKEN",
+					"kind":        "per_call",
+					"required":    false,
+					"sensitive":   true,
 					"description": "Set to your API credential.",
 				},
 				{
-					"name": "RICH_AUTH_USER_TOKEN",
-					"kind": "per_call",
-					"required": false,
-					"sensitive": true,
+					"name":        "RICH_AUTH_USER_TOKEN",
+					"kind":        "per_call",
+					"required":    false,
+					"sensitive":   true,
 					"description": "Set to your API credential.",
 				},
 			},
 		},
 		"resources": []map[string]any{
 			{
-				"name": "items",
+				"name":        "items",
 				"description": "Manage items",
-				"endpoints": []string{"list",  },
-				"syncable": true,
+				"endpoints":   []string{"list"},
+				"syncable":    true,
 			},
 		},
 		"query_tips": []string{
diff --git a/testdata/golden/expected/generate-golden-api-unicode/cafe-bistro/cmd/cafe-bistro-pp-mcp/main.go b/testdata/golden/expected/generate-golden-api-unicode/cafe-bistro/cmd/cafe-bistro-pp-mcp/main.go
index 03b16e68..e13793e8 100644
--- a/testdata/golden/expected/generate-golden-api-unicode/cafe-bistro/cmd/cafe-bistro-pp-mcp/main.go
+++ b/testdata/golden/expected/generate-golden-api-unicode/cafe-bistro/cmd/cafe-bistro-pp-mcp/main.go
@@ -7,8 +7,8 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/mark3labs/mcp-go/server"
 	mcptools "cafe-bistro-pp-cli/internal/mcp"
+	"github.com/mark3labs/mcp-go/server"
 )
 
 func main() {
diff --git a/testdata/golden/expected/generate-golden-api-unicode/cafe-bistro/internal/types/types.go b/testdata/golden/expected/generate-golden-api-unicode/cafe-bistro/internal/types/types.go
index 69b2517c..788ba908 100644
--- a/testdata/golden/expected/generate-golden-api-unicode/cafe-bistro/internal/types/types.go
+++ b/testdata/golden/expected/generate-golden-api-unicode/cafe-bistro/internal/types/types.go
@@ -3,9 +3,8 @@
 
 package types
 
-
 type CafeMenu struct {
-	Id string `json:"id"`
-	Name string `json:"name"`
+	Id         string `json:"id"`
+	Name       string `json:"name"`
 	Specialite string `json:"specialite"`
 }
diff --git a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/auth.go b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/auth.go
index 2503fdbe..a9c90486 100644
--- a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/auth.go
+++ b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/auth.go
@@ -5,9 +5,9 @@ package cli
 
 import (
 	"fmt"
+	"github.com/spf13/cobra"
 	"os"
 	"printing-press-golden-pp-cli/internal/config"
-	"github.com/spf13/cobra"
 )
 
 func newAuthCmd(flags *rootFlags) *cobra.Command {
@@ -30,8 +30,8 @@ func newAuthCmd(flags *rootFlags) *cobra.Command {
 func newAuthSetupCmd(_ *rootFlags) *cobra.Command {
 	var launch bool
 	cmd := &cobra.Command{
-		Use:   "setup",
-		Short: "Print steps for obtaining a credential (use --launch to open the URL)",
+		Use:     "setup",
+		Short:   "Print steps for obtaining a credential (use --launch to open the URL)",
 		Example: "  printing-press-golden-pp-cli auth setup\n  printing-press-golden-pp-cli auth setup --launch",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			w := cmd.OutOrStdout()
@@ -53,8 +53,8 @@ func newAuthSetupCmd(_ *rootFlags) *cobra.Command {
 
 func newAuthStatusCmd(flags *rootFlags) *cobra.Command {
 	return &cobra.Command{
-		Use:   "status",
-		Short: "Show authentication status",
+		Use:     "status",
+		Short:   "Show authentication status",
 		Example: "  printing-press-golden-pp-cli auth status",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			cfg, err := config.Load(flags.configPath)
@@ -102,10 +102,10 @@ func newAuthStatusCmd(flags *rootFlags) *cobra.Command {
 
 func newAuthSetTokenCmd(flags *rootFlags) *cobra.Command {
 	return &cobra.Command{
-		Use:   "set-token <token>",
-		Short: "Save an API token to the config file",
+		Use:     "set-token <token>",
+		Short:   "Save an API token to the config file",
 		Example: "  printing-press-golden-pp-cli auth set-token YOUR_TOKEN_HERE",
-		Args:  cobra.ExactArgs(1),
+		Args:    cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			cfg, err := config.Load(flags.configPath)
 			if err != nil {
@@ -142,8 +142,8 @@ func newAuthSetTokenCmd(flags *rootFlags) *cobra.Command {
 
 func newAuthLogoutCmd(flags *rootFlags) *cobra.Command {
 	return &cobra.Command{
-		Use:   "logout",
-		Short: "Clear stored credentials",
+		Use:     "logout",
+		Short:   "Clear stored credentials",
 		Example: "  printing-press-golden-pp-cli auth logout",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			cfg, err := config.Load(flags.configPath)
diff --git a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/doctor.go b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/doctor.go
index 6a62a438..065df457 100644
--- a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/doctor.go
+++ b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/doctor.go
@@ -13,10 +13,10 @@ import (
 	"strings"
 	"time"
 
+	"github.com/spf13/cobra"
 	"printing-press-golden-pp-cli/internal/client"
 	"printing-press-golden-pp-cli/internal/config"
 	"printing-press-golden-pp-cli/internal/store"
-	"github.com/spf13/cobra"
 )
 
 // looksLikeDoctorInterstitial reports whether the response body matches a known
diff --git a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/helpers.go b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/helpers.go
index d2f780d6..7b15713f 100644
--- a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/helpers.go
+++ b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/helpers.go
@@ -8,19 +8,19 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
 	"io"
 	"os"
 	"path/filepath"
+	"printing-press-golden-pp-cli/internal/client"
+	"printing-press-golden-pp-cli/internal/cliutil"
 	"regexp"
 	"sort"
 	"strings"
 	"text/tabwriter"
 	"time"
 	"unicode"
-	"printing-press-golden-pp-cli/internal/cliutil"
-	"printing-press-golden-pp-cli/internal/client"
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
 )
 
 var As = errors.As
@@ -94,11 +94,11 @@ type cliError struct {
 func (e *cliError) Error() string { return e.err.Error() }
 func (e *cliError) Unwrap() error { return e.err }
 
-func usageErr(err error) error    { return &cliError{code: 2, err: err} }
-func notFoundErr(err error) error { return &cliError{code: 3, err: err} }
-func authErr(err error) error     { return &cliError{code: 4, err: err} }
-func apiErr(err error) error      { return &cliError{code: 5, err: err} }
-func configErr(err error) error   { return &cliError{code: 10, err: err} }
+func usageErr(err error) error     { return &cliError{code: 2, err: err} }
+func notFoundErr(err error) error  { return &cliError{code: 3, err: err} }
+func authErr(err error) error      { return &cliError{code: 4, err: err} }
+func apiErr(err error) error       { return &cliError{code: 5, err: err} }
+func configErr(err error) error    { return &cliError{code: 10, err: err} }
 func rateLimitErr(err error) error { return &cliError{code: 7, err: err} }
 
