@metabase/cli 0.2.2 → 0.3.0

package/dist/runtime-CPIHg_Zg.mjs

@@ -1,1699 +0,0 @@
-import { AbortError, BASELINE_CAPABILITIES, ConfigError, DEFAULT_MAX_BYTES, ENV_API_KEY, ENV_DISABLE_KEYRING, ENV_PROFILE, ENV_SKIP_PREFLIGHT, ENV_URL, MetabaseError, NetworkError, ResponseShapeError, TimeoutError, ValidationError, consumeLegacyEnvWarnings, errorMessage, flagConsumesValue, isNotFoundError, isPlainObject, normalizeFlag, package_default, readEnv, reportError, toAliasArray, warn } from "./capabilities-1HTHeDa4.mjs";
-import { setMetabaseAugment } from "./command-augment-D9pI9Vbh.mjs";
-import { defineCommand } from "citty";
-import { z } from "zod";
-import { promises } from "node:fs";
-import { dirname, join } from "node:path";
-import { Entry } from "@napi-rs/keyring";
-import { homedir } from "node:os";
-import { parse } from "semver";
-import { setTimeout } from "node:timers/promises";
-
-//#region src/commands/parse-integer.ts
-const INTEGER_PATTERN = /^-?\d+$/;
-function parseInteger(value, options) {
-	const trimmed = value.trim();
-	if (!INTEGER_PATTERN.test(trimmed)) throw new ConfigError(`invalid ${options.name}: "${value}" (expected integer)`);
-	const parsed = Number.parseInt(trimmed, 10);
-	if (parsed < options.min) throw new ConfigError(`invalid ${options.name}: ${parsed} (must be ≥ ${options.min})`);
-	return parsed;
-}
-function parseOptionalInteger(value, options) {
-	if (value === void 0 || value === "") return null;
-	return parseInteger(value, options);
-}
-
-//#endregion
-//#region src/runtime/json.ts
-const JSON_CONTENT_TYPE = "application/json";
-function parseJson(input, schema, opts = {}) {
-	const result = parseJsonResult(input, schema, opts);
-	if (!result.ok) throw result.error;
-	return result.value;
-}
-function parseJsonResult(input, schema, opts = {}) {
-	const sourcePrefix = opts.source ? `${opts.source}: ` : "";
-	let raw;
-	try {
-		raw = JSON.parse(input);
-	} catch (error) {
-		return {
-			ok: false,
-			error: new ConfigError(`${sourcePrefix}invalid JSON: ${errorMessage(error)}`)
-		};
-	}
-	const parsed = schema.safeParse(raw);
-	if (!parsed.success) return {
-		ok: false,
-		error: new ValidationError(`${sourcePrefix}value did not match expected schema`, {
-			source: opts.source ?? "<input>",
-			zodIssues: parsed.error.issues
-		})
-	};
-	return {
-		ok: true,
-		value: parsed.data
-	};
-}
-function parseJsonOrPlain(text, contentType, schema, opts = {}) {
-	if (!isJsonContentType(contentType)) return parseJson(JSON.stringify(text), schema, opts);
-	const attempt = parseJsonResult(text, schema, opts);
-	if (attempt.ok) return attempt.value;
-	if (attempt.error instanceof ValidationError) throw attempt.error;
-	return parseJson(JSON.stringify(text), schema, opts);
-}
-function isJsonContentType(contentType) {
-	return contentType !== null && contentType.includes(JSON_CONTENT_TYPE);
-}
-
-//#endregion
-//#region src/core/paths.ts
-const APP_DIR_NAME = "metabase-cli";
-function configDir() {
-	if (process.platform === "win32") {
-		const appData = process.env["APPDATA"] ?? join(homedir(), "AppData", "Roaming");
-		return join(appData, APP_DIR_NAME);
-	}
-	const xdg = process.env["XDG_CONFIG_HOME"] ?? join(homedir(), ".config");
-	return join(xdg, APP_DIR_NAME);
-}
-
-//#endregion
-//#region src/domain/session-properties.ts
-const ServerVersion = z.object({
-	tag: z.string(),
-	date: z.string().optional(),
-	hash: z.string().optional()
-}).loose();
-const TokenFeatures = z.record(z.string(), z.boolean());
-const SessionProperties = z.object({
-	version: ServerVersion,
-	"token-features": TokenFeatures.optional()
-}).loose();
-
-//#endregion
-//#region src/core/version/tag.ts
-const ParsedVersionSchema = z.object({
-	tag: z.string(),
-	major: z.number().int().nonnegative(),
-	patch: z.number().int().nonnegative()
-});
-function tryParseTag(tag) {
-	const parsed = parse(tag);
-	if (parsed === null || parsed.major !== 0 && parsed.major !== 1) return null;
-	return {
-		tag,
-		major: parsed.minor,
-		patch: parsed.patch
-	};
-}
-
-//#endregion
-//#region src/core/auth/profile-record.ts
-const ProbedUser = z.object({
-	id: z.number().int(),
-	name: z.string(),
-	isAdmin: z.boolean()
-});
-const ProfileLastProbe = z.object({
-	at: z.iso.datetime(),
-	version: ParsedVersionSchema.nullable(),
-	tokenFeatures: TokenFeatures.nullable(),
-	user: ProbedUser
-});
-const ProfileFailureKind = z.enum([
-	"auth",
-	"network",
-	"server"
-]);
-const ProfileLastFailure = z.object({
-	at: z.iso.datetime(),
-	kind: ProfileFailureKind,
-	reason: z.string()
-});
-const ProfileOAuth = z.object({
-	accessToken: z.string().nullable(),
-	refreshToken: z.string().nullable(),
-	expiresAt: z.iso.datetime(),
-	clientId: z.string()
-}).loose();
-const ProfileAuthMethod = z.enum(["oauth", "apiKey"]);
-const ProfileRecord = z.object({
-	name: z.string(),
-	url: z.string(),
-	apiKey: z.string().nullable(),
-	oauth: ProfileOAuth.nullable().default(null),
-	lastProbe: ProfileLastProbe.nullable(),
-	lastFailure: ProfileLastFailure.nullable()
-}).loose();
-const ProfilesFile = z.object({ profiles: z.array(ProfileRecord) }).loose();
-function profileAuthMethod(record) {
-	return record.oauth !== null ? "oauth" : "apiKey";
-}
-
-//#endregion
-//#region src/core/auth/storage.ts
-const KEYRING_SERVICE = "metabase-cli";
-const PROFILES_FILE = "profiles.json";
-const LEGACY_CREDENTIALS_FILE = "credentials.json";
-const LEGACY_REJECTIONS_FILE = "rejections.json";
-const PROFILES_FILE_MODE = 384;
-const PROFILES_DIR_MODE = 448;
-const DEFAULT_PROFILE = "default";
-const LEGACY_STORAGE_NOTICE = "Old profile storage detected and ignored; re-run `mb auth login` for each profile.";
-const KEYCHAIN_RESIDUAL_NOTICE = "warning: could not remove one or more secrets from the OS keychain; a stored token may remain — remove it manually or retry.";
-const account = {
-	profileApiKey: (profile) => `profile:${profile}:apiKey`,
-	profileOAuthAccess: (profile) => `profile:${profile}:oauthAccess`,
-	profileOAuthRefresh: (profile) => `profile:${profile}:oauthRefresh`
-};
-let legacyWarningPending = false;
-let keychainResidualPending = false;
-let keyringDowngradeNotice = null;
-function profilesFilePath() {
-	return join(configDir(), PROFILES_FILE);
-}
-function consumeLegacyStorageWarning() {
-	if (!legacyWarningPending) return null;
-	legacyWarningPending = false;
-	return LEGACY_STORAGE_NOTICE;
-}
-function consumeKeychainResidualWarning() {
-	if (!keychainResidualPending) return null;
-	keychainResidualPending = false;
-	return KEYCHAIN_RESIDUAL_NOTICE;
-}
-function consumeKeyringDowngradeWarning() {
-	const message = keyringDowngradeNotice;
-	keyringDowngradeNotice = null;
-	return message;
-}
-function keyringEnabled() {
-	return readEnv(ENV_DISABLE_KEYRING) !== "1";
-}
-function trySetKeyring(key, value) {
-	if (!keyringEnabled()) return false;
-	try {
-		new Entry(KEYRING_SERVICE, key).setPassword(value);
-		return true;
-	} catch {
-		return false;
-	}
-}
