ymmv-cli 0.9.0 → 0.11.0

package/README.md

@@ -68,15 +68,20 @@ Every profile is open JSON too: `GET https://ymmv.fyi/api/v1/u/<handle>`. Full c
 ## Environment variables
 
 - `NO_COLOR` disables color output (and `FORCE_COLOR=0`/`false` force-disables it).
-- `YMMV_API` points the CLI at a different Worker (development/staging). Bare origin only.
+- `YMMV_API` points the CLI at a different Worker (development/staging). Bare origin only. That
+  Worker must be deployed with or after this CLI release: `ymmv login` requires the account id the
+  login response carries and refuses (revoking what it minted) otherwise, and `YMMV_TOKEN` needs
+  the server's account lookup.
 - `YMMV_TOKEN` authenticates without a browser (CI and scripts, below). Takes precedence over
   the stored login and is read-only: the CLI never writes, revokes, or deletes it, and
-  `ymmv login` / `ymmv logout` keep acting on the stored login. Viewing (`ymmv <handle>`) also
-  keeps using the stored login for the you-side of a diff. The token is sent to the server
-  `YMMV_API` selects, so set the two together.
-- `YMMV_HANDLE` names the GitHub username `YMMV_TOKEN` belongs to. Required for `ymmv -y` and
-  `ymmv set`/`unset` under an env token (there is no server lookup for it); ignored without
-  `YMMV_TOKEN`.
+  `ymmv login` / `ymmv logout` keep acting on the stored login. The CLI asks the server which
+  account the token belongs to, so every command, including the you-side of a `ymmv <handle>`
+  diff, runs as that account. The token is sent to the server `YMMV_API` selects, so set the
+  two together.
+- `YMMV_HANDLE` is optional. When set, it must name the GitHub username `YMMV_TOKEN` belongs
+  to: if the server reports a different account, `ymmv -y`, `ymmv set`/`unset`, and
+  `ymmv delete` refuse before sending anything, and `ymmv <handle>` shows the profile without
+  a diff. Ignored without `YMMV_TOKEN`.
 - `YMMV_NO_UPDATE_CHECK` disables the startup check for newer releases (the ecosystem-standard
   `NO_UPDATE_NOTIFIER` works too). The check is also off automatically under `CI`, in pipes,
   and in dev builds; it never blocks or fails a command.
@@ -89,7 +94,8 @@ Every profile is open JSON too: `GET https://ymmv.fyi/api/v1/u/<handle>`. Full c
 2. Copy the `token` value from the token file:
    `~/.config/ymmv/token.json` (Linux), `~/Library/Preferences/ymmv/token.json` (macOS),
    `%APPDATA%\ymmv\Config\token.json` (Windows).
-3. Set it as a CI secret named `YMMV_TOKEN`, and set `YMMV_HANDLE` to your GitHub username.
+3. Set it as a CI secret named `YMMV_TOKEN`. Setting `YMMV_HANDLE` to your GitHub username is
+   optional, and makes the job fail if the secret ever holds another account's token.
 4. Run `npx ymmv-cli@latest -y` in the job.
 
 Two things to know:
@@ -98,9 +104,12 @@ Two things to know:
   runs on. Values you already published always win, but curated keys you have never set get the
   CI runner's detected values (its OS, shell, and so on). For targeted updates from CI, prefer
   `ymmv set <key> <value>`.
-- A rejected or revoked `YMMV_TOKEN` fails with an error naming the variable; nothing falls back
-  to an interactive login, and the stored login file on the runner (if any) is left untouched.
-  `ymmv delete` acts on the account the token is bound to, regardless of `YMMV_HANDLE`.
+- A rejected or revoked `YMMV_TOKEN` fails `ymmv -y`, `ymmv set`/`unset`, and `ymmv delete` with
+  an error naming the variable; nothing falls back to an interactive login, and the stored login
+  file on the runner (if any) is left untouched. `ymmv <handle>` still shows the profile, with the
+  reason there is no diff on stderr, and exits 0.
+  `ymmv delete` acts on the account the token is bound to and names that account's page when
+  it asks for confirmation.