 // dryRunOK reports whether the command should short-circuit without doing any
@@ -1184,12 +1184,13 @@ func findField(obj map[string]any, names ...string) string {
 	}
 	return ""
 }
+
 // DataProvenance describes where data came from and when it was last synced.
 type DataProvenance struct {
 	Source       string     `json:"source"`                  // "live" or "local"
-	SyncedAt    *time.Time `json:"synced_at,omitempty"`     // when local data was last synced
-	Reason      string     `json:"reason,omitempty"`        // why local was used: "user_requested", "api_unreachable", "no_search_endpoint"
-	ResourceType string    `json:"resource_type,omitempty"` // which resource type was queried
+	SyncedAt     *time.Time `json:"synced_at,omitempty"`     // when local data was last synced
+	Reason       string     `json:"reason,omitempty"`        // why local was used: "user_requested", "api_unreachable", "no_search_endpoint"
+	ResourceType string     `json:"resource_type,omitempty"` // which resource type was queried
 	Freshness    any        `json:"freshness,omitempty"`     // optional machine-owned freshness metadata for covered command paths
 }
 
diff --git a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/projects_create.go b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/projects_create.go
index 444fff2d..952292b0 100644
--- a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/projects_create.go
+++ b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/projects_create.go
@@ -19,9 +19,9 @@ func newProjectsCreateCmd(flags *rootFlags) *cobra.Command {
 	var stdinBody bool
 
 	cmd := &cobra.Command{
-		Use:   "create",
-		Short: "Create project",
-		Example: "  printing-press-golden-pp-cli projects create --name example-resource",
+		Use:         "create",
+		Short:       "Create project",
+		Example:     "  printing-press-golden-pp-cli projects create --name example-resource",
 		Annotations: map[string]string{"pp:endpoint": "projects.create", "pp:method": "POST", "pp:path": "/projects"},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if !stdinBody {
@@ -75,7 +75,9 @@ func newProjectsCreateCmd(flags *rootFlags) *cobra.Command {
 						return nil
 					}
 				} else {
-					var wrapped struct{ Data []map[string]any `json:"data"` }
+					var wrapped struct {
+						Data []map[string]any `json:"data"`
+					}
 					if json.Unmarshal(data, &wrapped) == nil && len(wrapped.Data) > 0 {
 						if err := printAutoTable(cmd.OutOrStdout(), wrapped.Data); err != nil {
 							fmt.Fprintf(os.Stderr, "warning: table rendering failed, falling back to JSON: %v\n", err)
diff --git a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/projects_list.go b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/projects_list.go
index 2e250f60..471f181c 100644
--- a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/projects_list.go
+++ b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/projects_list.go
@@ -18,13 +18,13 @@ func newProjectsListCmd(flags *rootFlags) *cobra.Command {
 	var flagAll bool
 
 	cmd := &cobra.Command{
-		Use:   "list",
-		Short: "List projects",
-		Example: "  printing-press-golden-pp-cli projects list",
+		Use:         "list",
+		Short:       "List projects",
+		Example:     "  printing-press-golden-pp-cli projects list",
 		Annotations: map[string]string{"pp:endpoint": "projects.list", "pp:method": "GET", "pp:path": "/projects", "mcp:read-only": "true"},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if cmd.Flags().Changed("status") {
-				allowedStatus := []string{ "draft", "active", "archived" }
+				allowedStatus := []string{"draft", "active", "archived"}
 				validStatus := false
 				for _, v := range allowedStatus {
 					if flagStatus == v {
@@ -44,7 +44,7 @@ func newProjectsListCmd(flags *rootFlags) *cobra.Command {
 			path := "/projects"
 			data, prov, err := resolvePaginatedRead(cmd.Context(), c, flags, "projects", path, map[string]string{
 				"status": fmt.Sprintf("%v", flagStatus),
-				"limit": fmt.Sprintf("%v", flagLimit),
+				"limit":  fmt.Sprintf("%v", flagLimit),
 				"cursor": fmt.Sprintf("%v", flagCursor),
 			}, nil, flagAll, "cursor", "", "")
 			if err != nil {
diff --git a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/projects_tasks_list-project.go b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/projects_tasks_list-project.go
index 14a04515..5ac7f8d9 100644
--- a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/projects_tasks_list-project.go
+++ b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/projects_tasks_list-project.go
@@ -18,17 +18,17 @@ func newProjectsTasksListProjectCmd(flags *rootFlags) *cobra.Command {
 	var flagAll bool
 
 	cmd := &cobra.Command{
-		Use:   "list-project <projectId>",
-		Aliases: []string{"get"},
-		Short: "List project tasks",
-		Example: "  printing-press-golden-pp-cli projects tasks list-project 550e8400-e29b-41d4-a716-446655440000",
+		Use:         "list-project <projectId>",
+		Aliases:     []string{"get"},
+		Short:       "List project tasks",
+		Example:     "  printing-press-golden-pp-cli projects tasks list-project 550e8400-e29b-41d4-a716-446655440000",
 		Annotations: map[string]string{"pp:endpoint": "tasks.list-project", "pp:method": "GET", "pp:path": "/projects/{projectId}/tasks", "mcp:read-only": "true"},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if len(args) == 0 {
 				return cmd.Help()
 			}
 			if cmd.Flags().Changed("priority") {
-				allowedPriority := []string{ "low", "normal", "high" }
+				allowedPriority := []string{"low", "normal", "high"}
 				validPriority := false
 				for _, v := range allowedPriority {
 					if flagPriority == v {
@@ -49,8 +49,8 @@ func newProjectsTasksListProjectCmd(flags *rootFlags) *cobra.Command {
 			path = replacePathParam(path, "projectId", args[0])
 			data, prov, err := resolvePaginatedRead(cmd.Context(), c, flags, "tasks", path, map[string]string{
 				"priority": fmt.Sprintf("%v", flagPriority),
-				"limit": fmt.Sprintf("%v", flagLimit),
-				"cursor": fmt.Sprintf("%v", flagCursor),
+				"limit":    fmt.Sprintf("%v", flagLimit),
+				"cursor":   fmt.Sprintf("%v", flagCursor),
 			}, nil, flagAll, "cursor", "", "")
 			if err != nil {
 				return classifyAPIError(err, flags)
diff --git a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/projects_tasks_update-project.go b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/projects_tasks_update-project.go
index 6fb67a3e..8ea8114a 100644
--- a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/projects_tasks_update-project.go
+++ b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/projects_tasks_update-project.go
@@ -19,10 +19,10 @@ func newProjectsTasksUpdateProjectCmd(flags *rootFlags) *cobra.Command {
 	var stdinBody bool
 
 	cmd := &cobra.Command{
-		Use:   "update-project <projectId> <taskId>",
-		Aliases: []string{"update"},
-		Short: "Update project task",
-		Example: "  printing-press-golden-pp-cli projects tasks update-project 550e8400-e29b-41d4-a716-446655440000 550e8400-e29b-41d4-a716-446655440000",
+		Use:         "update-project <projectId> <taskId>",
+		Aliases:     []string{"update"},
+		Short:       "Update project task",
+		Example:     "  printing-press-golden-pp-cli projects tasks update-project 550e8400-e29b-41d4-a716-446655440000 550e8400-e29b-41d4-a716-446655440000",
 		Annotations: map[string]string{"pp:endpoint": "tasks.update-project", "pp:method": "PATCH", "pp:path": "/projects/{projectId}/tasks/{taskId}"},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if len(args) == 0 {
@@ -78,7 +78,9 @@ func newProjectsTasksUpdateProjectCmd(flags *rootFlags) *cobra.Command {
 						return nil
 					}
 				} else {
-					var wrapped struct{ Data []map[string]any `json:"data"` }
+					var wrapped struct {
+						Data []map[string]any `json:"data"`
+					}
 					if json.Unmarshal(data, &wrapped) == nil && len(wrapped.Data) > 0 {
 						if err := printAutoTable(cmd.OutOrStdout(), wrapped.Data); err != nil {
 							fmt.Fprintf(os.Stderr, "warning: table rendering failed, falling back to JSON: %v\n", err)
diff --git a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/promoted_public.go b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/promoted_public.go
index 592dd582..967f9f59 100644
--- a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/promoted_public.go
+++ b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/promoted_public.go
@@ -14,10 +14,10 @@ import (
 func newPublicPromotedCmd(flags *rootFlags) *cobra.Command {
 
 	cmd := &cobra.Command{
-		Use:   "public",
-		Short: "Get public service status",
-		Long:  "Shortcut for 'public get-status'. Get public service status",
-		Example: "  printing-press-golden-pp-cli public",
+		Use:         "public",
+		Short:       "Get public service status",
+		Long:        "Shortcut for 'public get-status'. Get public service status",
+		Example:     "  printing-press-golden-pp-cli public",
 		Annotations: map[string]string{"pp:endpoint": "public.get-status", "pp:method": "GET", "pp:path": "/public/status", "mcp:read-only": "true"},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			c, err := flags.newClient()
diff --git a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/root.go b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/root.go
index d8ce88a1..218d9a66 100644
--- a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/root.go
+++ b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/root.go
@@ -12,32 +12,32 @@ import (
 	"text/tabwriter"
 	"time"
 
