@metabase/cli 0.2.0 → 0.2.1-alpha.bcm-ghy-4075-spawn-default-profile.eb120d1

package/dist/{runtime-B-c-Fc2i.mjs → runtime-C6ASrgVA.mjs}

@@ -1,4 +1,4 @@
-import { AbortError, BASELINE_CAPABILITIES, ConfigError, DEFAULT_MAX_BYTES, ENV_API_KEY, ENV_DISABLE_KEYRING, ENV_PROFILE, ENV_SKIP_PREFLIGHT, ENV_URL, MetabaseError, NetworkError, ResponseShapeError, TimeoutError, ValidationError, consumeLegacyEnvWarnings, errorMessage, flagConsumesValue, isNotFoundError, isPlainObject, normalizeFlag, package_default, readEnv, reportError, toAliasArray, warn } from "./capabilities-DrDJo_ng.mjs";
+import { AbortError, BASELINE_CAPABILITIES, ConfigError, DEFAULT_MAX_BYTES, ENV_API_KEY, ENV_DISABLE_KEYRING, ENV_PROFILE, ENV_SKIP_PREFLIGHT, ENV_URL, MetabaseError, NetworkError, ResponseShapeError, TimeoutError, ValidationError, consumeLegacyEnvWarnings, errorMessage, flagConsumesValue, isNotFoundError, isPlainObject, normalizeFlag, package_default, readEnv, reportError, toAliasArray, warn } from "./capabilities-CiaAfUgX.mjs";
 import { setMetabaseAugment } from "./command-augment-D9pI9Vbh.mjs";
 import { defineCommand } from "citty";
 import { z } from "zod";
@@ -6,8 +6,8 @@ import { promises } from "node:fs";
 import { dirname, join } from "node:path";
 import { Entry } from "@napi-rs/keyring";
 import { homedir } from "node:os";
-import { parse } from "semver";
 import { setTimeout } from "node:timers/promises";
+import { parse } from "semver";
 
 //#region src/runtime/json.ts
 const JSON_CONTENT_TYPE = "application/json";
@@ -77,720 +77,372 @@ const SessionProperties = z.object({
 }).loose();
 
 //#endregion
-//#region src/core/version/tag.ts
-const ParsedVersionSchema = z.object({
-	tag: z.string(),
-	major: z.number().int().nonnegative(),
-	patch: z.number().int().nonnegative()
-});
-function tryParseTag(tag) {
-	const parsed = parse(tag);
-	if (parsed === null || parsed.major !== 0 && parsed.major !== 1) return null;
-	return {
-		tag,
-		major: parsed.minor,
-		patch: parsed.patch
-	};
+//#region src/core/url.ts
+function normalizeUrl(input) {
+	const trimmed = input.trim().replace(/\/+$/, "");
+	if (!/^https?:\/\//i.test(trimmed)) throw new ConfigError("URL must start with http:// or https://");
+	return trimmed;
 }
-
-//#endregion
-//#region src/core/auth/profile-record.ts
-const ProbedUser = z.object({
-	id: z.number().int(),
-	name: z.string(),
-	isAdmin: z.boolean()
-});
-const ProfileLastProbe = z.object({
-	at: z.iso.datetime(),
-	version: ParsedVersionSchema.nullable(),
-	tokenFeatures: TokenFeatures.nullable(),
-	user: ProbedUser
-});
-const ProfileFailureKind = z.enum([
-	"auth",
-	"network",
-	"server"
+function displayUrl(input) {
+	const parsed = new URL(input);
+	const path = parsed.pathname.replace(/\/+$/, "");
+	return `${parsed.origin}${path}`;
+}
+const LOOPBACK_HOSTS = new Set([
+	"localhost",
+	"127.0.0.1",
+	"::1",
+	"[::1]"
 ]);
-const ProfileLastFailure = z.object({
-	at: z.iso.datetime(),
-	kind: ProfileFailureKind,
-	reason: z.string()
-});
-const ProfileOAuth = z.object({
-	accessToken: z.string().nullable(),
-	refreshToken: z.string().nullable(),
-	expiresAt: z.iso.datetime(),
-	clientId: z.string()
-}).loose();
-const ProfileAuthMethod = z.enum(["oauth", "apiKey"]);
-const ProfileRecord = z.object({
-	name: z.string(),
-	url: z.string(),
-	apiKey: z.string().nullable(),
-	oauth: ProfileOAuth.nullable().default(null),
-	lastProbe: ProfileLastProbe.nullable(),
-	lastFailure: ProfileLastFailure.nullable()
-}).loose();
-const ProfilesFile = z.object({ profiles: z.array(ProfileRecord) }).loose();
-function profileAuthMethod(record) {
-	return record.oauth !== null ? "oauth" : "apiKey";
+function isLoopbackHost(hostname) {
+	return LOOPBACK_HOSTS.has(hostname.toLowerCase());
+}
+function assertEndpointOrigin(endpoint, baseUrl, label) {
+	let parsed;
+	try {
+		parsed = new URL(endpoint);
+	} catch {
+		throw new ConfigError(`OAuth ${label} is not a valid URL: ${endpoint}`);
+	}
+	const base = new URL(baseUrl);
+	if (parsed.protocol !== "https:" && !isLoopbackHost(parsed.hostname)) throw new ConfigError(`OAuth ${label} must use https: ${endpoint}`);
+	if (parsed.origin !== base.origin) throw new ConfigError(`OAuth ${label} origin (${parsed.origin}) does not match the Metabase URL (${base.origin})`);
 }
 
 //#endregion
-//#region src/core/auth/storage.ts
-const KEYRING_SERVICE = "metabase-cli";
-const PROFILES_FILE = "profiles.json";
-const LEGACY_CREDENTIALS_FILE = "credentials.json";
-const LEGACY_REJECTIONS_FILE = "rejections.json";
-const PROFILES_FILE_MODE = 384;
-const PROFILES_DIR_MODE = 448;
-const DEFAULT_PROFILE = "default";
-const LEGACY_STORAGE_NOTICE = "Old profile storage detected and ignored; re-run `mb auth login` for each profile.";
-const KEYCHAIN_RESIDUAL_NOTICE = "warning: could not remove one or more secrets from the OS keychain; a stored token may remain — remove it manually or retry.";
-const account = {
-	profileApiKey: (profile) => `profile:${profile}:apiKey`,
-	profileOAuthAccess: (profile) => `profile:${profile}:oauthAccess`,
-	profileOAuthRefresh: (profile) => `profile:${profile}:oauthRefresh`
-};
-let legacyWarningPending = false;
-let keychainResidualPending = false;
-let keyringDowngradeNotice = null;
-function profilesFilePath() {
-	return join(configDir(), PROFILES_FILE);
+//#region src/runtime/signal.ts
+function createProcessAbortHandler() {
+	const controller = new AbortController();
+	const handler = () => {
+		if (!controller.signal.aborted) controller.abort(new AbortError("interrupted"));
+		process.off("SIGINT", handler);
+	};
+	process.on("SIGINT", handler);
+	return {
+		signal: controller.signal,
+		uninstall: () => process.off("SIGINT", handler)
+	};
 }
-function consumeLegacyStorageWarning() {
-	if (!legacyWarningPending) return null;
-	legacyWarningPending = false;
-	return LEGACY_STORAGE_NOTICE;
+let singleton = null;
+function getProcessAbortSignal() {
+	if (singleton === null) singleton = createProcessAbortHandler().signal;
+	return singleton;
 }
-function consumeKeychainResidualWarning() {
-	if (!keychainResidualPending) return null;
-	keychainResidualPending = false;
-	return KEYCHAIN_RESIDUAL_NOTICE;
+function combineAborts(timeoutSignal, callerSignal) {
+	const processSignal = getProcessAbortSignal();
+	const signals = [timeoutSignal, processSignal];
+	if (callerSignal) signals.push(callerSignal);
+	return {
+		combined: AbortSignal.any(signals),
+		processSignal
+	};
 }
-function consumeKeyringDowngradeWarning() {
-	const message = keyringDowngradeNotice;
-	keyringDowngradeNotice = null;
-	return message;
+function throwIfAborted(...signals) {
+	for (const signal of signals) if (signal?.aborted) throw abortReason(signal);
 }
-function keyringEnabled() {
-	return readEnv(ENV_DISABLE_KEYRING) !== "1";
+function abortReason(signal) {
+	const reason = signal.reason;
+	if (reason instanceof MetabaseError) return reason;
+	if (reason instanceof Error || typeof reason === "string") return new AbortError(errorMessage(reason) || "aborted");
+	return new AbortError("aborted");
 }
-function trySetKeyring(key, value) {
-	if (!keyringEnabled()) return false;
-	try {
-		new Entry(KEYRING_SERVICE, key).setPassword(value);
-		return true;
-	} catch {
-		return false;
-	}
+
+//#endregion
+//#region src/core/auth/credential.ts
+const API_KEY_HEADER = "x-api-key";
+const AUTHORIZATION_HEADER = "authorization";
+const BEARER_PREFIX = "Bearer ";
+const EXPIRY_SKEW_MS = 6e4;
+const DEFAULT_EXPIRES_IN_SECONDS = 3600;
+function credentialAuthHeader(credential) {
+	if (credential.kind === "apiKey") return {
+		name: API_KEY_HEADER,
+		value: credential.apiKey
+	};
+	return {
+		name: AUTHORIZATION_HEADER,
+		value: BEARER_PREFIX + credential.accessToken
+	};
 }
-function tryReadKeyring(key) {
-	if (!keyringEnabled()) return void 0;
-	try {
-		return new Entry(KEYRING_SERVICE, key).getPassword();
-	} catch {
-		return void 0;
-	}
+function credentialSecrets(credential) {
+	if (credential.kind === "apiKey") return [credential.apiKey];
+	return [credential.accessToken, credential.refreshToken];
 }
-function removeKeyringEntry(key) {
-	if (!keyringEnabled()) return "skipped";
-	try {
-		return new Entry(KEYRING_SERVICE, key).deletePassword() ? "removed" : "absent";
-	} catch {
-		return "failed";
-	}
+function isOAuthExpired(credential, nowMs) {
+	const expiryMs = Date.parse(credential.expiresAt);
+	if (Number.isNaN(expiryMs)) return true;
+	return expiryMs - EXPIRY_SKEW_MS <= nowMs;
 }
-async function readProfilesFile() {
-	const path = profilesFilePath();
-	let raw;
-	try {
-		raw = await promises.readFile(path, "utf8");
-	} catch (error) {
-		if (isNotFoundError(error)) {
-			await detectLegacyArtifacts();
-			return { profiles: [] };
-		}
-		throw error;
-	}
-	const parsed = parseJsonResult(raw, ProfilesFile, { source: path });
-	if (parsed.ok) return parsed.value;
-	if (parsed.error instanceof ValidationError) {
-		legacyWarningPending = true;
-		return { profiles: [] };
-	}
-	throw parsed.error;
+function expiresAtFromNow(expiresInSeconds, nowMs) {
+	return new Date(nowMs + expiresInSeconds * 1e3).toISOString();
 }
-async function detectLegacyArtifacts() {
-	const legacyCredentials = join(configDir(), LEGACY_CREDENTIALS_FILE);
-	const legacyRejections = join(configDir(), LEGACY_REJECTIONS_FILE);
-	const [credentialsExists, rejectionsExists] = await Promise.all([fileExists(legacyCredentials), fileExists(legacyRejections)]);
-	if (credentialsExists || rejectionsExists) legacyWarningPending = true;
+function oauthCredentialFromTokens(tokens, refreshToken, clientId, scope, nowMs) {
+	return {
+		kind: "oauth",
+		accessToken: tokens.access_token,
+		refreshToken,
+		expiresAt: expiresAtFromNow(tokens.expires_in ?? DEFAULT_EXPIRES_IN_SECONDS, nowMs),
+		clientId,
+		scope
+	};
 }
-async function fileExists(path) {
-	try {
-		await promises.access(path);
-		return true;
-	} catch {
-		return false;
+
+//#endregion
+//#region src/core/http/sanitize.ts
+const SECRET_HEADER_NAMES = new Set([
+	"authorization",
+	"x-api-key",
+	"x-metabase-session",
+	"cookie",
+	"set-cookie",
+	"proxy-authorization"
+]);
+const REDACTED = "[REDACTED]";
+function redactHeaders(headers) {
+	const result = {};
+	const entries = headers instanceof Headers ? headers.entries() : Object.entries(headers);
+	for (const [key, value] of entries) result[key] = SECRET_HEADER_NAMES.has(key.toLowerCase()) ? REDACTED : value;
+	return result;
+}
+function redactBody(body, ctx) {
+	let result = body;
+	for (const secret of ctx.knownSecrets) {
+		if (secret.length === 0) continue;
+		result = result.replaceAll(secret, REDACTED);
 	}
+	return result;
 }
-async function writeProfilesFile(file) {
-	const path = profilesFilePath();
-	if (file.profiles.length === 0) {
-		await promises.unlink(path).catch(() => void 0);
-		await cleanupLegacyFiles();
-		return;
+
+//#endregion
+//#region src/core/http/errors.ts
+const ROUTE_MISSING_LITERAL = "API endpoint does not exist.";
+const RESOURCE_MISSING_LITERAL = "Not found.";
+const STATUS_CLASSIFICATIONS = {
+	401: { retryable: false },
+	403: { retryable: false },
+	404: { retryable: false },
+	408: {
+		retryable: true,
+		message: "Metabase timed out responding."
