@metabase/cli 0.4.1-alpha.release-65-integration-branch.5cbe297 → 0.5.1

package/dist/{runtime-X6hVzSMW.mjs → runtime-Ckns6TKK.mjs}

@@ -1,4 +1,4 @@
-import { $ as assertArgv, A as warn, B as setMetabaseAugment, F as ENV_SKIP_PREFLIGHT, H as version, I as ENV_URL, L as consumeLegacyEnvWarnings, M as ENV_DISABLE_KEYRING, R as readEnv, _t as isFileNotFoundError, a as Features, at as ChainedRequestError, c as ruleGap, dt as ResponseShapeError, et as givenFlagKeys, ft as TimeoutError, ht as errorMessage, i as FEATURE_RULES, j as ENV_API_KEY, l as reportError, lt as MetabaseError, mt as ValidationError, n as methodRequirements, o as evaluateFeatures, ot as ConfigError, r as FEATURE_NAMES, t as interruptSignal, tt as parseCsv, ut as NetworkError, vt as KNOWN_RANGE, w as isPlainObject, z as ProfileRefreshedError } from "./cli.mjs";
+import { $ as parseJsonResult, A as ENV_URL, B as Features, C as preflightUncheckedNotice, Ct as NetworkError, E as ENV_DISABLE_KEYRING, Et as TimeoutError, K as isRetryableStatus, M as readEnv, Mt as isNonInterruptFailure, N as ProfileRefreshedError, Nt as KNOWN_RANGE, Ot as ValidationError, S as preflightSkippedNotice, T as ENV_API_KEY, Tt as ResponseShapeError, U as ruleGap, V as evaluateFeatures, W as HttpError, X as JSON_CONTENT_TYPE, et as setMetabaseAugment, ht as parseCsv, i as reportError, j as consumeLegacyEnvWarnings, jt as isFileNotFoundError, kt as errorMessage, mt as givenFlagKeys, nt as version, pt as assertArgv, r as methodRequirements, t as interruptSignal, w as warn, yt as ConfigError, z as FEATURE_RULES } from "./cli.mjs";
 import { defineCommand } from "citty";
 import { z } from "zod";
 import { Entry } from "@napi-rs/keyring";
@@ -22,33 +22,6 @@ function parseOptionalInteger(value, options) {
 	return parseInteger(value, options);
 }
 //#endregion
-//#region ../client/src/version/preflight-error.ts
-const RequirementReason = z.enum(["version-too-old", "missing-token-feature"]);
-const RequirementFailure = z.object({
-	reason: RequirementReason,
-	detail: z.string(),
-	feature: z.enum(FEATURE_NAMES),
-	since: z.number().int(),
-	tokenFeature: z.string().nullable(),
-	serverVersion: z.string()
-});
-function versionTooOldMessage(since, serverVersion) {
-	return `This operation requires Metabase v${since}+ (this server is ${serverVersion}). Upgrade Metabase to use it.`;
-}
-function missingTokenFeatureMessage(tokenFeature) {
-	return `This operation requires the '${tokenFeature}' premium feature (not enabled on this server).`;
-}
-var CapabilityError = class extends MetabaseError {
-	category = "capability";
-	isRetryable = false;
-	developerDetail;
-	constructor(failure) {
-		super(failure.detail);
-		this.name = "CapabilityError";
-		this.developerDetail = failure;
-	}
-};
-//#endregion
 //#region ../client/src/domain/session-properties.ts
 const ServerVersion$1 = z.object({
 	tag: z.string(),
@@ -111,26 +84,6 @@ function describeVersion(version) {
 }
 const StoredServerVersion = z.object({ tag: z.string() }).loose().transform(({ tag }) => parseTag(tag));
 //#endregion
-//#region ../client/src/version/probe.ts
-const PROBE_PATH = "/api/session/properties";
-const PROBE_TIMEOUT_MS = 1e4;
-async function probeServer(client, opts = {}) {
-	return serverInfoFromProperties(await client.requestParsed(SessionProperties, PROBE_PATH, {
-		timeoutMs: PROBE_TIMEOUT_MS,
-		retries: opts.retries ?? 0
-	}));
-}
-function serverInfoFromProperties(properties) {
-	const { tag } = properties.version;
-	return {
-		version: parseTag(tag),
-		edition: editionFromTag(tag),
-		date: properties.version.date ?? null,
-		hash: properties.version.hash ?? null,
-		tokenFeatures: properties["token-features"] ?? null
-	};
-}
-//#endregion
 //#region ../client/src/version/profile.ts
 const Skew = z.enum([
 	"supported",
@@ -189,37 +142,6 @@ function grantsAnyFeature(tokenFeatures) {
 	return tokenFeatures !== null && Object.values(tokenFeatures).some((enabled) => enabled);
 }
 //#endregion
-//#region ../client/src/version/requirement-check.ts
-/** The first of `features` the profile lacks, or `null` when it has every one. */
-function checkFeatures(features, profile) {
-	for (const feature of features) {
-		const gap = featureGap(profile, feature);
-		if (gap !== null) return describeGap(gap, feature, profile);
-	}
-	return null;
-}
-function describeGap(gap, feature, profile) {
-	const rule = FEATURE_RULES[feature];
-	const serverVersion = profile.version.tag;
-	const tokenFeature = rule.tokenFeature ?? null;
-	if (gap.kind === "token") return {
-		reason: "missing-token-feature",
-		detail: missingTokenFeatureMessage(gap.tokenFeature),
-		feature,
-		since: rule.since,
-		tokenFeature,
-		serverVersion
-	};
-	return {
-		reason: "version-too-old",
-		detail: versionTooOldMessage(rule.since, describeVersion(profile.version)),
-		feature,
-		since: rule.since,
-		tokenFeature,
-		serverVersion
-	};
-}
-//#endregion
 //#region src/core/auth/server-summary.ts
 const KnownRange = z.object({
 	min: z.number().int(),
@@ -257,17 +179,32 @@ function skewNotice(profile) {
 	switch (profile.skew) {
 		case "supported":
 		case "development": return null;
-		case "older-than-known": return `Metabase ${describeVersion(profile.version)} is older than this CLI supports (v${min}+); commands needing a newer feature are refused by name. Upgrade Metabase to v${min} or later.`;
