@metabase/cli 0.3.0 → 0.3.1-alpha.versioning.9ac5f50

package/dist/{runtime-DiKyBxOw.mjs → runtime-BQiGgbgZ.mjs}

@@ -1,9 +1,6 @@
-import { d as ValidationError, f as errorMessage, i as ConfigError, l as TimeoutError, o as MetabaseError, p as isFileNotFoundError } from "./predicates-Bkm2IoeX.mjs";
-import { B as normalizeFlag, D as consumeLegacyEnvWarnings, E as ENV_URL, O as readEnv, S as ENV_DISABLE_KEYRING, T as ENV_SKIP_PREFLIGHT, V as toAliasArray, a as reportError, b as warn, i as mergeCapabilities, j as version, k as setMetabaseAugment, n as BASELINE_CAPABILITIES, r as checkCapabilities, t as interruptSignal, x as ENV_API_KEY, z as flagConsumesValue } from "./cli.mjs";
-import { _ as parseJsonResult, a as isRetryableStatus, c as normalizeUrl, f as isOAuthExpired, m as JSON_CONTENT_TYPE, o as assertEndpointOrigin, p as oauthCredentialFromTokens, r as HttpError, t as buildNetworkError } from "./network-error-CEb9ymDW.mjs";
+import { $ as ValidationError, A as setMetabaseAugment, C as ENV_DISABLE_KEYRING, D as ENV_URL, E as ENV_SKIP_PREFLIGHT, G as ChainedRequestError, H as normalizeFlag, J as MetabaseError, K as ConfigError, M as version, O as consumeLegacyEnvWarnings, S as ENV_API_KEY, U as toAliasArray, V as flagConsumesValue, X as ResponseShapeError, Y as NetworkError, Z as TimeoutError, at as featureGap, ct as editionFromTag, dt as FEATURE_RULES, et as errorMessage, ft as Features, h as isPlainObject, ht as TokenFeatures, i as reportError, it as createServerProfile, k as readEnv, lt as tryParseTag, mt as SessionProperties, n as methodRequirements, nt as KNOWN_RANGE, ot as Edition, r as summarizeCapabilities, rt as Skew, st as ParsedVersion, t as interruptSignal, tt as isFileNotFoundError, ut as FEATURE_NAMES, x as warn } from "./cli.mjs";
 import { defineCommand } from "citty";
 import { z } from "zod";
-import { parse } from "semver";
 import { Entry } from "@napi-rs/keyring";
 import { promises } from "node:fs";
 import { dirname, join } from "node:path";
@@ -23,6 +20,21 @@ function parseOptionalInteger(value, options) {
 }
 //#endregion
 //#region ../client/src/version/preflight-error.ts
+const RequirementReason = z.enum(["version-too-old", "missing-token-feature"]);
+const RequirementFailure = z.object({
+	reason: RequirementReason,
+	detail: z.string(),
+	feature: z.enum(FEATURE_NAMES),
+	since: z.number().int(),
+	tokenFeature: z.string().nullable(),
+	serverVersion: z.string().nullable()
+});
+function versionTooOldMessage(since, serverVersion) {
+	return `This operation requires Metabase v${since}+ (${serverVersion === null ? "this server's version is unknown" : `this server is ${serverVersion}`}). Upgrade Metabase to use it.`;
+}
+function missingTokenFeatureMessage(tokenFeature) {
+	return `This operation requires the '${tokenFeature}' premium feature (not enabled on this server).`;
+}
 var CapabilityError = class extends MetabaseError {
 	category = "capability";
 	isRetryable = false;
@@ -34,36 +46,750 @@ var CapabilityError = class extends MetabaseError {
 	}
 };
 //#endregion
-//#region ../client/src/domain/session-properties.ts
-const ServerVersion = z.object({
-	tag: z.string(),
-	date: z.string().optional(),
-	hash: z.string().optional()
+//#region ../client/src/version/probe.ts
+const PROBE_PATH = "/api/session/properties";
+const PROBE_TIMEOUT_MS = 1e4;
+async function probeServer(client, opts = {}) {
+	const properties = await client.requestParsed(SessionProperties, PROBE_PATH, {
+		timeoutMs: PROBE_TIMEOUT_MS,
+		retries: opts.retries ?? 0
+	});
+	const { tag } = properties.version;
+	return {
+		version: tryParseTag(tag),
+		edition: editionFromTag(tag),
+		date: properties.version.date ?? null,
+		hash: properties.version.hash ?? null,
+		tokenFeatures: properties["token-features"] ?? null
+	};
+}
+//#endregion
+//#region ../client/src/version/requirement-check.ts
+/** The first feature a method needs that the profile lacks, or `null` when it may proceed. */
+function checkRequirements(key, profile) {
+	return checkFeatures(methodRequirements(key), profile);
+}
+/** The first of `features` the profile lacks, or `null` when it has every one. */
+function checkFeatures(features, profile) {
+	for (const feature of features) {
+		const gap = featureGap(profile, feature);
+		if (gap !== null) return describeGap(gap, feature, profile);
+	}
+	return null;
+}
+function describeGap(gap, feature, profile) {
+	const rule = FEATURE_RULES[feature];
+	const serverVersion = profile.version === null ? null : profile.version.tag;
+	const tokenFeature = rule.tokenFeature ?? null;
+	if (gap.kind === "token") return {
+		reason: "missing-token-feature",
+		detail: missingTokenFeatureMessage(gap.tokenFeature),
+		feature,
+		since: rule.since,
+		tokenFeature,
+		serverVersion
+	};
+	return {
+		reason: "version-too-old",
+		detail: versionTooOldMessage(rule.since, serverVersion),
+		feature,
+		since: rule.since,
+		tokenFeature,
+		serverVersion
+	};
+}
+//#endregion
+//#region src/core/auth/server-summary.ts
+const KnownRange = z.object({
+	min: z.number().int(),
+	max: z.number().int()
+});
+const ServerSummary = z.object({
+	version: ParsedVersion.nullable(),
+	edition: Edition.nullable(),
+	skew: Skew.nullable(),
+	knownRange: KnownRange,
+	tokenFeatures: TokenFeatures.nullable(),
+	features: Features.nullable()
+});
+function summarizeServer(info) {
+	if (info === null) return {
+		version: null,
+		edition: null,
+		skew: null,
+		knownRange: KNOWN_RANGE,
+		tokenFeatures: null,
+		features: null
+	};
+	const profile = createServerProfile(info);
+	return {
+		version: profile.version,
+		edition: profile.edition,
+		skew: profile.skew,
+		knownRange: KNOWN_RANGE,
+		tokenFeatures: profile.tokenFeatures,
+		features: profile.features
+	};
+}
+const UNPARSEABLE_VERSION_LABEL = "an unparseable version";
+function versionLabel(version) {
+	return version === null ? UNPARSEABLE_VERSION_LABEL : version.tag;
+}
+function skewNotice(profile) {
+	const max = KNOWN_RANGE.max;
+	switch (profile.skew) {
+		case "supported": return null;
+		case "newer-than-known": return `Metabase ${versionLabel(profile.version)} is newer than this CLI supports (up to v${max}); commands run as if it were a head build past v${max}. Run \`mb upgrade\` for a newer CLI.`;
+		case "unknown": return `Could not parse the Metabase version; assuming a head build past v${max}.`;
+	}
+}
+const PROFILE_REFRESHED_REMEDY = "the profile was refreshed — retry the command.";
+function serverChangeNote(cached, fresh) {
