@metabase/cli 0.1.12 → 0.1.13

package/dist/{runtime-DgHh4T6t.mjs → runtime-DJTGfiKO.mjs}

@@ -1,6 +1,6 @@
-import { AbortError, ConfigError, MetabaseError, NetworkError, ResponseShapeError, TimeoutError, ValidationError, errorMessage, flagConsumesValue, isNotFoundError, normalizeFlag, setMetabaseAugment, toAliasArray } from "./command-augment-BH9qgQ5u.mjs";
-import { DEFAULT_MAX_BYTES, package_default, reportError } from "./error-BGH4gxGN.mjs";
-import { BASELINE_CAPABILITIES, isPlainObject, warn } from "./capabilities-7L9GVMd_.mjs";
+import { AbortError, ConfigError, MetabaseError, NetworkError, ResponseShapeError, TimeoutError, ValidationError, errorMessage, flagConsumesValue, isNotFoundError, normalizeFlag, setMetabaseAugment, toAliasArray, warn } from "./command-augment-CAur0XOQ.mjs";
+import { DEFAULT_MAX_BYTES, ENV_API_KEY, ENV_DISABLE_KEYRING, ENV_PROFILE, ENV_SKIP_PREFLIGHT, ENV_URL, consumeLegacyEnvWarnings, package_default, readEnv, reportError } from "./error-DR_i1hxJ.mjs";
+import { BASELINE_CAPABILITIES, isPlainObject } from "./capabilities-BX1rnVuH.mjs";
 import { defineCommand } from "citty";
 import { z } from "zod";
 import { promises } from "node:fs";
@@ -117,14 +117,25 @@ const ProfileLastFailure = z.object({
 	kind: ProfileFailureKind,
 	reason: z.string()
 });
+const ProfileOAuth = z.object({
+	accessToken: z.string().nullable(),
+	refreshToken: z.string().nullable(),
+	expiresAt: z.iso.datetime(),
+	clientId: z.string()
+}).loose();
+const ProfileAuthMethod = z.enum(["oauth", "apiKey"]);
 const ProfileRecord = z.object({
 	name: z.string(),
 	url: z.string(),
 	apiKey: z.string().nullable(),
+	oauth: ProfileOAuth.nullable().default(null),
 	lastProbe: ProfileLastProbe.nullable(),
 	lastFailure: ProfileLastFailure.nullable()
-});
-const ProfilesFile = z.object({ profiles: z.array(ProfileRecord) });
+}).loose();
+const ProfilesFile = z.object({ profiles: z.array(ProfileRecord) }).loose();
+function profileAuthMethod(record) {
+	return record.oauth !== null ? "oauth" : "apiKey";
+}
 
 //#endregion
 //#region src/core/auth/storage.ts
@@ -136,8 +147,15 @@ const PROFILES_FILE_MODE = 384;
 const PROFILES_DIR_MODE = 448;
 const DEFAULT_PROFILE = "default";
 const LEGACY_STORAGE_NOTICE = "Old profile storage detected and ignored; re-run `mb auth login` for each profile.";
-const account = { profileApiKey: (profile) => `profile:${profile}:apiKey` };
+const KEYCHAIN_RESIDUAL_NOTICE = "warning: could not remove one or more secrets from the OS keychain; a stored token may remain — remove it manually or retry.";
+const account = {
+	profileApiKey: (profile) => `profile:${profile}:apiKey`,
+	profileOAuthAccess: (profile) => `profile:${profile}:oauthAccess`,
+	profileOAuthRefresh: (profile) => `profile:${profile}:oauthRefresh`
+};
 let legacyWarningPending = false;
+let keychainResidualPending = false;
+let keyringDowngradeNotice = null;
 function profilesFilePath() {
 	return join(configDir(), PROFILES_FILE);
 }
@@ -146,8 +164,18 @@ function consumeLegacyStorageWarning() {
 	legacyWarningPending = false;
 	return LEGACY_STORAGE_NOTICE;
 }
+function consumeKeychainResidualWarning() {
+	if (!keychainResidualPending) return null;
+	keychainResidualPending = false;
+	return KEYCHAIN_RESIDUAL_NOTICE;
+}
+function consumeKeyringDowngradeWarning() {
+	const message = keyringDowngradeNotice;
+	keyringDowngradeNotice = null;
+	return message;
+}
 function keyringEnabled() {
-	return process.env["METABASE_CLI_DISABLE_KEYRING"] !== "1";
+	return readEnv(ENV_DISABLE_KEYRING) !== "1";
 }
 function trySetKeyring(key, value) {
 	if (!keyringEnabled()) return false;
@@ -166,12 +194,12 @@ function tryReadKeyring(key) {
 		return void 0;
 	}
 }
-function tryRemoveKeyring(key) {
-	if (!keyringEnabled()) return void 0;
+function removeKeyringEntry(key) {
+	if (!keyringEnabled()) return "skipped";
 	try {
-		return new Entry(KEYRING_SERVICE, key).deletePassword();
+		return new Entry(KEYRING_SERVICE, key).deletePassword() ? "removed" : "absent";
 	} catch {
-		return void 0;
+		return "failed";
 	}
 }
 async function readProfilesFile() {
@@ -219,8 +247,15 @@ async function writeProfilesFile(file) {
 		recursive: true,
 		mode: PROFILES_DIR_MODE
 	});
-	await promises.writeFile(path, JSON.stringify(file, null, 2) + "\n", { mode: PROFILES_FILE_MODE });
-	if (process.platform !== "win32") await promises.chmod(path, PROFILES_FILE_MODE);
+	const tmpPath = `${path}.${process.pid}.tmp`;
+	await promises.writeFile(tmpPath, JSON.stringify(file, null, 2) + "\n", { mode: PROFILES_FILE_MODE });
+	if (process.platform !== "win32") await promises.chmod(tmpPath, PROFILES_FILE_MODE);
+	try {
+		await promises.rename(tmpPath, path);
+	} catch (error) {
+		await promises.unlink(tmpPath).catch(() => void 0);
+		throw error;
+	}
 	await cleanupLegacyFiles();