+	},
+	425: { retryable: true },
+	429: {
+		retryable: true,
+		message: "Metabase rate-limited the request."
+	},
+	500: { retryable: true },
+	502: { retryable: true },
+	503: { retryable: true },
+	504: {
+		retryable: true,
+		message: "Metabase timed out responding."
 	}
-	await promises.mkdir(dirname(path), {
-		recursive: true,
-		mode: PROFILES_DIR_MODE
-	});
-	const tmpPath = `${path}.${process.pid}.tmp`;
-	await promises.writeFile(tmpPath, JSON.stringify(file, null, 2) + "\n", { mode: PROFILES_FILE_MODE });
-	if (process.platform !== "win32") await promises.chmod(tmpPath, PROFILES_FILE_MODE);
-	try {
-		await promises.rename(tmpPath, path);
-	} catch (error) {
-		await promises.unlink(tmpPath).catch(() => void 0);
-		throw error;
+};
+const ErrorEnvelope = z.object({
+	message: z.string().optional(),
+	error: z.string().optional(),
+	"error-message": z.string().optional(),
+	via: z.array(z.object({ message: z.string().optional() }).loose()).optional(),
+	"specific-errors": z.unknown().optional(),
+	errors: z.unknown().optional()
+}).loose();
+const MAX_EXTRACTED_MESSAGE_LEN = 500;
+const ELLIPSIS = "…";
+var HttpError = class extends MetabaseError {
+	category = "http";
+	exitCode = 1;
+	status;
+	kind;
+	developerDetail;
+	constructor(input) {
+		const sanitizedBody = sanitizeBody(input.rawBody, input.redactionContext);
+		const redactedHeaders = redactHeaders(input.responseHeaders);
+		const kind = classifyKind(input.status, sanitizedBody, redactedHeaders);
+		super(input.overrideUserMessage ?? buildUserMessage(kind, input, sanitizedBody));
+		this.name = "HttpError";
+		this.status = input.status;
+		this.kind = kind;
+		this.developerDetail = {
+			status: input.status,
+			statusText: input.statusText,
+			method: input.method,
+			url: input.url,
+			responseHeaders: redactedHeaders,
+			body: sanitizedBody
+		};
 	}
-	await cleanupLegacyFiles();
+	get isRetryable() {
+		return isRetryableStatus(this.status);
+	}
+};
+function isRetryableStatus(status) {
+	return STATUS_CLASSIFICATIONS[status]?.retryable === true;
 }
-async function cleanupLegacyFiles() {
-	await Promise.all([promises.unlink(join(configDir(), LEGACY_CREDENTIALS_FILE)).catch(() => void 0), promises.unlink(join(configDir(), LEGACY_REJECTIONS_FILE)).catch(() => void 0)]);
+function sanitizeBody(rawBody, ctx) {
+	if (rawBody === null) return null;
+	if (ctx === void 0) return rawBody;
+	return redactBody(rawBody, ctx);
 }
-function findRecord(file, name) {
-	return file.profiles.find((entry) => entry.name === name) ?? null;
+function classifyKind(status, sanitizedBody, redactedHeaders) {
+	if (status === 401 || status === 403) return "auth";
+	if (status === 404) return isRouteMissingResponse(sanitizedBody, redactedHeaders) ? "route-missing" : "resource-missing";
+	if (status === 429) return "rate-limit";
+	if (status >= 500 && status < 600) return "server-error";
+	return "generic";
 }
-function sideIsKeyringBacked(record, side) {
-	return side === "oauth" ? record.oauth !== null && record.oauth.accessToken === null : record.oauth === null && record.apiKey === null;
+function isRouteMissingResponse(sanitizedBody, redactedHeaders) {
+	if (sanitizedBody?.includes(ROUTE_MISSING_LITERAL)) return true;
+	if (sanitizedBody?.includes(RESOURCE_MISSING_LITERAL)) return false;
+	if (redactedHeaders["content-type"]?.includes(JSON_CONTENT_TYPE)) return false;
+	if (sanitizedBody === null || sanitizedBody.trim() === "") return true;
+	return !parseJsonResult(sanitizedBody, ErrorEnvelope).ok;
 }
-function flagResidualIfUnconfirmed(existing, cleared, removals) {
-	if (existing === null || !removals.includes("failed")) return;
-	if (sideIsKeyringBacked(existing, cleared)) keychainResidualPending = true;
+function buildUserMessage(kind, input, sanitizedBody) {
+	if (kind === "route-missing") return buildRouteMissingMessage(input);
+	if (kind === "resource-missing") return `Not found: ${input.method} ${pathFromUrl(input.url)}.`;
+	const fromBody = parseEnvelopeMessage(sanitizedBody);
+	if (fromBody !== null) return fromBody;
+	if (kind === "auth") return `Invalid or unauthorized API key (host: ${hostFromUrl(input.url)}).`;
+	return defaultMessageForStatus(input.status);
 }
-function fileLocation(key) {
-	return {
-		backend: "file",
-		path: profilesFilePath(),
-		account: key,
-		reason: keyringEnabled() ? "unavailable" : "disabled"
-	};
+function buildRouteMissingMessage(input) {
+	const path = pathFromUrl(input.url);
+	if (!input.serverTag) return `This endpoint is not available on the connected Metabase: ${input.method} ${path}.`;
+	return `This endpoint is not available on Metabase ${input.serverTag}: ${input.method} ${path}. The command may require a newer Metabase major version. Run 'mb auth list' to see this server's version.`;
 }
-function keyringFallbackWarning(location) {
-	const cause = location.reason === "disabled" ? `OS keychain disabled via ${ENV_DISABLE_KEYRING}` : "OS keychain unavailable";
-	return `warning: ${cause}; credentials stored as plaintext at ${location.path}`;
+function pathFromUrl(url) {
+	const parsed = new URL(url);
+	return parsed.pathname + parsed.search;
 }
-function persistSecret(key, value) {
-	if (trySetKeyring(key, value)) return {
-		backend: "keyring",
-		service: KEYRING_SERVICE,
-		account: key
-	};
-	removeKeyringEntry(key);
-	return fileLocation(key);
+function hostFromUrl(url) {
+	return new URL(url).host;
 }
-function resolveSecret(key, inline) {
-	if (inline !== null) return inline;
-	return tryReadKeyring(key) ?? null;
+function parseEnvelopeMessage(sanitizedBody) {
+	if (!sanitizedBody) return null;
+	const result = parseJsonResult(sanitizedBody, ErrorEnvelope);
+	if (!result.ok) return null;
+	const envelope = result.value;
+	const topLevel = envelope.message ?? envelope.error ?? envelope["error-message"];
+	if (topLevel) return capLength(topLevel);
+	const viaMessage = envelope.via?.find((entry) => entry.message)?.message;
+	if (viaMessage) return capLength(viaMessage);
+	const specific = formatErrorTree(envelope["specific-errors"]);
+	if (specific) return capLength(specific);
+	const generic = formatErrorTree(envelope.errors);
+	if (generic) return capLength(generic);
+	return null;
 }
-async function readProfileCredential(name = DEFAULT_PROFILE) {
-	const file = await readProfilesFile();
-	const record = findRecord(file, name);
-	if (record === null) return null;
-	return resolveRecordCredential(record);
+function formatErrorTree(value) {
+	const entries = collectLeafEntries(value, []);
+	if (entries.length === 0) return null;
+	return entries.map(formatLeafEntry).join("; ");
 }
-function resolveRecordCredential(record) {
-	if (record.oauth !== null) {
-		const accessToken = resolveSecret(account.profileOAuthAccess(record.name), record.oauth.accessToken);
-		const refreshToken = resolveSecret(account.profileOAuthRefresh(record.name), record.oauth.refreshToken);
-		if (accessToken === null || refreshToken === null) return null;
-		return {
-			url: record.url,
-			credential: {
-				kind: "oauth",
-				accessToken,
-				refreshToken,
-				expiresAt: record.oauth.expiresAt,
-				clientId: record.oauth.clientId
-			}
-		};
+function formatLeafEntry(entry) {
+	return entry.path === "" ? entry.message : `${entry.path}: ${entry.message}`;
+}
+function collectLeafEntries(value, path) {
+	if (typeof value === "string") {
+		const trimmed = value.trim();
+		return trimmed === "" ? [] : [{
+			path: path.join("."),
+			message: trimmed
+		}];
 	}
-	const apiKey = resolveSecret(account.profileApiKey(record.name), record.apiKey);
-	if (apiKey === null) return null;
-	return {
-		url: record.url,
-		credential: {
-			kind: "apiKey",
-			apiKey
-		}
-	};
+	if (Array.isArray(value)) {
+		const messages = value.filter((entry) => typeof entry === "string" && entry.trim() !== "");
+		if (messages.length === 0) return [];
+		return [{
+			path: path.join("."),
+			message: messages.join("; ")
+		}];
+	}
+	if (isPlainObject(value)) return Object.entries(value).flatMap(([key, child]) => collectLeafEntries(child, [...path, key]));
+	return [];
 }
-async function readProfileRecord(name = DEFAULT_PROFILE) {
-	const file = await readProfilesFile();
-	return findRecord(file, name);
+function capLength(message) {
+	if (message.length <= MAX_EXTRACTED_MESSAGE_LEN) return message;
+	return message.slice(0, MAX_EXTRACTED_MESSAGE_LEN - ELLIPSIS.length) + ELLIPSIS;
 }
-async function listProfileRecords() {
-	const file = await readProfilesFile();
-	return file.profiles;
+function defaultMessageForStatus(status) {
+	return STATUS_CLASSIFICATIONS[status]?.message ?? `Metabase returned ${status}.`;
 }
-async function upsertRecord(file, name, updated) {
-	const exists = findRecord(file, name) !== null;
