ymmv-cli 0.11.0 → 0.11.2

package/README.md

@@ -58,8 +58,8 @@ via npm Trusted Publishing, with provenance.
   the commands to run by hand)
 - `ymmv version` prints the CLI version (and notes a newer release when one is known)
 
-Values are capped at 256 characters and extra labels at 64; a profile holds up
-to 32 extras.
+Values are capped at 256 characters and extra labels at 64, and each needs at
+least one visible character; a profile holds up to 32 extras.
 
 Every profile is open JSON too: `GET https://ymmv.fyi/api/v1/u/<handle>`. Full contract
 (shape, statuses, caching, CORS):
@@ -69,9 +69,11 @@ Every profile is open JSON too: `GET https://ymmv.fyi/api/v1/u/<handle>`. Full c
 
 - `NO_COLOR` disables color output (and `FORCE_COLOR=0`/`false` force-disables it).
 - `YMMV_API` points the CLI at a different Worker (development/staging). Bare origin only. That
-  Worker must be deployed with or after this CLI release: `ymmv login` requires the account id the
-  login response carries and refuses (revoking what it minted) otherwise, and `YMMV_TOKEN` needs
-  the server's account lookup.
+  Worker must be deployed with or after this CLI release: `ymmv login` requires every field the
+  login response carries (the account id, and on a re-login the server's answer to retiring the
+  previous token) and refuses (revoking what it minted) otherwise, `YMMV_TOKEN` needs the
+  server's account lookup, and `ymmv`, `ymmv set`, and `ymmv unset` need the profile lookup they
+  read from before writing.
 - `YMMV_TOKEN` authenticates without a browser (CI and scripts, below). Takes precedence over
   the stored login and is read-only: the CLI never writes, revokes, or deletes it, and
   `ymmv login` / `ymmv logout` keep acting on the stored login. The CLI asks the server which

package/dist/cli.js

@@ -257,6 +257,34 @@ function diff(mine, theirs) {
   };
 }
 
+// ../shared/dist/display-url.js
+var PARSER_STRIPS = /[\t\n\r]/g;
+var HTTP_RE = /^https?:[/\\]*([^/?#\\]*)([/?#\\][\s\S]*)?$/i;
+function trimC0(s) {
+  let start = 0;
+  let end = s.length;
+  while (start < end && s.charCodeAt(start) <= 32)
+    start++;
+  while (end > start && s.charCodeAt(end - 1) <= 32)
+    end--;
+  return s.slice(start, end);
+}
+function displayUrl(value) {
+  const raw = value.trim();
+  const input = trimC0(raw.replace(PARSER_STRIPS, ""));
+  const m = HTTP_RE.exec(input);
+  if (!m)
+    return raw;
+  let url;
+  try {
+    url = new URL(input);
+  } catch {
+    return raw;
+  }
+  const prefix = url.protocol === "http:" ? "http://" : "";
+  return `${prefix}${url.host}${m[2] ?? ""}`;
+}
+
 // ../shared/dist/github.js
 var GITHUB_CLIENT_ID = "Ov23liMoD29eizQcN1KZ";
 function isGithubId(x) {
@@ -365,6 +393,12 @@ function isValidHandle(handle) {
   return handle.length >= 1 && handle.length <= 39 && HANDLE_RE.test(handle);
 }
 
+// ../shared/dist/visible.js
+var VISIBLE_RE = /[^\s\p{Default_Ignorable_Code_Point}\p{Cc}]/u;
+function hasVisibleContent(s) {
+  return VISIBLE_RE.test(s);
+}
+
 // src/render.ts
 var ESC = String.fromCharCode(27);
 var CSI = `${ESC}[`;