+	const before = versionLabel(cached.version);
+	const after = versionLabel(fresh.version);
+	if (before !== after) return `The server's version changed since the last probe (was ${before}, now ${after}); ${PROFILE_REFRESHED_REMEDY}`;
+	if (!sameTokenFeatures(cached.tokenFeatures, fresh.tokenFeatures)) return `The server's premium features changed since the last probe; ${PROFILE_REFRESHED_REMEDY}`;
+	return null;
+}
+function sameTokenFeatures(a, b) {
+	const grantedA = grantedFeatures(a);
+	const grantedB = grantedFeatures(b);
+	return grantedA.length === grantedB.length && grantedA.every((key, i) => key === grantedB[i]);
+}
+function grantedFeatures(features) {
+	if (features === null) return [];
+	return Object.keys(features).filter((key) => features[key] === true).toSorted();
+}
+//#endregion
+//#region ../client/src/url.ts
+function normalizeUrl(input) {
+	const trimmed = input.trim().replace(/\/+$/, "");
+	if (!/^https?:\/\//i.test(trimmed)) throw new ConfigError("URL must start with http:// or https://");
+	return trimmed;
+}
+function displayUrl(input) {
+	const parsed = new URL(input);
+	const path = parsed.pathname.replace(/\/+$/, "");
+	return `${parsed.origin}${path}`;
+}
+const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"::1",
+	"[::1]"
+]);
+function isLoopbackHost(hostname) {
+	return LOOPBACK_HOSTS.has(hostname.toLowerCase());
+}
+function assertEndpointOrigin(endpoint, baseUrl, label) {
+	let parsed;
+	try {
+		parsed = new URL(endpoint);
+	} catch {
+		throw new ConfigError(`OAuth ${label} is not a valid URL: ${endpoint}`);
+	}
+	const base = new URL(baseUrl);
+	if (parsed.protocol !== "https:" && !isLoopbackHost(parsed.hostname)) throw new ConfigError(`OAuth ${label} must use https: ${endpoint}`);
+	if (parsed.origin !== base.origin) throw new ConfigError(`OAuth ${label} origin (${parsed.origin}) does not match the Metabase URL (${base.origin})`);
+}
+//#endregion
+//#region ../client/src/auth/credential.ts
+const API_KEY_HEADER = "x-api-key";
+const AUTHORIZATION_HEADER = "authorization";
+const BEARER_PREFIX = "Bearer ";
+const EXPIRY_SKEW_MS = 6e4;
+function credentialAuthHeader(credential) {
+	if (credential.kind === "apiKey") return {
+		name: API_KEY_HEADER,
+		value: credential.apiKey
+	};
+	return {
+		name: AUTHORIZATION_HEADER,
+		value: BEARER_PREFIX + credential.accessToken
+	};
+}
+const MAX_HEADER_CODE_UNIT = 255;
+function headerBearingSecret(credential) {
+	if (credential.kind === "apiKey") return {
+		field: "apiKey",
+		value: credential.apiKey
+	};
+	return {
+		field: "accessToken",
+		value: credential.accessToken
+	};
+}
+function assertCredentialHeaderSafe(credential) {
+	const { field, value } = headerBearingSecret(credential);
+	for (let index = 0; index < value.length; index += 1) {
+		const codeUnit = value.charCodeAt(index);
+		if (codeUnit > MAX_HEADER_CODE_UNIT) {
+			const codePoint = codeUnit.toString(16).toUpperCase().padStart(4, "0");
+			throw new ConfigError(`Credential field "${field}" has a character at index ${index} (U+${codePoint}) that cannot be sent in an HTTP header. Header values are limited to Latin-1; a smart quote, ellipsis, or dash substituted during copy-paste is the usual cause.`);
+		}
+	}
+}
+function credentialSecrets(credential) {
+	if (credential.kind === "apiKey") return [credential.apiKey];
+	return [credential.accessToken, credential.refreshToken];
+}
+function isOAuthExpired(credential, nowMs) {
+	const expiryMs = Date.parse(credential.expiresAt);
+	if (Number.isNaN(expiryMs)) return true;
+	return expiryMs - EXPIRY_SKEW_MS <= nowMs;
+}
+function expiresAtFromNow(expiresInSeconds, nowMs) {
+	return new Date(nowMs + expiresInSeconds * 1e3).toISOString();
+}
+function oauthCredentialFromTokens(tokens, refreshToken, clientId, nowMs) {
+	return {
+		kind: "oauth",
+		accessToken: tokens.access_token,
+		refreshToken,
+		expiresAt: expiresAtFromNow(tokens.expires_in ?? 3600, nowMs),
+		clientId
+	};
+}
+//#endregion
+//#region ../client/src/json.ts
+const JSON_CONTENT_TYPE = "application/json";
+function parseJson(input, schema, opts = {}) {
+	const result = parseJsonResult(input, schema, opts);
+	if (!result.ok) throw result.error;
+	return result.value;
+}
+function parseJsonResult(input, schema, opts = {}) {
+	const sourcePrefix = opts.source === void 0 ? "" : `${opts.source}: `;
+	let raw;
+	try {
+		raw = JSON.parse(input);
+	} catch (error) {
+		return {
+			ok: false,
+			error: new ConfigError(`${sourcePrefix}invalid JSON: ${errorMessage(error)}`)
+		};
+	}
+	const parsed = schema.safeParse(raw);
+	if (!parsed.success) return {
+		ok: false,
+		error: new ValidationError(`${sourcePrefix}value did not match expected schema`, {
+			source: opts.source ?? "<input>",
+			zodIssues: parsed.error.issues
+		})
+	};
+	return {
+		ok: true,
+		value: parsed.data
+	};
+}
+function parseJsonOrPlain(text, contentType, schema, opts = {}) {
+	if (!isJsonContentType(contentType)) return parseJson(JSON.stringify(text), schema, opts);
+	const attempt = parseJsonResult(text, schema, opts);
+	if (attempt.ok) return attempt.value;
+	if (attempt.error instanceof ValidationError) throw attempt.error;
+	return parseJson(JSON.stringify(text), schema, opts);
+}
+function isJsonContentType(contentType) {
+	return contentType !== null && contentType.includes("application/json");
+}
+//#endregion
+//#region ../client/src/http/sanitize.ts
+const SECRET_HEADER_NAMES = /* @__PURE__ */ new Set([
+	"authorization",
+	"x-api-key",
+	"x-metabase-session",
+	"cookie",
+	"set-cookie",
+	"proxy-authorization"
+]);
+const REDACTED = "[REDACTED]";
+function redactHeaders(headers) {
+	const result = {};
+	const entries = headers instanceof Headers ? headers.entries() : Object.entries(headers);
+	for (const [key, value] of entries) result[key] = SECRET_HEADER_NAMES.has(key.toLowerCase()) ? REDACTED : value;
+	return result;
+}
+function redactBody(body, ctx) {
+	let result = body;
+	for (const secret of ctx.knownSecrets) {
+		if (secret.length === 0) continue;
+		result = result.replaceAll(secret, REDACTED);
+	}
+	return result;
+}
+//#endregion
+//#region ../client/src/http/errors.ts
+const NOT_FOUND_STATUS = 404;
+const TEXT_CONTENT_TYPE = "text/plain";
+const ROUTE_MISSING_LITERAL = "API endpoint does not exist.";
+const RESOURCE_MISSING_LITERAL = "Not found.";
+const STATUS_CLASSIFICATIONS = {
+	401: { retryable: false },
+	403: { retryable: false },
+	404: { retryable: false },
+	408: {
+		retryable: true,
+		message: "Metabase timed out responding."
