@metabase/cli 0.2.1-alpha.trust-system-ca.541e4e0 → 0.2.2-alpha.extract-api-client.27e2241

package/dist/runtime-DiKyBxOw.mjs

@@ -0,0 +1,1007 @@
+import { d as ValidationError, f as errorMessage, i as ConfigError, l as TimeoutError, o as MetabaseError, p as isFileNotFoundError } from "./predicates-Bkm2IoeX.mjs";
+import { B as normalizeFlag, D as consumeLegacyEnvWarnings, E as ENV_URL, O as readEnv, S as ENV_DISABLE_KEYRING, T as ENV_SKIP_PREFLIGHT, V as toAliasArray, a as reportError, b as warn, i as mergeCapabilities, j as version, k as setMetabaseAugment, n as BASELINE_CAPABILITIES, r as checkCapabilities, t as interruptSignal, x as ENV_API_KEY, z as flagConsumesValue } from "./cli.mjs";
+import { _ as parseJsonResult, a as isRetryableStatus, c as normalizeUrl, f as isOAuthExpired, m as JSON_CONTENT_TYPE, o as assertEndpointOrigin, p as oauthCredentialFromTokens, r as HttpError, t as buildNetworkError } from "./network-error-CEb9ymDW.mjs";
+import { defineCommand } from "citty";
+import { z } from "zod";
+import { parse } from "semver";
+import { Entry } from "@napi-rs/keyring";
+import { promises } from "node:fs";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+//#region src/commands/parse-integer.ts
+const INTEGER_PATTERN = /^-?\d+$/;
+function parseInteger(value, options) {
+	const trimmed = value.trim();
+	if (!INTEGER_PATTERN.test(trimmed)) throw new ConfigError(`invalid ${options.name}: "${value}" (expected integer)`);
+	const parsed = Number.parseInt(trimmed, 10);
+	if (parsed < options.min) throw new ConfigError(`invalid ${options.name}: ${parsed} (must be ≥ ${options.min})`);
+	return parsed;
+}
+function parseOptionalInteger(value, options) {
+	if (value === void 0) return null;
+	return parseInteger(value, options);
+}
+//#endregion
+//#region ../client/src/version/preflight-error.ts
+var CapabilityError = class extends MetabaseError {
+	category = "capability";
+	isRetryable = false;
+	developerDetail;
+	constructor(failure) {
+		super(failure.detail);
+		this.name = "CapabilityError";
+		this.developerDetail = failure;
+	}
+};
+//#endregion
+//#region ../client/src/domain/session-properties.ts
+const ServerVersion = z.object({
+	tag: z.string(),
+	date: z.string().optional(),
+	hash: z.string().optional()
+}).loose();
+const TokenFeatures = z.record(z.string(), z.boolean());
+const SessionProperties = z.object({
+	version: ServerVersion,
+	"token-features": TokenFeatures.optional()
+}).loose();
+//#endregion
+//#region ../client/src/version/tag.ts
+const ParsedVersion = z.object({
+	tag: z.string(),
+	major: z.number().int().nonnegative(),
+	patch: z.number().int().nonnegative()
+});
+const DEV_BUILD_SUFFIX = "-SNAPSHOT";
+function tryParseTag(tag) {
+	if (tag.endsWith(DEV_BUILD_SUFFIX)) return null;
+	const parsed = parse(tag);
+	if (parsed === null || parsed.major !== 0 && parsed.major !== 1) return null;
+	return {
+		tag,
+		major: parsed.minor,
+		patch: parsed.patch
+	};
+}
+//#endregion
+//#region src/core/paths.ts
+const APP_DIR_NAME = "metabase-cli";
+function configDir() {
+	if (process.platform === "win32") return join(process.env["APPDATA"] ?? join(homedir(), "AppData", "Roaming"), APP_DIR_NAME);
+	return join(process.env["XDG_CONFIG_HOME"] ?? join(homedir(), ".config"), APP_DIR_NAME);
+}
+//#endregion
+//#region src/core/auth/profile-record.ts
+const ProbedUser = z.object({
+	id: z.number().int(),
+	name: z.string(),
+	isAdmin: z.boolean()
+});
+const ProfileLastProbe = z.object({
+	at: z.iso.datetime(),
+	version: ParsedVersion.nullable(),
+	tokenFeatures: TokenFeatures.nullable(),
+	user: ProbedUser
+});
+const ProfileFailureKind = z.enum([
+	"auth",
+	"network",
+	"server"
+]);
+const ProfileLastFailure = z.object({
+	at: z.iso.datetime(),
+	kind: ProfileFailureKind,
+	reason: z.string()
+});
+const ProfileOAuth = z.object({
+	accessToken: z.string().nullable(),
+	refreshToken: z.string().nullable(),
+	expiresAt: z.iso.datetime(),
+	clientId: z.string()
+}).loose();
+const ProfileAuthMethod = z.enum(["oauth", "apiKey"]);
+const ProfileRecord = z.object({
+	name: z.string(),
+	url: z.string(),
+	apiKey: z.string().nullable(),
+	oauth: ProfileOAuth.nullable().default(null),
+	lastProbe: ProfileLastProbe.nullable(),
+	lastFailure: ProfileLastFailure.nullable()
+}).loose();
+const ProfilesFile = z.object({ profiles: z.array(ProfileRecord) }).loose();
+function profileAuthMethod(record) {
+	return record.oauth !== null ? "oauth" : "apiKey";
+}
+//#endregion
+//#region src/core/auth/storage.ts
+const KEYRING_SERVICE = "metabase-cli";
+const PROFILES_FILE = "profiles.json";