 
 ## License
 

package/dist/cli.js

@@ -259,6 +259,9 @@ function diff(mine, theirs) {
 
 // ../shared/dist/github.js
 var GITHUB_CLIENT_ID = "Ov23liMoD29eizQcN1KZ";
+function isGithubId(x) {
+  return typeof x === "number" && Number.isSafeInteger(x) && x > 0;
+}
 
 // ../shared/dist/types.js
 var SCHEMA_VERSION = 1;
@@ -390,10 +393,7 @@ var CTRL_RE = new RegExp(
   `[${String.fromCharCode(0)}-${String.fromCharCode(31)}${String.fromCharCode(127)}-${String.fromCharCode(159)}]`,
   "g"
 );
-var BIDI_RE = new RegExp(
-  `[${String.fromCharCode(8234)}-${String.fromCharCode(8238)}${String.fromCharCode(8294)}-${String.fromCharCode(8297)}${String.fromCharCode(8206)}${String.fromCharCode(8207)}]`,
-  "g"
-);
+var BIDI_RE = new RegExp("\\p{Bidi_Control}", "gu");
 function sanitizeValue(value) {
   return value.replace(ANSI_RE, "").replace(CTRL_RE, "").replace(BIDI_RE, "");
 }
@@ -545,6 +545,7 @@ function notFound(handle, color, base) {
 
 // src/http.ts
 var REQUEST_TIMEOUT_MS = 3e4;
+var REVOKE_CAP_MS = 5e3;
 var TIMEOUT_TEXT = "request timed out";
 function isTimeoutError(err) {
   return err instanceof Error && (err.name === "TimeoutError" || err.cause instanceof Error && err.cause.name === "TimeoutError");
@@ -683,6 +684,23 @@ async function bodyJson(res) {
     return null;
   }
 }
+var ENV_TOKEN_REJECTED = "The server rejected the token in YMMV_TOKEN (invalid or revoked).";
+var ENV_TOKEN_REJECTED_MINT_AGAIN = `${ENV_TOKEN_REJECTED} Mint a new one with \`ymmv login\` on an interactive machine and update YMMV_TOKEN.`;
+function parseIdentity(data) {
+  if (typeof data !== "object" || data === null) return null;
+  const { handle: rawHandle, github_id: id } = data;
+  const handle = rawHandle === null ? null : typeof rawHandle === "string" ? sanitizeValue(rawHandle) : void 0;
+  if (handle === void 0 || handle !== null && !isValidHandle(handle) || !isGithubId(id)) {
+    return null;
+  }
+  return { github_id: id, handle };
+}
+var MintRejected = class extends Error {
+  constructor(msg) {
+    super(msg);
+    this.name = "MintRejected";
+  }
+};
 async function mintYmmvToken(accessToken) {
   const res = await safeFetch(
     `${BASE}/api/v1/auth/token`,
@@ -724,19 +742,61 @@ async function mintYmmvToken(accessToken) {
     throw new Error(`login failed: ${res.status} ${wireText(slug)}`.trim());
   }
   const data = await bodyJson(res);
-  if (!data || typeof data.token !== "string" || data.token.length === 0 || data.handle !== null && typeof data.handle !== "string") {
+  const unexpected = `Unexpected response from ${BASE}. Nothing was saved; run \`ymmv login\` again.`;
+  if (!data) throw new Error(unexpected);
+  const token = typeof data.token === "string" && data.token.length > 0 ? data.token : null;
+  const identity = parseIdentity(data);
+  if (token === null || identity === null) {
+    let revokeFailed = false;
+    if (token !== null) {
+      await revokeYmmvToken(token, AbortSignal.timeout(REVOKE_CAP_MS)).catch(() => {
+        revokeFailed = true;
+      });
+    }
+    throw new MintRejected(
+      revokeFailed ? `${unexpected} The login the server minted could not be revoked.` : unexpected
+    );
+  }
+  return { token, ...identity };
+}
+async function fetchWhoami(token) {
+  const res = await safeFetch(
+    `${BASE}/api/v1/auth/whoami`,
+    {
+      headers: { authorization: `Bearer ${token}` },
+      // Never follow a redirect: the bearer must not travel to a redirect target, and a 30x→200
+      // must not read as a verified identity. Same guard as mint, logout, publish, and delete.
