@svgicons-com/cli 0.1.0-alpha.2 → 0.1.0-alpha.3

package/README.md

@@ -8,7 +8,7 @@ Public icon search works without changing the default endpoint. Pro workflows re
 
 The scanner is read-only by default. It never edits project files unless a future command explicitly adds that behavior.
 
-Current package version: `0.1.0-alpha.2`.
+Current package version: `0.1.0-alpha.3`.
 
 ## Requirements
 
@@ -18,17 +18,19 @@ Current package version: `0.1.0-alpha.2`.
 ## Login
 
 ```bash
-svgicons login --token YOUR_PRO_API_TOKEN
+svgicons login --token "YOUR_PRO_API_TOKEN"
 ```
 
 The explicit auth namespace is also supported:
 
 ```bash
-svgicons auth login --token YOUR_PRO_API_TOKEN
+svgicons auth login --token "YOUR_PRO_API_TOKEN"
 svgicons auth status
 svgicons doctor
 ```
 
+Pro API tokens may start with a numeric prefix and a pipe character, such as `10|...`. Keep the full token and wrap it in quotes when using a shell command.
+
 You can also avoid writing a config file by setting `SVGICONS_TOKEN` or `SVGICONS_API_TOKEN`.
 
 Inspect local config without exposing the stored token:
@@ -43,7 +45,7 @@ svgicons config set baseUrl https://svgicons.com
 
 ```bash
 svgicons version
-svgicons auth login --token YOUR_PRO_API_TOKEN
+svgicons auth login --token "YOUR_PRO_API_TOKEN"
 svgicons auth status --json
 svgicons config list --json
 svgicons doctor --json

package/RELEASE_NOTES.md

@@ -1,4 +1,8 @@
-# Svg/icons CLI 0.1.0-alpha.2
+# Svg/icons CLI 0.1.0-alpha.3
+
+This alpha refresh improves token setup safety. `login` now rejects obviously truncated numeric tokens, which commonly happens when a shell command is run without quoting a Sanctum-style token containing `|`.
+
+## 0.1.0-alpha.2
 
 This alpha refresh removes local-development wording from the public npm README. Runtime behavior is unchanged from `0.1.0-alpha.1`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svgicons-com/cli",
-  "version": "0.1.0-alpha.2",
+  "version": "0.1.0-alpha.3",
   "description": "Svg/icons CLI alpha for icon search, Pro collections, exports, project scanning, and license workflows.",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -181,11 +181,9 @@ export async function run(argv) {
 
 async function login(args, globalOptions = {}) {
   const options = parseOptions(args);
-  const token = options.token || globalOptions.token || process.env.SVGICONS_TOKEN || process.env.SVGICONS_API_TOKEN;
+  const rawToken = options.token || globalOptions.token || process.env.SVGICONS_TOKEN || process.env.SVGICONS_API_TOKEN;
 
-  if (!token) {
-    throw new Error('Missing token. Use: svgicons login --token <token>');
-  }
+  const token = normalizeLoginToken(rawToken);
 
   const baseUrl = normalizeBaseUrl(options['base-url'] || globalOptions['base-url'] || defaultBaseUrl());
   await writeConfig({
@@ -197,6 +195,28 @@ async function login(args, globalOptions = {}) {
   console.log(`Svg/icons CLI token saved for ${baseUrl}.`);
 }
 
+function normalizeLoginToken(token) {
+  if (!token) {
+    throw usageError('Missing token. Use: svgicons login --token "<token>"');
+  }
+
+  const value = String(token).trim();
+
+  if (value === '') {
+    throw usageError('Missing token. Use: svgicons login --token "<token>"');
+  }
+
+  if (/^\d+$/.test(value)) {
+    throw usageError('The token looks truncated. Svg/icons Pro API tokens can start with an id prefix like "10|". Wrap the full token in quotes: svgicons auth login --token "10|..."');
+  }
+
+  if (value.length < 20) {
+    throw usageError('The token value is too short. Copy the full Pro API token from your account page and wrap it in quotes when it contains "|".');
+  }
+
+  return value;
+}
+
 async function logout() {
   await clearConfig();
   console.log('Svg/icons CLI credentials removed.');