ymmv-cli 0.5.0 → 0.6.0

package/README.md

@@ -16,13 +16,15 @@ npx ymmv-cli bardisty   # view someone's stack in the terminal
 Viewing someone while you're logged in diffs their stack against yours:
 
 ```
-          bardisty  you
+  how bardisty differs from you
+
+          BARDISTY  YOU
 ~ Editor  Zed       VS Code
 = Shell   bash      bash
 ~ Theme   Gruvbox   Catppuccin
 ~ Font    Lilex     JetBrains Mono
 
-  3 differ · 1 shared — your mileage may vary
+  3 differ   1 shared
 ```
 
 Install once for the short `ymmv` command:
@@ -48,6 +50,9 @@ via npm Trusted Publishing, with provenance.
 
 Every profile is open JSON too: `GET https://ymmv.fyi/api/v1/u/<handle>`.
 
+Color output respects `NO_COLOR`; set `YMMV_API` to point the CLI at a different Worker
+(development).
+
 ## License
 
 MIT. Source + issues: <https://github.com/ymmv-fyi/ymmv>.

package/dist/cli.js

@@ -6,47 +6,6 @@ import { readFileSync as readFileSync2 } from "fs";
 // src/config.ts
 var BASE = (process.env.YMMV_API ?? "https://ymmv.fyi").replace(/\/+$/, "");
 
-// src/auth-http.ts
-async function mintYmmvToken(accessToken) {
-  const res = await fetch(`${BASE}/api/v1/auth/token`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ access_token: accessToken }),
-    // Never follow a redirect: a 30x must fail (the existing `!res.ok` guard rejects the resulting
-    // opaqueredirect), not re-POST the GitHub access_token to the redirect target or read a
-    // redirected 200 as a successful mint. Mirrors publish/delete in api.ts.
-    redirect: "manual"
-  });
-  if (!res.ok) {
-    const body = await res.json().catch(() => ({}));
-    if (res.status === 503) {
-      throw new Error(body.message ?? "GitHub is unavailable \u2014 run `ymmv login` again shortly.");
-    }
-    if (res.status === 429) {
-      const retry = res.headers.get("retry-after");
-      const msg = body.message ?? "too many login attempts \u2014 slow down and try again shortly";
-      throw new Error(retry ? `${msg} (retry in ${retry}s)` : msg);
-    }
-    throw new Error(`login failed: ${res.status} ${body.error ?? ""}`.trim());
-  }
-  return await res.json();
-}
-async function revokeYmmvToken(token) {
-  const res = await fetch(`${BASE}/api/v1/auth/logout`, {
-    method: "POST",
-    headers: { authorization: `Bearer ${token}` },
-    // Never follow a redirect: a 30x→200 must not read as a successful revoke (which would delete the
-    // local file while the server token stays live). Same guard as mint + publish/delete.
-    redirect: "manual"
-  });
-  if (!res.ok) throw new Error(`logout failed: ${res.status}`);
-  const body = await res.json().catch(() => ({}));
-  return body.revoked === true;
-}
-
-// src/commands.ts
-import { readFileSync, statSync } from "fs";
-
 // ../shared/dist/keys.js
 var CURATED_KEYS = [
   "editor",
@@ -380,6 +339,269 @@ function isValidHandle(handle) {
   return handle.length >= 1 && handle.length <= 39 && HANDLE_RE.test(handle);
 }
 
