@metabase/rde 0.1.0 → 0.1.1

package/dist/cli.mjs

@@ -1,13 +1,15 @@
 #!/usr/bin/env node
 import { defineCommand, runMain, showUsage } from "citty";
-import { promises } from "node:fs";
+import { createWriteStream, promises } from "node:fs";
 import { delimiter, dirname, join, resolve } from "node:path";
 import { ZodError, z } from "zod";
 import { homedir, tmpdir, userInfo } from "node:os";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
 import { confirm, intro, isCancel, log, multiselect, note, outro, password, select, spinner, text } from "@clack/prompts";
-import { connect, createServer } from "node:net";
 import { spawn } from "node:child_process";
+import { connect, createServer } from "node:net";
 import semver from "semver";
 //#region src/errors.ts
 var AbortError = class extends Error {
@@ -70,6 +72,14 @@ var MetabaseUnreachableError = class extends Error {
 		this.url = url;
 	}
 };
+var DownloadError = class extends Error {
+	url;
+	constructor(url, reason) {
+		super(`downloading ${url} failed: ${reason}`);
+		this.name = "DownloadError";
+		this.url = url;
+	}
+};
 //#endregion
 //#region src/output/error.ts
 const INTERRUPTED_MESSAGE = "Interrupted. Run `rde init` again to resume.";
@@ -115,6 +125,7 @@ const StepId = z.enum([
 	"start-metabase",
 	"admin-user",
 	"api-key",
+	"sample-database",
 	"license",
 	"databases",
 	"git-sync",
@@ -132,17 +143,20 @@ const DockerRuntimeState = z.object({
 	port: z.int().positive(),
 	hostAlias: z.literal(DOCKER_HOST_ALIAS)
 });
-const JarEdition = z.enum(["oss", "enterprise"]);
+const JarSource = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("release"),
+	version: z.string()
+}), z.object({
+	kind: z.literal("file"),
+	path: z.string()
+})]);
 const JarRuntimeState = z.object({
 	kind: z.literal("jar"),
-	edition: JarEdition,
-	version: z.string(),
-	jarPath: z.string(),
-	javaPath: z.string(),
-	port: z.int().positive(),
-	pid: z.int().positive().nullable()
+	source: JarSource,
+	port: z.int().positive()
 });
 const RuntimeState = z.discriminatedUnion("kind", [DockerRuntimeState, JarRuntimeState]);
+const RuntimeKind = z.enum(["docker", "jar"]);
 const AdminCredentials = z.discriminatedUnion("kind", [z.object({
 	kind: z.literal("prompted"),
 	email: z.string()
@@ -166,6 +180,12 @@ const DatabaseRecord = z.object({
 	engine: z.string(),
 	createdAt: z.string()
 });
+const SampleDatabaseState = z.object({
+	containerName: z.string(),
+	image: z.string(),
+	port: z.int().positive(),
+	databaseId: z.int().nullable()
+});
 const GitRemoteState = z.discriminatedUnion("kind", [z.object({
 	kind: z.literal("local-bare"),
 	barePath: z.string(),
@@ -182,15 +202,17 @@ const StepRecord = z.object({
 	completedAt: z.string()
 });
 const InstanceState = z.object({
-	schemaVersion: z.literal(1),
+	schemaVersion: z.literal(3),
 	name: z.string(),
 	runtime: RuntimeState.nullable(),
 	url: z.string().nullable(),
+	version: z.string().nullable(),
 	admin: AdminCredentials.nullable(),
 	apiKey: z.string().nullable(),
 	mbProfile: z.string(),
 	license: LicenseState,
 	databases: z.array(DatabaseRecord),
+	sampleDatabase: SampleDatabaseState.nullable(),
 	gitRemote: GitRemoteState.nullable(),
 	steps: z.partialRecord(StepId, StepRecord)
 });
@@ -214,15 +236,17 @@ function mbCommand(profile) {
 }
 function emptyInstanceState(name) {
 	return {
-		schemaVersion: 1,
+		schemaVersion: 3,
 		name,
 		runtime: null,
 		url: null,
+		version: null,
 		admin: null,
 		apiKey: null,
 		mbProfile: DEFAULT_MB_PROFILE,
 		license: { activated: false },
 		databases: [],
+		sampleDatabase: null,
 		gitRemote: null,
 		steps: {}
 	};
@@ -230,11 +254,31 @@ function emptyInstanceState(name) {
 //#endregion
 //#region src/state/migrate.ts
 const Versioned = z.object({ schemaVersion: z.int() });
+const V1 = 1;
+const V2 = 2;
+const StateV1 = z.object({ schemaVersion: z.literal(V1) }).loose();
+const StateV2 = z.object({ schemaVersion: z.literal(V2) }).loose();
+function liftV1(raw) {
+	return {
+		...StateV1.parse(raw),
+		schemaVersion: V2,
+		version: null
+	};
+}
+function liftV2(raw) {
+	return {
+		...StateV2.parse(raw),
+		schemaVersion: 3,
+		sampleDatabase: null
+	};
+}
 function migrateInstanceState(raw) {
 	const { schemaVersion } = Versioned.parse(raw);
 	switch (schemaVersion) {
-		case 1: return InstanceState.parse(raw);
-		default: throw new ConfigError(`state schemaVersion ${schemaVersion} is not supported by this build (expected 1)`);
+		case V1: return migrateInstanceState(liftV1(raw));
+		case V2: return migrateInstanceState(liftV2(raw));
+		case 3: return InstanceState.parse(raw);
+		default: throw new ConfigError(`state schemaVersion ${schemaVersion} is not supported by this build (expected 3)`);
 	}
 }
 //#endregion
@@ -244,13 +288,23 @@ function readEnv(name) {
 	return process.env[name];
 }
 const ENV_PATH = "PATH";
+const ENV_JAVA_HOME = "JAVA_HOME";
+function environmentWith(overrides) {
+	return {
+		...process.env,
+		...overrides
+	};
+}
 //#endregion
 //#region src/state/paths.ts
 const RDE_DIR_NAME = ".rde";
 const INSTANCES_DIR = "instances";
 const DATA_DIR = "data";
+const BACKUPS_DIR = "backups";
 const STATE_FILE = "state.json";
 const GLOBAL_CONFIG_FILE = "config.json";
+const JARS_DIR = "jars";
+const JAR_FILE$1 = "metabase.jar";
 function rdeHome() {
 	const override = readEnv(ENV_RDE_HOME);
 	if (override !== void 0) return override;
@@ -265,12 +319,24 @@ function instanceDir(name) {
 function instanceDataDir(name) {
 	return join(instanceDir(name), DATA_DIR);
 }
+function instanceBackupsDir(name) {
+	return join(instanceDir(name), BACKUPS_DIR);
+}
 function instanceStatePath(name) {
 	return join(instanceDir(name), STATE_FILE);
 }
 function globalConfigPath() {
 	return join(rdeHome(), GLOBAL_CONFIG_FILE);
 }
+function jarsDir() {
+	return join(rdeHome(), JARS_DIR);
+}
+function jarReleaseDir(version) {
+	return join(jarsDir(), version);
+}
+function releaseJarIn(jarsDirectory, version) {
+	return join(jarsDirectory, version, JAR_FILE$1);
+}
 //#endregion
 //#region src/state/store.ts
 const FILE_MODE$1 = 384;
@@ -561,6 +627,8 @@ const Initializing = z.object({
 //#endregion
 //#region src/metabase/http.ts
 const REQUEST_TIMEOUT_MS = 3e4;
+const PARTIAL_SUFFIX = ".part";
+const CONTENT_LENGTH_HEADER = "content-length";
 const SESSION_HEADER = "X-Metabase-Session";
 const API_KEY_HEADER = "X-Api-Key";
 const JSON_CONTENT_TYPE = "application/json";
@@ -686,6 +754,47 @@ function createHttp(options) {
 		}
 	};
 }
+function contentLength(response) {
+	const header = response.headers.get(CONTENT_LENGTH_HEADER);
+	if (header === null) return null;
+	const total = Number.parseInt(header, 10);
+	return Number.isNaN(total) ? null : total;
+}
+function progressCounter(total, onProgress) {
+	let received = 0;
+	return (chunk) => {
+		received += chunk.byteLength;
+		onProgress({
+			received,
+			total
+		});
+		return chunk;
+	};
+}
+async function downloadFile(url, destination, options) {
+	const fetchImpl = options.fetchImpl ?? fetch;
+	let response;
+	try {
+		response = await fetchImpl(url, { signal: options.signal });
+	} catch (error) {
+		if (options.signal.aborted) throw new AbortError();
+		throw new DownloadError(url, describeCause(error));
+	}
+	if (!response.ok) throw new DownloadError(url, `HTTP ${response.status}`);
+	if (response.body === null) throw new DownloadError(url, "empty response");
+	const partial = `${destination}${PARTIAL_SUFFIX}`;
+	const count = progressCounter(contentLength(response), options.onProgress);
+	try {
+		await pipeline(Readable.fromWeb(response.body), async function* (chunks) {
+			for await (const chunk of chunks) yield count(chunk);
+		}, createWriteStream(partial), { signal: options.signal });
+	} catch (error) {
+		await promises.rm(partial, { force: true });
+		if (options.signal.aborted) throw new AbortError();
+		throw new DownloadError(url, describeCause(error));
+	}
+	await promises.rename(partial, destination);
+}
 //#endregion
 //#region src/metabase/domain/permissions-group.ts
 const PermissionsGroup = z.object({
@@ -914,12 +1023,20 @@ function sessionResource(http) {
 //#endregion
 //#region src/metabase/resources/setting.ts
 const PREMIUM_EMBEDDING_TOKEN_SETTING = "premium-embedding-token";
+const TRANSFORMS_ENABLED_SETTING = "transforms-enabled";
 function settingResource(http) {
 	/** PUT /api/setting/premium-embedding-token */
 	async function setPremiumEmbeddingToken(value) {
 		await http.requestNoContent("PUT", `/api/setting/${PREMIUM_EMBEDDING_TOKEN_SETTING}`, { body: { value } });
 	}
-	return { setPremiumEmbeddingToken };
+	/** PUT /api/setting/transforms-enabled */
+	async function enableTransforms() {
+		await http.requestNoContent("PUT", `/api/setting/${TRANSFORMS_ENABLED_SETTING}`, { body: { value: true } });
+	}
+	return {
+		setPremiumEmbeddingToken,
+		enableTransforms
+	};
 }
 //#endregion
 //#region src/metabase/domain/setup.ts
@@ -2085,7 +2202,8 @@ async function runDatabaseFlow(deps) {
 }
 //#endregion
 //#region src/steps/databases.ts
-const STEP_ID$8 = "databases";
+const STEP_ID$9 = "databases";
+const ASK_DATABASES = { requested: false };
 function hostDatabasesDeps(signal) {
 	return {
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, signal),
@@ -2093,10 +2211,10 @@ function hostDatabasesDeps(signal) {
 		now: () => /* @__PURE__ */ new Date()
 	};
 }
-function isNotServingYet(error) {
+function isNotServingYet$1(error) {
 	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
 }
-function requireApiKey$1(state) {
+function requireApiKey$2(state) {
 	if (state.apiKey === null) throw new ConfigError(`instance ${state.name} has no API key yet; run \`rde init\``);
 	return state.apiKey;
 }
@@ -2106,7 +2224,7 @@ function hostAliasOf(runtime) {
 		case "jar": return null;
 	}
 }
-function toRecord(database, createdAt) {
+function toRecord$1(database, createdAt) {
 	return {
 		id: database.id,
 		name: database.name,
@@ -2118,7 +2236,7 @@ function authenticatedClient(state, deps) {
 	const configured = requireConfiguredRuntime(state);
 	return deps.client(configured.url, {
 		kind: "api-key",
-		key: requireApiKey$1(state)
+		key: requireApiKey$2(state)
 	});
 }
 async function listDatabases(state, deps) {
@@ -2156,7 +2274,7 @@ async function addDatabases(ctx, deps) {
 		existingCount: existing.data.length,
 		readTextFile: deps.readTextFile,
 		onCreated: async (database) => {
-			const record = toRecord(database, deps.now().toISOString());
+			const record = toRecord$1(database, deps.now().toISOString());
 			await ctx.saveState({
 				...ctx.state,
 				databases: [...ctx.state.databases, record]
@@ -2165,26 +2283,33 @@ async function addDatabases(ctx, deps) {
 	});
 	return existing.data.length + result.created.length > 0 ? "completed" : "skipped";
 }
-function hostDeps$10(ctx) {
+function hostDeps$12(ctx) {
 	return hostDatabasesDeps(ctx.signal);
 }
-function databasesStep(deps = hostDeps$10) {
+function sampleDatabaseId(state) {
+	return state.sampleDatabase === null ? null : state.sampleDatabase.databaseId;
+}
+function ownDatabaseIds(state) {
+	const sampleId = sampleDatabaseId(state);
+	return new Set(state.databases.filter((record) => record.id !== sampleId).map((record) => record.id));
+}
+function databasesStep(options, deps = hostDeps$12) {
 	return {
-		id: STEP_ID$8,
+		id: STEP_ID$9,
 		title: "Connect your databases",
 		async detect(ctx) {
 			const configured = configuredRuntime(ctx.state);
-			if (configured === null || ctx.state.apiKey === null || ctx.state.databases.length === 0) return "todo";
+			if (configured === null || ctx.state.apiKey === null) return "todo";
+			const own = ownDatabaseIds(ctx.state);
+			if (own.size === 0) return sampleDatabaseId(ctx.state) !== null && !options.requested ? "done" : "todo";
 			const client = deps(ctx).client(configured.url, {
 				kind: "api-key",
 				key: ctx.state.apiKey
 			});
 			try {
-				const listed = await client.database.list();
-				const known = new Set(ctx.state.databases.map((record) => record.id));
-				return listed.data.some((database) => known.has(database.id)) ? "done" : "todo";
+				return (await client.database.list()).data.some((database) => own.has(database.id)) ? "done" : "todo";
 			} catch (error) {
-				if (isNotServingYet(error)) return "todo";
+				if (isNotServingYet$1(error)) return "todo";
 				throw error;
 			}
 		},
@@ -2331,7 +2456,7 @@ const dbAdd = defineRdeCommand({
 		const name = await defaultInstanceName();
 		await requireInstanceState(name);
 		const ctx = await createWizardContext(name, { signal: interruptSignal });
-		await databasesStep().run(ctx);
+		await databasesStep(ASK_DATABASES).run(ctx);
 	}
 });
 //#endregion
@@ -2376,6 +2501,43 @@ const db = defineCommand({
 	}
 });
 //#endregion
+//#region src/metabase/domain/version-info.ts
+const VersionInfo = z.object({ latest: z.object({ version: z.string() }).loose() }).loose();
+//#endregion
+//#region src/metabase/releases.ts
+const DOWNLOADS_HOST = "https://downloads.metabase.com";
+const VERSION_INFO_HOST = "https://static.metabase.com";
+const VERSION_INFO_PATH = "/version-info-ee.json";
+const JAR_FILE = "metabase.jar";
+const RELEASE_TAG$1 = /^v(?<edition>[01])\.\d+\.\d+(?:\.\d+)?(?:-[\w.]+)?$/;
+const ENTERPRISE_EDITION = "1";
+function isReleaseTag(value) {
+	return RELEASE_TAG$1.test(value);
+}
+function jarDownloadUrl(version) {
+	const edition = RELEASE_TAG$1.exec(version)?.groups?.["edition"];
+	if (edition === void 0) throw new Error(`${version} is not a Metabase release tag`);
+	return `${DOWNLOADS_HOST}${edition === ENTERPRISE_EDITION ? "/enterprise" : ""}/${version}/${JAR_FILE}`;
+}
+function releaseLookup(signal, options = {}) {
+	const http = createHttp({
+		baseUrl: VERSION_INFO_HOST,
+		auth: NO_AUTH,
+		signal,
+		...options
+	});
+	return { async latestVersion() {
+		return (await http.requestJson("GET", VERSION_INFO_PATH, { schema: VersionInfo })).latest.version;
+	} };
+}
+function fileDownloader(signal, options = {}) {
+	return (url, destination, onProgress) => downloadFile(url, destination, {
+		signal,
+		onProgress,
+		...options
+	});
+}
+//#endregion
 //#region src/tools/process.ts
 var ProcessNotFoundError = class extends Error {
 	command;
@@ -2531,6 +2693,49 @@ function stream(signal, command, args, options) {
 		});
 	});
 }
+async function spawnDetached(command, args, options) {
+	const log = await promises.open(options.logPath, "a");
+	try {
+		return await new Promise((resolve, reject) => {
+			const child = spawn(command, args, {
+				stdio: [
+					"ignore",
+					log.fd,
+					log.fd
+				],
+				cwd: options.cwd,
+				env: environmentWith(options.env),
+				detached: true
+			});
+			child.on("error", (error) => {
+				reject(isFileNotFound(error) ? new ProcessNotFoundError(command) : error);
+			});
+			child.on("spawn", () => {
+				child.unref();
+				if (child.pid === void 0) {
+					reject(/* @__PURE__ */ new Error(`${command} spawned without a pid`));
+					return;
+				}
+				resolve(child.pid);
+			});
+		});
+	} finally {
+		await log.close();
+	}
+}
+const GONE_PROCESS_CODES = /* @__PURE__ */ new Set(["ESRCH", "EPERM"]);
+function isGoneProcess(error) {
+	return error instanceof Error && "code" in error && typeof error.code === "string" && GONE_PROCESS_CODES.has(error.code);
+}
+function signalProcess(pid, signal) {
+	try {
+		process.kill(pid, signal);
+		return true;
+	} catch (error) {
+		if (isGoneProcess(error)) return false;
+		throw error;
+	}
+}
 function stderrTail(stderr) {
 	return stderr.trim().split("\n").slice(-5).join("\n");
