@rathnasgala/cli 1.1.13 → 1.1.15

package/README.md

@@ -12,6 +12,16 @@ Nothing to install. Every command runs through `npx`.
 
 ## Start a publication
 
+Sign in once. The CLI binds the verified Gala and GitHub identities together, names the account
+profile after the GitHub username, and makes it active.
+
+```console
+npx --yes @rathnasgala/cli@latest auth add
+```
+
+Use `auth list` to inspect every pair, `auth use <github-login>` to change the active account, and
+`auth remove <github-login>` to forget one. Tokens from different profiles are never combined.
+
 Create it in the current empty folder:
 
 ```console
@@ -30,7 +40,7 @@ accepted and its `.git` directory is preserved. To reserve a custom domain durin
 `--domain blog.example.com`; Gala still requires GitHub ownership verification and healthy DNS
 before activating it.
 
-It signs you in to Gala and to GitHub if you are not already, creates the repository, registers the
+It uses the selected profile, creates the repository, registers the
 publication, and leaves a working checkout in the folder. GitHub starts the first deployment in the
 background. The command links to that deployment rather than presenting the public address as live
 before GitHub has finished.
@@ -126,18 +136,20 @@ Run any command with `--help`.
 
 | Command | What it does | Options |
 | --- | --- | --- |
-| `init` | Create a publication in the current or named empty directory | `--name`, `--domain` |
-| `domain` | Inspect or change the custom domain | `--root` |
+| `init` | Create a publication in the current or named empty directory | `--name`, `--domain`, `--account` |
+| `domain` | Inspect or change the custom domain | `--root`, `--account` |
 | `new` | Start a post | `--language`, `--root`, `--today` |
 | `preview` | Build and serve the publication locally | `--root`, `--today` |
-| `publish` | Check, record and send your work to GitHub | `--root`, `--today`, `--skip-checks` |
-| `prism` | Manage author-approved reading configurations | `--root`, `--language`, `--depth`, `--intent`, `--modality`, `--file`, `--reason`, `--yes` |
+| `publish` | Check, record and send your work to GitHub | `--root`, `--today`, `--account`, `--skip-checks` |
+| `prism` | Manage author-approved reading configurations | `--root`, `--account`, `--language`, `--depth`, `--intent`, `--modality`, `--file`, `--reason`, `--yes` |
 | `upgrade` | Inspect and apply a verified managed-theme update | `--root`, `--channel`, `--yes` |
-| `doctor` | Check a publication and say what is wrong | `--root` |
-| `auth` | Sign in to Gala and GitHub | - |
+| `doctor` | Check a publication and say what is wrong | `--root`, `--account` |
+| `auth` | Add, list, select or remove GitHub-named account profiles | `--api-base-url` |
 
-`auth` is never a prerequisite you have to remember: any command that needs a credential obtains
-one. It exists for when you want to do it deliberately - a new machine, or a different account.
+`init` shows both identities and uses the active account automatically. Registration stores that
+profile binding inside the checkout's private `.git` metadata. Later authenticated commands use the
+binding even if another profile becomes active. `--account` remains available for an explicit CI or
+unbound-checkout selection, but it can never override a different bound owner.