+	"github.com/spf13/cobra"
 	"printing-press-golden-pp-cli/internal/client"
 	"printing-press-golden-pp-cli/internal/config"
-	"github.com/spf13/cobra"
 )
 
 var version = "1.0.0"
 
 type rootFlags struct {
-	asJSON       bool
-	compact      bool
-	csv          bool
-	plain        bool
-	quiet        bool
-	dryRun       bool
-	noCache      bool
-	noInput      bool
-	idempotent   bool
-	yes          bool
-	agent        bool
-	selectFields string
-	configPath   string
-	profileName  string
-	deliverSpec  string
-	timeout      time.Duration
-	rateLimit    float64
-	dataSource   string
+	asJSON        bool
+	compact       bool
+	csv           bool
+	plain         bool
+	quiet         bool
+	dryRun        bool
+	noCache       bool
+	noInput       bool
+	idempotent    bool
+	yes           bool
+	agent         bool
+	selectFields  string
+	configPath    string
+	profileName   string
+	deliverSpec   string
+	timeout       time.Duration
+	rateLimit     float64
+	dataSource    string
 	freshnessMeta any
 
 	// deliverBuf captures command output when --deliver is set to a
diff --git a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/sync.go b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/sync.go
index 0118d655..abfee310 100644
--- a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/sync.go
+++ b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/cli/sync.go
@@ -6,16 +6,16 @@ package cli
 import (
 	"encoding/json"
 	"fmt"
+	"github.com/spf13/cobra"
 	"net/url"
 	"os"
+	"printing-press-golden-pp-cli/internal/store"
 	"regexp"
 	"strconv"
 	"strings"
 	"sync"
 	"sync/atomic"
 	"time"
-	"printing-press-golden-pp-cli/internal/store"
-	"github.com/spf13/cobra"
 )
 
 // unresolvedPathKeyRE matches `{key}` placeholders left in a sync path
@@ -818,8 +818,7 @@ type discriminatorDispatch struct {
 	Values map[string]string
 }
 
-var discriminatorDispatchers = map[string]discriminatorDispatch{
-}
+var discriminatorDispatchers = map[string]discriminatorDispatch{}
 
 func upsertResourceBatch(db *store.Store, resource string, items []json.RawMessage) (int, int, error) {
 	if _, ok := discriminatorDispatchers[resource]; !ok {
@@ -936,7 +935,7 @@ func defaultSyncResources() []string {
 func syncResourcePath(resource string) (string, error) {
 	paths := map[string]string{
 		"currencies": "/currencies",
-		"projects": "/projects",
+		"projects":   "/projects",
 	}
 	if p, ok := paths[resource]; ok {
 		return p, nil
@@ -1205,7 +1204,7 @@ func syncDependentResource(c interface {
 // flat paths.
 var resourceIDFieldOverrides = map[string]string{
 	"projects": "id",
-	"tasks": "id",
+	"tasks":    "id",
 }
 
 // genericIDFieldFallbacks is the runtime safety net for resources that did
diff --git a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/client/client.go b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/client/client.go
index fa42b072..47cf766f 100644
--- a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/client/client.go
+++ b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/client/client.go
@@ -14,11 +14,11 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"printing-press-golden-pp-cli/internal/cliutil"
+	"printing-press-golden-pp-cli/internal/config"
 	"sort"
 	"strings"
 	"time"
-	"printing-press-golden-pp-cli/internal/cliutil"
-	"printing-press-golden-pp-cli/internal/config"
 )
 
 type Client struct {
@@ -31,8 +31,6 @@ type Client struct {
 	limiter    *cliutil.AdaptiveLimiter
 }
 
-
-
 // APIError carries HTTP status information for structured exit codes.
 type APIError struct {
 	Method     string
@@ -397,7 +395,6 @@ func sanitizeJSONResponse(body []byte) []byte {
 	return body
 }
 
-
 // maskToken redacts all but the last 4 characters of a token for safe display.
 func maskToken(token string) string {
 	if token == "" {
diff --git a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/config/config.go b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/config/config.go
index cb12c836..612ec5a6 100644
--- a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/config/config.go
+++ b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/config/config.go
@@ -14,17 +14,17 @@ import (
 )
 
 type Config struct {
-	BaseURL        string `toml:"base_url"`
-	AuthHeaderVal  string `toml:"auth_header"`
-	Headers        map[string]string `toml:"headers,omitempty"`
-	AuthSource     string `toml:"-"`
-	AccessToken    string `toml:"access_token"`
-	RefreshToken   string `toml:"refresh_token"`
-	TokenExpiry    time.Time `toml:"token_expiry"`
-	ClientID       string `toml:"client_id"`
-	ClientSecret   string `toml:"client_secret"`
-	Path           string `toml:"-"`
-	PrintingPressGoldenApiKey string `toml:"press_golden_api_key"`
+	BaseURL                   string            `toml:"base_url"`
+	AuthHeaderVal             string            `toml:"auth_header"`
+	Headers                   map[string]string `toml:"headers,omitempty"`
+	AuthSource                string            `toml:"-"`
+	AccessToken               string            `toml:"access_token"`
+	RefreshToken              string            `toml:"refresh_token"`
+	TokenExpiry               time.Time         `toml:"token_expiry"`
+	ClientID                  string            `toml:"client_id"`
+	ClientSecret              string            `toml:"client_secret"`
+	Path                      string            `toml:"-"`
+	PrintingPressGoldenApiKey string            `toml:"press_golden_api_key"`
 }
 