+// src/render.ts
+var ESC = String.fromCharCode(27);
+var CSI = `${ESC}[`;
+var CODES = {
+  amber: `${CSI}93m`,
+  // DESIGN: amber == ANSI bright-yellow
+  faint: `${CSI}90m`,
+  bold: `${CSI}1m`,
+  reset: `${CSI}0m`
+};
+var NO_CODES = { amber: "", faint: "", bold: "", reset: "" };
+function palette(color) {
+  return color ? CODES : NO_CODES;
+}
+var ESC_INTRODUCERS = `${String.fromCharCode(27)}${String.fromCharCode(155)}`;
+var BEL = String.fromCharCode(7);
+var ANSI_RE = new RegExp(
+  `[${ESC_INTRODUCERS}][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d/#&.:=?%@~_]*)*)?${BEL})|(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]))`,
+  "g"
+);
+var CTRL_RE = new RegExp(
+  `[${String.fromCharCode(0)}-${String.fromCharCode(31)}${String.fromCharCode(127)}-${String.fromCharCode(159)}]`,
+  "g"
+);
+var BIDI_RE = new RegExp(
+  `[${String.fromCharCode(8234)}-${String.fromCharCode(8238)}${String.fromCharCode(8294)}-${String.fromCharCode(8297)}${String.fromCharCode(8206)}${String.fromCharCode(8207)}]`,
+  "g"
+);
+function sanitizeValue(value) {
+  return value.replace(ANSI_RE, "").replace(CTRL_RE, "").replace(BIDI_RE, "");
+}
+function useColor(env, isTTY) {
+  if (env.NO_COLOR !== void 0) return false;
+  if (env.FORCE_COLOR !== void 0) return env.FORCE_COLOR !== "0";
+  if (env.TERM === "dumb") return false;
+  return isTTY;
+}
+function colorEnabled() {
+  return useColor(process.env, Boolean(process.stdout.isTTY));
+}
+var OSC = `${ESC}]`;
+var ST = `${ESC}\\`;
+function displayUrl(value) {
+  return value.trim().replace(/^https:\/\/(?=.)/i, "");
+}
+var HTTP_URL_RE = /^https?:\/\/\S+$/i;
+function isHttpUrl(value) {
+  return HTTP_URL_RE.test(value.trim());
+}
+var NO_OSC8_TERMS = /* @__PURE__ */ new Set(["linux", "dumb"]);
+function link(url, color, term = process.env.TERM) {
+  const clean = sanitizeValue(url).trim();
+  if (!color) return clean;
+  const text = `${CODES.amber}${displayUrl(clean)}${CODES.reset}`;
+  if (term !== void 0 && NO_OSC8_TERMS.has(term)) return text;
+  return `${OSC}8;;${clean}${ST}${text}${OSC}8;;${ST}`;
+}
+function relTime(iso, now = Date.now) {
+  const t = Date.parse(iso);
+  if (Number.isNaN(t)) return sanitizeValue(iso);
+  const ms = now() - t;
+  if (ms < 6e4) return "just now";
+  const m = Math.floor(ms / 6e4);
+  if (m < 60) return `${m}m ago`;
+  const h = Math.floor(m / 60);
+  if (h < 24) return `${h}h ago`;
+  const d = Math.floor(h / 24);
+  if (d < 30) return `${d}d ago`;
+  return new Date(t).toISOString().slice(0, 10);
+}
+function renderProfile(profile, opts) {
+  const c = palette(opts.color);
+  const preview = opts.mode === "preview";
+  const byKey = new Map(
+    (profile.entries ?? []).map((e) => [e.key, e.value])
+  );
+  const rows = CURATED_KEYS.flatMap((key) => {
+    const value = byKey.get(key);
+    if (value === void 0 && !preview) return [];
+    return [{ label: KEY_LABELS[key], value: value === void 0 ? null : sanitizeValue(value) }];
+  });
+  const extras = (profile.extras ?? []).map((x) => ({
+    label: sanitizeValue(x.label),
+    value: sanitizeValue(x.value)
+  }));
+  const labelW = Math.max(
+    0,
+    ...rows.map((r) => r.label.length),
+    ...extras.map((x) => x.label.length)
+  );
+  const val = (v) => isHttpUrl(v) ? link(v, opts.color) : v;
+  const lines = [
+    "",
+    `  ${c.faint}${opts.site}/${c.reset}${c.bold}${sanitizeValue(profile.handle)}${c.reset}`,
+    ""
+  ];
+  for (const r of rows) {
+    lines.push(
+      r.value === null ? `  ${c.faint}${r.label.padEnd(labelW)}  ${MISSING}${c.reset}` : `  ${c.faint}${r.label.padEnd(labelW)}${c.reset}  ${val(r.value)}`
+    );
+  }
+  if (extras.length) {
+    lines.push("");
+    for (const x of extras) {
+      lines.push(`  ${c.faint}${x.label.padEnd(labelW)}${c.reset}  ${val(x.value)}`);
+    }
+  }
+  if (!preview) {
+    lines.push("", `  ${c.faint}updated ${relTime(profile.updated_at, opts.now)}${c.reset}`);
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+var MISSING = "\u2014";
+function extrasBlock(extras, theirsLabel, mineLabel, c) {
+  if (!extras.theirs.length && !extras.mine.length) return [];
+  const out = ["", `  ${c.faint}extras${c.reset}`];
+  const line = (who, label, value) => `  ${c.faint}${who}${c.reset}  ${sanitizeValue(label)} = ${sanitizeValue(value)}`;
+  for (const x of extras.theirs) out.push(line(theirsLabel, x.label, x.value));
+  for (const x of extras.mine) out.push(line(mineLabel, x.label, x.value));
+  return out;
+}
+function renderDiff(result, opts) {
+  const c = palette(opts.color);
+  const theirsLabel = sanitizeValue(opts.theirsLabel);
+  const mineLabel = sanitizeValue(opts.mineLabel);
+  const cells = result.rows.map((r) => ({
+    label: r.label,
+    theirs: r.theirs === null ? MISSING : sanitizeValue(r.theirs),
+    mine: r.mine === null ? MISSING : sanitizeValue(r.mine),
+    differ: r.status !== "same"
+  }));
+  const labelW = Math.max(3, ...cells.map((r) => r.label.length));
+  const theirsHead = theirsLabel.toUpperCase();
+  const theirsW = Math.max(theirsHead.length, ...cells.map((r) => r.theirs.length));
+  const lines = [
+    "",
+    // The web diff's h1, collapsed to one line — information (which side is which), not decoration,
+    // so it prints in both color modes.
+    `  ${c.faint}how${c.reset} ${c.bold}${theirsLabel}${c.reset} ${c.faint}differs from${c.reset} ${c.bold}${mineLabel}${c.reset}`,
+    ""
+  ];
+  lines.push(
+    `  ${c.faint}${"".padEnd(labelW)}  ${theirsHead.padEnd(theirsW)}  ${mineLabel.toUpperCase()}${c.reset}`
+  );
+  for (const r of cells) {
+    if (!opts.color) {
+      const sym = r.differ ? "~" : "=";
+      lines.push(`${sym} ${r.label.padEnd(labelW)}  ${r.theirs.padEnd(theirsW)}  ${r.mine}`);
+    } else if (r.differ) {
+      lines.push(
+        `${c.amber}\u2022${c.reset} ${r.label.padEnd(labelW)}  ${c.amber}${r.theirs.padEnd(theirsW)}${c.reset}  ${c.amber}${r.mine}${c.reset}`
+      );
+    } else {
+      lines.push(
+        `  ${c.faint}${r.label.padEnd(labelW)}  ${r.theirs.padEnd(theirsW)}  ${r.mine}${c.reset}`
+      );
+    }
+  }
+  lines.push(...extrasBlock(result.extras, theirsLabel, mineLabel, c));
+  lines.push("", `  ${c.faint}${result.differ} differ   ${result.shared} shared${c.reset}`, "");
+  return lines.join("\n");
+}
+function nudge(color) {
+  const c = palette(color);
+  return `
+  ${c.amber}publish yours to diff \u2192${c.reset} run ${c.bold}ymmv${c.reset}
+`;
+}
+function notFound(handle, color, base) {
+  return `
+  no ymmv profile for "${sanitizeValue(handle)}" yet.
+  publish one at ${link(base, color)} with: npx ymmv-cli
+`;
+}
+