 
 Every command prompts for what it needs when run in a terminal, and every prompt has an option that
 supplies it instead. With no terminal attached - in CI - nothing is ever prompted for: a value that
@@ -164,7 +176,7 @@ configured - so publishing works on a machine where those differ, or where none
 Sign in again:
 
 ```console
-npx --yes @rathnasgala/cli@latest auth
+npx --yes @rathnasgala/cli@latest auth add
 ```
 
 ### Gala cannot reach the repository

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rathnasgala/cli",
-  "version": "1.1.13",
+  "version": "1.1.15",
   "type": "module",
   "files": [
     "src"

package/src/api/gala.js

@@ -38,6 +38,15 @@ export function galaApi({ baseUrl = DEFAULT_API_BASE_URL, token } = {}) {
       }
     },
 
+    async profile() {
+      const body = await requestJson(`${root}/v1/me`, authorized('Gala account lookup'));
+      if (typeof body?.userId !== 'string' || typeof body?.email !== 'string'
+          || typeof body?.displayName !== 'string') {
+        throw new TypeError('Gala returned an unusable account identity');
+      }
+      return { userId: body.userId, email: body.email, displayName: body.displayName };
+    },
+
     /** Exchanges the GitHub token for the short-lived capability the GitHub-scoped routes require. */
     async githubCapability(githubToken) {
       const body = await requestJson(`${root}/v1/auth/github/device-authorizations`,

package/src/auth/checkout-profile.js

@@ -0,0 +1,105 @@
+import { readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+
+import { UsageError } from '../cli/args.js';
+import { readPublication } from '../publication.js';
+import { listProfiles, requireProfileName } from './profiles.js';
+
+const FILENAME = 'gala-account-profile';
+
+export async function bindCheckoutProfile(root, name) {
+  const gitDirectory = path.join(path.resolve(root), '.git');
+  const metadata = await stat(gitDirectory).catch(() => null);
+  if (!metadata?.isDirectory()) {
+    throw new Error('Cannot bind the account profile because this is not a standard Git checkout.');
+  }
+  const target = path.join(gitDirectory, FILENAME);
+  const temporary = `${target}.${process.pid}.tmp`;
+  try {
+    await writeFile(temporary, `${requireProfileName(name)}\n`, { flag: 'wx', mode: 0o600 });
+    await rename(temporary, target);
+  } catch (failure) {
+    await rm(temporary, { force: true });
+    throw failure;
+  }
+}
+
+export async function checkoutProfile(root) {
+  try {
+    return requireProfileName((await readFile(
+      path.join(path.resolve(root), '.git', FILENAME), 'utf8'
+    )).trim());
+  } catch (failure) {
+    if (failure?.code === 'ENOENT') return null;
+    throw failure;
+  }
+}
+
+export async function accountForCommand(options, root, { terminal, profilesRoot } = {}) {
+  const explicit = options.value('account');
+  const bound = await checkoutProfile(root);
+  if (explicit != null) {
+    const selected = await resolveProfileSelector(explicit, profilesRoot);
+    if (bound != null && bound !== selected) {
+      throw new UsageError(
+        `This checkout belongs to account profile ${bound}; --account ${selected} cannot override it.`
+      );
+    }
+    if (bound == null) await bindIfCheckout(root, selected);
+    return selected;
+  }
+  if (bound != null) return bound;
+
+  const profiles = await listProfiles(profilesRoot == null ? {} : { root: profilesRoot });
+  if (profiles.length === 0) {
+    throw new UsageError('No account profile exists. Run `npx --yes @rathnasgala/cli@latest auth add`.');
+  }
+  const publication = await readPublication(root);
+  const repositoryOwner = typeof publication?.repository === 'string'
+    ? publication.repository.split('/', 1)[0]?.toLowerCase()
+    : null;
+  const ownerMatches = repositoryOwner == null ? [] : profiles.filter((profile) =>
+    profile.githubLogin.toLowerCase() === repositoryOwner);
+  let selected;
+  if (ownerMatches.length === 1) selected = ownerMatches[0].name;
+  else if (profiles.length === 1) selected = profiles[0].name;
+  else {
+    if (!terminal?.interactive) {
+      throw new UsageError(
+        `This repository could use more than one account profile (${profileChoices(profiles)}); pass --account <profile>.`
+      );
+    }
+    const answer = await terminal.ask(`Which account owns this repository? (${profileChoices(profiles)})`);
+    selected = resolveFromProfiles(answer, profiles);
+  }
+  await bindIfCheckout(root, selected);
+  terminal?.note(`Using account profile ${selected} for this repository.`);
+  return selected;
+}
+
+async function resolveProfileSelector(value, profilesRoot) {
+  const profiles = await listProfiles(profilesRoot == null ? {} : { root: profilesRoot });
+  return resolveFromProfiles(value, profiles);
+}
+
+function resolveFromProfiles(value, profiles) {
+  const selector = String(value ?? '').trim().replace(/^@/, '').toLowerCase();
+  const matches = profiles.filter(({ name, githubLogin, gala: identity }) => name === selector