 func Load(configPath string) (*Config, error) {
diff --git a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/mcp/tools.go b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/mcp/tools.go
index ed9200fe..f48f6e6f 100644
--- a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/mcp/tools.go
+++ b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/mcp/tools.go
@@ -15,8 +15,8 @@ import (
 	mcplib "github.com/mark3labs/mcp-go/mcp"
 	"github.com/mark3labs/mcp-go/server"
 	"printing-press-golden-pp-cli/internal/cli"
-	"printing-press-golden-pp-cli/internal/cliutil"
 	"printing-press-golden-pp-cli/internal/client"
+	"printing-press-golden-pp-cli/internal/cliutil"
 	"printing-press-golden-pp-cli/internal/config"
 	"printing-press-golden-pp-cli/internal/mcp/cobratree"
 	"printing-press-golden-pp-cli/internal/store"
@@ -31,7 +31,7 @@ func RegisterTools(s *server.MCPServer) {
 			mcplib.WithDestructiveHintAnnotation(false),
 			mcplib.WithOpenWorldHintAnnotation(true),
 		),
-		makeAPIHandler("GET", "/currencies", []mcpParamBinding{ }, []string{ }),
+		makeAPIHandler("GET", "/currencies", []mcpParamBinding{}, []string{}),
 	)
 	s.AddTool(
 		mcplib.NewTool("projects_create",
@@ -42,7 +42,7 @@ func RegisterTools(s *server.MCPServer) {
 			mcplib.WithDestructiveHintAnnotation(false),
 			mcplib.WithOpenWorldHintAnnotation(true),
 		),
-		makeAPIHandler("POST", "/projects", []mcpParamBinding{{PublicName: "name", WireName: "name", Location: "body"},{PublicName: "owner_email", WireName: "owner_email", Location: "body"},{PublicName: "visibility", WireName: "visibility", Location: "body"}, }, []string{ }),
+		makeAPIHandler("POST", "/projects", []mcpParamBinding{{PublicName: "name", WireName: "name", Location: "body"}, {PublicName: "owner_email", WireName: "owner_email", Location: "body"}, {PublicName: "visibility", WireName: "visibility", Location: "body"}}, []string{}),
 	)
 	s.AddTool(
 		mcplib.NewTool("projects_get",
@@ -52,7 +52,7 @@ func RegisterTools(s *server.MCPServer) {
 			mcplib.WithDestructiveHintAnnotation(false),
 			mcplib.WithOpenWorldHintAnnotation(true),
 		),
-		makeAPIHandler("GET", "/projects/{projectId}", []mcpParamBinding{{PublicName: "projectId", WireName: "projectId", Location: "path"}, }, []string{"projectId", }),
+		makeAPIHandler("GET", "/projects/{projectId}", []mcpParamBinding{{PublicName: "projectId", WireName: "projectId", Location: "path"}}, []string{"projectId"}),
 	)
 	s.AddTool(
 		mcplib.NewTool("projects_list",
@@ -64,7 +64,7 @@ func RegisterTools(s *server.MCPServer) {
 			mcplib.WithDestructiveHintAnnotation(false),
 			mcplib.WithOpenWorldHintAnnotation(true),
 		),
-		makeAPIHandler("GET", "/projects", []mcpParamBinding{{PublicName: "status", WireName: "status", Location: "query"},{PublicName: "limit", WireName: "limit", Location: "query"},{PublicName: "cursor", WireName: "cursor", Location: "query"}, }, []string{ }),
+		makeAPIHandler("GET", "/projects", []mcpParamBinding{{PublicName: "status", WireName: "status", Location: "query"}, {PublicName: "limit", WireName: "limit", Location: "query"}, {PublicName: "cursor", WireName: "cursor", Location: "query"}}, []string{}),
 	)
 	s.AddTool(
 		mcplib.NewTool("projects_tasks_list-project",
@@ -77,7 +77,7 @@ func RegisterTools(s *server.MCPServer) {
 			mcplib.WithDestructiveHintAnnotation(false),
 			mcplib.WithOpenWorldHintAnnotation(true),
 		),
-		makeAPIHandler("GET", "/projects/{projectId}/tasks", []mcpParamBinding{{PublicName: "projectId", WireName: "projectId", Location: "path"},{PublicName: "priority", WireName: "priority", Location: "query"},{PublicName: "limit", WireName: "limit", Location: "query"},{PublicName: "cursor", WireName: "cursor", Location: "query"}, }, []string{"projectId", }),
+		makeAPIHandler("GET", "/projects/{projectId}/tasks", []mcpParamBinding{{PublicName: "projectId", WireName: "projectId", Location: "path"}, {PublicName: "priority", WireName: "priority", Location: "query"}, {PublicName: "limit", WireName: "limit", Location: "query"}, {PublicName: "cursor", WireName: "cursor", Location: "query"}}, []string{"projectId"}),
 	)
 	s.AddTool(
 		mcplib.NewTool("projects_tasks_update-project",
@@ -89,7 +89,7 @@ func RegisterTools(s *server.MCPServer) {
 			mcplib.WithString("title", mcplib.Description("Title")),
 			mcplib.WithOpenWorldHintAnnotation(true),
 		),
-		makeAPIHandler("PATCH", "/projects/{projectId}/tasks/{taskId}", []mcpParamBinding{{PublicName: "projectId", WireName: "projectId", Location: "path"},{PublicName: "taskId", WireName: "taskId", Location: "path"},{PublicName: "completed", WireName: "completed", Location: "body"},{PublicName: "priority", WireName: "priority", Location: "body"},{PublicName: "title", WireName: "title", Location: "body"}, }, []string{"projectId","taskId", }),
+		makeAPIHandler("PATCH", "/projects/{projectId}/tasks/{taskId}", []mcpParamBinding{{PublicName: "projectId", WireName: "projectId", Location: "path"}, {PublicName: "taskId", WireName: "taskId", Location: "path"}, {PublicName: "completed", WireName: "completed", Location: "body"}, {PublicName: "priority", WireName: "priority", Location: "body"}, {PublicName: "title", WireName: "title", Location: "body"}}, []string{"projectId", "taskId"}),
 	)
 	s.AddTool(
 		mcplib.NewTool("public_get-status",
@@ -98,7 +98,7 @@ func RegisterTools(s *server.MCPServer) {
 			mcplib.WithDestructiveHintAnnotation(false),
 			mcplib.WithOpenWorldHintAnnotation(true),
 		),
-		makeAPIHandler("GET", "/public/status", []mcpParamBinding{ }, []string{ }),
+		makeAPIHandler("GET", "/public/status", []mcpParamBinding{}, []string{}),
 	)
 	s.AddTool(
 		mcplib.NewTool("reports_summary_get-report-year",
@@ -108,7 +108,7 @@ func RegisterTools(s *server.MCPServer) {
 			mcplib.WithDestructiveHintAnnotation(false),
 			mcplib.WithOpenWorldHintAnnotation(true),
 		),
-		makeAPIHandler("GET", "/reports/{year}/summary", []mcpParamBinding{{PublicName: "year", WireName: "year", Location: "path"}, }, []string{"year", }),
+		makeAPIHandler("GET", "/reports/{year}/summary", []mcpParamBinding{{PublicName: "year", WireName: "year", Location: "path"}}, []string{"year"}),
 	)
 	// Search tool — faster than iterating list endpoints for finding specific items
 	s.AddTool(
@@ -306,6 +306,7 @@ func dbPath() string {
 	home, _ := os.UserHomeDir()
 	return filepath.Join(home, ".local", "share", "printing-press-golden-pp-cli", "data.db")
 }
+
 // Note: MCP tools use their own dbPath() because they are in a separate package (main, not cli).
 // The CLI's defaultDBPath() in the cli package uses the same canonical path.
 
@@ -445,37 +446,37 @@ func handleContext(_ context.Context, _ mcplib.CallToolRequest) (*mcplib.CallToo
 			"type": "api_key",
 			"env_vars": []map[string]any{
 				{
-					"name": "PRINTING_PRESS_GOLDEN_API_KEY",
-					"kind": "per_call",
-					"required": true,
-					"sensitive": true,
+					"name":        "PRINTING_PRESS_GOLDEN_API_KEY",
+					"kind":        "per_call",
+					"required":    true,
+					"sensitive":   true,
 					"description": "Set to your API credential.",
 				},
 			},
 		},
 		"resources": []map[string]any{
 			{
-				"name": "currencies",
+				"name":        "currencies",
 				"description": "Manage currencies",
-				"endpoints": []string{"list",  },
-				"syncable": true,
+				"endpoints":   []string{"list"},
+				"syncable":    true,
 			},
 			{
-				"name": "projects",
+				"name":        "projects",
 				"description": "Manage projects",
-				"endpoints": []string{"create", "get", "list",  },
-				"syncable": true,
-				"searchable": true,
+				"endpoints":   []string{"create", "get", "list"},
+				"syncable":    true,
+				"searchable":  true,
 			},
 			{
-				"name": "public",
+				"name":        "public",
 				"description": "Manage public",
-				"endpoints": []string{"get-status",  },
+				"endpoints":   []string{"get-status"},
 			},
 			{
-				"name": "reports",
+				"name":        "reports",
 				"description": "Manage reports",
-				"endpoints": []string{ },
+				"endpoints":   []string{},
 			},
 		},
 		"query_tips": []string{
diff --git a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/types/types.go b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/types/types.go
index 0cecb7b0..dfb8a50d 100644
--- a/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/types/types.go
+++ b/testdata/golden/expected/generate-golden-api/printing-press-golden/internal/types/types.go
@@ -3,36 +3,35 @@
 