@@ -397,6 +431,9 @@ var BIDI_RE = new RegExp("\\p{Bidi_Control}", "gu");
 function sanitizeValue(value) {
   return value.replace(ANSI_RE, "").replace(CTRL_RE, "").replace(BIDI_RE, "");
 }
+function showsVisibleText(value) {
+  return hasVisibleContent(sanitizeValue(value));
+}
 function useColor(env, isTTY) {
   if (env.NO_COLOR !== void 0) return false;
   if (env.FORCE_COLOR !== void 0) {
@@ -410,12 +447,10 @@ function colorEnabled() {
 }
 var OSC = `${ESC}]`;
 var ST = `${ESC}\\`;
-function displayUrl(value) {
-  return value.trim().replace(/^https:\/\/(?=.)/i, "");
-}
 var HTTP_URL_RE = /^https?:\/\/\S+$/i;
 function isHttpUrl(value) {
-  return HTTP_URL_RE.test(value.trim());
+  const t = value.trim();
+  return HTTP_URL_RE.test(t) && URL.canParse(t);
 }
 var NO_OSC8_TERMS = /* @__PURE__ */ new Set(["linux", "dumb"]);
 function link(url, color, term = process.env.TERM, label) {
@@ -571,10 +606,16 @@ function causeText(err) {
   return sanitizeValue(text);
 }
 function wireText(text) {
-  const clean = sanitizeValue(String(text));
-  return clean.length > 200 ? `${clean.slice(0, 200)}\u2026` : clean;
+  return capped(sanitizeValue(String(text)));
+}
+var WIRE_TEXT_CAP = 200;
+function head(clean) {
+  return [...clean.slice(0, WIRE_TEXT_CAP * 2)].slice(0, WIRE_TEXT_CAP).join("");
+}
+function capped(clean) {
+  const kept = head(clean);
+  return kept.length < clean.length ? `${kept}\u2026` : clean;
 }
-var INVISIBLE_RE = new RegExp("\\p{Default_Ignorable_Code_Point}", "gu");
 async function wireBody(res) {
   try {
     return await res.text();
@@ -589,8 +630,8 @@ function wireErrorBody(raw) {
     const out = {};
     if (typeof body?.error === "string") out.slug = body.error;
     if (typeof body?.message === "string") {
-      const clean = wireText(body.message).trim();
-      if (clean.replace(INVISIBLE_RE, "").trim()) out.message = clean;
+      const clean = sanitizeValue(body.message);
+      if (hasVisibleContent(head(clean))) out.message = capped(clean).trim();
     }
     return out;
   } catch {
@@ -695,19 +736,23 @@ function parseIdentity(data) {
   }
   return { github_id: id, handle };
 }
+function serverBehindHint() {
+  return process.env.YMMV_API ? "Point YMMV_API at an up-to-date server." : "The server is behind this CLI release; try again later.";
+}
 var MintRejected = class extends Error {
   constructor(msg) {
     super(msg);
     this.name = "MintRejected";
   }
 };
-async function mintYmmvToken(accessToken) {
+async function mintYmmvToken(accessToken, revoke) {
   const res = await safeFetch(
     `${BASE}/api/v1/auth/token`,
     {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify({ access_token: accessToken }),
+      // JSON.stringify drops an undefined `revoke`: no key on the wire when there is nothing to retire.
+      body: JSON.stringify({ access_token: accessToken, revoke }),
       // Never follow a redirect: a 30x must fail (the existing `!res.ok` guard rejects the resulting
       // opaqueredirect), not re-POST the GitHub access_token to the redirect target or read a
       // redirected 200 as a successful mint. Mirrors publish/delete in api.ts.
