feat(cli): port login and logout commands to native TypeScript (#5446)

Promotes `supabase login` and `supabase logout` from Phase 0 Go-binary
proxy wrappers to native TypeScript Effect handlers in the legacy shell
(CLI-1302). Parity with the Go CLI is the explicit priority — matching
stdout/stderr strings, streams, exit codes, the OAuth crypto flow, the
credential-delete ordering, and the telemetry stitch.

## login

- **Token path** — resolves the token from `--token` →
`SUPABASE_ACCESS_TOKEN` → piped stdin (non-TTY), saves it, then stitches
telemetry identity and prints `You are now logged in. Happy coding!`.
- **Browser OAuth flow** — ECDH P-256 keypair + AES-256-GCM decrypt
(`LegacyLoginCrypto`), session polling at
`/platform/cli/login/{sessionId}` + best-effort `/v1/profile` gotrue-id
fetch (`LegacyLoginApi`). Verify-with-retries mirrors Go's backoff: 3
attempts total, `Retry (n/2)` printed on the first two failures only.
- **Telemetry** — fetches the gotrue id, stitches or clears the
`distinct_id`, and always captures `cli_login_completed`. The stitch
*aliases* only (no `identify`) to match Go's `StitchLogin`.
- **Profile persistence** — on success, an explicitly-set profile is
written to `~/.supabase/profile` (Go's `PostRunE` / `SaveProfileName`);
`LegacyCliConfig` now reads that file back as the lowest-precedence
profile source.
- Claude Code plugin hint on a TTY stdout.

## logout

- Confirm prompt honoring `--yes`, the not-logged-in stderr path (exits
0, skips the credential sweep), real-removal-failure propagation, and
the project-credential sweep.

## Shared infra

- `LegacyCredentials.deleteAccessToken` reshaped to the Go-faithful
tri-state (`void` | `LegacyNotLoggedInError` | `LegacyDeleteTokenError`)
reproducing Go's file-first / legacy-keyring / profile-keyring ordering
— including the deliberate "file removed yet *not logged in*" quirk on
no-keyring hosts. Adds `deleteAllProjectCredentials`.
- `LegacyTelemetryState` gains `stitchLogin` / `clearDistinctId` (alias
+ persist, sharing one JSON read/merge internal).

## Reviewer-relevant notes

- The profile-file **read** fallback lives in the shared
`LegacyCliConfig` layer, so it now applies to every legacy command
(correct Go parity, wider than just login).
- `~/.supabase/profile` write failure is fatal (exit 1), matching Go's
"block subsequent CI commands on save failure".

SIDE_EFFECTS.md added for both commands; the porting-status tracker is
flipped to `ported`.

Author: Coly010

apps/cli/docs/go-cli-porting-status.md

@@ -261,8 +261,8 @@ Legend:
 | `postgres-config get`                  | `ported`      | [`../src/legacy/commands/postgres-config/get/get.command.ts`](../src/legacy/commands/postgres-config/get/get.command.ts)                                                                  |
 | `postgres-config update`               | `ported`      | [`../src/legacy/commands/postgres-config/update/update.command.ts`](../src/legacy/commands/postgres-config/update/update.command.ts)                                                      |
 | `postgres-config delete`               | `ported`      | [`../src/legacy/commands/postgres-config/delete/delete.command.ts`](../src/legacy/commands/postgres-config/delete/delete.command.ts)                                                      |
-| `login`                                | `wrapped`     | [`../src/legacy/commands/login/login.command.ts`](../src/legacy/commands/login/login.command.ts)                                                                                          |
-| `logout`                               | `wrapped`     | [`../src/legacy/commands/logout/logout.command.ts`](../src/legacy/commands/logout/logout.command.ts)                                                                                      |
+| `login`                                | `ported`      | [`../src/legacy/commands/login/login.command.ts`](../src/legacy/commands/login/login.command.ts)                                                                                          |
+| `logout`                               | `ported`      | [`../src/legacy/commands/logout/logout.command.ts`](../src/legacy/commands/logout/logout.command.ts)                                                                                      |
 | `link`                                 | `ported`      | [`../src/legacy/commands/link/link.command.ts`](../src/legacy/commands/link/link.command.ts)                                                                                              |
 | `unlink`                               | `ported`      | [`../src/legacy/commands/unlink/unlink.command.ts`](../src/legacy/commands/unlink/unlink.command.ts)                                                                                      |
 | `bootstrap`                            | `wrapped`     | [`../src/legacy/commands/bootstrap/bootstrap.command.ts`](../src/legacy/commands/bootstrap/bootstrap.command.ts)                                                                          |

