feat(cli): add whoami command (#6552)

## What and why

Adds `supabase whoami`, a read-only command that fetches the active
user's Management API profile. Text output presents clear user-facing
labels, while JSON and stream-JSON expose the stable `id`, `email`, and
`username` fields instead of leaking API-specific field names.

Linear:
[CLI-1280](https://linear.app/supabase/issue/CLI-1280/add-a-whoami-command)

## Usage

```console
$ supabase whoami
USER ID                               USERNAME  EMAIL
00000000-0000-0000-0000-000000000000 example   user@example.com
```

```console
$ supabase whoami --output-format json
{"id":"00000000-0000-0000-0000-000000000000","email":"user@example.com","username":"example"}
```

Stream-JSON emits the same identity object under a standard
`result.data` envelope.

## Testing strategy

Handler integration coverage exercises the Management API request, all
output modes, transport/status/decoding failures, unsupported legacy
output flags, machine-mode progress behavior, and telemetry flushing.
Focused formatter unit coverage protects text rendering, with the full
CLI unit and integration suites covering workspace interactions.

## Review

The complete branch diff was reviewed for correctness, test coverage and
failure behavior, and scope and maintainability. Follow-up findings were
closed by removing externally mutating live coverage, tightening
machine-output and failure assertions, documenting inherited
filesystem/environment/telemetry behavior, and normalizing the public
JSON contract.

Author: Prashansa-K

apps/cli/src/cli/root.ts

@@ -45,6 +45,7 @@ import { testCommand } from "../commands/test/test.command.ts";
 import { telemetryCommand } from "../commands/telemetry/telemetry.command.ts";
 import { unlinkCommand } from "../commands/unlink/unlink.command.ts";
 import { vanitySubdomainsCommand } from "../commands/vanity-subdomains/vanity-subdomains.command.ts";
+import { whoamiCommand } from "../commands/whoami/whoami.command.ts";
 import { OutputFormatFlag } from "../shared/cli/global-flags.ts";
 import { outputLayerFor } from "../shared/output/output.layer.ts";
 import { quietProgressTextOutputLayer } from "../output/quiet-progress-text-output.layer.ts";
@@ -121,6 +122,7 @@ export const rootCommandForBackend = (backend: StackBackend = "legacy"): CliRoot
       testCommand,
       unlinkCommand,
       vanitySubdomainsCommand,
+      whoamiCommand,
     ]),
     Command.provide(
       Layer.unwrap(

apps/cli/src/command-internal/go-output-flag.ts

@@ -49,3 +49,8 @@ export function outputFormatEnumMessage(allowed: ReadonlyArray<string>): string
 export function invalidOutputFormatMessage(value: string, allowed: ReadonlyArray<string>): string {
   return `invalid argument "${value}" for "-o, --output" flag: ${outputFormatEnumMessage(allowed)}`;
 }
+
+/** Directs commands that do not support the legacy output flag to `--output-format`. */
+export function unsupportedOutputFlagMessage(command: string): string {
+  return `the -o/--output flag is not supported by ${command}; use --output-format json|stream-json instead.`;
+}

apps/cli/src/command-internal/go-output-flag.unit.test.ts

@@ -4,6 +4,7 @@ import {
   RESOURCE_OUTPUT_FORMATS,
   invalidOutputFormatMessage,
   outputFormatEnumMessage,
+  unsupportedOutputFlagMessage,
 } from "./go-output-flag.ts";
 
 describe("go-output-flag", () => {
@@ -25,4 +26,19 @@ describe("go-output-flag", () => {
       'invalid argument "yaml" for "-o, --output" flag: must be one of [ json | table | csv ]',
     );
   });
+
+  it("directs unsupported commands to --output-format", () => {
+    expect(unsupportedOutputFlagMessage("whoami")).toBe(
+      "the -o/--output flag is not supported by whoami; use --output-format json|stream-json instead.",
+    );
+    expect(unsupportedOutputFlagMessage("pull")).toBe(
+      "the -o/--output flag is not supported by pull; use --output-format json|stream-json instead.",
+    );
+    expect(unsupportedOutputFlagMessage("config diff")).toBe(
+      "the -o/--output flag is not supported by config diff; use --output-format json|stream-json instead.",
+    );
+    expect(unsupportedOutputFlagMessage("config pull")).toBe(
+      "the -o/--output flag is not supported by config pull; use --output-format json|stream-json instead.",
+    );
+  });
 });

apps/cli/src/command-internal/http-errors.ts

@@ -101,6 +101,10 @@ export function unexpectedStatusMessage(status: number, body: string): string {
   return `unexpected status ${status}: ${body}`;
 }
 