@@ -742,23 +787,29 @@ async function mintYmmvToken(accessToken) {
     throw new Error(`login failed: ${res.status} ${wireText(slug)}`.trim());
   }
   const data = await bodyJson(res);
-  const unexpected = `Unexpected response from ${BASE}. Nothing was saved; run \`ymmv login\` again.`;
+  const unexpected = `Unexpected response from ${BASE}. Nothing was saved` + (revoke === void 0 ? "" : " (the previous login on this machine may have been signed out)") + "; run `ymmv login` again.";
   if (!data) throw new Error(unexpected);
   const token = typeof data.token === "string" && data.token.length > 0 ? data.token : null;
   const identity = parseIdentity(data);
-  if (token === null || identity === null) {
+  const revoked = typeof data.revoked === "boolean" ? data.revoked : void 0;
+  const behind = token !== null && identity !== null && revoke !== void 0 && revoked === void 0 ? `${BASE} did not retire the previous login. ${serverBehindHint()} Nothing was saved; to log in anyway, run \`ymmv logout\` first.` : null;
+  if (token === null || identity === null || behind !== null) {
     let revokeFailed = false;
     if (token !== null) {
       await revokeYmmvToken(token, AbortSignal.timeout(REVOKE_CAP_MS)).catch(() => {
         revokeFailed = true;
       });
     }
+    const refusal = behind ?? unexpected;
     throw new MintRejected(
-      revokeFailed ? `${unexpected} The login the server minted could not be revoked.` : unexpected
+      revokeFailed ? `${refusal} The login the server minted could not be revoked.` : refusal
     );
   }
   return { token, ...identity };
 }
+function missingRouteError(missing) {
+  return new Error(`${BASE} has no ${missing}. ${serverBehindHint()}`);
+}
 async function fetchWhoami(token) {
   const res = await safeFetch(
     `${BASE}/api/v1/auth/whoami`,
@@ -773,9 +824,7 @@ async function fetchWhoami(token) {
   if (!res.ok) {
     if (res.status === 401) throw new Error(ENV_TOKEN_REJECTED_MINT_AGAIN);
     if (res.status === 404) {
-      throw new Error(
-        `${BASE} has no identity lookup for YMMV_TOKEN. ${process.env.YMMV_API ? "Point YMMV_API at an up-to-date server." : "The server is behind this CLI release; try again later."}`
-      );
+      throw missingRouteError("identity lookup for YMMV_TOKEN");
     }
     throw new Error(
       withRetryHint(
@@ -996,6 +1045,9 @@ async function pollForToken(dc, deps = {}) {
   }
   throw new Error("Device code expired. Run `ymmv login` again.");
 }
+function retirable(cred) {
+  return cred != null && cred.base === BASE && cred.token.trim() !== "";
+}
 async function login(deps = {}) {
   if (!process.stdin.isTTY) {
     throw new Error(
@@ -1028,18 +1080,23 @@ ${c.faint}waiting for GitHub approval\u2026 (Ctrl+C to cancel)${c.reset}`
     )
   );
   const accessToken = await pollForToken(dc, deps);
-  const minted = await mintYmmvToken(accessToken);
-  const replaced = await peekCredential();
+  const before = await peekCredential();
+  const revoke = retirable(before) ? before.token : void 0;
+  const minted = await mintYmmvToken(accessToken, revoke);
+  const after = await peekCredential();
   try {
     await saveToken(minted);
   } catch (e) {
     await revokeYmmvToken(minted.token).catch(() => {
+      console.error(
+        message(`${c.faint}(the login the server minted could not be revoked)${c.reset}`)
+      );
     });
     throw e;
   }
-  if (replaced && replaced.base === BASE && replaced.token !== minted.token) {
+  if (retirable(after) && after.token !== revoke && after.token !== minted.token) {
     try {
-      await revokeYmmvToken(replaced.token);
+      await revokeYmmvToken(after.token);
     } catch {
       console.error(message(`${c.faint}(couldn't revoke the previous session's token)${c.reset}`));
     }
@@ -1058,6 +1115,12 @@ var PublishRefusal = class extends Error {
     this.name = "PublishRefusal";
   }
 };
+var ProfileChanged = class extends PublishRefusal {
+  constructor() {
+    super("Your profile changed since this command read it. Re-run the command.");
+    this.name = "ProfileChanged";
+  }
+};
 var NOT_PERSISTED = "Login did not persist a token. Run `ymmv login`.";
 function assertVerified(cred) {
   if (cred.source === "env" && cred.github_id === null) {
@@ -1099,12 +1162,16 @@ async function ensureLogin() {
   if (!fresh) throw new Error(NOT_PERSISTED);
   return fresh;
 }
-async function publishProfile(profile, expected) {
+async function publishProfile(profile, expected, opts = {}) {
   const send = (c) => safeFetch(
     `${BASE}/api/v1/profile`,
     {
       method: "POST",
-      headers: { "content-type": "application/json", authorization: `Bearer ${c.token}` },
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${c.token}`,
+        ...opts.ifMatch ? { "if-match": opts.ifMatch } : {}
+      },
       // Send the login-bound handle, never a caller-guessed one — the official client never claims
       // a handle it doesn't own.