 }
 async function cleanupLegacyFiles() {
@@ -229,6 +264,13 @@ async function cleanupLegacyFiles() {
 function findRecord(file, name) {
 	return file.profiles.find((entry) => entry.name === name) ?? null;
 }
+function sideIsKeyringBacked(record, side) {
+	return side === "oauth" ? record.oauth !== null && record.oauth.accessToken === null : record.oauth === null && record.apiKey === null;
+}
+function flagResidualIfUnconfirmed(existing, cleared, removals) {
+	if (existing === null || !removals.includes("failed")) return;
+	if (sideIsKeyringBacked(existing, cleared)) keychainResidualPending = true;
+}
 function fileLocation(key) {
 	return {
 		backend: "file",
@@ -238,34 +280,54 @@ function fileLocation(key) {
 	};
 }
 function keyringFallbackWarning(location) {
-	const cause = location.reason === "disabled" ? "OS keychain disabled via METABASE_CLI_DISABLE_KEYRING" : "OS keychain unavailable";
+	const cause = location.reason === "disabled" ? `OS keychain disabled via ${ENV_DISABLE_KEYRING}` : "OS keychain unavailable";
 	return `warning: ${cause}; credentials stored as plaintext at ${location.path}`;
 }
-async function persistApiKey(name, apiKey) {
-	const key = account.profileApiKey(name);
-	if (trySetKeyring(key, apiKey)) return {
+function persistSecret(key, value) {
+	if (trySetKeyring(key, value)) return {
 		backend: "keyring",
 		service: KEYRING_SERVICE,
 		account: key
 	};
+	removeKeyringEntry(key);
 	return fileLocation(key);
 }
-async function readProfile(name = DEFAULT_PROFILE) {
+function resolveSecret(key, inline) {
+	if (inline !== null) return inline;
+	return tryReadKeyring(key) ?? null;
+}
+async function readProfileCredential(name = DEFAULT_PROFILE) {
 	const file = await readProfilesFile();
 	const record = findRecord(file, name);
 	if (record === null) return null;
-	const apiKey = await resolveApiKey(record);
+	return resolveRecordCredential(record);
+}
+function resolveRecordCredential(record) {
+	if (record.oauth !== null) {
+		const accessToken = resolveSecret(account.profileOAuthAccess(record.name), record.oauth.accessToken);
+		const refreshToken = resolveSecret(account.profileOAuthRefresh(record.name), record.oauth.refreshToken);
+		if (accessToken === null || refreshToken === null) return null;
+		return {
+			url: record.url,
+			credential: {
+				kind: "oauth",
+				accessToken,
+				refreshToken,
+				expiresAt: record.oauth.expiresAt,
+				clientId: record.oauth.clientId
+			}
+		};
+	}
+	const apiKey = resolveSecret(account.profileApiKey(record.name), record.apiKey);
 	if (apiKey === null) return null;
 	return {
 		url: record.url,
-		apiKey
+		credential: {
+			kind: "apiKey",
+			apiKey
+		}
 	};
 }
-async function resolveApiKey(record) {
-	const fromKeyring = tryReadKeyring(account.profileApiKey(record.name));
-	if (typeof fromKeyring === "string") return fromKeyring;
-	return record.apiKey;
-}
 async function readProfileRecord(name = DEFAULT_PROFILE) {
 	const file = await readProfilesFile();
 	return findRecord(file, name);
@@ -274,29 +336,72 @@ async function listProfileRecords() {
 	const file = await readProfilesFile();
 	return file.profiles;
 }
+async function upsertRecord(file, name, updated) {
+	const exists = findRecord(file, name) !== null;
+	const profiles = exists ? file.profiles.map((entry) => entry.name === name ? updated : entry) : [...file.profiles, updated];
+	await writeProfilesFile({
+		...file,
+		profiles
+	});
+}
 async function writeProfile(profile, name = DEFAULT_PROFILE) {
-	const location = await persistApiKey(name, profile.apiKey);
+	const location = persistSecret(account.profileApiKey(name), profile.apiKey);
 	const inlineApiKey = location.backend === "file" ? profile.apiKey : null;
 	const file = await readProfilesFile();
 	const existing = findRecord(file, name);
+	flagResidualIfUnconfirmed(existing, "oauth", [removeKeyringEntry(account.profileOAuthAccess(name)), removeKeyringEntry(account.profileOAuthRefresh(name))]);
 	const updated = existing === null ? {
 		name,
 		url: profile.url,
 		apiKey: inlineApiKey,
+		oauth: null,
 		lastProbe: null,
 		lastFailure: null
 	} : {
 		...existing,
 		url: profile.url,
-		apiKey: inlineApiKey
+		apiKey: inlineApiKey,
+		oauth: null
 	};
-	const profiles = existing === null ? [...file.profiles, updated] : file.profiles.map((entry) => entry.name === name ? updated : entry);
-	await writeProfilesFile({
-		...file,
-		profiles
-	});
+	await upsertRecord(file, name, updated);
 	return location;
 }
+async function writeOAuthProfile(url, credential, name = DEFAULT_PROFILE) {
+	const accessKey = account.profileOAuthAccess(name);
+	const refreshKey = account.profileOAuthRefresh(name);
+	const accessLocation = persistSecret(accessKey, credential.accessToken);
+	const refreshLocation = persistSecret(refreshKey, credential.refreshToken);
