- Switch validation endpoint from /-/npm/v1/user to /-/whoami which
works for all token types regardless of scope/permissions
- Fix revocation token matching: use Regex extractor with Liquid-rendered
prefix ({{ TOKEN | prefix: 8 }}) to locate the correct token in the
list response instead of blindly taking objects[0]
- Add Liquid template rendering support in multi-step revocation
extraction patterns (render_extractor) for dynamic matching
- Add debug logging of HTTP response status and body during revocation
so -v flag shows full API responses for troubleshooting
- Include response body in extraction failure error messages
Co-authored-by: Cursor <cursoragent@cursor.com>