+		case "older-than-known": return `Metabase ${describeVersion(profile.version)} is older than this CLI supports (v${min}+); a command relying on a newer feature may fail. Upgrade Metabase to v${min} or later.`;
 		case "newer-than-known": return `Metabase ${describeVersion(profile.version)} is newer than this CLI supports (up to v${max}); commands run as if it were v${max + 1}. Run \`mb upgrade\` for a newer CLI.`;
 	}
 }
-const PROFILE_REFRESHED_REMEDY = "the profile was refreshed — retry the command.";
-function serverChangeNote(cached, fresh) {
+const PROFILE_REFRESHED = "the profile was refreshed";
+const PROFILE_STALE = "the profile could not be updated (the warning above says why)";
+const SAFE_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]);
+/** Whether two probes agree on everything a feature switch reads: the version tag and the premium features. */
+function sameServer(a, b) {
+	return describeVersion(a.version) === describeVersion(b.version) && sameTokenFeatures(a.tokenFeatures, b.tokenFeatures);
+}
+function serverChangeNote(cached, fresh, method, profile) {
+	if (sameServer(cached, fresh)) return null;
+	const remedy = changeRemedy(SAFE_METHODS.has(method), profile);
 	const before = describeVersion(cached.version);
 	const after = describeVersion(fresh.version);
-	if (before !== after) return `The server's version changed since the last probe (was ${before}, now ${after}); ${PROFILE_REFRESHED_REMEDY}`;
-	if (!sameTokenFeatures(cached.tokenFeatures, fresh.tokenFeatures)) return `The server's premium features changed since the last probe; ${PROFILE_REFRESHED_REMEDY}`;
-	return null;
+	if (before !== after) return `The server's version changed since the last probe (was ${before}, now ${after}); ${remedy}`;
+	return `The server's premium features changed since the last probe; ${remedy}`;
+}
+function changeRemedy(isSafe, profile) {
+	if (profile === "current") return isSafe ? `${PROFILE_REFRESHED} — retry the command.` : `${PROFILE_REFRESHED}, but the request may have been applied — check before retrying.`;
+	return isSafe ? `${PROFILE_STALE} — retry the command once it can be.` : `${PROFILE_STALE}, and the request may have been applied — check before retrying.`;
 }
 function sameTokenFeatures(a, b) {
 	const grantedA = grantedFeatures(a);
@@ -369,296 +306,29 @@ function oauthCredentialFromTokens(tokens, refreshToken, clientId, nowMs) {
 	};
 }
 //#endregion
-//#region ../client/src/json.ts
-const JSON_CONTENT_TYPE = "application/json";
-function parseJson(input, schema, opts = {}) {
-	const result = parseJsonResult(input, schema, opts);
-	if (!result.ok) throw result.error;
-	return result.value;
-}
-function parseJsonResult(input, schema, opts = {}) {
-	const sourcePrefix = opts.source === void 0 ? "" : `${opts.source}: `;
-	let raw;
-	try {
-		raw = JSON.parse(input);
-	} catch (error) {
-		return {
-			ok: false,
-			error: new ConfigError(`${sourcePrefix}invalid JSON: ${errorMessage(error)}`)
-		};
-	}
-	const parsed = schema.safeParse(raw);
-	if (!parsed.success) return {
-		ok: false,
-		error: new ValidationError(`${sourcePrefix}value did not match expected schema`, {
-			source: opts.source ?? "<input>",
-			zodIssues: parsed.error.issues
-		})
-	};
+//#region ../client/src/version/probe.ts
+const PROBE_PATH = "/api/session/properties";
+async function probeServer(client, opts = {}) {
+	return serverInfoFromProperties(await client.requestParsed(SessionProperties, PROBE_PATH, probeBudget(opts)));
+}
+function probeBudget(opts) {
 	return {
-		ok: true,
-		value: parsed.data
+		timeoutMs: opts.timeoutMs ?? 1e4,
+		retries: opts.retries ?? 0
 	};
 }
-function parseJsonOrPlain(text, contentType, schema, opts = {}) {
-	if (!isJsonContentType(contentType)) return parseJson(JSON.stringify(text), schema, opts);
-	const attempt = parseJsonResult(text, schema, opts);
-	if (attempt.ok) return attempt.value;
-	if (attempt.error instanceof ValidationError) throw attempt.error;
-	return parseJson(JSON.stringify(text), schema, opts);
-}
-function isJsonContentType(contentType) {
-	return contentType !== null && contentType.includes("application/json");
-}
-//#endregion
-//#region ../client/src/http/sanitize.ts
-const SECRET_HEADER_NAMES = /* @__PURE__ */ new Set([
-	"authorization",
-	"x-api-key",
-	"x-metabase-session",
-	"cookie",
-	"set-cookie",
-	"proxy-authorization"
-]);
-const REDACTED = "[REDACTED]";
-function redactHeaders(headers) {
-	const result = {};
-	const entries = headers instanceof Headers ? headers.entries() : Object.entries(headers);
-	for (const [key, value] of entries) result[key] = SECRET_HEADER_NAMES.has(key.toLowerCase()) ? REDACTED : value;
-	return result;
-}
-function redactBody(body, ctx) {
-	let result = body;
-	for (const secret of ctx.knownSecrets) {
-		if (secret.length === 0) continue;
-		result = result.replaceAll(secret, REDACTED);
-	}
-	return result;
-}
-//#endregion
-//#region ../client/src/http/errors.ts
-const NOT_FOUND_STATUS = 404;
-const TEXT_CONTENT_TYPE = "text/plain";
-const ROUTE_MISSING_LITERAL = "API endpoint does not exist.";
-const RESOURCE_MISSING_LITERAL = "Not found.";
-const STATUS_CLASSIFICATIONS = {
-	401: { retryable: false },
-	403: { retryable: false },
-	404: { retryable: false },
-	408: {
-		retryable: true,
-		message: "Metabase timed out responding."