-	const profiles = exists ? file.profiles.map((entry) => entry.name === name ? updated : entry) : [...file.profiles, updated];
-	await writeProfilesFile({
-		...file,
-		profiles
+
+//#endregion
+//#region src/core/http/network-error.ts
+const NETWORK_HINTS = {
+	ECONNREFUSED: (t) => `Connection refused by ${t.host} — is Metabase running and is the port correct?`,
+	ENOTFOUND: (t) => `Host not found: ${t.hostname} — check the URL.`,
+	EAI_AGAIN: (t) => `Could not resolve ${t.hostname} — check your network connection and the URL.`,
+	ECONNRESET: (t) => `Connection to ${t.host} was reset — the server may have closed it, or http/https may be mismatched.`,
+	ETIMEDOUT: (t) => `Connection to ${t.host} timed out — check the host, port, and your network.`
+};
+const TLS_ERROR_CODES = new Set([
+	"EPROTO",
+	"DEPTH_ZERO_SELF_SIGNED_CERT",
+	"SELF_SIGNED_CERT_IN_CHAIN",
+	"UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+	"CERT_HAS_EXPIRED",
+	"ERR_TLS_CERT_ALTNAME_INVALID"
+]);
+function buildNetworkError(error, method, url) {
+	const fallback = errorMessage(error);
+	const code = causeCode(error);
+	const target = networkTarget(url);
+	return new NetworkError(networkMessage(code, target, fallback), {
+		method,
+		url,
+		cause: code ?? fallback
 	});
 }
-async function writeProfile(profile, name = DEFAULT_PROFILE) {
-	const location = persistSecret(account.profileApiKey(name), profile.apiKey);
-	const inlineApiKey = location.backend === "file" ? profile.apiKey : null;
-	const file = await readProfilesFile();
-	const existing = findRecord(file, name);
-	flagResidualIfUnconfirmed(existing, "oauth", [removeKeyringEntry(account.profileOAuthAccess(name)), removeKeyringEntry(account.profileOAuthRefresh(name))]);
-	const updated = existing === null ? {
-		name,
-		url: profile.url,
-		apiKey: inlineApiKey,
-		oauth: null,
-		lastProbe: null,
-		lastFailure: null
-	} : {
-		...existing,
-		url: profile.url,
-		apiKey: inlineApiKey,
-		oauth: null
-	};
-	await upsertRecord(file, name, updated);
-	return location;
-}
-async function writeOAuthProfile(url, credential, name = DEFAULT_PROFILE) {
-	const accessKey = account.profileOAuthAccess(name);
-	const refreshKey = account.profileOAuthRefresh(name);
-	const accessLocation = persistSecret(accessKey, credential.accessToken);
-	const refreshLocation = persistSecret(refreshKey, credential.refreshToken);
-	const onFile = accessLocation.backend === "file" || refreshLocation.backend === "file";
-	const oauth = {
-		accessToken: onFile ? credential.accessToken : null,
-		refreshToken: onFile ? credential.refreshToken : null,
-		expiresAt: credential.expiresAt,
-		clientId: credential.clientId
-	};
-	const file = await readProfilesFile();
-	const existing = findRecord(file, name);
-	if (onFile && existing !== null && sideIsKeyringBacked(existing, "oauth")) keyringDowngradeNotice = keyringFallbackWarning(fileLocation(accessKey));
-	flagResidualIfUnconfirmed(existing, "apiKey", [removeKeyringEntry(account.profileApiKey(name))]);
-	const updated = existing === null ? {
-		name,
-		url,
-		apiKey: null,
-		oauth,
-		lastProbe: null,
-		lastFailure: null
-	} : {
-		...existing,
-		url,
-		apiKey: null,
-		oauth
-	};
-	await upsertRecord(file, name, updated);
-	return onFile ? fileLocation(accessKey) : {
-		backend: "keyring",
-		service: KEYRING_SERVICE,
-		account: accessKey
-	};
-}
-async function writeProbeResult(name, input) {
-	const probe = ProfileLastProbe.parse({
-		at: new Date().toISOString(),
-		version: input.server.version,
-		tokenFeatures: input.server.tokenFeatures,
-		user: input.user
-	});
-	const file = await readProfilesFile();
-	const existing = findRecord(file, name);
-	if (existing === null) return null;
-	const profiles = file.profiles.map((entry) => entry.name === name ? {
-		...entry,
-		lastProbe: probe,
-		lastFailure: null
-	} : entry);
-	await writeProfilesFile({
-		...file,
-		profiles
-	});
-	return probe;
-}
-async function writeProbeFailure(name, input) {
-	const failure$1 = ProfileLastFailure.parse({
-		at: new Date().toISOString(),
-		kind: input.kind,
-		reason: input.reason
-	});
-	const file = await readProfilesFile();
-	const existing = findRecord(file, name);
-	if (existing === null) return null;
-	const profiles = file.profiles.map((entry) => entry.name === name ? {
-		...entry,
-		lastFailure: failure$1
-	} : entry);
-	await writeProfilesFile({
-		...file,
-		profiles
-	});
-	return failure$1;
-}
-async function clearProfile(name = DEFAULT_PROFILE) {
-	const file = await readProfilesFile();
-	const existing = findRecord(file, name);
-	const removals = [
-		removeKeyringEntry(account.profileApiKey(name)),
-		removeKeyringEntry(account.profileOAuthAccess(name)),
-		removeKeyringEntry(account.profileOAuthRefresh(name))
-	];
-	if (existing !== null) flagResidualIfUnconfirmed(existing, existing.oauth !== null ? "oauth" : "apiKey", removals);
-	if (existing === null) return false;
-	await writeProfilesFile({
-		...file,
-		profiles: file.profiles.filter((entry) => entry.name !== name)
-	});
-	return true;
-}
-
-//#endregion
-//#region src/runtime/signal.ts
-function createProcessAbortHandler() {
-	const controller = new AbortController();
-	const handler = () => {
-		if (!controller.signal.aborted) controller.abort(new AbortError("interrupted"));
-		process.off("SIGINT", handler);
-	};
-	process.on("SIGINT", handler);
-	return {
-		signal: controller.signal,
-		uninstall: () => process.off("SIGINT", handler)
-	};
+function networkMessage(code, target, fallback) {
+	if (code === null) return `Could not reach Metabase: ${fallback}`;
+	if (TLS_ERROR_CODES.has(code)) return `Could not reach Metabase: TLS error contacting ${target.host} (${code}) — the certificate could not be verified, or https:// was used against a plain-HTTP server.`;
+	const hint = NETWORK_HINTS[code];
+	if (hint === void 0) return `Could not reach Metabase: ${fallback} (${code})`;
+	return `Could not reach Metabase: ${hint(target)}`;
 }
-let singleton = null;
-function getProcessAbortSignal() {
-	if (singleton === null) singleton = createProcessAbortHandler().signal;
-	return singleton;
+function causeCode(error) {
+	const cause = error instanceof Error ? error.cause : void 0;
+	if (cause instanceof Error && "code" in cause && typeof cause.code === "string") return cause.code;
+	return null;
 }
-function combineAborts(timeoutSignal, callerSignal) {
-	const processSignal = getProcessAbortSignal();
-	const signals = [timeoutSignal, processSignal];
-	if (callerSignal) signals.push(callerSignal);
+function networkTarget(url) {
+	const parsed = new URL(url);
 	return {
-		combined: AbortSignal.any(signals),
-		processSignal
+		host: parsed.host,
+		hostname: parsed.hostname
 	};
 }
-function throwIfAborted(...signals) {
-	for (const signal of signals) if (signal?.aborted) throw abortReason(signal);
-}
-function abortReason(signal) {
-	const reason = signal.reason;
-	if (reason instanceof MetabaseError) return reason;
-	if (reason instanceof Error || typeof reason === "string") return new AbortError(errorMessage(reason) || "aborted");
-	return new AbortError("aborted");
-}
 
 //#endregion
-//#region src/core/auth/credential.ts
-const API_KEY_HEADER = "x-api-key";
-const AUTHORIZATION_HEADER = "authorization";
-const BEARER_PREFIX = "Bearer ";
-const EXPIRY_SKEW_MS = 6e4;
-const DEFAULT_EXPIRES_IN_SECONDS = 3600;
-function credentialAuthHeader(credential) {
-	if (credential.kind === "apiKey") return {
-		name: API_KEY_HEADER,
-		value: credential.apiKey
-	};
-	return {
-		name: AUTHORIZATION_HEADER,
-		value: BEARER_PREFIX + credential.accessToken
-	};
-}
-function credentialSecrets(credential) {
-	if (credential.kind === "apiKey") return [credential.apiKey];
-	return [credential.accessToken, credential.refreshToken];
-}
-function isOAuthExpired(credential, nowMs) {
-	const expiryMs = Date.parse(credential.expiresAt);
-	if (Number.isNaN(expiryMs)) return true;
-	return expiryMs - EXPIRY_SKEW_MS <= nowMs;
-}
-function expiresAtFromNow(expiresInSeconds, nowMs) {
-	return new Date(nowMs + expiresInSeconds * 1e3).toISOString();
+//#region src/core/http/retry.ts
+const DEFAULT_MAX_RETRIES = 3;
+const BASE_DELAY_MS = 250;
+const MAX_DELAY_MS = 8e3;
+const MS_PER_SECOND = 1e3;
+function backoffDelay({ attempt, retryAfterHeader }) {
+	const fromHeader = parseRetryAfter(retryAfterHeader);
+	if (fromHeader !== null) return fromHeader;
+	return Math.min(MAX_DELAY_MS, BASE_DELAY_MS * 2 ** attempt);
 }
-function oauthCredentialFromTokens(tokens, refreshToken, clientId, nowMs) {
-	return {
-		kind: "oauth",
-		accessToken: tokens.access_token,
-		refreshToken,
-		expiresAt: expiresAtFromNow(tokens.expires_in ?? DEFAULT_EXPIRES_IN_SECONDS, nowMs),
-		clientId
-	};
+function parseRetryAfter(header) {
+	if (!header) return null;
+	const numeric = Number(header);