 package types
 
-
 type CreateProjectRequest struct {
-	Name string `json:"name"`
+	Name       string `json:"name"`
 	OwnerEmail string `json:"owner_email"`
 	Visibility string `json:"visibility"`
 }
 
 type Currency struct {
-	Code string `json:"code"`
-	Decimals int `json:"decimals"`
-	Symbol string `json:"symbol"`
+	Code     string `json:"code"`
+	Decimals int    `json:"decimals"`
+	Symbol   string `json:"symbol"`
 }
 
 type Project struct {
-	Id string `json:"id"`
-	Name string `json:"name"`
-	Status string `json:"status"`
+	Id         string `json:"id"`
+	Name       string `json:"name"`
+	Status     string `json:"status"`
 	Visibility string `json:"visibility"`
 }
 
 type Task struct {
-	DueAt string `json:"due_at"`
-	Id string `json:"id"`
-	Priority string `json:"priority"`
+	DueAt     string `json:"due_at"`
+	Id        string `json:"id"`
+	Priority  string `json:"priority"`
 	ProjectId string `json:"project_id"`
-	Title string `json:"title"`
+	Title     string `json:"title"`
 }
 
 type UpdateTaskRequest struct {
-	Completed bool `json:"completed"`
-	Priority string `json:"priority"`
-	Title string `json:"title"`
+	Completed bool   `json:"completed"`
+	Priority  string `json:"priority"`
+	Title     string `json:"title"`
 }
diff --git a/testdata/golden/expected/generate-mcp-api/mcp-cloudflare/internal/mcp/code_orch.go b/testdata/golden/expected/generate-mcp-api/mcp-cloudflare/internal/mcp/code_orch.go
index 7ea169ef..c8e7b386 100644
--- a/testdata/golden/expected/generate-mcp-api/mcp-cloudflare/internal/mcp/code_orch.go
+++ b/testdata/golden/expected/generate-mcp-api/mcp-cloudflare/internal/mcp/code_orch.go
@@ -53,13 +53,13 @@ func RegisterCodeOrchestrationTools(s *server.MCPServer) {
 // lowercase stream of description + path tokens used for naive ranking;
 // anything more sophisticated belongs on the agent side.
 type codeOrchEndpoint struct {
-	ID          string
-	Method      string
-	Path        string
-	Tier        string
-	Summary     string
-	Positional  []string
-	keywords    []string
+	ID         string
+	Method     string
+	Path       string
+	Tier       string
+	Summary    string
+	Positional []string
+	keywords   []string
 }
 
 // codeOrchEndpoints is the generator-populated registry covering every
@@ -67,12 +67,12 @@ type codeOrchEndpoint struct {
 // via <api>_search, so hierarchy shows up as dotted IDs, not nested maps.
 var codeOrchEndpoints = []codeOrchEndpoint{
 	{
-		ID:      "items.list",
-		Method:  "GET",
-		Path:    "/items",
-		Summary: "List items",
-		Positional: []string{ },
-		keywords: codeOrchKeywords("items", "list", "List items", "/items"),
+		ID:         "items.list",
+		Method:     "GET",
+		Path:       "/items",
+		Summary:    "List items",
+		Positional: []string{},
+		keywords:   codeOrchKeywords("items", "list", "List items", "/items"),
 	},
 }
 
diff --git a/testdata/golden/expected/generate-mcp-api/mcp-cloudflare/internal/mcp/tools.go b/testdata/golden/expected/generate-mcp-api/mcp-cloudflare/internal/mcp/tools.go
index 20acfcbd..c5f8efeb 100644
--- a/testdata/golden/expected/generate-mcp-api/mcp-cloudflare/internal/mcp/tools.go
+++ b/testdata/golden/expected/generate-mcp-api/mcp-cloudflare/internal/mcp/tools.go
@@ -15,8 +15,8 @@ import (
 	mcplib "github.com/mark3labs/mcp-go/mcp"
 	"github.com/mark3labs/mcp-go/server"
 	"mcp-cloudflare-pp-cli/internal/cli"
-	"mcp-cloudflare-pp-cli/internal/cliutil"
 	"mcp-cloudflare-pp-cli/internal/client"
+	"mcp-cloudflare-pp-cli/internal/cliutil"
 	"mcp-cloudflare-pp-cli/internal/config"
 	"mcp-cloudflare-pp-cli/internal/mcp/cobratree"
 	"mcp-cloudflare-pp-cli/internal/store"
@@ -212,6 +212,7 @@ func dbPath() string {
 	home, _ := os.UserHomeDir()
 	return filepath.Join(home, ".local", "share", "mcp-cloudflare-pp-cli", "data.db")
 }
+
 // Note: MCP tools use their own dbPath() because they are in a separate package (main, not cli).
 // The CLI's defaultDBPath() in the cli package uses the same canonical path.
 
@@ -324,20 +325,20 @@ func handleContext(_ context.Context, _ mcplib.CallToolRequest) (*mcplib.CallToo
 			"type": "api_key",
 			"env_vars": []map[string]any{
 				{
-					"name": "MCP_CLOUDFLARE_API_KEY",
-					"kind": "per_call",
-					"required": true,
-					"sensitive": true,
+					"name":        "MCP_CLOUDFLARE_API_KEY",
+					"kind":        "per_call",
+					"required":    true,
+					"sensitive":   true,
 					"description": "Set to your API credential.",
 				},
 			},
 		},
 		"resources": []map[string]any{
 			{
-				"name": "items",
+				"name":        "items",
 				"description": "Manage items",
-				"endpoints": []string{"list",  },
-				"syncable": true,
+				"endpoints":   []string{"list"},
+				"syncable":    true,
 			},
 		},
 		"query_tips": []string{
diff --git a/testdata/golden/expected/generate-public-param-names/public-param-golden/internal/cli/stores_create.go b/testdata/golden/expected/generate-public-param-names/public-param-golden/internal/cli/stores_create.go
index 94b550ba..8fe13fd8 100644
--- a/testdata/golden/expected/generate-public-param-names/public-param-golden/internal/cli/stores_create.go
+++ b/testdata/golden/expected/generate-public-param-names/public-param-golden/internal/cli/stores_create.go
@@ -17,9 +17,9 @@ func newStoresCreateCmd(flags *rootFlags) *cobra.Command {
 	var stdinBody bool
 
 	cmd := &cobra.Command{
-		Use:   "create",
-		Short: "Create a store record",
-		Example: "  public-param-golden-pp-cli stores create --store-code example-value",
+		Use:         "create",
+		Short:       "Create a store record",
+		Example:     "  public-param-golden-pp-cli stores create --store-code example-value",
 		Annotations: map[string]string{"pp:endpoint": "stores.create", "pp:method": "POST", "pp:path": "/stores"},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if !stdinBody {
@@ -64,7 +64,9 @@ func newStoresCreateCmd(flags *rootFlags) *cobra.Command {
 						return nil
 					}
 				} else {
-					var wrapped struct{ Data []map[string]any `json:"data"` }
+					var wrapped struct {
+						Data []map[string]any `json:"data"`
+					}
 					if json.Unmarshal(data, &wrapped) == nil && len(wrapped.Data) > 0 {
 						if err := printAutoTable(cmd.OutOrStdout(), wrapped.Data); err != nil {
 							fmt.Fprintf(os.Stderr, "warning: table rendering failed, falling back to JSON: %v\n", err)
diff --git a/testdata/golden/expected/generate-public-param-names/public-param-golden/internal/cli/stores_find.go b/testdata/golden/expected/generate-public-param-names/public-param-golden/internal/cli/stores_find.go
index e2ddce1f..afb941af 100644
--- a/testdata/golden/expected/generate-public-param-names/public-param-golden/internal/cli/stores_find.go
+++ b/testdata/golden/expected/generate-public-param-names/public-param-golden/internal/cli/stores_find.go
@@ -16,9 +16,9 @@ func newStoresFindCmd(flags *rootFlags) *cobra.Command {
 	var flagC string
 