-	},
-	425: { retryable: true },
-	429: {
-		retryable: true,
-		message: "Metabase rate-limited the request."
-	},
-	500: { retryable: true },
-	502: { retryable: true },
-	503: { retryable: true },
-	504: {
-		retryable: true,
-		message: "Metabase timed out responding."
-	}
-};
-const ErrorEnvelope = z.object({
-	message: z.string().optional(),
-	error: z.string().optional(),
-	"error-message": z.string().optional(),
-	via: z.array(z.object({ message: z.string().optional() }).loose()).optional(),
-	"specific-errors": z.unknown().optional(),
-	errors: z.unknown().optional(),
-	"error-code": z.string().optional()
-}).loose();
-const FieldErrorNodeSchema = z.lazy(() => z.union([
-	z.string(),
-	z.array(z.string()),
-	z.record(z.string(), FieldErrorNodeSchema)
-]));
-const FieldErrorTree = z.record(z.string(), FieldErrorNodeSchema);
-const FIELD_MESSAGE_SEPARATOR = "; ";
-const MAX_EXTRACTED_MESSAGE_LEN = 500;
-const ELLIPSIS = "…";
-const GOT_VALUE_PATTERN = /got: ((?:[^"\\]|\\.)*)/g;
-const MAX_GOT_VALUE_LEN = 60;
-var HttpError = class extends MetabaseError {
-	category = "http";
-	status;
-	kind;
-	developerDetail;
-	constructor(input) {
-		const sanitizedBody = sanitizeBody(input.rawBody, input.redactionContext);
-		const redactedHeaders = redactHeaders(input.responseHeaders);
-		const kind = classifyKind(input.status, sanitizedBody, redactedHeaders);
-		super(input.overrideUserMessage ?? buildUserMessage(kind, input, sanitizedBody, redactedHeaders));
-		const fields = extractEnvelopeViews(sanitizedBody);
-		this.name = "HttpError";
-		this.status = input.status;
-		this.kind = kind;
-		this.developerDetail = {
-			status: input.status,
-			statusText: input.statusText,
-			method: input.method,
-			url: input.url,
-			responseHeaders: redactedHeaders,
-			body: sanitizedBody,
-			fieldErrors: fields.fieldErrors,
-			specificFieldErrors: fields.specificFieldErrors,
-			errorCode: fields.errorCode
-		};
-	}
-	get isRetryable() {
-		return isRetryableStatus(this.status);
-	}
-	get fieldErrors() {
-		return this.developerDetail.fieldErrors;
-	}
-	get specificFieldErrors() {
-		return this.developerDetail.specificFieldErrors;
-	}
-	get errorCode() {
-		return this.developerDetail.errorCode;
-	}
-};
-function chainRequestFailure(cause, message) {
-	if (cause instanceof HttpError) return new HttpError({
-		status: cause.status,
-		statusText: cause.developerDetail.statusText,
-		method: cause.developerDetail.method,
-		url: cause.developerDetail.url,
-		responseHeaders: cause.developerDetail.responseHeaders,
-		rawBody: cause.developerDetail.body,
-		overrideUserMessage: message
-	});
-	return new ChainedRequestError(message, cause);
-}
-function isRetryableStatus(status) {
-	return STATUS_CLASSIFICATIONS[status]?.retryable === true;
-}
-function sanitizeBody(rawBody, ctx) {
-	if (rawBody === null) return null;
-	if (ctx === void 0) return rawBody;
-	return redactBody(rawBody, ctx);
-}
-function classifyKind(status, sanitizedBody, redactedHeaders) {
-	if (status === 401 || status === 403) return "auth";
-	if (status === NOT_FOUND_STATUS) return isRouteMissingResponse(sanitizedBody, redactedHeaders) ? "route-missing" : "resource-missing";
-	if (status === 429) return "rate-limit";
-	if (status >= 500 && status < 600) return "server-error";
-	return "generic";
-}
-function isRouteMissingResponse(sanitizedBody, redactedHeaders) {
-	if (sanitizedBody?.includes(ROUTE_MISSING_LITERAL)) return true;
-	if (sanitizedBody?.includes(RESOURCE_MISSING_LITERAL)) return false;
-	if (redactedHeaders["content-type"]?.includes("application/json")) return false;
-	if (sanitizedBody === null || sanitizedBody.trim() === "") return true;
-	return parseEnvelope(sanitizedBody) === null;
-}
-function buildUserMessage(kind, input, sanitizedBody, redactedHeaders) {
-	if (kind === "route-missing") return buildRouteMissingMessage(input);
-	if (kind === "resource-missing") return `Not found: ${input.method} ${pathFromUrl(input.url)}.`;
-	const fromBody = parseEnvelopeMessage(sanitizedBody);
-	if (fromBody !== null) return fromBody;
-	if (kind === "auth") return `Invalid or unauthorized API key (host: ${hostFromUrl(input.url)}).`;
-	const fromText = plainTextMessage(sanitizedBody, redactedHeaders);
-	if (fromText !== null) return fromText;
-	return defaultMessageForStatus(input.status);
-}
-function plainTextMessage(sanitizedBody, redactedHeaders) {
-	if (sanitizedBody === null || !redactedHeaders["content-type"]?.includes(TEXT_CONTENT_TYPE)) return null;
-	const trimmed = sanitizedBody.trim();
-	return trimmed === "" ? null : condenseMessage(trimmed);
-}