+	if (Number.isFinite(numeric) && numeric >= 0) return Math.round(numeric * MS_PER_SECOND);
+	const dateMs = Date.parse(header);
+	if (Number.isFinite(dateMs)) return Math.max(0, dateMs - Date.now());
+	return null;
 }
-
-//#endregion
-//#region src/core/http/sanitize.ts
-const SECRET_HEADER_NAMES = new Set([
-	"authorization",
-	"x-api-key",
-	"x-metabase-session",
-	"cookie",
-	"set-cookie",
-	"proxy-authorization"
-]);
-const REDACTED = "[REDACTED]";
-function redactHeaders(headers) {
-	const result = {};
-	const entries = headers instanceof Headers ? headers.entries() : Object.entries(headers);
-	for (const [key, value] of entries) result[key] = SECRET_HEADER_NAMES.has(key.toLowerCase()) ? REDACTED : value;
-	return result;
+function sleep(ms, signal) {
+	return setTimeout(ms, void 0, { signal });
 }
-function redactBody(body, ctx) {
-	let result = body;
-	for (const secret of ctx.knownSecrets) {
-		if (secret.length === 0) continue;
-		result = result.replaceAll(secret, REDACTED);
-	}
-	return result;
-}
-
-//#endregion
-//#region src/core/http/errors.ts
-const ROUTE_MISSING_LITERAL = "API endpoint does not exist.";
-const RESOURCE_MISSING_LITERAL = "Not found.";
-const STATUS_CLASSIFICATIONS = {
-	401: { retryable: false },
-	403: { retryable: false },
-	404: { retryable: false },
-	408: {
-		retryable: true,
-		message: "Metabase timed out responding."
-	},
-	425: { retryable: true },
-	429: {
-		retryable: true,
-		message: "Metabase rate-limited the request."
-	},
-	500: { retryable: true },
-	502: { retryable: true },
-	503: { retryable: true },
-	504: {
-		retryable: true,
-		message: "Metabase timed out responding."
-	}
-};
-const ErrorEnvelope = z.object({
-	message: z.string().optional(),
-	error: z.string().optional(),
-	"error-message": z.string().optional(),
-	via: z.array(z.object({ message: z.string().optional() }).loose()).optional(),
-	"specific-errors": z.unknown().optional(),
-	errors: z.unknown().optional()
-}).loose();
-const MAX_EXTRACTED_MESSAGE_LEN = 500;
-const ELLIPSIS = "…";
-var HttpError = class extends MetabaseError {
-	category = "http";
-	exitCode = 1;
-	status;
-	kind;
-	developerDetail;
-	constructor(input) {
-		const sanitizedBody = sanitizeBody(input.rawBody, input.redactionContext);
-		const redactedHeaders = redactHeaders(input.responseHeaders);
-		const kind = classifyKind(input.status, sanitizedBody, redactedHeaders);
-		super(input.overrideUserMessage ?? buildUserMessage(kind, input, sanitizedBody));
-		this.name = "HttpError";
-		this.status = input.status;
-		this.kind = kind;
-		this.developerDetail = {
-			status: input.status,
-			statusText: input.statusText,
-			method: input.method,
-			url: input.url,
-			responseHeaders: redactedHeaders,
-			body: sanitizedBody
-		};
-	}
-	get isRetryable() {
-		return isRetryableStatus(this.status);
-	}
-};
-function isRetryableStatus(status) {
-	return STATUS_CLASSIFICATIONS[status]?.retryable === true;
-}
-function sanitizeBody(rawBody, ctx) {
-	if (rawBody === null) return null;
-	if (ctx === void 0) return rawBody;
-	return redactBody(rawBody, ctx);
-}
-function classifyKind(status, sanitizedBody, redactedHeaders) {
-	if (status === 401 || status === 403) return "auth";
-	if (status === 404) return isRouteMissingResponse(sanitizedBody, redactedHeaders) ? "route-missing" : "resource-missing";
-	if (status === 429) return "rate-limit";
-	if (status >= 500 && status < 600) return "server-error";
-	return "generic";
-}
-function isRouteMissingResponse(sanitizedBody, redactedHeaders) {
-	if (sanitizedBody?.includes(ROUTE_MISSING_LITERAL)) return true;
-	if (sanitizedBody?.includes(RESOURCE_MISSING_LITERAL)) return false;
-	if (redactedHeaders["content-type"]?.includes(JSON_CONTENT_TYPE)) return false;
-	if (sanitizedBody === null || sanitizedBody.trim() === "") return true;
-	return !parseJsonResult(sanitizedBody, ErrorEnvelope).ok;
-}
-function buildUserMessage(kind, input, sanitizedBody) {
-	if (kind === "route-missing") return buildRouteMissingMessage(input);
-	if (kind === "resource-missing") return `Not found: ${input.method} ${pathFromUrl(input.url)}.`;
-	const fromBody = parseEnvelopeMessage(sanitizedBody);
-	if (fromBody !== null) return fromBody;
-	if (kind === "auth") return `Invalid or unauthorized API key (host: ${hostFromUrl(input.url)}).`;
-	return defaultMessageForStatus(input.status);
-}
-function buildRouteMissingMessage(input) {
-	const path = pathFromUrl(input.url);
-	if (!input.serverTag) return `This endpoint is not available on the connected Metabase: ${input.method} ${path}.`;
-	return `This endpoint is not available on Metabase ${input.serverTag}: ${input.method} ${path}. The command may require a newer Metabase major version. Run 'mb auth list' to see this server's version.`;
-}
-function pathFromUrl(url) {
-	const parsed = new URL(url);
-	return parsed.pathname + parsed.search;
-}
-function hostFromUrl(url) {
-	return new URL(url).host;
-}
-function parseEnvelopeMessage(sanitizedBody) {
-	if (!sanitizedBody) return null;
-	const result = parseJsonResult(sanitizedBody, ErrorEnvelope);
-	if (!result.ok) return null;
-	const envelope = result.value;
-	const topLevel = envelope.message ?? envelope.error ?? envelope["error-message"];
-	if (topLevel) return capLength(topLevel);
-	const viaMessage = envelope.via?.find((entry) => entry.message)?.message;
-	if (viaMessage) return capLength(viaMessage);
-	const specific = formatErrorTree(envelope["specific-errors"]);
-	if (specific) return capLength(specific);
-	const generic = formatErrorTree(envelope.errors);
-	if (generic) return capLength(generic);
-	return null;
-}
-function formatErrorTree(value) {
-	const entries = collectLeafEntries(value, []);
-	if (entries.length === 0) return null;
-	return entries.map(formatLeafEntry).join("; ");
-}
-function formatLeafEntry(entry) {
-	return entry.path === "" ? entry.message : `${entry.path}: ${entry.message}`;
-}
-function collectLeafEntries(value, path) {
-	if (typeof value === "string") {
-		const trimmed = value.trim();
-		return trimmed === "" ? [] : [{
-			path: path.join("."),
-			message: trimmed
-		}];
-	}
-	if (Array.isArray(value)) {
-		const messages = value.filter((entry) => typeof entry === "string" && entry.trim() !== "");
-		if (messages.length === 0) return [];
-		return [{
-			path: path.join("."),
-			message: messages.join("; ")
-		}];
-	}
-	if (isPlainObject(value)) return Object.entries(value).flatMap(([key, child]) => collectLeafEntries(child, [...path, key]));
-	return [];
-}
-function capLength(message) {
-	if (message.length <= MAX_EXTRACTED_MESSAGE_LEN) return message;
-	return message.slice(0, MAX_EXTRACTED_MESSAGE_LEN - ELLIPSIS.length) + ELLIPSIS;
-}
-function defaultMessageForStatus(status) {
-	return STATUS_CLASSIFICATIONS[status]?.message ?? `Metabase returned ${status}.`;
-}
-
-//#endregion
-//#region src/core/http/network-error.ts
-const NETWORK_HINTS = {
-	ECONNREFUSED: (t) => `Connection refused by ${t.host} — is Metabase running and is the port correct?`,
-	ENOTFOUND: (t) => `Host not found: ${t.hostname} — check the URL.`,
-	EAI_AGAIN: (t) => `Could not resolve ${t.hostname} — check your network connection and the URL.`,
-	ECONNRESET: (t) => `Connection to ${t.host} was reset — the server may have closed it, or http/https may be mismatched.`,
-	ETIMEDOUT: (t) => `Connection to ${t.host} timed out — check the host, port, and your network.`
-};
-const TLS_ERROR_CODES = new Set([
-	"EPROTO",
-	"DEPTH_ZERO_SELF_SIGNED_CERT",
-	"SELF_SIGNED_CERT_IN_CHAIN",
-	"UNABLE_TO_VERIFY_LEAF_SIGNATURE",
-	"CERT_HAS_EXPIRED",
-	"ERR_TLS_CERT_ALTNAME_INVALID"
-]);
-function buildNetworkError(error, method, url) {
-	const fallback = errorMessage(error);
-	const code = causeCode(error);
-	const target = networkTarget(url);
-	return new NetworkError(networkMessage(code, target, fallback), {
-		method,
-		url,
-		cause: code ?? fallback
-	});
-}
-function networkMessage(code, target, fallback) {
-	if (code === null) return `Could not reach Metabase: ${fallback}`;
-	if (TLS_ERROR_CODES.has(code)) return `Could not reach Metabase: TLS error contacting ${target.host} (${code}) — the certificate could not be verified, or https:// was used against a plain-HTTP server.`;
-	const hint = NETWORK_HINTS[code];
-	if (hint === void 0) return `Could not reach Metabase: ${fallback} (${code})`;
-	return `Could not reach Metabase: ${hint(target)}`;
-}
-function causeCode(error) {
-	const cause = error instanceof Error ? error.cause : void 0;
-	if (cause instanceof Error && "code" in cause && typeof cause.code === "string") return cause.code;
-	return null;
-}
-function networkTarget(url) {
-	const parsed = new URL(url);
-	return {
-		host: parsed.host,
-		hostname: parsed.hostname
-	};
-}
-
-//#endregion