+/** Shared remediation for Management API requests rejected with HTTP 401. */
+export const AUTHENTICATION_FAILED_STATUS_MESSAGE =
+  "Authentication failed: your access token is invalid or has expired. Run `supabase login` to re-authenticate.";
+
 export type NetworkErrorFactory<E> = new (args: {
   readonly message: string;
   readonly decode?: boolean;

apps/cli/src/command-internal/pooler-fallback.unit.test.ts

@@ -51,6 +51,7 @@ function captureOutput() {
           message: () => Effect.void,
           stop: () => Effect.void,
         }),
+      result: () => Effect.void,
       success: () => Effect.void,
       fail: () => Effect.void,
       raw: (text: string, stream: "stdout" | "stderr" = "stdout") =>

apps/cli/src/commands/config/config.read-status.ts

@@ -1,4 +1,8 @@
-import { sanitizeInlineName, unexpectedStatusMessage } from "../../command-internal/http-errors.ts";
+import {
+  AUTHENTICATION_FAILED_STATUS_MESSAGE,
+  sanitizeInlineName,
+  unexpectedStatusMessage,
+} from "../../command-internal/http-errors.ts";
 
 /**
  * Purpose-written messages for the status codes a wrong or inaccessible ref
@@ -26,7 +30,7 @@ export function configReadStatusMessage(
   apiHost: string,
 ): string {
   if (status === 401) {
-    return "Authentication failed: your access token is invalid or has expired. Run `supabase login` to re-authenticate.";
+    return AUTHENTICATION_FAILED_STATUS_MESSAGE;
   }
   if (status === 403) {
     return `Access denied for project ${sanitizeInlineName(ref)}: your account does not have permission to view its configuration.`;

apps/cli/src/commands/config/diff/diff.handler.ts

@@ -13,6 +13,7 @@ import { validateWorkdirIsDirectory } from "../../../command-internal/workdir-va
 import { LinkedProjectCache } from "../../../telemetry/linked-project-cache.service.ts";
 import { TelemetryState } from "../../../telemetry/telemetry-state.service.ts";
 import { OutputFlag } from "../../../command-internal/global-flags.ts";
+import { unsupportedOutputFlagMessage } from "../../../command-internal/go-output-flag.ts";
 import { Output } from "../../../shared/output/output.service.ts";
 import { ProcessControl } from "../../../shared/runtime/process-control.service.ts";
 import {
@@ -110,8 +111,7 @@ export const configDiff = Effect.fn("config.diff")(function* (flags: ConfigDiffF
     // the same as every other failure here.
     if (Option.isSome(goOutputFlag)) {
       return yield* new ConfigDiffOutputFlagUnsupportedError({
-        message:
-          "the -o/--output flag is not supported by config diff; use --output-format json|stream-json instead.",
+        message: unsupportedOutputFlagMessage("config diff"),
       });
     }
 

apps/cli/src/commands/config/pull/pull.handler.ts

@@ -16,6 +16,7 @@ import { validateWorkdirIsDirectory } from "../../../command-internal/workdir-va
 import { LinkedProjectCache } from "../../../telemetry/linked-project-cache.service.ts";
 import { TelemetryState } from "../../../telemetry/telemetry-state.service.ts";
 import { resolveYes, OutputFlag } from "../../../command-internal/global-flags.ts";
+import { unsupportedOutputFlagMessage } from "../../../command-internal/go-output-flag.ts";
 import { promptYesNo } from "../../../command-internal/prompt-yes-no.ts";
 import { Output } from "../../../shared/output/output.service.ts";
 import { Tty } from "../../../shared/runtime/tty.service.ts";
@@ -275,8 +276,7 @@ export const configPull = Effect.fn("config.pull")(function* (flags: ConfigPullF
     // contract (CLI-2156, mirrors `config diff`).
     if (Option.isSome(goOutputFlag)) {
       return yield* new ConfigPullOutputFlagUnsupportedError({
-        message:
-          "the -o/--output flag is not supported by config pull; use --output-format json|stream-json instead.",
+        message: unsupportedOutputFlagMessage("config pull"),
       });
     }
 

apps/cli/src/commands/issue/issue.integration.test.ts

@@ -79,6 +79,7 @@ function issueMockOutput(opts: { readonly format?: OutputFormat } = {}) {
           message: () => Effect.void,
           stop: () => Effect.void,
         }),
+      result: () => Effect.void,
       success: (message: string, data?: Record<string, unknown>) =>
         Effect.sync(() => {
           messages.push({ type: "success", message, data });

apps/cli/src/commands/pull/pull.handler.ts

@@ -4,6 +4,7 @@ import { CommandSettings } from "../../config/command-settings.service.ts";
 import { pathHasUncommittedChanges } from "../../command-internal/git-status.ts";
 import { mapHttpError } from "../../command-internal/http-errors.ts";
 import { MigrationsReadError } from "../../command-internal/migration.errors.ts";
+import { unsupportedOutputFlagMessage } from "../../command-internal/go-output-flag.ts";
 import { validateWorkdirIsDirectory } from "../../command-internal/workdir-validation.ts";
 import { MachineErrorContext } from "../../shared/output/machine-error-context.service.ts";
 import { resolveYes, OutputFlag } from "../../command-internal/global-flags.ts";
@@ -248,8 +249,7 @@ export const pull = Effect.fn("pull")(function* (flags: PullFlags) {
     // a net-new TS command with no Go parity contract (CLI-2156).
     if (Option.isSome(goOutputFlag)) {
       return yield* new PullOutputFlagUnsupportedError({
-        message:
-          "the -o/--output flag is not supported by pull; use --output-format json|stream-json instead.",
+        message: unsupportedOutputFlagMessage("pull"),
       });
     }