+    || githubLogin.toLowerCase() === selector
+    || identity.email.toLowerCase() === selector);
+  if (matches.length === 1) return matches[0].name;
+  if (matches.length > 1) {
+    throw new UsageError(`Account ${value} matches more than one profile; use one of: ${profileChoices(matches)}.`);
+  }
+  throw new UsageError(`Account ${value} is not configured; use one of: ${profileChoices(profiles)}.`);
+}
+
+function profileChoices(profiles) {
+  return profiles.map(({ name, githubLogin, gala: identity }) =>
+    `${name} (GitHub @${githubLogin}, Gala ${identity.email})`).join(', ');
+}
+
+async function bindIfCheckout(root, selected) {
+  const metadata = await stat(path.join(path.resolve(root), '.git')).catch(() => null);
+  if (metadata?.isDirectory()) await bindCheckoutProfile(root, selected);
+}

package/src/auth/profiles.js

@@ -0,0 +1,210 @@
+import { chmod, mkdir, mkdtemp, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+
+import { galaApi } from '../api/gala.js';
+import { githubApi } from '../api/github.js';
+import { UsageError } from '../cli/args.js';
+import { galaCredential } from './gala.js';
+import { githubCredential } from './github.js';
+import { credentialDirectory, readCredential } from './store.js';
+
+const PROFILE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const ULID = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
+const STORE_VERSION = '2';
+
+export function requireProfileName(value) {
+  if (typeof value !== 'string' || !PROFILE.test(value)) {
+    throw new UsageError('Account profile names use lowercase letters, numbers and single hyphens.');
+  }
+  return value;
+}
+
+export function profilePaths(name, { root = credentialDirectory() } = {}) {
+  const safe = requireProfileName(name);
+  const directory = path.join(root, 'profiles', safe);
+  return {
+    directory,
+    metadata: path.join(directory, 'profile.json'),
+    gala: path.join(directory, 'gala.json'),
+    github: path.join(directory, 'github.json'),
+    active: path.join(root, 'active-profile'),
+  };
+}
+
+export async function addProfile({
+  terminal,
+  apiBaseUrl,
+  root = credentialDirectory(),
+  galaSignIn = galaCredential,
+  githubSignIn = githubCredential,
+  galaLookup = async (credential) => galaApi({
+    baseUrl: credential.apiBaseUrl,
+    token: credential.accessToken,
+  }).profile(),
+  githubLookup = async (credential) => githubApi(credential.accessToken).viewer(),
+}) {
+  await mkdir(root, { recursive: true, mode: 0o700 });
+  const pending = await mkdtemp(path.join(root, '.pending-profile-'));
+  await chmod(pending, 0o700);
+  const pendingPaths = {
+    gala: path.join(pending, 'gala.json'),
+    github: path.join(pending, 'github.json'),
+  };
+  try {
+    const gala = await galaSignIn({ terminal, apiBaseUrl, target: pendingPaths.gala });
+    const galaIdentity = await galaLookup(gala);
+    const github = await githubSignIn({ terminal, target: pendingPaths.github });
+    const githubLogin = await githubLookup(github);
+    if (typeof githubLogin !== 'string') {
+      throw new UsageError('GitHub did not return an account username.');
+    }
+    const name = requireProfileName(githubLogin.toLowerCase());
+    const metadata = normalizeMetadata({ schemaVersion: 2, name, gala: galaIdentity, githubLogin });
+    await atomicJson(path.join(pending, 'profile.json'), metadata);
+    await prepareStore(root);
+    const paths = profilePaths(name, { root });
+    await rm(paths.directory, { recursive: true, force: true });
+    await rename(pending, paths.directory);
+    await setActiveProfile(name, { root });
+    return { metadata, gala, github };
+  } catch (failure) {
+    await rm(pending, { recursive: true, force: true });
+    throw failure;
+  }
+}
+
+export async function listProfiles({ root = credentialDirectory() } = {}) {
+  const directory = path.join(root, 'profiles');
+  let names;
+  try {
+    names = await readdir(directory);
+  } catch (failure) {
+    if (failure?.code === 'ENOENT') return [];
+    throw failure;
+  }
+  const active = await activeProfile({ root });
+  const profiles = [];
+  for (const name of names.sort()) {
+    try {
+      const metadata = JSON.parse(await readFile(profilePaths(name, { root }).metadata, 'utf8'));
+      profiles.push({ ...normalizeMetadata(metadata), active: name === active });
+    } catch (failure) {
+      if (failure?.code !== 'ENOENT' && !(failure instanceof SyntaxError)) throw failure;
+    }
+  }
+  return profiles;
+}
+
+export async function useProfile(name, { root = credentialDirectory() } = {}) {
+  const selected = await readProfile(name, { root });
+  await setActiveProfile(selected.metadata.name, { root });
+  return selected.metadata;
+}
+
+export async function removeProfile(name, { root = credentialDirectory() } = {}) {
+  const paths = profilePaths(name, { root });
+  try {
+    const metadata = await stat(paths.directory);