+const LEGACY_CREDENTIALS_FILE = "credentials.json";
+const LEGACY_REJECTIONS_FILE = "rejections.json";
+const PROFILES_FILE_MODE = 384;
+const PROFILES_DIR_MODE = 448;
+const DEFAULT_PROFILE = "default";
+const LEGACY_STORAGE_NOTICE = "Old profile storage detected and ignored; re-run `mb auth login` for each profile.";
+const KEYCHAIN_RESIDUAL_NOTICE = "warning: could not remove one or more secrets from the OS keychain; a stored token may remain — remove it manually or retry.";
+const account = {
+	profileApiKey: (profile) => `profile:${profile}:apiKey`,
+	profileOAuthAccess: (profile) => `profile:${profile}:oauthAccess`,
+	profileOAuthRefresh: (profile) => `profile:${profile}:oauthRefresh`
+};
+let legacyWarningPending = false;
+let keychainResidualPending = false;
+let keyringDowngradeNotice = null;
+function profilesFilePath() {
+	return join(configDir(), PROFILES_FILE);
+}
+function consumeLegacyStorageWarning() {
+	if (!legacyWarningPending) return null;
+	legacyWarningPending = false;
+	return LEGACY_STORAGE_NOTICE;
+}
+function consumeKeychainResidualWarning() {
+	if (!keychainResidualPending) return null;
+	keychainResidualPending = false;
+	return KEYCHAIN_RESIDUAL_NOTICE;
+}
+function consumeKeyringDowngradeWarning() {
+	const message = keyringDowngradeNotice;
+	keyringDowngradeNotice = null;
+	return message;
+}
+function keyringEnabled() {
+	return readEnv(ENV_DISABLE_KEYRING) !== "1";
+}
+function trySetKeyring(key, value) {
+	if (!keyringEnabled()) return false;
+	try {
+		new Entry(KEYRING_SERVICE, key).setPassword(value);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function tryReadKeyring(key) {
+	if (!keyringEnabled()) return;
+	try {
+		return new Entry(KEYRING_SERVICE, key).getPassword();
+	} catch {
+		return;
+	}
+}
+function removeKeyringEntry(key) {
+	if (!keyringEnabled()) return "skipped";
+	try {
+		return new Entry(KEYRING_SERVICE, key).deletePassword() ? "removed" : "absent";
+	} catch {
+		return "failed";
+	}
+}
+async function readProfilesFile() {
+	const path = profilesFilePath();
+	let raw;
+	try {
+		raw = await promises.readFile(path, "utf8");
+	} catch (error) {
+		if (isFileNotFoundError(error)) {
+			await detectLegacyArtifacts();
+			return { profiles: [] };
+		}
+		throw error;
+	}
+	const parsed = parseJsonResult(raw, ProfilesFile, { source: path });
+	if (parsed.ok) return parsed.value;
+	if (parsed.error instanceof ValidationError) {
+		legacyWarningPending = true;
+		return { profiles: [] };
+	}
+	throw parsed.error;
+}
+async function detectLegacyArtifacts() {
+	const legacyCredentials = join(configDir(), LEGACY_CREDENTIALS_FILE);
+	const legacyRejections = join(configDir(), LEGACY_REJECTIONS_FILE);
+	const [credentialsExists, rejectionsExists] = await Promise.all([fileExists(legacyCredentials), fileExists(legacyRejections)]);
+	if (credentialsExists || rejectionsExists) legacyWarningPending = true;
+}
+async function fileExists(path) {
+	try {
+		await promises.access(path);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function writeProfilesFile(file) {
+	const path = profilesFilePath();
+	if (file.profiles.length === 0) {
+		await promises.unlink(path).catch(() => void 0);
+		await cleanupLegacyFiles();
+		return;
+	}
+	await promises.mkdir(dirname(path), {
+		recursive: true,
+		mode: PROFILES_DIR_MODE
+	});
+	const tmpPath = `${path}.${process.pid}.tmp`;
+	await promises.writeFile(tmpPath, JSON.stringify(file, null, 2) + "\n", { mode: PROFILES_FILE_MODE });
+	if (process.platform !== "win32") await promises.chmod(tmpPath, PROFILES_FILE_MODE);
+	try {
+		await promises.rename(tmpPath, path);
+	} catch (error) {
+		await promises.unlink(tmpPath).catch(() => void 0);
+		throw error;
+	}
+	await cleanupLegacyFiles();
+}
+async function cleanupLegacyFiles() {
+	await Promise.all([promises.unlink(join(configDir(), LEGACY_CREDENTIALS_FILE)).catch(() => void 0), promises.unlink(join(configDir(), LEGACY_REJECTIONS_FILE)).catch(() => void 0)]);
+}
+function findRecord(file, name) {
+	return file.profiles.find((entry) => entry.name === name) ?? null;
+}
+function sideIsKeyringBacked(record, side) {
+	return side === "oauth" ? record.oauth !== null && record.oauth.accessToken === null : record.oauth === null && record.apiKey === null;
+}
+function flagResidualIfUnconfirmed(existing, cleared, removals) {
+	if (existing === null || !removals.includes("failed")) return;
+	if (sideIsKeyringBacked(existing, cleared)) keychainResidualPending = true;
+}
+function fileLocation(key) {
+	return {
+		backend: "file",
+		path: profilesFilePath(),
+		account: key,