       body: JSON.stringify({ ...profile, handle: c.handle ?? profile.handle }),
@@ -1182,6 +1249,7 @@ async function publishProfile(profile, expected) {
       );
     }
   }
+  if (res.status === 412) throw new ProfileChanged();
   if (res.status === 429) throw new Error(await rateLimitMessage(res));
   if (!res.ok) {
     const raw = await wireBody(res);
@@ -1207,6 +1275,40 @@ async function fetchProfileJson(handle) {
   }
   return parseProfile(await res.json());
 }
+var HEADER_SAFE_TAG = /^[!#-~]{1,128}$/;
+async function fetchOwnProfile(cred) {
+  assertVerified(cred);
+  const res = await safeFetch(
+    `${BASE}/api/v1/profile`,
+    {
+      headers: { authorization: `Bearer ${cred.token}` },
+      // Never follow a redirect: the bearer must not travel to a redirect target, and a 30x→200
+      // must not read as a profile. Same guard as whoami, mint, logout, publish, and delete.
+      redirect: "manual"
+    },
+    BASE
+  );
+  if (res.status === 401) {
+    throw new Error(
+      cred.source === "env" ? ENV_TOKEN_REJECTED_MINT_AGAIN : "Session expired. Run `ymmv login`, then re-run the command."
+    );
+  }
+  if (res.status === 404) {
+    const { slug } = wireErrorBody(await wireBody(res));
+    if (slug === "not_found") return null;
+    throw missingRouteError("profile lookup");
+  }
+  if (res.status === 429) throw new Error(await rateLimitMessage(res));
+  if (!res.ok) {
+    const raw = await wireBody(res);
+    throw new Error(withRetryHint(`fetch failed: ${res.status} ${wireText(raw)}`, res));
+  }
+  const profile = parseProfile(await res.json());
+  if (!HEADER_SAFE_TAG.test(profile.updated_at)) {
+    throw new Error(`Unexpected response from ${BASE}. Check YMMV_API, or try again shortly.`);
+  }
+  return { profile, etag: `"${profile.updated_at}"` };
+}
 async function deleteProfile(cred) {
   assertVerified(cred);
   const res = await safeFetch(
@@ -1625,7 +1727,31 @@ function pagePointer(handle) {
   const c = palette(color);
   return ` ${c.faint}\u2192 ${color ? displayUrl(BASE) : BASE}/${handle}${c.reset}`;
 }
-async function promptEntries(defaults, prompter) {
+function writeRuleRefusal(entries, existing) {
+  const saved = savedKeys(existing);
+  for (const { key, value } of entries) {
+    if (!isCuratedKey(key)) continue;
+    const problem = valueProblem(value);
+    if (problem === void 0) continue;
+    const remedy = problem === "invisible" ? "Set one" : "Set a shorter one";
+    const source = saved.has(key) ? "saved" : "detected";
+    const remove = problem === "invisible" && source === "saved" ? `, or remove it: ymmv unset ${key}` : "";
+    return `The ${source} ${KEY_LABELS[key]} value ${ruleClause(problem, value)}. ${remedy}: ymmv set ${key} <value>${remove}.`;
+  }
+  return void 0;
+}
+function valueProblem(value) {
+  if (!showsVisibleText(value)) return "invisible";
+  if (value.length > MAX_VALUE) return "over-cap";
+  return void 0;
+}
+function ruleClause(problem, value) {
+  return problem === "invisible" ? "has no visible text" : `is ${value.length} characters; the cap is ${MAX_VALUE}`;
+}
+function savedKeys(existing) {
+  return new Set((existing?.entries ?? []).map((e) => e.key));
+}
+async function promptEntries(defaults, saved, prompter) {
   const c = palette(colorEnabled());
   console.log(message(`${c.faint}Enter to keep, "-" to clear${c.reset}`));
   const chosen = /* @__PURE__ */ new Map();
@@ -1633,13 +1759,15 @@ async function promptEntries(defaults, prompter) {
     for (; ; ) {
       const answer = (await prompter.ask(KEY_LABELS[key], defaults.get(key))).trim();
       const value = answer === "-" ? "" : answer;
-      if (value.length > MAX_VALUE) {
-        const isDefault = value === (defaults.get(key) ?? "").trim();
-        console.log(
-          message(
