feat: add --profile, auth switch, auth list and per-account logout

[l2ysho]

Note

TL;DR — Adds a way to choose between stored accounts. Commands that call the API take --profile. apify auth switch sets the active account, apify auth list shows all stored accounts offline, and apify logout takes --profile or --all. APIFY_TOKEN still has priority, so --profile and auth switch fail while it is set.

Stacked on #1458 (base claude/multi-account-login-1386). Change the base when #1434 → #1450 → #1458 are merged.

Closes #1384. Part of #1297.

Change

• static enableProfileFlag on ApifyCommand adds --profile <name|userId>, the same way enableJsonFlag adds --json. It is set on 46 commands that call the API: actors, builds, datasets, key-value-stores, runs, task, api, info, run, auth token and create. It is not on init, actor * or mcp install.
• create gets the flag even though the issue calls it offline: with --source github|gitlab|bitbucket it calls the API to set up the Git repository.
• --profile matches a user ID, then name ?? username. So profiles migrated from v1 (which have name: null) match by username.
• An unknown profile fails with exit code InvalidInput and lists the stored accounts. --profile fails with InvalidInput when APIFY_TOKEN is set, also when the two tokens are the same. The selection applies to one command only, so telemetry does not change.
• auth switch [profile]:
  • Prompts when you give no argument, and fails in a non-interactive shell.
  • Refuses an account that has no stored token.
  • Fails while APIFY_TOKEN is set.
  • Calls updateUserId().
• auth list [--json]: shows name, user ID, personal or organization, last login and storage. It marks the active account and shows a warning when APIFY_TOKEN overrides it. It makes no network calls.
• logout --profile <name> removes that account and keeps the active one. logout --all asks for confirmation first; --yes skips the prompt. Removing an account that is not active keeps the legacy unkeyed keyring entries. With nothing stored, logout and logout --all print the same No accounts are stored. Run "apify login" to add one. line as auth list, and exit 0. Before, they reported success. The e2e test that checked for the old message is updated.
• When a token is rejected, the message names the account: The stored API token for my-org was rejected. Run "apify login" to log in to my-org again. A selected account with no token gives No API token is stored for my-org. The CLI no longer says "not logged in" in that case.
• info shows token source: --profile flag and a profile row. run --profile passes that account's token and proxy password to the Actor process.
• docs/ regenerated.

Verification

• pnpm run test:local — 713 passed, 4 skipped (65 files). New file test/local/commands/auth-profiles.test.ts covers the checks in the issue's Verification list.
• pnpm run lint, pnpm run format, pnpm run build — clean. pnpm run update-docs — adds auth list and auth switch, and adds --profile to the commands that opt in.
• I ran node dist/apify.js by hand with a temporary auth folder that held two profiles. I tried auth list (table and --json), an unknown --profile, APIFY_TOKEN with --profile, auth switch with no argument from a pipe, APIFY_TOKEN with auth switch, logout --profile, and logout --all with and without --yes. All gave the expected output and exit codes.
• pnpm run test:api not run: no token in this environment.
• Install size unchanged: no dependency was added or removed.

Left out

• No APIFY_PROFILE variable and no profile renaming, as the issue says.
• auth switch and logout --profile take the account as an argument or flag only. There is no ls alias for auth list.

🤖 Generated with Claude Code