+// src/http.ts
+function causeText(err) {
+  const pick = (e) => {
+    if (e instanceof AggregateError) {
+      const first = e.errors.find((x) => x instanceof Error && x.message.length > 0);
+      if (first) return first.message;
+      const code = e.code;
+      if (code) return String(code);
+    }
+    return e.message;
+  };
+  let text;
+  if (err instanceof Error) {
+    const fromCause = err.cause instanceof Error ? pick(err.cause) : "";
+    text = fromCause || pick(err) || String(err);
+  } else {
+    text = String(err);
+  }
+  return sanitizeValue(text);
+}
+function wireText(text) {
+  const clean = sanitizeValue(String(text));
+  return clean.length > 200 ? `${clean.slice(0, 200)}\u2026` : clean;
+}
+async function safeFetch(url, init, reach, fetchFn = globalThis.fetch) {
+  try {
+    return await fetchFn(url, init);
+  } catch (err) {
+    throw new Error(`Can't reach ${reach}. Check your connection (${causeText(err)})`, {
+      cause: err
+    });
+  }
+}
+
+// src/auth-http.ts
+async function mintYmmvToken(accessToken) {
+  const res = await safeFetch(
+    `${BASE}/api/v1/auth/token`,
+    {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ access_token: accessToken }),
+      // Never follow a redirect: a 30x must fail (the existing `!res.ok` guard rejects the resulting
+      // opaqueredirect), not re-POST the GitHub access_token to the redirect target or read a
+      // redirected 200 as a successful mint. Mirrors publish/delete in api.ts.
+      redirect: "manual"
+    },
+    BASE
+  );
+  if (!res.ok) {
+    const body = await res.json().catch(() => ({}));
+    if (res.status === 503) {
+      throw new Error(
+        body.message ? wireText(body.message) : "GitHub is unavailable. Run `ymmv login` again shortly."
+      );
+    }
+    if (res.status === 429) {
+      const retry = res.headers.get("retry-after");
+      const msg = body.message ? wireText(body.message) : "Too many login attempts. Slow down and try again shortly";
+      throw new Error(retry ? `${msg} (retry in ${retry}s)` : msg);
+    }
+    throw new Error(`login failed: ${res.status} ${wireText(body.error ?? "")}`.trim());
+  }
+  const data = await res.json().catch(() => null);
+  if (!data || typeof data.token !== "string" || data.token.length === 0 || data.handle !== null && typeof data.handle !== "string") {
+    throw new Error(
+      `Unexpected response from ${BASE}. Nothing was saved; run \`ymmv login\` again.`
+    );
+  }
+  return { token: data.token, handle: data.handle === null ? null : sanitizeValue(data.handle) };
+}
+async function revokeYmmvToken(token) {
+  const res = await fetch(`${BASE}/api/v1/auth/logout`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}` },
+    // Never follow a redirect: a 30x→200 must not read as a successful revoke (which would delete the
+    // local file while the server token stays live). Same guard as mint + publish/delete.
+    redirect: "manual"
+  });
+  if (!res.ok) throw new Error(`logout failed: ${res.status}`);
+  const body = await res.json().catch(() => ({}));
+  return body.revoked === true;
+}
+
+// src/commands.ts
+import { readFileSync, statSync } from "fs";
+
 // src/token-store.ts
 import { randomUUID } from "crypto";
 import { chmod, mkdir, readFile, rename, rm, writeFile } from "fs/promises";
@@ -440,15 +662,24 @@ var TOKEN_URL = "https://github.com/login/oauth/access_token";
 var realSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 async function requestDeviceCode(deps = {}) {
   const doFetch = deps.fetch ?? globalThis.fetch;
-  const res = await doFetch(DEVICE_CODE_URL, {
-    method: "POST",
-    headers: { accept: "application/json" },
-    body: new URLSearchParams({ client_id: GITHUB_CLIENT_ID })
-  });
+  const res = await safeFetch(
+    DEVICE_CODE_URL,
+    {
+      method: "POST",
+      headers: { accept: "application/json" },
+      body: new URLSearchParams({ client_id: GITHUB_CLIENT_ID })
+    },
+    "github.com",
+    doFetch
+  );
   if (!res.ok) {
-    throw new Error(`device code request failed: ${res.status} ${await res.text()}`);
+    throw new Error(`device code request failed: ${res.status} ${wireText(await res.text())}`);
   }
-  return await res.json();
+  const data = await res.json().catch(() => null);
+  if (!data || typeof data.device_code !== "string" || typeof data.user_code !== "string" || typeof data.verification_uri !== "string" || typeof data.expires_in !== "number") {
+    throw new Error("GitHub sent an unexpected device-code response. Run `ymmv login` again.");
+  }
+  return data;
 }
 async function pollForToken(dc, deps = {}) {
   const doFetch = deps.fetch ?? globalThis.fetch;
@@ -457,30 +688,39 @@ async function pollForToken(dc, deps = {}) {
   let interval = dc.interval || 5;
   const deadline = now() + dc.expires_in * 1e3;
   let transientFailures = 0;
+  let lastCause = "";
   const MAX_TRANSIENT_FAILURES = 5;
   while (now() < deadline) {
     await sleep(interval * 1e3);
-    const res = await doFetch(TOKEN_URL, {
-      method: "POST",
-      headers: { accept: "application/json" },
-      body: new URLSearchParams({
-        client_id: GITHUB_CLIENT_ID,
-        device_code: dc.device_code,
-        grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-      })
-    });
+    let res;
+    try {
+      res = await doFetch(TOKEN_URL, {
+        method: "POST",
+        headers: { accept: "application/json" },
+        body: new URLSearchParams({
+          client_id: GITHUB_CLIENT_ID,
+          device_code: dc.device_code,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+        })
+      });
+    } catch (err) {
+      lastCause = causeText(err);
+    }
     let tok;
-    if (res.ok) {
+    if (res?.ok) {
       try {
         tok = await res.json();
       } catch {
         tok = void 0;
+        lastCause = "unexpected response body";
       }
+    } else if (res) {
+      lastCause = `HTTP ${res.status}`;
     }
     if (tok === void 0) {
       if (++transientFailures >= MAX_TRANSIENT_FAILURES) {
         throw new Error(
-          "GitHub isn't responding to the login poll \u2014 check your connection and run `ymmv login` again."
+          `GitHub isn't responding to the login poll. Check your connection and run \`ymmv login\` again.${lastCause ? ` (last error: ${lastCause})` : ""}`
         );
       }
       continue;
@@ -496,22 +736,28 @@ async function pollForToken(dc, deps = {}) {
       case "access_denied":
         throw new Error("Authorization denied. Run `ymmv login` to try again.");
       case "expired_token":
