@elixpo/lixblogs-cli 1.3.1 → 1.3.3

package/README.md

@@ -29,6 +29,7 @@ node bin/lixblogs.mjs --help
 ```bash
 # Log in via device authorization
 node bin/lixblogs.mjs login
+# Credentials are saved under the authenticated username and made active.
 
 # Save credentials under an explicit local profile name
 node bin/lixblogs.mjs login --profile personal
@@ -51,8 +52,10 @@ Interactive login shows one compact device card and stays quiet while Accounts
 approval is pending. Press Enter to open the verification URL locally, use
 `--open` to open it immediately, or copy the URL to any browser when connected
 to a VPS. Device authorization does not require a localhost callback or an
-exposed port. Profile names such as `personal`, `work`, or `test` are local
-credential slots; `whoami` reports the actual Accounts identity.
+exposed port. The authenticated username becomes the local profile alias unless
+`--profile` explicitly overrides it. Run `lixblogs login` again to add another
+account, `lixblogs profiles` to list saved accounts, and
+`lixblogs use <username>` to switch the active one.
 
 ### Blog lifecycle
 
@@ -148,7 +151,7 @@ command exits with code 3 and retains both versions under
 `.lixblogs-conflicts/`; it never overwrites the newer server revision.
 
 Global flags:
-- `--profile <name>` — named profile to use (default: `"default"`)
+- `--profile <name>` — override the username-based local account alias
 - `--env <environment>` — override environment (`development` | `staging` | `production`)
 - `--scope <scope>` — request an additional/alternate OAuth scope; repeatable
 - `--open` — open the verification URL with the device code pre-filled

package/bin/lixblogs.mjs

@@ -31,6 +31,7 @@ import { authStatus } from "../src/commands/auth/status.js";
 import { authLogout } from "../src/commands/auth/logout.js";
 import { authRevoke } from "../src/commands/auth/revoke.js";
 import { authProfiles, authUse } from "../src/commands/auth/profiles.js";
+import { profileAliasFromIdentity } from "../src/commands/auth/profileAlias.js";
 import { ProfileRegistry, validateProfileId } from "../src/config/ProfileRegistry.js";
 import { AuthenticatedClient } from "../src/auth/AuthenticatedClient.js";
 import { BlogClient, BlogApiError } from "../src/api/BlogClient.js";
@@ -164,7 +165,7 @@ Usage:
   lixblogs skill install <name>   [--target <directory>] [--dry-run] --yes
 
 Global flags:
-  --profile <name>            named profile to use (default: "default")
+  --profile <name>            local account alias (defaults to the signed-in username)
   --env <environment>         override environment (development|staging|production)
   --auth-provider <provider>  elixpo, or mock in development/test only
   --accounts-url <url>        override the Accounts discovery origin
@@ -269,7 +270,11 @@ async function getCredentialStoreOrFail(opts, profileRegistry) {
 async function runLogin(opts) {
   const config = resolveConfig({ flags: configFlags(opts) });
   const profileRegistry = new ProfileRegistry();
-  const profileId = await selectedProfile(config, profileRegistry);
+  const requestedProfileId = validateProfileId(config.profile);
+  const scopes = opts.scope?.length ? [...opts.scope] : [...DEFAULT_SCOPES];
+  if (!config.profileExplicit && !scopes.includes("lixblogs:profile:read")) {
+    scopes.push("lixblogs:profile:read");
+  }
 
   let provider;
   try {
@@ -287,9 +292,15 @@ async function runLogin(opts) {
     result = await authLogin({
       provider,
       credentialStore,
-      profileId,
-      scopes: opts.scope?.length ? opts.scope : DEFAULT_SCOPES,
+      profileId: requestedProfileId,
+      scopes,
       openBrowser: opts.open ? openBrowser : undefined,
+      resolveProfileId: config.profileExplicit
+        ? undefined
+        : ({ accessToken }) => profileAliasFromIdentity({
+            accessToken,
+            apiBaseUrl: config.apiBaseUrl,
+          }),
       onStatus: (status) => {
         if (opts.json) {
           if (status.type !== "pending") output(opts, { event: status.type, ...status });
@@ -303,7 +314,7 @@ async function runLogin(opts) {
             url,
             code: status.userCode,
             expiresInSeconds: status.expiresInSeconds,
-            profile: profileId,
+            profile: config.profileExplicit ? requestedProfileId : null,