+	},
+	425: { retryable: true },
+	429: {
+		retryable: true,
+		message: "Metabase rate-limited the request."
+	},
+	500: { retryable: true },
+	502: { retryable: true },
+	503: { retryable: true },
+	504: {
+		retryable: true,
+		message: "Metabase timed out responding."
+	}
+};
+const ErrorEnvelope = z.object({
+	message: z.string().optional(),
+	error: z.string().optional(),
+	"error-message": z.string().optional(),
+	via: z.array(z.object({ message: z.string().optional() }).loose()).optional(),
+	"specific-errors": z.unknown().optional(),
+	errors: z.unknown().optional()
+}).loose();
+const FieldErrorNodeSchema = z.lazy(() => z.union([
+	z.string(),
+	z.array(z.string()),
+	z.record(z.string(), FieldErrorNodeSchema)
+]));
+const FieldErrorTree = z.record(z.string(), FieldErrorNodeSchema);
+const FIELD_MESSAGE_SEPARATOR = "; ";
+const MAX_EXTRACTED_MESSAGE_LEN = 500;
+const ELLIPSIS = "…";
+var HttpError = class extends MetabaseError {
+	category = "http";
+	status;
+	kind;
+	developerDetail;
+	constructor(input) {
+		const sanitizedBody = sanitizeBody(input.rawBody, input.redactionContext);
+		const redactedHeaders = redactHeaders(input.responseHeaders);
+		const kind = classifyKind(input.status, sanitizedBody, redactedHeaders);
+		super(input.overrideUserMessage ?? buildUserMessage(kind, input, sanitizedBody, redactedHeaders));
+		const fields = extractFieldErrors(sanitizedBody);
+		this.name = "HttpError";
+		this.status = input.status;
+		this.kind = kind;
+		this.developerDetail = {
+			status: input.status,
+			statusText: input.statusText,
+			method: input.method,
+			url: input.url,
+			responseHeaders: redactedHeaders,
+			body: sanitizedBody,
+			fieldErrors: fields.fieldErrors,
+			specificFieldErrors: fields.specificFieldErrors
+		};
+	}
+	get isRetryable() {
+		return isRetryableStatus(this.status);
+	}
+	get fieldErrors() {
+		return this.developerDetail.fieldErrors;
+	}
+	get specificFieldErrors() {
+		return this.developerDetail.specificFieldErrors;
+	}
+};
+function chainRequestFailure(cause, message) {
+	if (cause instanceof HttpError) return new HttpError({
+		status: cause.status,
+		statusText: cause.developerDetail.statusText,
+		method: cause.developerDetail.method,
+		url: cause.developerDetail.url,
+		responseHeaders: cause.developerDetail.responseHeaders,
+		rawBody: cause.developerDetail.body,
+		overrideUserMessage: message
+	});
+	return new ChainedRequestError(message, cause);
+}
+function isRetryableStatus(status) {
+	return STATUS_CLASSIFICATIONS[status]?.retryable === true;
+}
+function sanitizeBody(rawBody, ctx) {
+	if (rawBody === null) return null;
+	if (ctx === void 0) return rawBody;
+	return redactBody(rawBody, ctx);
+}
+function classifyKind(status, sanitizedBody, redactedHeaders) {
+	if (status === 401 || status === 403) return "auth";
+	if (status === NOT_FOUND_STATUS) return isRouteMissingResponse(sanitizedBody, redactedHeaders) ? "route-missing" : "resource-missing";
+	if (status === 429) return "rate-limit";
+	if (status >= 500 && status < 600) return "server-error";
+	return "generic";
+}
+function isRouteMissingResponse(sanitizedBody, redactedHeaders) {
+	if (sanitizedBody?.includes(ROUTE_MISSING_LITERAL)) return true;
+	if (sanitizedBody?.includes(RESOURCE_MISSING_LITERAL)) return false;
+	if (redactedHeaders["content-type"]?.includes("application/json")) return false;
+	if (sanitizedBody === null || sanitizedBody.trim() === "") return true;
+	return parseEnvelope(sanitizedBody) === null;
+}
+function buildUserMessage(kind, input, sanitizedBody, redactedHeaders) {
+	if (kind === "route-missing") return buildRouteMissingMessage(input);
+	if (kind === "resource-missing") return `Not found: ${input.method} ${pathFromUrl(input.url)}.`;
+	const fromBody = parseEnvelopeMessage(sanitizedBody);
+	if (fromBody !== null) return fromBody;
+	if (kind === "auth") return `Invalid or unauthorized API key (host: ${hostFromUrl(input.url)}).`;
+	const fromText = plainTextMessage(sanitizedBody, redactedHeaders);
+	if (fromText !== null) return fromText;
+	return defaultMessageForStatus(input.status);
+}
+function plainTextMessage(sanitizedBody, redactedHeaders) {
+	if (sanitizedBody === null || !redactedHeaders["content-type"]?.includes(TEXT_CONTENT_TYPE)) return null;
+	const trimmed = sanitizedBody.trim();
+	return trimmed === "" ? null : capLength(trimmed);
+}
+function buildRouteMissingMessage(input) {
+	const path = pathFromUrl(input.url);
+	if (!input.serverTag) return `This endpoint is not available on the connected Metabase: ${input.method} ${path}.`;
+	return `This endpoint is not available on Metabase ${input.serverTag}: ${input.method} ${path}. It may require a newer Metabase major version.`;
+}
+function pathFromUrl(url) {
+	const parsed = new URL(url);
+	return parsed.pathname + parsed.search;
+}
+function hostFromUrl(url) {
+	return new URL(url).host;
+}
+function parseEnvelope(sanitizedBody) {
+	if (!sanitizedBody) return null;
+	const result = parseJsonResult(sanitizedBody, ErrorEnvelope);
+	return result.ok ? result.value : null;
+}
+const NO_FIELD_ERRORS = {
+	fieldErrors: null,
+	specificFieldErrors: null
+};
+function extractFieldErrors(sanitizedBody) {
+	const envelope = parseEnvelope(sanitizedBody);
+	if (envelope === null) return NO_FIELD_ERRORS;
+	return {
+		fieldErrors: parseFieldErrors(envelope.errors),
+		specificFieldErrors: parseFieldErrors(envelope["specific-errors"])
+	};
+}
+function parseFieldErrors(value) {
+	const parsed = FieldErrorTree.safeParse(value);
+	if (!parsed.success) return null;
+	const entries = collectLeafEntries(parsed.data, []);
+	if (entries.length === 0) return null;
+	return Object.fromEntries(entries.map((entry) => [entry.path, entry.message]));
+}
+function parseEnvelopeMessage(sanitizedBody) {
+	const envelope = parseEnvelope(sanitizedBody);
+	if (envelope === null) return null;
+	const topLevel = envelope.message ?? envelope.error ?? envelope["error-message"];
+	if (topLevel) return capLength(topLevel);