+	const onFile = accessLocation.backend === "file" || refreshLocation.backend === "file";
+	const oauth = {
+		accessToken: onFile ? credential.accessToken : null,
+		refreshToken: onFile ? credential.refreshToken : null,
+		expiresAt: credential.expiresAt,
+		clientId: credential.clientId
+	};
+	const file = await readProfilesFile();
+	const existing = findRecord(file, name);
+	if (onFile && existing !== null && sideIsKeyringBacked(existing, "oauth")) keyringDowngradeNotice = keyringFallbackWarning(fileLocation(accessKey));
+	flagResidualIfUnconfirmed(existing, "apiKey", [removeKeyringEntry(account.profileApiKey(name))]);
+	const updated = existing === null ? {
+		name,
+		url,
+		apiKey: null,
+		oauth,
+		lastProbe: null,
+		lastFailure: null
+	} : {
+		...existing,
+		url,
+		apiKey: null,
+		oauth
+	};
+	await upsertRecord(file, name, updated);
+	return onFile ? fileLocation(accessKey) : {
+		backend: "keyring",
+		service: KEYRING_SERVICE,
+		account: accessKey
+	};
+}
 async function writeProbeResult(name, input) {
 	const probe = ProfileLastProbe.parse({
 		at: new Date().toISOString(),
@@ -319,7 +424,7 @@ async function writeProbeResult(name, input) {
 	return probe;
 }
 async function writeProbeFailure(name, input) {
-	const failure = ProfileLastFailure.parse({
+	const failure$1 = ProfileLastFailure.parse({
 		at: new Date().toISOString(),
 		kind: input.kind,
 		reason: input.reason
@@ -329,18 +434,23 @@ async function writeProbeFailure(name, input) {
 	if (existing === null) return null;
 	const profiles = file.profiles.map((entry) => entry.name === name ? {
 		...entry,
-		lastFailure: failure
+		lastFailure: failure$1
 	} : entry);
 	await writeProfilesFile({
 		...file,
 		profiles
 	});
-	return failure;
+	return failure$1;
 }
 async function clearProfile(name = DEFAULT_PROFILE) {
-	tryRemoveKeyring(account.profileApiKey(name));
 	const file = await readProfilesFile();
 	const existing = findRecord(file, name);
+	const removals = [
+		removeKeyringEntry(account.profileApiKey(name)),
+		removeKeyringEntry(account.profileOAuthAccess(name)),
+		removeKeyringEntry(account.profileOAuthRefresh(name))
+	];
+	if (existing !== null) flagResidualIfUnconfirmed(existing, existing.oauth !== null ? "oauth" : "apiKey", removals);
 	if (existing === null) return false;
 	await writeProfilesFile({
 		...file,
@@ -387,6 +497,45 @@ function abortReason(signal) {
 	return new AbortError("aborted");
 }
 
+//#endregion
+//#region src/core/auth/credential.ts
+const API_KEY_HEADER = "x-api-key";
+const AUTHORIZATION_HEADER = "authorization";
+const BEARER_PREFIX = "Bearer ";
+const EXPIRY_SKEW_MS = 6e4;
+const DEFAULT_EXPIRES_IN_SECONDS = 3600;
+function credentialAuthHeader(credential) {
+	if (credential.kind === "apiKey") return {
+		name: API_KEY_HEADER,
+		value: credential.apiKey
+	};
+	return {
+		name: AUTHORIZATION_HEADER,
+		value: BEARER_PREFIX + credential.accessToken
+	};
+}
+function credentialSecrets(credential) {
+	if (credential.kind === "apiKey") return [credential.apiKey];
+	return [credential.accessToken, credential.refreshToken];
+}
+function isOAuthExpired(credential, nowMs) {
+	const expiryMs = Date.parse(credential.expiresAt);
+	if (Number.isNaN(expiryMs)) return true;
+	return expiryMs - EXPIRY_SKEW_MS <= nowMs;
+}
+function expiresAtFromNow(expiresInSeconds, nowMs) {
+	return new Date(nowMs + expiresInSeconds * 1e3).toISOString();
+}
+function oauthCredentialFromTokens(tokens, refreshToken, clientId, nowMs) {
+	return {
+		kind: "oauth",
+		accessToken: tokens.access_token,
+		refreshToken,
+		expiresAt: expiresAtFromNow(tokens.expires_in ?? DEFAULT_EXPIRES_IN_SECONDS, nowMs),
+		clientId
+	};
+}
+
 //#endregion
 //#region src/core/http/sanitize.ts
 const SECRET_HEADER_NAMES = new Set([
@@ -567,6 +716,53 @@ function defaultMessageForStatus(status) {
 	return STATUS_CLASSIFICATIONS[status]?.message ?? `Metabase returned ${status}.`;
 }
 
+//#endregion
+//#region src/core/http/network-error.ts
+const NETWORK_HINTS = {
+	ECONNREFUSED: (t) => `Connection refused by ${t.host} — is Metabase running and is the port correct?`,
+	ENOTFOUND: (t) => `Host not found: ${t.hostname} — check the URL.`,
+	EAI_AGAIN: (t) => `Could not resolve ${t.hostname} — check your network connection and the URL.`,
+	ECONNRESET: (t) => `Connection to ${t.host} was reset — the server may have closed it, or http/https may be mismatched.`,
+	ETIMEDOUT: (t) => `Connection to ${t.host} timed out — check the host, port, and your network.`
+};
+const TLS_ERROR_CODES = new Set([
+	"EPROTO",
+	"DEPTH_ZERO_SELF_SIGNED_CERT",
+	"SELF_SIGNED_CERT_IN_CHAIN",
+	"UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+	"CERT_HAS_EXPIRED",
+	"ERR_TLS_CERT_ALTNAME_INVALID"
+]);
+function buildNetworkError(error, method, url) {
+	const fallback = errorMessage(error);
