flostep 0.1.0 → 0.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flostep",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Build, update and share Flostep diagrams from the terminal, from CI, or from a coding agent.",
   "type": "module",
   "bin": {

package/src/api.js

@@ -17,9 +17,10 @@ const TIMEOUT_MS = 30_000;
 const MAX_PAGES = 50;
 
 export class Api {
-  constructor({ host, token }) {
+  constructor({ host, token, tokenSource }) {
     this.host = host;
     this.token = token;
+    this.tokenSource = tokenSource;
   }
 
   async request(method, path, body) {
@@ -71,8 +72,15 @@ export class Api {
       // The server distinguishes expired from invalid, and that distinction is
       // the whole reason it does: "log in again" and "you copied it wrong" are
       // different fixes. Passing its sentence through keeps them distinct.
+      // Which credential was rejected matters more than the sentence: a stale
+      // FLOSTEP_TOKEN in the shell outranks `flostep login`, so logging in
+      // again "works" and the very next command fails the same way.
       return new CliError(message || "Not authenticated.", {
-        hint: this.token ? "Run `flostep login` to sign in again." : "Run `flostep login` first."
+        hint: !this.token
+          ? "Run `flostep login` first."
+          : this.tokenSource === "FLOSTEP_TOKEN"
+            ? "This used FLOSTEP_TOKEN from your environment, which overrides `flostep login`.\n  Run `unset FLOSTEP_TOKEN`, or set it to a valid key."
+            : "Run `flostep login` to sign in again."
       });
     }
 

package/src/cli.js

@@ -219,14 +219,14 @@ export async function main(argv) {
     return 0;
   }
 
-  const { token } = resolveToken();
+  const { token, source: tokenSource } = resolveToken();
   const ctx = {
     json: parsed.values.json,
     token,
     // Built lazily by the command, because `login` needs a host with no token
     // and `logout` needs neither.
     api() {
-      return new Api({ host: resolveHost(), token });
+      return new Api({ host: resolveHost(), token, tokenSource });
     }
   };