-function tryReadKeyring(key) {
-	if (!keyringEnabled()) return void 0;
-	try {
-		return new Entry(KEYRING_SERVICE, key).getPassword();
-	} catch {
-		return void 0;
-	}
-}
-function removeKeyringEntry(key) {
-	if (!keyringEnabled()) return "skipped";
-	try {
-		return new Entry(KEYRING_SERVICE, key).deletePassword() ? "removed" : "absent";
-	} catch {
-		return "failed";
-	}
-}
-async function readProfilesFile() {
-	const path = profilesFilePath();
-	let raw;
-	try {
-		raw = await promises.readFile(path, "utf8");
-	} catch (error) {
-		if (isNotFoundError(error)) {
-			await detectLegacyArtifacts();
-			return { profiles: [] };
-		}
-		throw error;
-	}
-	const parsed = parseJsonResult(raw, ProfilesFile, { source: path });
-	if (parsed.ok) return parsed.value;
-	if (parsed.error instanceof ValidationError) {
-		legacyWarningPending = true;
-		return { profiles: [] };
-	}
-	throw parsed.error;
-}
-async function detectLegacyArtifacts() {
-	const legacyCredentials = join(configDir(), LEGACY_CREDENTIALS_FILE);
-	const legacyRejections = join(configDir(), LEGACY_REJECTIONS_FILE);
-	const [credentialsExists, rejectionsExists] = await Promise.all([fileExists(legacyCredentials), fileExists(legacyRejections)]);
-	if (credentialsExists || rejectionsExists) legacyWarningPending = true;
-}
-async function fileExists(path) {
-	try {
-		await promises.access(path);
-		return true;
-	} catch {
-		return false;
-	}
-}
-async function writeProfilesFile(file) {
-	const path = profilesFilePath();
-	if (file.profiles.length === 0) {
-		await promises.unlink(path).catch(() => void 0);
-		await cleanupLegacyFiles();
-		return;
-	}
-	await promises.mkdir(dirname(path), {
-		recursive: true,
-		mode: PROFILES_DIR_MODE
-	});
-	const tmpPath = `${path}.${process.pid}.tmp`;
-	await promises.writeFile(tmpPath, JSON.stringify(file, null, 2) + "\n", { mode: PROFILES_FILE_MODE });
-	if (process.platform !== "win32") await promises.chmod(tmpPath, PROFILES_FILE_MODE);
-	try {
-		await promises.rename(tmpPath, path);
-	} catch (error) {
-		await promises.unlink(tmpPath).catch(() => void 0);
-		throw error;
-	}
-	await cleanupLegacyFiles();
-}
-async function cleanupLegacyFiles() {
-	await Promise.all([promises.unlink(join(configDir(), LEGACY_CREDENTIALS_FILE)).catch(() => void 0), promises.unlink(join(configDir(), LEGACY_REJECTIONS_FILE)).catch(() => void 0)]);
-}
-function findRecord(file, name) {
-	return file.profiles.find((entry) => entry.name === name) ?? null;
-}
-function sideIsKeyringBacked(record, side) {
-	return side === "oauth" ? record.oauth !== null && record.oauth.accessToken === null : record.oauth === null && record.apiKey === null;
-}
-function flagResidualIfUnconfirmed(existing, cleared, removals) {
-	if (existing === null || !removals.includes("failed")) return;
-	if (sideIsKeyringBacked(existing, cleared)) keychainResidualPending = true;
-}
-function fileLocation(key) {
-	return {
-		backend: "file",
-		path: profilesFilePath(),
-		account: key,
-		reason: keyringEnabled() ? "unavailable" : "disabled"
-	};
-}
-function keyringFallbackWarning(location) {
-	const cause = location.reason === "disabled" ? `OS keychain disabled via ${ENV_DISABLE_KEYRING}` : "OS keychain unavailable";
-	return `warning: ${cause}; credentials stored as plaintext at ${location.path}`;
-}
-function persistSecret(key, value) {
-	if (trySetKeyring(key, value)) return {
-		backend: "keyring",
-		service: KEYRING_SERVICE,
-		account: key
-	};
-	removeKeyringEntry(key);
-	return fileLocation(key);
-}
-function resolveSecret(key, inline) {
-	if (inline !== null) return inline;
-	return tryReadKeyring(key) ?? null;
-}
-async function readProfileCredential(name = DEFAULT_PROFILE) {
-	const file = await readProfilesFile();
-	const record = findRecord(file, name);
-	if (record === null) return null;
-	return resolveRecordCredential(record);
-}
-function resolveRecordCredential(record) {
-	if (record.oauth !== null) {
-		const accessToken = resolveSecret(account.profileOAuthAccess(record.name), record.oauth.accessToken);
-		const refreshToken = resolveSecret(account.profileOAuthRefresh(record.name), record.oauth.refreshToken);
-		if (accessToken === null || refreshToken === null) return null;
-		return {
-			url: record.url,
-			credential: {
-				kind: "oauth",
-				accessToken,
-				refreshToken,
-				expiresAt: record.oauth.expiresAt,
-				clientId: record.oauth.clientId
-			}
-		};
-	}
-	const apiKey = resolveSecret(account.profileApiKey(record.name), record.apiKey);
-	if (apiKey === null) return null;
-	return {
-		url: record.url,
-		credential: {
-			kind: "apiKey",
-			apiKey
-		}
-	};
-}
-async function readProfileRecord(name = DEFAULT_PROFILE) {
-	const file = await readProfilesFile();
-	return findRecord(file, name);
-}
-async function listProfileRecords() {
-	const file = await readProfilesFile();
-	return file.profiles;
-}
-async function upsertRecord(file, name, updated) {
-	const exists = findRecord(file, name) !== null;
-	const profiles = exists ? file.profiles.map((entry) => entry.name === name ? updated : entry) : [...file.profiles, updated];
-	await writeProfilesFile({
-		...file,
-		profiles
-	});
-}
-async function writeProfile(profile, name = DEFAULT_PROFILE) {
-	const location = persistSecret(account.profileApiKey(name), profile.apiKey);
-	const inlineApiKey = location.backend === "file" ? profile.apiKey : null;
-	const file = await readProfilesFile();
-	const existing = findRecord(file, name);
-	flagResidualIfUnconfirmed(existing, "oauth", [removeKeyringEntry(account.profileOAuthAccess(name)), removeKeyringEntry(account.profileOAuthRefresh(name))]);
-	const updated = existing === null ? {
-		name,
-		url: profile.url,
-		apiKey: inlineApiKey,
-		oauth: null,
-		lastProbe: null,
-		lastFailure: null
-	} : {
-		...existing,
-		url: profile.url,
-		apiKey: inlineApiKey,
-		oauth: null
-	};
-	await upsertRecord(file, name, updated);
-	return location;
-}
-async function writeOAuthProfile(url, credential, name = DEFAULT_PROFILE) {
-	const accessKey = account.profileOAuthAccess(name);
-	const refreshKey = account.profileOAuthRefresh(name);
-	const accessLocation = persistSecret(accessKey, credential.accessToken);
-	const refreshLocation = persistSecret(refreshKey, credential.refreshToken);
-	const onFile = accessLocation.backend === "file" || refreshLocation.backend === "file";
-	const oauth = {
-		accessToken: onFile ? credential.accessToken : null,
-		refreshToken: onFile ? credential.refreshToken : null,
-		expiresAt: credential.expiresAt,
-		clientId: credential.clientId
-	};
-	const file = await readProfilesFile();
-	const existing = findRecord(file, name);
-	if (onFile && existing !== null && sideIsKeyringBacked(existing, "oauth")) keyringDowngradeNotice = keyringFallbackWarning(fileLocation(accessKey));
-	flagResidualIfUnconfirmed(existing, "apiKey", [removeKeyringEntry(account.profileApiKey(name))]);
-	const updated = existing === null ? {
-		name,
-		url,