 	cmd := &cobra.Command{
-		Use:   "find",
-		Short: "Find nearby stores by address",
-		Example: "  public-param-golden-pp-cli stores find --address example-value --city example-value",
+		Use:         "find",
+		Short:       "Find nearby stores by address",
+		Example:     "  public-param-golden-pp-cli stores find --address example-value --city example-value",
 		Annotations: map[string]string{"pp:endpoint": "stores.find", "pp:method": "GET", "pp:path": "/power/store-locator", "mcp:read-only": "true"},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if !(cmd.Flags().Changed("address") || cmd.Flags().Changed("s")) && !flags.dryRun {
diff --git a/testdata/golden/expected/generate-public-param-names/public-param-golden/internal/mcp/tools.go b/testdata/golden/expected/generate-public-param-names/public-param-golden/internal/mcp/tools.go
index 72980e0a..8401c7f6 100644
--- a/testdata/golden/expected/generate-public-param-names/public-param-golden/internal/mcp/tools.go
+++ b/testdata/golden/expected/generate-public-param-names/public-param-golden/internal/mcp/tools.go
@@ -29,7 +29,7 @@ func RegisterTools(s *server.MCPServer) {
 			mcplib.WithDestructiveHintAnnotation(false),
 			mcplib.WithOpenWorldHintAnnotation(true),
 		),
-		makeAPIHandler("POST", "/stores", []mcpParamBinding{{PublicName: "store-code", WireName: "store_code", Location: "body"}, }, []string{ }),
+		makeAPIHandler("POST", "/stores", []mcpParamBinding{{PublicName: "store-code", WireName: "store_code", Location: "body"}}, []string{}),
 	)
 	s.AddTool(
 		mcplib.NewTool("stores_find",
@@ -40,7 +40,7 @@ func RegisterTools(s *server.MCPServer) {
 			mcplib.WithDestructiveHintAnnotation(false),
 			mcplib.WithOpenWorldHintAnnotation(true),
 		),
-		makeAPIHandler("GET", "/power/store-locator", []mcpParamBinding{{PublicName: "address", WireName: "s", Location: "query"},{PublicName: "city", WireName: "c", Location: "query"}, }, []string{ }),
+		makeAPIHandler("GET", "/power/store-locator", []mcpParamBinding{{PublicName: "address", WireName: "s", Location: "query"}, {PublicName: "city", WireName: "c", Location: "query"}}, []string{}),
 	)
 
 	// Context tool — front-loaded domain knowledge for agents.
@@ -210,6 +210,7 @@ func dbPath() string {
 	home, _ := os.UserHomeDir()
 	return filepath.Join(home, ".local", "share", "public-param-golden-pp-cli", "data.db")
 }
+
 // Note: MCP tools use their own dbPath() because they are in a separate package (main, not cli).
 // The CLI's defaultDBPath() in the cli package uses the same canonical path.
 
@@ -223,10 +224,10 @@ func handleContext(_ context.Context, _ mcplib.CallToolRequest) (*mcplib.CallToo
 		"tool_surface": "MCP exposes typed endpoint tools plus a runtime mirror of user-facing CLI commands. Endpoint tools keep typed schemas; command-mirror tools shell out to the companion public-param-golden-pp-cli binary.",
 		"resources": []map[string]any{
 			{
-				"name": "stores",
+				"name":        "stores",
 				"description": "Store lookup operations",
-				"endpoints": []string{"create", "find",  },
-				"searchable": true,
+				"endpoints":   []string{"create", "find"},
+				"searchable":  true,
 			},
 		},
 		"query_tips": []string{
diff --git a/testdata/golden/expected/generate-sync-walker-api/sync-walker-golden/internal/cli/promoted_games.go b/testdata/golden/expected/generate-sync-walker-api/sync-walker-golden/internal/cli/promoted_games.go
index 219562c3..4df2359a 100644
--- a/testdata/golden/expected/generate-sync-walker-api/sync-walker-golden/internal/cli/promoted_games.go
+++ b/testdata/golden/expected/generate-sync-walker-api/sync-walker-golden/internal/cli/promoted_games.go
@@ -14,10 +14,10 @@ import (
 func newGamesPromotedCmd(flags *rootFlags) *cobra.Command {
 
 	cmd := &cobra.Command{
-		Use:   "games",
-		Short: "List games",
-		Long:  "Shortcut for 'games list'. List games",
-		Example: "  sync-walker-golden-pp-cli games",
+		Use:         "games",
+		Short:       "List games",
+		Long:        "Shortcut for 'games list'. List games",
+		Example:     "  sync-walker-golden-pp-cli games",
 		Annotations: map[string]string{"pp:endpoint": "games.list", "pp:method": "GET", "pp:path": "/games", "mcp:read-only": "true"},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			c, err := flags.newClient()
diff --git a/testdata/golden/expected/generate-sync-walker-api/sync-walker-golden/internal/cli/promoted_leagues.go b/testdata/golden/expected/generate-sync-walker-api/sync-walker-golden/internal/cli/promoted_leagues.go
index 31ae1d76..bd549e9e 100644
--- a/testdata/golden/expected/generate-sync-walker-api/sync-walker-golden/internal/cli/promoted_leagues.go
+++ b/testdata/golden/expected/generate-sync-walker-api/sync-walker-golden/internal/cli/promoted_leagues.go
@@ -14,10 +14,10 @@ import (
 func newLeaguesPromotedCmd(flags *rootFlags) *cobra.Command {
 
 	cmd := &cobra.Command{
-		Use:   "leagues <game_key>",
-		Short: "List leagues for a game",
-		Long:  "Shortcut for 'leagues list'. List leagues for a game",
-		Example: "  sync-walker-golden-pp-cli leagues your-token-here",
+		Use:         "leagues <game_key>",
+		Short:       "List leagues for a game",
+		Long:        "Shortcut for 'leagues list'. List leagues for a game",
+		Example:     "  sync-walker-golden-pp-cli leagues your-token-here",
 		Annotations: map[string]string{"pp:endpoint": "leagues.list", "pp:method": "GET", "pp:path": "/games/{game_key}/leagues", "mcp:read-only": "true"},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			c, err := flags.newClient()
diff --git a/testdata/golden/expected/generate-sync-walker-api/sync-walker-golden/internal/cli/sync.go b/testdata/golden/expected/generate-sync-walker-api/sync-walker-golden/internal/cli/sync.go
index 2e2aa4f8..04e9c926 100644
--- a/testdata/golden/expected/generate-sync-walker-api/sync-walker-golden/internal/cli/sync.go
+++ b/testdata/golden/expected/generate-sync-walker-api/sync-walker-golden/internal/cli/sync.go
@@ -6,16 +6,16 @@ package cli
 import (
 	"encoding/json"
 	"fmt"
+	"github.com/spf13/cobra"
 	"net/url"
 	"os"
 	"regexp"
 	"strconv"
 	"strings"
 	"sync"
+	"sync-walker-golden-pp-cli/internal/store"
 	"sync/atomic"
 	"time"
-	"sync-walker-golden-pp-cli/internal/store"
-	"github.com/spf13/cobra"
 )
 
 // unresolvedPathKeyRE matches `{key}` placeholders left in a sync path
@@ -818,8 +818,7 @@ type discriminatorDispatch struct {
 	Values map[string]string
 }
 