-function buildRouteMissingMessage(input) {
-	const path = pathFromUrl(input.url);
-	if (!input.serverTag) return `This endpoint is not available on the connected Metabase: ${input.method} ${path}.`;
-	return `This endpoint is not available on Metabase ${input.serverTag}: ${input.method} ${path}. It may require a newer Metabase major version.`;
-}
-function pathFromUrl(url) {
-	const parsed = new URL(url);
-	return parsed.pathname + parsed.search;
-}
-function hostFromUrl(url) {
-	return new URL(url).host;
-}
-function parseEnvelope(sanitizedBody) {
-	if (!sanitizedBody) return null;
-	const result = parseJsonResult(sanitizedBody, ErrorEnvelope);
-	return result.ok ? result.value : null;
-}
-const NO_ENVELOPE_VIEWS = {
-	fieldErrors: null,
-	specificFieldErrors: null,
-	errorCode: null
-};
-function extractEnvelopeViews(sanitizedBody) {
-	const envelope = parseEnvelope(sanitizedBody);
-	if (envelope === null) return NO_ENVELOPE_VIEWS;
+function serverInfoFromProperties(properties) {
+	const { tag } = properties.version;
 	return {
-		fieldErrors: parseFieldErrors(envelope.errors),
-		specificFieldErrors: parseFieldErrors(envelope["specific-errors"]),
-		errorCode: envelope["error-code"] ?? null
+		version: parseTag(tag),
+		edition: editionFromTag(tag),
+		date: properties.version.date ?? null,
+		hash: properties.version.hash ?? null,
+		tokenFeatures: properties["token-features"] ?? null
 	};
 }
-function parseFieldErrors(value) {
-	const parsed = FieldErrorTree.safeParse(value);
-	if (!parsed.success) return null;
-	const entries = collectLeafEntries(parsed.data, []);
-	if (entries.length === 0) return null;
-	return Object.fromEntries(entries.map((entry) => [entry.path, entry.message]));
-}
-function parseEnvelopeMessage(sanitizedBody) {
-	const envelope = parseEnvelope(sanitizedBody);
-	if (envelope === null) return null;
-	const topLevel = envelope.message ?? envelope.error ?? envelope["error-message"];
-	if (topLevel) return condenseMessage(topLevel);
-	const viaMessage = envelope.via?.find((entry) => entry.message)?.message;
-	if (viaMessage) return condenseMessage(viaMessage);
-	const specific = formatErrorTree(envelope["specific-errors"]);
-	if (specific) return condenseMessage(specific);
-	const generic = formatErrorTree(envelope.errors);
-	if (generic) return condenseMessage(generic);
-	return null;
-}
-function formatErrorTree(value) {
-	const entries = collectLeafEntries(value, []);
-	if (entries.length === 0) return null;
-	return entries.map(formatLeafEntry).join(FIELD_MESSAGE_SEPARATOR);
-}
-function formatLeafEntry(entry) {
-	return entry.path === "" ? entry.message : `${entry.path}: ${entry.message}`;
-}
-function collectLeafEntries(value, path) {
-	if (typeof value === "string") {
-		const trimmed = value.trim();
-		return trimmed === "" ? [] : [{
-			path: path.join("."),
-			message: trimmed
-		}];
-	}
-	if (Array.isArray(value)) {
-		const messages = value.filter((entry) => typeof entry === "string" && entry.trim() !== "");
-		if (messages.length === 0) return [];
-		return [{
-			path: path.join("."),
-			message: messages.join(FIELD_MESSAGE_SEPARATOR)
-		}];
-	}
-	if (isPlainObject(value)) return Object.entries(value).flatMap(([key, child]) => collectLeafEntries(child, [...path, key]));
-	return [];
-}
-function condenseMessage(message) {
-	const trimmed = message.replace(GOT_VALUE_PATTERN, trimGotValue);
-	if (trimmed.length <= MAX_EXTRACTED_MESSAGE_LEN) return trimmed;
-	return trimmed.slice(0, MAX_EXTRACTED_MESSAGE_LEN - 1) + ELLIPSIS;
-}
-function trimGotValue(match, value) {
-	if (value.length <= MAX_GOT_VALUE_LEN) return match;
-	return `got: ${value.slice(0, MAX_GOT_VALUE_LEN)}${ELLIPSIS}`;
-}
-function defaultMessageForStatus(status) {
-	return STATUS_CLASSIFICATIONS[status]?.message ?? `Metabase returned ${status}.`;
+function profileFromProperties(properties) {
+	return createServerProfile(serverInfoFromProperties(properties));
 }
 //#endregion
 //#region ../client/src/http/network-error.ts
@@ -842,7 +512,7 @@ async function grantsFullAccessScope(metadata, baseUrl, userAgent) {
 		headers: { accept: JSON_CONTENT_TYPE }
 	});
 	if (!response.ok) throw await failure(response, "Server properties", "GET", url);
-	return createServerProfile(serverInfoFromProperties(await readJson(response, SessionProperties, "Server properties"))).features.oauthFullAccessScope;
+	return createServerProfile(serverInfoFromProperties(await readJson(response, SessionProperties, "Server properties"))).features.oauthFullAccessScopeUnadvertised;
 }
 async function tryDiscoverMetadata(baseUrl, userAgent) {
 	const metadata = await fetchMetadata(baseUrl, userAgent);