+	const viaMessage = envelope.via?.find((entry) => entry.message)?.message;
+	if (viaMessage) return capLength(viaMessage);
+	const specific = formatErrorTree(envelope["specific-errors"]);
+	if (specific) return capLength(specific);
+	const generic = formatErrorTree(envelope.errors);
+	if (generic) return capLength(generic);
+	return null;
+}
+function formatErrorTree(value) {
+	const entries = collectLeafEntries(value, []);
+	if (entries.length === 0) return null;
+	return entries.map(formatLeafEntry).join(FIELD_MESSAGE_SEPARATOR);
+}
+function formatLeafEntry(entry) {
+	return entry.path === "" ? entry.message : `${entry.path}: ${entry.message}`;
+}
+function collectLeafEntries(value, path) {
+	if (typeof value === "string") {
+		const trimmed = value.trim();
+		return trimmed === "" ? [] : [{
+			path: path.join("."),
+			message: trimmed
+		}];
+	}
+	if (Array.isArray(value)) {
+		const messages = value.filter((entry) => typeof entry === "string" && entry.trim() !== "");
+		if (messages.length === 0) return [];
+		return [{
+			path: path.join("."),
+			message: messages.join(FIELD_MESSAGE_SEPARATOR)
+		}];
+	}
+	if (isPlainObject(value)) return Object.entries(value).flatMap(([key, child]) => collectLeafEntries(child, [...path, key]));
+	return [];
+}
+function capLength(message) {
+	if (message.length <= MAX_EXTRACTED_MESSAGE_LEN) return message;
+	return message.slice(0, MAX_EXTRACTED_MESSAGE_LEN - 1) + ELLIPSIS;
+}
+function defaultMessageForStatus(status) {
+	return STATUS_CLASSIFICATIONS[status]?.message ?? `Metabase returned ${status}.`;
+}
+//#endregion
+//#region ../client/src/http/network-error.ts
+const NETWORK_HINTS = {
+	ECONNREFUSED: (t) => `Connection refused by ${t.host} — is Metabase running and is the port correct?`,
+	ENOTFOUND: (t) => `Host not found: ${t.hostname} — check the URL.`,
+	EAI_AGAIN: (t) => `Could not resolve ${t.hostname} — check your network connection and the URL.`,
+	ECONNRESET: (t) => `Connection to ${t.host} was reset — the server may have closed it, or http/https may be mismatched.`,
+	UND_ERR_SOCKET: (t) => `Connection to ${t.host} was closed by the other side — a pooled connection or a proxy may have dropped it.`,
+	EPIPE: (t) => `Connection to ${t.host} closed while the request was still being written — the server or a proxy dropped it.`,
+	ETIMEDOUT: (t) => `Connection to ${t.host} timed out — check the host, port, and your network.`
+};
+const CONNECTION_CLOSED_CODES = /* @__PURE__ */ new Set([
+	"ECONNRESET",
+	"UND_ERR_SOCKET",
+	"EPIPE"
+]);
+const TLS_ERROR_CODES = /* @__PURE__ */ new Set([
+	"EPROTO",
+	"DEPTH_ZERO_SELF_SIGNED_CERT",
+	"SELF_SIGNED_CERT_IN_CHAIN",
+	"UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+	"CERT_HAS_EXPIRED",
+	"ERR_TLS_CERT_ALTNAME_INVALID"
+]);
+function buildNetworkError(error, method, url) {
+	const fallback = errorMessage(error);
+	const code = failureCode(error);
+	return new NetworkError(networkMessage(code, networkTarget(url), fallback), {
+		method,
+		url,
+		cause: code ?? fallback
+	});
+}
+function isConnectionClosed(error) {
+	const code = failureCode(error);
+	return code !== null && CONNECTION_CLOSED_CODES.has(code);
+}
+function networkMessage(code, target, fallback) {
+	if (code === null) return `Could not reach Metabase: ${fallback}`;
+	if (TLS_ERROR_CODES.has(code)) return `Could not reach Metabase: TLS error contacting ${target.host} (${code}) — the certificate could not be verified, or https:// was used against a plain-HTTP server. For a certificate the OS does not trust either, set NODE_EXTRA_CA_CERTS to its CA bundle.`;
+	const hint = NETWORK_HINTS[code];
+	if (hint === void 0) return `Could not reach Metabase: ${fallback} (${code})`;
+	return `Could not reach Metabase: ${hint(target)}`;
+}
+function failureCode(error) {
+	const own = errorCode(error);
+	if (own !== null) return own;
+	return errorCode(error instanceof Error ? error.cause : void 0);
+}
+function errorCode(value) {
+	if (value instanceof Error && "code" in value && typeof value.code === "string") return value.code;
+	return null;
+}
+function networkTarget(url) {
+	const parsed = new URL(url);
+	return {
+		host: parsed.host,
+		hostname: parsed.hostname
+	};
+}
+//#endregion
+//#region ../client/src/http/oauth.ts
+const DISCOVERY_PATH = "/.well-known/oauth-authorization-server";
+const FORM_CONTENT_TYPE = "application/x-www-form-urlencoded";
+const OAUTH_TIMEOUT_MS = 3e4;
+async function oauthFetch(request) {
+	const timeoutSignal = AbortSignal.timeout(OAUTH_TIMEOUT_MS);
+	try {
+		return await fetch(request.url, {
+			method: request.method,
+			headers: {
+				...request.headers,
+				"user-agent": request.userAgent
+			},
+			...request.body !== void 0 ? { body: request.body } : {},
+			signal: timeoutSignal
+		});
+	} catch (error) {
+		if (timeoutSignal.aborted) throw new TimeoutError(`OAuth request timed out after ${OAUTH_TIMEOUT_MS}ms`, {
+			kind: "http",
+			method: request.method,
+			url: request.url,
+			timeoutMs: OAUTH_TIMEOUT_MS
+		});
+		throw buildNetworkError(error, request.method, request.url);
+	}
+}
+const OAUTH_SCOPE = "mb:full";
+const OAuthServerMetadata = z.object({
+	issuer: z.string(),
+	authorization_endpoint: z.string(),
+	token_endpoint: z.string(),
+	registration_endpoint: z.string().optional(),
+	revocation_endpoint: z.string().optional(),
+	scopes_supported: z.array(z.string()).optional()
 }).loose();
-const TokenFeatures = z.record(z.string(), z.boolean());
-const SessionProperties = z.object({
-	version: ServerVersion,
-	"token-features": TokenFeatures.optional()
+const RegisteredClient = z.object({ client_id: z.string() }).loose();
+const OAuthTokens = z.object({
+	access_token: z.string(),
+	token_type: z.string(),
+	expires_in: z.number().int().optional(),
+	refresh_token: z.string().optional()
 }).loose();
+const OAuthErrorBody = z.object({
+	error: z.string(),
+	error_description: z.string().optional()
+}).loose();
+async function readJson(response, schema, source) {
+	let raw;
+	try {
+		raw = await response.json();
+	} catch (error) {