 }
@@ -2615,15 +2820,71 @@ async function whichCommand(name) {
 	return null;
 }
 //#endregion
+//#region src/tools/java.ts
+const JAVA = "java";
+const JAVA_INSTALL_HINT = `install a Java 21+ runtime (Temurin from https://adoptium.net, or your package manager) or point JAVA_HOME at one`;
+const VERSION_LINE = /version "(?<version>[^"]+)"/;
+const LEGACY_MAJOR = 1;
+function javaMajor(version) {
+	const [first, second] = version.split(".").map((part) => Number.parseInt(part, 10));
+	if (first === void 0 || Number.isNaN(first)) return null;
+	if (first === LEGACY_MAJOR && second !== void 0 && !Number.isNaN(second)) return second;
+	return first;
+}
+async function javaPath() {
+	const home = readEnv(ENV_JAVA_HOME);
+	if (home !== void 0) {
+		const candidate = join(home, "bin", JAVA);
+		if (await isExecutable(candidate)) return candidate;
+	}
+	return whichCommand(JAVA);
+}
+function javaTool(runner) {
+	async function find() {
+		const path = await javaPath();
+		if (path === null) return {
+			found: false,
+			reason: "java is not installed"
+		};
+		let output;
+		try {
+			const result = await runner.run(path, ["-version"]);
+			if (result.exitCode !== 0) return {
+				found: false,
+				reason: `${path} -version failed: ${stderrTail(result.stderr)}`
+			};
+			output = result.stderr;
+		} catch (error) {
+			if (error instanceof ProcessNotFoundError) return {
+				found: false,
+				reason: "java is not installed"
+			};
+			throw error;
+		}
+		const version = VERSION_LINE.exec(output)?.groups?.["version"];
+		if (version === void 0) return {
+			found: false,
+			reason: `${path} -version printed no version`
+		};
+		const major = javaMajor(version);
+		if (major === null) return {
+			found: false,
+			reason: `${path} reports an unreadable version ${version}`
+		};
+		return {
+			found: true,
+			path,
+			version,
+			major
+		};
+	}
+	return { find };
+}
+//#endregion
 //#region src/tools/docker.ts
 const DOCKER = "docker";
 const CONTAINER_DATA_DIR = "/rde";
 const LOOPBACK_HOST = "127.0.0.1";
-const CONTAINER_PORT$1 = 3e3;
-const ENV_DB_FILE = `MB_DB_FILE=${CONTAINER_DATA_DIR}/metabase.db`;
-const ENV_PLUGINS_DIR = `MB_PLUGINS_DIR=${CONTAINER_DATA_DIR}/plugins`;
-const STAGING_STORE_ENV = ["MB_RUN_MODE=e2e", "MB_STORE_USE_STAGING=true"];
-const ALLOW_LOCAL_WAREHOUSES_ENV = "MB_WAREHOUSE_ALLOWED_NETWORKS=allow-all";
 const ENV_HOST_UID = "MUID";
 const ENV_HOST_GID = "MGID";
 const ADD_HOST_GATEWAY = `--add-host=${DOCKER_HOST_ALIAS}:host-gateway`;
@@ -2659,17 +2920,10 @@ function createArgs(options) {
 		"--name",
 		options.name,
 		"-p",
-		`${LOOPBACK_HOST}:${options.port}:${CONTAINER_PORT$1}`,
-		"-v",
-		`${options.dataDir}:${CONTAINER_DATA_DIR}`,
-		"-e",
-		ENV_DB_FILE,
-		"-e",
-		ENV_PLUGINS_DIR,
-		"-e",
-		`MB_SITE_URL=http://localhost:${options.port}`
+		`${LOOPBACK_HOST}:${options.port.host}:${options.port.container}`
 	];
-	for (const env of [...STAGING_STORE_ENV, ALLOW_LOCAL_WAREHOUSES_ENV]) args.push("-e", env);
+	if (options.mount !== null) args.push("-v", `${options.mount.source}:${options.mount.target}`);
+	for (const [name, value] of Object.entries(options.env)) args.push("-e", `${name}=${value}`);
 	if (options.hostUser !== null) {
 		args.push("-e", `${ENV_HOST_UID}=${options.hostUser.uid}`);
 		args.push("-e", `${ENV_HOST_GID}=${options.hostUser.gid}`);
@@ -2714,7 +2968,7 @@ function dockerTool(runner) {
 		const result = await runner.run(DOCKER, args, { onLine: options.onLine });
 		if (result.exitCode !== 0) throw toolFailure(DOCKER, args, result);
 	}
-	async function imageExists(image) {
+	async function imageId(image) {
 		const args = [
 			"image",
 			"inspect",
@@ -2723,8 +2977,8 @@ function dockerTool(runner) {
 			"{{.Id}}"
 		];
 		const result = await runner.run(DOCKER, args);
-		if (result.exitCode === 0) return true;
-		if (NO_SUCH_IMAGE.test(result.stderr)) return false;
+		if (result.exitCode === 0) return result.stdout.trim();
+		if (NO_SUCH_IMAGE.test(result.stderr)) return null;
 		throw toolFailure(DOCKER, args, result);
 	}
 	async function imageRemove(image) {
@@ -2746,6 +3000,14 @@ function dockerTool(runner) {
 			ports: portMappings(container.HostConfig.PortBindings)
 		};
 	}
+	async function containerImageId(name) {
+		return (await docker([
+			"inspect",
+			name,
+			"--format",
+			"{{.Image}}"
+		])).stdout.trim();
+	}
 	async function containerCreate(options) {
 		await docker(createArgs(options));
 	}
@@ -2758,6 +3020,13 @@ function dockerTool(runner) {
 	async function containerRemove(name) {
 		await docker(["rm", name]);
 	}
+	async function containerExecSucceeds(name, command) {
+		return (await runner.run(DOCKER, [
+			"exec",
+			name,
+			...command
+		])).exitCode === 0;
+	}
 	async function containerLogs(name, options) {
 		const args = ["logs"];
 		if (options.follow) args.push("--follow");
@@ -2768,17 +3037,213 @@ function dockerTool(runner) {
 	return {
 		available,
 		imagePull,
-		imageExists,
+		imageId,
 		imageRemove,
 		containerInspect,
+		containerImageId,
 		containerCreate,
 		containerStart,
 		containerStop,
 		containerRemove,
+		containerExecSucceeds,
 		containerLogs
 	};
 }
 //#endregion
+//#region src/runtime/server.ts
+const DEFAULT_PORT = 3100;
+const PLUGINS_DIR = "plugins";
+const DB_DIR = "metabase.db";
+const DB_FILE = "metabase.db";
+const STAGING_STORE_ENV = {
+	MB_RUN_MODE: "e2e",
+	MB_STORE_USE_STAGING: "true"
+};
+const ALLOW_LOCAL_WAREHOUSES_ENV = { MB_WAREHOUSE_ALLOWED_NETWORKS: "allow-all" };
+const NO_H2_SAMPLE_ENV = { MB_LOAD_SAMPLE_CONTENT: "false" };
+function instanceUrl(port) {
+	return `http://localhost:${port}`;
+}
+function serverEnv(options) {
+	return {
+		MB_DB_FILE: options.dbFile,
+		MB_PLUGINS_DIR: options.pluginsDir,
+		MB_SITE_URL: instanceUrl(options.port),
+		...STAGING_STORE_ENV,
+		...ALLOW_LOCAL_WAREHOUSES_ENV,
+		...NO_H2_SAMPLE_ENV
+	};
+}
+function jettyEnv(port) {
+	return {
+		MB_JETTY_HOST: LOOPBACK_HOST,
+		MB_JETTY_PORT: String(port)
+	};
+}
+//#endregion
+//#region src/runtime/jar.ts
+const LATEST = "latest";
+const JAR_SUFFIX = ".jar";
+const LOG_FILE = "metabase.log";
+const PID_FILE = "metabase.pid";
+const PID_FILE_MODE = 384;
+const JAR_STOP_GRACE_MS = 3e4;
+const BYTES_PER_MB = 1048576;
+const TAG_PREFIX = "v";
+function parseJarSpec(value) {
+	const trimmed = value.trim();
+	if (trimmed === "latest") return { kind: "latest" };
+	if (trimmed.endsWith(JAR_SUFFIX)) return {
+		kind: "file",
+		path: resolve(trimmed)
+	};
+	const tagged = trimmed.startsWith(TAG_PREFIX) ? trimmed : `${TAG_PREFIX}${trimmed}`;
+	return isReleaseTag(tagged) ? {
+		kind: "release",
+		version: tagged
+	} : null;
+}
+function jarPathOf(source, jarsDir) {
+	switch (source.kind) {
+		case "release": return releaseJarIn(jarsDir, source.version);
+		case "file": return source.path;
+	}
+}
+function describeJar(source) {
+	switch (source.kind) {
+		case "release": return `Metabase ${source.version} jar`;
+		case "file": return `jar ${source.path}`;
+	}
+}
+function logPathOf(instanceDir) {
+	return join(instanceDir, LOG_FILE);
+}
+function pidPathOf(instanceDir) {
+	return join(instanceDir, PID_FILE);
+}
+async function pathExists$1(path) {
+	try {
+		await promises.access(path);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function requireJava(java) {
+	const found = await java.find();
+	if (!found.found) throw new ConfigError(`${found.reason}; ${JAVA_INSTALL_HINT}`);
+	if (found.major < 21) throw new ConfigError(`Java ${found.version} at ${found.path} is too old: Metabase needs 21 or newer; ${JAVA_INSTALL_HINT}`);
+	return found;
+}
+function megabytes(bytes) {
+	return (bytes / BYTES_PER_MB).toFixed(0);
+}
+function progressLine(progress) {
+	if (progress.total === null) return `${megabytes(progress.received)} MB`;
+	return `${megabytes(progress.received)} of ${megabytes(progress.total)} MB`;
+}
+async function readPid(pidPath) {
+	let text;
+	try {
+		text = await promises.readFile(pidPath, "utf8");
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
+		throw error;
+	}
+	const pid = Number.parseInt(text.trim(), 10);
+	if (Number.isNaN(pid) || pid <= 0) throw new ConfigError(`${pidPath} does not hold a pid; delete it and run \`rde start\``);
+	return pid;
+}
+async function runningJarPid(instanceDir, jarPath, daemon) {
+	const pid = await readPid(pidPathOf(instanceDir));
+	if (pid === null) return null;
+	const commandLine = await daemon.commandLine(pid);
+	return commandLine !== null && commandLine.includes(jarPath) ? pid : null;
+}
+async function inspectJar(state, deps) {
+	const jarPath = jarPathOf(state.source, deps.jarsDir);
+	return {
+		jarPath,
+		jarExists: await pathExists$1(jarPath),
+		pid: await runningJarPid(deps.instanceDir, jarPath, deps.daemon)
+	};
+}
+function jarRuntime(state, deps) {
+	const { daemon } = deps;
+	const url = instanceUrl(state.port);
+	const jarPath = jarPathOf(state.source, deps.jarsDir);
+	const logPath = logPathOf(deps.instanceDir);
+	const pidPath = pidPathOf(deps.instanceDir);
+	function runningPid() {
+		return runningJarPid(deps.instanceDir, jarPath, daemon);
+	}
+	async function ensureJar(options) {
+		if (await pathExists$1(jarPath)) return;
+		switch (state.source.kind) {
+			case "file": throw new ConfigError(`${jarPath} does not exist; run \`rde init\` again with another jar`);
+			case "release":
+				await promises.mkdir(dirname(jarPath), { recursive: true });
+				await deps.download(jarDownloadUrl(state.source.version), jarPath, (progress) => options.onProgress(progressLine(progress)));
+		}
+	}
+	async function install(options) {
+		await requireJava(deps.java);
+		await promises.mkdir(join(deps.dataDir, PLUGINS_DIR), { recursive: true });
+		await promises.mkdir(join(deps.dataDir, DB_DIR), { recursive: true });
+		await ensureJar(options);
+	}
+	async function start() {
+		if (await runningPid() !== null) return;
+		if (!await pathExists$1(jarPath)) throw new ConfigError(`${jarPath} does not exist; run \`rde init\``);
+		const java = await requireJava(deps.java);
+		await promises.mkdir(deps.instanceDir, { recursive: true });
+		const pid = await daemon.start({
+			command: java.path,
+			args: ["-jar", jarPath],
+			options: {
+				cwd: deps.dataDir,
+				env: {
+					...serverEnv({
+						dbFile: join(deps.dataDir, DB_DIR, DB_FILE),
+						pluginsDir: join(deps.dataDir, PLUGINS_DIR),
+						port: state.port
+					}),
+					...jettyEnv(state.port)
+				},
+				logPath
+			}
+		});
+		await promises.writeFile(pidPath, `${pid}\n`, { mode: PID_FILE_MODE });
+	}
+	async function stop() {
+		const pid = await runningPid();
+		if (pid !== null) await daemon.terminate(pid, { graceMs: JAR_STOP_GRACE_MS });
+		await promises.rm(pidPath, { force: true });
+	}
+	async function status() {
+		const inspection = await inspectJar(state, deps);
+		return {
+			installed: inspection.jarExists,
+			running: inspection.pid !== null,
+			url
+		};
+	}
+	async function logs(options) {
+		if (!await pathExists$1(logPath)) throw new ConfigError(`${logPath} does not exist yet; run \`rde start\``);
+		await daemon.tailLog(logPath, options);
+	}
+	return {
+		kind: "jar",
+		install,
+		start,
+		stop,
+		status,
+		logs,
+		url: () => url,
+		hostAlias: () => null
+	};
+}
+//#endregion
 //#region src/runtime/port.ts
 const PORT_SCAN_LIMIT = 100;
 function canBind(port) {
@@ -2818,93 +3283,342 @@ const hostPortProbe = {
 	findFree: findFreePort
 };
 //#endregion
-//#region src/tools/agents.ts
-const AgentId = z.enum([
-	"claude-code",
-	"codex",
-	"cursor",
-	"gemini-cli",
-	"opencode",
-	"windsurf"
-]);
-const AGENTS = [
-	{
-		id: "claude-code",
-		displayName: "Claude Code",
-		skillsCliName: "claude-code",
-		command: "claude",
-		launch: "claude",
-		configDir: (home) => join(home, ".claude")
-	},
-	{
-		id: "codex",
-		displayName: "Codex",
-		skillsCliName: "codex",
-		command: "codex",
-		launch: "codex",
-		configDir: (home) => join(home, ".codex")
-	},
-	{
-		id: "cursor",
-		displayName: "Cursor",
-		skillsCliName: "cursor",
-		command: "cursor",
-		launch: "cursor .",
-		configDir: (home) => join(home, ".cursor")
-	},
-	{
-		id: "gemini-cli",
-		displayName: "Gemini CLI",
-		skillsCliName: "gemini-cli",
-		command: "gemini",
-		launch: "gemini",
-		configDir: (home) => join(home, ".gemini")
-	},
-	{
-		id: "opencode",
-		displayName: "OpenCode",
-		skillsCliName: "opencode",
-		command: "opencode",
-		launch: "opencode",
-		configDir: (_home, configHome) => join(configHome, "opencode")
-	},
-	{
-		id: "windsurf",
-		displayName: "Windsurf",
-		skillsCliName: "windsurf",
-		command: null,
-		launch: "windsurf .",
-		configDir: (home) => join(home, ".codeium", "windsurf")
-	}
-];
-async function directoryExists$1(path) {
-	try {
-		return (await promises.stat(path)).isDirectory();
-	} catch {
-		return false;
-	}
+//#region src/tools/daemon.ts
+const PS = "ps";
+const EXIT_POLL_MS = 250;
+const TAIL = "tail";
+const WHOLE_FILE = "+1";
+function tailArgs(path, options) {
+	const args = ["-n", options.tail === null ? WHOLE_FILE : String(options.tail)];
+	if (options.follow) args.push("-f");
+	args.push(path);
+	return args;
 }
-function hostAgentProbe() {
-	const home = homedir();
+function daemonTool(runner) {
+	async function commandLine(pid) {
+		if (!signalProcess(pid, 0)) return null;
+		const result = await runner.run(PS, [
+			"-o",
+			"command=",
+			"-p",
+			String(pid)
+		]);
+		const line = result.stdout.trim();
+		return result.exitCode === 0 && line.length > 0 ? line : null;
+	}
+	async function terminate(pid, options) {
+		if (!signalProcess(pid, "SIGTERM")) return;
+		const deadline = Date.now() + options.graceMs;
+		while (Date.now() < deadline) {
+			await setTimeout$1(EXIT_POLL_MS);
+			if (!signalProcess(pid, 0)) return;
+		}
+		signalProcess(pid, "SIGKILL");
+		while (signalProcess(pid, 0)) await setTimeout$1(EXIT_POLL_MS);
+	}
 	return {
-		commandExists: async (command) => await whichCommand(command) !== null,
-		directoryExists: directoryExists$1,
-		home,
-		configHome: readEnv("XDG_CONFIG_HOME") ?? join(home, ".config")
+		start: (spawn) => spawnDetached(spawn.command, spawn.args, spawn.options),
+		commandLine,
+		terminate,
+		tailLog: (path, options) => runner.stream(TAIL, tailArgs(path, options))
 	};
 }
-async function isDetected(agent, probe) {
-	if (agent.command !== null && await probe.commandExists(agent.command)) return true;
-	return probe.directoryExists(agent.configDir(probe.home, probe.configHome));
+//#endregion
+//#region src/runtime/docker.ts
+const DEFAULT_IMAGE = "metabase/metabase-dev:transform-tests-ee";
+const CONTAINER_NAME_PREFIX$1 = "rde-metabase";
+const CONTAINER_PORT = 3e3;
+function containerName(instanceName) {
+	return `${CONTAINER_NAME_PREFIX$1}-${instanceName}`;
 }
-async function detectAgents(probe) {
-	return Promise.all(AGENTS.map(async (agent) => ({
-		id: agent.id,
-		displayName: agent.displayName,
-		skillsCliName: agent.skillsCliName,
-		launch: agent.launch,
-		detected: await isDetected(agent, probe)
-	})));
+function publishesPortOnLoopback(inspection, port) {
+	return inspection.ports.some((mapping) => mapping.container === CONTAINER_PORT && mapping.host === port && mapping.hostIp === "127.0.0.1");
+}
+function hostUserFor(platform, hostUser) {
+	return platform === "linux" ? hostUser : null;
+}
+function dockerRuntime(state, deps) {
+	const { docker } = deps;
+	const url = instanceUrl(state.port);
+	async function inspect() {
+		return docker.containerInspect(state.containerName);
+	}
+	function conflict(reason) {