apps/cli/src/legacy/auth/legacy-credentials.layer.ts

@@ -4,7 +4,12 @@ import { RuntimeInfo } from "../../shared/runtime/runtime-info.service.ts";
 import { normalizeKeyringToken } from "../../shared/auth/keyring-token.ts";
 import { LegacyCliConfig } from "../config/legacy-cli-config.service.ts";
 import { LegacyCredentials } from "./legacy-credentials.service.ts";
-import { LegacyCredentialDeleteError, LegacyInvalidAccessTokenError } from "./legacy-errors.ts";
+import {
+  LegacyCredentialDeleteError,
+  LegacyDeleteTokenError,
+  LegacyInvalidAccessTokenError,
+  LegacyNotLoggedInError,
+} from "./legacy-errors.ts";
 
 const KEYRING_SERVICE = "Supabase CLI";
 const LEGACY_KEYRING_ACCOUNT = "access-token";
@@ -14,6 +19,9 @@ const ACCESS_TOKEN_PATTERN = /^sbp_(oauth_)?[a-f0-9]{40}$/;
 
 const INVALID_TOKEN_MESSAGE = "Invalid access token format. Must be like `sbp_0102...1920`.";
 
+// Go's `utils.ErrNotLoggedIn` (`access_token.go:19`).
+const NOT_LOGGED_IN_MESSAGE = "You were not logged in, nothing to do.";
+
 type KeyringModule = typeof import("@napi-rs/keyring");
 type KeyringEntry = InstanceType<KeyringModule["Entry"]>;
 type RuntimePlatform = NodeJS.Platform;
@@ -219,6 +227,92 @@ const deleteKeyringEntryStrict = (
     return deleted;
   });
 
+// Delete the access-token profile entry, distinguishing the three outcomes Go's
+// `credentials.StoreProvider.Delete(profile)` collapses into via the
+// `access_token.go:110-117` error mapping:
+//   - `"deleted"`  — an entry existed and was removed (→ logged out, exit 0);
+//   - `"notFound"` — no entry existed (→ Go's `ErrNotLoggedIn`, exit 0);
+//   - `LegacyDeleteTokenError` — a real `deleteCredential()` failure (exit 1).
+// Like `deleteKeyringEntryStrict`, the entry is probed first so deleting an
+// absent macOS entry never blocks on a Keychain prompt, and the Windows
+// target-shaped credential is handled separately.
+const deleteProfileKeyringEntry = (
+  module: KeyringModule,
+  account: string,
+  platform: RuntimePlatform,
+): Effect.Effect<"deleted" | "notFound", LegacyDeleteTokenError> =>
+  Effect.gen(function* () {
+    let found = false;
+
+    const plain = new module.Entry(KEYRING_SERVICE, account);
+    if (readEntryPassword(plain)) {
+      yield* Effect.try({
+        try: () => {
+          plain.deleteCredential();
+        },
+        catch: (cause) =>
+          new LegacyDeleteTokenError({
+            message: `failed to delete access token from keyring: ${String(cause)}`,
+          }),
+      });
+      found = true;
+    }
+
+    if (platform === "win32" && readGoWindowsTarget(module, account)) {
+      const target = module.Entry.withTarget(
+        goWindowsCredentialTarget(account),
+        KEYRING_SERVICE,
+        account,
+      );
+      yield* Effect.try({
+        try: () => {
+          target.deleteCredential();
+        },
+        catch: (cause) =>
+          new LegacyDeleteTokenError({
+            message: `failed to delete access token from keyring: ${String(cause)}`,
+          }),
+      });
+      found = true;
+    }
+
+    return found ? "deleted" : "notFound";
+  });
+
+// Best-effort wipe of every entry in the `"Supabase CLI"` keyring namespace —
+// the project database-password credentials `link` writes. Mirrors Go's
+// `keyring.DeleteAll(namespace)` (`store.go:71`). Never fails: per-entry delete
+// errors are swallowed so a single stuck credential can't abort logout.
+//
+// On Windows, Go stores credentials under the target-shaped name
+// `Supabase CLI:<account>` rather than the plain `Entry(service, account)` form
+// (see `writeGoWindowsTarget`). So each discovered account is deleted in BOTH
+// forms — the plain entry and, on win32, the Go target entry — mirroring the
+// individual deletes in `deleteProfileKeyringEntry`. Without this, a Go-written
+// project credential would survive `logout` on Windows.
+const deleteAllKeyringEntries = (
+  module: KeyringModule,
+  platform: RuntimePlatform,
+): Effect.Effect<void> =>
+  Effect.sync(() => {
+    let entries: ReadonlyArray<{ account: string }>;
+    try {
+      entries = module.findCredentials(KEYRING_SERVICE);
+    } catch {
+      return;
+    }
+    for (const { account } of entries) {
+      try {
+        new module.Entry(KEYRING_SERVICE, account).deleteCredential();
+      } catch {
+        // best-effort per entry
+      }
+      if (platform === "win32" && readGoWindowsTarget(module, account)) {
+        deleteGoWindowsTarget(module, account);
+      }
+    }
+  });
+
 const makeLegacyCredentials = Effect.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
@@ -307,23 +401,50 @@ const makeLegacyCredentials = Effect.gen(function* () {
       }),
 