+    if (!metadata.isDirectory()) throw new UsageError(`Account profile ${name} is unavailable.`);
+  } catch (failure) {
+    if (failure?.code === 'ENOENT') throw new UsageError(`Account profile ${name} does not exist.`);
+    throw failure;
+  }
+  await rm(paths.directory, { recursive: true });
+  if (await activeProfile({ root }) === name) await rm(paths.active, { force: true });
+}
+
+export async function selectedProfile({ name, root = credentialDirectory() } = {}) {
+  const selected = name == null ? await activeProfile({ root }) : requireProfileName(name);
+  if (selected == null) {
+    throw new UsageError('No account profile is active. Run `npx --yes @rathnasgala/cli@latest auth add`.');
+  }
+  return readProfile(selected, { root });
+}
+
+export async function activeProfile({ root = credentialDirectory() } = {}) {
+  try {
+    const value = (await readFile(path.join(root, 'active-profile'), 'utf8')).trim();
+    return requireProfileName(value);
+  } catch (failure) {
+    if (failure?.code === 'ENOENT') return null;
+    throw failure;
+  }
+}
+
+async function readProfile(name, { root }) {
+  const paths = profilePaths(name, { root });
+  let metadata;
+  try {
+    metadata = normalizeMetadata(JSON.parse(await readFile(paths.metadata, 'utf8')));
+  } catch (failure) {
+    if (failure?.code === 'ENOENT' || failure instanceof SyntaxError) {
+      throw new UsageError(`Account profile ${name} is incomplete; remove it and add it again.`);
+    }
+    throw failure;
+  }
+  const [gala, github] = await Promise.all([readCredential(paths.gala), readCredential(paths.github)]);
+  if (gala == null || github == null) {
+    throw new UsageError(
+      `Account profile ${name} has expired; run \`npx --yes @rathnasgala/cli@latest auth add\` to sign in again.`
+    );
+  }
+  return { metadata, gala, github };
+}
+
+async function setActiveProfile(name, { root }) {
+  await mkdir(root, { recursive: true, mode: 0o700 });
+  await atomicText(path.join(root, 'active-profile'), `${requireProfileName(name)}\n`);
+}
+
+function normalizeMetadata(value) {
+  const name = requireProfileName(value?.name);
+  if (value?.schemaVersion !== 2) {
+    throw new UsageError(`Account profile ${name} has an unsupported format.`);
+  }
+  const userId = value?.gala?.userId;
+  const email = value?.gala?.email;
+  const displayName = value?.gala?.displayName;
+  const githubLogin = value?.githubLogin;
+  if (typeof userId !== 'string' || !ULID.test(userId)
+      || typeof email !== 'string' || email === ''
+      || typeof displayName !== 'string' || displayName === ''
+      || typeof githubLogin !== 'string' || githubLogin === '') {
+    throw new UsageError(`Account profile ${name} has invalid identity metadata.`);
+  }
+  if (githubLogin.toLowerCase() !== name) {
+    throw new UsageError(`Account profile ${name} does not match its GitHub identity.`);
+  }
+  return { schemaVersion: 2, name, gala: { userId, email, displayName }, githubLogin };
+}
+
+async function prepareStore(root) {
+  const version = path.join(root, 'profile-store-version');
+  const current = await readFile(version, 'utf8').catch((failure) => {
+    if (failure?.code === 'ENOENT') return null;
+    throw failure;
+  });
+  if (current?.trim() !== STORE_VERSION) {
+    await rm(path.join(root, 'profiles'), { recursive: true, force: true });
+    await rm(path.join(root, 'active-profile'), { force: true });
+    await rm(path.join(root, 'credentials.json'), { force: true });
+    await rm(path.join(root, 'github-credentials.json'), { force: true });
+    await atomicText(version, `${STORE_VERSION}\n`);
+  }
+  await mkdir(path.join(root, 'profiles'), { recursive: true, mode: 0o700 });
+}
+
+async function atomicJson(target, value) {
+  return atomicText(target, `${JSON.stringify(value)}\n`);
+}
+
+async function atomicText(target, value) {
+  const temporary = `${target}.${process.pid}.tmp`;
+  try {
+    await writeFile(temporary, value, { flag: 'wx', mode: 0o600 });
+    await rename(temporary, target);
+  } catch (failure) {
+    await rm(temporary, { force: true });
+    throw failure;
+  }
+}

package/src/auth/store.js

@@ -31,6 +31,10 @@ export function credentialPath(name, { platform = process.platform, environment
   return path.join(environment.XDG_CONFIG_HOME || path.join(home, '.config'), 'gala', `${name}.json`);
 }
 
+export function credentialDirectory(options = {}) {
+  return path.dirname(credentialPath('credentials', options));
+}
+
 export async function writeCredential(target, record) {
   const directory = path.dirname(path.resolve(target));
   await mkdir(directory, { recursive: true, mode: 0o700 });

package/src/commands/auth.js

@@ -1,20 +1,42 @@
-import { galaCredential } from '../auth/gala.js';
-import { githubCredential } from '../auth/github.js';
+import { addProfile, listProfiles, removeProfile, useProfile } from '../auth/profiles.js';
+import { UsageError } from '../cli/args.js';
 
 /**
  * Signs in to both, and says so.