+		return new ConfigError(`container ${state.containerName} already exists ${reason}; remove it with \`docker rm -f ${state.containerName}\` and run \`rde init\` again`);
+	}
+	async function install(options) {
+		const existing = await inspect();
+		if (existing.exists) {
+			if (existing.image !== state.image) throw conflict(`with image ${existing.image}, not ${state.image}`);
+			if (!publishesPortOnLoopback(existing, state.port)) throw conflict(`without port ${state.port} published on ${LOOPBACK_HOST}`);
+			return;
+		}
+		await promises.mkdir(join(deps.dataDir, PLUGINS_DIR), { recursive: true });
+		await docker.imagePull(state.image, { onLine: options.onProgress });
+		await docker.containerCreate({
+			name: state.containerName,
+			image: state.image,
+			port: {
+				host: state.port,
+				container: CONTAINER_PORT
+			},
+			mount: {
+				source: deps.dataDir,
+				target: CONTAINER_DATA_DIR
+			},
+			env: serverEnv({
+				dbFile: `${CONTAINER_DATA_DIR}/${DB_DIR}`,
+				pluginsDir: `${CONTAINER_DATA_DIR}/${PLUGINS_DIR}`,
+				port: state.port
+			}),
+			addHostGateway: deps.platform === "linux",
+			hostUser: hostUserFor(deps.platform, deps.hostUser)
+		});
+	}
+	async function start() {
+		const existing = await inspect();
+		if (!existing.exists) throw new ConfigError(`container ${state.containerName} does not exist; run \`rde init\``);
+		if (existing.running) return;
+		await docker.containerStart(state.containerName);
+	}
+	async function stop() {
+		const existing = await inspect();
+		if (!existing.exists || !existing.running) return;
+		await docker.containerStop(state.containerName);
+	}
+	async function status() {
+		const existing = await inspect();
+		return {
+			installed: existing.exists,
+			running: existing.exists && existing.running,
+			url
+		};
+	}
+	async function logs(options) {
+		if (!(await inspect()).exists) throw new ConfigError(`container ${state.containerName} does not exist; run \`rde init\``);
+		await docker.containerLogs(state.containerName, options);
+	}
+	return {
+		kind: "docker",
+		install,
+		start,
+		stop,
+		status,
+		logs,
+		url: () => url,
+		hostAlias: () => state.hostAlias
+	};
+}
+//#endregion
+//#region src/runtime/runtime.ts
+function hostRuntimeDeps(instanceName, signal) {
+	const user = userInfo();
+	const runner = processRunner(signal);
+	return {
+		docker: dockerTool(runner),
+		java: javaTool(runner),
+		daemon: daemonTool(runner),
+		download: fileDownloader(signal),
+		dataDir: instanceDataDir(instanceName),
+		instanceDir: instanceDir(instanceName),
+		jarsDir: jarsDir(),
+		platform: process.platform,
+		hostUser: {
+			uid: user.uid,
+			gid: user.gid
+		}
+	};
+}
+function runtimeFromState(state, deps) {
+	switch (state.kind) {
+		case "docker": return dockerRuntime(state, deps);
+		case "jar": return jarRuntime(state, deps);
+	}
+}
+//#endregion
+//#region src/runtime/sample-database.ts
+const SAMPLE_DATABASE_IMAGE = "metabase/qa-databases:postgres-sample-15";
+const SAMPLE_DATABASE_USER = "metabase";
+const SAMPLE_DATABASE_PASSWORD = "metasample123";
+const SAMPLE_DATABASE_NAME = "sample";
+const SAMPLE_DATABASE_PORT = 15432;
+const SAMPLE_DATABASE_READY_TIMEOUT_MS = 12e4;
+const POSTGRES_PORT = 5432;
+const CONTAINER_NAME_PREFIX = "rde-sampledb";
+const READY_POLL_MS = 1e3;
+const READY_PROBE = [
+	"pg_isready",
+	"-h",
+	LOOPBACK_HOST,
+	"-U",
+	SAMPLE_DATABASE_USER,
+	"-d",
+	SAMPLE_DATABASE_NAME
+];
+function sampleContainerName(instanceName) {
+	return `${CONTAINER_NAME_PREFIX}-${instanceName}`;
+}
+function sampleDatabaseUrl(port) {
+	return `postgres://${SAMPLE_DATABASE_USER}:${SAMPLE_DATABASE_PASSWORD}@localhost:${port}/${SAMPLE_DATABASE_NAME}`;
+}
+function publishesOnLoopback$1(inspection, port) {
+	return inspection.ports.some((mapping) => mapping.container === POSTGRES_PORT && mapping.host === port && mapping.hostIp === "127.0.0.1");
+}
+function sampleDatabaseContainer(state, docker) {
+	const name = state.containerName;
+	function conflict(reason) {
+		return new ConfigError(`container ${name} already exists ${reason}; remove it with \`docker rm -f ${name}\` and run \`rde init\` again`);
+	}
+	async function install(options) {
+		const existing = await docker.containerInspect(name);
+		if (existing.exists) {
+			if (existing.image !== state.image) throw conflict(`with image ${existing.image}, not ${state.image}`);
+			if (!publishesOnLoopback$1(existing, state.port)) throw conflict(`without port ${state.port} published on ${LOOPBACK_HOST}`);
+			return;
+		}
+		await docker.imagePull(state.image, { onLine: options.onProgress });
+		await docker.containerCreate({
+			name,
+			image: state.image,
+			port: {
+				host: state.port,
+				container: POSTGRES_PORT
+			},
+			mount: null,
+			env: {},
+			addHostGateway: false,
+			hostUser: null
+		});
+	}
+	async function start() {
+		const existing = await docker.containerInspect(name);
+		if (!existing.exists) return "missing";
+		if (existing.running) return "running";
+		await docker.containerStart(name);
+		return "started";
+	}
+	async function stop() {
+		const existing = await docker.containerInspect(name);
+		if (existing.exists && existing.running) await docker.containerStop(name);
+	}
+	async function status() {
+		const existing = await docker.containerInspect(name);
+		return {
+			installed: existing.exists,
+			running: existing.exists && existing.running
+		};
+	}
+	async function waitReady(options) {
+		const deadline = Date.now() + options.timeoutMs;
+		const interval = options.pollMs ?? READY_POLL_MS;
+		for (;;) {
+			if (await docker.containerExecSucceeds(name, READY_PROBE)) return;
+			const existing = await docker.containerInspect(name);
+			if (!existing.exists || !existing.running) throw new ConfigError(`container ${name} stopped before Postgres was ready; \`docker logs ${name}\` shows why`);
+			if (Date.now() >= deadline) throw new ConfigError(`Postgres in ${name} is not ready after ${Math.round(options.timeoutMs / 1e3)}s; \`docker logs ${name}\` shows what it is doing`);
+			try {
+				await setTimeout$1(interval, void 0, { signal: options.signal });
+			} catch {
+				throw new AbortError();
+			}
+		}
+	}
+	return {
+		install,
+		start,
+		stop,
+		status,
+		waitReady
+	};
+}
+//#endregion
+//#region src/tools/agents.ts
+const AgentId = z.enum([
+	"claude-code",
+	"codex",
+	"cursor",
+	"gemini-cli",
+	"opencode",
+	"windsurf"
+]);
+const AGENTS = [
+	{
+		id: "claude-code",
+		displayName: "Claude Code",
+		skillsCliName: "claude-code",
+		command: "claude",
+		launch: "claude",
+		configDir: (home) => join(home, ".claude")
+	},
+	{
+		id: "codex",
+		displayName: "Codex",
+		skillsCliName: "codex",
+		command: "codex",
+		launch: "codex",
+		configDir: (home) => join(home, ".codex")
+	},
+	{
+		id: "cursor",
+		displayName: "Cursor",
+		skillsCliName: "cursor",
+		command: "cursor",
+		launch: "cursor .",
+		configDir: (home) => join(home, ".cursor")
+	},
+	{
+		id: "gemini-cli",
+		displayName: "Gemini CLI",
+		skillsCliName: "gemini-cli",
+		command: "gemini",
+		launch: "gemini",
+		configDir: (home) => join(home, ".gemini")
+	},
+	{
+		id: "opencode",
+		displayName: "OpenCode",
+		skillsCliName: "opencode",
+		command: "opencode",
+		launch: "opencode",
+		configDir: (_home, configHome) => join(configHome, "opencode")
+	},
+	{
+		id: "windsurf",
+		displayName: "Windsurf",
+		skillsCliName: "windsurf",
+		command: null,
+		launch: "windsurf .",
+		configDir: (home) => join(home, ".codeium", "windsurf")
+	}
+];
+async function directoryExists$1(path) {
+	try {
+		return (await promises.stat(path)).isDirectory();
+	} catch {
+		return false;
+	}
+}
+function hostAgentProbe() {
+	const home = homedir();
+	return {
+		commandExists: async (command) => await whichCommand(command) !== null,
+		directoryExists: directoryExists$1,
+		home,
+		configHome: readEnv("XDG_CONFIG_HOME") ?? join(home, ".config")
+	};
+}
+async function isDetected(agent, probe) {
+	if (agent.command !== null && await probe.commandExists(agent.command)) return true;
+	return probe.directoryExists(agent.configDir(probe.home, probe.configHome));
+}
+async function detectAgents(probe) {
+	return Promise.all(AGENTS.map(async (agent) => ({
+		id: agent.id,
+		displayName: agent.displayName,
+		skillsCliName: agent.skillsCliName,
+		launch: agent.launch,
+		detected: await isDetected(agent, probe)
+	})));
 }
 //#endregion
 //#region src/tools/mb.ts
@@ -3282,11 +3996,10 @@ function skillsCli(runner) {
 }
 //#endregion
 //#region src/steps/agents-skills.ts
-const STEP_ID$7 = "agents-skills";
-const AGENTS_SKILLS_KEYS = { agents: `${STEP_ID$7}.agents` };
-const DETECTED_HINT = "detected";
+const STEP_ID$8 = "agents-skills";
 const MECHANICS_NOTE = "The skill's mechanics come from `mb skills get <name>` at runtime, so nothing else needs installing.";
-function hostDeps$9(ctx) {
+const DETECT_AGENTS = { agents: null };
+function hostDeps$11(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
 		probe: hostAgentProbe()
@@ -3295,6 +4008,9 @@ function hostDeps$9(ctx) {
 function detectedOnly(agents) {
 	return agents.filter((agent) => agent.detected);
 }
+function displayNames(agents) {
+	return agents.map((agent) => agent.displayName).join(", ");
+}
 function skillCoversAgent(entry, agent) {
 	return entry.agents.includes(agent.displayName);
 }
@@ -3304,45 +4020,53 @@ function coversAny(entry, agents) {
 async function rdeSkillEntries(runner) {
 	return (await skillsCli(runner).list()).filter((entry) => entry.name === "rde");
 }
-function agentChoice(agent) {
+function installedLines(entries) {
+	return entries.map((entry) => `${entry.agents.join(", ")}: ${entry.path}`).join("\n");
+}
+const SOURCE_NOTES = {
+	override: "from --agents",
+	detected: "detected on this machine"
+};
+function selectAgents(all, options) {
+	if (options.agents === null) return {
+		agents: detectedOnly(all),
+		source: "detected"
+	};
+	const chosen = options.agents;
 	return {
-		value: agent.id,
-		label: agent.displayName,
-		...agent.detected && { hint: DETECTED_HINT }
+		agents: all.filter((agent) => chosen.includes(agent.id)),
+		source: "override"
 	};
 }
-function installedLines(entries) {
-	return entries.map((entry) => `${entry.agents.join(", ")}: ${entry.path}`).join("\n");
+function skipLine(all, source) {
+	switch (source) {
+		case "override": return `Skipping the rde skill; run \`rde init --only ${STEP_ID$8}\` to install it later`;
+		case "detected": return `No coding agent found (${displayNames(all)}); run \`rde init --only ${STEP_ID$8} --agents <name>\` once one is installed`;
+	}
 }
-function agentsSkillsStep(deps = hostDeps$9) {
+function agentsSkillsStep(options, deps = hostDeps$11) {
 	return {
-		id: STEP_ID$7,
+		id: STEP_ID$8,
 		title: "Install the rde skill for your coding agents",
 		async detect(ctx) {
 			const resolved = deps(ctx);
 			const detected = detectedOnly(await detectAgents(resolved.probe));
-			if (detected.length === 0) return ctx.state.steps[STEP_ID$7]?.status === "skipped" ? "not-applicable" : "todo";
+			if (detected.length === 0) return ctx.state.steps[STEP_ID$8]?.status === "skipped" ? "not-applicable" : "todo";
 			return (await rdeSkillEntries(resolved.runner)).some((entry) => coversAny(entry, detected)) ? "done" : "todo";
 		},
 		async run(ctx) {
 			const resolved = deps(ctx);
-			const agents = await detectAgents(resolved.probe);
-			const chosen = await ctx.prompts.multiselect({
-				key: AGENTS_SKILLS_KEYS.agents,
-				message: "Install the rde skill for which coding agents?",
-				choices: agents.map(agentChoice),
-				initialValues: detectedOnly(agents).map((agent) => agent.id),
-				required: false
-			});
-			if (chosen.length === 0) {
-				ctx.ui.info(`Skipping the rde skill; run \`rde init --only ${STEP_ID$7}\` to install it later`);
+			const all = await detectAgents(resolved.probe);
+			const selection = selectAgents(all, options);
+			if (selection.agents.length === 0) {
+				ctx.ui.info(skipLine(all, selection.source));
 				return "skipped";
 			}
-			const selected = agents.filter((agent) => chosen.includes(agent.id));
+			ctx.ui.info(`Installing the rde skill for ${displayNames(selection.agents)} (${SOURCE_NOTES[selection.source]})`);
 			await skillsCli(resolved.runner).add({
 				source: RDE_SKILL_SOURCE,
 				skill: "rde",
-				agents: selected.map((agent) => agent.skillsCliName)
+				agents: selection.agents.map((agent) => agent.skillsCliName)
 			});
 			const entries = await rdeSkillEntries(resolved.runner);
 			if (entries.length === 0) throw new ConfigError(`the skills installer finished but \`skills list\` does not show the rde skill`);
@@ -3354,30 +4078,19 @@ function agentsSkillsStep(deps = hostDeps$9) {
 }
 //#endregion
 //#region src/steps/install-mb.ts
-const STEP_ID$6 = "install-mb";
-const INSTALL_MB_KEYS = {
-	packageManager: `${STEP_ID$6}.package-manager`,
-	confirm: `${STEP_ID$6}.confirm`
-};
+const STEP_ID$7 = "install-mb";
 const MIN_MB_VERSION = "0.3.0";
 const MB_RANGE = `>=${MIN_MB_VERSION}`;
-const PACKAGE_MANAGERS = [
-	"npm",
-	"pnpm",
-	"yarn",
-	"bun"
-];
 function installedWith(scriptPath) {
 	return scriptPath === void 0 ? "npm" : packageManagerFor(scriptPath);
 }
 function rdeInstalledWith() {
 	return installedWith(process.argv[1]);
 }
-function hostDeps$8(ctx) {
+function hostDeps$10(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
-		installedWith: rdeInstalledWith(),
-		commandExists: async (name) => await whichCommand(name) !== null
+		installedWith: rdeInstalledWith()
 	};
 }
 async function inspectMb(runner) {
@@ -3391,35 +4104,9 @@ async function inspectMb(runner) {
 		satisfies: semver.satisfies(version, MB_RANGE, { includePrerelease: true })
 	};
 }
-async function candidateManagers(deps) {
-	const others = [];
-	for (const manager of PACKAGE_MANAGERS) if (manager !== deps.installedWith && await deps.commandExists(manager)) others.push(manager);
-	return [deps.installedWith, ...others];
-}
-function managerChoice(manager, preferred) {
-	return {
-		value: manager,
-		label: manager,
-		...manager === preferred && { hint: "installed rde" }
-	};
-}
 function displayCommand(install) {
 	return [install.command, ...install.args].join(" ");
 }
-async function chooseManager(ctx, deps, verb) {
-	const managers = await candidateManagers(deps);
-	if (managers.length > 1) return ctx.prompts.select({
-		key: INSTALL_MB_KEYS.packageManager,
-		message: `${verb} ${MB_PACKAGE} globally with which package manager?`,
-		choices: managers.map((manager) => managerChoice(manager, deps.installedWith))
-	});
-	if (!await ctx.prompts.confirm({
-		key: INSTALL_MB_KEYS.confirm,
-		message: `${verb} @metabase/cli globally with ${deps.installedWith}?`,
-		initialValue: true
-	})) throw new ConfigError(`mb is required; install it with \`${displayCommand(mbInstallCommand(deps.installedWith))}\` and run rde init again`);
-	return deps.installedWith;
-}
 function stillWrong(install, after) {
 	const found = after.installed ? `mb ${after.version} is still what is on PATH (${MIN_MB_VERSION} or newer is required)` : "mb is not on PATH after the install";
 	return new ExternalToolError({
@@ -3429,9 +4116,9 @@ function stillWrong(install, after) {
 		stderrTail: `${found}; open a new terminal and run rde init again`
 	});
 }
-function installMbStep(deps = hostDeps$8) {
+function installMbStep(deps = hostDeps$10) {
 	return {
-		id: STEP_ID$6,
+		id: STEP_ID$7,
 		title: "Install the Metabase CLI",
 		async detect(ctx) {
 			const found = await inspectMb(deps(ctx).runner);