-            `${c.faint}${isDefault ? `the saved value is ${value.length} characters; the cap is ${MAX_VALUE}. Type a shorter value or - to clear` : `that value is ${value.length} characters; the cap is ${MAX_VALUE}`}${c.reset}`
-          )
-        );
+      const rawDefault = defaults.get(key) ?? "";
+      const isDefault = value === sanitizeValue(rawDefault).trim();
+      const emptiedDefault = answer === "" && rawDefault !== "";
+      const problem = emptiedDefault ? "invisible" : value === "" ? void 0 : valueProblem(value);
+      if (problem !== void 0) {
+        const which = `the ${saved.has(key) ? "saved" : "detected"} value`;
+        const clause = ruleClause(problem, value);
+        const note = isDefault ? `${which} ${clause}. Type a ${problem === "invisible" ? "value" : "shorter value"} or - to clear` : `that value ${clause}`;
+        console.log(message(`${c.faint}${note}${c.reset}`));
         continue;
       }
       if (value) chosen.set(key, value);
@@ -1666,11 +1794,13 @@ async function publish(io) {
       return readFileSync(p, "utf8");
     }
   });
-  const existing = await fetchProfileJson(handle);
+  const own = await fetchOwnProfile(cred);
+  const existing = own?.profile ?? null;
   assertHandleUnchanged(existing, cred, handle);
   const defaults = buildDefaults(existing, detected);
-  const carried = unknownEntries(existing);
-  const extras = existing?.extras ?? [];
+  let carried = unknownEntries(existing);
+  let extras = existing?.extras ?? [];
+  let ifMatch = own?.etag;
   const color = colorEnabled();
   const site = displayUrl(BASE);
   const showCard = (entries) => {
@@ -1698,25 +1828,36 @@ async function publish(io) {
   };
   let values = defaults;
   const assemble = () => [...entriesFromMap(values), ...carried];
+  const edits = /* @__PURE__ */ new Map();
+  let saved = savedKeys(existing);
+  const prompt = async (prompter) => {
+    const before = values;
+    values = await promptEntries(values, saved, prompter);
+    for (const key of CURATED_KEYS) {
+      const after = values.get(key);
+      if (after !== before.get(key)) edits.set(key, after);
+    }
+  };
   if (!io.interactive || !io.prompter || io.yes) {
-    const over = [...values].find(([, v]) => v.length > MAX_VALUE);
-    if (over) {
-      console.error(
-        message(
-          `The detected ${KEY_LABELS[over[0]]} value is ${over[1].length} characters; the cap is ${MAX_VALUE}. Set a shorter one: ymmv set ${over[0]} <value>.`
-        )
-      );
+    const entries = assemble();
+    const refusal = writeRuleRefusal(entries, existing);
+    if (refusal !== void 0) {
+      console.error(message(refusal));
       process.exitCode = 1;
       return;
     }
-    const entries = assemble();
     showCard(entries);
-    printPublished(await publishProfile(newProfile(handle, entries, extras), cred), color);
+    printPublished(
+      await publishProfile(newProfile(handle, entries, extras), cred, { ifMatch }),
+      color
+    );
     return;
   }
   try {
-    if (!existing) values = await promptEntries(values, io.prompter);
+    if (!existing) await prompt(io.prompter);
+    const failsRule = ([, v]) => valueProblem(v) !== void 0;
     for (; ; ) {
+      if ([...values].some(failsRule)) await prompt(io.prompter);
       const entries = assemble();
       showCard(entries);
       const ans = await io.prompter.choice(
@@ -1727,9 +1868,38 @@ async function publish(io) {
       );
       if (ans === "y") {
         try {
-          printPublished(await publishProfile(newProfile(handle, entries, extras), cred), color);
+          printPublished(
+            await publishProfile(newProfile(handle, entries, extras), cred, { ifMatch }),
+            color
+          );
           return;
         } catch (e) {
+          if (e instanceof ProfileChanged) {
+            console.error(
+              message(
+                "Your profile changed since this command read it. Reloaded the current version; your answers are kept."