+		throw new ConfigError(`${source}: invalid JSON response (${errorMessage(error)})`);
+	}
+	const parsed = schema.safeParse(raw);
+	if (!parsed.success) throw new ConfigError(`${source}: unexpected response shape`);
+	return parsed.data;
+}
+async function failure(response, source, method, url) {
+	const rawBody = await response.text().catch(() => "");
+	if (isRetryableStatus(response.status)) return new HttpError({
+		status: response.status,
+		statusText: response.statusText,
+		method,
+		url,
+		responseHeaders: response.headers,
+		rawBody
+	});
+	const parsed = parseJsonResult(rawBody, OAuthErrorBody);
+	if (parsed.ok) {
+		const detail = parsed.value.error_description ?? parsed.value.error;
+		return new ConfigError(`${source} failed (${response.status}): ${detail}`);
+	}
+	return new ConfigError(`${source} failed (${response.status})`);
+}
+async function postForm(url, userAgent, params, schema, source) {
+	const response = await oauthFetch({
+		url,
+		method: "POST",
+		userAgent,
+		headers: {
+			"content-type": FORM_CONTENT_TYPE,
+			accept: JSON_CONTENT_TYPE
+		},
+		body: new URLSearchParams(params)
+	});
+	if (!response.ok) throw await failure(response, source, "POST", url);
+	return readJson(response, schema, source);
+}
+const OAUTH_UNSUPPORTED_MESSAGE = "this Metabase does not support OAuth login (requires Metabase v63 or newer)";
+async function tryDiscoverMetadata(baseUrl, userAgent) {
+	const response = await oauthFetch({
+		url: `${baseUrl}${DISCOVERY_PATH}`,
+		method: "GET",
+		userAgent,
+		headers: { accept: JSON_CONTENT_TYPE }
+	});
+	const contentType = response.headers.get("content-type") ?? "";
+	if (!response.ok || !contentType.includes("json")) {
+		await response.body?.cancel().catch(() => void 0);
+		return null;
+	}
+	const metadata = await readJson(response, OAuthServerMetadata, "OAuth discovery");
+	const scopes = metadata.scopes_supported;
+	if (scopes !== void 0 && !scopes.includes("mb:full")) return null;
+	assertEndpointOrigin(metadata.issuer, baseUrl, "issuer");
+	assertEndpointOrigin(metadata.authorization_endpoint, baseUrl, "authorization endpoint");
+	assertEndpointOrigin(metadata.token_endpoint, baseUrl, "token endpoint");
+	if (metadata.registration_endpoint !== void 0) assertEndpointOrigin(metadata.registration_endpoint, baseUrl, "registration endpoint");
+	if (metadata.revocation_endpoint !== void 0) assertEndpointOrigin(metadata.revocation_endpoint, baseUrl, "revocation endpoint");
+	return metadata;
+}
+async function discoverMetadata(baseUrl, userAgent) {
+	const metadata = await tryDiscoverMetadata(baseUrl, userAgent);
+	if (metadata === null) throw new ConfigError(OAUTH_UNSUPPORTED_MESSAGE);
+	return metadata;
+}
+async function registerClient(input) {
+	const response = await oauthFetch({
+		url: input.registrationEndpoint,
+		method: "POST",
+		userAgent: input.userAgent,
+		headers: {
+			"content-type": JSON_CONTENT_TYPE,
+			accept: JSON_CONTENT_TYPE
+		},
+		body: JSON.stringify({
+			application_type: "native",
+			client_name: input.clientName,
+			redirect_uris: [input.redirectUri],
+			grant_types: ["authorization_code", "refresh_token"],
+			response_types: ["code"],
+			token_endpoint_auth_method: "none",
+			scope: OAUTH_SCOPE
+		})
+	});
+	if (!response.ok) throw await failure(response, "OAuth client registration", "POST", input.registrationEndpoint);
+	return readJson(response, RegisteredClient, "OAuth client registration");
+}
+function exchangeCode(input) {
+	return postForm(input.tokenEndpoint, input.userAgent, {
+		grant_type: "authorization_code",
+		code: input.code,
+		redirect_uri: input.redirectUri,
+		client_id: input.clientId,
+		code_verifier: input.codeVerifier
+	}, OAuthTokens, "OAuth token exchange");
+}
+function refreshTokens(input) {
+	return postForm(input.tokenEndpoint, input.userAgent, {
+		grant_type: "refresh_token",
+		refresh_token: input.refreshToken,
+		client_id: input.clientId
+	}, OAuthTokens, "OAuth token refresh");
+}
+async function revokeToken(input) {
+	const response = await oauthFetch({
+		url: input.revocationEndpoint,
+		method: "POST",
+		userAgent: input.userAgent,
+		headers: { "content-type": FORM_CONTENT_TYPE },
+		body: new URLSearchParams({
+			token: input.token,
+			client_id: input.clientId
+		})
+	});
+	if (!response.ok) throw await failure(response, "OAuth token revocation", "POST", input.revocationEndpoint);
+	await response.body?.cancel().catch(() => void 0);
+}
 //#endregion
-//#region ../client/src/version/tag.ts
-const ParsedVersion = z.object({
-	tag: z.string(),
-	major: z.number().int().nonnegative(),
-	patch: z.number().int().nonnegative()
-});
-const DEV_BUILD_SUFFIX = "-SNAPSHOT";
-function tryParseTag(tag) {
-	if (tag.endsWith(DEV_BUILD_SUFFIX)) return null;
-	const parsed = parse(tag);
-	if (parsed === null || parsed.major !== 0 && parsed.major !== 1) return null;
-	return {
-		tag,
-		major: parsed.minor,
-		patch: parsed.patch
-	};
+//#region ../client/src/auth/oauth-session.ts
+async function refreshOAuthCredential(baseUrl, credential, nowMs, userAgent) {
+	const tokens = await refreshTokens({
+		tokenEndpoint: (await discoverMetadata(baseUrl, userAgent)).token_endpoint,
+		refreshToken: credential.refreshToken,
+		clientId: credential.clientId,
+		userAgent
+	});
+	return oauthCredentialFromTokens(tokens, tokens.refresh_token ?? credential.refreshToken, credential.clientId, nowMs);
+}
+async function revokeOAuthCredential(baseUrl, credential, userAgent) {
+	const revocationEndpoint = (await discoverMetadata(baseUrl, userAgent)).revocation_endpoint;
+	if (revocationEndpoint === void 0) return false;
+	await revokeToken({
+		revocationEndpoint,
+		token: credential.refreshToken,
+		clientId: credential.clientId,
+		userAgent
+	});
+	await revokeToken({
+		revocationEndpoint,
+		token: credential.accessToken,
+		clientId: credential.clientId,
+		userAgent
+	});
+	return true;
 }
 //#endregion
+//#region src/core/user-agent.ts
+const USER_AGENT = `metabase-cli/${version}`;
+const OAUTH_CLIENT_NAME = "Metabase CLI";