+	const code = causeCode(error);
+	const target = networkTarget(url);
+	return new NetworkError(networkMessage(code, target, fallback), {
+		method,
+		url,
+		cause: code ?? fallback
+	});
+}
+function networkMessage(code, target, fallback) {
+	if (code === null) return `Could not reach Metabase: ${fallback}`;
+	if (TLS_ERROR_CODES.has(code)) return `Could not reach Metabase: TLS error contacting ${target.host} (${code}) — the certificate could not be verified, or https:// was used against a plain-HTTP server.`;
+	const hint = NETWORK_HINTS[code];
+	if (hint === void 0) return `Could not reach Metabase: ${fallback} (${code})`;
+	return `Could not reach Metabase: ${hint(target)}`;
+}
+function causeCode(error) {
+	const cause = error instanceof Error ? error.cause : void 0;
+	if (cause instanceof Error && "code" in cause && typeof cause.code === "string") return cause.code;
+	return null;
+}
+function networkTarget(url) {
+	const parsed = new URL(url);
+	return {
+		host: parsed.host,
+		hostname: parsed.hostname
+	};
+}
+
 //#endregion
 //#region src/core/http/retry.ts
 const DEFAULT_MAX_RETRIES = 3;
@@ -601,6 +797,7 @@ async function runWithRetries(attempt, signal) {
 
 //#endregion
 //#region src/core/http/client.ts
+const UNAUTHORIZED_STATUS = 401;
 const DEFAULT_TIMEOUT_MS = 3e4;
 const OCTET_STREAM_CONTENT_TYPE = "application/octet-stream";
 const TEXT_CONTENT_TYPE_PREFIX = "text/";
@@ -615,7 +812,26 @@ const NO_SERVER_TAG = async () => null;
 function createClient(config, overrides = {}) {
 	const fetchImpl = overrides.fetchImpl ?? globalThis.fetch.bind(globalThis);
 	const getServerTag = overrides.getServerTag ?? NO_SERVER_TAG;
-	const redactionContext = { knownSecrets: new Set([config.apiKey]) };
+	const refreshCredential = overrides.refreshCredential;
+	let credential = config.credential;
+	const knownSecrets = new Set(credentialSecrets(credential));
+	const redactionContext = { knownSecrets };
+	let refreshInFlight = null;
+	function tryRefreshCredential() {
+		const refresh = refreshCredential;
+		if (credential.kind !== "oauth" || refresh === void 0) return Promise.resolve(false);
+		refreshInFlight ??= refreshOnce(refresh).finally(() => {
+			refreshInFlight = null;
+		});
+		return refreshInFlight;
+	}
+	async function refreshOnce(refresh) {
+		const next = await refresh();
+		if (next === null) return false;
+		credential = next;
+		for (const secret of credentialSecrets(next)) knownSecrets.add(secret);
+		return true;
+	}
 	async function attemptOnce(prepared, attempt) {
 		const hasRetriesLeft = attempt < prepared.retries;
 		const timeoutSignal = AbortSignal.timeout(prepared.timeoutMs);
@@ -677,12 +893,33 @@ function createClient(config, overrides = {}) {
 	async function executeRaw(prepared) {
 		return runWithRetries((attempt) => attemptOnce(prepared, attempt), prepared.callerSignal);
 	}
+	async function executeWithAuthRefresh(path, opts) {
+		const prepared = prepare(path, opts);
+		try {
+			return {
+				response: await executeRaw(prepared),
+				prepared
+			};
+		} catch (error) {
+			if (error instanceof HttpError && error.status === UNAUTHORIZED_STATUS) {
+				if (await tryRefreshCredential()) {
+					const retried = prepare(path, opts);
+					return {
+						response: await executeRaw(retried),
+						prepared: retried
+					};
+				}
+			}
+			throw error;
+		}
+	}
 	function prepare(path, opts = {}) {
 		const method = opts.method ?? "GET";
 		const expectContentType = opts.expectContentType ?? "json";
 		const url = buildUrl(config.url, path, opts.query);
 		const headers = new Headers();
-		headers.set("x-api-key", config.apiKey);
+		const auth = credentialAuthHeader(credential);
+		headers.set(auth.name, auth.value);
 		headers.set("accept", acceptHeader(expectContentType));
 		headers.set("user-agent", USER_AGENT);
 		let body = null;
@@ -709,14 +946,13 @@ function createClient(config, overrides = {}) {
 	}
 	return {
 		async requestRaw(path, opts) {
-			return executeRaw(prepare(path, opts));
+			return (await executeWithAuthRefresh(path, opts ?? {})).response;
 		},
 		async requestParsed(schema, path, opts) {
-			const prepared = prepare(path, {
+			const { response, prepared } = await executeWithAuthRefresh(path, {
 				...opts,
 				expectContentType: "json"
 			});
-			const response = await executeRaw(prepared);
 			const text = await response.text();
 			try {
 				return parseJson(text, schema, { source: prepared.url });
@@ -732,11 +968,10 @@ function createClient(config, overrides = {}) {
 			}
 		},
 		async requestStream(path, opts) {
-			const prepared = prepare(path, {
+			const { response, prepared } = await executeWithAuthRefresh(path, {
 				...opts,
 				expectContentType: opts?.expectContentType ?? "binary"
 			});
-			const response = await executeRaw(prepared);