     deleteAccessToken: Effect.gen(function* () {
-      let anyDeleted = false;
-      if (Option.isSome(keyringModule)) {
-        if (yield* tryKeyringDelete(keyringModule.value, profileAccount, runtimeInfo.platform)) {
-          anyDeleted = true;
-        }
-        if (
-          yield* tryKeyringDelete(keyringModule.value, LEGACY_KEYRING_ACCOUNT, runtimeInfo.platform)
-        ) {
-          anyDeleted = true;
-        }
-      }
+      // Reproduce Go's `utils.DeleteAccessToken` (`access_token.go:100-119`) in
+      // its exact order.
+
+      // 1. Always remove the fallback token file first. A missing file is
+      //    ignored (Go's `errors.Is(err, os.ErrNotExist)`); any other removal
+      //    failure aborts before the keyring is touched.
       const exists = yield* fs.exists(fallbackPath).pipe(Effect.orElseSucceed(() => false));
       if (exists) {
-        yield* fs.remove(fallbackPath).pipe(Effect.orDie);
-        anyDeleted = true;
+        yield* fs.remove(fallbackPath).pipe(
+          Effect.catch((error) =>
+            Effect.fail(
+              new LegacyDeleteTokenError({
+                message: `failed to remove access token file: ${error.message}`,
+              }),
+            ),
+          ),
+        );
+      }
+
+      // 2. Best-effort delete of the legacy `access-token` keyring account.
+      //    Go debug-logs and ignores any error here — never affects the result.
+      if (Option.isSome(keyringModule)) {
+        yield* tryKeyringDelete(keyringModule.value, LEGACY_KEYRING_ACCOUNT, runtimeInfo.platform);
+      }
+
+      // 3. Delete the profile keyring account — this alone decides the outcome.
+      //    No keyring backend (WSL / `SUPABASE_NO_KEYRING` / unsupported) maps to
+      //    Go's `ErrNotSupported`/`ErrUnsupportedPlatform` → `ErrNotLoggedIn`.
+      if (Option.isNone(keyringModule)) {
+        return yield* Effect.fail(new LegacyNotLoggedInError({ message: NOT_LOGGED_IN_MESSAGE }));
       }
-      return anyDeleted;
+      const outcome = yield* deleteProfileKeyringEntry(
+        keyringModule.value,
+        profileAccount,
+        runtimeInfo.platform,
+      );
+      if (outcome === "notFound") {
+        return yield* Effect.fail(new LegacyNotLoggedInError({ message: NOT_LOGGED_IN_MESSAGE }));
+      }
+    }),
+
+    deleteAllProjectCredentials: Effect.gen(function* () {
+      if (Option.isNone(keyringModule)) return;
+      yield* deleteAllKeyringEntries(keyringModule.value, runtimeInfo.platform);
     }),
 
     deleteProjectCredential: (projectRef: string) =>