+//#endregion
 //#region src/core/paths.ts
 const APP_DIR_NAME = "metabase-cli";
 function configDir() {
@@ -80,6 +806,9 @@ const ProbedUser = z.object({
 const ProfileLastProbe = z.object({
 	at: z.iso.datetime(),
 	version: ParsedVersion.nullable(),
+	edition: Edition.nullable().default(null),
+	date: z.string().nullable().default(null),
+	hash: z.string().nullable().default(null),
 	tokenFeatures: TokenFeatures.nullable(),
 	user: ProbedUser
 });
@@ -374,6 +1103,9 @@ async function writeProbeResult(name, input) {
 	const probe = ProfileLastProbe.parse({
 		at: (/* @__PURE__ */ new Date()).toISOString(),
 		version: input.server.version,
+		edition: input.server.edition,
+		date: input.server.date,
+		hash: input.server.hash,
 		tokenFeatures: input.server.tokenFeatures,
 		user: input.user
 	});
@@ -425,207 +1157,6 @@ async function clearProfile(name = DEFAULT_PROFILE) {
 	return true;
 }
 //#endregion
-//#region ../client/src/http/oauth.ts
-const DISCOVERY_PATH = "/.well-known/oauth-authorization-server";
-const FORM_CONTENT_TYPE = "application/x-www-form-urlencoded";
-const OAUTH_TIMEOUT_MS = 3e4;
-async function oauthFetch(request) {
-	const timeoutSignal = AbortSignal.timeout(OAUTH_TIMEOUT_MS);
-	try {
-		return await fetch(request.url, {
-			method: request.method,
-			headers: {
-				...request.headers,
-				"user-agent": request.userAgent
-			},
-			...request.body !== void 0 ? { body: request.body } : {},
-			signal: timeoutSignal
-		});
-	} catch (error) {
-		if (timeoutSignal.aborted) throw new TimeoutError(`OAuth request timed out after ${OAUTH_TIMEOUT_MS}ms`, {
-			kind: "http",
-			method: request.method,
-			url: request.url,
-			timeoutMs: OAUTH_TIMEOUT_MS
-		});
-		throw buildNetworkError(error, request.method, request.url);
-	}
-}
-const OAUTH_SCOPE = "mb:full";
-const OAuthServerMetadata = z.object({
-	issuer: z.string(),
-	authorization_endpoint: z.string(),
-	token_endpoint: z.string(),
-	registration_endpoint: z.string().optional(),
-	revocation_endpoint: z.string().optional(),
-	scopes_supported: z.array(z.string()).optional()
-}).loose();
-const RegisteredClient = z.object({ client_id: z.string() }).loose();
-const OAuthTokens = z.object({
-	access_token: z.string(),
-	token_type: z.string(),
-	expires_in: z.number().int().optional(),
-	refresh_token: z.string().optional()
-}).loose();
-const OAuthErrorBody = z.object({
-	error: z.string(),
-	error_description: z.string().optional()
-}).loose();
-async function readJson(response, schema, source) {
-	let raw;
-	try {
-		raw = await response.json();
-	} catch (error) {
-		throw new ConfigError(`${source}: invalid JSON response (${errorMessage(error)})`);
-	}
-	const parsed = schema.safeParse(raw);
-	if (!parsed.success) throw new ConfigError(`${source}: unexpected response shape`);
-	return parsed.data;
-}
-async function failure(response, source, method, url) {
-	const rawBody = await response.text().catch(() => "");
-	if (isRetryableStatus(response.status)) return new HttpError({
-		status: response.status,
-		statusText: response.statusText,
-		method,
-		url,
-		responseHeaders: response.headers,
-		rawBody
-	});
-	const parsed = parseJsonResult(rawBody, OAuthErrorBody);
-	if (parsed.ok) {
-		const detail = parsed.value.error_description ?? parsed.value.error;
-		return new ConfigError(`${source} failed (${response.status}): ${detail}`);
-	}
-	return new ConfigError(`${source} failed (${response.status})`);
-}
-async function postForm(url, userAgent, params, schema, source) {
-	const response = await oauthFetch({
-		url,
-		method: "POST",
-		userAgent,
-		headers: {
-			"content-type": FORM_CONTENT_TYPE,
-			accept: JSON_CONTENT_TYPE
-		},
-		body: new URLSearchParams(params)
-	});
-	if (!response.ok) throw await failure(response, source, "POST", url);
-	return readJson(response, schema, source);
-}
-const OAUTH_UNSUPPORTED_MESSAGE = "this Metabase does not support OAuth login (requires Metabase v63 or newer)";
-async function tryDiscoverMetadata(baseUrl, userAgent) {
-	const response = await oauthFetch({
-		url: `${baseUrl}${DISCOVERY_PATH}`,
-		method: "GET",
-		userAgent,
-		headers: { accept: JSON_CONTENT_TYPE }
-	});
-	const contentType = response.headers.get("content-type") ?? "";
-	if (!response.ok || !contentType.includes("json")) {
-		await response.body?.cancel().catch(() => void 0);
-		return null;
-	}
-	const metadata = await readJson(response, OAuthServerMetadata, "OAuth discovery");
-	const scopes = metadata.scopes_supported;
-	if (scopes !== void 0 && !scopes.includes("mb:full")) return null;
-	assertEndpointOrigin(metadata.issuer, baseUrl, "issuer");
-	assertEndpointOrigin(metadata.authorization_endpoint, baseUrl, "authorization endpoint");
-	assertEndpointOrigin(metadata.token_endpoint, baseUrl, "token endpoint");
-	if (metadata.registration_endpoint !== void 0) assertEndpointOrigin(metadata.registration_endpoint, baseUrl, "registration endpoint");
-	if (metadata.revocation_endpoint !== void 0) assertEndpointOrigin(metadata.revocation_endpoint, baseUrl, "revocation endpoint");
-	return metadata;
-}
-async function discoverMetadata(baseUrl, userAgent) {
-	const metadata = await tryDiscoverMetadata(baseUrl, userAgent);
-	if (metadata === null) throw new ConfigError(OAUTH_UNSUPPORTED_MESSAGE);
-	return metadata;
-}
-async function registerClient(input) {
-	const response = await oauthFetch({
-		url: input.registrationEndpoint,
-		method: "POST",
-		userAgent: input.userAgent,
-		headers: {
-			"content-type": JSON_CONTENT_TYPE,
-			accept: JSON_CONTENT_TYPE
-		},
-		body: JSON.stringify({
-			application_type: "native",
-			client_name: input.clientName,
-			redirect_uris: [input.redirectUri],
-			grant_types: ["authorization_code", "refresh_token"],
-			response_types: ["code"],
-			token_endpoint_auth_method: "none",
-			scope: OAUTH_SCOPE
-		})
-	});
-	if (!response.ok) throw await failure(response, "OAuth client registration", "POST", input.registrationEndpoint);
-	return readJson(response, RegisteredClient, "OAuth client registration");
