Structured review pass — findings grouped by what they'd actually do to
you, most severe first. Coverage over politeness: I report it, you
decide.

CORRECTNESS (blocks merge)
  ▸ src/api.ts:44 — the error path returns undefined, and the caller at
    :81 does .length on it. Null-input crash. This is the merge-blocker.
  ▸ src/parse.ts:23 — off-by-one: loop runs to <= length, reads one past
    the array. Silent on happy path, wrong on the boundary.

RISK FLAGS (should-fix before merge)
  ▸ auth/token.ts:12 — token compared with ===, not a constant-time
    compare. Timing-attack surface on an auth path.
  ▸ No test covers the error branch above — which is exactly why it
    shipped.

STYLE / CONSISTENCY (non-blocking)
  ▸ Mixed async styles in one file (.then and await). Pick one.
  ▸ src/util.ts:30 — magic number 86400, name it SECONDS_PER_DAY.

WHAT'S GOOD
The refactor consolidates three duplicated fetch calls into one — right
call, and it makes the correctness fix above a one-line change instead
of three.

VERDICT
Block on the two correctness items. The security and test gaps I'd fix
in the same PR since the files are already open; style can follow.

Paste the diff and I'll run the real pass line by line.