+      redirect: "manual"
+    },
+    BASE
+  );
+  if (!res.ok) {
+    if (res.status === 401) throw new Error(ENV_TOKEN_REJECTED_MINT_AGAIN);
+    if (res.status === 404) {
+      throw new Error(
+        `${BASE} has no identity lookup for YMMV_TOKEN. ${process.env.YMMV_API ? "Point YMMV_API at an up-to-date server." : "The server is behind this CLI release; try again later."}`
+      );
+    }
     throw new Error(
-      `Unexpected response from ${BASE}. Nothing was saved; run \`ymmv login\` again.`
+      withRetryHint(
+        await serverMessage(res) ?? (res.status === 429 ? "rate limited, too many requests" : `The server couldn't look up your token (${res.status}). Try again shortly.`),
+        res
+      )
     );
   }
-  return { token: data.token, handle: data.handle === null ? null : sanitizeValue(data.handle) };
+  const identity = parseIdentity(await bodyJson(res));
+  if (!identity) {
+    throw new Error(`Unexpected response from ${BASE}. Check YMMV_API, or try again shortly.`);
+  }
+  return identity;
 }
-async function revokeYmmvToken(token) {
+async function revokeYmmvToken(token, signal) {
   const res = await safeFetch(
     `${BASE}/api/v1/auth/logout`,
     {
       method: "POST",
       headers: { authorization: `Bearer ${token}` },
+      signal,
       // Never follow a redirect: a 30x→200 must not read as a successful revoke (which would delete
       // the local file while the server token stays live). Same guard as mint + publish/delete.
       redirect: "manual"
@@ -769,7 +829,12 @@ async function saveToken(data) {
   if (process.platform !== "win32") await chmod(dir, 448).catch(() => {
   });
   const tmp = `${path}.${randomUUID()}.tmp`;
-  const stored = { base: BASE, token: data.token, handle: data.handle };
+  const stored = {
+    base: BASE,
+    token: data.token,
+    handle: data.handle,
+    github_id: data.github_id
+  };
   try {
     await writeFile(tmp, JSON.stringify(stored), { mode: 384 });
     if (process.platform !== "win32") await chmod(tmp, 384);
@@ -790,10 +855,17 @@ async function readTokenFile() {
 }
 async function loadToken() {
   const parsed = await readTokenFile();
-  if (!parsed || parsed.base !== BASE || typeof parsed.token !== "string" || parsed.token === "" || parsed.handle !== null && typeof parsed.handle !== "string") {
+  const rawId = parsed?.github_id;
+  const idOk = rawId === void 0 || rawId === null || isGithubId(rawId);
+  if (!parsed || parsed.base !== BASE || typeof parsed.token !== "string" || parsed.token === "" || parsed.handle !== null && typeof parsed.handle !== "string" || !idOk) {
     return null;
   }
-  return parsed;
+  return {
+    base: parsed.base,
+    token: parsed.token,
+    handle: parsed.handle === "" ? null : parsed.handle,
+    github_id: isGithubId(rawId) ? rawId : null
+  };
 }
 async function peekCredential() {
   const parsed = await readTokenFile();
@@ -802,7 +874,13 @@ async function peekCredential() {
 async function loadCredential() {
   const envToken = process.env.YMMV_TOKEN || "";
   if (envToken !== "") {
-    return { base: BASE, token: envToken, handle: process.env.YMMV_HANDLE || null, source: "env" };
+    return {
+      base: BASE,
+      token: envToken,
+      handle: process.env.YMMV_HANDLE || null,
+      github_id: null,
+      source: "env"
+    };
   }
   const stored = await loadToken();
   return stored ? { ...stored, source: "file" } : null;
@@ -950,16 +1028,16 @@ ${c.faint}waiting for GitHub approval\u2026 (Ctrl+C to cancel)${c.reset}`
     )
   );
   const accessToken = await pollForToken(dc, deps);
-  const { token, handle } = await mintYmmvToken(accessToken);
+  const minted = await mintYmmvToken(accessToken);
   const replaced = await peekCredential();
   try {
-    await saveToken({ token, handle });
+    await saveToken(minted);
   } catch (e) {
-    await revokeYmmvToken(token).catch(() => {
+    await revokeYmmvToken(minted.token).catch(() => {
     });
     throw e;
   }
-  if (replaced && replaced.base === BASE && replaced.token !== token) {
+  if (replaced && replaced.base === BASE && replaced.token !== minted.token) {
     try {
       await revokeYmmvToken(replaced.token);
     } catch {
@@ -968,7 +1046,7 @@ ${c.faint}waiting for GitHub approval\u2026 (Ctrl+C to cancel)${c.reset}`
   }
   console.log(
     message(
-      handle ? `Logged in as ${handle}.` : "Logged in. No handle bound (your GitHub username is a reserved word)."
+      minted.handle ? `Logged in as ${minted.handle}.` : "Logged in. No handle bound (your GitHub username is a reserved word)."