-//#region src/core/http/retry.ts
-const DEFAULT_MAX_RETRIES = 3;
-const BASE_DELAY_MS = 250;
-const MAX_DELAY_MS = 8e3;
-const MS_PER_SECOND = 1e3;
-function backoffDelay({ attempt, retryAfterHeader }) {
-	const fromHeader = parseRetryAfter(retryAfterHeader);
-	if (fromHeader !== null) return fromHeader;
-	return Math.min(MAX_DELAY_MS, BASE_DELAY_MS * 2 ** attempt);
-}
-function parseRetryAfter(header) {
-	if (!header) return null;
-	const numeric = Number(header);
-	if (Number.isFinite(numeric) && numeric >= 0) return Math.round(numeric * MS_PER_SECOND);
-	const dateMs = Date.parse(header);
-	if (Number.isFinite(dateMs)) return Math.max(0, dateMs - Date.now());
-	return null;
-}
-function sleep(ms, signal) {
-	return setTimeout(ms, void 0, { signal });
-}
-async function runWithRetries(attempt, signal) {
-	let attemptIndex = 0;
-	while (true) {
-		const outcome = await attempt(attemptIndex);
-		if (outcome.kind === "success") return outcome.response;
-		await sleep(outcome.delayMs, signal);
-		attemptIndex += 1;
+async function runWithRetries(attempt, signal) {
+	let attemptIndex = 0;
+	while (true) {
+		const outcome = await attempt(attemptIndex);
+		if (outcome.kind === "success") return outcome.response;
+		await sleep(outcome.delayMs, signal);
+		attemptIndex += 1;
 	}
 }
 
@@ -990,38 +642,612 @@ function buildUrl(baseUrl, path, query) {
 	}
 	return target.toString();
 }
-function acceptHeader(expected) {
-	if (expected === "json") return JSON_CONTENT_TYPE;
-	if (expected === "text") return "text/*";
-	return "*/*";
+function acceptHeader(expected) {
+	if (expected === "json") return JSON_CONTENT_TYPE;
+	if (expected === "text") return "text/*";
+	return "*/*";
+}
+function assertContentType(response, prepared) {
+	if (prepared.expectContentType === "binary") return;
+	const contentType = response.headers.get("content-type");
+	if (contentType === null) throwContentTypeMismatch(response, prepared, prepared.expectContentType);
+	if (prepared.expectContentType === "json" && !contentType.includes(JSON_CONTENT_TYPE)) throwContentTypeMismatch(response, prepared, "json");
+	if (prepared.expectContentType === "text" && !contentType.startsWith(TEXT_CONTENT_TYPE_PREFIX)) throwContentTypeMismatch(response, prepared, "text");
+}
+function throwContentTypeMismatch(response, prepared, expected) {
+	const actual = response.headers.get("content-type") ?? "no content-type";
+	throw new HttpError({
+		status: response.status,
+		statusText: response.statusText,
+		method: prepared.method,
+		url: prepared.url,
+		responseHeaders: response.headers,
+		rawBody: null,
+		overrideUserMessage: `Expected ${expected} response but got ${actual}`
+	});
+}
+async function readBodyForError(response) {
+	try {
+		const buffer = Buffer.from(await response.arrayBuffer());
+		return buffer.subarray(0, ERROR_BODY_BYTE_CAP).toString("utf8");
+	} catch (error) {
+		return `[body read failed: ${errorMessage(error)}]`;
+	}
+}
+
+//#endregion
+//#region src/core/http/oauth.ts
+const DISCOVERY_PATH = "/.well-known/oauth-authorization-server";
+const FORM_CONTENT_TYPE = "application/x-www-form-urlencoded";
+const OAUTH_TIMEOUT_MS = 3e4;
+async function oauthFetch(request) {
+	const timeoutSignal = AbortSignal.timeout(OAUTH_TIMEOUT_MS);
+	try {
+		return await fetch(request.url, {
+			method: request.method,
+			headers: {
+				...request.headers,
+				"user-agent": USER_AGENT
+			},
+			...request.body !== void 0 ? { body: request.body } : {},
+			signal: timeoutSignal
+		});
+	} catch (error) {
+		if (timeoutSignal.aborted) throw new TimeoutError(`OAuth request timed out after ${OAUTH_TIMEOUT_MS}ms`, {
+			kind: "http",
+			method: request.method,
+			url: request.url,
+			timeoutMs: OAUTH_TIMEOUT_MS
+		});
+		throw buildNetworkError(error, request.method, request.url);
+	}
+}
+const OAUTH_SCOPE = "mb:full";
+const WORKSPACE_MANAGER_SCOPE = "mb:workspace-manager";
+const OAuthServerMetadata = z.object({
+	issuer: z.string(),
+	authorization_endpoint: z.string(),
+	token_endpoint: z.string(),
+	registration_endpoint: z.string().optional(),
+	revocation_endpoint: z.string().optional(),
+	scopes_supported: z.array(z.string()).optional()
+}).loose();
+const RegisteredClient = z.object({ client_id: z.string() }).loose();
+const OAuthTokens = z.object({
+	access_token: z.string(),
+	token_type: z.string(),
+	expires_in: z.number().int().optional(),
+	refresh_token: z.string().optional()
+}).loose();
+const OAuthErrorBody = z.object({
+	error: z.string(),
+	error_description: z.string().optional()
+}).loose();
+async function readJson(response, schema, source) {
+	let raw;
+	try {
+		raw = await response.json();
+	} catch (error) {
+		throw new ConfigError(`${source}: invalid JSON response (${errorMessage(error)})`);
+	}
+	const parsed = schema.safeParse(raw);
+	if (!parsed.success) throw new ConfigError(`${source}: unexpected response shape`);
+	return parsed.data;
+}
+async function failure(response, source, method, url) {
+	const rawBody = await response.text().catch(() => "");
+	if (isRetryableStatus(response.status)) return new HttpError({
+		status: response.status,
+		statusText: response.statusText,
+		method,
+		url,
+		responseHeaders: response.headers,
+		rawBody
+	});
+	const parsed = parseJsonResult(rawBody, OAuthErrorBody);
+	if (parsed.ok) {
+		const detail = parsed.value.error_description ?? parsed.value.error;
+		return new ConfigError(`${source} failed (${response.status}): ${detail}`);
+	}
+	return new ConfigError(`${source} failed (${response.status})`);
+}
+async function postForm(url, params, schema, source) {
+	const response = await oauthFetch({
+		url,
+		method: "POST",
+		headers: {
+			"content-type": FORM_CONTENT_TYPE,
+			accept: JSON_CONTENT_TYPE
+		},
+		body: new URLSearchParams(params)
+	});
+	if (!response.ok) throw await failure(response, source, "POST", url);
+	return readJson(response, schema, source);
+}
+const OAUTH_UNSUPPORTED_MESSAGE = "this Metabase does not support OAuth login (requires Metabase v63 or newer)";
+async function tryDiscoverMetadata(baseUrl, requiredScope = OAUTH_SCOPE) {
+	const url = `${baseUrl}${DISCOVERY_PATH}`;
+	const response = await oauthFetch({
+		url,
+		method: "GET",
+		headers: { accept: JSON_CONTENT_TYPE }
+	});
+	const contentType = response.headers.get("content-type") ?? "";
+	if (!response.ok || !contentType.includes("json")) {
+		await response.body?.cancel().catch(() => void 0);
+		return null;
+	}
+	const metadata = await readJson(response, OAuthServerMetadata, "OAuth discovery");
+	const scopes = metadata.scopes_supported;
+	if (scopes !== void 0 && !scopes.includes(requiredScope)) return null;
+	assertEndpointOrigin(metadata.issuer, baseUrl, "issuer");
+	assertEndpointOrigin(metadata.authorization_endpoint, baseUrl, "authorization endpoint");
+	assertEndpointOrigin(metadata.token_endpoint, baseUrl, "token endpoint");
+	if (metadata.registration_endpoint !== void 0) assertEndpointOrigin(metadata.registration_endpoint, baseUrl, "registration endpoint");
+	if (metadata.revocation_endpoint !== void 0) assertEndpointOrigin(metadata.revocation_endpoint, baseUrl, "revocation endpoint");
+	return metadata;
+}
+async function discoverMetadata(baseUrl, requiredScope = OAUTH_SCOPE) {
+	const metadata = await tryDiscoverMetadata(baseUrl, requiredScope);
+	if (metadata === null) throw new ConfigError(OAUTH_UNSUPPORTED_MESSAGE);
+	return metadata;
+}
+async function registerClient(input) {
+	const response = await oauthFetch({
+		url: input.registrationEndpoint,
+		method: "POST",
+		headers: {
+			"content-type": JSON_CONTENT_TYPE,
+			accept: JSON_CONTENT_TYPE
+		},
+		body: JSON.stringify({
+			application_type: "native",
+			client_name: input.clientName,
+			redirect_uris: [input.redirectUri],
+			grant_types: ["authorization_code", "refresh_token"],
+			response_types: ["code"],
+			token_endpoint_auth_method: "none",
+			scope: input.scope
+		})
+	});
+	if (!response.ok) throw await failure(response, "OAuth client registration", "POST", input.registrationEndpoint);
+	return readJson(response, RegisteredClient, "OAuth client registration");
+}
+function exchangeCode(input) {
+	return postForm(input.tokenEndpoint, {
+		grant_type: "authorization_code",
+		code: input.code,
+		redirect_uri: input.redirectUri,
+		client_id: input.clientId,
+		code_verifier: input.codeVerifier
+	}, OAuthTokens, "OAuth token exchange");
+}
+function refreshTokens(input) {
+	return postForm(input.tokenEndpoint, {
+		grant_type: "refresh_token",
+		refresh_token: input.refreshToken,
+		client_id: input.clientId
+	}, OAuthTokens, "OAuth token refresh");
+}
+async function revokeToken(input) {
+	const response = await oauthFetch({
+		url: input.revocationEndpoint,
+		method: "POST",
+		headers: { "content-type": FORM_CONTENT_TYPE },