-        throw new Error("Device code expired \u2014 run `ymmv login` again.");
+        throw new Error("Device code expired. Run `ymmv login` again.");
       default:
-        throw new Error(`device flow failed: ${tok.error ?? "unknown error"}`);
+        throw new Error(`device flow failed: ${wireText(tok.error ?? "unknown error")}`);
     }
   }
-  throw new Error("Device code expired \u2014 run `ymmv login` again.");
+  throw new Error("Device code expired. Run `ymmv login` again.");
 }
 async function login(deps = {}) {
   if (!process.stdin.isTTY) {
     throw new Error(
-      "Device login needs an interactive terminal \u2014 run `ymmv login` in a real terminal (a piped or CI shell can't complete the GitHub device flow)."
+      "Device login needs an interactive terminal. Run `ymmv login` in a real terminal (a piped or CI shell can't complete the GitHub device flow)."
     );
   }
   const dc = await requestDeviceCode(deps);
-  console.log(`
-  Open ${dc.verification_uri} and enter code: ${dc.user_code}
+  const color = colorEnabled();
+  const c = palette(color);
+  const verifyUri = /^https:\/\/github\.com\//.test(dc.verification_uri) ? link(dc.verification_uri, color) : sanitizeValue(dc.verification_uri);
+  console.log(
+    `
+  Open ${verifyUri} and enter code: ${c.bold}${sanitizeValue(dc.user_code)}${c.reset}`
+  );
+  console.log(`  ${c.faint}waiting for GitHub approval\u2026 (Ctrl+C to cancel)${c.reset}
 `);
   const accessToken = await pollForToken(dc, deps);
   const { token, handle } = await mintYmmvToken(accessToken);
@@ -524,147 +770,17 @@ async function login(deps = {}) {
   }
   console.log(
     handle ? `  Logged in as ${handle}.
-` : "  Logged in \u2014 no handle bound (your GitHub username is a reserved word).\n"
-  );
-}
-
-// src/render.ts
-var ESC = String.fromCharCode(27);
-var CSI = `${ESC}[`;
-var CODES = {
-  amber: `${CSI}93m`,
-  // DESIGN: amber == ANSI bright-yellow
-  faint: `${CSI}90m`,
-  bold: `${CSI}1m`,
-  reset: `${CSI}0m`
-};
-var NO_CODES = { amber: "", faint: "", bold: "", reset: "" };
-function palette(color) {
-  return color ? CODES : NO_CODES;
-}
-var ESC_INTRODUCERS = `${String.fromCharCode(27)}${String.fromCharCode(155)}`;
-var BEL = String.fromCharCode(7);
-var ANSI_RE = new RegExp(
-  `[${ESC_INTRODUCERS}][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d/#&.:=?%@~_]*)*)?${BEL})|(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]))`,
-  "g"
-);
-var CTRL_RE = new RegExp(
-  `[${String.fromCharCode(0)}-${String.fromCharCode(31)}${String.fromCharCode(127)}-${String.fromCharCode(159)}]`,
-  "g"
-);
-var BIDI_RE = new RegExp(
-  `[${String.fromCharCode(8234)}-${String.fromCharCode(8238)}${String.fromCharCode(8294)}-${String.fromCharCode(8297)}${String.fromCharCode(8206)}${String.fromCharCode(8207)}]`,
-  "g"
-);
-function sanitizeValue(value) {
-  return value.replace(ANSI_RE, "").replace(CTRL_RE, "").replace(BIDI_RE, "");
-}
-function useColor(env, isTTY) {
-  if (env.NO_COLOR !== void 0) return false;
-  if (env.FORCE_COLOR !== void 0) return env.FORCE_COLOR !== "0";
-  return isTTY;
-}
-function orderedEntries(profile) {
-  const byKey = new Map(
-    (profile.entries ?? []).map((e) => [e.key, e.value])
+` : "  Logged in. No handle bound (your GitHub username is a reserved word).\n"
   );
-  return CURATED_KEYS.flatMap((key) => {
-    const value = byKey.get(key);
-    return value === void 0 ? [] : [{ label: KEY_LABELS[key], value: sanitizeValue(value) }];
-  });
-}
-function renderProfile(profile, opts) {
-  const c = palette(opts.color);
-  const rows = orderedEntries(profile);
-  const extras = (profile.extras ?? []).map((x) => ({
-    label: sanitizeValue(x.label),
-    value: sanitizeValue(x.value)
-  }));
-  const labelW = Math.max(
-    0,
-    ...rows.map((r) => r.label.length),
-    ...extras.map((x) => x.label.length)
-  );
-  const lines = ["", `  ${c.bold}${sanitizeValue(profile.handle)}${c.reset}`, ""];
-  for (const r of rows) {
-    lines.push(`  ${c.faint}${r.label.padEnd(labelW)}${c.reset}  ${r.value}`);
-  }
-  if (extras.length) {
-    lines.push("");
-    for (const x of extras) {
-      lines.push(`  ${c.faint}${x.label.padEnd(labelW)}${c.reset}  ${x.value}`);
-    }
-  }
-  lines.push("", `  ${c.faint}updated ${sanitizeValue(profile.updated_at)}${c.reset}`, "");
-  return lines.join("\n");
-}
-var MISSING = "\u2014";
-function extrasBlock(extras, theirsLabel, mineLabel, c) {
-  if (!extras.theirs.length && !extras.mine.length) return [];
-  const out = ["", `  ${c.faint}extras${c.reset}`];
-  const line = (who, label, value) => `  ${c.faint}${who}${c.reset}  ${sanitizeValue(label)} = ${sanitizeValue(value)}`;
-  for (const x of extras.theirs) out.push(line(theirsLabel, x.label, x.value));
-  for (const x of extras.mine) out.push(line(mineLabel, x.label, x.value));
-  return out;
-}
-function renderDiff(result, opts) {
-  const c = palette(opts.color);
-  const theirsLabel = sanitizeValue(opts.theirsLabel);
-  const mineLabel = sanitizeValue(opts.mineLabel);
-  const cells = result.rows.map((r) => ({
-    label: r.label,
-    theirs: r.theirs === null ? MISSING : sanitizeValue(r.theirs),
-    mine: r.mine === null ? MISSING : sanitizeValue(r.mine),
-    differ: r.status !== "same"
-  }));
-  const labelW = Math.max(3, ...cells.map((r) => r.label.length));
-  const theirsW = Math.max(theirsLabel.length, ...cells.map((r) => r.theirs.length));
-  const lines = [""];
-  lines.push(
-    `  ${c.faint}${"".padEnd(labelW)}  ${theirsLabel.padEnd(theirsW)}  ${mineLabel}${c.reset}`
-  );
-  for (const r of cells) {
-    if (!opts.color) {
-      const sym = r.differ ? "~" : "=";
-      lines.push(`${sym} ${r.label.padEnd(labelW)}  ${r.theirs.padEnd(theirsW)}  ${r.mine}`);
-    } else if (r.differ) {
-      lines.push(
-        `${c.amber}\u2022${c.reset} ${r.label.padEnd(labelW)}  ${c.amber}${r.theirs.padEnd(theirsW)}${c.reset}  ${c.amber}${r.mine}${c.reset}`
-      );
-    } else {
-      lines.push(
-        `  ${c.faint}${r.label.padEnd(labelW)}  ${r.theirs.padEnd(theirsW)}  ${r.mine}${c.reset}`
-      );
-    }
-  }
-  lines.push(...extrasBlock(result.extras, theirsLabel, mineLabel, c));
-  lines.push(
-    "",
-    `  ${c.faint}${result.differ} differ \xB7 ${result.shared} shared \u2014 your mileage may vary${c.reset}`,
-    ""
-  );
-  return lines.join("\n");
-}
-function nudge(color) {
-  const c = palette(color);
-  return `
-  ${c.amber}publish yours to diff \u2192${c.reset} run ${c.bold}ymmv${c.reset}
-`;
-}
-function notFound(handle) {
-  return `
-  no ymmv profile for "${sanitizeValue(handle)}" yet.
-  publish one at ymmv.fyi with: npx ymmv-cli
-`;
 }
 