+              )
+            );
+            const liveCred = cred.source === "env" ? cred : await loadCredential() ?? cred;
+            const fresh = await fetchOwnProfile(liveCred);
+            if (!fresh) {
+              throw new PublishRefusal(
+                "Your profile was deleted since this command read it. Nothing was published. Run `ymmv` again to recreate it."
+              );
+            }
+            assertHandleUnchanged(fresh.profile, cred, handle);
+            const rebased = buildDefaults(fresh.profile, detected);
+            for (const [key, value] of edits) {
+              if (value === void 0) rebased.delete(key);
+              else rebased.set(key, value);
+            }
+            values = rebased;
+            saved = savedKeys(fresh.profile);
+            carried = unknownEntries(fresh.profile);
+            extras = fresh.profile.extras;
+            ifMatch = fresh.etag;
+            continue;
+          }
           if (e instanceof PromptAborted || e instanceof PublishRefusal) throw e;
           const ambiguous = e instanceof NetworkError || isTimeoutError(e);
           console.error(
@@ -1745,7 +1915,7 @@ ${ambiguous ? "The publish may not have completed. Your answers are kept." : "No
         console.log(message("Aborted. Nothing published."));
         return;
       }
-      values = await promptEntries(values, io.prompter);
+      await prompt(io.prompter);
     }
   } catch (e) {
     if (e instanceof PromptAborted) {
@@ -1812,7 +1982,8 @@ async function runSet(target) {
   const cred = await ensureLogin();
   const handle = requireHandle(cred);
   if (!handle) return;
-  const existing = await fetchProfileJson(handle);
+  const own = await fetchOwnProfile(cred);
+  const existing = own?.profile ?? null;
   assertHandleUnchanged(existing, cred, handle);
   const { entries, extras } = applySet(existing, target);
   if (target.kind === "extra" && extras.length > MAX_EXTRAS) {
@@ -1824,15 +1995,33 @@ async function runSet(target) {
     process.exitCode = 1;
     return;
   }
-  const res = await publishProfile(newProfile(handle, entries, extras), cred);
-  const line = target.kind === "curated" ? `Set ${KEY_LABELS[target.key]} = ${target.value}.` : `Set extra ${target.label} = ${target.value}.`;
+  const refusal = writeRuleRefusal(entries, existing);
+  if (refusal !== void 0) {
+    console.error(message(refusal));
+    process.exitCode = 1;
+    return;
+  }
+  const res = await publishProfile(newProfile(handle, entries, extras), cred, {
+    ifMatch: own?.etag
+  });
+  const line = target.kind === "curated" ? `Set ${KEY_LABELS[target.key]} = ${sanitizeValue(target.value)}.` : `Set extra ${sanitizeValue(target.label)} = ${sanitizeValue(target.value)}.`;