-		apiKey: null,
-		oauth,
-		lastProbe: null,
-		lastFailure: null
-	} : {
-		...existing,
-		url,
-		apiKey: null,
-		oauth
-	};
-	await upsertRecord(file, name, updated);
-	return onFile ? fileLocation(accessKey) : {
-		backend: "keyring",
-		service: KEYRING_SERVICE,
-		account: accessKey
-	};
-}
-async function writeProbeResult(name, input) {
-	const probe = ProfileLastProbe.parse({
-		at: new Date().toISOString(),
-		version: input.server.version,
-		tokenFeatures: input.server.tokenFeatures,
-		user: input.user
-	});
-	const file = await readProfilesFile();
-	const existing = findRecord(file, name);
-	if (existing === null) return null;
-	const profiles = file.profiles.map((entry) => entry.name === name ? {
-		...entry,
-		lastProbe: probe,
-		lastFailure: null
-	} : entry);
-	await writeProfilesFile({
-		...file,
-		profiles
-	});
-	return probe;
-}
-async function writeProbeFailure(name, input) {
-	const failure$1 = ProfileLastFailure.parse({
-		at: new Date().toISOString(),
-		kind: input.kind,
-		reason: input.reason
-	});
-	const file = await readProfilesFile();
-	const existing = findRecord(file, name);
-	if (existing === null) return null;
-	const profiles = file.profiles.map((entry) => entry.name === name ? {
-		...entry,
-		lastFailure: failure$1
-	} : entry);
-	await writeProfilesFile({
-		...file,
-		profiles
-	});
-	return failure$1;
-}
-async function clearProfile(name = DEFAULT_PROFILE) {
-	const file = await readProfilesFile();
-	const existing = findRecord(file, name);
-	const removals = [
-		removeKeyringEntry(account.profileApiKey(name)),
-		removeKeyringEntry(account.profileOAuthAccess(name)),
-		removeKeyringEntry(account.profileOAuthRefresh(name))
-	];
-	if (existing !== null) flagResidualIfUnconfirmed(existing, existing.oauth !== null ? "oauth" : "apiKey", removals);
-	if (existing === null) return false;
-	await writeProfilesFile({
-		...file,
-		profiles: file.profiles.filter((entry) => entry.name !== name)
-	});
-	return true;
-}
-
-//#endregion
-//#region src/core/auth/credential.ts
-const API_KEY_HEADER = "x-api-key";
-const AUTHORIZATION_HEADER = "authorization";
-const BEARER_PREFIX = "Bearer ";
-const EXPIRY_SKEW_MS = 6e4;
-const DEFAULT_EXPIRES_IN_SECONDS = 3600;
-function credentialAuthHeader(credential) {
-	if (credential.kind === "apiKey") return {
-		name: API_KEY_HEADER,
-		value: credential.apiKey
-	};
-	return {
-		name: AUTHORIZATION_HEADER,
-		value: BEARER_PREFIX + credential.accessToken
-	};
-}
-function credentialSecrets(credential) {
-	if (credential.kind === "apiKey") return [credential.apiKey];
-	return [credential.accessToken, credential.refreshToken];
-}
-function isOAuthExpired(credential, nowMs) {
-	const expiryMs = Date.parse(credential.expiresAt);
-	if (Number.isNaN(expiryMs)) return true;
-	return expiryMs - EXPIRY_SKEW_MS <= nowMs;
-}
-function expiresAtFromNow(expiresInSeconds, nowMs) {
-	return new Date(nowMs + expiresInSeconds * 1e3).toISOString();
-}
-function oauthCredentialFromTokens(tokens, refreshToken, clientId, nowMs) {
-	return {
-		kind: "oauth",
-		accessToken: tokens.access_token,
-		refreshToken,
-		expiresAt: expiresAtFromNow(tokens.expires_in ?? DEFAULT_EXPIRES_IN_SECONDS, nowMs),
-		clientId
-	};
-}
-
-//#endregion
-//#region src/core/url.ts
-function normalizeUrl(input) {
-	const trimmed = input.trim().replace(/\/+$/, "");
-	if (!/^https?:\/\//i.test(trimmed)) throw new ConfigError("URL must start with http:// or https://");
-	return trimmed;
-}
-function displayUrl(input) {
-	const parsed = new URL(input);
-	const path = parsed.pathname.replace(/\/+$/, "");
-	return `${parsed.origin}${path}`;
-}
-const LOOPBACK_HOSTS = new Set([
-	"localhost",
-	"127.0.0.1",
-	"::1",
-	"[::1]"
-]);
-function isLoopbackHost(hostname) {
-	return LOOPBACK_HOSTS.has(hostname.toLowerCase());
-}
-function assertEndpointOrigin(endpoint, baseUrl, label) {
-	let parsed;
-	try {
-		parsed = new URL(endpoint);
-	} catch {
-		throw new ConfigError(`OAuth ${label} is not a valid URL: ${endpoint}`);
-	}
-	const base = new URL(baseUrl);
-	if (parsed.protocol !== "https:" && !isLoopbackHost(parsed.hostname)) throw new ConfigError(`OAuth ${label} must use https: ${endpoint}`);
-	if (parsed.origin !== base.origin) throw new ConfigError(`OAuth ${label} origin (${parsed.origin}) does not match the Metabase URL (${base.origin})`);
-}
-
-//#endregion
-//#region src/runtime/signal.ts
-function createProcessAbortHandler() {
-	const controller = new AbortController();
-	const handler = () => {
-		if (!controller.signal.aborted) controller.abort(new AbortError("interrupted"));
-		process.off("SIGINT", handler);
-	};
-	process.on("SIGINT", handler);
-	return {
-		signal: controller.signal,
-		uninstall: () => process.off("SIGINT", handler)
-	};
-}
-let singleton = null;
-function getProcessAbortSignal() {
-	if (singleton === null) singleton = createProcessAbortHandler().signal;
-	return singleton;
-}
-function combineAborts(timeoutSignal, callerSignal) {
-	const processSignal = getProcessAbortSignal();
-	const signals = [timeoutSignal, processSignal];
-	if (callerSignal) signals.push(callerSignal);
-	return {
-		combined: AbortSignal.any(signals),
-		processSignal
-	};
-}
-function throwIfAborted(...signals) {
-	for (const signal of signals) if (signal?.aborted) throw abortReason(signal);
-}
-function abortReason(signal) {
-	const reason = signal.reason;
-	if (reason instanceof MetabaseError) return reason;
-	if (reason instanceof Error || typeof reason === "string") return new AbortError(errorMessage(reason) || "aborted");
-	return new AbortError("aborted");
-}
-
-//#endregion
-//#region src/core/http/sanitize.ts
-const SECRET_HEADER_NAMES = new Set([
-	"authorization",
-	"x-api-key",
-	"x-metabase-session",
-	"cookie",
-	"set-cookie",
-	"proxy-authorization"
-]);
-const REDACTED = "[REDACTED]";
-function redactHeaders(headers) {
-	const result = {};
-	const entries = headers instanceof Headers ? headers.entries() : Object.entries(headers);
-	for (const [key, value] of entries) result[key] = SECRET_HEADER_NAMES.has(key.toLowerCase()) ? REDACTED : value;
-	return result;
-}
-function redactBody(body, ctx) {
-	let result = body;
-	for (const secret of ctx.knownSecrets) {
-		if (secret.length === 0) continue;
-		result = result.replaceAll(secret, REDACTED);
-	}
-	return result;
-}
-
-//#endregion
-//#region src/core/http/errors.ts
-const ROUTE_MISSING_LITERAL = "API endpoint does not exist.";
-const RESOURCE_MISSING_LITERAL = "Not found.";
-const STATUS_CLASSIFICATIONS = {
-	401: { retryable: false },
-	403: { retryable: false },
-	404: { retryable: false },
-	408: {
-		retryable: true,
-		message: "Metabase timed out responding."
-	},
-	425: { retryable: true },
-	429: {
-		retryable: true,
-		message: "Metabase rate-limited the request."
-	},
-	500: { retryable: true },
-	502: { retryable: true },
-	503: { retryable: true },
-	504: {
-		retryable: true,
-		message: "Metabase timed out responding."