 // src/api.ts
 async function rateLimitMessage(res) {
   const retry = res.headers.get("retry-after");
-  let msg = "rate limited \u2014 too many requests";
+  let msg = "rate limited, too many requests";
   try {
     const body = await res.json();
-    if (typeof body?.message === "string" && body.message) msg = body.message;
+    if (typeof body?.message === "string" && body.message) msg = wireText(body.message);
   } catch {
   }
   return retry ? `${msg} (retry in ${retry}s)` : msg;
@@ -674,32 +790,43 @@ async function ensureLogin() {
   if (existing) return existing;
   await login();
   const fresh = await loadToken();
-  if (!fresh) throw new Error("login did not persist a token \u2014 run `ymmv login`.");
+  if (!fresh) throw new Error("Login did not persist a token. Run `ymmv login`.");
   return fresh;
 }
 async function publishProfile(profile) {
-  const send = (c) => fetch(`${BASE}/api/v1/profile`, {
-    method: "POST",
-    headers: { "content-type": "application/json", authorization: `Bearer ${c.token}` },
-    // Send the login-bound handle, never a caller-guessed one — the official client never claims
-    // a handle it doesn't own.
-    body: JSON.stringify({ ...profile, handle: c.handle ?? profile.handle }),
-    redirect: "manual"
-    // a mutation must never follow a redirect into a false success
-  });
+  const send = (c) => safeFetch(
+    `${BASE}/api/v1/profile`,
+    {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${c.token}` },
+      // Send the login-bound handle, never a caller-guessed one — the official client never claims
+      // a handle it doesn't own.
+      body: JSON.stringify({ ...profile, handle: c.handle ?? profile.handle }),
+      redirect: "manual"
+      // a mutation must never follow a redirect into a false success
+    },
+    BASE
+  );
   let cred = await ensureLogin();
   if ((cred.handle ?? "").toLowerCase() !== profile.handle.toLowerCase()) {
     throw new Error(
-      "the stored login changed while this command was running \u2014 re-run it under the current account."
+      "The stored login changed while this command was running. Re-run it under the current account."
     );
   }
   let res = await send(cred);
   if (res.status === 401 || res.status === 409) {
-    if (res.status === 401) await deleteToken();
+    const was401 = res.status === 401;
+    if (was401) await deleteToken();
     await login();
     cred = await ensureLogin();
+    if ((cred.handle ?? "").toLowerCase() !== profile.handle.toLowerCase()) {
+      const bound = sanitizeValue(cred.handle ?? "");
+      throw new Error(
+        was401 ? `The re-login bound a different account ("${bound}", not "${sanitizeValue(profile.handle)}"). Nothing was published. Re-run under the account you meant.` : `Your login now binds "${bound}". Nothing was published. Re-run the command to publish under it.`
+      );
+    }
     res = await send(cred);
-    if (res.status === 401) throw new Error("authentication failed \u2014 run `ymmv login`.");
+    if (res.status === 401) throw new Error("Authentication failed. Run `ymmv login`.");
     if (res.status === 409) {
       throw new Error(
         "that handle is taken by another account (your GitHub handle may have been reused)."
@@ -708,33 +835,37 @@ async function publishProfile(profile) {
   }
   if (res.status === 429) throw new Error(await rateLimitMessage(res));
   if (!res.ok) {
-    throw new Error(`publish failed: ${res.status} ${await res.text()}`);
+    throw new Error(`publish failed: ${res.status} ${wireText(await res.text())}`);
   }
   const data = await res.json();
   const shown = typeof data.handle === "string" ? sanitizeValue(data.handle) : profile.handle;
-  console.log(`Published ${shown} -> ${BASE}/${shown}`);
+  return { handle: shown, url: `${BASE}/${shown}` };
 }
 async function fetchProfileJson(handle) {
-  const res = await fetch(`${BASE}/api/v1/u/${encodeURIComponent(handle)}`);
+  const res = await safeFetch(`${BASE}/api/v1/u/${encodeURIComponent(handle)}`, void 0, BASE);
   if (res.status === 404) return null;
   if (!res.ok) {
-    throw new Error(`fetch failed: ${res.status} ${await res.text()}`);
+    throw new Error(`fetch failed: ${res.status} ${wireText(await res.text())}`);
   }
   return parseProfile(await res.json());
 }
 async function deleteProfile() {
   const cred = await ensureLogin();
-  const res = await fetch(`${BASE}/api/v1/profile`, {
-    method: "DELETE",
-    headers: { authorization: `Bearer ${cred.token}` },
-    redirect: "manual"
-  });
+  const res = await safeFetch(
+    `${BASE}/api/v1/profile`,
+    {
+      method: "DELETE",
+      headers: { authorization: `Bearer ${cred.token}` },
+      redirect: "manual"
+    },
+    BASE
+  );
   if (res.status === 401) {
-    throw new Error("session expired \u2014 run `ymmv login`, then `ymmv delete` again.");
+    throw new Error("Session expired. Run `ymmv login`, then `ymmv delete` again.");
   }
   if (res.status === 429) throw new Error(await rateLimitMessage(res));
   if (!res.ok) {
-    throw new Error(`delete failed: ${res.status} ${await res.text()}`);
+    throw new Error(`delete failed: ${res.status} ${wireText(await res.text())}`);
   }
 }
 