-}
-function exchangeCode(input) {
-	return postForm(input.tokenEndpoint, input.userAgent, {
-		grant_type: "authorization_code",
-		code: input.code,
-		redirect_uri: input.redirectUri,
-		client_id: input.clientId,
-		code_verifier: input.codeVerifier
-	}, OAuthTokens, "OAuth token exchange");
-}
-function refreshTokens(input) {
-	return postForm(input.tokenEndpoint, input.userAgent, {
-		grant_type: "refresh_token",
-		refresh_token: input.refreshToken,
-		client_id: input.clientId
-	}, OAuthTokens, "OAuth token refresh");
-}
-async function revokeToken(input) {
-	const response = await oauthFetch({
-		url: input.revocationEndpoint,
-		method: "POST",
-		userAgent: input.userAgent,
-		headers: { "content-type": FORM_CONTENT_TYPE },
-		body: new URLSearchParams({
-			token: input.token,
-			client_id: input.clientId
-		})
-	});
-	if (!response.ok) throw await failure(response, "OAuth token revocation", "POST", input.revocationEndpoint);
-	await response.body?.cancel().catch(() => void 0);
-}
-//#endregion
-//#region ../client/src/auth/oauth-session.ts
-async function refreshOAuthCredential(baseUrl, credential, nowMs, userAgent) {
-	const tokens = await refreshTokens({
-		tokenEndpoint: (await discoverMetadata(baseUrl, userAgent)).token_endpoint,
-		refreshToken: credential.refreshToken,
-		clientId: credential.clientId,
-		userAgent
-	});
-	return oauthCredentialFromTokens(tokens, tokens.refresh_token ?? credential.refreshToken, credential.clientId, nowMs);
-}
-async function revokeOAuthCredential(baseUrl, credential, userAgent) {
-	const revocationEndpoint = (await discoverMetadata(baseUrl, userAgent)).revocation_endpoint;
-	if (revocationEndpoint === void 0) return false;
-	await revokeToken({
-		revocationEndpoint,
-		token: credential.refreshToken,
-		clientId: credential.clientId,
-		userAgent
-	});
-	await revokeToken({
-		revocationEndpoint,
-		token: credential.accessToken,
-		clientId: credential.clientId,
-		userAgent
-	});
-	return true;
-}
-//#endregion
-//#region src/core/user-agent.ts
-const USER_AGENT = `metabase-cli/${version}`;
-const OAUTH_CLIENT_NAME = "Metabase CLI";
-//#endregion
 //#region src/core/config.ts
 function isPreflightSkipped() {
 	return readEnv(ENV_SKIP_PREFLIGHT) === "1";
@@ -741,6 +1272,19 @@ function resolveCredential(flagKey, envKey, stored) {
 	return null;
 }
 //#endregion
+//#region src/core/auth/cached-server.ts
+async function readCachedProbe(profileName, url) {
+	const record = await readProfileRecord(profileName);
+	if (record === null || record.lastProbe === null) return null;
+	if (url !== null && normalizeUrl(record.url) !== url) return null;
+	return record.lastProbe;
+}
+async function readCachedServerProfile(profileName) {
+	const envUrl = readEnvCredentials().url;
+	const probe = await readCachedProbe(profileName, envUrl === null ? null : normalizeUrl(envUrl));
+	return probe === null ? null : createServerProfile(probe);
+}
+//#endregion
 //#region src/output/format.ts
 function resolveFormat({ json, format, isTty }) {
 	const explicit = format !== void 0 && format !== "auto" ? format : null;
@@ -875,7 +1419,7 @@ function flagCandidates(token) {
 //#endregion
 //#region src/commands/runtime.ts
 function defineMetabaseCommand(def) {
-	const required = def.capabilities === null ? null : mergeCapabilities(def.capabilities);
+	const requirements = def.requires === null ? null : deriveRequirements(def.requires);
 	const cmd = defineCommand({
 		meta: def.meta,
 		args: def.args,
@@ -888,35 +1432,44 @@ function defineMetabaseCommand(def) {
 				assertKnownFlags(rawArgs, def.args);
 				let cachedConfig = null;
 				let cachedClient = null;
-				let cachedServerInfo = null;
 				const getResolvedConfig = async () => {
 					if (cachedConfig === null) cachedConfig = await resolveConfig(buildConfigFlags(ctx));
 					return cachedConfig;
 				};
-				const getServerInfo = () => {
-					if (cachedServerInfo === null) cachedServerInfo = loadServerInfo(getResolvedConfig);
-					return cachedServerInfo;
-				};
+				const preflightSkipped = ctx.skipPreflight || isPreflightSkipped();
+				let cachedServer = null;
+				const noticeSkew = createSkewNotifier();
 				const rawGetClient = async () => {
 					if (cachedClient === null) {
 						const resolved = await getResolvedConfig();
-						const { createClient } = await import("./client-BqhzKdLM.mjs").then((n) => n.t);
+						const probe = await readCachedProbe(resolved.profile, resolved.url);
+						const server = probe === null ? null : createServerProfile(probe);
+						const { createClient } = await import("./client-Bv7Iwdvh.mjs").then((n) => n.t);
 						cachedClient = createClient({
 							url: resolved.url,
 							credential: resolved.credential
 						}, {
 							userAgent: USER_AGENT,
-							getServerTag: async () => (await getServerInfo())?.version?.tag ?? null,
+							...server !== null && { server },
 							refreshCredential: createCredentialRefresher(resolved.profile),
-							signal: interruptSignal
+							signal: interruptSignal,
+							enforceRequirements: !preflightSkipped
 						});
+						if (probe !== null && server !== null) {
+							cachedServer = {
+								client: cachedClient,
+								profileName: resolved.profile,
+								probe
+							};
+							noticeSkew(server);
+						}
 					}
 					return cachedClient;
 				};
-				const enforcePreflight = createPreflightEnforcer(required, getServerInfo, ctx.skipPreflight);
+				const enforcePreflight = createPreflightEnforcer(requirements === null ? null : requirements.features, preflightSkipped, noticeSkew);
 				const getClient = async () => {
 					const client = await rawGetClient();
-					await enforcePreflight();
+					await enforcePreflight(client);
 					return client;
 				};
 				try {
@@ -924,9 +1477,10 @@ function defineMetabaseCommand(def) {
 						args,
 						ctx,
 						getClient,
-						getResolvedConfig,
-						getServerInfo
+						getResolvedConfig
 					});
+				} catch (error) {
+					throw await refreshProfileOnStaleError(error, cachedServer);