-	}
-};
-const ErrorEnvelope = z.object({
-	message: z.string().optional(),
-	error: z.string().optional(),
-	"error-message": z.string().optional(),
-	via: z.array(z.object({ message: z.string().optional() }).loose()).optional(),
-	"specific-errors": z.unknown().optional(),
-	errors: z.unknown().optional()
-}).loose();
-const MAX_EXTRACTED_MESSAGE_LEN = 500;
-const ELLIPSIS = "…";
-var HttpError = class extends MetabaseError {
-	category = "http";
-	exitCode = 1;
-	status;
-	kind;
-	developerDetail;
-	constructor(input) {
-		const sanitizedBody = sanitizeBody(input.rawBody, input.redactionContext);
-		const redactedHeaders = redactHeaders(input.responseHeaders);
-		const kind = classifyKind(input.status, sanitizedBody, redactedHeaders);
-		super(input.overrideUserMessage ?? buildUserMessage(kind, input, sanitizedBody));
-		this.name = "HttpError";
-		this.status = input.status;
-		this.kind = kind;
-		this.developerDetail = {
-			status: input.status,
-			statusText: input.statusText,
-			method: input.method,
-			url: input.url,
-			responseHeaders: redactedHeaders,
-			body: sanitizedBody
-		};
-	}
-	get isRetryable() {
-		return isRetryableStatus(this.status);
-	}
-};
-function isRetryableStatus(status) {
-	return STATUS_CLASSIFICATIONS[status]?.retryable === true;
-}
-function sanitizeBody(rawBody, ctx) {
-	if (rawBody === null) return null;
-	if (ctx === void 0) return rawBody;
-	return redactBody(rawBody, ctx);
-}
-function classifyKind(status, sanitizedBody, redactedHeaders) {
-	if (status === 401 || status === 403) return "auth";
-	if (status === 404) return isRouteMissingResponse(sanitizedBody, redactedHeaders) ? "route-missing" : "resource-missing";
-	if (status === 429) return "rate-limit";
-	if (status >= 500 && status < 600) return "server-error";
-	return "generic";
-}
-function isRouteMissingResponse(sanitizedBody, redactedHeaders) {
-	if (sanitizedBody?.includes(ROUTE_MISSING_LITERAL)) return true;
-	if (sanitizedBody?.includes(RESOURCE_MISSING_LITERAL)) return false;
-	if (redactedHeaders["content-type"]?.includes(JSON_CONTENT_TYPE)) return false;
-	if (sanitizedBody === null || sanitizedBody.trim() === "") return true;
-	return !parseJsonResult(sanitizedBody, ErrorEnvelope).ok;
-}
-function buildUserMessage(kind, input, sanitizedBody) {
-	if (kind === "route-missing") return buildRouteMissingMessage(input);
-	if (kind === "resource-missing") return `Not found: ${input.method} ${pathFromUrl(input.url)}.`;
-	const fromBody = parseEnvelopeMessage(sanitizedBody);
-	if (fromBody !== null) return fromBody;
-	if (kind === "auth") return `Invalid or unauthorized API key (host: ${hostFromUrl(input.url)}).`;
-	return defaultMessageForStatus(input.status);
-}
-function buildRouteMissingMessage(input) {
-	const path = pathFromUrl(input.url);
-	if (!input.serverTag) return `This endpoint is not available on the connected Metabase: ${input.method} ${path}.`;
-	return `This endpoint is not available on Metabase ${input.serverTag}: ${input.method} ${path}. The command may require a newer Metabase major version. Run 'mb auth list' to see this server's version.`;
-}
-function pathFromUrl(url) {
-	const parsed = new URL(url);
-	return parsed.pathname + parsed.search;
-}
-function hostFromUrl(url) {
-	return new URL(url).host;
-}
-function parseEnvelopeMessage(sanitizedBody) {
-	if (!sanitizedBody) return null;
-	const result = parseJsonResult(sanitizedBody, ErrorEnvelope);
-	if (!result.ok) return null;
-	const envelope = result.value;
-	const topLevel = envelope.message ?? envelope.error ?? envelope["error-message"];
-	if (topLevel) return capLength(topLevel);
-	const viaMessage = envelope.via?.find((entry) => entry.message)?.message;
-	if (viaMessage) return capLength(viaMessage);
-	const specific = formatErrorTree(envelope["specific-errors"]);
-	if (specific) return capLength(specific);
-	const generic = formatErrorTree(envelope.errors);
-	if (generic) return capLength(generic);
-	return null;
-}
-function formatErrorTree(value) {
-	const entries = collectLeafEntries(value, []);
-	if (entries.length === 0) return null;
-	return entries.map(formatLeafEntry).join("; ");
-}
-function formatLeafEntry(entry) {
-	return entry.path === "" ? entry.message : `${entry.path}: ${entry.message}`;
-}
-function collectLeafEntries(value, path) {
-	if (typeof value === "string") {
-		const trimmed = value.trim();
-		return trimmed === "" ? [] : [{
-			path: path.join("."),
-			message: trimmed
-		}];
-	}
-	if (Array.isArray(value)) {
-		const messages = value.filter((entry) => typeof entry === "string" && entry.trim() !== "");
-		if (messages.length === 0) return [];
-		return [{
-			path: path.join("."),
-			message: messages.join("; ")
-		}];
-	}
-	if (isPlainObject(value)) return Object.entries(value).flatMap(([key, child]) => collectLeafEntries(child, [...path, key]));
-	return [];
-}
-function capLength(message) {
-	if (message.length <= MAX_EXTRACTED_MESSAGE_LEN) return message;
-	return message.slice(0, MAX_EXTRACTED_MESSAGE_LEN - ELLIPSIS.length) + ELLIPSIS;
-}
-function defaultMessageForStatus(status) {
-	return STATUS_CLASSIFICATIONS[status]?.message ?? `Metabase returned ${status}.`;
-}
-
-//#endregion
-//#region src/core/http/network-error.ts
-const NETWORK_HINTS = {
-	ECONNREFUSED: (t) => `Connection refused by ${t.host} — is Metabase running and is the port correct?`,
-	ENOTFOUND: (t) => `Host not found: ${t.hostname} — check the URL.`,
-	EAI_AGAIN: (t) => `Could not resolve ${t.hostname} — check your network connection and the URL.`,
-	ECONNRESET: (t) => `Connection to ${t.host} was reset — the server may have closed it, or http/https may be mismatched.`,
-	ETIMEDOUT: (t) => `Connection to ${t.host} timed out — check the host, port, and your network.`
-};
-const TLS_ERROR_CODES = new Set([
-	"EPROTO",
-	"DEPTH_ZERO_SELF_SIGNED_CERT",
-	"SELF_SIGNED_CERT_IN_CHAIN",
-	"UNABLE_TO_VERIFY_LEAF_SIGNATURE",
-	"CERT_HAS_EXPIRED",
-	"ERR_TLS_CERT_ALTNAME_INVALID"
-]);
-function buildNetworkError(error, method, url) {
-	const fallback = errorMessage(error);
-	const code = causeCode(error);
-	const target = networkTarget(url);
-	return new NetworkError(networkMessage(code, target, fallback), {
-		method,
-		url,
-		cause: code ?? fallback
-	});
-}
-function networkMessage(code, target, fallback) {
-	if (code === null) return `Could not reach Metabase: ${fallback}`;
-	if (TLS_ERROR_CODES.has(code)) return `Could not reach Metabase: TLS error contacting ${target.host} (${code}) — the certificate could not be verified, or https:// was used against a plain-HTTP server. For a certificate the OS does not trust either, set NODE_EXTRA_CA_CERTS to its CA bundle.`;
-	const hint = NETWORK_HINTS[code];
-	if (hint === void 0) return `Could not reach Metabase: ${fallback} (${code})`;
-	return `Could not reach Metabase: ${hint(target)}`;
-}
-function causeCode(error) {
-	const cause = error instanceof Error ? error.cause : void 0;
-	if (cause instanceof Error && "code" in cause && typeof cause.code === "string") return cause.code;
-	return null;
-}
-function networkTarget(url) {
-	const parsed = new URL(url);
-	return {
-		host: parsed.host,
-		hostname: parsed.hostname
-	};
-}
-
-//#endregion
-//#region src/core/http/retry.ts
-const DEFAULT_MAX_RETRIES = 3;
-const BASE_DELAY_MS = 250;
-const MAX_DELAY_MS = 8e3;
-const MS_PER_SECOND = 1e3;
-function backoffDelay({ attempt, retryAfterHeader }) {
-	const fromHeader = parseRetryAfter(retryAfterHeader);
-	if (fromHeader !== null) return fromHeader;
-	return Math.min(MAX_DELAY_MS, BASE_DELAY_MS * 2 ** attempt);
-}
-function parseRetryAfter(header) {
-	if (!header) return null;
-	const numeric = Number(header);
-	if (Number.isFinite(numeric) && numeric >= 0) return Math.round(numeric * MS_PER_SECOND);
-	const dateMs = Date.parse(header);