@@ -1008,10 +1139,87 @@ function applyUnset(existing, target) {
   };
 }
 
-// src/commands.ts
-function colorEnabled() {
-  return useColor(process.env, Boolean(process.stdout.isTTY));
+// src/prompt.ts
+import { stdin, stdout } from "process";
+import { createInterface } from "readline/promises";
+var PromptAborted = class extends Error {
+  constructor() {
+    super("aborted");
+    this.name = "PromptAborted";
+  }
+};
+function promptLine(label, def, color = false) {
+  const c = palette(color);
+  const clean = def ? sanitizeValue(def) : def;
+  return `  ${c.faint}${label}${c.reset}${clean ? ` [${clean}]` : ""}: `;
+}
+function matchChoice(answer, keys, def) {
+  if (keys.some((k) => k.length !== 1) || new Set(keys).size !== keys.length) {
+    throw new Error(`choice keys must be unique single letters: ${keys.join(",")}`);
+  }
+  const a = answer.trim().toLowerCase();
+  if (a === "") return def;
+  const first = a[0];
+  return keys.includes(first) ? first : null;
 }
+function makePrompter() {
+  let rl = null;
+  const color = colorEnabled();
+  const c = palette(color);
+  let ac = null;
+  const io = () => {
+    if (!rl) {
+      rl = createInterface({ input: stdin, output: stdout });
+      rl.on("SIGINT", () => {
+        if (ac) ac.abort();
+        else {
+          stdout.write("\n");
+          process.exit(130);
+        }
+      });
+      rl.on("close", () => {
+        ac?.abort();
+      });
+    }
+    return rl;
+  };
+  const question = async (query) => {
+    const controller = new AbortController();
+    ac = controller;
+    try {
+      return await io().question(query, { signal: controller.signal });
+    } catch (e) {
+      if (e instanceof Error && e.name === "AbortError") throw new PromptAborted();
+      throw e;
+    } finally {
+      ac = null;
+    }
+  };
+  return {
+    async ask(label, def) {
+      const clean = def ? sanitizeValue(def) : def;
+      const answer = (await question(promptLine(label, def, color))).trim();
+      return answer === "" ? clean ?? "" : answer;
+    },
+    async confirm(q, defYes) {
+      const answer = (await question(`  ${q} ${c.faint}[${defYes ? "Y/n" : "y/N"}]${c.reset} `)).trim().toLowerCase();
+      if (answer === "") return defYes;
+      return answer === "y" || answer === "yes";
+    },
+    async choice(q, keys, def, hint) {
+      for (; ; ) {
+        const hit = matchChoice(await question(`  ${q} ${c.faint}[${hint}]${c.reset} `), keys, def);
+        if (hit !== null) return hit;
+      }
+    },
+    close() {
+      rl?.close();
+      rl = null;
+    }
+  };
+}
+
+// src/commands.ts
 function requireHandle(cred) {
   if (cred.handle) return cred.handle;
   console.error(
@@ -1023,7 +1231,7 @@ function requireHandle(cred) {
 function assertHandleUnchanged(existing, handle) {
   if (existing && existing.handle.toLowerCase() !== handle.toLowerCase()) {
     throw new Error(
-      `this login is bound to "${handle}" but your profile now lives at "${sanitizeValue(existing.handle)}" \u2014 run \`ymmv login\` to refresh, then retry.`
+      `This login is bound to "${handle}" but your profile now lives at "${sanitizeValue(existing.handle)}". Run \`ymmv login\` to refresh, then retry.`
     );
   }
 }
@@ -1036,14 +1244,25 @@ function newProfile(handle, entries, extras) {
     updated_at: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
+function printPublished(res, color) {
+  console.log(`Published ${res.handle} \u2192 ${link(res.url, color)}`);
+}
+function pagePointer(handle) {
+  const color = colorEnabled();
+  const c = palette(color);
+  return ` ${c.faint}\u2192 ${color ? displayUrl(BASE) : BASE}/${handle}${c.reset}`;
+}
 async function promptEntries(defaults, prompter) {
+  const c = palette(colorEnabled());
+  console.log(`
+  ${c.faint}Enter to keep, "-" to clear${c.reset}`);
   const chosen = /* @__PURE__ */ new Map();
   for (const key of CURATED_KEYS) {
     const answer = (await prompter.ask(KEY_LABELS[key], defaults.get(key))).trim();
     const value = answer === "-" ? "" : answer;
     if (value) chosen.set(key, value);
   }
-  return entriesFromMap(chosen);
+  return chosen;
 }
 async function publish(io) {
   if (!io.interactive && !io.yes) {
@@ -1065,44 +1284,73 @@ async function publish(io) {
   assertHandleUnchanged(existing, handle);
   const defaults = buildDefaults(existing, detected);
   const carried = unknownEntries(existing);
-  let entries = entriesFromMap(defaults);
   const extras = existing?.extras ?? [];
-  if (io.interactive && io.prompter) {
-    entries = await promptEntries(defaults, io.prompter);
-  }
-  entries = [...entries, ...carried];
-  const profile = newProfile(handle, entries, extras);
-  console.log(renderProfile(profile, { color: colorEnabled() }));
-  if (carried.length > 0) {
-    const s = carried.length === 1 ? "" : "s";
-    console.log(`(+${carried.length} newer field${s} kept as-is \u2014 upgrade ymmv-cli to edit them)`);
-    for (const e of carried) {
-      console.log(`    ${sanitizeValue(e.key)} = ${sanitizeValue(e.value)}`);
+  const color = colorEnabled();
+  const site = displayUrl(BASE);
+  const showCard = (entries) => {
+    console.log(
+      renderProfile(newProfile(handle, entries, extras), { color, site, mode: "preview" })
+    );
+    if (carried.length > 0) {
+      const s = carried.length === 1 ? "" : "s";
+      console.log(`(+${carried.length} newer field${s} kept as-is; upgrade ymmv-cli to edit them)`);
+      for (const e of carried) {
+        console.log(`    ${sanitizeValue(e.key)} = ${sanitizeValue(e.value)}`);
+      }
     }
-  }
-  const publishedLabels = new Set(
-    entries.filter((e) => isCuratedKey(e.key)).map((e) => KEY_LABELS[e.key].toLowerCase())
-  );
-  for (const x of extras) {
-    if (publishedLabels.has(x.label.trim().toLowerCase())) {