@@ -3445,7 +4132,7 @@ function installMbStep(deps = hostDeps$8) {
 				return "completed";
 			}
 			if (before.installed) ctx.ui.warn(`mb ${before.version} is installed; ${MIN_MB_VERSION} or newer is required`);
-			const install = mbInstallCommand(await chooseManager(ctx, resolved, before.installed ? "Upgrade" : "Install"));
+			const install = mbInstallCommand(resolved.installedWith);
 			ctx.ui.info(`Running ${displayCommand(install)}`);
 			const exitCode = await resolved.runner.stream(install.command, install.args);
 			if (exitCode !== 0) throw new ExternalToolError({
@@ -3606,25 +4293,35 @@ const NODE_RANGE = `>=${MIN_NODE_VERSION}`;
 const NODE_HINT = `Install Node ${MIN_NODE_VERSION} or newer from https://nodejs.org or with your version manager`;
 const MARK_OK = "✓";
 const MARK_MISSING = "✗";
+const MARK_OPTIONAL = "–";
+const DOCKER_OPTIONAL = `Metabase can run as a jar with Java instead, without the sample database`;
+const JAVA_OPTIONAL = `Metabase can run in Docker instead`;
 const PLATFORMS = {
 	darwin: {
 		name: "macOS",
 		gitHint: "Install the Xcode Command Line Tools: xcode-select --install",
-		dockerHint: "Install Docker Desktop (https://www.docker.com/products/docker-desktop/), OrbStack, or colima, and start it"
+		dockerHint: "Install Docker Desktop (https://www.docker.com/products/docker-desktop/), OrbStack, or colima, and start it",
+		javaHint: `Install Java 21 or newer: brew install --cask temurin@21, or from https://adoptium.net`
 	},
 	linux: {
 		name: "Linux",
 		gitHint: "Install the git package with your distribution's package manager",
-		dockerHint: "Install the docker package, start the daemon, and add yourself to the docker group: sudo usermod -aG docker $USER (then log in again)"
+		dockerHint: "Install the docker package, start the daemon, and add yourself to the docker group: sudo usermod -aG docker $USER (then log in again)",
+		javaHint: `Install Java 21 or newer with your distribution's package manager (openjdk-21-jre) or from https://adoptium.net`
 	}
 };
-function hostDeps$7(ctx) {
+function hostDeps$9(ctx) {
+	const runner = processRunner(ctx.signal);
 	return {
 		platform: process.platform,
 		nodeVersion: process.version,
-		runner: processRunner(ctx.signal)
+		runner,
+		java: javaTool(runner)
 	};
 }
+function blocks(check) {
+	return !check.ok && check.optional === null;
+}
 function isSupported(platform) {
 	return platform === "darwin" || platform === "linux";
 }
@@ -3641,7 +4338,8 @@ function nodeCheck(nodeVersion) {
 		id: "node",
 		ok: false,
 		label: `Node ${nodeVersion} (${MIN_NODE_VERSION} or newer is required)`,
-		hint: NODE_HINT
+		hint: NODE_HINT,
+		optional: null
 	};
 }
 async function gitCheck(runner, facts) {
@@ -3656,7 +4354,8 @@ async function gitCheck(runner, facts) {
 			id: "git",
 			ok: false,
 			label: "git is not installed",
-			hint: facts.gitHint
+			hint: facts.gitHint,
+			optional: null
 		};
 		throw error;
 	}
@@ -3672,8 +4371,35 @@ async function dockerCheck(runner, facts) {
 		id: "docker",
 		ok: false,
 		label: `Docker: ${docker.reason}`,
-		hint: facts.dockerHint
+		hint: facts.dockerHint,
+		optional: null
+	};
+}
+async function javaCheck(tool, facts) {
+	const java = await tool.find();
+	if (java.found && java.major >= 21) return {
+		id: "java",
+		ok: true,
+		label: `Java ${java.version}`
 	};
+	return {
+		id: "java",
+		ok: false,
+		label: java.found ? `Java ${java.version} (21 or newer is required)` : `Java: ${java.reason}`,
+		hint: facts.javaHint,
+		optional: null
+	};
+}
+function coveredBy(check, other, optional) {
+	return !check.ok && other.ok ? {
+		...check,
+		optional
+	} : check;
+}
+async function runtimeChecks(deps, facts) {
+	const docker = await dockerCheck(deps.runner, facts);
+	const java = await javaCheck(deps.java, facts);
+	return [coveredBy(docker, java, DOCKER_OPTIONAL), coveredBy(java, docker, JAVA_OPTIONAL)];
 }
 async function runChecks(deps, platform) {
 	const facts = PLATFORMS[platform];
@@ -3685,7 +4411,7 @@ async function runChecks(deps, platform) {
 		},
 		nodeCheck(deps.nodeVersion),
 		await gitCheck(deps.runner, facts),
-		await dockerCheck(deps.runner, facts)
+		...await runtimeChecks(deps, facts)
 	];
 }
 async function machineChecks(deps) {
@@ -3693,46 +4419,54 @@ async function machineChecks(deps) {
 		id: "platform",
 		ok: false,
 		label: `${deps.platform} is not supported`,
-		hint: "rde runs on macOS and Linux"
+		hint: "rde runs on macOS and Linux",
+		optional: null
 	}];
 	return runChecks(deps, deps.platform);
 }
+function checkLine(check) {
+	if (check.ok) return `${MARK_OK} ${check.label}`;
+	if (check.optional !== null) return `${MARK_OPTIONAL} ${check.label}; ${check.optional}\n  ${check.hint}`;
+	return `${MARK_MISSING} ${check.label}\n  ${check.hint}`;
+}
 function checkLines(checks) {
-	return checks.map((check) => check.ok ? `${MARK_OK} ${check.label}` : `${MARK_MISSING} ${check.label}\n  ${check.hint}`);
+	return checks.map(checkLine);
 }
-function preflightStep(deps = hostDeps$7) {
+function preflightStep(deps = hostDeps$9) {
 	return {
 		id: "preflight",
 		title: "Check this machine",
 		async detect(ctx) {
-			return (await machineChecks(deps(ctx))).every((check) => check.ok) ? "done" : "todo";
+			return (await machineChecks(deps(ctx))).some(blocks) ? "todo" : "done";
 		},
 		async run(ctx) {
 			const resolved = deps(ctx);
 			if (!isSupported(resolved.platform)) throw unsupportedPlatform(resolved.platform);
 			const checks = await runChecks(resolved, resolved.platform);
 			ctx.ui.note(checkLines(checks).join("\n"), "This machine");
-			if (checks.some((check) => !check.ok)) throw new ConfigError("Fix the items above and run rde init again");
+			if (checks.some(blocks)) throw new ConfigError("Fix the items above and run rde init again");
 			return "completed";
 		}
 	};
 }
 //#endregion
 //#region src/steps/doctor.ts
-function hostDoctorDeps(signal) {
+function hostDoctorDeps(instanceName, signal) {
 	const runner = processRunner(signal);
+	const runtime = hostRuntimeDeps(instanceName, signal);
 	return {
 		platform: process.platform,
 		nodeVersion: process.version,
 		runner,
+		java: runtime.java,
 		installedWith: rdeInstalledWith(),
-		docker: dockerTool(runner),
+		runtime,
 		ports: hostPortProbe,
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, signal),
 		probe: hostAgentProbe()
 	};
 }
-const NOT_FOUND_STATUS$1 = 404;
+const NOT_FOUND_STATUS$2 = 404;
 const NO_INSTANCE = "no instance yet; run `rde init`";
 const NOT_HEALTHY = "Metabase is not healthy";
 function ok(id, label, detail) {
@@ -3763,12 +4497,23 @@ function failed(id, label, failure) {
 		...failure
 	};
 }
-async function machineRows(deps) {
-	return (await machineChecks(deps)).map((check) => check.ok ? ok(check.id, check.id, check.label) : failed(check.id, check.id, {
+const PROGRAM_FOR_RUNTIME = {
+	docker: "docker",
+	jar: "java"
+};
+function machineRow(check, needed) {
+	if (check.ok) return ok(check.id, check.id, check.label);
+	if (!blocks(check) && check.id !== needed) return skipped(check.id, check.id, `${check.label}; ${check.optional}`);
+	return failed(check.id, check.id, {
 		detail: check.label,
 		hint: check.hint,
 		fix: "preflight"
-	}));
+	});
+}
+async function machineRows(deps, runtime) {
+	const checks = await machineChecks(deps);
+	const needed = runtime === null ? null : PROGRAM_FOR_RUNTIME[runtime.kind];
+	return checks.map((check) => machineRow(check, needed));
 }
 function installHint(installedWith) {
 	const install = mbInstallCommand(installedWith);
@@ -3791,20 +4536,27 @@ async function mbRow(deps) {
 function publishesOnLoopback(container, port) {
 	return container.ports.some((mapping) => mapping.host === port && mapping.hostIp === "127.0.0.1");
 }
+const CONTAINER = "the container";
 async function containerRow(runtime, deps, dockerOk) {
 	const label = "container";
 	if (!dockerOk) return {
 		row: skipped("container", label, "Docker is not available"),
-		present: null
+		running: false,
+		holder: CONTAINER
 	};
-	const inspection = await deps.docker.containerInspect(runtime.containerName);
+	const inspection = await deps.runtime.docker.containerInspect(runtime.containerName);
 	if (!inspection.exists) return {
 		row: failed("container", label, {
 			detail: `${runtime.containerName} does not exist`,
 			hint: "`rde init` recreates it from the saved choices",
 			fix: "runtime"
 		}),
-		present: null
+		running: false,
+		holder: CONTAINER
+	};
+	const found = {
+		running: inspection.running,
+		holder: CONTAINER
 	};
 	if (inspection.image !== runtime.image) return {
 		row: failed("container", label, {
@@ -3812,7 +4564,7 @@ async function containerRow(runtime, deps, dockerOk) {
 			hint: `remove it with \`docker rm -f ${runtime.containerName}\` and run \`rde init\``,
 			fix: null
 		}),
-		present: inspection
+		...found
 	};
 	if (!publishesOnLoopback(inspection, runtime.port)) return {
 		row: failed("container", label, {
@@ -3820,20 +4572,51 @@ async function containerRow(runtime, deps, dockerOk) {
 			hint: `remove it with \`docker rm -f ${runtime.containerName}\` and run \`rde init\``,
 			fix: null
 		}),
-		present: inspection
+		...found
+	};
+	const state = inspection.running ? "running" : "stopped";
+	return {
+		row: ok("container", label, `${runtime.containerName} ${state} (${runtime.image})`),
+		...found
+	};
+}
+const JAR_PROCESS = "the Metabase process";
+async function processRow(runtime, deps) {
+	const label = "process";
+	const inspection = await inspectJar(runtime, deps.runtime);
+	const jar = describeJar(runtime.source);
+	if (!inspection.jarExists) {
+		const hint = runtime.source.kind === "release" ? "`rde init` downloads it again" : "put the jar back, or run `rde init` again with another one";
+		return {
+			row: failed("process", label, {
+				detail: `${inspection.jarPath} does not exist`,
+				hint,
+				fix: "runtime"
+			}),
+			running: false,
+			holder: JAR_PROCESS
+		};
+	}
+	const found = {
+		running: inspection.pid !== null,
+		holder: JAR_PROCESS
 	};
-	const state = inspection.running ? "running" : "stopped";
 	return {
-		row: ok("container", label, `${runtime.containerName} ${state} (${runtime.image})`),
-		present: inspection
+		row: ok("process", label, `${jar} ${inspection.pid === null ? "stopped" : `running as pid ${inspection.pid}`}`),
+		...found
 	};
 }
-async function portRow(port, container, ports) {
+function runtimeRow(runtime, deps, dockerOk) {
+	switch (runtime.kind) {
+		case "docker": return containerRow(runtime, deps, dockerOk);
+		case "jar": return processRow(runtime, deps);
+	}
+}
+async function portRow(port, finding, ports) {
 	const free = await ports.isFree(port);
-	const running = container?.running === true;
-	if (running && !free) return ok("port", "port", `${port}, published by the container`);
-	if (running) return failed("port", "port", {
-		detail: `${port} is not answering although the container runs`,
+	if (finding.running && !free) return ok("port", "port", `${port}, held by ${finding.holder}`);
+	if (finding.running) return failed("port", "port", {
+		detail: `${port} is not answering although ${finding.holder} runs`,
 		hint: "`rde logs` shows what Metabase is doing",
 		fix: null
 	});
@@ -3879,14 +4662,26 @@ async function healthRow(url, deps) {
 		throw error;
 	}
 }
-async function adminRow(state, url, deps) {
-	if (!(await deps.client(url, NO_AUTH).session.properties())["has-user-setup"]) return failed("admin", "admin user", {
+function adminRow(state, properties) {
+	if (!properties["has-user-setup"]) return failed("admin", "admin user", {
 		detail: "Metabase has no admin user yet",
 		hint: "`rde init --only admin-user`",
 		fix: "admin-user"
 	});
 	return ok("admin", "admin user", state.admin?.email ?? "created outside rde");
 }
+const VERSION_STEP = "start-metabase";
+function versionRow(state, properties) {
+	const label = "Metabase version";
+	const running = properties.version.tag;
+	if (state.version === null) return ok("version", label, `${running}; \`rde start\` records it in the state file`);
+	if (state.version !== running) return failed("version", label, {
+		detail: `running ${running}, the state file says ${state.version}`,
+		hint: "`rde start` records the running version",
+		fix: VERSION_STEP
+	});
+	return ok("version", label, running);
+}
 function apiKeyRow(state) {
 	if (state.apiKey === null) return failed("api-key", "API key", {
 		detail: "none in the state file",
@@ -3913,8 +4708,8 @@ async function mbProfileRow(state, deps, mbInstalled, healthy) {
 	const user = entry.user === null ? "" : ` as ${entry.user.name}`;
 	return ok("mb-profile", label, `${state.mbProfile}: ok${user}`);
 }
-function isNoToken(error) {
-	return error instanceof MetabaseApiError && error.status === NOT_FOUND_STATUS$1;
+function isNotFound$2(error) {
+	return error instanceof MetabaseApiError && error.status === NOT_FOUND_STATUS$2;
 }
 async function licenseRow(client) {
 	const label = "license";
@@ -3927,7 +4722,7 @@ async function licenseRow(client) {
 		});
 		return ok("license", label, `valid, ${status.features.includes("remote-sync") ? `with ${REMOTE_SYNC_FEATURE}` : `without ${REMOTE_SYNC_FEATURE}, so git sync is unavailable`}`);
 	} catch (error) {
-		if (isNoToken(error)) return skipped("license", label, "not activated; `rde init --from license` adds one");
+		if (isNotFound$2(error)) return skipped("license", label, "not activated; `rde init --from license` adds one");
 		throw error;
 	}
 }
@@ -3945,6 +4740,46 @@ async function databasesRow(state, client) {
 	const names = state.databases.map((record) => record.name).join(", ");
 	return ok("databases", label, `${state.databases.length} connected: ${names}`);
 }
+const SAMPLE_DATABASE_STEP = "sample-database";
+const SAMPLE_LABEL = "sample database";
+async function sampleDatabaseRow(record, deps, dockerOk, client) {
+	const id = "sample-database";
+	if (!dockerOk) return skipped(id, SAMPLE_LABEL, "Docker is not available");
+	const status = await sampleDatabaseContainer(record, deps.runtime.docker).status();
+	if (!status.installed) return failed(id, SAMPLE_LABEL, {
+		detail: `${record.containerName} does not exist`,
+		hint: "`rde init` recreates it",
+		fix: SAMPLE_DATABASE_STEP
+	});
+	if (!status.running) return failed(id, SAMPLE_LABEL, {
+		detail: `${record.containerName} is stopped`,
+		hint: "`rde start`",
+		fix: "start-metabase"
+	});
+	if (await deps.ports.isFree(record.port)) return failed(id, SAMPLE_LABEL, {
+		detail: `${record.containerName} runs but port ${record.port} is not answering`,
+		hint: `\`docker logs ${record.containerName}\` shows what Postgres is doing`,
+		fix: null
+	});
+	const where = `${record.containerName} running on ${LOOPBACK_HOST}:${record.port}`;
+	if (record.databaseId === null) return failed(id, SAMPLE_LABEL, {
+		detail: `${where}; not connected to Metabase yet`,
+		hint: "`rde init` connects it",
+		fix: SAMPLE_DATABASE_STEP
+	});
+	if (client === null) return skipped(id, SAMPLE_LABEL, `${where}; ${NOT_HEALTHY}, so the connection is unchecked`);
+	try {
+		const database = await client.database.get(record.databaseId);
+		return ok(id, SAMPLE_LABEL, `${where}, database ${database.id} sync ${database.initial_sync_status}`);
+	} catch (error) {
+		if (isNotFound$2(error)) return failed(id, SAMPLE_LABEL, {
+			detail: `${where}; database ${record.databaseId} is gone from Metabase`,
+			hint: "`rde init` connects it again",
+			fix: SAMPLE_DATABASE_STEP
+		});
+		throw error;
+	}
+}
 function isMbFailure$1(error) {