     )
   );
 }
@@ -980,19 +1058,48 @@ var PublishRefusal = class extends Error {
     this.name = "PublishRefusal";
   }
 };
-var ENV_TOKEN_REJECTED = "The server rejected the token in YMMV_TOKEN (revoked or expired).";
+var NOT_PERSISTED = "Login did not persist a token. Run `ymmv login`.";
+function assertVerified(cred) {
+  if (cred.source === "env" && cred.github_id === null) {
+    throw new PublishRefusal(
+      "Internal error: the YMMV_TOKEN credential was not verified. This is a ymmv-cli bug; please report it at https://github.com/ymmv-fyi/ymmv/issues."
+    );
+  }
+}
 async function rateLimitMessage(res) {
   return withRetryHint(await serverMessage(res) ?? "rate limited, too many requests", res);
 }
+async function loginOrRefuse() {
+  try {
+    await login();
+  } catch (e) {
+    if (e instanceof MintRejected) throw new PublishRefusal(e.message);
+    throw e;
+  }
+  const fresh = await loadCredential();
+  if (!fresh) throw new PublishRefusal(NOT_PERSISTED);
+  return fresh;
+}
+async function verifyEnvCredential(cred) {
+  const identity = await fetchWhoami(cred.token);
+  const claimed = cred.handle;
+  if (claimed !== null && claimed.toLowerCase() !== identity.handle?.toLowerCase()) {
+    const shown = `YMMV_HANDLE is "${sanitizeValue(claimed)}"`;
+    throw new Error(
+      identity.handle === null ? `${shown} but the YMMV_TOKEN account has no handle bound.` : `${shown} but YMMV_TOKEN belongs to "${identity.handle}". Fix or unset YMMV_HANDLE.`
+    );
+  }
+  return { ...cred, handle: identity.handle, github_id: identity.github_id };
+}
 async function ensureLogin() {
   const existing = await loadCredential();
-  if (existing) return existing;
+  if (existing) return existing.source === "env" ? verifyEnvCredential(existing) : existing;
   await login();
   const fresh = await loadCredential();
-  if (!fresh) throw new Error("Login did not persist a token. Run `ymmv login`.");
+  if (!fresh) throw new Error(NOT_PERSISTED);
   return fresh;
 }
-async function publishProfile(profile) {
+async function publishProfile(profile, expected) {
   const send = (c) => safeFetch(
     `${BASE}/api/v1/profile`,
     {
@@ -1006,8 +1113,15 @@ async function publishProfile(profile) {
     },
     BASE
   );
-  let cred = await ensureLogin();
-  if ((cred.handle ?? "").toLowerCase() !== profile.handle.toLowerCase()) {
+  assertVerified(expected);
+  let cred = expected.source === "env" ? expected : await loadCredential();
+  if (!cred) {
+    console.log(message("Not logged in. Logging in to publish."));
+    cred = await loginOrRefuse();
+  }
+  assertVerified(cred);
+  const idDrifted = expected.source === "file" && (expected.github_id === null ? cred.github_id !== null : cred.github_id !== expected.github_id);
+  if ((cred.handle ?? "").toLowerCase() !== profile.handle.toLowerCase() || idDrifted) {
     throw new PublishRefusal(
       "The stored login changed while this command was running. Re-run it under the current account."
     );
@@ -1016,23 +1130,43 @@ async function publishProfile(profile) {
   if (res.status === 401 || res.status === 409) {
     if (cred.source === "env") {
       throw new PublishRefusal(
-        res.status === 401 ? `${ENV_TOKEN_REJECTED} Mint a new one with \`ymmv login\` on an interactive machine and update YMMV_TOKEN.` : "The server no longer accepts this handle for the YMMV_TOKEN account. Update YMMV_HANDLE, or mint a fresh token with `ymmv login`."
+        res.status === 401 ? ENV_TOKEN_REJECTED_MINT_AGAIN : (
+          // The handle came from whoami moments ago, so a 409 means the bind changed in between
+          // (a re-login on another machine after a GitHub rename). A fresh run looks it up again.
+          "The server no longer accepts this handle for the YMMV_TOKEN account. Re-run the command."
+        )
       );
     }
     const was401 = res.status === 401;
+    const before = cred;
     console.log(
       message(
         was401 ? "Session expired. Logging in again to retry the publish." : "The server no longer recognizes your handle. Logging in again to retry the publish."