             interactive,
             color: colorEnabled(),
           }));
@@ -331,6 +342,8 @@ async function runLogin(opts) {
   output(opts, { ok: true, profile: result.profileId });
   if (!opts.json && !opts.quiet) {
     console.log(`  Credentials saved to local profile "${result.profileId}".`);
+    console.log("  Tip: add another account with `lixblogs login`, list accounts with `lixblogs profiles`,");
+    console.log("       and switch with `lixblogs use <username>`.");
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elixpo/lixblogs-cli",
-  "version": "1.3.1",
+  "version": "1.3.3",
   "description": "Official CLI for LixBlogs — publish, manage, and inspect blogs through the supported API. Built for creators and agent automation.",
   "author": {
     "name": "Elixpo",

package/src/cli/ui.js

@@ -27,7 +27,9 @@ export function loginChallenge({ url, code, expiresInSeconds, profile, interacti
     `  URL      ${url}`,
     `  Code     ${paint(code, ANSI.bold, color)}`,
     `  Expires  ${Math.ceil(expiresInSeconds / 60)} min`,
-    `  Profile  ${profile} ${paint("(local credential slot)", ANSI.dim, color)}`,
+    profile
+      ? `  Profile  ${profile} ${paint("(local credential slot)", ANSI.dim, color)}`
+      : `  Profile  ${paint("your Accounts username after approval", ANSI.dim, color)}`,
     "",
     `  ${instruction}`,
     "  No localhost callback or exposed port is required.",

package/src/commands/auth/login.js

@@ -23,6 +23,7 @@ import { redactErrorMessage } from "../../config/redact.js";
  * @param {string} params.profileId - which named profile this login is for
  * @param {string[]} params.scopes - scopes being requested
  * @param {(url: string) => Promise<void>} [params.openBrowser] - optional browser opener
+ * @param {(params: { accessToken: string, requestedProfileId: string }) => Promise<string>} [params.resolveProfileId]
  * @param {(ms: number) => Promise<void>} [params.sleep] - injectable for tests
  * @param {(...args: any[]) => void} [params.onStatus] - callback for UI updates (verification URL, polling status, etc.)
  * @returns {Promise<{ ok: true, profileId: string } | { ok: false, reason: string }>}
@@ -33,6 +34,7 @@ export async function authLogin({
   profileId,
   scopes,
   openBrowser,
+  resolveProfileId,
   sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
   onStatus = () => {},
 }) {
@@ -69,14 +71,26 @@ export async function authLogin({
     }
 
     if (result.status === "approved") {
-      await credentialStore.set(profileId, {
+      let resolvedProfileId = profileId;
+      if (resolveProfileId) {
+        try {
+          resolvedProfileId = await resolveProfileId({
+            accessToken: result.token.accessToken,
+            requestedProfileId: profileId,
+          });
+        } catch (err) {
+          return { ok: false, reason: redactErrorMessage(err.message) };
+        }
+      }
+
+      await credentialStore.set(resolvedProfileId, {
         accessToken: result.token.accessToken,
         refreshToken: result.token.refreshToken,
         expiresAt: Date.now() + result.token.expiresInSeconds * 1000,
         scopes: result.token.scopes,
       });
       onStatus({ type: "approved" });
-      return { ok: true, profileId };
+      return { ok: true, profileId: resolvedProfileId };
     }
 
     if (result.status === "denied") {

package/src/commands/auth/profileAlias.js

@@ -0,0 +1,29 @@
+import { validateProfileId } from "../../config/ProfileRegistry.js";
+
+/** Resolve the authenticated Accounts username without persisting a temporary profile. */
+export async function profileAliasFromIdentity({
+  accessToken,
+  apiBaseUrl,
+  fetchImpl = globalThis.fetch,
+}) {
+  const endpoint = new URL("/api/v1/me", apiBaseUrl);
+  const response = await fetchImpl(endpoint, {
+    headers: {
+      accept: "application/json",
+      authorization: `Bearer ${accessToken}`,
+    },
+  });
+
+  let payload;
+  try {
+    payload = await response.json();
+  } catch {
+    throw new Error("LixBlogs could not resolve the signed-in username.");
+  }
+
+  if (!response.ok || typeof payload?.data?.username !== "string") {
+    throw new Error(payload?.error?.message || "LixBlogs could not resolve the signed-in username.");
+  }
+
+  return validateProfileId(payload.data.username);
+}