-	if (Number.isFinite(dateMs)) return Math.max(0, dateMs - Date.now());
-	return null;
-}
-function sleep(ms, signal) {
-	return setTimeout(ms, void 0, { signal });
-}
-async function runWithRetries(attempt, signal) {
-	let attemptIndex = 0;
-	while (true) {
-		const outcome = await attempt(attemptIndex);
-		if (outcome.kind === "success") return outcome.response;
-		await sleep(outcome.delayMs, signal);
-		attemptIndex += 1;
-	}
-}
-
-//#endregion
-//#region src/core/http/client.ts
-const UNAUTHORIZED_STATUS = 401;
-const DEFAULT_TIMEOUT_MS = 3e4;
-const OCTET_STREAM_CONTENT_TYPE = "application/octet-stream";
-const TEXT_CONTENT_TYPE_PREFIX = "text/";
-const ERROR_BODY_BYTE_CAP = 64 * 1024;
-const USER_AGENT = `metabase-cli/${package_default.version}`;
-const IDEMPOTENT_METHODS = new Set([
-	"GET",
-	"HEAD",
-	"OPTIONS"
-]);
-const NO_SERVER_TAG = async () => null;
-function createClient(config, overrides = {}) {
-	const fetchImpl = overrides.fetchImpl ?? globalThis.fetch.bind(globalThis);
-	const getServerTag = overrides.getServerTag ?? NO_SERVER_TAG;
-	const refreshCredential = overrides.refreshCredential;
-	let credential = config.credential;
-	const knownSecrets = new Set(credentialSecrets(credential));
-	const redactionContext = { knownSecrets };
-	let refreshInFlight = null;
-	function tryRefreshCredential() {
-		const refresh = refreshCredential;
-		if (credential.kind !== "oauth" || refresh === void 0) return Promise.resolve(false);
-		refreshInFlight ??= refreshOnce(refresh).finally(() => {
-			refreshInFlight = null;
-		});
-		return refreshInFlight;
-	}
-	async function refreshOnce(refresh) {
-		const next = await refresh();
-		if (next === null) return false;
-		credential = next;
-		for (const secret of credentialSecrets(next)) knownSecrets.add(secret);
-		return true;
-	}
-	async function attemptOnce(prepared, attempt) {
-		const hasRetriesLeft = attempt < prepared.retries;
-		const timeoutSignal = AbortSignal.timeout(prepared.timeoutMs);
-		const { combined, processSignal } = combineAborts(timeoutSignal, prepared.callerSignal);
-		let response;
-		try {
-			response = await fetchImpl(prepared.url, {
-				method: prepared.method,
-				headers: prepared.headers,
-				body: prepared.body,
-				signal: combined
-			});
-		} catch (error) {
-			throwIfAborted(prepared.callerSignal, processSignal);
-			if (hasRetriesLeft) return {
-				kind: "retry",
-				delayMs: backoffDelay({ attempt })
-			};
-			if (timeoutSignal.aborted) throw new TimeoutError(`Request timed out after ${prepared.timeoutMs}ms`, {
-				kind: "http",
-				method: prepared.method,
-				url: prepared.url,
-				timeoutMs: prepared.timeoutMs
-			});
-			throw buildNetworkError(error, prepared.method, prepared.url);
-		}
-		const canRetryStatus = hasRetriesLeft && prepared.idempotent;
-		if (!response.ok && isRetryableStatus(response.status) && canRetryStatus) {
-			const retryAfter = response.headers.get("Retry-After");
-			response.body?.cancel().catch(() => void 0);
-			return {
-				kind: "retry",
-				delayMs: backoffDelay({
-					attempt,
-					retryAfterHeader: retryAfter
-				})
-			};
-		}
-		if (!response.ok) {
-			const rawBody = await readBodyForError(response);
-			const serverTag = await getServerTag();
-			throw new HttpError({
-				status: response.status,
-				statusText: response.statusText,
-				method: prepared.method,
-				url: prepared.url,
-				responseHeaders: response.headers,
-				rawBody,
-				serverTag,
-				redactionContext
-			});
-		}
-		assertContentType(response, prepared);
-		return {
-			kind: "success",
-			response
-		};
-	}
-	async function executeRaw(prepared) {
-		return runWithRetries((attempt) => attemptOnce(prepared, attempt), prepared.callerSignal);
-	}
-	async function executeWithAuthRefresh(path, opts) {
-		const prepared = prepare(path, opts);
-		try {
-			return {
-				response: await executeRaw(prepared),
-				prepared
-			};
-		} catch (error) {
-			if (error instanceof HttpError && error.status === UNAUTHORIZED_STATUS) {
-				if (await tryRefreshCredential()) {
-					const retried = prepare(path, opts);
-					return {
-						response: await executeRaw(retried),
-						prepared: retried
-					};
-				}
-			}
-			throw error;
-		}
-	}
-	function prepare(path, opts = {}) {
-		const method = opts.method ?? "GET";
-		const expectContentType = opts.expectContentType ?? "json";
-		const url = buildUrl(config.url, path, opts.query);
-		const headers = new Headers();
-		const auth = credentialAuthHeader(credential);
-		headers.set(auth.name, auth.value);
-		headers.set("accept", acceptHeader(expectContentType));
-		headers.set("user-agent", USER_AGENT);
-		let body = null;
-		if (opts.body !== void 0 && opts.body !== null) if (typeof opts.body === "string" || opts.body instanceof URLSearchParams) body = opts.body;
-		else if (opts.body instanceof FormData || opts.body instanceof ReadableStream) body = opts.body;
-		else if (opts.body instanceof Uint8Array) {
-			body = opts.body;
-			headers.set("content-type", OCTET_STREAM_CONTENT_TYPE);
-		} else {
-			body = JSON.stringify(opts.body);
-			headers.set("content-type", JSON_CONTENT_TYPE);
-		}
-		return {
-			url,
-			method,
-			headers,
-			body,
-			expectContentType,
-			retries: opts.retries ?? DEFAULT_MAX_RETRIES,
-			idempotent: opts.idempotent ?? IDEMPOTENT_METHODS.has(method),
-			timeoutMs: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS,
-			callerSignal: opts.signal
-		};
-	}
-	return {
-		async requestRaw(path, opts) {
-			return (await executeWithAuthRefresh(path, opts ?? {})).response;
-		},
-		async requestParsed(schema, path, opts) {
-			const { response, prepared } = await executeWithAuthRefresh(path, {
-				...opts,
-				expectContentType: "json"
-			});
-			const text = await response.text();
-			try {
-				return parseJson(text, schema, { source: prepared.url });
-			} catch (error) {
-				if (error instanceof ValidationError) throw new ResponseShapeError({
-					method: prepared.method,
-					url: prepared.url,
-					status: response.status,
-					zodIssues: error.developerDetail.zodIssues,
-					serverTag: await getServerTag()
-				});
-				throw error;
-			}
-		},
-		async requestStream(path, opts) {
-			const { response, prepared } = await executeWithAuthRefresh(path, {
-				...opts,
-				expectContentType: opts?.expectContentType ?? "binary"
-			});
-			if (!response.body) throw new NetworkError("Response had no body to stream", {
-				method: prepared.method,
-				url: prepared.url,
-				cause: "missing body"
-			});
-			return response.body;
-		}
-	};
-}
-function buildUrl(baseUrl, path, query) {
-	const normalizedPath = path.startsWith("/") ? path : `/${path}`;
-	const target = new URL(baseUrl + normalizedPath);
-	if (query) for (const [key, value] of Object.entries(query)) {
-		if (value === void 0) continue;
-		if (Array.isArray(value)) for (const entry of value) target.searchParams.append(key, String(entry));
-		else target.searchParams.append(key, String(value));
-	}
-	return target.toString();
-}
-function acceptHeader(expected) {
-	if (expected === "json") return JSON_CONTENT_TYPE;
-	if (expected === "text") return "text/*";
-	return "*/*";
-}
-function assertContentType(response, prepared) {
-	if (prepared.expectContentType === "binary") return;
-	const contentType = response.headers.get("content-type");
-	if (contentType === null) throwContentTypeMismatch(response, prepared, prepared.expectContentType);
-	if (prepared.expectContentType === "json" && !contentType.includes(JSON_CONTENT_TYPE)) throwContentTypeMismatch(response, prepared, "json");
-	if (prepared.expectContentType === "text" && !contentType.startsWith(TEXT_CONTENT_TYPE_PREFIX)) throwContentTypeMismatch(response, prepared, "text");
-}
-function throwContentTypeMismatch(response, prepared, expected) {