 			if (!response.body) throw new NetworkError("Response had no body to stream", {
 				method: prepared.method,
 				url: prepared.url,
@@ -780,50 +1015,6 @@ function throwContentTypeMismatch(response, prepared, expected) {
 		overrideUserMessage: `Expected ${expected} response but got ${actual}`
 	});
 }
-const NETWORK_HINTS = {
-	ECONNREFUSED: (t) => `Connection refused by ${t.host} — is Metabase running and is the port correct?`,
-	ENOTFOUND: (t) => `Host not found: ${t.hostname} — check the URL.`,
-	EAI_AGAIN: (t) => `Could not resolve ${t.hostname} — check your network connection and the URL.`,
-	ECONNRESET: (t) => `Connection to ${t.host} was reset — the server may have closed it, or http/https may be mismatched.`,
-	ETIMEDOUT: (t) => `Connection to ${t.host} timed out — check the host, port, and your network.`
-};
-const TLS_ERROR_CODES = new Set([
-	"EPROTO",
-	"DEPTH_ZERO_SELF_SIGNED_CERT",
-	"SELF_SIGNED_CERT_IN_CHAIN",
-	"UNABLE_TO_VERIFY_LEAF_SIGNATURE",
-	"CERT_HAS_EXPIRED",
-	"ERR_TLS_CERT_ALTNAME_INVALID"
-]);
-function buildNetworkError(error, method, url) {
-	const fallback = errorMessage(error);
-	const code = causeCode(error);
-	const target = networkTarget(url);
-	return new NetworkError(networkMessage(code, target, fallback), {
-		method,
-		url,
-		cause: code ?? fallback
-	});
-}
-function networkMessage(code, target, fallback) {
-	if (code === null) return `Could not reach Metabase: ${fallback}`;
-	if (TLS_ERROR_CODES.has(code)) return `Could not reach Metabase: TLS error contacting ${target.host} (${code}) — the certificate could not be verified, or https:// was used against a plain-HTTP server.`;
-	const hint = NETWORK_HINTS[code];
-	if (hint === void 0) return `Could not reach Metabase: ${fallback} (${code})`;
-	return `Could not reach Metabase: ${hint(target)}`;
-}
-function causeCode(error) {
-	const cause = error instanceof Error ? error.cause : void 0;
-	if (cause instanceof Error && "code" in cause && typeof cause.code === "string") return cause.code;
-	return null;
-}
-function networkTarget(url) {
-	const parsed = new URL(url);
-	return {
-		host: parsed.host,
-		hostname: parsed.hostname
-	};
-}
 async function readBodyForError(response) {
 	try {
 		const buffer = Buffer.from(await response.arrayBuffer());
@@ -856,52 +1047,302 @@ function normalizeUrl(input) {
 	if (!/^https?:\/\//i.test(trimmed)) throw new ConfigError("URL must start with http:// or https://");
 	return trimmed;
 }
-function originOnly(input) {
+function displayUrl(input) {
 	const parsed = new URL(input);
-	parsed.username = "";
-	parsed.password = "";
-	return parsed.origin;
+	const path = parsed.pathname.replace(/\/+$/, "");
+	return `${parsed.origin}${path}`;
+}
+const LOOPBACK_HOSTS = new Set([
+	"localhost",
+	"127.0.0.1",
+	"::1",
+	"[::1]"
+]);
+function isLoopbackHost(hostname) {
+	return LOOPBACK_HOSTS.has(hostname.toLowerCase());
+}
+function assertEndpointOrigin(endpoint, baseUrl, label) {
+	let parsed;
+	try {
+		parsed = new URL(endpoint);
+	} catch {
+		throw new ConfigError(`OAuth ${label} is not a valid URL: ${endpoint}`);
+	}
+	const base = new URL(baseUrl);
+	if (parsed.protocol !== "https:" && !isLoopbackHost(parsed.hostname)) throw new ConfigError(`OAuth ${label} must use https: ${endpoint}`);
+	if (parsed.origin !== base.origin) throw new ConfigError(`OAuth ${label} origin (${parsed.origin}) does not match the Metabase URL (${base.origin})`);
+}
+
+//#endregion
+//#region src/core/http/oauth.ts
+const DISCOVERY_PATH = "/.well-known/oauth-authorization-server";
+const FORM_CONTENT_TYPE = "application/x-www-form-urlencoded";
+const OAUTH_TIMEOUT_MS = 3e4;
+async function oauthFetch(request) {
+	const timeoutSignal = AbortSignal.timeout(OAUTH_TIMEOUT_MS);
+	try {
+		return await fetch(request.url, {
+			method: request.method,
+			headers: {
+				...request.headers,
+				"user-agent": USER_AGENT
+			},
+			...request.body !== void 0 ? { body: request.body } : {},
+			signal: timeoutSignal
+		});
+	} catch (error) {
+		if (timeoutSignal.aborted) throw new TimeoutError(`OAuth request timed out after ${OAUTH_TIMEOUT_MS}ms`, {
+			kind: "http",
+			method: request.method,
+			url: request.url,
+			timeoutMs: OAUTH_TIMEOUT_MS
+		});
+		throw buildNetworkError(error, request.method, request.url);
+	}
+}
+const OAUTH_SCOPE = "mb:full";
+const OAuthServerMetadata = z.object({
+	issuer: z.string(),
+	authorization_endpoint: z.string(),
+	token_endpoint: z.string(),
+	registration_endpoint: z.string().optional(),
+	revocation_endpoint: z.string().optional(),
+	scopes_supported: z.array(z.string()).optional()
+}).loose();
+const RegisteredClient = z.object({ client_id: z.string() }).loose();
+const OAuthTokens = z.object({
+	access_token: z.string(),
+	token_type: z.string(),
+	expires_in: z.number().int().optional(),