-var discriminatorDispatchers = map[string]discriminatorDispatch{
-}
+var discriminatorDispatchers = map[string]discriminatorDispatch{}
 
 func upsertResourceBatch(db *store.Store, resource string, items []json.RawMessage) (int, int, error) {
 	if _, ok := discriminatorDispatchers[resource]; !ok {
@@ -1216,8 +1215,7 @@ var pageItemKeys = []string{"data", "results", "items", "records", "nodes", "ent
 // Includes both flat resources and dependent (parent-child) resources so a
 // failed child sync flagged x-critical: true exits non-zero just like a
 // flat-resource critical failure.
-var criticalResources = map[string]bool{
-}
+var criticalResources = map[string]bool{}
 
 // extractID resolves an item's primary-key field. It consults the
 // per-resource templated override first; on miss, it falls through to the
diff --git a/testdata/golden/expected/generate-sync-walker-api/sync-walker-golden/internal/store/store.go b/testdata/golden/expected/generate-sync-walker-api/sync-walker-golden/internal/store/store.go
index 21316528..dbfaf727 100644
--- a/testdata/golden/expected/generate-sync-walker-api/sync-walker-golden/internal/store/store.go
+++ b/testdata/golden/expected/generate-sync-walker-api/sync-walker-golden/internal/store/store.go
@@ -733,6 +733,7 @@ func sqliteFieldValue(v any) any {
 func lookupFieldValue(obj map[string]any, snakeKey string) any {
 	return LookupFieldValue(obj, snakeKey)
 }
+
 // upsertLeaguesTx writes the typed-table portion of a leagues upsert
 // inside an existing transaction. The caller is responsible for the generic
 // resources insert (via upsertGenericResourceTx) and for committing the tx.
diff --git a/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/cli/doctor.go b/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/cli/doctor.go
index ea9b544e..c76d5c70 100644
--- a/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/cli/doctor.go
+++ b/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/cli/doctor.go
@@ -13,10 +13,10 @@ import (
 	"strings"
 	"time"
 
+	"github.com/spf13/cobra"
 	"tier-routing-golden-pp-cli/internal/client"
 	"tier-routing-golden-pp-cli/internal/config"
 	"tier-routing-golden-pp-cli/internal/store"
-	"github.com/spf13/cobra"
 )
 
 // looksLikeDoctorInterstitial reports whether the response body matches a known
diff --git a/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/cli/items_enterprise.go b/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/cli/items_enterprise.go
index 5410ebbc..e1b61c22 100644
--- a/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/cli/items_enterprise.go
+++ b/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/cli/items_enterprise.go
@@ -14,9 +14,9 @@ import (
 func newItemsEnterpriseCmd(flags *rootFlags) *cobra.Command {
 
 	cmd := &cobra.Command{
-		Use:   "enterprise",
-		Short: "List enterprise items",
-		Example: "  tier-routing-golden-pp-cli items enterprise",
+		Use:         "enterprise",
+		Short:       "List enterprise items",
+		Example:     "  tier-routing-golden-pp-cli items enterprise",
 		Annotations: map[string]string{"pp:endpoint": "items.enterprise", "pp:method": "GET", "pp:path": "/items/enterprise", "mcp:read-only": "true"},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			c, err := flags.newClient()
diff --git a/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/cli/items_list.go b/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/cli/items_list.go
index 88da2dd2..d6468679 100644
--- a/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/cli/items_list.go
+++ b/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/cli/items_list.go
@@ -15,9 +15,9 @@ func newItemsListCmd(flags *rootFlags) *cobra.Command {
 	var flagAll bool
 
 	cmd := &cobra.Command{
-		Use:   "list",
-		Short: "List free items",
-		Example: "  tier-routing-golden-pp-cli items list",
+		Use:         "list",
+		Short:       "List free items",
+		Example:     "  tier-routing-golden-pp-cli items list",
 		Annotations: map[string]string{"pp:endpoint": "items.list", "pp:method": "GET", "pp:path": "/items", "mcp:read-only": "true"},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			c, err := flags.newClient()
@@ -27,8 +27,7 @@ func newItemsListCmd(flags *rootFlags) *cobra.Command {
 			c = c.WithTier("free")
 
 			path := "/items"
-			data, prov, err := resolvePaginatedRead(cmd.Context(), c, flags, "items", path, map[string]string{
-			}, nil, flagAll, "cursor", "", "")
+			data, prov, err := resolvePaginatedRead(cmd.Context(), c, flags, "items", path, map[string]string{}, nil, flagAll, "cursor", "", "")
 			if err != nil {
 				return classifyAPIError(err, flags)
 			}
diff --git a/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/cli/items_premium.go b/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/cli/items_premium.go
index b0617769..15ca2c6f 100644
--- a/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/cli/items_premium.go
+++ b/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/cli/items_premium.go
@@ -14,9 +14,9 @@ import (
 func newItemsPremiumCmd(flags *rootFlags) *cobra.Command {
 
 	cmd := &cobra.Command{
-		Use:   "premium",
-		Short: "List paid items",
-		Example: "  tier-routing-golden-pp-cli items premium",
+		Use:         "premium",
+		Short:       "List paid items",
+		Example:     "  tier-routing-golden-pp-cli items premium",
 		Annotations: map[string]string{"pp:endpoint": "items.premium", "pp:method": "GET", "pp:path": "/items/premium", "mcp:read-only": "true"},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			c, err := flags.newClient()
diff --git a/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/cli/sync.go b/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/cli/sync.go
index 9c0abc9e..82cdd353 100644
--- a/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/cli/sync.go
+++ b/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/cli/sync.go
@@ -6,6 +6,7 @@ package cli
 import (
 	"encoding/json"
 	"fmt"
+	"github.com/spf13/cobra"
 	"net/url"
 	"os"
 	"regexp"
@@ -13,10 +14,9 @@ import (
 	"strings"
 	"sync"
 	"sync/atomic"
-	"time"
 	"tier-routing-golden-pp-cli/internal/client"
 	"tier-routing-golden-pp-cli/internal/store"
-	"github.com/spf13/cobra"
+	"time"
 )
 
 // unresolvedPathKeyRE matches `{key}` placeholders left in a sync path
@@ -792,8 +792,7 @@ type discriminatorDispatch struct {
 	Values map[string]string
 }
 
-var discriminatorDispatchers = map[string]discriminatorDispatch{
-}
+var discriminatorDispatchers = map[string]discriminatorDispatch{}
 
 func upsertResourceBatch(db *store.Store, resource string, items []json.RawMessage) (int, int, error) {
 	if _, ok := discriminatorDispatchers[resource]; !ok {
@@ -930,8 +929,7 @@ func syncClientForResource(c *client.Client, resource string) *client.Client {
 // Includes both flat resources and dependent (parent-child) resources so
 // annotations on a child path-item are honored at runtime, not just on
 // flat paths.
-var resourceIDFieldOverrides = map[string]string{
-}
+var resourceIDFieldOverrides = map[string]string{}
 
 // genericIDFieldFallbacks is the runtime safety net for resources that did
 // NOT receive a templated IDField. API-specific names belong in spec
@@ -948,8 +946,7 @@ var pageItemKeys = []string{"data", "results", "items", "records", "nodes", "ent
 // Includes both flat resources and dependent (parent-child) resources so a
 // failed child sync flagged x-critical: true exits non-zero just like a
 // flat-resource critical failure.
-var criticalResources = map[string]bool{
-}
+var criticalResources = map[string]bool{}
 