-      const label = sanitizeValue(x.label.trim());
-      console.log(`(extra "${label}" duplicates a curated field \u2014 ymmv unset --extra "${label}")`);
+    const publishedLabels = new Set(
+      entries.filter((e) => isCuratedKey(e.key)).map((e) => KEY_LABELS[e.key].toLowerCase())
+    );
+    for (const x of extras) {
+      if (publishedLabels.has(x.label.trim().toLowerCase())) {
+        const label = sanitizeValue(x.label.trim());
+        console.log(`(extra "${label}" duplicates a curated field; ymmv unset --extra "${label}")`);
+      }
     }
+  };
+  let values = defaults;
+  const assemble = () => [...entriesFromMap(values), ...carried];
+  if (!io.interactive || !io.prompter || io.yes) {
+    const entries = assemble();
+    showCard(entries);
+    printPublished(await publishProfile(newProfile(handle, entries, extras)), color);
+    return;
   }
-  if (io.interactive && io.prompter && !io.yes) {
-    const go = await io.prompter.confirm(`Publish to ymmv.fyi/${handle}?`, true);
-    if (!go) {
-      console.log("Aborted \u2014 nothing published.");
+  try {
+    if (!existing) values = await promptEntries(values, io.prompter);
+    for (; ; ) {
+      const entries = assemble();
+      showCard(entries);
+      const ans = await io.prompter.choice(
+        `Publish to ${site}/${sanitizeValue(handle)}?`,
+        ["y", "n", "e"],
+        "y",
+        "Y/n/e=edit"
+      );
+      if (ans === "y") {
+        printPublished(await publishProfile(newProfile(handle, entries, extras)), color);
+        return;
+      }
+      if (ans === "n") {
+        console.log("Aborted. Nothing published.");
+        return;
+      }
+      values = await promptEntries(values, io.prompter);
+    }
+  } catch (e) {
+    if (e instanceof PromptAborted) {
+      console.log("\nAborted. Nothing published.");
+      process.exitCode = 130;
       return;
     }
+    throw e;
   }
-  await publishProfile(profile);
 }
 async function view(handle) {
   const theirs = await fetchProfileJson(handle);
   const c = colorEnabled();
   if (!theirs) {
-    console.log(notFound(handle));
+    console.log(notFound(handle, c, BASE));
     return;
   }
   const cred = await loadToken();
@@ -1115,12 +1363,12 @@ async function view(handle) {
       return;
     }
     if (!mine) {
-      console.log(renderProfile(theirs, { color: c }));
+      console.log(renderProfile(theirs, { color: c, site: displayUrl(BASE) }));
       console.log(nudge(c));
       return;
     }
   }
-  console.log(renderProfile(theirs, { color: c }));
+  console.log(renderProfile(theirs, { color: c, site: displayUrl(BASE) }));
 }
 async function runSet(target) {
   const cred = await ensureLogin();
@@ -1129,12 +1377,9 @@ async function runSet(target) {
   const existing = await fetchProfileJson(handle);
   assertHandleUnchanged(existing, handle);
   const { entries, extras } = applySet(existing, target);
-  await publishProfile(newProfile(handle, entries, extras));
-  if (target.kind === "curated") {
-    console.log(`Set ${KEY_LABELS[target.key]} = ${target.value}.`);
-  } else {
-    console.log(`Set extra ${target.label} = ${target.value}.`);
-  }
+  const res = await publishProfile(newProfile(handle, entries, extras));
+  const line = target.kind === "curated" ? `Set ${KEY_LABELS[target.key]} = ${target.value}.` : `Set extra ${target.label} = ${target.value}.`;
+  console.log(`${line}${pagePointer(res.handle)}`);
 }
 async function runUnset(target) {
   const cred = await ensureLogin();
@@ -1143,7 +1388,7 @@ async function runUnset(target) {
   const existing = await fetchProfileJson(handle);
   assertHandleUnchanged(existing, handle);
   if (!existing) {
-    console.log("No profile yet \u2014 run `ymmv` to publish one.");
+    console.log("No profile yet. Run `ymmv` to publish one.");
     return;
   }
   const { entries, extras, removed } = applyUnset(existing, target);
@@ -1153,18 +1398,13 @@ async function runUnset(target) {
     );
     return;
   }
-  await publishProfile(newProfile(handle, entries, extras));
-  if (target.kind === "curated") {
-    console.log(`Removed ${KEY_LABELS[target.key]} (was "${sanitizeValue(removed.value)}").`);
-  } else {
-    console.log(
-      `Removed extra "${sanitizeValue(removed.label)}" (was "${sanitizeValue(removed.value)}").`
-    );
-  }
+  const res = await publishProfile(newProfile(handle, entries, extras));
+  const line = target.kind === "curated" ? `Removed ${KEY_LABELS[target.key]} (was "${sanitizeValue(removed.value)}").` : `Removed extra "${sanitizeValue(removed.label)}" (was "${sanitizeValue(removed.value)}").`;
+  console.log(`${line}${pagePointer(res.handle)}`);
 }
 async function runDelete(io) {
   const cred = await ensureLogin();
-  const target = cred.handle ? `ymmv.fyi/${cred.handle}` : "your profile";
+  const target = cred.handle ? `${displayUrl(BASE)}/${sanitizeValue(cred.handle)}` : "your profile";
   if (!io.yes) {
     if (!io.interactive || !io.prompter) {
       console.error(
@@ -1173,9 +1413,19 @@ async function runDelete(io) {
       process.exitCode = 1;
       return;
     }
-    const go = await io.prompter.confirm(`Delete ${target}? This is permanent`, false);
+    let go;
+    try {
+      go = await io.prompter.confirm(`Delete ${target}? This is permanent`, false);
+    } catch (e) {
+      if (e instanceof PromptAborted) {
+        console.log("\nCancelled. Nothing deleted.");
+        process.exitCode = 130;
+        return;
+      }
+      throw e;
+    }
     if (!go) {
-      console.log("Cancelled \u2014 nothing deleted.");
+      console.log("Cancelled. Nothing deleted.");
       return;
     }
   }
@@ -1184,37 +1434,6 @@ async function runDelete(io) {
   console.log(`Deleted ${target}. Run \`ymmv\` to publish again.`);
 }
 