-	const actual = response.headers.get("content-type") ?? "no content-type";
-	throw new HttpError({
-		status: response.status,
-		statusText: response.statusText,
-		method: prepared.method,
-		url: prepared.url,
-		responseHeaders: response.headers,
-		rawBody: null,
-		overrideUserMessage: `Expected ${expected} response but got ${actual}`
-	});
-}
-async function readBodyForError(response) {
-	try {
-		const buffer = Buffer.from(await response.arrayBuffer());
-		return buffer.subarray(0, ERROR_BODY_BYTE_CAP).toString("utf8");
-	} catch (error) {
-		return `[body read failed: ${errorMessage(error)}]`;
-	}
-}
-
-//#endregion
-//#region src/core/http/oauth.ts
-const DISCOVERY_PATH = "/.well-known/oauth-authorization-server";
-const FORM_CONTENT_TYPE = "application/x-www-form-urlencoded";
-const OAUTH_TIMEOUT_MS = 3e4;
-async function oauthFetch(request) {
-	const timeoutSignal = AbortSignal.timeout(OAUTH_TIMEOUT_MS);
-	try {
-		return await fetch(request.url, {
-			method: request.method,
-			headers: {
-				...request.headers,
-				"user-agent": USER_AGENT
-			},
-			...request.body !== void 0 ? { body: request.body } : {},
-			signal: timeoutSignal
-		});
-	} catch (error) {
-		if (timeoutSignal.aborted) throw new TimeoutError(`OAuth request timed out after ${OAUTH_TIMEOUT_MS}ms`, {
-			kind: "http",
-			method: request.method,
-			url: request.url,
-			timeoutMs: OAUTH_TIMEOUT_MS
-		});
-		throw buildNetworkError(error, request.method, request.url);
-	}
-}
-const OAUTH_SCOPE = "mb:full";
-const OAuthServerMetadata = z.object({
-	issuer: z.string(),
-	authorization_endpoint: z.string(),
-	token_endpoint: z.string(),
-	registration_endpoint: z.string().optional(),
-	revocation_endpoint: z.string().optional(),
-	scopes_supported: z.array(z.string()).optional()
-}).loose();
-const RegisteredClient = z.object({ client_id: z.string() }).loose();
-const OAuthTokens = z.object({
-	access_token: z.string(),
-	token_type: z.string(),
-	expires_in: z.number().int().optional(),
-	refresh_token: z.string().optional()
-}).loose();
-const OAuthErrorBody = z.object({
-	error: z.string(),
-	error_description: z.string().optional()
-}).loose();
-async function readJson(response, schema, source) {
-	let raw;
-	try {
-		raw = await response.json();
-	} catch (error) {
-		throw new ConfigError(`${source}: invalid JSON response (${errorMessage(error)})`);
-	}
-	const parsed = schema.safeParse(raw);
-	if (!parsed.success) throw new ConfigError(`${source}: unexpected response shape`);
-	return parsed.data;
-}
-async function failure(response, source, method, url) {
-	const rawBody = await response.text().catch(() => "");
-	if (isRetryableStatus(response.status)) return new HttpError({
-		status: response.status,
-		statusText: response.statusText,
-		method,
-		url,
-		responseHeaders: response.headers,
-		rawBody
-	});
-	const parsed = parseJsonResult(rawBody, OAuthErrorBody);
-	if (parsed.ok) {
-		const detail = parsed.value.error_description ?? parsed.value.error;
-		return new ConfigError(`${source} failed (${response.status}): ${detail}`);
-	}
-	return new ConfigError(`${source} failed (${response.status})`);
-}
-async function postForm(url, params, schema, source) {
-	const response = await oauthFetch({
-		url,
-		method: "POST",
-		headers: {
-			"content-type": FORM_CONTENT_TYPE,
-			accept: JSON_CONTENT_TYPE
-		},
-		body: new URLSearchParams(params)
-	});
-	if (!response.ok) throw await failure(response, source, "POST", url);
-	return readJson(response, schema, source);
-}
-const OAUTH_UNSUPPORTED_MESSAGE = "this Metabase does not support OAuth login (requires Metabase v63 or newer)";
-async function tryDiscoverMetadata(baseUrl) {
-	const url = `${baseUrl}${DISCOVERY_PATH}`;
-	const response = await oauthFetch({
-		url,
-		method: "GET",
-		headers: { accept: JSON_CONTENT_TYPE }
-	});
-	const contentType = response.headers.get("content-type") ?? "";
-	if (!response.ok || !contentType.includes("json")) {
-		await response.body?.cancel().catch(() => void 0);
-		return null;
-	}
-	const metadata = await readJson(response, OAuthServerMetadata, "OAuth discovery");
-	const scopes = metadata.scopes_supported;
-	if (scopes !== void 0 && !scopes.includes(OAUTH_SCOPE)) return null;
-	assertEndpointOrigin(metadata.issuer, baseUrl, "issuer");
-	assertEndpointOrigin(metadata.authorization_endpoint, baseUrl, "authorization endpoint");
-	assertEndpointOrigin(metadata.token_endpoint, baseUrl, "token endpoint");
-	if (metadata.registration_endpoint !== void 0) assertEndpointOrigin(metadata.registration_endpoint, baseUrl, "registration endpoint");
-	if (metadata.revocation_endpoint !== void 0) assertEndpointOrigin(metadata.revocation_endpoint, baseUrl, "revocation endpoint");
-	return metadata;
-}
-async function discoverMetadata(baseUrl) {
-	const metadata = await tryDiscoverMetadata(baseUrl);
-	if (metadata === null) throw new ConfigError(OAUTH_UNSUPPORTED_MESSAGE);
-	return metadata;
-}
-async function registerClient(input) {
-	const response = await oauthFetch({
-		url: input.registrationEndpoint,
-		method: "POST",
-		headers: {
-			"content-type": JSON_CONTENT_TYPE,
-			accept: JSON_CONTENT_TYPE
-		},
-		body: JSON.stringify({
-			application_type: "native",
-			client_name: input.clientName,
-			redirect_uris: [input.redirectUri],
-			grant_types: ["authorization_code", "refresh_token"],
-			response_types: ["code"],
-			token_endpoint_auth_method: "none",
-			scope: OAUTH_SCOPE
-		})
-	});
-	if (!response.ok) throw await failure(response, "OAuth client registration", "POST", input.registrationEndpoint);
-	return readJson(response, RegisteredClient, "OAuth client registration");
-}
-function exchangeCode(input) {
-	return postForm(input.tokenEndpoint, {
-		grant_type: "authorization_code",
-		code: input.code,
-		redirect_uri: input.redirectUri,
-		client_id: input.clientId,
-		code_verifier: input.codeVerifier
-	}, OAuthTokens, "OAuth token exchange");
-}
-function refreshTokens(input) {
-	return postForm(input.tokenEndpoint, {
-		grant_type: "refresh_token",
-		refresh_token: input.refreshToken,
-		client_id: input.clientId
-	}, OAuthTokens, "OAuth token refresh");
-}
-async function revokeToken(input) {
-	const response = await oauthFetch({
-		url: input.revocationEndpoint,
-		method: "POST",
-		headers: { "content-type": FORM_CONTENT_TYPE },
-		body: new URLSearchParams({
-			token: input.token,
-			client_id: input.clientId
-		})
-	});
-	if (!response.ok) throw await failure(response, "OAuth token revocation", "POST", input.revocationEndpoint);
-	await response.body?.cancel().catch(() => void 0);
-}
-
-//#endregion
-//#region src/core/auth/oauth-session.ts
-async function refreshOAuthCredential(baseUrl, credential, nowMs) {
-	const metadata = await discoverMetadata(baseUrl);
-	const tokens = await refreshTokens({
-		tokenEndpoint: metadata.token_endpoint,
-		refreshToken: credential.refreshToken,
-		clientId: credential.clientId
-	});
-	return oauthCredentialFromTokens(tokens, tokens.refresh_token ?? credential.refreshToken, credential.clientId, nowMs);
-}
-async function revokeOAuthCredential(baseUrl, credential) {
-	const metadata = await discoverMetadata(baseUrl);
-	const revocationEndpoint = metadata.revocation_endpoint;
-	if (revocationEndpoint === void 0) return false;
-	await revokeToken({
-		revocationEndpoint,
-		token: credential.refreshToken,
-		clientId: credential.clientId
-	});
-	await revokeToken({
-		revocationEndpoint,
-		token: credential.accessToken,
-		clientId: credential.clientId
-	});
-	return true;
-}
-
-//#endregion
-//#region src/core/config.ts
-function isPreflightSkipped() {
-	return readEnv(ENV_SKIP_PREFLIGHT) === "1";
-}
-function resolveProfileName(profileFlag) {
-	return explicitProfileName(profileFlag) ?? DEFAULT_PROFILE;
-}