+	refresh_token: z.string().optional()
+}).loose();
+const OAuthErrorBody = z.object({
+	error: z.string(),
+	error_description: z.string().optional()
+}).loose();
+async function readJson(response, schema, source) {
+	let raw;
+	try {
+		raw = await response.json();
+	} catch (error) {
+		throw new ConfigError(`${source}: invalid JSON response (${errorMessage(error)})`);
+	}
+	const parsed = schema.safeParse(raw);
+	if (!parsed.success) throw new ConfigError(`${source}: unexpected response shape`);
+	return parsed.data;
+}
+async function failure(response, source, method, url) {
+	const rawBody = await response.text().catch(() => "");
+	if (isRetryableStatus(response.status)) return new HttpError({
+		status: response.status,
+		statusText: response.statusText,
+		method,
+		url,
+		responseHeaders: response.headers,
+		rawBody
+	});
+	const parsed = parseJsonResult(rawBody, OAuthErrorBody);
+	if (parsed.ok) {
+		const detail = parsed.value.error_description ?? parsed.value.error;
+		return new ConfigError(`${source} failed (${response.status}): ${detail}`);
+	}
+	return new ConfigError(`${source} failed (${response.status})`);
+}
+async function postForm(url, params, schema, source) {
+	const response = await oauthFetch({
+		url,
+		method: "POST",
+		headers: {
+			"content-type": FORM_CONTENT_TYPE,
+			accept: JSON_CONTENT_TYPE
+		},
+		body: new URLSearchParams(params)
+	});
+	if (!response.ok) throw await failure(response, source, "POST", url);
+	return readJson(response, schema, source);
+}
+const OAUTH_UNSUPPORTED_MESSAGE = "this Metabase does not support OAuth login (requires Metabase v63 or newer)";
+async function tryDiscoverMetadata(baseUrl) {
+	const url = `${baseUrl}${DISCOVERY_PATH}`;
+	const response = await oauthFetch({
+		url,
+		method: "GET",
+		headers: { accept: JSON_CONTENT_TYPE }
+	});
+	const contentType = response.headers.get("content-type") ?? "";
+	if (!response.ok || !contentType.includes("json")) {
+		await response.body?.cancel().catch(() => void 0);
+		return null;
+	}
+	const metadata = await readJson(response, OAuthServerMetadata, "OAuth discovery");
+	const scopes = metadata.scopes_supported;
+	if (scopes !== void 0 && !scopes.includes(OAUTH_SCOPE)) return null;
+	assertEndpointOrigin(metadata.issuer, baseUrl, "issuer");
+	assertEndpointOrigin(metadata.authorization_endpoint, baseUrl, "authorization endpoint");
+	assertEndpointOrigin(metadata.token_endpoint, baseUrl, "token endpoint");
+	if (metadata.registration_endpoint !== void 0) assertEndpointOrigin(metadata.registration_endpoint, baseUrl, "registration endpoint");
+	if (metadata.revocation_endpoint !== void 0) assertEndpointOrigin(metadata.revocation_endpoint, baseUrl, "revocation endpoint");
+	return metadata;
+}
+async function discoverMetadata(baseUrl) {
+	const metadata = await tryDiscoverMetadata(baseUrl);
+	if (metadata === null) throw new ConfigError(OAUTH_UNSUPPORTED_MESSAGE);
+	return metadata;
+}
+async function registerClient(input) {
+	const response = await oauthFetch({
+		url: input.registrationEndpoint,
+		method: "POST",
+		headers: {
+			"content-type": JSON_CONTENT_TYPE,
+			accept: JSON_CONTENT_TYPE
+		},
+		body: JSON.stringify({
+			application_type: "native",
+			client_name: input.clientName,
+			redirect_uris: [input.redirectUri],
+			grant_types: ["authorization_code", "refresh_token"],
+			response_types: ["code"],
+			token_endpoint_auth_method: "none",
+			scope: OAUTH_SCOPE
+		})
+	});
+	if (!response.ok) throw await failure(response, "OAuth client registration", "POST", input.registrationEndpoint);
+	return readJson(response, RegisteredClient, "OAuth client registration");
+}
+function exchangeCode(input) {
+	return postForm(input.tokenEndpoint, {
+		grant_type: "authorization_code",
+		code: input.code,
+		redirect_uri: input.redirectUri,
+		client_id: input.clientId,
+		code_verifier: input.codeVerifier
+	}, OAuthTokens, "OAuth token exchange");
+}
+function refreshTokens(input) {
+	return postForm(input.tokenEndpoint, {
+		grant_type: "refresh_token",
+		refresh_token: input.refreshToken,
+		client_id: input.clientId
+	}, OAuthTokens, "OAuth token refresh");
+}
+async function revokeToken(input) {
+	const response = await oauthFetch({
+		url: input.revocationEndpoint,
+		method: "POST",
+		headers: { "content-type": FORM_CONTENT_TYPE },
+		body: new URLSearchParams({
+			token: input.token,
+			client_id: input.clientId
+		})
+	});
+	if (!response.ok) throw await failure(response, "OAuth token revocation", "POST", input.revocationEndpoint);
+	await response.body?.cancel().catch(() => void 0);
+}
+
+//#endregion
+//#region src/core/auth/oauth-session.ts
+async function refreshOAuthCredential(baseUrl, credential, nowMs) {
+	const metadata = await discoverMetadata(baseUrl);
+	const tokens = await refreshTokens({