@@ -1095,6 +765,12 @@ async function fileExists(path) {
 		return false;
 	}
 }
+let profilesFileQueue = Promise.resolve();
+function exclusively(update) {
+	const result = profilesFileQueue.then(update);
+	profilesFileQueue = result.then(() => void 0, () => void 0);
+	return result;
+}
 async function writeProfilesFile(file) {
 	const path = profilesFilePath();
 	if (file.profiles.length === 0) {
@@ -1199,123 +875,130 @@ async function upsertRecord(file, name, updated) {
 	});
 }
 async function writeProfile(profile, name = DEFAULT_PROFILE) {
-	const location = persistSecret(account.profileApiKey(name), profile.apiKey);
-	const inlineApiKey = location.backend === "file" ? profile.apiKey : null;
-	const file = await readProfilesFile();
-	const existing = findRecord(file, name);
-	flagResidualIfUnconfirmed(existing, "oauth", [removeKeyringEntry(account.profileOAuthAccess(name)), removeKeyringEntry(account.profileOAuthRefresh(name))]);
-	await upsertRecord(file, name, existing === null ? {
-		name,
-		url: profile.url,
-		apiKey: inlineApiKey,
-		oauth: null,
-		lastProbe: null,
-		lastFailure: null
-	} : {
-		...existing,
-		url: profile.url,
-		apiKey: inlineApiKey,
-		oauth: null
+	return exclusively(async () => {
+		const location = persistSecret(account.profileApiKey(name), profile.apiKey);
+		const inlineApiKey = location.backend === "file" ? profile.apiKey : null;
+		const file = await readProfilesFile();
+		const existing = findRecord(file, name);
+		flagResidualIfUnconfirmed(existing, "oauth", [removeKeyringEntry(account.profileOAuthAccess(name)), removeKeyringEntry(account.profileOAuthRefresh(name))]);
+		await upsertRecord(file, name, existing === null ? {
+			name,
+			url: profile.url,
+			apiKey: inlineApiKey,
+			oauth: null,
+			lastProbe: null,
+			lastFailure: null
+		} : {
+			...existing,
+			url: profile.url,
+			apiKey: inlineApiKey,
+			oauth: null
+		});
+		return location;
 	});
-	return location;
 }
 async function writeOAuthProfile(url, credential, name = DEFAULT_PROFILE) {
-	const accessKey = account.profileOAuthAccess(name);
-	const refreshKey = account.profileOAuthRefresh(name);
-	const accessLocation = persistSecret(accessKey, credential.accessToken);
-	const refreshLocation = persistSecret(refreshKey, credential.refreshToken);
-	const onFile = accessLocation.backend === "file" || refreshLocation.backend === "file";
-	const oauth = {
-		accessToken: onFile ? credential.accessToken : null,
-		refreshToken: onFile ? credential.refreshToken : null,
-		expiresAt: credential.expiresAt,
-		clientId: credential.clientId
-	};
-	const file = await readProfilesFile();
-	const existing = findRecord(file, name);
-	if (onFile && existing !== null && sideIsKeyringBacked(existing, "oauth")) keyringDowngradeNotice = keyringFallbackWarning(fileLocation(accessKey));
-	flagResidualIfUnconfirmed(existing, "apiKey", [removeKeyringEntry(account.profileApiKey(name))]);
-	await upsertRecord(file, name, existing === null ? {
-		name,
-		url,
-		apiKey: null,
-		oauth,
-		lastProbe: null,
-		lastFailure: null
-	} : {
-		...existing,
-		url,
-		apiKey: null,
-		oauth
+	return exclusively(async () => {
+		const accessKey = account.profileOAuthAccess(name);
+		const refreshKey = account.profileOAuthRefresh(name);
+		const accessLocation = persistSecret(accessKey, credential.accessToken);
+		const refreshLocation = persistSecret(refreshKey, credential.refreshToken);
+		const onFile = accessLocation.backend === "file" || refreshLocation.backend === "file";
+		const oauth = {
+			accessToken: onFile ? credential.accessToken : null,
+			refreshToken: onFile ? credential.refreshToken : null,
+			expiresAt: credential.expiresAt,
+			clientId: credential.clientId
+		};
+		const file = await readProfilesFile();
+		const existing = findRecord(file, name);
+		if (onFile && existing !== null && sideIsKeyringBacked(existing, "oauth")) keyringDowngradeNotice = keyringFallbackWarning(fileLocation(accessKey));
+		flagResidualIfUnconfirmed(existing, "apiKey", [removeKeyringEntry(account.profileApiKey(name))]);
+		await upsertRecord(file, name, existing === null ? {
+			name,
+			url,
+			apiKey: null,
+			oauth,
+			lastProbe: null,
+			lastFailure: null
+		} : {
+			...existing,
+			url,
+			apiKey: null,
+			oauth
+		});
+		return onFile ? fileLocation(accessKey) : {
+			backend: "keyring",
+			service: KEYRING_SERVICE,
+			account: accessKey
+		};
 	});
-	return onFile ? fileLocation(accessKey) : {
-		backend: "keyring",
-		service: KEYRING_SERVICE,
-		account: accessKey
-	};
 }
 async function writeProbeResult(name, input) {