       )
     );
     if (was401) await deleteToken();
-    await login();
-    cred = await ensureLogin();
-    if ((cred.handle ?? "").toLowerCase() !== profile.handle.toLowerCase()) {
-      const bound = sanitizeValue(cred.handle ?? "");
-      throw new PublishRefusal(
-        was401 ? `The re-login bound a different account ("${bound}", not "${sanitizeValue(profile.handle)}"). Nothing was published. Re-run under the account you meant.` : `Your login now binds "${bound}". Nothing was published. Re-run the command to publish under it.`
-      );
+    cred = await loginOrRefuse();
+    const known = before.github_id !== null;
+    const idChanged = known && cred.github_id !== before.github_id;
+    const sameHandle = (cred.handle ?? "").toLowerCase() === profile.handle.toLowerCase();
+    if (!sameHandle || idChanged) {
+      const mine = sanitizeValue(profile.handle);
+      const bound = cred.handle === null ? null : sanitizeValue(cred.handle);
+      const reRun = "Nothing was published. Re-run under the account you meant.";
+      const otherAccount = `The re-login bound a different account ("${bound}", not "${mine}"). ${reRun}`;
+      if (idChanged) {
+        throw new PublishRefusal(
+          sameHandle ? `The handle "${mine}" now belongs to a different GitHub account. ${reRun}` : bound === null ? `The re-login bound a different GitHub account. ${reRun}` : otherAccount
+        );
+      }
+      if (bound === null) {
+        throw new PublishRefusal(
+          "Your login no longer binds a handle (your GitHub username is a reserved word). Nothing was published."
+        );
+      }
+      const rebound = `Your login now binds "${bound}". Nothing was published. Re-run the command to publish under it.`;
+      if (known) throw new PublishRefusal(rebound);
+      throw new PublishRefusal(was401 ? otherAccount : rebound);
     }
     res = await send(cred);
     if (res.status === 401) throw new PublishRefusal("Authentication failed. Run `ymmv login`.");
@@ -1074,6 +1208,7 @@ async function fetchProfileJson(handle) {
   return parseProfile(await res.json());
 }
 async function deleteProfile(cred) {
+  assertVerified(cred);
   const res = await safeFetch(
     `${BASE}/api/v1/profile`,
     {
@@ -1460,16 +1595,16 @@ function requireHandle(cred) {
   if (cred.handle) return cred.handle;
   console.error(
     message(
-      cred.source === "env" ? "YMMV_TOKEN is set but YMMV_HANDLE is not. Set YMMV_HANDLE to the GitHub username the token belongs to." : "Your GitHub username is a reserved word, so no handle is bound. Rename on GitHub, then run `ymmv login` again."
+      cred.source === "env" ? "The account behind YMMV_TOKEN has no handle bound. Run `ymmv login` on an interactive machine, as the same GitHub account, to rebind it. If that GitHub username is a reserved word, rename on GitHub first." : "Your GitHub username is a reserved word, so no handle is bound. Rename on GitHub, then run `ymmv login` again."
     )
   );
   process.exitCode = 1;
   return null;
 }
-function assertHandleUnchanged(existing, handle) {
+function assertHandleUnchanged(existing, cred, handle) {
   if (existing && existing.handle.toLowerCase() !== handle.toLowerCase()) {
     throw new Error(
-      `This login is bound to "${handle}" but your profile now lives at "${sanitizeValue(existing.handle)}". Run \`ymmv login\` to refresh, then retry.`
+      `This login is bound to "${handle}" but your profile now lives at "${sanitizeValue(existing.handle)}". ${cred.source === "env" ? "Re-run the command." : "Run `ymmv login` to refresh, then retry."}`
     );
   }
 }
@@ -1532,7 +1667,7 @@ async function publish(io) {
     }
   });
   const existing = await fetchProfileJson(handle);
-  assertHandleUnchanged(existing, handle);
+  assertHandleUnchanged(existing, cred, handle);
   const defaults = buildDefaults(existing, detected);
   const carried = unknownEntries(existing);
   const extras = existing?.extras ?? [];
@@ -1576,7 +1711,7 @@ async function publish(io) {
     }
     const entries = assemble();
     showCard(entries);
-    printPublished(await publishProfile(newProfile(handle, entries, extras)), color);
+    printPublished(await publishProfile(newProfile(handle, entries, extras), cred), color);
     return;
   }
   try {
@@ -1592,7 +1727,7 @@ async function publish(io) {
       );