+		reason: keyringEnabled() ? "unavailable" : "disabled"
+	};
+}
+function keyringFallbackWarning(location) {
+	return `warning: ${location.reason === "disabled" ? `OS keychain disabled via ${ENV_DISABLE_KEYRING}` : "OS keychain unavailable"}; credentials stored as plaintext at ${location.path}`;
+}
+function persistSecret(key, value) {
+	if (trySetKeyring(key, value)) return {
+		backend: "keyring",
+		service: KEYRING_SERVICE,
+		account: key
+	};
+	removeKeyringEntry(key);
+	return fileLocation(key);
+}
+function resolveSecret(key, inline) {
+	if (inline !== null) return inline;
+	return tryReadKeyring(key) ?? null;
+}
+async function readProfileCredential(name = DEFAULT_PROFILE) {
+	const record = findRecord(await readProfilesFile(), name);
+	if (record === null) return null;
+	return resolveRecordCredential(record);
+}
+function resolveRecordCredential(record) {
+	if (record.oauth !== null) {
+		const accessToken = resolveSecret(account.profileOAuthAccess(record.name), record.oauth.accessToken);
+		const refreshToken = resolveSecret(account.profileOAuthRefresh(record.name), record.oauth.refreshToken);
+		if (accessToken === null || refreshToken === null) return null;
+		return {
+			url: record.url,
+			credential: {
+				kind: "oauth",
+				accessToken,
+				refreshToken,
+				expiresAt: record.oauth.expiresAt,
+				clientId: record.oauth.clientId
+			}
+		};
+	}
+	const apiKey = resolveSecret(account.profileApiKey(record.name), record.apiKey);
+	if (apiKey === null) return null;
+	return {
+		url: record.url,
+		credential: {
+			kind: "apiKey",
+			apiKey
+		}
+	};
+}
+async function readProfileRecord(name = DEFAULT_PROFILE) {
+	return findRecord(await readProfilesFile(), name);
+}
+async function listProfileRecords() {
+	return (await readProfilesFile()).profiles;
+}
+async function upsertRecord(file, name, updated) {
+	const profiles = findRecord(file, name) !== null ? file.profiles.map((entry) => entry.name === name ? updated : entry) : [...file.profiles, updated];
+	await writeProfilesFile({
+		...file,
+		profiles
+	});
+}
+async function writeProfile(profile, name = DEFAULT_PROFILE) {
+	const location = persistSecret(account.profileApiKey(name), profile.apiKey);
+	const inlineApiKey = location.backend === "file" ? profile.apiKey : null;
+	const file = await readProfilesFile();
+	const existing = findRecord(file, name);
+	flagResidualIfUnconfirmed(existing, "oauth", [removeKeyringEntry(account.profileOAuthAccess(name)), removeKeyringEntry(account.profileOAuthRefresh(name))]);
+	await upsertRecord(file, name, existing === null ? {
+		name,
+		url: profile.url,
+		apiKey: inlineApiKey,
+		oauth: null,
+		lastProbe: null,
+		lastFailure: null
+	} : {
+		...existing,
+		url: profile.url,
+		apiKey: inlineApiKey,
+		oauth: null
+	});
+	return location;
+}
+async function writeOAuthProfile(url, credential, name = DEFAULT_PROFILE) {
+	const accessKey = account.profileOAuthAccess(name);
+	const refreshKey = account.profileOAuthRefresh(name);
+	const accessLocation = persistSecret(accessKey, credential.accessToken);
+	const refreshLocation = persistSecret(refreshKey, credential.refreshToken);
+	const onFile = accessLocation.backend === "file" || refreshLocation.backend === "file";
+	const oauth = {
+		accessToken: onFile ? credential.accessToken : null,
+		refreshToken: onFile ? credential.refreshToken : null,
+		expiresAt: credential.expiresAt,
+		clientId: credential.clientId
+	};
+	const file = await readProfilesFile();
+	const existing = findRecord(file, name);
+	if (onFile && existing !== null && sideIsKeyringBacked(existing, "oauth")) keyringDowngradeNotice = keyringFallbackWarning(fileLocation(accessKey));
+	flagResidualIfUnconfirmed(existing, "apiKey", [removeKeyringEntry(account.profileApiKey(name))]);
+	await upsertRecord(file, name, existing === null ? {
+		name,
+		url,
+		apiKey: null,
+		oauth,
+		lastProbe: null,
+		lastFailure: null
+	} : {
+		...existing,
+		url,
+		apiKey: null,
+		oauth
+	});
+	return onFile ? fileLocation(accessKey) : {
+		backend: "keyring",
+		service: KEYRING_SERVICE,
+		account: accessKey
+	};
+}
+async function writeProbeResult(name, input) {
+	const probe = ProfileLastProbe.parse({
+		at: (/* @__PURE__ */ new Date()).toISOString(),
+		version: input.server.version,
+		tokenFeatures: input.server.tokenFeatures,
+		user: input.user
+	});
+	const file = await readProfilesFile();
+	if (findRecord(file, name) === null) return null;
+	const profiles = file.profiles.map((entry) => entry.name === name ? {
+		...entry,
+		lastProbe: probe,
+		lastFailure: null
+	} : entry);
+	await writeProfilesFile({