+		tokenEndpoint: metadata.token_endpoint,
+		refreshToken: credential.refreshToken,
+		clientId: credential.clientId
+	});
+	return oauthCredentialFromTokens(tokens, tokens.refresh_token ?? credential.refreshToken, credential.clientId, nowMs);
+}
+async function revokeOAuthCredential(baseUrl, credential) {
+	const metadata = await discoverMetadata(baseUrl);
+	const revocationEndpoint = metadata.revocation_endpoint;
+	if (revocationEndpoint === void 0) return false;
+	await revokeToken({
+		revocationEndpoint,
+		token: credential.refreshToken,
+		clientId: credential.clientId
+	});
+	await revokeToken({
+		revocationEndpoint,
+		token: credential.accessToken,
+		clientId: credential.clientId
+	});
+	return true;
 }
 
 //#endregion
 //#region src/core/config.ts
-const ENV_URL = "METABASE_URL";
-const ENV_API_KEY = "METABASE_API_KEY";
-const ENV_PROFILE = "METABASE_PROFILE";
-const ENV_SKIP_PREFLIGHT = "METABASE_CLI_SKIP_PREFLIGHT";
 function isPreflightSkipped() {
-	return process.env[ENV_SKIP_PREFLIGHT] === "1";
+	return readEnv(ENV_SKIP_PREFLIGHT) === "1";
 }
 function resolveProfileName(profileFlag) {
 	return explicitProfileName(profileFlag) ?? DEFAULT_PROFILE;
 }
 function explicitProfileName(profileFlag) {
-	return profileFlag || process.env[ENV_PROFILE] || null;
+	return profileFlag || readEnv(ENV_PROFILE) || null;
 }
 function readEnvCredentials() {
 	return {
-		url: process.env[ENV_URL] ?? null,
-		apiKey: process.env[ENV_API_KEY] ?? null
+		url: readEnv(ENV_URL) ?? null,
+		apiKey: readEnv(ENV_API_KEY) ?? null
 	};
 }
 async function resolveConfig(flags) {
 	const profile = resolveProfileName(flags.profile);
 	const env = readEnvCredentials();
-	const flagUrl = flags.url;
-	const flagKey = flags.apiKey;
-	const needsStored = !flagUrl && !env.url || !flagKey && !env.apiKey;
-	const stored = needsStored ? await readProfile(profile) : null;
-	const urlField = pickField(flagUrl, env.url, stored?.url);
-	const keyField = pickField(flagKey, env.apiKey, stored?.apiKey);
-	if (urlField === null || keyField === null) {
+	const hasUrl = Boolean(flags.url ?? env.url);
+	const hasKey = Boolean(flags.apiKey ?? env.apiKey);
+	const stored = hasUrl && hasKey ? null : await readProfileCredential(profile);
+	const url = resolveUrl(flags.url, env.url, stored?.url);
+	const credential = resolveCredential(flags.apiKey, env.apiKey, stored?.credential);
+	if (url === null || credential === null) {
 		const hint = await failureHintForProfile(profile);
 		throw new ConfigError(`Not authenticated for profile "${profile}". Run \`mb auth login\`, set ${ENV_URL}/${ENV_API_KEY}, or pass --url/--api-key.${hint}`);
 	}
+	const normalizedUrl = normalizeUrl(url.value);
+	assertOAuthUrlMatchesIssuer(credential.credential, stored?.url, normalizedUrl, profile);
+	const fresh = await ensureFreshCredential(profile, credential.credential, stored?.url);
 	return {
-		url: normalizeUrl(urlField.value),
-		apiKey: keyField.value,
+		url: normalizedUrl,
+		credential: fresh,
 		profile,
-		source: urlField.source === keyField.source ? urlField.source : "mixed"
+		source: url.source === credential.source ? url.source : "mixed"
+	};
+}
+function assertOAuthUrlMatchesIssuer(credential, issuerUrl, requestUrl, profile) {
+	if (credential.kind !== "oauth" || issuerUrl === void 0) return;
+	const issuer = normalizeUrl(issuerUrl);
+	if (issuer === requestUrl) return;
+	throw new ConfigError(`profile "${profile}" is a browser-login (OAuth) profile bound to ${issuer}, but the request URL is ${requestUrl}. Drop --url/${ENV_URL} to use the profile's own URL, or run \`mb auth login --url ${requestUrl}\` to authenticate there.`);
+}
+async function ensureFreshCredential(profile, credential, issuerUrl) {
+	if (credential.kind !== "oauth" || issuerUrl === void 0) return credential;
+	if (!isOAuthExpired(credential, Date.now())) return credential;
+	let refreshed;
+	try {
+		refreshed = await refreshOAuthCredential(issuerUrl, credential, Date.now());
+	} catch {
+		return credential;
+	}
+	await persistRefreshed(profile, issuerUrl, refreshed);
+	return refreshed;
+}
+async function refreshAndPersist(profile, issuerUrl, credential) {
+	const refreshed = await refreshOAuthCredential(issuerUrl, credential, Date.now());
+	await persistRefreshed(profile, issuerUrl, refreshed);
+	return refreshed;
+}
+async function persistRefreshed(profile, issuerUrl, refreshed) {
+	await writeOAuthProfile(issuerUrl, refreshed, profile);
+}
+function createCredentialRefresher(profile) {
+	return async () => {
+		const stored = await readProfileCredential(profile);
+		if (stored === null || stored.credential.kind !== "oauth") return null;
+		try {
+			return await refreshAndPersist(profile, stored.url, stored.credential);
+		} catch (error) {