-// src/prompt.ts
-import { stdin, stdout } from "process";
-import { createInterface } from "readline/promises";
-function promptLine(label, def) {
-  const clean = def ? sanitizeValue(def) : def;
-  return `  ${label}${clean ? ` [${clean}]` : ""}: `;
-}
-function makePrompter() {
-  let rl = null;
-  const io = () => {
-    rl ??= createInterface({ input: stdin, output: stdout });
-    return rl;
-  };
-  return {
-    async ask(label, def) {
-      const clean = def ? sanitizeValue(def) : def;
-      const answer = (await io().question(promptLine(label, def))).trim();
-      return answer === "" ? clean ?? "" : answer;
-    },
-    async confirm(question, defYes) {
-      const answer = (await io().question(`  ${question} ${defYes ? "[Y/n]" : "[y/N]"} `)).trim().toLowerCase();
-      if (answer === "") return defYes;
-      return answer === "y" || answer === "yes";
-    },
-    close() {
-      rl?.close();
-      rl = null;
-    }
-  };
-}
-
 // src/resolve.ts
 var SET_EXTRA = 'ymmv set --extra "Label=Value"';
 var UNSET_EXTRA = 'ymmv unset --extra "Label"';
@@ -1288,7 +1507,7 @@ function resolveArg(argv) {
     return { kind: "view", handle };
   }
   if (first.startsWith("-")) {
-    return { kind: "error", message: `unknown option "${first}". Run \`ymmv help\`.` };
+    return { kind: "error", message: `Unknown option "${first}". Run \`ymmv help\`.` };
   }
   if (!isValidHandle(first)) {
     return {
@@ -1300,12 +1519,12 @@ function resolveArg(argv) {
 }
 
 // src/index.ts
-var HELP = `ymmv \u2014 terminal-native developer tool-stack profiles (ymmv.fyi)
+var help = (c) => `${c.bold}ymmv${c.reset}: terminal-native developer tool-stack profiles (ymmv.fyi)
 
-Usage:
+${c.faint}Usage:${c.reset}
   ymmv                      detect your stack, confirm, and publish your profile
   ymmv -y                   publish without prompts (required when stdin isn't a TTY)
-  ymmv <handle>             view a profile \u2014 logged in, see the diff vs yours
+  ymmv <handle>             view a profile; logged in, see the diff vs yours
   ymmv view <handle>        explicit view (when a handle collides with a verb)
   ymmv set <key> <value>    set one curated key
   ymmv set --extra "L=V"    set a free-form extra
@@ -1315,17 +1534,14 @@ Usage:
   ymmv login | logout       GitHub device-flow auth
   ymmv help | --version
 
-Curated keys: editor, os, shell, prompt, terminal, browser, window-manager,
-              font, theme, multiplexer, version-manager, dotfiles, ai-tool
-
-Respects NO_COLOR. Point YMMV_API at a dev Worker to target one.
-Publish your own: npx ymmv-cli`;
+${c.faint}Curated keys:${c.reset} editor, os, shell, prompt, terminal, browser, window-manager,
+              font, theme, multiplexer, version-manager, dotfiles, ai-tool`;
 async function logout() {
   const stored = await loadToken();
   if (!stored) {
     const otherBase = await peekBase();
     console.log(
-      otherBase && otherBase !== BASE ? `Not logged in to ${BASE} (a token for ${otherBase} exists \u2014 set YMMV_API to that to log out of it).` : "Not logged in."
+      otherBase && otherBase !== BASE ? `Not logged in to ${BASE} (a token for ${otherBase} exists; set YMMV_API to that to log out of it).` : "Not logged in."
     );
     return;
   }
@@ -1334,7 +1550,7 @@ async function logout() {
     revoked = await revokeYmmvToken(stored.token);
   } catch {
     console.error(
-      "Couldn't reach the server to revoke \u2014 your token is still active. Run `ymmv logout` again when connected."
+      "Couldn't reach the server to revoke. Your token is still active. Run `ymmv logout` again when connected."
     );
     process.exitCode = 1;
     return;
@@ -1377,14 +1593,17 @@ async function main(argv) {
     case "delete":
       await interactive(runDelete, cmd.yes);
       break;
-    case "login":
+    case "login": {
       await login();
+      const c = palette(colorEnabled());
+      console.log(`  ${c.faint}next: run ymmv to publish your stack${c.reset}`);
       break;
+    }
     case "logout":
       await logout();
       break;
     case "help":
-      console.log(HELP);
+      console.log(help(palette(colorEnabled())));
       break;
     case "version":
       printVersion();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ymmv-cli",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Publish and diff terminal-native developer tool-stack profiles at ymmv.fyi.",
   "type": "module",
   "bin": {