       if (ans === "y") {
         try {
-          printPublished(await publishProfile(newProfile(handle, entries, extras)), color);
+          printPublished(await publishProfile(newProfile(handle, entries, extras), cred), color);
           return;
         } catch (e) {
           if (e instanceof PromptAborted || e instanceof PublishRefusal) throw e;
@@ -1629,7 +1764,26 @@ async function view(handle) {
     console.log(notFound(handle, c, BASE));
     return;
   }
-  const cred = await loadToken();
+  const plainCard = (note, wrap = true) => {
+    console.log(renderProfile(theirs, { color: c, site: displayUrl(BASE) }));
+    if (note) {
+      const codes = palette(c);
+      console.error(message(`${codes.faint}${wrap ? `(${note})` : note}${codes.reset}`));
+    }
+  };
+  let cred = await loadCredential();
+  if (cred?.source === "env") {
+    try {
+      cred = await verifyEnvCredential(cred);
+    } catch (e) {
+      plainCard(`No diff: ${displayError(e)}`, false);
+      return;
+    }
+    if (cred.handle === null) {
+      plainCard("no diff: the account behind YMMV_TOKEN has no handle bound");
+      return;
+    }
+  }
   if (cred?.handle) {
     let mineFailed = false;
     const mine = await fetchProfileJson(cred.handle).catch(() => {
@@ -1643,24 +1797,23 @@ async function view(handle) {
       return;
     }
     if (!mine) {
-      console.log(renderProfile(theirs, { color: c, site: displayUrl(BASE) }));
       if (mineFailed) {
-        const codes = palette(c);
-        console.error(message(`${codes.faint}(couldn't load your profile to diff)${codes.reset}`));
+        plainCard("couldn't load your profile to diff");
       } else {
+        plainCard();
         console.log(nudge(c));
       }
       return;
     }
   }
-  console.log(renderProfile(theirs, { color: c, site: displayUrl(BASE) }));
+  plainCard();
 }
 async function runSet(target) {
   const cred = await ensureLogin();
   const handle = requireHandle(cred);
   if (!handle) return;
   const existing = await fetchProfileJson(handle);
-  assertHandleUnchanged(existing, handle);
+  assertHandleUnchanged(existing, cred, handle);
   const { entries, extras } = applySet(existing, target);
   if (target.kind === "extra" && extras.length > MAX_EXTRAS) {
     console.error(
@@ -1671,7 +1824,7 @@ async function runSet(target) {
     process.exitCode = 1;
     return;
   }
-  const res = await publishProfile(newProfile(handle, entries, extras));
+  const res = await publishProfile(newProfile(handle, entries, extras), cred);
   const line = target.kind === "curated" ? `Set ${KEY_LABELS[target.key]} = ${target.value}.` : `Set extra ${target.label} = ${target.value}.`;
   console.log(message(`${line}${pagePointer(res.handle)}`));
 }
@@ -1680,7 +1833,7 @@ async function runUnset(target) {
   const handle = requireHandle(cred);
   if (!handle) return;
   const existing = await fetchProfileJson(handle);
-  assertHandleUnchanged(existing, handle);
+  assertHandleUnchanged(existing, cred, handle);
   if (!existing) {
     console.log(message("No profile yet. Run `ymmv` to publish one."));
     return;
@@ -1694,13 +1847,13 @@ async function runUnset(target) {
     );
     return;
   }
-  const res = await publishProfile(newProfile(handle, entries, extras));
+  const res = await publishProfile(newProfile(handle, entries, extras), cred);
   const line = target.kind === "curated" ? `Removed ${KEY_LABELS[target.key]} (was "${sanitizeValue(removed.value)}").` : `Removed extra "${sanitizeValue(removed.label)}" (was "${sanitizeValue(removed.value)}").`;
   console.log(message(`${line}${pagePointer(res.handle)}`));
 }
 async function runDelete(io) {
   const cred = await ensureLogin();
-  const target = cred.source === "env" ? "the profile bound to YMMV_TOKEN" : cred.handle ? `${displayUrl(BASE)}/${sanitizeValue(cred.handle)}` : "your profile";
+  const target = cred.handle ? `${displayUrl(BASE)}/${sanitizeValue(cred.handle)}` : cred.source === "env" ? "the profile bound to YMMV_TOKEN" : "your profile";
   if (!io.yes) {
     if (!io.interactive || !io.prompter) {
       console.error(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ymmv-cli",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Publish and diff terminal-native developer tool-stack profiles at ymmv.fyi.",
   "type": "module",
   "bin": {