 				} finally {
 					emitPendingWarnings();
 				}
@@ -941,10 +1495,17 @@ function defineMetabaseCommand(def) {
 		skills: def.skills ?? [],
 		inputSchema: def.inputSchema ?? null,
 		outputSchema: def.outputSchema ?? null,
-		capabilities: required
+		requires: requirements,
+		capabilities: requirements === null ? null : summarizeCapabilities(requirements.features)
 	});
 	return cmd;
 }
+function deriveRequirements(methods) {
+	return {
+		methods,
+		features: [...new Set(methods.flatMap((key) => methodRequirements(key)))]
+	};
+}
 function emitPendingWarnings() {
 	for (const message of consumeLegacyEnvWarnings()) warn(message);
 	const legacy = consumeLegacyStorageWarning();
@@ -952,34 +1513,58 @@ function emitPendingWarnings() {
 	const downgrade = consumeKeyringDowngradeWarning();
 	if (downgrade !== null) warn(downgrade);
 }
-async function loadServerInfo(getResolvedConfig) {
-	const record = await readProfileRecord((await getResolvedConfig()).profile);
-	if (record === null || record.lastProbe === null) return null;
-	return {
-		version: record.lastProbe.version,
-		tokenFeatures: record.lastProbe.tokenFeatures
+function createSkewNotifier() {
+	let noticed = false;
+	return (profile) => {
+		if (noticed) return;
+		noticed = true;
+		const notice = skewNotice(profile);
+		if (notice !== null) warn(notice);
 	};
 }
 const NO_OP_ENFORCER = async () => {};
-const NO_PROBE_DATA_WARNING = "Could not detect Metabase server version. Proceeding without preflight check; failures may produce confusing errors. Run `mb auth list` (or `mb auth login`) to populate the version cache.";
-function createPreflightEnforcer(required, getServerInfo, skip) {
-	if (required === null || skip || isPreflightSkipped() || isBaseline(required)) return NO_OP_ENFORCER;
+function createPreflightEnforcer(features, skip, noticeSkew) {
+	if (features === null || skip || features.length === 0) return NO_OP_ENFORCER;
 	let done = false;
-	return async () => {
+	return async (client) => {
 		if (done) return;
 		done = true;
-		const info = await getServerInfo();
-		if (info === null) {
-			warn(NO_PROBE_DATA_WARNING);
-			return;
-		}
-		const failure = checkCapabilities(info, required);
-		if (failure === null || failure.reason === "unknown-version") return;
-		throw new CapabilityError(failure);
+		const profile = await client.server();
+		noticeSkew(profile);
+		const failure = checkFeatures(features, profile);
+		if (failure !== null) throw new CapabilityError(failure);
 	};
 }
-function isBaseline(caps) {
-	return caps.minVersion === BASELINE_CAPABILITIES.minVersion && caps.tokenFeature === void 0;
+async function refreshProfileOnStaleError(error, cached) {
+	if (cached === null) return error;
+	if (error instanceof ResponseShapeError) {
+		const note = await refreshChangedProbe(cached);
+		return note === null ? error : new ResponseShapeError(`${error.message}\n${note}`, error.developerDetail);
+	}
+	if (error instanceof CapabilityError) {
+		const note = await refreshChangedProbe(cached);
+		return note === null ? error : new CapabilityError({
+			...error.developerDetail,
+			detail: `${error.message}\n${note}`
+		});
+	}
+	return error;
+}
+async function refreshChangedProbe(cached) {
+	let fresh;
+	try {
+		fresh = await probeServer(cached.client);
+	} catch (error) {
+		if (error instanceof MetabaseError) return null;
+		throw error;
+	}
+	const note = serverChangeNote(cached.probe, fresh);
+	if (note === null) return null;
+	await writeProbeResult(cached.profileName, {
+		user: cached.probe.user,
+		server: fresh
+	});
+	return note;
 }
 function pickCommonArgs(args) {
 	const out = {};
@@ -1004,4 +1589,4 @@ function buildConfigFlags(ctx) {
 	return flags;
 }
 //#endregion
-export { ProbedUser as A, readProfileCredential as C, writeProbeFailure as D, writeOAuthProfile as E, tryParseTag as F, SessionProperties as I, TokenFeatures as L, ProfileLastFailure as M, profileAuthMethod as N, writeProbeResult as O, ParsedVersion as P, parseInteger as R, listProfileRecords as S, resolveRecordCredential as T, DEFAULT_PROFILE as _, createCredentialRefresher as a, consumeKeyringDowngradeWarning as b, resolveProfileName as c, revokeOAuthCredential as d, OAUTH_SCOPE as f, tryDiscoverMetadata as g, registerClient as h, parseEnumCsv as i, ProfileAuthMethod as j, writeProfile as k, OAUTH_CLIENT_NAME as l, exchangeCode as m, parseCsv as n, explicitProfileName as o, discoverMetadata as p, parseEnum as r, readEnvCredentials as s, defineMetabaseCommand as t, USER_AGENT as u, clearProfile as v, readProfileRecord as w, keyringFallbackWarning as x, consumeKeychainResidualWarning as y, parseOptionalInteger as z };
+export { probeServer as $, OAUTH_SCOPE as A, JSON_CONTENT_TYPE as B, ProbedUser as C, OAUTH_CLIENT_NAME as D, profileAuthMethod as E, buildNetworkError as F, credentialSecrets as G, parseJsonOrPlain as H, isConnectionClosed as I, normalizeUrl as J, oauthCredentialFromTokens as K, HttpError as L, exchangeCode as M, registerClient as N, USER_AGENT as O, tryDiscoverMetadata as P, checkRequirements as Q, chainRequestFailure as R, writeProfile as S, ProfileLastFailure as T, assertCredentialHeaderSafe as U, parseJson as V, credentialAuthHeader as W, summarizeServer as X, ServerSummary as Y, checkFeatures as Z, readProfileRecord as _, readCachedServerProfile as a, writeProbeFailure as b, readEnvCredentials as c, clearProfile as d, CapabilityError as et, consumeKeychainResidualWarning as f, readProfileCredential as g, listProfileRecords as h, parseEnumCsv as i, discoverMetadata as j, revokeOAuthCredential as k, resolveProfileName as l, keyringFallbackWarning as m, parseCsv as n, parseInteger as nt, createCredentialRefresher as o, consumeKeyringDowngradeWarning as p, displayUrl as q, parseEnum as r, parseOptionalInteger as rt, explicitProfileName as s, defineMetabaseCommand as t, RequirementFailure as tt, DEFAULT_PROFILE as u, resolveRecordCredential as v, ProfileAuthMethod as w, writeProbeResult as x, writeOAuthProfile as y, isRetryableStatus as z };