+		...file,
+		profiles
+	});
+	return probe;
+}
+async function writeProbeFailure(name, input) {
+	const failure = ProfileLastFailure.parse({
+		at: (/* @__PURE__ */ new Date()).toISOString(),
+		kind: input.kind,
+		reason: input.reason
+	});
+	const file = await readProfilesFile();
+	if (findRecord(file, name) === null) return null;
+	const profiles = file.profiles.map((entry) => entry.name === name ? {
+		...entry,
+		lastFailure: failure
+	} : entry);
+	await writeProfilesFile({
+		...file,
+		profiles
+	});
+	return failure;
+}
+async function clearProfile(name = DEFAULT_PROFILE) {
+	const file = await readProfilesFile();
+	const existing = findRecord(file, name);
+	const removals = [
+		removeKeyringEntry(account.profileApiKey(name)),
+		removeKeyringEntry(account.profileOAuthAccess(name)),
+		removeKeyringEntry(account.profileOAuthRefresh(name))
+	];
+	if (existing !== null) flagResidualIfUnconfirmed(existing, existing.oauth !== null ? "oauth" : "apiKey", removals);
+	if (existing === null) return false;
+	await writeProfilesFile({
+		...file,
+		profiles: file.profiles.filter((entry) => entry.name !== name)
+	});
+	return true;
+}
+//#endregion
+//#region ../client/src/http/oauth.ts
+const DISCOVERY_PATH = "/.well-known/oauth-authorization-server";
+const FORM_CONTENT_TYPE = "application/x-www-form-urlencoded";
+const OAUTH_TIMEOUT_MS = 3e4;
+async function oauthFetch(request) {
+	const timeoutSignal = AbortSignal.timeout(OAUTH_TIMEOUT_MS);
+	try {
+		return await fetch(request.url, {
+			method: request.method,
+			headers: {
+				...request.headers,
+				"user-agent": request.userAgent
+			},
+			...request.body !== void 0 ? { body: request.body } : {},
+			signal: timeoutSignal
+		});
+	} catch (error) {
+		if (timeoutSignal.aborted) throw new TimeoutError(`OAuth request timed out after ${OAUTH_TIMEOUT_MS}ms`, {
+			kind: "http",
+			method: request.method,
+			url: request.url,
+			timeoutMs: OAUTH_TIMEOUT_MS
+		});
+		throw buildNetworkError(error, request.method, request.url);
+	}
+}
+const OAUTH_SCOPE = "mb:full";
+const OAuthServerMetadata = z.object({
+	issuer: z.string(),
+	authorization_endpoint: z.string(),
+	token_endpoint: z.string(),
+	registration_endpoint: z.string().optional(),
+	revocation_endpoint: z.string().optional(),
+	scopes_supported: z.array(z.string()).optional()
+}).loose();
+const RegisteredClient = z.object({ client_id: z.string() }).loose();
+const OAuthTokens = z.object({
+	access_token: z.string(),
+	token_type: z.string(),
+	expires_in: z.number().int().optional(),
+	refresh_token: z.string().optional()
+}).loose();
+const OAuthErrorBody = z.object({
+	error: z.string(),
+	error_description: z.string().optional()
+}).loose();
+async function readJson(response, schema, source) {
+	let raw;
+	try {
+		raw = await response.json();
+	} catch (error) {
+		throw new ConfigError(`${source}: invalid JSON response (${errorMessage(error)})`);
+	}
+	const parsed = schema.safeParse(raw);
+	if (!parsed.success) throw new ConfigError(`${source}: unexpected response shape`);
+	return parsed.data;
+}
+async function failure(response, source, method, url) {
+	const rawBody = await response.text().catch(() => "");
+	if (isRetryableStatus(response.status)) return new HttpError({
+		status: response.status,
+		statusText: response.statusText,
+		method,
+		url,
+		responseHeaders: response.headers,
+		rawBody
+	});
+	const parsed = parseJsonResult(rawBody, OAuthErrorBody);
+	if (parsed.ok) {
+		const detail = parsed.value.error_description ?? parsed.value.error;
+		return new ConfigError(`${source} failed (${response.status}): ${detail}`);
+	}
+	return new ConfigError(`${source} failed (${response.status})`);
+}
+async function postForm(url, userAgent, params, schema, source) {
+	const response = await oauthFetch({
+		url,
+		method: "POST",
+		userAgent,
+		headers: {
+			"content-type": FORM_CONTENT_TYPE,
+			accept: JSON_CONTENT_TYPE
+		},
+		body: new URLSearchParams(params)
+	});
+	if (!response.ok) throw await failure(response, source, "POST", url);
+	return readJson(response, schema, source);
+}
+const OAUTH_UNSUPPORTED_MESSAGE = "this Metabase does not support OAuth login (requires Metabase v63 or newer)";
+async function tryDiscoverMetadata(baseUrl, userAgent) {
+	const response = await oauthFetch({
+		url: `${baseUrl}${DISCOVERY_PATH}`,
+		method: "GET",
+		userAgent,
+		headers: { accept: JSON_CONTENT_TYPE }
+	});
+	const contentType = response.headers.get("content-type") ?? "";
+	if (!response.ok || !contentType.includes("json")) {
+		await response.body?.cancel().catch(() => void 0);