+		body: new URLSearchParams({
+			token: input.token,
+			client_id: input.clientId
+		})
+	});
+	if (!response.ok) throw await failure(response, "OAuth token revocation", "POST", input.revocationEndpoint);
+	await response.body?.cancel().catch(() => void 0);
+}
+
+//#endregion
+//#region src/core/version/tag.ts
+const ParsedVersionSchema = z.object({
+	tag: z.string(),
+	major: z.number().int().nonnegative(),
+	patch: z.number().int().nonnegative()
+});
+function tryParseTag(tag) {
+	const parsed = parse(tag);
+	if (parsed === null || parsed.major !== 0 && parsed.major !== 1) return null;
+	return {
+		tag,
+		major: parsed.minor,
+		patch: parsed.patch
+	};
+}
+
+//#endregion
+//#region src/core/auth/profile-record.ts
+const ProbedUser = z.object({
+	id: z.number().int(),
+	name: z.string(),
+	isAdmin: z.boolean()
+});
+const ProfileLastProbe = z.object({
+	at: z.iso.datetime(),
+	version: ParsedVersionSchema.nullable(),
+	tokenFeatures: TokenFeatures.nullable(),
+	user: ProbedUser
+});
+const ProfileFailureKind = z.enum([
+	"auth",
+	"network",
+	"server"
+]);
+const ProfileLastFailure = z.object({
+	at: z.iso.datetime(),
+	kind: ProfileFailureKind,
+	reason: z.string()
+});
+const ProfileOAuth = z.object({
+	accessToken: z.string().nullable(),
+	refreshToken: z.string().nullable(),
+	expiresAt: z.iso.datetime(),
+	clientId: z.string(),
+	scope: z.string().default(OAUTH_SCOPE)
+}).loose();
+const ProfileAuthMethod = z.enum(["oauth", "apiKey"]);
+const ProfileRecord = z.object({
+	name: z.string(),
+	url: z.string(),
+	apiKey: z.string().nullable(),
+	oauth: ProfileOAuth.nullable().default(null),
+	lastProbe: ProfileLastProbe.nullable(),
+	lastFailure: ProfileLastFailure.nullable()
+}).loose();
+const ProfilesFile = z.object({
+	profiles: z.array(ProfileRecord),
+	defaultProfile: z.string().nullable().default(null)
+}).loose();
+function profileAuthMethod(record) {
+	return record.oauth !== null ? "oauth" : "apiKey";
+}
+
+//#endregion
+//#region src/core/auth/storage.ts
+const KEYRING_SERVICE = "metabase-cli";
+const PROFILES_FILE = "profiles.json";
+const LEGACY_CREDENTIALS_FILE = "credentials.json";
+const LEGACY_REJECTIONS_FILE = "rejections.json";
+const PROFILES_FILE_MODE = 384;
+const PROFILES_DIR_MODE = 448;
+const DEFAULT_PROFILE = "default";
+const LEGACY_STORAGE_NOTICE = "Old profile storage detected and ignored; re-run `mb auth login` for each profile.";
+const KEYCHAIN_RESIDUAL_NOTICE = "warning: could not remove one or more secrets from the OS keychain; a stored token may remain — remove it manually or retry.";
+const account = {
+	profileApiKey: (profile) => `profile:${profile}:apiKey`,
+	profileOAuthAccess: (profile) => `profile:${profile}:oauthAccess`,
+	profileOAuthRefresh: (profile) => `profile:${profile}:oauthRefresh`
+};
+let legacyWarningPending = false;
+let keychainResidualPending = false;
+let keyringDowngradeNotice = null;
+function profilesFilePath() {
+	return join(configDir(), PROFILES_FILE);
+}
+function consumeLegacyStorageWarning() {
+	if (!legacyWarningPending) return null;
+	legacyWarningPending = false;
+	return LEGACY_STORAGE_NOTICE;
+}
+function consumeKeychainResidualWarning() {
+	if (!keychainResidualPending) return null;
+	keychainResidualPending = false;
+	return KEYCHAIN_RESIDUAL_NOTICE;
+}
+function consumeKeyringDowngradeWarning() {
+	const message = keyringDowngradeNotice;
+	keyringDowngradeNotice = null;
+	return message;
+}
+function keyringEnabled() {
+	return readEnv(ENV_DISABLE_KEYRING) !== "1";
+}
+function trySetKeyring(key, value) {
+	if (!keyringEnabled()) return false;
+	try {
+		new Entry(KEYRING_SERVICE, key).setPassword(value);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function tryReadKeyring(key) {
+	if (!keyringEnabled()) return void 0;
+	try {
+		return new Entry(KEYRING_SERVICE, key).getPassword();
+	} catch {
+		return void 0;
+	}
+}
+function removeKeyringEntry(key) {
+	if (!keyringEnabled()) return "skipped";
+	try {
+		return new Entry(KEYRING_SERVICE, key).deletePassword() ? "removed" : "absent";
+	} catch {
+		return "failed";
+	}
+}
+async function readProfilesFile() {
+	const path = profilesFilePath();
+	let raw;
+	try {
+		raw = await promises.readFile(path, "utf8");
+	} catch (error) {
+		if (isNotFoundError(error)) {
+			await detectLegacyArtifacts();
+			return {
+				profiles: [],
+				defaultProfile: null
+			};
+		}
+		throw error;
+	}
+	const parsed = parseJsonResult(raw, ProfilesFile, { source: path });
+	if (parsed.ok) return parsed.value;
+	if (parsed.error instanceof ValidationError) {
+		legacyWarningPending = true;
+		return {
+			profiles: [],
+			defaultProfile: null
+		};
+	}
+	throw parsed.error;
+}
+async function detectLegacyArtifacts() {
+	const legacyCredentials = join(configDir(), LEGACY_CREDENTIALS_FILE);
+	const legacyRejections = join(configDir(), LEGACY_REJECTIONS_FILE);
+	const [credentialsExists, rejectionsExists] = await Promise.all([fileExists(legacyCredentials), fileExists(legacyRejections)]);
+	if (credentialsExists || rejectionsExists) legacyWarningPending = true;
+}
+async function fileExists(path) {
+	try {
+		await promises.access(path);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function writeProfilesFile(file) {
+	const path = profilesFilePath();
+	if (file.profiles.length === 0) {
+		await promises.unlink(path).catch(() => void 0);
+		await cleanupLegacyFiles();
+		return;
+	}
+	await promises.mkdir(dirname(path), {
+		recursive: true,
+		mode: PROFILES_DIR_MODE
+	});
+	const tmpPath = `${path}.${process.pid}.tmp`;
+	await promises.writeFile(tmpPath, JSON.stringify(file, null, 2) + "\n", { mode: PROFILES_FILE_MODE });
+	if (process.platform !== "win32") await promises.chmod(tmpPath, PROFILES_FILE_MODE);
+	try {
+		await promises.rename(tmpPath, path);
+	} catch (error) {
+		await promises.unlink(tmpPath).catch(() => void 0);
+		throw error;
+	}
+	await cleanupLegacyFiles();
+}
+async function cleanupLegacyFiles() {
+	await Promise.all([promises.unlink(join(configDir(), LEGACY_CREDENTIALS_FILE)).catch(() => void 0), promises.unlink(join(configDir(), LEGACY_REJECTIONS_FILE)).catch(() => void 0)]);
+}
+function findRecord(file, name) {
+	return file.profiles.find((entry) => entry.name === name) ?? null;
+}
+function sideIsKeyringBacked(record, side) {
+	return side === "oauth" ? record.oauth !== null && record.oauth.accessToken === null : record.oauth === null && record.apiKey === null;
+}
+function flagResidualIfUnconfirmed(existing, cleared, removals) {
+	if (existing === null || !removals.includes("failed")) return;
+	if (sideIsKeyringBacked(existing, cleared)) keychainResidualPending = true;
+}
+function fileLocation(key) {
+	return {
+		backend: "file",
+		path: profilesFilePath(),
+		account: key,
+		reason: keyringEnabled() ? "unavailable" : "disabled"
+	};
+}
+function keyringFallbackWarning(location) {
+	const cause = location.reason === "disabled" ? `OS keychain disabled via ${ENV_DISABLE_KEYRING}` : "OS keychain unavailable";
+	return `warning: ${cause}; credentials stored as plaintext at ${location.path}`;
+}
+function persistSecret(key, value) {
+	if (trySetKeyring(key, value)) return {
+		backend: "keyring",
+		service: KEYRING_SERVICE,
+		account: key
+	};
+	removeKeyringEntry(key);
+	return fileLocation(key);
+}
+function resolveSecret(key, inline) {
+	if (inline !== null) return inline;
+	return tryReadKeyring(key) ?? null;
+}
+async function readProfileCredential(name = DEFAULT_PROFILE) {
+	const file = await readProfilesFile();
+	const record = findRecord(file, name);
+	if (record === null) return null;
+	return resolveRecordCredential(record);
+}
+function resolveRecordCredential(record) {
+	if (record.oauth !== null) {
+		const accessToken = resolveSecret(account.profileOAuthAccess(record.name), record.oauth.accessToken);
+		const refreshToken = resolveSecret(account.profileOAuthRefresh(record.name), record.oauth.refreshToken);
+		if (accessToken === null || refreshToken === null) return null;
+		return {
+			url: record.url,
+			credential: {
+				kind: "oauth",
+				accessToken,
+				refreshToken,
+				expiresAt: record.oauth.expiresAt,
+				clientId: record.oauth.clientId,
+				scope: record.oauth.scope
+			}
+		};
+	}
+	const apiKey = resolveSecret(account.profileApiKey(record.name), record.apiKey);
+	if (apiKey === null) return null;
+	return {
+		url: record.url,
+		credential: {
+			kind: "apiKey",
+			apiKey
+		}
+	};
+}
+async function readProfileRecord(name = DEFAULT_PROFILE) {
+	const file = await readProfilesFile();
+	return findRecord(file, name);
+}
+async function listProfileRecords() {
+	const file = await readProfilesFile();
+	return file.profiles;
+}
+async function upsertRecord(file, name, updated) {
+	const exists = findRecord(file, name) !== null;