-function explicitProfileName(profileFlag) {
-	return profileFlag || readEnv(ENV_PROFILE) || null;
-}
-function readEnvCredentials() {
-	return {
-		url: readEnv(ENV_URL) ?? null,
-		apiKey: readEnv(ENV_API_KEY) ?? null
-	};
-}
-async function resolveConfig(flags) {
-	const profile = resolveProfileName(flags.profile);
-	const env = readEnvCredentials();
-	const hasUrl = Boolean(flags.url ?? env.url);
-	const hasKey = Boolean(flags.apiKey ?? env.apiKey);
-	const stored = hasUrl && hasKey ? null : await readProfileCredential(profile);
-	const url = resolveUrl(flags.url, env.url, stored?.url);
-	const credential = resolveCredential(flags.apiKey, env.apiKey, stored?.credential);
-	if (url === null || credential === null) {
-		const hint = await failureHintForProfile(profile);
-		throw new ConfigError(`Not authenticated for profile "${profile}". Run \`mb auth login\`, set ${ENV_URL}/${ENV_API_KEY}, or pass --url/--api-key.${hint}`);
-	}
-	const normalizedUrl = normalizeUrl(url.value);
-	assertOAuthUrlMatchesIssuer(credential.credential, stored?.url, normalizedUrl, profile);
-	const fresh = await ensureFreshCredential(profile, credential.credential, stored?.url);
-	return {
-		url: normalizedUrl,
-		credential: fresh,
-		profile,
-		source: url.source === credential.source ? url.source : "mixed"
-	};
-}
-function assertOAuthUrlMatchesIssuer(credential, issuerUrl, requestUrl, profile) {
-	if (credential.kind !== "oauth" || issuerUrl === void 0) return;
-	const issuer = normalizeUrl(issuerUrl);
-	if (issuer === requestUrl) return;
-	throw new ConfigError(`profile "${profile}" is a browser-login (OAuth) profile bound to ${issuer}, but the request URL is ${requestUrl}. Drop --url/${ENV_URL} to use the profile's own URL, or run \`mb auth login --url ${requestUrl}\` to authenticate there.`);
-}
-async function ensureFreshCredential(profile, credential, issuerUrl) {
-	if (credential.kind !== "oauth" || issuerUrl === void 0) return credential;
-	if (!isOAuthExpired(credential, Date.now())) return credential;
-	let refreshed;
-	try {
-		refreshed = await refreshOAuthCredential(issuerUrl, credential, Date.now());
-	} catch {
-		return credential;
-	}
-	await persistRefreshed(profile, issuerUrl, refreshed);
-	return refreshed;
-}
-async function refreshAndPersist(profile, issuerUrl, credential) {
-	const refreshed = await refreshOAuthCredential(issuerUrl, credential, Date.now());
-	await persistRefreshed(profile, issuerUrl, refreshed);
-	return refreshed;
-}
-async function persistRefreshed(profile, issuerUrl, refreshed) {
-	await writeOAuthProfile(issuerUrl, refreshed, profile);
-}
-function createCredentialRefresher(profile) {
-	return async () => {
-		const stored = await readProfileCredential(profile);
-		if (stored === null || stored.credential.kind !== "oauth") return null;
-		try {
-			return await refreshAndPersist(profile, stored.url, stored.credential);
-		} catch (error) {
-			if (error instanceof ConfigError) throw new ConfigError(`${error.message} — run \`mb auth login --profile ${profile}\` to log in again`);
-			throw error;
-		}
-	};
-}
-async function failureHintForProfile(profile) {
-	const record = await readProfileRecord(profile);
-	if (record === null || record.lastFailure === null) return "";
-	if (record.lastProbe !== null && record.lastProbe.at >= record.lastFailure.at) return "";
-	return ` profile "${profile}" last verify failed: ${record.lastFailure.reason}. Run \`mb auth login --profile ${profile}\` to update the token.`;
-}
-function resolveUrl(flag, env, stored) {
-	if (flag) return {
-		value: flag,
-		source: "flag"
-	};
-	if (env) return {
-		value: env,
-		source: "env"
-	};
-	if (stored) return {
-		value: stored,
-		source: "stored"
-	};
-	return null;
-}
-function resolveCredential(flagKey, envKey, stored) {
-	if (flagKey) return {
-		credential: {
-			kind: "apiKey",
-			apiKey: flagKey
-		},
-		source: "flag"
-	};
-	if (envKey) return {
-		credential: {
-			kind: "apiKey",
-			apiKey: envKey
-		},
-		source: "env"
-	};
-	if (stored) return {
-		credential: stored,
-		source: "stored"
-	};
-	return null;
-}
-
-//#endregion
-//#region src/core/version/capabilities.ts
-function mergeCapabilities(overrides) {
-	if (overrides === void 0) return BASELINE_CAPABILITIES;
-	return {
-		minVersion: overrides.minVersion ?? BASELINE_CAPABILITIES.minVersion,
-		...overrides.tokenFeature === void 0 ? {} : { tokenFeature: overrides.tokenFeature }
-	};
-}
-function checkCapabilities(info, required) {
-	if (info.version === null) return {
-		reason: "unknown-version",
-		detail: "Could not detect Metabase server version. Proceeding without preflight check; failures may produce confusing errors."
-	};
-	if (info.version.major < required.minVersion) return {
-		reason: "version-too-old",
-		detail: `This command requires Metabase v${required.minVersion}+ (this server is ${info.version.tag}). Upgrade Metabase or pin mb-cli to an older release.`
-	};
-	if (required.tokenFeature !== void 0) {
-		const enabled = info.tokenFeatures?.[required.tokenFeature] === true;
-		if (!enabled) return {
-			reason: "missing-token-feature",
-			detail: `This command requires the '${required.tokenFeature}' premium feature (not enabled on this server).`
-		};
-	}
-	return null;
-}
-
-//#endregion
-//#region src/core/version/preflight-error.ts
-var CapabilityError = class extends MetabaseError {
-	category = "capability";
-	isRetryable = false;
-	exitCode = 2;
-	developerDetail;
-	constructor(failure$1) {
-		super(failure$1.detail);
-		this.name = "CapabilityError";
-		this.developerDetail = failure$1;
-	}
-};
-
-//#endregion
-//#region src/core/version/probe.ts
-const PROBE_PATH = "/api/session/properties";
-const PROBE_TIMEOUT_MS = 1e4;
-async function probeServer(client, opts = {}) {
-	const properties = await client.requestParsed(SessionProperties, PROBE_PATH, {
-		timeoutMs: PROBE_TIMEOUT_MS,
-		retries: opts.retries ?? 0
-	});
-	const version = tryParseTag(properties.version.tag);
-	return {
-		version,
-		tokenFeatures: properties["token-features"] ?? null
-	};
-}
-
-//#endregion
-//#region src/output/format.ts
-function resolveFormat({ json, format, isTty }) {
-	const explicit = format !== void 0 && format !== "auto" ? format : null;
-	if (explicit !== null && explicit !== "json" && explicit !== "text") throw new ConfigError(`invalid --format value: "${explicit}" (expected: auto, json, text)`);
-	if (json && explicit !== null && explicit !== "json") throw new ConfigError(`--json conflicts with --format ${explicit}`);
-	if (json) return "json";
-	if (explicit !== null) return explicit;
-	return isTty ? "text" : "json";
-}
-
-//#endregion
-//#region src/runtime/csv.ts
-function parseCsv(raw) {
-	return raw.split(",").map((part) => part.trim()).filter((part) => part.length > 0);
-}
-function parseEnumCsv(raw, schema, flagName) {
-	if (raw === void 0 || raw === "") return void 0;
-	const parts = parseCsv(raw);
-	if (parts.length === 0) return void 0;
-	const accepted = [];
-	const rejected = [];
-	for (const part of parts) {
-		const result = schema.safeParse(part);
-		if (result.success) accepted.push(result.data);
-		else rejected.push(part);
-	}
-	if (rejected.length > 0) {
-		const allowed = Object.values(schema.enum).join(", ");
-		throw new ConfigError(`invalid ${flagName} value: ${rejected.join(", ")} (expected one of: ${allowed})`);
-	}
-	return accepted;
-}
-function parseEnum(raw, schema, flagName) {
-	if (raw === void 0 || raw === "") return void 0;
-	const result = schema.safeParse(raw);
-	if (!result.success) {
-		const allowed = Object.values(schema.enum).join(", ");
-		throw new ConfigError(`invalid ${flagName} value: "${raw}" (expected one of: ${allowed})`);
-	}
-	return result.data;
-}
-
-//#endregion
-//#region src/commands/context.ts
-function resolveCommonFlags(args, options = {}) {