 // extractID resolves an item's primary-key field. It consults the
 // per-resource templated override first; on miss, it falls through to the
diff --git a/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/client/client.go b/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/client/client.go
index cf2edc6c..feb16071 100644
--- a/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/client/client.go
+++ b/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/client/client.go
@@ -16,19 +16,19 @@ import (
 	"path/filepath"
 	"sort"
 	"strings"
-	"time"
 	"tier-routing-golden-pp-cli/internal/cliutil"
 	"tier-routing-golden-pp-cli/internal/config"
+	"time"
 )
 
 type Client struct {
-	BaseURL    string
-	Config     *config.Config
-	HTTPClient *http.Client
-	DryRun     bool
-	NoCache    bool
-	cacheDir   string
-	limiter    *cliutil.AdaptiveLimiter
+	BaseURL     string
+	Config      *config.Config
+	HTTPClient  *http.Client
+	DryRun      bool
+	NoCache     bool
+	cacheDir    string
+	limiter     *cliutil.AdaptiveLimiter
 	requestTier string
 	limiters    map[string]*cliutil.AdaptiveLimiter
 }
@@ -52,8 +52,8 @@ func (c *Client) WithTier(tier string) *Client {
 func newTierLimiters(rateLimit float64) map[string]*cliutil.AdaptiveLimiter {
 	return map[string]*cliutil.AdaptiveLimiter{
 		"enterprise": cliutil.NewAdaptiveLimiter(rateLimit),
-		"free": cliutil.NewAdaptiveLimiter(rateLimit),
-		"paid": cliutil.NewAdaptiveLimiter(rateLimit),
+		"free":       cliutil.NewAdaptiveLimiter(rateLimit),
+		"paid":       cliutil.NewAdaptiveLimiter(rateLimit),
 	}
 }
 
@@ -91,9 +91,9 @@ func (c *Client) authForRequest() (requestAuth, error) {
 			return requestAuth{In: "header", Name: "Authorization"}, nil
 		}
 		value := applyTierAuthFormat("Bearer {access_token}", map[string]string{
-			"token": tierValue0,
-			"access_token": tierValue0,
-			"enterprise_token": tierValue0,
+			"token":                 tierValue0,
+			"access_token":          tierValue0,
+			"enterprise_token":      tierValue0,
 			"TIER_ENTERPRISE_TOKEN": tierValue0,
 		})
 		return requestAuth{Value: value, In: "header", Name: "Authorization"}, nil
@@ -125,8 +125,6 @@ func applyTierAuthFormat(format string, replacements map[string]string) string {
 	return format
 }
 
-
-
 // APIError carries HTTP status information for structured exit codes.
 type APIError struct {
 	Method     string
@@ -510,7 +508,6 @@ func sanitizeJSONResponse(body []byte) []byte {
 	return body
 }
 
-
 // maskToken redacts all but the last 4 characters of a token for safe display.
 func maskToken(token string) string {
 	if token == "" {
diff --git a/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/mcp/tools.go b/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/mcp/tools.go
index 75b1cb8c..f468b8b1 100644
--- a/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/mcp/tools.go
+++ b/testdata/golden/expected/generate-tier-routing-api/tier-routing-golden/internal/mcp/tools.go
@@ -15,8 +15,8 @@ import (
 	mcplib "github.com/mark3labs/mcp-go/mcp"
 	"github.com/mark3labs/mcp-go/server"
 	"tier-routing-golden-pp-cli/internal/cli"
-	"tier-routing-golden-pp-cli/internal/cliutil"
 	"tier-routing-golden-pp-cli/internal/client"
+	"tier-routing-golden-pp-cli/internal/cliutil"
 	"tier-routing-golden-pp-cli/internal/config"
 	"tier-routing-golden-pp-cli/internal/mcp/cobratree"
 	"tier-routing-golden-pp-cli/internal/store"
@@ -31,7 +31,7 @@ func RegisterTools(s *server.MCPServer) {
 			mcplib.WithDestructiveHintAnnotation(false),
 			mcplib.WithOpenWorldHintAnnotation(true),
 		),
-		makeAPIHandler("GET", "/items/enterprise", "enterprise", []mcpParamBinding{ }, []string{ }),
+		makeAPIHandler("GET", "/items/enterprise", "enterprise", []mcpParamBinding{}, []string{}),
 	)
 	s.AddTool(
 		mcplib.NewTool("items_list",
@@ -40,7 +40,7 @@ func RegisterTools(s *server.MCPServer) {
 			mcplib.WithDestructiveHintAnnotation(false),
 			mcplib.WithOpenWorldHintAnnotation(true),
 		),
-		makeAPIHandler("GET", "/items", "free", []mcpParamBinding{ }, []string{ }),
+		makeAPIHandler("GET", "/items", "free", []mcpParamBinding{}, []string{}),
 	)
 	s.AddTool(
 		mcplib.NewTool("items_premium",
@@ -49,7 +49,7 @@ func RegisterTools(s *server.MCPServer) {
 			mcplib.WithDestructiveHintAnnotation(false),
 			mcplib.WithOpenWorldHintAnnotation(true),
 		),
-		makeAPIHandler("GET", "/items/premium", "paid", []mcpParamBinding{ }, []string{ }),
+		makeAPIHandler("GET", "/items/premium", "paid", []mcpParamBinding{}, []string{}),
 	)
 	// SQL tool — ad-hoc analysis on synced data without API calls
 	s.AddTool(
@@ -237,6 +237,7 @@ func dbPath() string {
 	home, _ := os.UserHomeDir()
 	return filepath.Join(home, ".local", "share", "tier-routing-golden-pp-cli", "data.db")
 }
+
 // Note: MCP tools use their own dbPath() because they are in a separate package (main, not cli).
 // The CLI's defaultDBPath() in the cli package uses the same canonical path.
 
@@ -349,10 +350,10 @@ func handleContext(_ context.Context, _ mcplib.CallToolRequest) (*mcplib.CallToo
 			"type": "bearer_token",
 			"env_vars": []map[string]any{
 				{
-					"name": "TIER_GLOBAL_TOKEN",
-					"kind": "per_call",
-					"required": true,
-					"sensitive": true,
+					"name":        "TIER_GLOBAL_TOKEN",
+					"kind":        "per_call",
+					"required":    true,
+					"sensitive":   true,
 					"description": "Set to your API credential.",
 				},
 			},
@@ -364,10 +365,10 @@ func handleContext(_ context.Context, _ mcplib.CallToolRequest) (*mcplib.CallToo
 					"auth_type": "bearer_token",
 					"env_vars": []map[string]any{
 						{
-							"name": "TIER_ENTERPRISE_TOKEN",
-							"kind": "per_call",
-							"required": true,
-							"sensitive": true,
+							"name":        "TIER_ENTERPRISE_TOKEN",
+							"kind":        "per_call",
+							"required":    true,
+							"sensitive":   true,
 							"description": "Set to your API credential.",
 						},
 					},
@@ -377,13 +378,13 @@ func handleContext(_ context.Context, _ mcplib.CallToolRequest) (*mcplib.CallToo
 				},
 				"paid": map[string]any{
 					"auth_type": "api_key",
-					"base_url": "https://paid.api.example.com",
+					"base_url":  "https://paid.api.example.com",
 					"env_vars": []map[string]any{
 						{
-							"name": "TIER_PAID_KEY",
-							"kind": "per_call",
-							"required": true,
-							"sensitive": true,
+							"name":        "TIER_PAID_KEY",
+							"kind":        "per_call",
+							"required":    true,
+							"sensitive":   true,
 							"description": "Set to your API credential.",
 						},
 					},
@@ -391,16 +392,16 @@ func handleContext(_ context.Context, _ mcplib.CallToolRequest) (*mcplib.CallToo
 			},
 			"endpoints": map[string]string{
 				"items_enterprise": "enterprise",
-				"items_list": "free",
-				"items_premium": "paid",
+				"items_list":       "free",
+				"items_premium":    "paid",
 			},
 		},
 		"resources": []map[string]any{
 			{
-				"name": "items",
+				"name":        "items",
 				"description": "Items",
-				"endpoints": []string{"enterprise", "list", "premium",  },
-				"syncable": true,
+				"endpoints":   []string{"enterprise", "list", "premium"},
+				"syncable":    true,
 			},
 		},
 		"query_tips": []string{

← ff4b6528 fix(cli): unwrap single-key API envelopes before agent prove  ·  back to Cli Printing Press  ·  fix(cli): gate OAuth refresh-token params on x-oauth-refresh cba06db1 →