+		return null;
+	}
+	const metadata = await readJson(response, OAuthServerMetadata, "OAuth discovery");
+	const scopes = metadata.scopes_supported;
+	if (scopes !== void 0 && !scopes.includes("mb:full")) return null;
+	assertEndpointOrigin(metadata.issuer, baseUrl, "issuer");
+	assertEndpointOrigin(metadata.authorization_endpoint, baseUrl, "authorization endpoint");
+	assertEndpointOrigin(metadata.token_endpoint, baseUrl, "token endpoint");
+	if (metadata.registration_endpoint !== void 0) assertEndpointOrigin(metadata.registration_endpoint, baseUrl, "registration endpoint");
+	if (metadata.revocation_endpoint !== void 0) assertEndpointOrigin(metadata.revocation_endpoint, baseUrl, "revocation endpoint");
+	return metadata;
+}
+async function discoverMetadata(baseUrl, userAgent) {
+	const metadata = await tryDiscoverMetadata(baseUrl, userAgent);
+	if (metadata === null) throw new ConfigError(OAUTH_UNSUPPORTED_MESSAGE);
+	return metadata;
+}
+async function registerClient(input) {
+	const response = await oauthFetch({
+		url: input.registrationEndpoint,
+		method: "POST",
+		userAgent: input.userAgent,
+		headers: {
+			"content-type": JSON_CONTENT_TYPE,
+			accept: JSON_CONTENT_TYPE
+		},
+		body: JSON.stringify({
+			application_type: "native",
+			client_name: input.clientName,
+			redirect_uris: [input.redirectUri],
+			grant_types: ["authorization_code", "refresh_token"],
+			response_types: ["code"],
+			token_endpoint_auth_method: "none",
+			scope: OAUTH_SCOPE
+		})
+	});
+	if (!response.ok) throw await failure(response, "OAuth client registration", "POST", input.registrationEndpoint);
+	return readJson(response, RegisteredClient, "OAuth client registration");
+}
+function exchangeCode(input) {
+	return postForm(input.tokenEndpoint, input.userAgent, {
+		grant_type: "authorization_code",
+		code: input.code,
+		redirect_uri: input.redirectUri,
+		client_id: input.clientId,
+		code_verifier: input.codeVerifier
+	}, OAuthTokens, "OAuth token exchange");
+}
+function refreshTokens(input) {
+	return postForm(input.tokenEndpoint, input.userAgent, {
+		grant_type: "refresh_token",
+		refresh_token: input.refreshToken,
+		client_id: input.clientId
+	}, OAuthTokens, "OAuth token refresh");
+}
+async function revokeToken(input) {
+	const response = await oauthFetch({
+		url: input.revocationEndpoint,
+		method: "POST",
+		userAgent: input.userAgent,
+		headers: { "content-type": FORM_CONTENT_TYPE },
+		body: new URLSearchParams({
+			token: input.token,
+			client_id: input.clientId
+		})
+	});
+	if (!response.ok) throw await failure(response, "OAuth token revocation", "POST", input.revocationEndpoint);
+	await response.body?.cancel().catch(() => void 0);
+}
+//#endregion
+//#region ../client/src/auth/oauth-session.ts
+async function refreshOAuthCredential(baseUrl, credential, nowMs, userAgent) {
+	const tokens = await refreshTokens({
+		tokenEndpoint: (await discoverMetadata(baseUrl, userAgent)).token_endpoint,
+		refreshToken: credential.refreshToken,
+		clientId: credential.clientId,
+		userAgent
+	});
+	return oauthCredentialFromTokens(tokens, tokens.refresh_token ?? credential.refreshToken, credential.clientId, nowMs);
+}
+async function revokeOAuthCredential(baseUrl, credential, userAgent) {
+	const revocationEndpoint = (await discoverMetadata(baseUrl, userAgent)).revocation_endpoint;
+	if (revocationEndpoint === void 0) return false;
+	await revokeToken({
+		revocationEndpoint,
+		token: credential.refreshToken,
+		clientId: credential.clientId,
+		userAgent
+	});
+	await revokeToken({
+		revocationEndpoint,
+		token: credential.accessToken,
+		clientId: credential.clientId,
+		userAgent
+	});
+	return true;
+}
+//#endregion
+//#region src/core/user-agent.ts
+const USER_AGENT = `metabase-cli/${version}`;
+const OAUTH_CLIENT_NAME = "Metabase CLI";
+//#endregion
+//#region src/core/config.ts
+function isPreflightSkipped() {
+	return readEnv(ENV_SKIP_PREFLIGHT) === "1";
+}
+function resolveProfileName(profileFlag) {
+	return explicitProfileName(profileFlag) ?? "default";
+}
+function explicitProfileName(profileFlag) {
+	return profileFlag || readEnv("MB_PROFILE") || null;
+}
+function readEnvCredentials() {
+	return {
+		url: readEnv("MB_URL") ?? null,
+		apiKey: readEnv("MB_API_KEY") ?? null
+	};
+}
+async function resolveConfig(flags) {
+	const profile = resolveProfileName(flags.profile);
+	const env = readEnvCredentials();
+	const hasUrl = Boolean(flags.url ?? env.url);
+	const hasKey = Boolean(flags.apiKey ?? env.apiKey);
+	const stored = hasUrl && hasKey ? null : await readProfileCredential(profile);