   console.log(message(`${line}${pagePointer(res.handle)}`));
 }
+var PASTE_SAFE_LABEL = /^[\p{L}\p{N} _.+/:-]+$/u;
+function extraHint(existing, label) {
+  const eq = label.indexOf("=");
+  const head2 = eq > 0 ? label.slice(0, eq).trim() : "";
+  if (!head2 || !applyUnset(existing, { kind: "extra", label: head2 }).removed) return "";
+  const shown = PASTE_SAFE_LABEL.test(head2) ? head2 : "Label";
+  return `
+(unset takes just the label: ymmv unset --extra "${shown}")`;
+}
 async function runUnset(target) {
   const cred = await ensureLogin();
   const handle = requireHandle(cred);
   if (!handle) return;
-  const existing = await fetchProfileJson(handle);
+  const own = await fetchOwnProfile(cred);
+  const existing = own?.profile ?? null;
   assertHandleUnchanged(existing, cred, handle);
   if (!existing) {
     console.log(message("No profile yet. Run `ymmv` to publish one."));
@@ -1840,14 +2029,19 @@ async function runUnset(target) {
   }
   const { entries, extras, removed } = applyUnset(existing, target);
   if (!removed) {
-    console.log(
-      message(
-        target.kind === "curated" ? `${KEY_LABELS[target.key]} is not set.` : `No extra "${target.label}".`
-      )
-    );
+    const line2 = target.kind === "curated" ? `${KEY_LABELS[target.key]} is not set.` : `No extra "${sanitizeValue(target.label)}".${extraHint(existing, target.label)}`;
+    console.log(message(line2));
     return;
   }
-  const res = await publishProfile(newProfile(handle, entries, extras), cred);
+  const refusal = writeRuleRefusal(entries, existing);
+  if (refusal !== void 0) {
+    console.error(message(refusal));
+    process.exitCode = 1;
+    return;
+  }
+  const res = await publishProfile(newProfile(handle, entries, extras), cred, {
+    ifMatch: own?.etag
+  });
   const line = target.kind === "curated" ? `Removed ${KEY_LABELS[target.key]} (was "${sanitizeValue(removed.value)}").` : `Removed extra "${sanitizeValue(removed.label)}" (was "${sanitizeValue(removed.value)}").`;
   console.log(message(`${line}${pagePointer(res.handle)}`));
 }
@@ -1893,10 +2087,10 @@ var SET_USAGE = `usage: ymmv set <key> <value>  |  ${SET_EXTRA}`;
 var EXTRA_USAGE = `usage: ${SET_EXTRA}`;
 var UNSET_USAGE = `usage: ymmv unset <key>  |  ${UNSET_EXTRA}`;
 var VIEW_USAGE = "usage: ymmv view <handle>";
-function invalidKeyError(head, hint) {
+function invalidKeyError(head2, hint) {
   return {
     kind: "error",
-    message: `"${sanitizeValue(head)}" is not a curated key. Valid keys: ${CURATED_KEYS.join(", ")}.
+    message: `"${sanitizeValue(head2)}" is not a curated key. Valid keys: ${CURATED_KEYS.join(", ")}.