+			if (error instanceof ConfigError) throw new ConfigError(`${error.message} — run \`mb auth login --profile ${profile}\` to log in again`);
+			throw error;
+		}
 	};
 }
 async function failureHintForProfile(profile) {
@@ -910,7 +1351,7 @@ async function failureHintForProfile(profile) {
 	if (record.lastProbe !== null && record.lastProbe.at >= record.lastFailure.at) return "";
 	return ` profile "${profile}" last verify failed: ${record.lastFailure.reason}. Run \`mb auth login --profile ${profile}\` to update the token.`;
 }
-function pickField(flag, env, stored) {
+function resolveUrl(flag, env, stored) {
 	if (flag) return {
 		value: flag,
 		source: "flag"
@@ -925,6 +1366,27 @@ function pickField(flag, env, stored) {
 	};
 	return null;
 }
+function resolveCredential(flagKey, envKey, stored) {
+	if (flagKey) return {
+		credential: {
+			kind: "apiKey",
+			apiKey: flagKey
+		},
+		source: "flag"
+	};
+	if (envKey) return {
+		credential: {
+			kind: "apiKey",
+			apiKey: envKey
+		},
+		source: "env"
+	};
+	if (stored) return {
+		credential: stored,
+		source: "stored"
+	};
+	return null;
+}
 
 //#endregion
 //#region src/core/version/capabilities.ts
@@ -961,10 +1423,10 @@ var CapabilityError = class extends MetabaseError {
 	isRetryable = false;
 	exitCode = 2;
 	developerDetail;
-	constructor(failure) {
-		super(failure.detail);
+	constructor(failure$1) {
+		super(failure$1.detail);
 		this.name = "CapabilityError";
-		this.developerDetail = failure;
+		this.developerDetail = failure$1;
 	}
 };
 
@@ -1132,8 +1594,11 @@ function defineMetabaseCommand(def) {
 						const resolved = await getResolvedConfig();
 						cachedClient = createClient({
 							url: resolved.url,
-							apiKey: resolved.apiKey
-						}, { getServerTag: async () => (await getServerInfo())?.version?.tag ?? null });
+							credential: resolved.credential
+						}, {
+							getServerTag: async () => (await getServerInfo())?.version?.tag ?? null,
+							refreshCredential: createCredentialRefresher(resolved.profile)
+						});
 					}
 					return cachedClient;
 				};
@@ -1152,7 +1617,7 @@ function defineMetabaseCommand(def) {
 						getServerInfo
 					});
 				} finally {
-					emitLegacyStorageWarningIfPending();
+					emitPendingWarnings();
 				}
 			} catch (error) {
 				reportError(error, reportFormat);
@@ -1167,9 +1632,12 @@ function defineMetabaseCommand(def) {
 	});
 	return cmd;
 }
-function emitLegacyStorageWarningIfPending() {
-	const message = consumeLegacyStorageWarning();
-	if (message !== null) warn(message);
+function emitPendingWarnings() {
+	for (const message of consumeLegacyEnvWarnings()) warn(message);
+	const legacy = consumeLegacyStorageWarning();
+	if (legacy !== null) warn(legacy);
+	const downgrade = consumeKeyringDowngradeWarning();
+	if (downgrade !== null) warn(downgrade);
 }
 async function loadServerInfo(getResolvedConfig) {
 	const resolved = await getResolvedConfig();
@@ -1193,9 +1661,9 @@ function createPreflightEnforcer(required, getServerInfo, skip) {
 			warn(NO_PROBE_DATA_WARNING);
 			return;
 		}
-		const failure = checkCapabilities(info, required);
-		if (failure === null || failure.reason === "unknown-version") return;
-		throw new CapabilityError(failure);
+		const failure$1 = checkCapabilities(info, required);
+		if (failure$1 === null || failure$1.reason === "unknown-version") return;
+		throw new CapabilityError(failure$1);
 	};
 }
 function isBaseline(caps) {
@@ -1223,4 +1691,4 @@ function buildConfigFlags(ctx) {
 }
 
 //#endregion
-export { DEFAULT_PROFILE, HttpError, ParsedVersionSchema, ProbedUser, ProfileLastFailure, TokenFeatures, USER_AGENT, clearProfile, combineAborts, createClient, defineMetabaseCommand, explicitProfileName, keyringFallbackWarning, listProfileRecords, normalizeUrl, originOnly, parseCsv, parseEnum, parseEnumCsv, parseInteger, parseJson, parseJsonOrPlain, probeServer, readEnvCredentials, readProfile, readProfileRecord, resolveProfileName, throwIfAborted, writeProbeFailure, writeProbeResult, writeProfile };
+export { DEFAULT_PROFILE, HttpError, OAUTH_SCOPE, ParsedVersionSchema, ProbedUser, ProfileAuthMethod, ProfileLastFailure, TokenFeatures, USER_AGENT, clearProfile, combineAborts, consumeKeychainResidualWarning, consumeKeyringDowngradeWarning, createClient, createCredentialRefresher, defineMetabaseCommand, discoverMetadata, displayUrl, exchangeCode, explicitProfileName, keyringFallbackWarning, listProfileRecords, normalizeUrl, oauthCredentialFromTokens, parseCsv, parseEnum, parseEnumCsv, parseInteger, parseJson, parseJsonOrPlain, probeServer, profileAuthMethod, readEnvCredentials, readProfileCredential, readProfileRecord, registerClient, resolveProfileName, resolveRecordCredential, revokeOAuthCredential, throwIfAborted, tryDiscoverMetadata, writeOAuthProfile, writeProbeFailure, writeProbeResult, writeProfile };