+	const profiles = exists ? file.profiles.map((entry) => entry.name === name ? updated : entry) : [...file.profiles, updated];
+	await writeProfilesFile({
+		...file,
+		profiles
+	});
+}
+async function writeProfile(profile, name = DEFAULT_PROFILE) {
+	const location = persistSecret(account.profileApiKey(name), profile.apiKey);
+	const inlineApiKey = location.backend === "file" ? profile.apiKey : null;
+	const file = await readProfilesFile();
+	const existing = findRecord(file, name);
+	flagResidualIfUnconfirmed(existing, "oauth", [removeKeyringEntry(account.profileOAuthAccess(name)), removeKeyringEntry(account.profileOAuthRefresh(name))]);
+	const updated = existing === null ? {
+		name,
+		url: profile.url,
+		apiKey: inlineApiKey,
+		oauth: null,
+		lastProbe: null,
+		lastFailure: null
+	} : {
+		...existing,
+		url: profile.url,
+		apiKey: inlineApiKey,
+		oauth: null
+	};
+	await upsertRecord(file, name, updated);
+	return location;
+}
+async function writeOAuthProfile(url, credential, name = DEFAULT_PROFILE) {
+	const accessKey = account.profileOAuthAccess(name);
+	const refreshKey = account.profileOAuthRefresh(name);
+	const accessLocation = persistSecret(accessKey, credential.accessToken);
+	const refreshLocation = persistSecret(refreshKey, credential.refreshToken);
+	const onFile = accessLocation.backend === "file" || refreshLocation.backend === "file";
+	const oauth = {
+		accessToken: onFile ? credential.accessToken : null,
+		refreshToken: onFile ? credential.refreshToken : null,
+		expiresAt: credential.expiresAt,
+		clientId: credential.clientId,
+		scope: credential.scope
+	};
+	const file = await readProfilesFile();
+	const existing = findRecord(file, name);
+	if (onFile && existing !== null && sideIsKeyringBacked(existing, "oauth")) keyringDowngradeNotice = keyringFallbackWarning(fileLocation(accessKey));
+	flagResidualIfUnconfirmed(existing, "apiKey", [removeKeyringEntry(account.profileApiKey(name))]);
+	const updated = existing === null ? {
+		name,
+		url,
+		apiKey: null,
+		oauth,
+		lastProbe: null,
+		lastFailure: null
+	} : {
+		...existing,
+		url,
+		apiKey: null,
+		oauth
+	};
+	await upsertRecord(file, name, updated);
+	return onFile ? fileLocation(accessKey) : {
+		backend: "keyring",
+		service: KEYRING_SERVICE,
+		account: accessKey
+	};
+}
+async function writeProbeResult(name, input) {
+	const probe = ProfileLastProbe.parse({
+		at: new Date().toISOString(),
+		version: input.server.version,
+		tokenFeatures: input.server.tokenFeatures,
+		user: input.user
+	});
+	const file = await readProfilesFile();
+	const existing = findRecord(file, name);
+	if (existing === null) return null;
+	const profiles = file.profiles.map((entry) => entry.name === name ? {
+		...entry,
+		lastProbe: probe,
+		lastFailure: null
+	} : entry);
+	await writeProfilesFile({
+		...file,
+		profiles
+	});
+	return probe;
+}
+async function writeProbeFailure(name, input) {
+	const failure$1 = ProfileLastFailure.parse({
+		at: new Date().toISOString(),
+		kind: input.kind,
+		reason: input.reason
+	});
+	const file = await readProfilesFile();
+	const existing = findRecord(file, name);
+	if (existing === null) return null;
+	const profiles = file.profiles.map((entry) => entry.name === name ? {
+		...entry,
+		lastFailure: failure$1
+	} : entry);
+	await writeProfilesFile({
+		...file,
+		profiles
+	});
+	return failure$1;
+}
+async function clearProfile(name = DEFAULT_PROFILE) {
+	const file = await readProfilesFile();
+	const existing = findRecord(file, name);
+	const removals = [
+		removeKeyringEntry(account.profileApiKey(name)),
+		removeKeyringEntry(account.profileOAuthAccess(name)),
+		removeKeyringEntry(account.profileOAuthRefresh(name))
+	];
+	if (existing !== null) flagResidualIfUnconfirmed(existing, existing.oauth !== null ? "oauth" : "apiKey", removals);
+	if (existing === null) return false;
+	await writeProfilesFile({
+		...file,
+		profiles: file.profiles.filter((entry) => entry.name !== name),
+		defaultProfile: file.defaultProfile === name ? null : file.defaultProfile
+	});
+	return true;
 }
-function assertContentType(response, prepared) {
-	if (prepared.expectContentType === "binary") return;
-	const contentType = response.headers.get("content-type");
-	if (contentType === null) throwContentTypeMismatch(response, prepared, prepared.expectContentType);
-	if (prepared.expectContentType === "json" && !contentType.includes(JSON_CONTENT_TYPE)) throwContentTypeMismatch(response, prepared, "json");
-	if (prepared.expectContentType === "text" && !contentType.startsWith(TEXT_CONTENT_TYPE_PREFIX)) throwContentTypeMismatch(response, prepared, "text");
+async function readDefaultProfileName() {
+	const file = await readProfilesFile();
+	return file.defaultProfile;
 }
-function throwContentTypeMismatch(response, prepared, expected) {
-	const actual = response.headers.get("content-type") ?? "no content-type";
-	throw new HttpError({
-		status: response.status,
-		statusText: response.statusText,
-		method: prepared.method,
-		url: prepared.url,
-		responseHeaders: response.headers,
-		rawBody: null,
-		overrideUserMessage: `Expected ${expected} response but got ${actual}`
+async function setDefaultProfile(name) {
+	const file = await readProfilesFile();
+	await writeProfilesFile({
+		...file,
+		defaultProfile: name
 	});
 }
-async function readBodyForError(response) {
-	try {
-		const buffer = Buffer.from(await response.arrayBuffer());
-		return buffer.subarray(0, ERROR_BODY_BYTE_CAP).toString("utf8");
-	} catch (error) {
-		return `[body read failed: ${errorMessage(error)}]`;
-	}
-}
 
 //#endregion
 //#region src/core/version/probe.ts
@@ -1039,219 +1265,19 @@ async function probeServer(client, opts = {}) {
 	};
 }
 
-//#endregion
-//#region src/core/url.ts
-function normalizeUrl(input) {
-	const trimmed = input.trim().replace(/\/+$/, "");
-	if (!/^https?:\/\//i.test(trimmed)) throw new ConfigError("URL must start with http:// or https://");
-	return trimmed;
-}
-function displayUrl(input) {
-	const parsed = new URL(input);
-	const path = parsed.pathname.replace(/\/+$/, "");
-	return `${parsed.origin}${path}`;
-}
-const LOOPBACK_HOSTS = new Set([
-	"localhost",
-	"127.0.0.1",
-	"::1",
-	"[::1]"
-]);
-function isLoopbackHost(hostname) {
-	return LOOPBACK_HOSTS.has(hostname.toLowerCase());
-}
-function assertEndpointOrigin(endpoint, baseUrl, label) {
-	let parsed;
-	try {
-		parsed = new URL(endpoint);
-	} catch {
-		throw new ConfigError(`OAuth ${label} is not a valid URL: ${endpoint}`);
-	}
-	const base = new URL(baseUrl);
-	if (parsed.protocol !== "https:" && !isLoopbackHost(parsed.hostname)) throw new ConfigError(`OAuth ${label} must use https: ${endpoint}`);
-	if (parsed.origin !== base.origin) throw new ConfigError(`OAuth ${label} origin (${parsed.origin}) does not match the Metabase URL (${base.origin})`);
-}
-
-//#endregion
-//#region src/core/http/oauth.ts
-const DISCOVERY_PATH = "/.well-known/oauth-authorization-server";
-const FORM_CONTENT_TYPE = "application/x-www-form-urlencoded";
-const OAUTH_TIMEOUT_MS = 3e4;
-async function oauthFetch(request) {
-	const timeoutSignal = AbortSignal.timeout(OAUTH_TIMEOUT_MS);
-	try {
-		return await fetch(request.url, {
-			method: request.method,
-			headers: {
-				...request.headers,
-				"user-agent": USER_AGENT
-			},
-			...request.body !== void 0 ? { body: request.body } : {},
-			signal: timeoutSignal
-		});
-	} catch (error) {
-		if (timeoutSignal.aborted) throw new TimeoutError(`OAuth request timed out after ${OAUTH_TIMEOUT_MS}ms`, {
-			kind: "http",
-			method: request.method,
-			url: request.url,
-			timeoutMs: OAUTH_TIMEOUT_MS
-		});
-		throw buildNetworkError(error, request.method, request.url);
-	}
-}
-const OAUTH_SCOPE = "mb:full";
-const OAuthServerMetadata = z.object({
-	issuer: z.string(),
-	authorization_endpoint: z.string(),
-	token_endpoint: z.string(),
-	registration_endpoint: z.string().optional(),
-	revocation_endpoint: z.string().optional(),
-	scopes_supported: z.array(z.string()).optional()
-}).loose();
-const RegisteredClient = z.object({ client_id: z.string() }).loose();
-const OAuthTokens = z.object({
-	access_token: z.string(),
-	token_type: z.string(),
-	expires_in: z.number().int().optional(),
-	refresh_token: z.string().optional()
-}).loose();
-const OAuthErrorBody = z.object({
-	error: z.string(),
-	error_description: z.string().optional()
-}).loose();
-async function readJson(response, schema, source) {
-	let raw;
-	try {
-		raw = await response.json();
-	} catch (error) {
-		throw new ConfigError(`${source}: invalid JSON response (${errorMessage(error)})`);
-	}
-	const parsed = schema.safeParse(raw);
-	if (!parsed.success) throw new ConfigError(`${source}: unexpected response shape`);
-	return parsed.data;
-}