 	return error instanceof ProcessNotFoundError || error instanceof ExternalToolError;
 }
@@ -3993,66 +4828,56 @@ async function skillRows(state, deps) {
 		return ok(skillRowId(agent), agentLabel, entry.path);
 	});
 }
-function dockerRuntimeOf(state) {
-	const configured = configuredRuntime(state);
-	if (configured === null || configured.runtime.kind !== "docker") return null;
-	return {
-		runtime: configured.runtime,
-		url: configured.url
-	};
-}
-function noRuntimeRows(state) {
-	const detail = state.runtime?.kind === "jar" ? "the jar runtime is not available yet" : NO_INSTANCE;
+function noRuntimeRows() {
 	return [
-		"container",
+		"runtime",
 		"port",
 		"health"
-	].map((id) => skipped(id, id, detail));
+	].map((id) => skipped(id, id, NO_INSTANCE));
 }
 async function instanceRows(state, deps, dockerOk, mbInstalled) {
-	const docker = dockerRuntimeOf(state);
-	if (docker === null) return [
-		...noRuntimeRows(state),
+	const configured = configuredRuntime(state);
+	if (configured === null) return [
+		...noRuntimeRows(),
+		skipped("version", "Metabase version", NO_INSTANCE),
 		skipped("admin", "admin user", NO_INSTANCE),
 		apiKeyRow(state),
 		skipped("mb-profile", "mb profile", NO_INSTANCE),
 		skipped("license", "license", NO_INSTANCE),
 		skipped("databases", "databases", NO_INSTANCE),
+		skipped("sample-database", SAMPLE_LABEL, NO_INSTANCE),
 		skipped("git-sync", "remote sync", NO_INSTANCE)
 	];
-	const container = await containerRow(docker.runtime, deps, dockerOk);
-	const { row: health, healthy } = await healthRow(docker.url, deps);
+	const runtime = await runtimeRow(configured.runtime, deps, dockerOk);
+	const { row: health, healthy } = await healthRow(configured.url, deps);
+	const properties = healthy ? await deps.client(configured.url, NO_AUTH).session.properties() : null;
 	const rows = [
-		container.row,
-		await portRow(docker.runtime.port, container.present, deps.ports),
+		runtime.row,
+		await portRow(configured.runtime.port, runtime, deps.ports),
 		health,
-		healthy ? await adminRow(state, docker.url, deps) : skipped("admin", "admin user", NOT_HEALTHY),
+		properties === null ? skipped("version", "Metabase version", NOT_HEALTHY) : versionRow(state, properties),
+		properties === null ? skipped("admin", "admin user", NOT_HEALTHY) : adminRow(state, properties),
 		apiKeyRow(state),
 		await mbProfileRow(state, deps, mbInstalled, healthy)
 	];
-	if (!healthy || state.apiKey === null) {
+	const client = healthy && state.apiKey !== null ? deps.client(configured.url, {
+		kind: "api-key",
+		key: state.apiKey
+	}) : null;
+	if (client === null) {
 		const reason = healthy ? "no API key" : NOT_HEALTHY;
 		rows.push(skipped("license", "license", reason), skipped("databases", "databases", reason));
-	} else {
-		const client = deps.client(docker.url, {
-			kind: "api-key",
-			key: state.apiKey
-		});
-		rows.push(await licenseRow(client), await databasesRow(state, client));
-	}
+	} else rows.push(await licenseRow(client), await databasesRow(state, client));
+	rows.push(state.sampleDatabase === null ? skipped("sample-database", SAMPLE_LABEL, "not connected; `rde init` adds one") : await sampleDatabaseRow(state.sampleDatabase, deps, dockerOk, client));
 	rows.push(await gitSyncRow(state, deps));
 	return rows;
 }
 async function collectDoctor(instance, state, deps) {
-	const machine = await machineRows(deps);
+	const machine = await machineRows(deps, state?.runtime ?? null);
 	const dockerOk = machine.some((row) => row.id === "docker" && row.status === "ok");
 	const mb = await mbRow(deps);
 	const checks = [...machine, mb];
-	if (state === null) checks.push(...[
-		"container",
-		"port",
-		"health"
-	].map((id) => skipped(id, id, NO_INSTANCE)), skipped("admin", "admin user", NO_INSTANCE), skipped("api-key", "API key", NO_INSTANCE), skipped("mb-profile", "mb profile", NO_INSTANCE), skipped("license", "license", NO_INSTANCE), skipped("databases", "databases", NO_INSTANCE), skipped("git-sync", "remote sync", NO_INSTANCE));
+	if (state === null) checks.push(...noRuntimeRows(), skipped("version", "Metabase version", NO_INSTANCE), skipped("admin", "admin user", NO_INSTANCE), skipped("api-key", "API key", NO_INSTANCE), skipped("mb-profile", "mb profile", NO_INSTANCE), skipped("license", "license", NO_INSTANCE), skipped("databases", "databases", NO_INSTANCE), skipped("sample-database", SAMPLE_LABEL, NO_INSTANCE), skipped("git-sync", "remote sync", NO_INSTANCE));
 	else checks.push(...await instanceRows(state, deps, dockerOk, mb.status === "ok"));
 	checks.push(...await skillRows(state, deps));
 	return {
@@ -4109,13 +4934,12 @@ async function fixDoctor(report, steps, ctx, options) {
 }
 //#endregion
 //#region src/steps/admin-user.ts
-const STEP_ID$5 = "admin-user";
+const STEP_ID$6 = "admin-user";
 const ADMIN_USER_KEYS = {
-	variant: `${STEP_ID$5}.variant`,
-	email: `${STEP_ID$5}.email`,
-	password: `${STEP_ID$5}.password`,
-	firstName: `${STEP_ID$5}.first-name`,
-	lastName: `${STEP_ID$5}.last-name`
+	email: `${STEP_ID$6}.email`,
+	password: `${STEP_ID$6}.password`,
+	firstName: `${STEP_ID$6}.first-name`,
+	lastName: `${STEP_ID$6}.last-name`
 };
 const DEFAULT_ADMIN_EMAIL = "admin@metabase.com";
 const DEFAULT_ADMIN_PASSWORD = "metabase123";
@@ -4123,16 +4947,8 @@ const DEFAULT_SITE_NAME = "rde";
 const MIN_PASSWORD_LENGTH = 6;
 const DIGIT = /\d/;
 const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-const CREDENTIALS_CHOICES = [{
-	value: "default",
-	label: "Use default credentials",
-	hint: `${DEFAULT_ADMIN_EMAIL} / ${DEFAULT_ADMIN_PASSWORD}, saved in ~/.rde`
-}, {
-	value: "prompted",
-	label: "Enter my own",
-	hint: "never saved"
-}];
-function hostDeps$6(ctx) {
+const DEFAULT_ADMIN = { variant: "default" };
+function hostDeps$8(ctx) {
 	return { client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal) };
 }
 function isNotReady(error) {
@@ -4194,9 +5010,9 @@ function credentialsRecord(kind, user) {
 		};
 	}
 }
-function adminUserStep(deps = hostDeps$6) {
+function adminUserStep(options, deps = hostDeps$8) {
 	return {
-		id: STEP_ID$5,
+		id: STEP_ID$6,
 		title: "Create the admin user",
 		async detect(ctx) {
 			const configured = configuredRuntime(ctx.state);
@@ -4218,12 +5034,7 @@ function adminUserStep(deps = hostDeps$6) {
 			}
 			const token = properties["setup-token"];
 			if (token === null) throw new ConfigError("Metabase has no admin user yet but offers no setup token");
-			const kind = await ctx.prompts.select({
-				key: ADMIN_USER_KEYS.variant,
-				message: "Admin credentials",
-				choices: CREDENTIALS_CHOICES
-			});
-			const user = await chooseUser(ctx, kind);
+			const user = await chooseUser(ctx, options.variant);
 			const session = await client.setup.create({
 				token,
 				user,
@@ -4232,7 +5043,7 @@ function adminUserStep(deps = hostDeps$6) {
 			ctx.session.metabaseSession.set(session.id);
 			await ctx.saveState({
 				...ctx.state,
-				admin: credentialsRecord(kind, user)
+				admin: credentialsRecord(options.variant, user)
 			});
 			ctx.ui.success(`Admin user ${user.email} created`);
 			return "completed";
@@ -4241,14 +5052,14 @@ function adminUserStep(deps = hostDeps$6) {
 }
 //#endregion
 //#region src/steps/api-key.ts
-const STEP_ID$4 = "api-key";
+const STEP_ID$5 = "api-key";
 const API_KEY_KEYS = {
-	email: `${STEP_ID$4}.email`,
-	password: `${STEP_ID$4}.password`,
-	profile: `${STEP_ID$4}.profile`
+	email: `${STEP_ID$5}.email`,
+	password: `${STEP_ID$5}.password`,
+	profile: `${STEP_ID$5}.profile`
 };
 const ADMINISTRATORS_GROUP_NAME = "Administrators";
-function hostDeps$5(ctx) {
+function hostDeps$7(ctx) {
 	return {
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
 		runner: processRunner(ctx.signal)
@@ -4342,9 +5153,9 @@ function usageNote(profile) {
 	if (profile === "default") return `${mbCommand(profile)} <command> uses this instance`;
 	return `${mbCommand(profile)} <command>\nMB_PROFILE=${profile} for agents and scripts`;
 }
-function apiKeyStep(deps = hostDeps$5) {
+function apiKeyStep(deps = hostDeps$7) {
 	return {
-		id: STEP_ID$4,
+		id: STEP_ID$5,
 		title: "Connect the Metabase CLI",
 		async detect(ctx) {
 			if (ctx.state.apiKey === null) return "todo";
@@ -4379,13 +5190,13 @@ function apiKeyStep(deps = hostDeps$5) {
 }
 //#endregion
 //#region src/steps/git-sync.ts
-const STEP_ID$3 = "git-sync";
+const STEP_ID$4 = "git-sync";
 const GIT_SYNC_KEYS = {
-	location: `${STEP_ID$3}.location`,
-	path: `${STEP_ID$3}.path`,
-	remote: `${STEP_ID$3}.remote`,
-	url: `${STEP_ID$3}.url`,
-	token: `${STEP_ID$3}.token`
+	location: `${STEP_ID$4}.location`,
+	path: `${STEP_ID$4}.path`,
+	remote: `${STEP_ID$4}.remote`,
+	url: `${STEP_ID$4}.url`,
+	token: `${STEP_ID$4}.token`
 };
 const BARE_REPO_NAME = "content.git";
 const DEFAULT_BRANCH = "main";
@@ -4405,7 +5216,7 @@ const TERMINAL_TASK_STATUSES = /* @__PURE__ */ new Set([
 	"timed-out",
 	"conflict"
 ]);
-function hostDeps$4(ctx) {
+function hostDeps$6(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
@@ -4738,7 +5549,7 @@ async function importExistingContent(run, gitRemote) {
 	spinner.stop("Import finished");
 	reportImport(run, outcome);
 }
-function usageLines(state, gitRemote) {
+function usageLines$1(state, gitRemote) {
 	const profile = state.mbProfile;
 	return [
 		`cd ${gitRemote.workdir}`,
@@ -4785,16 +5596,16 @@ async function runGitSync(ctx, deps) {
 	const remote = await configureRemote(run, configured.runtime, flow.model);
 	await applySettings(run, remote);
 	await importExistingContent(run, remote.gitRemote);
-	ctx.ui.note(usageLines(ctx.state, remote.gitRemote).join("\n"), "Working with the repository");
+	ctx.ui.note(usageLines$1(ctx.state, remote.gitRemote).join("\n"), "Working with the repository");
 	return "completed";
 }
-function gitSyncStep(deps = hostDeps$4) {
+function gitSyncStep(deps = hostDeps$6) {
 	return {
-		id: STEP_ID$3,
+		id: STEP_ID$4,
 		title: "Connect a git repository",
 		async detect(ctx) {
 			if (!hasRemoteSync(ctx.state.license)) return "not-applicable";
-			if (ctx.state.steps[STEP_ID$3]?.status === "skipped") return "not-applicable";
+			if (ctx.state.steps[STEP_ID$4]?.status === "skipped") return "not-applicable";
 			if (ctx.state.gitRemote === null) return "todo";
 			try {
 				return (await mbTool(deps(ctx).runner).gitSyncStatus(ctx.state.mbProfile)).branch === null ? "todo" : "done";
@@ -4810,22 +5621,22 @@ function gitSyncStep(deps = hostDeps$4) {
 }
 //#endregion
 //#region src/steps/license.ts
-const STEP_ID$2 = "license";
-const LICENSE_KEYS = { token: `${STEP_ID$2}.token` };
+const STEP_ID$3 = "license";
+const LICENSE_KEYS = { token: `${STEP_ID$3}.token` };
 const TOKEN_PATTERN = /^[0-9a-f]{64}$/i;
-const NOT_FOUND_STATUS = 404;
-function hostDeps$3(ctx) {
+const NOT_FOUND_STATUS$1 = 404;
+function hostDeps$5(ctx) {
 	return { client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal) };
 }
 function isNoTokenYet(error) {
-	if (error instanceof MetabaseApiError) return error.status === NOT_FOUND_STATUS;
+	if (error instanceof MetabaseApiError) return error.status === NOT_FOUND_STATUS$1;
 	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
 }
 function validateToken(value) {
 	if (value.length === 0 || TOKEN_PATTERN.test(value)) return;
 	return "A license token is 64 hexadecimal characters";
 }
-function requireApiKey(ctx) {
+function requireApiKey$1(ctx) {
 	if (ctx.state.apiKey === null) throw new ConfigError("no API key yet; the api-key step comes first");
 	return ctx.state.apiKey;
 }
@@ -4833,12 +5644,12 @@ function activeLabel(status) {
 	const plan = status["plan-alias"];
 	return plan === void 0 ? "License active" : `License active (plan ${plan})`;
 }
-function licenseStep(deps = hostDeps$3) {
+function licenseStep(deps = hostDeps$5) {
 	return {
-		id: STEP_ID$2,
+		id: STEP_ID$3,
 		title: "Activate your license",
 		async detect(ctx) {
-			if (ctx.state.steps[STEP_ID$2]?.status === "skipped") return "not-applicable";
+			if (ctx.state.steps[STEP_ID$3]?.status === "skipped") return "not-applicable";
 			const configured = configuredRuntime(ctx.state);
 			if (configured === null || ctx.state.apiKey === null) return "todo";
 			const client = deps(ctx).client(configured.url, {
@@ -4854,7 +5665,7 @@ function licenseStep(deps = hostDeps$3) {
 		},
 		async run(ctx) {
 			const configured = requireConfiguredRuntime(ctx.state);
-			const apiKey = requireApiKey(ctx);
+			const apiKey = requireApiKey$1(ctx);
 			const token = await ctx.prompts.password({
 				key: LICENSE_KEYS.token,
 				message: "Paste your Metabase license token (Enter to skip)",
@@ -4898,242 +5709,343 @@ function licenseStep(deps = hostDeps$3) {
 	};
 }
 //#endregion
-//#region src/runtime/docker.ts
-const DEFAULT_IMAGE = "metabase/metabase-enterprise:latest";
-const DEFAULT_PORT = 13e3;
-const CONTAINER_NAME_PREFIX = "rde-metabase";
-const CONTAINER_PORT = 3e3;
-const PLUGINS_DIR = "plugins";
-function containerName(instanceName) {
-	return `${CONTAINER_NAME_PREFIX}-${instanceName}`;
+//#region src/steps/runtime.ts
+const STEP_ID$2 = "runtime";
+const MIN_PORT = 1;
+const MAX_PORT = 65535;
+const PORT_PATTERN = /^\d+$/;
+const RUNTIME_NAMES = {
+	docker: "Docker",
+	jar: "jar"
+};
+const NO_RUNTIME_FLAGS = {
+	kind: null,
+	image: null,
+	jar: null,
+	port: null
+};
+function hostDeps$4(ctx) {
+	return {
+		runtime: hostRuntimeDeps(ctx.state.name, ctx.signal),
+		ports: hostPortProbe,
+		releases: releaseLookup(ctx.signal)
+	};
 }
-function instanceUrl(port) {
-	return `http://localhost:${port}`;
+function parsePort(value) {
+	if (!PORT_PATTERN.test(value)) return null;
+	const port = Number.parseInt(value, 10);
+	return port >= MIN_PORT && port <= MAX_PORT ? port : null;
 }
-function publishesPortOnLoopback(inspection, port) {
-	return inspection.ports.some((mapping) => mapping.container === CONTAINER_PORT && mapping.host === port && mapping.hostIp === "127.0.0.1");
+function javaReason(java) {
+	if (!java.found) return java.reason;
+	return java.major >= 21 ? null : `Java ${java.version} is older than 21`;
 }
-function hostUserFor(platform, hostUser) {
-	return platform === "linux" ? hostUser : null;
+function unavailableReason(kind, available) {
+	switch (kind) {
+		case "docker": return available.docker.available ? null : available.docker.reason;
+		case "jar": return javaReason(available.java);
+	}
 }
-function dockerRuntime(state, deps) {
-	const { docker } = deps;
-	const url = instanceUrl(state.port);
-	async function inspect() {
-		return docker.containerInspect(state.containerName);
+function javaLabel(java) {
+	return java.found ? `Java ${java.version}` : "Java";
+}
+async function availability(runtime) {
+	return {
+		docker: await runtime.docker.available(),
+		java: await runtime.java.find()
+	};
+}
+async function chooseKind(ctx, options, runtime) {
+	const available = await availability(runtime);
+	if (options.kind !== null) {
+		const reason = unavailableReason(options.kind, available);
+		if (reason !== null) throw new ConfigError(`--runtime ${options.kind} is not usable: ${reason}`);
+		ctx.ui.info(`Using the ${RUNTIME_NAMES[options.kind]} runtime from --runtime`);
+		return options.kind;
 	}
-	function conflict(reason) {
-		return new ConfigError(`container ${state.containerName} already exists ${reason}; remove it with \`docker rm -f ${state.containerName}\` and run \`rde init\` again`);
+	if (available.docker.available) {
+		ctx.ui.info(`Using Docker ${available.docker.serverVersion}`);
+		return "docker";
 	}
-	async function install(options) {