 For anything else, use: ${hint}.`
   };
 }
@@ -1920,9 +2114,15 @@ function valueCapError(value) {
     message: `That value is ${value.length} characters; the cap is ${MAX_VALUE}.`
   };
 }
+function labelInvisibleError() {
+  return { kind: "error", message: "That label has no visible text." };
+}
+function valueInvisibleError() {
+  return { kind: "error", message: "That value has no visible text." };
+}
 function parseSet(rest) {
-  const head = rest[0];
-  if (head === "--extra" || head === "-e") {
+  const head2 = rest[0];
+  if (head2 === "--extra" || head2 === "-e") {
     const spec = rest.slice(1).join(" ").trim();
     const eq = spec.indexOf("=");
     if (eq <= 0) return { kind: "error", message: EXTRA_USAGE };
@@ -1930,35 +2130,33 @@ function parseSet(rest) {
     const value2 = spec.slice(eq + 1).trim();
     if (!label || !value2) return { kind: "error", message: EXTRA_USAGE };
     if (value2 === "-") return { kind: "unset", target: { kind: "extra", label } };
+    if (!showsVisibleText(label)) return labelInvisibleError();
+    if (!showsVisibleText(value2)) return valueInvisibleError();
     if (label.length > MAX_LABEL) return labelCapError(label);
     if (value2.length > MAX_VALUE) return valueCapError(value2);
     return { kind: "set", target: { kind: "extra", label, value: value2 } };
   }
-  if (!head) return { kind: "error", message: SET_USAGE };
-  if (!isCuratedKey(head)) return invalidKeyError(head, SET_EXTRA);
+  if (!head2) return { kind: "error", message: SET_USAGE };
+  if (!isCuratedKey(head2)) return invalidKeyError(head2, SET_EXTRA);
   const value = rest.slice(1).join(" ").trim();
-  if (!value) return { kind: "error", message: `usage: ymmv set ${head} <value>` };
-  if (value === "-") return { kind: "unset", target: { kind: "curated", key: head } };
+  if (!value) return { kind: "error", message: `usage: ymmv set ${head2} <value>` };
+  if (value === "-") return { kind: "unset", target: { kind: "curated", key: head2 } };
+  if (!showsVisibleText(value)) return valueInvisibleError();
   if (value.length > MAX_VALUE) return valueCapError(value);
-  return { kind: "set", target: { kind: "curated", key: head, value } };
+  return { kind: "set", target: { kind: "curated", key: head2, value } };
 }
 function parseUnset(rest) {
-  const head = rest[0];
-  if (head === "--extra" || head === "-e") {
+  const head2 = rest[0];
+  if (head2 === "--extra" || head2 === "-e") {
     const label = rest.slice(1).join(" ").trim();
     if (!label) return { kind: "error", message: `usage: ${UNSET_EXTRA}` };
-    if (label.includes("=")) {
-      return {
-        kind: "error",
-        message: 'unset takes just the label: ymmv unset --extra "Keyboard"'
-      };
-    }
+    if (label.length > MAX_LABEL) return labelCapError(label);
     return { kind: "unset", target: { kind: "extra", label } };
   }
-  if (!head) return { kind: "error", message: UNSET_USAGE };
-  if (!isCuratedKey(head)) return invalidKeyError(head, UNSET_EXTRA);
-  if (rest.length > 1) return { kind: "error", message: `usage: ymmv unset ${head}` };
-  return { kind: "unset", target: { kind: "curated", key: head } };
+  if (!head2) return { kind: "error", message: UNSET_USAGE };
+  if (!isCuratedKey(head2)) return invalidKeyError(head2, UNSET_EXTRA);
+  if (rest.length > 1) return { kind: "error", message: `usage: ymmv unset ${head2}` };
+  return { kind: "unset", target: { kind: "curated", key: head2 } };
 }
 function resolveArg(argv) {
   const first = argv[0];
@@ -2317,7 +2515,9 @@ ${c.faint}Curated keys:${c.reset} editor, os, shell, prompt, terminal, browser,
               font, theme, multiplexer, version-manager, dotfiles, ai-tool`;
 async function logout() {
   const stored = await loadToken();
-  if (!stored) {
+  const leftover = stored ? null : await peekCredential();
+  const token = stored?.token ?? (retirable(leftover) ? leftover.token : null);
+  if (token === null) {
     const otherBase = await peekBase();
     console.log(
       message(
@@ -2328,7 +2528,7 @@ async function logout() {
   }
   let revoked;
   try {
-    revoked = await revokeYmmvToken(stored.token);
+    revoked = await revokeYmmvToken(token);
   } catch (e) {
     console.error(
       message(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ymmv-cli",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "Publish and diff terminal-native developer tool-stack profiles at ymmv.fyi.",
   "type": "module",
   "bin": {