-	const probe = ProfileLastProbe.parse({
-		at: (/* @__PURE__ */ new Date()).toISOString(),
-		version: input.server.version,
-		edition: input.server.edition,
-		date: input.server.date,
-		hash: input.server.hash,
-		tokenFeatures: input.server.tokenFeatures,
-		user: input.user
-	});
-	const file = await readProfilesFile();
-	if (findRecord(file, name) === null) return null;
-	const profiles = file.profiles.map((entry) => entry.name === name ? {
-		...entry,
-		lastProbe: probe,
-		lastFailure: null
-	} : entry);
-	await writeProfilesFile({
-		...file,
-		profiles
+	return exclusively(async () => {
+		const probe = ProfileLastProbe.parse({
+			at: (/* @__PURE__ */ new Date()).toISOString(),
+			version: input.server.version,
+			edition: input.server.edition,
+			date: input.server.date,
+			hash: input.server.hash,
+			tokenFeatures: input.server.tokenFeatures,
+			user: input.user
+		});
+		const file = await readProfilesFile();
+		if (findRecord(file, name) === null) return null;
+		const profiles = file.profiles.map((entry) => entry.name === name ? {
+			...entry,
+			lastProbe: probe,
+			lastFailure: null
+		} : entry);
+		await writeProfilesFile({
+			...file,
+			profiles
+		});
+		return probe;
 	});
-	return probe;
 }
 async function writeProbeFailure(name, input) {
-	const failure = ProfileLastFailure.parse({
-		at: (/* @__PURE__ */ new Date()).toISOString(),
-		kind: input.kind,
-		reason: input.reason
-	});
-	const file = await readProfilesFile();
-	if (findRecord(file, name) === null) return null;
-	const profiles = file.profiles.map((entry) => entry.name === name ? {
-		...entry,
-		lastFailure: failure
-	} : entry);
-	await writeProfilesFile({
-		...file,
-		profiles
+	return exclusively(async () => {
+		const failure = ProfileLastFailure.parse({
+			at: (/* @__PURE__ */ new Date()).toISOString(),
+			kind: input.kind,
+			reason: input.reason
+		});
+		const file = await readProfilesFile();
+		if (findRecord(file, name) === null) return null;
+		const profiles = file.profiles.map((entry) => entry.name === name ? {
+			...entry,
+			lastFailure: failure
+		} : entry);
+		await writeProfilesFile({
+			...file,
+			profiles
+		});
+		return failure;
 	});
-	return failure;
 }
 async function clearProfile(name = DEFAULT_PROFILE) {
-	const file = await readProfilesFile();
-	const existing = findRecord(file, name);
-	const removals = [
-		removeKeyringEntry(account.profileApiKey(name)),
-		removeKeyringEntry(account.profileOAuthAccess(name)),
-		removeKeyringEntry(account.profileOAuthRefresh(name))
-	];
-	if (existing !== null) flagResidualIfUnconfirmed(existing, existing.oauth !== null ? "oauth" : "apiKey", removals);
-	if (existing === null) return false;
-	await writeProfilesFile({
-		...file,
-		profiles: file.profiles.filter((entry) => entry.name !== name)
+	return exclusively(async () => {
+		const file = await readProfilesFile();
+		const existing = findRecord(file, name);
+		const removals = [
+			removeKeyringEntry(account.profileApiKey(name)),
+			removeKeyringEntry(account.profileOAuthAccess(name)),
+			removeKeyringEntry(account.profileOAuthRefresh(name))
+		];
+		if (existing !== null) flagResidualIfUnconfirmed(existing, existing.oauth !== null ? "oauth" : "apiKey", removals);
+		if (existing === null) return false;
+		await writeProfilesFile({
+			...file,
+			profiles: file.profiles.filter((entry) => entry.name !== name)
+		});
+		return true;
 	});
-	return true;
 }
 //#endregion
 //#region src/core/config.ts
-function isPreflightSkipped() {
-	return readEnv(ENV_SKIP_PREFLIGHT) === "1";
-}
 function resolveProfileName(profileFlag) {
 	return explicitProfileName(profileFlag) ?? "default";
 }
@@ -1451,7 +1134,8 @@ async function readCachedServerProfile(profileName) {
 	if (hit.kind !== "found") return hit;
 	return {
 		kind: "found",
-		profile: createServerProfile(hit.probe)
+		profile: createServerProfile(hit.probe),
+		probedAt: hit.probe.at
 	};
 }
 //#endregion
@@ -1487,7 +1171,7 @@ function resolveCommonFlags(args, options = {}) {
 		url: args.url,
 		apiKey: args.apiKey,
 		profile: args.profile,
-		skipPreflight: args.skipPreflight === true
+		skipPreflight: args.skipPreflight
 	};
 }
 function parseFields(value) {
@@ -1529,45 +1213,42 @@ function defineMetabaseCommand(def) {
 				assertArgv(rawArgs, def.args);
 				const ctx = resolveCommonFlags(commonArgs);
 				let cachedConfig = null;
-				let cachedClient = null;
 				const getResolvedConfig = async () => {
 					if (cachedConfig === null) cachedConfig = await resolveConfig(buildConfigFlags(ctx));
 					return cachedConfig;
 				};