+	const url = resolveUrl(flags.url, env.url, stored?.url);
+	const credential = resolveCredential(flags.apiKey, env.apiKey, stored?.credential);
+	if (url === null || credential === null) throw new ConfigError(`Not authenticated for profile "${profile}". Run \`mb auth login\`, set ${ENV_URL}/${ENV_API_KEY}, or pass --url/--api-key.${await failureHintForProfile(profile)}`);
+	const normalizedUrl = normalizeUrl(url.value);
+	assertOAuthUrlMatchesIssuer(credential.credential, stored?.url, normalizedUrl, profile);
+	return {
+		url: normalizedUrl,
+		credential: await ensureFreshCredential(profile, credential.credential, stored?.url),
+		profile,
+		source: url.source === credential.source ? url.source : "mixed"
+	};
+}
+function assertOAuthUrlMatchesIssuer(credential, issuerUrl, requestUrl, profile) {
+	if (credential.kind !== "oauth" || issuerUrl === void 0) return;
+	const issuer = normalizeUrl(issuerUrl);
+	if (issuer === requestUrl) return;
+	throw new ConfigError(`profile "${profile}" is a browser-login (OAuth) profile bound to ${issuer}, but the request URL is ${requestUrl}. Drop --url/${ENV_URL} to use the profile's own URL, or run \`mb auth login --url ${requestUrl}\` to authenticate there.`);
+}
+async function ensureFreshCredential(profile, credential, issuerUrl) {
+	if (credential.kind !== "oauth" || issuerUrl === void 0) return credential;
+	if (!isOAuthExpired(credential, Date.now())) return credential;
+	let refreshed;
+	try {
+		refreshed = await refreshOAuthCredential(issuerUrl, credential, Date.now(), USER_AGENT);
+	} catch {
+		return credential;
+	}
+	await persistRefreshed(profile, issuerUrl, refreshed);
+	return refreshed;
+}
+async function refreshAndPersist(profile, issuerUrl, credential) {
+	const refreshed = await refreshOAuthCredential(issuerUrl, credential, Date.now(), USER_AGENT);
+	await persistRefreshed(profile, issuerUrl, refreshed);
+	return refreshed;
+}
+async function persistRefreshed(profile, issuerUrl, refreshed) {
+	await writeOAuthProfile(issuerUrl, refreshed, profile);
+}
+function createCredentialRefresher(profile) {
+	return async () => {
+		const stored = await readProfileCredential(profile);
+		if (stored === null || stored.credential.kind !== "oauth") return null;
+		try {
+			return await refreshAndPersist(profile, stored.url, stored.credential);
+		} catch (error) {
+			if (error instanceof ConfigError) throw new ConfigError(`${error.message} — run \`mb auth login --profile ${profile}\` to log in again`);
+			throw error;
+		}
+	};
+}
+async function failureHintForProfile(profile) {
+	const record = await readProfileRecord(profile);
+	if (record === null || record.lastFailure === null) return "";
+	if (record.lastProbe !== null && record.lastProbe.at >= record.lastFailure.at) return "";
+	return ` profile "${profile}" last verify failed: ${record.lastFailure.reason}. Run \`mb auth login --profile ${profile}\` to update the token.`;
+}
+function resolveUrl(flag, env, stored) {
+	if (flag) return {
+		value: flag,
+		source: "flag"
+	};
+	if (env) return {
+		value: env,
+		source: "env"
+	};
+	if (stored) return {
+		value: stored,
+		source: "stored"
+	};
+	return null;
+}
+function resolveCredential(flagKey, envKey, stored) {
+	if (flagKey) return {
+		credential: {
+			kind: "apiKey",
+			apiKey: flagKey
+		},
+		source: "flag"
+	};
+	if (envKey) return {
+		credential: {
+			kind: "apiKey",
+			apiKey: envKey
+		},
+		source: "env"
+	};
+	if (stored) return {
+		credential: stored,
+		source: "stored"
+	};
+	return null;
+}
+//#endregion
+//#region src/output/format.ts
+function resolveFormat({ json, format, isTty }) {
+	const explicit = format !== void 0 && format !== "auto" ? format : null;
+	if (explicit !== null && explicit !== "json" && explicit !== "text") throw new ConfigError(`invalid --format value: "${explicit}" (expected: auto, json, text)`);
+	if (json && explicit !== null && explicit !== "json") throw new ConfigError(`--json conflicts with --format ${explicit}`);
+	if (json) return "json";
+	if (explicit !== null) return explicit;
+	return isTty ? "text" : "json";
+}
+//#endregion
+//#region src/runtime/csv.ts
+function parseCsv(raw) {
+	return raw.split(",").map((part) => part.trim()).filter((part) => part.length > 0);
+}
+function parseEnumCsv(raw, schema, flagName) {
+	if (raw === void 0 || raw === "") return;
+	const parts = parseCsv(raw);
+	if (parts.length === 0) return;
+	const accepted = [];
+	const rejected = [];
+	for (const part of parts) {
+		const result = schema.safeParse(part);
+		if (result.success) accepted.push(result.data);