-		const existing = await inspect();
-		if (existing.exists) {
-			if (existing.image !== state.image) throw conflict(`with image ${existing.image}, not ${state.image}`);
-			if (!publishesPortOnLoopback(existing, state.port)) throw conflict(`without port ${state.port} published on ${LOOPBACK_HOST}`);
-			return;
-		}
-		await promises.mkdir(join(deps.dataDir, PLUGINS_DIR), { recursive: true });
-		await docker.imagePull(state.image, { onLine: options.onProgress });
-		await docker.containerCreate({
-			name: state.containerName,
-			image: state.image,
-			port: state.port,
-			dataDir: deps.dataDir,
-			addHostGateway: deps.platform === "linux",
-			hostUser: hostUserFor(deps.platform, deps.hostUser)
-		});
+	const javaProblem = javaReason(available.java);
+	if (javaProblem !== null) throw new ConfigError(`neither Docker nor Java can run Metabase here: ${available.docker.reason}; ${javaProblem}`);
+	ctx.ui.info(`Docker is not available (${available.docker.reason}); using the jar runtime with ${javaLabel(available.java)}`);
+	return "jar";
+}
+function chooseImage(ctx, options) {
+	if (options.image !== null) {
+		ctx.ui.info(`Using image ${options.image} from --image`);
+		return options.image;
 	}
-	async function start() {
-		const existing = await inspect();
-		if (!existing.exists) throw new ConfigError(`container ${state.containerName} does not exist; run \`rde init\``);
-		if (existing.running) return;
-		await docker.containerStart(state.containerName);
+	return DEFAULT_IMAGE;
+}
+async function resolveJar(ctx, spec, releases) {
+	const parsed = parseJarSpec(spec);
+	if (parsed === null) throw new ConfigError(`${spec} is not latest, a release tag such as v1.63.18, or the path of a .jar file`);
+	if (parsed.kind !== "latest") return parsed;
+	const version = await releases.latestVersion();
+	ctx.ui.info(`The latest Metabase release is ${version}`);
+	return {
+		kind: "release",
+		version
+	};
+}
+async function chooseJar(ctx, options, releases) {
+	if (options.jar !== null) {
+		ctx.ui.info(`Using ${options.jar} from --jar`);
+		return resolveJar(ctx, options.jar, releases);
 	}
-	async function stop() {
-		const existing = await inspect();
-		if (!existing.exists || !existing.running) return;
-		await docker.containerStop(state.containerName);
+	return resolveJar(ctx, LATEST, releases);
+}
+async function choosePort(ctx, options, ports) {
+	if (options.port !== null) {
+		if (!await ports.isFree(options.port)) throw new ConfigError(`port ${options.port} from --port is in use by another program`);
+		ctx.ui.info(`Using port ${options.port} from --port`);
+		return options.port;
 	}
-	async function status() {
-		const existing = await inspect();
-		return {
-			installed: existing.exists,
-			running: existing.exists && existing.running,
-			url
+	const free = await ports.findFree(DEFAULT_PORT);
+	if (free !== 3100) ctx.ui.warn(`Port ${DEFAULT_PORT} is in use; using ${free}`);
+	return free;
+}
+async function chooseRuntime(ctx, options, deps) {
+	const kind = await chooseKind(ctx, options, deps.runtime);
+	switch (kind) {
+		case "docker": {
+			const image = chooseImage(ctx, options);
+			const port = await choosePort(ctx, options, deps.ports);
+			return {
+				kind,
+				image,
+				containerName: containerName(ctx.state.name),
+				port,
+				hostAlias: DOCKER_HOST_ALIAS
+			};
+		}
+		case "jar": return {
+			kind,
+			source: await chooseJar(ctx, options, deps.releases),
+			port: await choosePort(ctx, options, deps.ports)
 		};
 	}
-	async function logs(options) {
-		if (!(await inspect()).exists) throw new ConfigError(`container ${state.containerName} does not exist; run \`rde init\``);
-		await docker.containerLogs(state.containerName, options);
+}
+function describeRuntime(runtime) {
+	switch (runtime.kind) {
+		case "docker": return runtime.image;
+		case "jar": return describeJar(runtime.source);
 	}
-	return {
-		kind: "docker",
-		install,
-		start,
-		stop,
-		status,
-		logs,
-		url: () => url,
-		hostAlias: () => state.hostAlias
-	};
 }
-//#endregion
-//#region src/runtime/runtime.ts
-function hostRuntimeDeps(instanceName, signal) {
-	const user = userInfo();
+async function persistedRuntime(ctx, options, deps) {
+	const existing = configuredRuntime(ctx.state);
+	if (existing !== null) {
+		ctx.ui.info(`Reinstalling Metabase from the saved choices: ${describeRuntime(existing.runtime)} on port ${existing.runtime.port}`);
+		return existing.runtime;
+	}
+	const chosen = await chooseRuntime(ctx, options, deps);
+	await ctx.saveState({
+		...ctx.state,
+		runtime: chosen,
+		url: instanceUrl(chosen.port)
+	});
+	return chosen;
+}
+function runtimeStep(options, deps = hostDeps$4) {
 	return {
-		docker: dockerTool(processRunner(signal)),
-		dataDir: instanceDataDir(instanceName),
-		platform: process.platform,
-		hostUser: {
-			uid: user.uid,
-			gid: user.gid
+		id: STEP_ID$2,
+		title: "Install Metabase",
+		async detect(ctx) {
+			const existing = configuredRuntime(ctx.state);
+			if (existing === null) return "todo";
+			return (await runtimeFromState(existing.runtime, deps(ctx).runtime).status()).installed ? "done" : "todo";
+		},
+		async run(ctx) {
+			const resolved = deps(ctx);
+			const chosen = await persistedRuntime(ctx, options, resolved);
+			const runtime = runtimeFromState(chosen, resolved.runtime);
+			const spinner = ctx.ui.spinner(`Installing Metabase from ${describeRuntime(chosen)}`);
+			try {
+				await runtime.install({ onProgress: (line) => spinner.update(line) });
+			} catch (error) {
+				spinner.fail("Metabase install failed");
+				throw error;
+			}
+			spinner.stop(`Metabase installed on port ${chosen.port}`);
+			return "completed";
 		}
 	};
 }
-function runtimeFromState(state, deps) {
-	switch (state.kind) {
-		case "docker": return dockerRuntime(state, deps);
-		case "jar": throw new ConfigError("jar runtime is not available yet");
-	}
-}
 //#endregion
-//#region src/steps/runtime.ts
-const STEP_ID$1 = "runtime";
-const RUNTIME_KEYS = {
-	kind: `${STEP_ID$1}.kind`,
-	image: `${STEP_ID$1}.image`,
-	port: `${STEP_ID$1}.port`
-};
-const MIN_PORT = 1;
-const MAX_PORT = 65535;
-const PORT_PATTERN = /^\d+$/;
-const RUNTIME_CHOICES = [{
-	value: "docker",
-	label: "Docker",
-	hint: "recommended"
-}, {
-	value: "jar",
-	label: "Jar",
-	hint: "coming soon"
-}];
-function hostDeps$2(ctx) {
+//#region src/steps/sample-database.ts
+const STEP_ID$1 = "sample-database";
+const SAMPLE_DATABASE_DISPLAY_NAME = "Sample Database";
+const POSTGRES_ENGINE = "postgres";
+const NOT_FOUND_STATUS = 404;
+function hostDeps$3(ctx) {
 	return {
 		runtime: hostRuntimeDeps(ctx.state.name, ctx.signal),
-		ports: hostPortProbe
+		ports: hostPortProbe,
+		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
+		readyTimeoutMs: SAMPLE_DATABASE_READY_TIMEOUT_MS,
+		now: () => /* @__PURE__ */ new Date()
 	};
 }
-function parsePort(value) {
-	if (!PORT_PATTERN.test(value)) return null;
-	const port = Number.parseInt(value, 10);
-	return port >= MIN_PORT && port <= MAX_PORT ? port : null;
+function isNotServingYet(error) {
+	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
 }
-function validatePort(value) {
-	return parsePort(value) === null ? `Enter a port between ${MIN_PORT} and ${MAX_PORT}` : void 0;
+function isNotFound$1(error) {
+	return error instanceof MetabaseApiError && error.status === NOT_FOUND_STATUS;
 }
-async function chooseKind(ctx) {
-	for (;;) {
-		const kind = await ctx.prompts.select({
-			key: RUNTIME_KEYS.kind,
-			message: "How should Metabase run?",
-			choices: RUNTIME_CHOICES
-		});
-		if (kind === "docker") return kind;
-		ctx.ui.warn("The jar runtime is not available yet; pick Docker for now");
-	}
+function requireApiKey(state) {
+	if (state.apiKey === null) throw new ConfigError(`instance ${state.name} has no API key yet; run \`rde init\``);
+	return state.apiKey;
 }
-async function chooseImage(ctx, options) {
-	if (options.image !== null) {
-		ctx.ui.info(`Using image ${options.image} from --image`);
-		return options.image;
+async function recordedDatabase(record, client) {
+	if (record.databaseId === null) return null;
+	try {
+		return await client.database.get(record.databaseId);
+	} catch (error) {
+		if (isNotFound$1(error)) return null;
+		throw error;
 	}
-	return ctx.prompts.text({
-		key: RUNTIME_KEYS.image,
-		message: "Docker image",
-		defaultValue: DEFAULT_IMAGE,
-		placeholder: DEFAULT_IMAGE
-	});
 }
-async function suggestPort(ctx, ports) {
-	if (await ports.isFree(13e3)) return DEFAULT_PORT;
-	const free = await ports.findFree(DEFAULT_PORT);
-	ctx.ui.warn(`Port ${DEFAULT_PORT} is in use by another program; ${free} is free`);
-	return free;
+async function persistedRecord(ctx, deps) {
+	const existing = ctx.state.sampleDatabase;
+	if (existing !== null) {
+		if ((await sampleDatabaseContainer(existing, deps.runtime.docker).status()).installed || await deps.ports.isFree(existing.port)) return {
+			record: existing,
+			staleDatabaseId: null
+		};
+		const pointer = existing.databaseId === null ? "" : `; Metabase database ${existing.databaseId} still points at the old one`;
+		ctx.ui.warn(`Port ${existing.port} is in use by another program; the sample database moves to a new port${pointer}`);
+	}
+	const port = await deps.ports.findFree(SAMPLE_DATABASE_PORT);
+	if (port !== 15432) ctx.ui.warn(`Port ${SAMPLE_DATABASE_PORT} is in use; using ${port} for the sample database`);
+	const record = {
+		containerName: sampleContainerName(ctx.state.name),
+		image: SAMPLE_DATABASE_IMAGE,
+		port,
+		databaseId: null
+	};
+	await ctx.saveState({
+		...ctx.state,
+		sampleDatabase: record
+	});
+	return {
+		record,
+		staleDatabaseId: existing?.databaseId ?? null
+	};
 }
-async function choosePort(ctx, options, ports) {
-	if (options.port !== null) {
-		if (!await ports.isFree(options.port)) throw new ConfigError(`port ${options.port} from --port is in use by another program`);
-		ctx.ui.info(`Using port ${options.port} from --port`);
-		return options.port;
+async function installAndStart(ctx, sidecar, record, deps) {
+	const installing = ctx.ui.spinner(`Installing the sample database from ${record.image}`);
+	try {
+		await sidecar.install({ onProgress: (line) => installing.update(line) });
+	} catch (error) {
+		installing.fail("Sample database install failed");
+		throw error;
 	}
-	const suggested = await suggestPort(ctx, ports);
-	for (;;) {
-		const answer = await ctx.prompts.text({
-			key: RUNTIME_KEYS.port,
-			message: "Host port for Metabase",
-			defaultValue: String(suggested),
-			placeholder: String(suggested),
-			validate: validatePort
+	installing.stop(`Sample database container ${record.containerName} on port ${record.port}`);
+	await sidecar.start();
+	const waiting = ctx.ui.spinner("Waiting for Postgres to accept connections…");
+	try {
+		await sidecar.waitReady({
+			timeoutMs: deps.readyTimeoutMs,
+			signal: ctx.signal
 		});
-		const port = parsePort(answer);
-		if (port === null) throw new ConfigError(`${answer} is not a port between ${MIN_PORT} and ${MAX_PORT}`);
-		if (await ports.isFree(port)) return port;
-		ctx.ui.warn(`Port ${port} is in use by another program`);
+	} catch (error) {
+		waiting.fail("Postgres did not become ready");
+		throw error;
 	}
+	waiting.stop(`Postgres is ready on ${LOOPBACK_HOST}:${record.port}`);
+}
+function connectionDetails(record, configured, deps) {
+	const alias = runtimeFromState(configured.runtime, deps.runtime).hostAlias();
+	return applyHostAlias({
+		host: "localhost",
+		port: record.port,
+		dbname: SAMPLE_DATABASE_NAME,
+		user: SAMPLE_DATABASE_USER,
+		password: SAMPLE_DATABASE_PASSWORD
+	}, POSTGRES_ENGINE, alias).details;
 }
-async function chooseRuntime(ctx, options, ports) {
-	await chooseKind(ctx);
-	const image = await chooseImage(ctx, options);
-	const port = await choosePort(ctx, options, ports);
+function toRecord(database, createdAt) {
 	return {
-		kind: "docker",
-		image,
-		containerName: containerName(ctx.state.name),
-		port,
-		hostAlias: DOCKER_HOST_ALIAS
+		id: database.id,
+		name: database.name,
+		engine: database.engine,
+		createdAt
 	};
 }
-function describeRuntime(runtime) {
-	switch (runtime.kind) {
-		case "docker": return runtime.image;
-		case "jar": return `${runtime.edition} jar ${runtime.version}`;
+async function connectDatabase(ctx, choice, configured, client, deps) {
+	const { record } = choice;
+	const known = await recordedDatabase(record, client);
+	if (known !== null) {
+		ctx.ui.info(`${known.name} is already connected as database ${known.id}`);
+		return known;
 	}
-}
-async function persistedRuntime(ctx, options, ports) {
-	const existing = configuredRuntime(ctx.state);
-	if (existing !== null) {
-		ctx.ui.info(`Reinstalling Metabase from the saved choices: ${describeRuntime(existing.runtime)} on port ${existing.runtime.port}`);
-		return existing.runtime;
+	const spinner = ctx.ui.spinner(`Connecting ${SAMPLE_DATABASE_DISPLAY_NAME}…`);
+	let database;
+	try {
+		database = await client.database.create({
+			name: SAMPLE_DATABASE_DISPLAY_NAME,
+			engine: POSTGRES_ENGINE,
+			details: connectionDetails(record, configured, deps)
+		});
+	} catch (error) {
+		spinner.fail(`Could not connect ${SAMPLE_DATABASE_DISPLAY_NAME}`);
+		throw error;
 	}
-	const chosen = await chooseRuntime(ctx, options, ports);
+	const stale = /* @__PURE__ */ new Set([record.databaseId, choice.staleDatabaseId]);
+	const others = ctx.state.databases.filter((entry) => !stale.has(entry.id));
 	await ctx.saveState({
 		...ctx.state,
-		runtime: chosen,
-		url: instanceUrl(chosen.port)
+		sampleDatabase: {
+			...record,
+			databaseId: database.id
+		},
+		databases: [...others, toRecord(database, deps.now().toISOString())]
 	});
-	return chosen;
+	spinner.stop(`Connected ${database.name} as database ${database.id}`);
+	return database;
+}
+function usageLines(record) {
+	return [`psql "${sampleDatabaseUrl(record.port)}"`, "Transforms are enabled; this database is where they can write."].join("\n");
 }
-function runtimeStep(options, deps = hostDeps$2) {
+function sampleDatabaseStep(deps = hostDeps$3) {
 	return {
 		id: STEP_ID$1,
-		title: "Install Metabase",
+		title: "Connect a sample database",
 		async detect(ctx) {
-			const existing = configuredRuntime(ctx.state);
-			if (existing === null) return "todo";
-			return (await runtimeFromState(existing.runtime, deps(ctx).runtime).status()).installed ? "done" : "todo";
-		},
-		async run(ctx) {
 			const resolved = deps(ctx);
-			const chosen = await persistedRuntime(ctx, options, resolved.ports);
-			const runtime = runtimeFromState(chosen, resolved.runtime);
-			const spinner = ctx.ui.spinner(`Installing Metabase from ${describeRuntime(chosen)}`);
+			if (!(await resolved.runtime.docker.available()).available) return "not-applicable";
+			const record = ctx.state.sampleDatabase;
+			const configured = configuredRuntime(ctx.state);
+			if (record === null || configured === null || ctx.state.apiKey === null) return "todo";
+			if (!(await sampleDatabaseContainer(record, resolved.runtime.docker).status()).installed) return "todo";
+			const client = resolved.client(configured.url, {
+				kind: "api-key",
+				key: ctx.state.apiKey
+			});
 			try {
-				await runtime.install({ onProgress: (line) => spinner.update(line) });
+				return await recordedDatabase(record, client) === null ? "todo" : "done";
 			} catch (error) {
-				spinner.fail("Metabase install failed");
+				if (isNotServingYet(error)) return "todo";
 				throw error;
 			}
-			spinner.stop(`Metabase installed on port ${chosen.port}`);