  *
- * Not a prerequisite the writer has to remember: every command that needs a credential obtains one.
- * This exists for the times they want to do it deliberately - a new machine, a different account,
- * or after a token has expired.
+ * One login creates and activates the GitHub-named pair. A writer returns here only for a new
+ * machine, a different account, or an expired token.
  */
 export async function auth({ terminal, options }) {
-  const gala = await galaCredential({ terminal, apiBaseUrl: options.value('api-base-url') });
-  const github = await githubCredential({ terminal });
-
-  terminal.blank();
-  terminal.done(`Gala   - valid until ${new Date(gala.expiresAt).toLocaleString()}`);
-  terminal.done(github.expiresAt
-    ? `GitHub - valid until ${new Date(github.expiresAt).toLocaleString()}`
-    : 'GitHub - signed in');
+  const [action = 'list', name, ...extra] = options.positional;
+  if (extra.length > 0 || !['list', 'add', 'use', 'remove'].includes(action)) {
+    throw new UsageError('Use: auth [list|add|use <github-login>|remove <github-login>]');
+  }
+  if (action === 'list') {
+    if (name != null) throw new UsageError('auth list takes no profile name');
+    const profiles = await listProfiles();
+    if (profiles.length === 0) {
+      terminal.note('No account profiles. Run auth add.');
+      return [];
+    }
+    for (const profile of profiles) {
+      terminal.done(`${profile.active ? '*' : ' '} ${profile.name}: Gala ${profile.gala.email} + GitHub @${profile.githubLogin}`);
+    }
+    return profiles;
+  }
+  if (action === 'add') {
+    if (name != null) throw new UsageError('auth add takes no profile name; it uses your GitHub username');
+    const profile = await addProfile({ terminal, apiBaseUrl: options.value('api-base-url') });
+    terminal.done(`Using ${profile.metadata.name}: Gala ${profile.metadata.gala.email} + GitHub @${profile.metadata.githubLogin}`);
+    return profile.metadata;
+  }
+  if (name == null) throw new UsageError(`auth ${action} needs a GitHub username`);
+  if (action === 'use') {
+    const profile = await useProfile(name);
+    terminal.done(`Using ${name}: Gala ${profile.gala.email} + GitHub @${profile.githubLogin}`);
+    return profile;
+  }
+  await removeProfile(name);
+  terminal.done(`Removed account profile ${name}`);
+  return null;
 }

package/src/commands/doctor.js

@@ -2,8 +2,8 @@ import { readFile, readdir, stat } from 'node:fs/promises';
 import path from 'node:path';
 
 import { galaApi } from '../api/gala.js';
-import { galaCredential } from '../auth/gala.js';
-import { githubCredential } from '../auth/github.js';
+import { accountForCommand } from '../auth/checkout-profile.js';
+import { selectedProfile } from '../auth/profiles.js';
 import { cliCommand } from '../cli/invocation.js';
 import { createGit } from '../git.js';
 
@@ -19,8 +19,16 @@ export async function doctor({ terminal, options, cwd = process.cwd() }) {
   const root = path.resolve(options.value('root') ?? cwd);
   const checks = [];
 
+  let selected;
+  checks.push(await checkCredential('Account profile', async () => {
+    const account = await accountForCommand(options, root, { terminal });
+    selected = await selectedProfile({ name: account });
+    return ok(`${account}: Gala ${selected.metadata.gala.email} + GitHub @${selected.metadata.githubLogin}`);
+  }));
+
   checks.push(await checkCredential('Gala sign-in', async () => {
-    const gala = await galaCredential({ terminal, apiBaseUrl: options.value('api-base-url') });
+    if (selected == null) throw new Error('account profile is unavailable');
+    const gala = selected.gala;
     const accepted = await galaApi({ baseUrl: gala.apiBaseUrl, token: gala.accessToken }).accepted();
     return accepted
       ? ok(`valid until ${new Date(gala.expiresAt).toLocaleString()}`)