+		else rejected.push(part);
+	}
+	if (rejected.length > 0) {
+		const allowed = Object.values(schema.enum).join(", ");
+		throw new ConfigError(`invalid ${flagName} value: ${rejected.join(", ")} (expected one of: ${allowed})`);
+	}
+	return accepted;
+}
+function parseEnum(raw, schema, flagName) {
+	if (raw === void 0 || raw === "") return;
+	const result = schema.safeParse(raw);
+	if (!result.success) throw new ConfigError(`invalid ${flagName} value: "${raw}" (expected one of: ${Object.values(schema.enum).join(", ")})`);
+	return result.data;
+}
+//#endregion
+//#region src/commands/context.ts
+function resolveOutputFormat(args, options = {}) {
+	return resolveFormat({
+		json: args.json,
+		format: args.format,
+		isTty: options.isTty ?? Boolean(process.stdout.isTTY)
+	});
+}
+function resolveCommonFlags(args, options = {}) {
+	const fields = parseFields(args.fields);
+	const full = args.full === true;
+	if (full && fields !== void 0) throw new ConfigError("--full conflicts with --fields (use one or neither)");
+	return {
+		format: resolveOutputFormat(args, options),
+		full,
+		fields,
+		maxBytes: parseMaxBytes(args.maxBytes),
+		range: parseRange(args.limit, args.offset),
+		url: args.url,
+		apiKey: args.apiKey,
+		profile: args.profile,
+		skipPreflight: args.skipPreflight === true
+	};
+}
+function parseFields(value) {
+	if (value === void 0 || value === "") return;
+	const parts = parseCsv(value);
+	return parts.length > 0 ? parts : void 0;
+}
+function parseMaxBytes(value) {
+	return parseInteger(value ?? String(24576), {
+		name: "--max-bytes",
+		min: 0
+	});
+}
+function parseRange(limit, offset) {
+	const parsedLimit = parseOptionalInteger(limit, {
+		name: "--limit",
+		min: 1
+	});
+	return {
+		offset: parseInteger(offset ?? "0", {
+			name: "--offset",
+			min: 0
+		}),
+		limit: parsedLimit === null ? void 0 : parsedLimit
+	};
+}
+//#endregion
+//#region src/commands/known-flags.ts
+const ARGUMENT_SEPARATOR = "--";
+const NEGATION_PREFIX = "no-";
+const BUILTIN_FLAGS = [
+	"help",
+	"h",
+	"version",
+	"v"
+];
+function assertKnownFlags(rawArgs, argsDef) {
+	const allowed = allowedFlagKeys(argsDef);
+	let index = 0;
+	while (index < rawArgs.length) {
+		const token = rawArgs[index];
+		if (token === void 0 || token === ARGUMENT_SEPARATOR) return;
+		if (!isFlagToken(token)) {
+			index += 1;
+			continue;
+		}
+		if (!flagCandidates(token).some((candidate) => allowed.has(candidate))) throw new ConfigError(`unknown flag: ${displayFlag(token)}`);
+		index += flagConsumesValue(token, argsDef) ? 2 : 1;
+	}
+}
+function allowedFlagKeys(argsDef) {
+	const keys = new Set(BUILTIN_FLAGS.map(normalizeFlag));
+	for (const [name, def] of Object.entries(argsDef)) {
+		keys.add(normalizeFlag(name));
+		if ("alias" in def) for (const alias of toAliasArray(def.alias)) keys.add(normalizeFlag(alias));
+	}
+	return keys;
+}
+function isFlagToken(token) {
+	return token.startsWith("-") && token !== "-";
+}
+function displayFlag(token) {
+	const equals = token.indexOf("=");
+	return equals === -1 ? token : token.slice(0, equals);
+}
+function flagCandidates(token) {
+	const name = displayFlag(token).replace(/^-+/, "");
+	const candidates = [normalizeFlag(name)];
+	if (name.startsWith(NEGATION_PREFIX)) candidates.push(normalizeFlag(name.slice(3)));
+	return candidates;
+}
+//#endregion
+//#region src/commands/runtime.ts
+function defineMetabaseCommand(def) {
+	const required = def.capabilities === null ? null : mergeCapabilities(def.capabilities);
+	const cmd = defineCommand({
+		meta: def.meta,
+		args: def.args,
+		async run({ args, rawArgs }) {
+			const commonArgs = pickCommonArgs(args);
+			let reportFormat;
+			try {
+				reportFormat = resolveOutputFormat(commonArgs);
+				const ctx = resolveCommonFlags(commonArgs);
+				assertKnownFlags(rawArgs, def.args);
+				let cachedConfig = null;
+				let cachedClient = null;
+				let cachedServerInfo = null;
+				const getResolvedConfig = async () => {
+					if (cachedConfig === null) cachedConfig = await resolveConfig(buildConfigFlags(ctx));
+					return cachedConfig;
+				};
+				const getServerInfo = () => {
+					if (cachedServerInfo === null) cachedServerInfo = loadServerInfo(getResolvedConfig);
+					return cachedServerInfo;
+				};
+				const rawGetClient = async () => {
+					if (cachedClient === null) {
+						const resolved = await getResolvedConfig();
+						const { createClient } = await import("./client-BqhzKdLM.mjs").then((n) => n.t);
+						cachedClient = createClient({
+							url: resolved.url,
+							credential: resolved.credential
+						}, {