-	const isTty = options.isTty ?? Boolean(process.stdout.isTTY);
-	const fields = parseFields(args.fields);
-	const full = args.full === true;
-	if (full && fields !== void 0) throw new ConfigError("--full conflicts with --fields (use one or neither)");
-	return {
-		format: resolveFormat({
-			json: args.json,
-			format: args.format,
-			isTty
-		}),
-		full,
-		fields,
-		maxBytes: parseMaxBytes(args.maxBytes),
-		url: args.url,
-		apiKey: args.apiKey,
-		profile: args.profile,
-		skipPreflight: args.skipPreflight === true
-	};
-}
-function parseFields(value) {
-	if (value === void 0 || value === "") return void 0;
-	const parts = parseCsv(value);
-	return parts.length > 0 ? parts : void 0;
-}
-function parseMaxBytes(value) {
-	return parseInteger(value ?? String(DEFAULT_MAX_BYTES), {
-		name: "--max-bytes",
-		min: 0
-	});
-}
-
-//#endregion
-//#region src/commands/known-flags.ts
-const ARGUMENT_SEPARATOR = "--";
-const NEGATION_PREFIX = "no-";
-const BUILTIN_FLAGS = [
-	"help",
-	"h",
-	"version",
-	"v"
-];
-function assertKnownFlags(rawArgs, argsDef) {
-	const allowed = allowedFlagKeys(argsDef);
-	let index = 0;
-	while (index < rawArgs.length) {
-		const token = rawArgs[index];
-		if (token === void 0 || token === ARGUMENT_SEPARATOR) return;
-		if (!isFlagToken(token)) {
-			index += 1;
-			continue;
-		}
-		const matched = flagCandidates(token).some((candidate) => allowed.has(candidate));
-		if (!matched) throw new ConfigError(`unknown flag: ${displayFlag(token)}`);
-		index += flagConsumesValue(token, argsDef) ? 2 : 1;
-	}
-}
-function allowedFlagKeys(argsDef) {
-	const keys = new Set(BUILTIN_FLAGS.map(normalizeFlag));
-	for (const [name, def] of Object.entries(argsDef)) {
-		keys.add(normalizeFlag(name));
-		if ("alias" in def) for (const alias of toAliasArray(def.alias)) keys.add(normalizeFlag(alias));
-	}
-	return keys;
-}
-function isFlagToken(token) {
-	return token.startsWith("-") && token !== "-";
-}
-function displayFlag(token) {
-	const equals = token.indexOf("=");
-	return equals === -1 ? token : token.slice(0, equals);
-}
-function flagCandidates(token) {
-	const name = displayFlag(token).replace(/^-+/, "");
-	const candidates = [normalizeFlag(name)];
-	if (name.startsWith(NEGATION_PREFIX)) candidates.push(normalizeFlag(name.slice(NEGATION_PREFIX.length)));
-	return candidates;
-}
-
-//#endregion
-//#region src/commands/runtime.ts
-function defineMetabaseCommand(def) {
-	const required = def.capabilities === null ? null : mergeCapabilities(def.capabilities);
-	const cmd = defineCommand({
-		meta: def.meta,
-		args: def.args,
-		async run({ args, rawArgs }) {
-			let reportFormat;
-			try {
-				const ctx = resolveCommonFlags(pickCommonArgs(args));
-				reportFormat = ctx.format;
-				assertKnownFlags(rawArgs, def.args);
-				let cachedConfig = null;
-				let cachedClient = null;
-				let cachedServerInfo = null;
-				const getResolvedConfig = async () => {
-					if (cachedConfig === null) cachedConfig = await resolveConfig(buildConfigFlags(ctx));
-					return cachedConfig;
-				};
-				const getServerInfo = () => {
-					if (cachedServerInfo === null) cachedServerInfo = loadServerInfo(getResolvedConfig);
-					return cachedServerInfo;
-				};
-				const rawGetClient = async () => {
-					if (cachedClient === null) {
-						const resolved = await getResolvedConfig();
-						cachedClient = createClient({
-							url: resolved.url,
-							credential: resolved.credential
-						}, {
-							getServerTag: async () => (await getServerInfo())?.version?.tag ?? null,
-							refreshCredential: createCredentialRefresher(resolved.profile)
-						});
-					}
-					return cachedClient;
-				};
-				const enforcePreflight = createPreflightEnforcer(required, getServerInfo, ctx.skipPreflight);
-				const getClient = async () => {
-					const client = await rawGetClient();
-					await enforcePreflight();
-					return client;
-				};
-				try {
-					await def.run({
-						args,
-						ctx,
-						getClient,
-						getResolvedConfig,
-						getServerInfo
-					});
-				} finally {
-					emitPendingWarnings();
-				}
-			} catch (error) {
-				reportError(error, reportFormat);
-			}
-		}
-	});
-	setMetabaseAugment(cmd, {
-		examples: def.examples ?? [],
-		details: def.details ? def.details : null,
-		skills: def.skills ?? [],
-		inputSchema: def.inputSchema ?? null,
-		outputSchema: def.outputSchema ?? null,
-		capabilities: required
-	});
-	return cmd;
-}
-function emitPendingWarnings() {
-	for (const message of consumeLegacyEnvWarnings()) warn(message);
-	const legacy = consumeLegacyStorageWarning();
-	if (legacy !== null) warn(legacy);
-	const downgrade = consumeKeyringDowngradeWarning();
-	if (downgrade !== null) warn(downgrade);
-}
-async function loadServerInfo(getResolvedConfig) {
-	const resolved = await getResolvedConfig();
-	const record = await readProfileRecord(resolved.profile);
-	if (record === null || record.lastProbe === null) return null;
-	return {
-		version: record.lastProbe.version,
-		tokenFeatures: record.lastProbe.tokenFeatures
-	};
-}
-const NO_OP_ENFORCER = async () => {};
-const NO_PROBE_DATA_WARNING = "Could not detect Metabase server version. Proceeding without preflight check; failures may produce confusing errors. Run `mb auth list` (or `mb auth login`) to populate the version cache.";
-function createPreflightEnforcer(required, getServerInfo, skip) {
-	if (required === null || skip || isPreflightSkipped() || isBaseline(required)) return NO_OP_ENFORCER;
-	let done = false;
-	return async () => {
-		if (done) return;
-		done = true;
-		const info = await getServerInfo();
-		if (info === null) {
-			warn(NO_PROBE_DATA_WARNING);
-			return;
-		}
-		const failure$1 = checkCapabilities(info, required);
-		if (failure$1 === null || failure$1.reason === "unknown-version") return;
-		throw new CapabilityError(failure$1);
-	};
-}
-function isBaseline(caps) {
-	return caps.minVersion === BASELINE_CAPABILITIES.minVersion && caps.tokenFeature === void 0;
-}
-function pickCommonArgs(args) {
-	const out = {};
-	if (typeof args["format"] === "string") out.format = args["format"];
-	if (typeof args["json"] === "boolean") out.json = args["json"];
-	if (typeof args["full"] === "boolean") out.full = args["full"];
-	if (typeof args["fields"] === "string") out.fields = args["fields"];
-	if (typeof args["maxBytes"] === "string") out.maxBytes = args["maxBytes"];
-	if (typeof args["profile"] === "string") out.profile = args["profile"];
-	if (typeof args["url"] === "string") out.url = args["url"];
-	if (typeof args["apiKey"] === "string") out.apiKey = args["apiKey"];
-	if (typeof args["skipPreflight"] === "boolean") out.skipPreflight = args["skipPreflight"];
-	return out;
-}
-function buildConfigFlags(ctx) {
-	const flags = {};
-	if (ctx.profile !== void 0) flags.profile = ctx.profile;
-	if (ctx.url !== void 0) flags.url = ctx.url;
-	if (ctx.apiKey !== void 0) flags.apiKey = ctx.apiKey;
-	return flags;
-}
-
-//#endregion
-export { DEFAULT_PROFILE, HttpError, OAUTH_SCOPE, ParsedVersionSchema, ProbedUser, ProfileAuthMethod, ProfileLastFailure, TokenFeatures, USER_AGENT, clearProfile, combineAborts, consumeKeychainResidualWarning, consumeKeyringDowngradeWarning, createClient, createCredentialRefresher, defineMetabaseCommand, discoverMetadata, displayUrl, exchangeCode, explicitProfileName, keyringFallbackWarning, listProfileRecords, normalizeUrl, oauthCredentialFromTokens, parseCsv, parseEnum, parseEnumCsv, parseInteger, parseJson, parseJsonOrPlain, parseOptionalInteger, probeServer, profileAuthMethod, readEnvCredentials, readProfileCredential, readProfileRecord, registerClient, resolveProfileName, resolveRecordCredential, revokeOAuthCredential, throwIfAborted, tryDiscoverMetadata, writeOAuthProfile, writeProbeFailure, writeProbeResult, writeProfile };