@@ -28,7 +36,8 @@ export async function doctor({ terminal, options, cwd = process.cwd() }) {
   }));
 
   checks.push(await checkCredential('GitHub sign-in', async () => {
-    const github = await githubCredential({ terminal });
+    if (selected == null) throw new Error('account profile is unavailable');
+    const github = selected.github;
     return ok(github.expiresAt
       ? `valid until ${new Date(github.expiresAt).toLocaleString()}`
       : 'signed in');

package/src/commands/domain.js

@@ -1,7 +1,8 @@
 import path from 'node:path';
 
 import { galaApi } from '../api/gala.js';
-import { galaCredential } from '../auth/gala.js';
+import { accountForCommand } from '../auth/checkout-profile.js';
+import { selectedProfile } from '../auth/profiles.js';
 import { UsageError } from '../cli/args.js';
 import { cliCommand } from '../cli/invocation.js';
 import { customDomain } from '../domain.js';
@@ -22,9 +23,8 @@ export async function domain({ terminal, options, cwd = process.cwd() }) {
   if (action === 'set' && value == null) throw new UsageError('domain set needs a hostname');
   if (action !== 'set' && value != null) throw new UsageError(`domain ${action} takes no hostname`);
 
-  const credential = await galaCredential({
-    terminal, apiBaseUrl: options.value('api-base-url'),
-  });
+  const account = await accountForCommand(options, root, { terminal });
+  const credential = (await selectedProfile({ name: account })).gala;
   const api = galaApi({ baseUrl: credential.apiBaseUrl, token: credential.accessToken });
 
   if (action === 'status') {

package/src/commands/init.js

@@ -3,8 +3,8 @@ import path from 'node:path';
 
 import { galaApi } from '../api/gala.js';
 import { githubApi } from '../api/github.js';
-import { galaCredential } from '../auth/gala.js';
-import { githubCredential } from '../auth/github.js';
+import { accountForCommand, bindCheckoutProfile } from '../auth/checkout-profile.js';
+import { selectedProfile } from '../auth/profiles.js';
 import { cloneRepository, createGit, populateEmptyRepository } from '../git.js';
 import { UsageError } from '../cli/args.js';
 import { CLI_INVOCATION, shellArgument } from '../cli/invocation.js';
@@ -45,8 +45,10 @@ export async function init({ terminal, options, cwd = process.cwd() }) {
 
   const destination = await inspectDestination(directory);
 
-  const gala = await galaCredential({ terminal, apiBaseUrl: options.value('api-base-url') });
-  const github = await githubCredential({ terminal });
+  const profile = await selectedProfile({ name: options.value('account') });
+  const { gala, github, metadata } = profile;
+  const account = metadata.name;
+  terminal.step(`Account ${account}: Gala ${metadata.gala.email} + GitHub @${metadata.githubLogin}`);
 
   const name = await publicationName({ terminal, explicitName, directory });
 
@@ -71,6 +73,7 @@ export async function init({ terminal, options, cwd = process.cwd() }) {
   if (destination === 'empty-git') await populateEmptyRepository(checkout);
   else await cloneRepository(checkout);
 
+  await bindCheckoutProfile(directory, account);
   terminal.step('Registering the publication');
   const git = createGit({ root: directory, token: github.accessToken });
   const registration = await api.registerSite({

package/src/commands/prism.js

@@ -2,7 +2,8 @@ import { readFile } from 'node:fs/promises';
 import path from 'node:path';
 
 import { galaApi } from '../api/gala.js';
-import { galaCredential } from '../auth/gala.js';
+import { accountForCommand } from '../auth/checkout-profile.js';
+import { selectedProfile } from '../auth/profiles.js';
 import { UsageError } from '../cli/args.js';
 import { cliCommand } from '../cli/invocation.js';
 import { createGit } from '../git.js';
@@ -21,7 +22,8 @@ export async function prism({ terminal, options, cwd = process.cwd() }) {
   if (!publication || !ULID.test(publication.siteId ?? '')) {