+							userAgent: USER_AGENT,
+							getServerTag: async () => (await getServerInfo())?.version?.tag ?? null,
+							refreshCredential: createCredentialRefresher(resolved.profile),
+							signal: interruptSignal
+						});
+					}
+					return cachedClient;
+				};
+				const enforcePreflight = createPreflightEnforcer(required, getServerInfo, ctx.skipPreflight);
+				const getClient = async () => {
+					const client = await rawGetClient();
+					await enforcePreflight();
+					return client;
+				};
+				try {
+					await def.run({
+						args,
+						ctx,
+						getClient,
+						getResolvedConfig,
+						getServerInfo
+					});
+				} finally {
+					emitPendingWarnings();
+				}
+			} catch (error) {
+				reportError(error, reportFormat);
+			}
+		}
+	});
+	setMetabaseAugment(cmd, {
+		examples: def.examples ?? [],
+		details: def.details ? def.details : null,
+		skills: def.skills ?? [],
+		inputSchema: def.inputSchema ?? null,
+		outputSchema: def.outputSchema ?? null,
+		capabilities: required
+	});
+	return cmd;
+}
+function emitPendingWarnings() {
+	for (const message of consumeLegacyEnvWarnings()) warn(message);
+	const legacy = consumeLegacyStorageWarning();
+	if (legacy !== null) warn(legacy);
+	const downgrade = consumeKeyringDowngradeWarning();
+	if (downgrade !== null) warn(downgrade);
+}
+async function loadServerInfo(getResolvedConfig) {
+	const record = await readProfileRecord((await getResolvedConfig()).profile);
+	if (record === null || record.lastProbe === null) return null;
+	return {
+		version: record.lastProbe.version,
+		tokenFeatures: record.lastProbe.tokenFeatures
+	};
+}
+const NO_OP_ENFORCER = async () => {};
+const NO_PROBE_DATA_WARNING = "Could not detect Metabase server version. Proceeding without preflight check; failures may produce confusing errors. Run `mb auth list` (or `mb auth login`) to populate the version cache.";
+function createPreflightEnforcer(required, getServerInfo, skip) {
+	if (required === null || skip || isPreflightSkipped() || isBaseline(required)) return NO_OP_ENFORCER;
+	let done = false;
+	return async () => {
+		if (done) return;
+		done = true;
+		const info = await getServerInfo();
+		if (info === null) {
+			warn(NO_PROBE_DATA_WARNING);
+			return;
+		}
+		const failure = checkCapabilities(info, required);
+		if (failure === null || failure.reason === "unknown-version") return;
+		throw new CapabilityError(failure);
+	};
+}
+function isBaseline(caps) {
+	return caps.minVersion === BASELINE_CAPABILITIES.minVersion && caps.tokenFeature === void 0;
+}
+function pickCommonArgs(args) {
+	const out = {};
+	if (typeof args["format"] === "string") out.format = args["format"];
+	if (typeof args["json"] === "boolean") out.json = args["json"];
+	if (typeof args["full"] === "boolean") out.full = args["full"];
+	if (typeof args["fields"] === "string") out.fields = args["fields"];
+	if (typeof args["maxBytes"] === "string") out.maxBytes = args["maxBytes"];
+	if (typeof args["limit"] === "string") out.limit = args["limit"];
+	if (typeof args["offset"] === "string") out.offset = args["offset"];
+	if (typeof args["profile"] === "string") out.profile = args["profile"];
+	if (typeof args["url"] === "string") out.url = args["url"];
+	if (typeof args["apiKey"] === "string") out.apiKey = args["apiKey"];
+	if (typeof args["skipPreflight"] === "boolean") out.skipPreflight = args["skipPreflight"];
+	return out;
+}
+function buildConfigFlags(ctx) {
+	const flags = {};
+	if (ctx.profile !== void 0) flags.profile = ctx.profile;
+	if (ctx.url !== void 0) flags.url = ctx.url;
+	if (ctx.apiKey !== void 0) flags.apiKey = ctx.apiKey;
+	return flags;
+}
+//#endregion
+export { ProbedUser as A, readProfileCredential as C, writeProbeFailure as D, writeOAuthProfile as E, tryParseTag as F, SessionProperties as I, TokenFeatures as L, ProfileLastFailure as M, profileAuthMethod as N, writeProbeResult as O, ParsedVersion as P, parseInteger as R, listProfileRecords as S, resolveRecordCredential as T, DEFAULT_PROFILE as _, createCredentialRefresher as a, consumeKeyringDowngradeWarning as b, resolveProfileName as c, revokeOAuthCredential as d, OAUTH_SCOPE as f, tryDiscoverMetadata as g, registerClient as h, parseEnumCsv as i, ProfileAuthMethod as j, writeProfile as k, OAUTH_CLIENT_NAME as l, exchangeCode as m, parseCsv as n, explicitProfileName as o, discoverMetadata as p, parseEnum as r, readEnvCredentials as s, defineMetabaseCommand as t, USER_AGENT as u, clearProfile as v, readProfileRecord as w, keyringFallbackWarning as x, consumeKeychainResidualWarning as y, parseOptionalInteger as z };