+		},
+		async run(ctx) {
+			const resolved = deps(ctx);
+			const configured = requireConfiguredRuntime(ctx.state);
+			const apiKey = requireApiKey(ctx.state);
+			const docker = await resolved.runtime.docker.available();
+			if (!docker.available) throw new ConfigError(`the sample database runs in Docker, which is not available: ${docker.reason}`);
+			const choice = await persistedRecord(ctx, resolved);
+			await installAndStart(ctx, sampleDatabaseContainer(choice.record, resolved.runtime.docker), choice.record, resolved);
+			const client = resolved.client(configured.url, {
+				kind: "api-key",
+				key: apiKey
+			});
+			await connectDatabase(ctx, choice, configured, client, resolved);
+			await client.setting.enableTransforms();
+			ctx.ui.note(usageLines(choice.record), "Sample database");
 			return "completed";
 		}
 	};
@@ -5147,7 +6059,7 @@ async function startAndWaitForHealth(runtime, client, options) {
 //#region src/steps/start-metabase.ts
 const LOG_TAIL_ON_TIMEOUT = 30;
 const PERCENT = 100;
-function hostDeps$1(ctx) {
+function hostDeps$2(ctx) {
 	return {
 		runtime: hostRuntimeDeps(ctx.state.name, ctx.signal),
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
@@ -5157,10 +6069,26 @@ function hostDeps$1(ctx) {
 function isNotHealthy(error) {
 	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError || error instanceof MetabaseApiError;
 }
+async function runningVersion(client) {
+	return (await client.session.properties()).version.tag;
+}
 function progressLabel(progress) {
 	return `Starting Metabase… ${Math.round(progress * PERCENT)}%`;
 }
-function startMetabaseStep(deps = hostDeps$1) {
+async function startSampleDatabase(ctx, deps) {
+	const record = ctx.state.sampleDatabase;
+	if (record === null) return;
+	switch (await sampleDatabaseContainer(record, deps.runtime.docker).start()) {
+		case "missing":
+			ctx.ui.warn(`Sample database container ${record.containerName} is missing; \`rde init\` recreates it`);
+			return;
+		case "started":
+			ctx.ui.info(`Sample database container ${record.containerName} started`);
+			return;
+		case "running": return;
+	}
+}
+function startMetabaseStep(deps = hostDeps$2) {
 	return {
 		id: "start-metabase",
 		title: "Start Metabase",
@@ -5180,6 +6108,7 @@ function startMetabaseStep(deps = hostDeps$1) {
 			const configured = requireConfiguredRuntime(ctx.state);
 			const runtime = runtimeFromState(configured.runtime, resolved.runtime);
 			const client = resolved.client(configured.url, NO_AUTH);
+			await startSampleDatabase(ctx, resolved);
 			const spinner = ctx.ui.spinner("Starting Metabase…");
 			try {
 				await startAndWaitForHealth(runtime, client, {
@@ -5196,7 +6125,12 @@ function startMetabaseStep(deps = hostDeps$1) {
 				} else spinner.fail("Metabase failed to start");
 				throw error;
 			}
-			spinner.stop(`Metabase is running at ${configured.url}`);
+			const version = await runningVersion(client);
+			await ctx.saveState({
+				...ctx.state,
+				version
+			});
+			spinner.stop(`Metabase ${version} is running at ${configured.url}`);
 			return "completed";
 		}
 	};
@@ -5205,7 +6139,7 @@ function startMetabaseStep(deps = hostDeps$1) {
 //#region src/steps/summary.ts
 const STEP_ID = "summary";
 const GIT_SYNC_STEP_ID = "git-sync";
-function hostDeps(ctx) {
+function hostDeps$1(ctx) {
 	return {
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
 		runner: processRunner(ctx.signal),
@@ -5273,6 +6207,7 @@ async function summaryLines(state, deps) {
 	if (login !== null) lines.push(login);
 	lines.push(profile === "default" ? `Metabase CLI: ${mbCommand(profile)} <command>` : `Metabase CLI: ${mbCommand(profile)} <command>  or  export MB_PROFILE=${profile}`);
 	lines.push(...await databaseLines$1(state, deps));
+	if (state.sampleDatabase !== null) lines.push(`Sample database: psql "${sampleDatabaseUrl(state.sampleDatabase.port)}"`);
 	lines.push(...gitLines(state));
 	const installed = await skillsCli(deps.runner).list();
 	lines.push(skillLine(installed.filter((entry) => entry.name === "rde")));
@@ -5280,7 +6215,7 @@ async function summaryLines(state, deps) {
 	lines.push("Lifecycle: rde status, rde stop, rde start");
 	return lines;
 }
-function summaryStep(deps = hostDeps) {
+function summaryStep(deps = hostDeps$1) {
 	return {
 		id: STEP_ID,
 		title: "Summary",
@@ -5295,16 +6230,23 @@ function summaryStep(deps = hostDeps) {
 }
 //#endregion
 //#region src/steps/index.ts
+const DEFAULT_STEP_OPTIONS = {
+	runtime: NO_RUNTIME_FLAGS,
+	agents: DETECT_AGENTS,
+	admin: DEFAULT_ADMIN,
+	databases: ASK_DATABASES
+};
 const STEP_BY_ID = {
 	preflight: () => preflightStep(),
 	"install-mb": () => installMbStep(),
-	"agents-skills": () => agentsSkillsStep(),
-	runtime: (options) => runtimeStep(options),
+	"agents-skills": (options) => agentsSkillsStep(options.agents),
+	runtime: (options) => runtimeStep(options.runtime),
 	"start-metabase": () => startMetabaseStep(),
-	"admin-user": () => adminUserStep(),
+	"admin-user": (options) => adminUserStep(options.admin),
 	"api-key": () => apiKeyStep(),
+	"sample-database": () => sampleDatabaseStep(),
 	license: () => licenseStep(),
-	databases: () => databasesStep(),
+	databases: (options) => databasesStep(options.databases),
 	"git-sync": () => gitSyncStep(),
 	summary: () => summaryStep()
 };
@@ -5345,16 +6287,13 @@ const doctor = defineRdeCommand({
 	async run(args) {
 		const name = await instanceNameOrDefault();
 		const state = await readInstanceState(name);
-		const deps = hostDoctorDeps(interruptSignal);
+		const deps = hostDoctorDeps(name, interruptSignal);
 		let report = await collectDoctor(name, state, deps);
 		if (args.fix && report.failed > 0) {
 			if (state === null) throw new ConfigError("no instance to fix yet; run `rde init`");
 			print(report, args.json);
 			const ctx = await createWizardContext(name, { signal: interruptSignal });
-			if (await fixDoctor(report, initSteps({
-				image: null,
-				port: null
-			}), ctx, { yes: args.yes })) report = await collectDoctor(name, ctx.state, deps);
+			if (await fixDoctor(report, initSteps(DEFAULT_STEP_OPTIONS), ctx, { yes: args.yes })) report = await collectDoctor(name, ctx.state, deps);
 		}
 		print(report, args.json);
 		if (report.failed > 0) throw new Error(doctorSummary(report));
@@ -5381,12 +6320,6 @@ const EnvString = z.string().transform((value, ctx) => {
 });
 const AdminVariant = z.enum(["default", "prompted"]);
 const RemoteKind = z.enum(["local-bare", "hosted"]);
-const PackageManagerName = z.enum([
-	"npm",
-	"pnpm",
-	"yarn",
-	"bun"
-]);
 const FieldValue = z.union([
 	EnvString,
 	z.number(),
@@ -5398,13 +6331,15 @@ const DatabaseEntry = z.strictObject({
 	fields: z.record(z.string(), FieldValue).optional(),
 	name: z.string().optional()
 }).refine((entry) => entry.uri === void 0 !== (entry.fields === void 0), { message: "a database needs either uri or fields" });
+const RuntimeSection = z.strictObject({
+	kind: RuntimeKind.optional(),
+	image: EnvString.optional(),
+	jar: EnvString.optional(),
+	port: z.int().positive().optional()
+}).refine((section) => section.image === void 0 || section.jar === void 0, { message: "a runtime section has either image or jar" }).refine((section) => section.kind !== "docker" || section.jar === void 0, { message: "jar does not apply to the docker runtime" }).refine((section) => section.kind !== "jar" || section.image === void 0, { message: "image does not apply to the jar runtime" });
 const SECTIONS = {
-	"install-mb": z.strictObject({ "package-manager": PackageManagerName }).optional(),
 	"agents-skills": z.strictObject({ agents: z.array(AgentId) }).optional(),
-	runtime: z.strictObject({
-		image: EnvString.optional(),
-		port: z.int().positive().optional()
-	}).optional(),
+	runtime: RuntimeSection.optional(),
 	"admin-user": z.strictObject({
 		variant: AdminVariant,
 		email: EnvString.optional(),
@@ -5469,7 +6404,6 @@ function addDatabase(map, database, last) {
 	add(map, DATABASE_KEYS.another, select$1(last ? "finish" : "another"));
 }
 function addAdmin(map, admin) {
-	add(map, ADMIN_USER_KEYS.variant, select$1(admin.variant));
 	if (admin.variant !== "prompted") return;
 	if (admin.email !== void 0) {
 		add(map, ADMIN_USER_KEYS.email, text$1(admin.email));
@@ -5482,24 +6416,31 @@ function addAdmin(map, admin) {
 	add(map, ADMIN_USER_KEYS.firstName, text$1(admin["first-name"] ?? NO_NAME));
 	add(map, ADMIN_USER_KEYS.lastName, text$1(admin["last-name"] ?? NO_NAME));
 }
+function runtimeKindOf(runtime) {
+	if (runtime.kind !== void 0) return runtime.kind;
+	if (runtime.image !== void 0) return "docker";
+	if (runtime.jar !== void 0) return "jar";
+	return null;
+}
+function stepOptionsFrom(answers) {
+	const runtime = answers.runtime;
+	const agents = answers["agents-skills"];
+	const admin = answers["admin-user"];
+	const databases = answers.databases;
+	return {
+		runtime: runtime === void 0 ? DEFAULT_STEP_OPTIONS.runtime : {
+			kind: runtimeKindOf(runtime),
+			image: runtime.image ?? null,
+			jar: runtime.jar ?? null,
+			port: runtime.port ?? null
+		},
+		agents: agents === void 0 ? DEFAULT_STEP_OPTIONS.agents : { agents: agents.agents },
+		admin: admin === void 0 ? DEFAULT_STEP_OPTIONS.admin : { variant: admin.variant },
+		databases: { requested: databases !== void 0 && databases.length > 0 }
+	};
+}
 function keyedAnswers(answers) {
 	const map = /* @__PURE__ */ new Map();
-	const installMb = answers["install-mb"];
-	if (installMb !== void 0) {
-		add(map, INSTALL_MB_KEYS.packageManager, select$1(installMb["package-manager"]));
-		add(map, INSTALL_MB_KEYS.confirm, confirm$1(true));
-	}
-	const agents = answers["agents-skills"];
-	if (agents !== void 0) add(map, AGENTS_SKILLS_KEYS.agents, {
-		kind: "multiselect",
-		values: agents.agents
-	});
-	const runtime = answers.runtime;
-	if (runtime !== void 0) {
-		add(map, RUNTIME_KEYS.kind, select$1("docker"));
-		if (runtime.image !== void 0) add(map, RUNTIME_KEYS.image, text$1(runtime.image));
-		if (runtime.port !== void 0) add(map, RUNTIME_KEYS.port, text$1(String(runtime.port)));
-	}
 	const admin = answers["admin-user"];
 	if (admin !== void 0) addAdmin(map, admin);
 	const apiKey = answers["api-key"];
@@ -5555,12 +6496,6 @@ function mergeInitAnswers(file, flags) {
 	};
 }
 const FLAG_FOR_KEY = {
-	[INSTALL_MB_KEYS.packageManager]: "--yes",
-	[INSTALL_MB_KEYS.confirm]: "--yes",
-	[AGENTS_SKILLS_KEYS.agents]: "--agents or --skip-agents",
-	[RUNTIME_KEYS.image]: "--image",
-	[RUNTIME_KEYS.port]: "--port",
-	[ADMIN_USER_KEYS.variant]: "--admin",
 	[ADMIN_USER_KEYS.email]: "--admin-email",
 	[ADMIN_USER_KEYS.password]: "--admin-password",
 	[API_KEY_KEYS.email]: "--admin-email",
@@ -5590,6 +6525,7 @@ function refusalWithoutTerminal(prompt) {
 }
 const LIST_SEPARATOR = ",";
 const DATABASE_SEPARATOR = "=";
+const RUNTIME_LIST$1 = RuntimeKind.options.join(", ");
 const GIT_REMOTE_NAMES = {
 	local: "local-bare",
 	hosted: "hosted"
@@ -5661,6 +6597,37 @@ function gitSection(flags, secrets) {
 		...secrets.has("--git-token") && { token: secrets.get("--git-token") }
 	};
 }
+function impliedKind(flags) {
+	if (flags.image !== void 0 && flags.jar !== void 0) throw conflict("--image", "--jar");
+	if (flags.image !== void 0) return "docker";
+	if (flags.jar !== void 0) return "jar";
+	return null;
+}
+function runtimeKind(flags) {
+	const implied = impliedKind(flags);
+	if (flags.runtime === void 0) return;
+	const parsed = RuntimeKind.safeParse(flags.runtime);
+	if (!parsed.success) throw new ConfigError(`--runtime ${flags.runtime} is not one of ${RUNTIME_LIST$1}`);
+	if (implied !== null && implied !== parsed.data) throw conflict(`--runtime ${parsed.data}`, implied === "docker" ? "--image" : "--jar");
+	return parsed.data;
+}
+function portFlag(value) {
+	if (value === void 0) return;
+	const port = parsePort(value);
+	if (port === null) throw new ConfigError(`--port ${value} is not a valid port number`);
+	return port;
+}
+function runtimeSection(flags) {
+	const kind = runtimeKind(flags);
+	const port = portFlag(flags.port);
+	if (kind === void 0 && flags.image === void 0 && flags.jar === void 0 && port === void 0) return;
+	return {
+		...kind !== void 0 && { kind },
+		...flags.image !== void 0 && { image: flags.image },
+		...flags.jar !== void 0 && { jar: flags.jar },
+		...port !== void 0 && { port }
+	};
+}
 function agentsSection(flags) {
 	if (flags.skipAgents) {
 		if (flags.agents !== void 0) throw conflict("--skip-agents", "--agents");
@@ -5685,7 +6652,7 @@ async function answersFromFlags(flags, readStdin) {
 		}
 	], readStdin);
 	const sections = {
-		runtime: {},
+		runtime: runtimeSection(flags),
 		"admin-user": adminSection(flags, secrets),
 		license: licenseSection(flags, secrets),
 		databases: databasesSection(flags),
@@ -5724,10 +6691,6 @@ function stringOf(answer) {
 	if (answer.kind === "select" && typeof answer.value === "string") return answer.value;
 	return null;
 }
-function runtime(draft) {
-	draft.answers.runtime ??= {};
-	return draft.answers.runtime;
-}
 function admin(draft) {
 	draft.answers["admin-user"] ??= { variant: "prompted" };
 	return draft.answers["admin-user"];
@@ -5736,21 +6699,12 @@ function gitSync(draft) {
 	draft.answers["git-sync"] ??= { location: "skip" };
 	return draft.answers["git-sync"];
 }
-function isAdminVariant(value) {
-	return value === "default" || value === "prompted";
-}
 function isLocation(value) {
 	return value === "here" || value === "new" || value === "existing" || value === "skip";
 }
 function isRemote(value) {
 	return value === "local-bare" || value === "hosted";
 }
-function isPackageManager(value) {
-	return value === "npm" || value === "pnpm" || value === "yarn" || value === "bun";
-}
-function isAgentList(values) {
-	return values.every((value) => typeof value === "string");
-}
 function applyDatabaseRecord(draft, record) {
 	const value = stringOf(record.answer);
 	if (record.key === DATABASE_KEYS.engine) {
@@ -5780,8 +6734,7 @@ function applyDatabaseRecord(draft, record) {
 	else if (value !== null) database.fields[fieldName] = value;
 }
 function applyAdminRecord(draft, key, value) {
-	if (key === ADMIN_USER_KEYS.variant && value !== null && isAdminVariant(value)) admin(draft).variant = value;
-	else if (key === ADMIN_USER_KEYS.email && value !== null) admin(draft).email = value;
+	if (key === ADMIN_USER_KEYS.email && value !== null) admin(draft).email = value;
 	else if (key === ADMIN_USER_KEYS.password) admin(draft).password = envReference(ENV_ADMIN_PASSWORD);
 	else if (key === ADMIN_USER_KEYS.firstName && value !== null && value.length > 0) admin(draft)["first-name"] = value;
 	else if (key === ADMIN_USER_KEYS.lastName && value !== null && value.length > 0) admin(draft)["last-name"] = value;
@@ -5794,16 +6747,11 @@ function applyGitRecord(draft, key, value) {
 	else if (key === GIT_SYNC_KEYS.token) gitSync(draft).token = envReference(ENV_GIT_TOKEN);
 }
 function applyRecord(draft, record) {
-	const { key, answer } = record;
-	const value = stringOf(answer);
+	const { key } = record;
+	const value = stringOf(record.answer);
 	if (key.startsWith("databases.")) applyDatabaseRecord(draft, record);
 	else if (key.startsWith("admin-user.")) applyAdminRecord(draft, key, value);
 	else if (key.startsWith("git-sync.")) applyGitRecord(draft, key, value);
-	else if (key === INSTALL_MB_KEYS.packageManager && value !== null && isPackageManager(value)) draft.answers["install-mb"] = { "package-manager": value };
-	else if (key === AGENTS_SKILLS_KEYS.agents && answer.kind === "multiselect") {