     throw new UsageError('Run this inside a registered Gala publication, or pass --root.');
   }
-  const credential = await galaCredential({ terminal, apiBaseUrl: options.value('api-base-url') });
+  const account = await accountForCommand(options, root, { terminal });
+  const credential = (await selectedProfile({ name: account })).gala;
   const api = galaApi({ baseUrl: credential.apiBaseUrl, token: credential.accessToken });
   const [action = 'status', ...args] = options.positional;
 

package/src/commands/publish.js

@@ -2,7 +2,8 @@ import path from 'node:path';
 
 import { checkContent } from '../content.js';
 import { createGit } from '../git.js';
-import { githubCredential } from '../auth/github.js';
+import { accountForCommand } from '../auth/checkout-profile.js';
+import { selectedProfile } from '../auth/profiles.js';
 import { readPublication } from '../publication.js';
 
 /**
@@ -25,7 +26,8 @@ export async function publish({ terminal, options, cwd = process.cwd(), regenera
   const root = path.resolve(options.value('root') ?? cwd);
   const today = options.value('today');
 
-  const github = await githubCredential({ terminal });
+  const account = await accountForCommand(options, root, { terminal });
+  const github = (await selectedProfile({ name: account })).github;
   const git = createGit({ root, token: github.accessToken });
 
   terminal.step('Catching up with GitHub');

package/src/commands-manifest.js

@@ -26,20 +26,21 @@ import { cliCommand } from './cli/invocation.js';
  */
 export const COMMANDS = {
   auth: {
-    summary: 'Sign in to Gala and GitHub',
+    summary: 'Add, inspect, select or remove account profiles',
+    usage: cliCommand('auth [list|add|use <github-login>|remove <github-login>] [--api-base-url URL]'),
     flags: ['api-base-url'],
     run: auth
   },
   init: {
     summary: 'Create a publication in an empty directory',
-    usage: cliCommand('init [directory] [--name my-notes] [--domain blog.example.com]'),
-    flags: ['name', 'domain', 'api-base-url'],
+    usage: cliCommand('init [directory] [--name my-notes] [--domain blog.example.com] [--account github-login]'),
+    flags: ['name', 'domain', 'account'],
     run: init
   },
   domain: {
     summary: 'Inspect or change this publication’s custom domain',
-    usage: cliCommand('domain [status|set <hostname>|check|cancel|remove] [--root path]'),
-    flags: ['root', 'api-base-url'],
+    usage: cliCommand('domain [status|set <hostname>|check|cancel|remove] [--root path] [--account github-login]'),
+    flags: ['root', 'account'],
     run: domain
   },
   new: {
@@ -55,14 +56,15 @@ export const COMMANDS = {
   },
   publish: {
     summary: 'Check, record and send your work to GitHub',
-    flags: ['root', 'today'],
+    usage: cliCommand('publish [--root path] [--today YYYY-MM-DD] [--account github-login] [--skip-checks]'),
+    flags: ['root', 'today', 'account'],
     switches: ['skip-checks'],
     run: publish
   },
   prism: {
     summary: 'Manage author-approved Prism configurations',
-    usage: cliCommand('prism <status|mode|link-policy|list|create|edit|generate|submit|approve|reject|revoke> [arguments]'),
-    flags: ['root', 'api-base-url', 'language', 'depth', 'intent', 'modality', 'file', 'reason'],
+    usage: cliCommand('prism <status|mode|link-policy|list|create|edit|generate|submit|approve|reject|revoke> [arguments] [--account github-login]'),
+    flags: ['root', 'account', 'language', 'depth', 'intent', 'modality', 'file', 'reason'],
     switches: ['yes'],
     run: prism
   },
@@ -75,7 +77,8 @@ export const COMMANDS = {
   },
   doctor: {
     summary: 'Check a publication and say what is wrong',
-    flags: ['root', 'api-base-url'],
+    usage: cliCommand('doctor [--root path] [--account github-login]'),
+    flags: ['root', 'account'],
     run: doctor
   }
 };