-				const preflightSkipped = ctx.skipPreflight || isPreflightSkipped();
-				let cachedServer = null;
-				const noticeSkew = createSkewNotifier();
-				const rawGetClient = async () => {
-					if (cachedClient === null) {
-						const resolved = await getResolvedConfig();
-						const probe = await readCachedProbe(resolved.profile, resolved.url);
-						const server = probe === null ? null : createServerProfile(probe);
-						const { createClient } = await import("./client-1UIUBA_V.mjs").then((n) => n.t);
-						cachedClient = createClient({
-							url: resolved.url,
-							credential: resolved.credential
-						}, {
-							userAgent: USER_AGENT,
-							...server !== null && { server },
-							refreshCredential: createCredentialRefresher(resolved.profile),
-							signal: interruptSignal,
-							enforceRequirements: !preflightSkipped
-						});
-						if (probe !== null && server !== null) {
-							cachedServer = {
-								client: cachedClient,
-								profileName: resolved.profile,
-								probe
-							};
-							noticeSkew(server);
-						}
-					}
-					return cachedClient;
+				const run = {
+					server: null,
+					profileSave: Promise.resolve("current")
 				};
-				const enforcePreflight = createPreflightEnforcer(requirements === null ? null : requirements.features, preflightSkipped, noticeSkew);
+				const noticeSkew = createSkewNotifier();
+				const skipPreflight = ctx.skipPreflight ?? readEnv("MB_CLI_SKIP_PREFLIGHT") === "1";
 				const getClient = async () => {
-					const client = await rawGetClient();
-					await enforcePreflight(client);
+					if (run.server !== null) return run.server.client;
+					const resolved = await getResolvedConfig();
+					const probe = await readCachedProbe(resolved.profile, resolved.url);
+					const server = probe === null ? null : createServerProfile(probe);
+					const saveProbe = probe === null ? null : createProbeSaver(resolved.profile, probe);
+					const { createClient } = await import("./client-BBwYPXDW.mjs").then((n) => n.t);
+					const client = createClient({
+						url: resolved.url,
+						credential: resolved.credential
+					}, {
+						userAgent: USER_AGENT,
+						...server !== null && { server },
+						refreshCredential: createCredentialRefresher(resolved.profile),
+						onServerProbed: (fresh, profile) => {
+							noticeSkew(profile);
+							if (saveProbe !== null) run.profileSave = run.profileSave.then(() => saveProbe(fresh));
+						},
+						...skipPreflight && { onPreflightSkipped: createPreflightSkipWarner() },
+						signal: interruptSignal
+					});
+					run.server = {
+						client,
+						cachedProbe: probe
+					};
+					if (server !== null) noticeSkew(server);
 					return client;
 				};
 				try {
@@ -1578,8 +1259,9 @@ function defineMetabaseCommand(def) {
 						getResolvedConfig
 					});
 				} catch (error) {
-					throw await refreshProfileOnStaleError(error, cachedServer);
+					throw await diagnoseFailure(error, run);
 				} finally {
+					await settleRun(run);
 					emitPendingWarnings();
 				}
 			} catch (error) {
@@ -1619,40 +1301,72 @@ function createSkewNotifier() {
 		if (notice !== null) warn(notice);
 	};
 }
-const NO_OP_ENFORCER = async () => {};
-function createPreflightEnforcer(features, skip, noticeSkew) {
-	if (features === null || skip || features.length === 0) return NO_OP_ENFORCER;
-	let done = false;
-	return async (client) => {
-		if (done) return;
-		done = true;
-		const profile = await client.server();
-		noticeSkew(profile);
-		const failure = checkFeatures(features, profile);
-		if (failure !== null) throw new CapabilityError(failure);
+function createPreflightSkipWarner() {
+	const warned = /* @__PURE__ */ new Set();
+	return (skipped) => {
+		const notice = skippedPreflightNotice(skipped);
+		const key = skipped.kind === "unverified" ? skipped.kind : notice;
+		if (warned.has(key)) return;
+		warned.add(key);
+		warn(notice);
+	};
+}
+function skippedPreflightNotice(skipped) {
+	if (skipped.kind === "refused") return preflightSkippedNotice(skipped.refusal.message);
+	return preflightUncheckedNotice(skipped.failure.message);
+}
+function createProbeSaver(profileName, cached) {
+	let current = cached;
+	let state = "current";
+	return async (fresh) => {
+		if (sameServer(current, fresh)) return state;
+		current = fresh;
+		try {
+			await writeProbeResult(profileName, {
+				user: cached.user,
+				server: fresh
+			});
+			state = "current";
+		} catch (error) {
+			warn(`Could not save the server's new probe to profile "${profileName}": ${errorMessage(error)}`);
+			state = "stale";
+		}
+		return state;
 	};
 }
-async function refreshProfileOnStaleError(error, cached) {