-async function failure(response, source, method, url) {
-	const rawBody = await response.text().catch(() => "");
-	if (isRetryableStatus(response.status)) return new HttpError({
-		status: response.status,
-		statusText: response.statusText,
-		method,
-		url,
-		responseHeaders: response.headers,
-		rawBody
-	});
-	const parsed = parseJsonResult(rawBody, OAuthErrorBody);
-	if (parsed.ok) {
-		const detail = parsed.value.error_description ?? parsed.value.error;
-		return new ConfigError(`${source} failed (${response.status}): ${detail}`);
-	}
-	return new ConfigError(`${source} failed (${response.status})`);
-}
-async function postForm(url, params, schema, source) {
-	const response = await oauthFetch({
-		url,
-		method: "POST",
-		headers: {
-			"content-type": FORM_CONTENT_TYPE,
-			accept: JSON_CONTENT_TYPE
-		},
-		body: new URLSearchParams(params)
-	});
-	if (!response.ok) throw await failure(response, source, "POST", url);
-	return readJson(response, schema, source);
-}
-const OAUTH_UNSUPPORTED_MESSAGE = "this Metabase does not support OAuth login (requires Metabase v63 or newer)";
-async function tryDiscoverMetadata(baseUrl) {
-	const url = `${baseUrl}${DISCOVERY_PATH}`;
-	const response = await oauthFetch({
-		url,
-		method: "GET",
-		headers: { accept: JSON_CONTENT_TYPE }
-	});
-	const contentType = response.headers.get("content-type") ?? "";
-	if (!response.ok || !contentType.includes("json")) {
-		await response.body?.cancel().catch(() => void 0);
-		return null;
-	}
-	const metadata = await readJson(response, OAuthServerMetadata, "OAuth discovery");
-	const scopes = metadata.scopes_supported;
-	if (scopes !== void 0 && !scopes.includes(OAUTH_SCOPE)) return null;
-	assertEndpointOrigin(metadata.issuer, baseUrl, "issuer");
-	assertEndpointOrigin(metadata.authorization_endpoint, baseUrl, "authorization endpoint");
-	assertEndpointOrigin(metadata.token_endpoint, baseUrl, "token endpoint");
-	if (metadata.registration_endpoint !== void 0) assertEndpointOrigin(metadata.registration_endpoint, baseUrl, "registration endpoint");
-	if (metadata.revocation_endpoint !== void 0) assertEndpointOrigin(metadata.revocation_endpoint, baseUrl, "revocation endpoint");
-	return metadata;
-}
-async function discoverMetadata(baseUrl) {
-	const metadata = await tryDiscoverMetadata(baseUrl);
-	if (metadata === null) throw new ConfigError(OAUTH_UNSUPPORTED_MESSAGE);
-	return metadata;
-}
-async function registerClient(input) {
-	const response = await oauthFetch({
-		url: input.registrationEndpoint,
-		method: "POST",
-		headers: {
-			"content-type": JSON_CONTENT_TYPE,
-			accept: JSON_CONTENT_TYPE
-		},
-		body: JSON.stringify({
-			application_type: "native",
-			client_name: input.clientName,
-			redirect_uris: [input.redirectUri],
-			grant_types: ["authorization_code", "refresh_token"],
-			response_types: ["code"],
-			token_endpoint_auth_method: "none",
-			scope: OAUTH_SCOPE
-		})
-	});
-	if (!response.ok) throw await failure(response, "OAuth client registration", "POST", input.registrationEndpoint);
-	return readJson(response, RegisteredClient, "OAuth client registration");
-}
-function exchangeCode(input) {
-	return postForm(input.tokenEndpoint, {
-		grant_type: "authorization_code",
-		code: input.code,
-		redirect_uri: input.redirectUri,
-		client_id: input.clientId,
-		code_verifier: input.codeVerifier
-	}, OAuthTokens, "OAuth token exchange");
-}
-function refreshTokens(input) {
-	return postForm(input.tokenEndpoint, {
-		grant_type: "refresh_token",
-		refresh_token: input.refreshToken,
-		client_id: input.clientId
-	}, OAuthTokens, "OAuth token refresh");
-}
-async function revokeToken(input) {
-	const response = await oauthFetch({
-		url: input.revocationEndpoint,
-		method: "POST",
-		headers: { "content-type": FORM_CONTENT_TYPE },
-		body: new URLSearchParams({
-			token: input.token,
-			client_id: input.clientId
-		})
-	});
-	if (!response.ok) throw await failure(response, "OAuth token revocation", "POST", input.revocationEndpoint);
-	await response.body?.cancel().catch(() => void 0);
-}
-
 //#endregion
 //#region src/core/auth/oauth-session.ts
 async function refreshOAuthCredential(baseUrl, credential, nowMs) {
-	const metadata = await discoverMetadata(baseUrl);
+	const metadata = await discoverMetadata(baseUrl, credential.scope);
 	const tokens = await refreshTokens({
 		tokenEndpoint: metadata.token_endpoint,
 		refreshToken: credential.refreshToken,
 		clientId: credential.clientId
 	});
-	return oauthCredentialFromTokens(tokens, tokens.refresh_token ?? credential.refreshToken, credential.clientId, nowMs);
+	return oauthCredentialFromTokens(tokens, tokens.refresh_token ?? credential.refreshToken, credential.clientId, credential.scope, nowMs);
 }
 async function revokeOAuthCredential(baseUrl, credential) {
-	const metadata = await discoverMetadata(baseUrl);
+	const metadata = await discoverMetadata(baseUrl, credential.scope);
 	const revocationEndpoint = metadata.revocation_endpoint;
 	if (revocationEndpoint === void 0) return false;
 	await revokeToken({
@@ -1272,8 +1298,10 @@ async function revokeOAuthCredential(baseUrl, credential) {
 function isPreflightSkipped() {
 	return readEnv(ENV_SKIP_PREFLIGHT) === "1";
 }
-function resolveProfileName(profileFlag) {
-	return explicitProfileName(profileFlag) ?? DEFAULT_PROFILE;
+async function resolveActiveProfileName(profileFlag) {
+	const explicit = explicitProfileName(profileFlag);
+	if (explicit !== null) return explicit;
+	return await readDefaultProfileName() ?? DEFAULT_PROFILE;
 }
 function explicitProfileName(profileFlag) {
 	return profileFlag || readEnv(ENV_PROFILE) || null;
@@ -1285,7 +1313,7 @@ function readEnvCredentials() {
 	};
 }
 async function resolveConfig(flags) {
-	const profile = resolveProfileName(flags.profile);
+	const profile = await resolveActiveProfileName(flags.profile);
 	const env = readEnvCredentials();
 	const hasUrl = Boolean(flags.url ?? env.url);
 	const hasKey = Boolean(flags.apiKey ?? env.apiKey);
@@ -1615,6 +1643,8 @@ function defineMetabaseCommand(def) {
 						getResolvedConfig,
 						getServerInfo
 					});
+				} catch (error) {
+					throw enrichScopeForbiddenError(error, cachedConfig);
 				} finally {
 					emitPendingWarnings();
 				}
@@ -1633,6 +1663,12 @@ function defineMetabaseCommand(def) {
 	});
 	return cmd;
 }
+function enrichScopeForbiddenError(error, config) {
+	if (!(error instanceof HttpError) || error.status !== 403 || config === null) return error;
+	const { credential } = config;
+	if (credential.kind !== "oauth" || credential.scope === OAUTH_SCOPE) return error;
+	return new ConfigError(`${error.userMessage} This profile's login is scoped to ${credential.scope}, which only allows workspace commands against this server. Run \`mb auth login\` for a full-access login, or run content commands against the workspace itself via its ws-<id> profile.`);
+}
 function emitPendingWarnings() {
 	for (const message of consumeLegacyEnvWarnings()) warn(message);
 	const legacy = consumeLegacyStorageWarning();
@@ -1692,4 +1728,4 @@ function buildConfigFlags(ctx) {
 }
 
 //#endregion
-export { DEFAULT_PROFILE, HttpError, OAUTH_SCOPE, ParsedVersionSchema, ProbedUser, ProfileAuthMethod, ProfileLastFailure, TokenFeatures, USER_AGENT, clearProfile, combineAborts, consumeKeychainResidualWarning, consumeKeyringDowngradeWarning, createClient, createCredentialRefresher, defineMetabaseCommand, discoverMetadata, displayUrl, exchangeCode, explicitProfileName, keyringFallbackWarning, listProfileRecords, normalizeUrl, oauthCredentialFromTokens, parseCsv, parseEnum, parseEnumCsv, parseInteger, parseJson, parseJsonOrPlain, probeServer, profileAuthMethod, readEnvCredentials, readProfileCredential, readProfileRecord, registerClient, resolveProfileName, resolveRecordCredential, revokeOAuthCredential, throwIfAborted, tryDiscoverMetadata, writeOAuthProfile, writeProbeFailure, writeProbeResult, writeProfile };
+export { DEFAULT_PROFILE, HttpError, OAUTH_SCOPE, ParsedVersionSchema, ProbedUser, ProfileAuthMethod, ProfileLastFailure, TokenFeatures, USER_AGENT, WORKSPACE_MANAGER_SCOPE, clearProfile, combineAborts, consumeKeychainResidualWarning, consumeKeyringDowngradeWarning, createClient, createCredentialRefresher, defineMetabaseCommand, discoverMetadata, displayUrl, exchangeCode, explicitProfileName, keyringFallbackWarning, listProfileRecords, normalizeUrl, oauthCredentialFromTokens, parseCsv, parseEnum, parseEnumCsv, parseInteger, parseJson, parseJsonOrPlain, probeServer, profileAuthMethod, readEnvCredentials, readProfileCredential, readProfileRecord, registerClient, resolveActiveProfileName, resolveRecordCredential, revokeOAuthCredential, setDefaultProfile, throwIfAborted, tryDiscoverMetadata, writeOAuthProfile, writeProbeFailure, writeProbeResult, writeProfile };