-	if (cached === null) return error;
-	if (!(error instanceof ResponseShapeError) && !(error instanceof CapabilityError)) return error;
-	const note = await refreshChangedProbe(cached);
+async function settleRun(run) {
+	let awaited = null;
+	while (awaited !== run.profileSave) {
+		if (run.server !== null) await run.server.client.probesSettled();
+		awaited = run.profileSave;
+		await awaited;
+	}
+}
+async function diagnoseFailure(error, run) {
+	if (run.server === null || !isSkewSymptom(error)) return error;
+	const { client, cachedProbe } = run.server;
+	if (cachedProbe === null) {
+		await probeOnTheWayOut(client);
+		return error;
+	}
+	const detail = error instanceof ResponseShapeError ? error.developerDetail : null;
+	if (detail === null || detail.kind !== "zod" || detail.serverTag !== cachedProbe.version.tag) return error;
+	const fresh = await probeOnTheWayOut(client);
+	if (fresh === null) return error;
+	const note = serverChangeNote(cachedProbe, fresh, detail.method, await run.profileSave);
 	return note === null ? error : new ProfileRefreshedError(error, note);
 }
-async function refreshChangedProbe(cached) {
-	let fresh;
+function isSkewSymptom(error) {
+	if (error instanceof ResponseShapeError) return true;
+	return error instanceof HttpError && error.kind === "route-missing";
+}
+async function probeOnTheWayOut(client) {
 	try {
-		fresh = await probeServer(cached.client);
+		return await client.verifiedServer();
 	} catch (error) {
-		if (error instanceof MetabaseError) return null;
+		if (isNonInterruptFailure(error)) return null;
 		throw error;
 	}
-	const note = serverChangeNote(cached.probe, fresh);
-	if (note === null) return null;
-	await writeProbeResult(cached.profileName, {
-		user: cached.probe.user,
-		server: fresh
-	});
-	return note;
 }
 function resolveReportFormat(commonArgs, rawArgs, argsDef) {
 	try {
@@ -1685,4 +1399,4 @@ function buildConfigFlags(ctx) {
 	return flags;
 }
 //#endregion
-export { CapabilityError as $, registerClient as A, assertCredentialHeaderSafe as B, profileAuthMethod as C, OAUTH_SCOPE as D, revokeOAuthCredential as E, chainRequestFailure as F, normalizeUrl as G, credentialSecrets as H, isRetryableStatus as I, checkFeatures as J, ServerSummary as K, JSON_CONTENT_TYPE as L, buildNetworkError as M, isConnectionClosed as N, discoverLoginMetadata as O, HttpError as P, probeServer as Q, parseJson as R, ProfileLastFailure as S, USER_AGENT as T, oauthCredentialFromTokens as U, credentialAuthHeader as V, displayUrl as W, createServerProfile as X, Skew as Y, PROBE_PATH as Z, writeProbeFailure as _, readEnvCredentials as a, ProbedUser as b, clearProfile as c, keyringFallbackWarning as d, RequirementFailure as et, listProfileRecords as f, writeOAuthProfile as g, resolveRecordCredential as h, explicitProfileName as i, tryDiscoverMetadata as j, exchangeCode as k, consumeKeychainResidualWarning as l, readProfileRecord as m, readCachedServerProfile as n, parseOptionalInteger as nt, resolveProfileName as o, readProfileCredential as p, summarizeServer as q, createCredentialRefresher as r, DEFAULT_PROFILE as s, defineMetabaseCommand as t, parseInteger as tt, consumeKeyringDowngradeWarning as u, writeProbeResult as v, OAUTH_CLIENT_NAME as w, ProfileAuthMethod as x, writeProfile as y, parseJsonOrPlain as z };
+export { parseOptionalInteger as $, registerClient as A, credentialAuthHeader as B, profileAuthMethod as C, OAUTH_SCOPE as D, revokeOAuthCredential as E, probeBudget as F, ServerSummary as G, oauthCredentialFromTokens as H, probeServer as I, createServerProfile as J, summarizeServer as K, profileFromProperties as L, buildNetworkError as M, isConnectionClosed as N, discoverLoginMetadata as O, PROBE_PATH as P, parseInteger as Q, serverInfoFromProperties as R, ProfileLastFailure as S, USER_AGENT as T, displayUrl as U, credentialSecrets as V, normalizeUrl as W, describeVersion as X, featureGap as Y, SessionProperties as Z, writeProbeFailure as _, readEnvCredentials as a, ProbedUser as b, clearProfile as c, keyringFallbackWarning as d, listProfileRecords as f, writeOAuthProfile as g, resolveRecordCredential as h, explicitProfileName as i, tryDiscoverMetadata as j, exchangeCode as k, consumeKeychainResidualWarning as l, readProfileRecord as m, readCachedServerProfile as n, resolveProfileName as o, readProfileCredential as p, Skew as q, createCredentialRefresher as r, DEFAULT_PROFILE as s, defineMetabaseCommand as t, consumeKeyringDowngradeWarning as u, writeProbeResult as v, OAUTH_CLIENT_NAME as w, ProfileAuthMethod as x, writeProfile as y, assertCredentialHeaderSafe as z };