-		if (isAgentList(answer.values)) draft.answers["agents-skills"] = { agents: answer.values };
-	} else if (key === RUNTIME_KEYS.image && value !== null) runtime(draft).image = value;
-	else if (key === RUNTIME_KEYS.port && value !== null) runtime(draft).port = Number(value);
 	else if (key === API_KEY_KEYS.profile && value !== null) {
 		const profile = MbProfileChoice.safeParse(value);
 		if (profile.success) draft.answers["api-key"] = { profile: profile.data };
@@ -5822,7 +6770,7 @@ function databaseEntry(database, index) {
 		...database.name !== null && { name: database.name }
 	};
 }
-function answersFromRecords(records) {
+function answersFromRecords(records, overrides) {
 	const draft = {
 		answers: {},
 		databases: [],
@@ -5831,7 +6779,11 @@ function answersFromRecords(records) {
 	for (const record of records) applyRecord(draft, record);
 	const databases = draft.databases.map(databaseEntry).filter((entry) => entry !== null);
 	if (databases.length > 0 || draft.databasesFinished) draft.answers.databases = databases;
-	return draft.answers;
+	return {
+		...draft.answers,
+		...overrides.runtime !== void 0 && { runtime: overrides.runtime },
+		...overrides["agents-skills"] !== void 0 && { "agents-skills": overrides["agents-skills"] }
+	};
 }
 async function writeAnswersFile(path, answers) {
 	await promises.writeFile(path, JSON.stringify(answers, null, 2) + "\n", { mode: FILE_MODE });
@@ -6016,40 +6968,24 @@ function recordingPrompts(base) {
 //#endregion
 //#region src/commands/init.ts
 const STEP_LIST = StepId.options.join(", ");
+const RUNTIME_LIST = RuntimeKind.options.join(", ");
 function stepFlag(flag, value) {
 	if (value === void 0) return;
 	const parsed = StepId.safeParse(value);
 	if (!parsed.success) throw new ConfigError(`${flag} ${value} is not one of the steps: ${STEP_LIST}`);
 	return parsed.data;
 }
-function portFlag(value) {
-	if (value === void 0) return null;
-	const port = parsePort(value);
-	if (port === null) throw new ConfigError(`--port ${value} is not a valid port number`);
-	return port;
-}
 async function combinedAnswers(options) {
 	const fromFlags = await answersFromFlags(options.flags, readStdinLine);
 	if (options.answersPath === void 0) return fromFlags;
 	return mergeInitAnswers(await loadInitAnswers(options.answersPath), fromFlags);
 }
-async function promptsFor(options) {
+function promptsFor(answers, yes) {
 	const answering = {
 		...!stdinIsTty() && { unanswered: refusalWithoutTerminal },
-		...options.yes && { confirmAll: true }
-	};
-	return answeringPrompts(clackPrompts(), keyedAnswers(await combinedAnswers(options)), answering);
-}
-function withRuntimeFlags(answers, image, port) {
-	if (image === null && port === null) return answers;
-	return {
-		...answers,
-		runtime: {
-			...answers.runtime,
-			...image !== null && { image },
-			...port !== null && { port }
-		}
+		...yes && { confirmAll: true }
 	};
+	return answeringPrompts(clackPrompts(), keyedAnswers(answers), answering);
 }
 const init = defineRdeCommand({
 	meta: {
@@ -6065,13 +7001,21 @@ const init = defineRdeCommand({
 			type: "string",
 			description: "Run only this step"
 		},
+		runtime: {
+			type: "string",
+			description: `How a new instance runs Metabase (${RUNTIME_LIST}); Docker when it is available`
+		},
 		image: {
 			type: "string",
-			description: "Docker image for a new instance"
+			description: "Docker image for a new instance (implies --runtime docker)"
+		},
+		jar: {
+			type: "string",
+			description: "Metabase jar for a new instance: latest, a release tag, or a .jar path (implies --runtime jar)"
 		},
 		port: {
 			type: "string",
-			description: "Host port for a new instance"
+			description: "Host port for a new instance; the first free from 3100"
 		},
 		answers: {
 			type: "string",
@@ -6083,7 +7027,7 @@ const init = defineRdeCommand({
 		},
 		admin: {
 			type: "string",
-			description: "Admin credentials: default or prompted"
+			description: "Admin credentials: default (admin@metabase.com / metabase123) or prompted"
 		},
 		"admin-email": {
 			type: "string",
@@ -6134,7 +7078,7 @@ const init = defineRdeCommand({
 		},
 		agents: {
 			type: "string",
-			description: "Agents to install the skill for, comma-separated"
+			description: "Agents to install the skill for, comma-separated; the detected ones by default"
 		},
 		"skip-agents": {
 			type: "boolean",
@@ -6147,7 +7091,7 @@ const init = defineRdeCommand({
 		},
 		yes: {
 			type: "boolean",
-			description: "Answer yes to every confirmation",
+			description: "Answer yes to every confirmation (skipping databases)",
 			default: false
 		}
 	},
@@ -6158,14 +7102,14 @@ const init = defineRdeCommand({
 			...from !== void 0 && { from },
 			...only !== void 0 && { only }
 		};
-		const stepOptions = {
-			image: args.image ?? null,
-			port: portFlag(args.port)
-		};
 		const runOptions = {
 			answersPath: args.answers,
 			yes: args.yes,
 			flags: {
+				runtime: args.runtime,
+				image: args.image,
+				jar: args.jar,
+				port: args.port,
 				admin: args.admin,
 				adminEmail: args["admin-email"],
 				adminPassword: args["admin-password"],
@@ -6184,16 +7128,17 @@ const init = defineRdeCommand({
 			}
 		};
 		const printTo = args["print-answers"];
-		const answering = await promptsFor(runOptions);
+		const answers = await combinedAnswers(runOptions);
+		const answering = promptsFor(answers, runOptions.yes);
 		const recording = printTo === void 0 ? null : recordingPrompts(answering);
 		const ctx = await createWizardContext(DEFAULT_INSTANCE_NAME, {
 			signal: interruptSignal,
 			prompts: recording?.prompts ?? answering
 		});
 		ctx.ui.intro("rde init");
-		await runWizard(initSteps(stepOptions), ctx, options);
+		await runWizard(initSteps(stepOptionsFrom(answers)), ctx, options);
 		if (recording !== null && printTo !== void 0) {
-			await writeAnswersFile(printTo, withRuntimeFlags(answersFromRecords(recording.records), stepOptions.image, stepOptions.port));
+			await writeAnswersFile(printTo, answersFromRecords(recording.records, answers));
 			ctx.ui.info(`Answers written to ${printTo}`);
 		}
 		ctx.ui.outro("rde init finished");
@@ -6204,10 +7149,12 @@ const init = defineRdeCommand({
 async function loadInstance(name, signal) {
 	const state = await requireInstanceState(name);
 	const configured = requireConfiguredRuntime(state);
+	const deps = hostRuntimeDeps(name, signal);
 	return {
 		state,
 		url: configured.url,
-		runtime: runtimeFromState(configured.runtime, hostRuntimeDeps(name, signal))
+		runtime: runtimeFromState(configured.runtime, deps),
+		sampleDatabase: state.sampleDatabase === null ? null : sampleDatabaseContainer(state.sampleDatabase, deps.docker)
 	};
 }
 function openInstance(url) {
@@ -6264,10 +7211,7 @@ const start = defineRdeCommand({
 const SUMMARY_STEP_ID = "summary";
 function hostStatusDeps(instanceName, signal) {
 	return {
-		steps: initSteps({
-			image: null,
-			port: null
-		}),
+		steps: initSteps(DEFAULT_STEP_OPTIONS),
 		runtime: hostRuntimeDeps(instanceName, signal),
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, signal),
 		runner: processRunner(signal)
@@ -6307,6 +7251,19 @@ async function databasesOf(ctx, deps, health) {
 		throw error;
 	}
 }
+async function sampleDatabaseOf(ctx, deps, databases) {
+	const record = ctx.state.sampleDatabase;
+	if (record === null) return null;
+	const status = await sampleDatabaseContainer(record, deps.runtime.docker).status();
+	const listed = databases?.find((database) => database.id === record.databaseId) ?? null;
+	return {
+		container: status.running ? "running" : status.installed ? "stopped" : "missing",
+		port: record.port,
+		url: sampleDatabaseUrl(record.port),
+		databaseId: record.databaseId,
+		initialSyncStatus: listed === null ? null : listed.initialSyncStatus
+	};
+}
 function taskLabel(status) {
 	const task = status.current_task;
 	return task === null ? null : `${task.sync_task_type} ${task.status}`;
@@ -6332,6 +7289,7 @@ async function collectStatus(ctx, deps) {
 	const configured = configuredRuntime(ctx.state);
 	const runtime = configured === null ? null : await runtimeFromState(configured.runtime, deps.runtime).status();
 	const health = configured === null ? null : await healthOf(configured.url, deps);
+	const databases = health === null ? null : await databasesOf(ctx, deps, health);
 	return {
 		instance: ctx.state.name,
 		url: configured?.url ?? null,
@@ -6340,9 +7298,11 @@ async function collectStatus(ctx, deps) {
 			installed: runtime.installed,
 			running: runtime.running
 		},
+		version: ctx.state.version,
 		health,
 		steps: await stepReports(ctx, deps),
-		databases: health === null ? null : await databasesOf(ctx, deps, health),
+		databases,
+		sampleDatabase: await sampleDatabaseOf(ctx, deps, databases),
 		gitSync: await gitSyncOf(ctx, deps)
 	};
 }
@@ -6352,6 +7312,9 @@ function runtimeLine(report) {
 	if (report.runtime.installed) return `Runtime: ${report.runtime.kind}, stopped; \`rde start\``;
 	return `Runtime: ${report.runtime.kind}, not installed; run \`rde init\``;
 }
+function versionLine(report) {
+	return report.version === null ? "Version: not recorded yet; `rde start` records it" : `Version: ${report.version}`;
+}
 function isGitSyncFailure(value) {
 	return "error" in value;
 }
@@ -6360,6 +7323,22 @@ function gitSyncLine(report) {
 	if (isGitSyncFailure(report.gitSync)) return `Remote sync: ${report.gitSync.error}`;
 	return `Remote sync: ${report.gitSync.branch === null ? "no branch" : `branch ${report.gitSync.branch}`}, ${report.gitSync.dirty ? "unsynced changes" : "in sync"}, ${report.gitSync.task === null ? "no task running" : `task ${report.gitSync.task}`}`;
 }
+const CONTAINER_STATE_LABEL = {
+	running: "container running",
+	stopped: "container stopped; `rde start`",
+	missing: "container missing; `rde init` recreates it"
+};
+function sampleConnectionLabel(report, sample) {
+	if (sample.databaseId === null) return "not connected to Metabase yet; `rde init`";
+	if (report.databases === null) return "sync unknown while Metabase is not running";
+	if (sample.initialSyncStatus === null) return `database ${sample.databaseId} is gone from Metabase; \`rde init\` connects it again`;
+	return `sync ${sample.initialSyncStatus}`;
+}
+function sampleDatabaseLine(report) {
+	const sample = report.sampleDatabase;
+	if (sample === null) return "Sample database: not connected; `rde init` adds one";
+	return `Sample database: ${sample.url}, ${CONTAINER_STATE_LABEL[sample.container]}, ${sampleConnectionLabel(report, sample)}`;
+}
 function databaseLines(report) {
 	if (report.databases === null) return ["Databases: unavailable while Metabase is not running"];
 	return ["Databases:", ...databaseListingLines(report.databases).map((line) => `  ${line}`)];
@@ -6368,10 +7347,12 @@ function statusLines(report) {
 	return [
 		report.url === null ? `Instance ${report.instance}` : `Instance ${report.instance} — ${report.url}`,
 		runtimeLine(report),
+		versionLine(report),
 		`Health: ${report.health ?? "unknown"}`,
 		"Steps:",
 		...checklistLines(report.steps).map((line) => `  ${line}`),
 		...databaseLines(report),
+		sampleDatabaseLine(report),
 		gitSyncLine(report)
 	];
 }
@@ -6403,13 +7384,19 @@ const status = defineRdeCommand({
 const stop = defineRdeCommand({
 	meta: {
 		name: "stop",
-		description: "Stop the Metabase instance"
+		description: "Stop the Metabase instance and its sample database"
 	},
 	async run() {
 		const instance = await loadInstance(await defaultInstanceName(), interruptSignal);
 		const before = await instance.runtime.status();
 		await instance.runtime.stop();
-		printLines([before.running ? "Metabase stopped" : "Metabase is not running"]);
+		const lines = [before.running ? "Metabase stopped" : "Metabase is not running"];
+		if (instance.sampleDatabase !== null) {
+			const sidecar = await instance.sampleDatabase.status();
+			await instance.sampleDatabase.stop();
+			lines.push(sidecar.running ? "Sample database stopped" : "Sample database is not running");
+		}
+		printLines(lines);
 	}
 });
 //#endregion
@@ -6419,10 +7406,12 @@ function hostUninstallDeps(signal) {
 	const runner = processRunner(signal);
 	return {
 		docker: dockerTool(runner),
+		daemon: daemonTool(runner),
 		runner
 	};
 }
-const NOT_TOUCHED = "The mb CLI and Docker itself";
+const NOT_TOUCHED = "The mb CLI, Docker, and Java themselves";
+const ANY_JAR = "-jar";
 function isFileSystemError(error) {
 	return error instanceof Error && "code" in error;
 }
@@ -6495,13 +7484,28 @@ async function findContainer(name, docker, stateImage) {
 		throw error;
 	}
 }
+async function findJarProcess(instance, source, daemon) {
+	const dir = instanceDir(instance);
+	const pid = await runningJarPid(dir, source === null ? ANY_JAR : jarPathOf(source, jarsDir()), daemon);
+	if (pid === null) {
+		await promises.rm(pidPathOf(dir), { force: true });
+		return null;
+	}
+	return {
+		label: `Metabase process ${pid} (running; it is stopped first)`,
+		remove: async () => {
+			await daemon.terminate(pid, { graceMs: JAR_STOP_GRACE_MS });
+			await promises.rm(pidPathOf(dir), { force: true });
+		}
+	};
+}
 async function findImage(image, docker, removeImage) {
 	if (!removeImage) return {
 		removal: null,
 		kept: `Docker image ${image}; pass --remove-image to delete it`
 	};
 	try {
-		if (!await docker.imageExists(image)) return {
+		if (await docker.imageId(image) === null) return {
 			removal: null,
 			kept: null
 		};
@@ -6520,6 +7524,31 @@ async function findImage(image, docker, removeImage) {
 		kept: null
 	};
 }
+async function findJar(source, removeImage) {
+	if (source.kind !== "release") return {
+		removal: null,
+		kept: null
+	};
+	const dir = jarReleaseDir(source.version);
+	if (!await pathExists(dir)) return {
+		removal: null,
+		kept: null
+	};
+	if (!removeImage) return {
+		removal: null,
+		kept: `Downloaded jar ${dir}; pass --remove-image to delete it`
+	};
+	return {
+		removal: {
+			label: `Downloaded jar ${dir}`,
+			remove: () => promises.rm(dir, {
+				recursive: true,
+				force: true
+			})
+		},
+		kept: null
+	};
+}
 function isInstanceProfile(status, url) {
 	if (!status.present) return false;
 	if (url !== null) return status.url === url;
@@ -6574,7 +7603,11 @@ async function findConfigEntry(instance) {
 	};
 }
 async function pruneEmptyDirs() {
-	for (const dir of [instancesDir(), rdeHome()]) try {
+	for (const dir of [
+		instancesDir(),
+		jarsDir(),
+		rdeHome()
+	]) try {
 		await promises.rmdir(dir);
 	} catch (error) {
 		if (!isNotFound(error) && !isNotEmpty(error)) throw error;
@@ -6597,10 +7630,23 @@ async function planUninstall(options, deps) {
 	const container = await findContainer(runtime?.containerName ?? containerName(options.instance), deps.docker, runtime?.image ?? null);
 	if (container.removal !== null) removals.push(container.removal);
 	if (container.problem !== null) problems.push(container.problem);
-	if (container.image !== null) {
-		const image = await findImage(container.image, deps.docker, options.removeImage);
-		if (image.removal !== null) removals.push(image.removal);
-		if (image.kept !== null) kept.push(image.kept);
+	const sample = state?.sampleDatabase ?? null;
+	const sidecar = await findContainer(sample?.containerName ?? sampleContainerName(options.instance), deps.docker, sample?.image ?? null);
+	if (sidecar.removal !== null) removals.push(sidecar.removal);
+	if (sidecar.problem !== null) problems.push(sidecar.problem);
+	const jarSource = state?.runtime?.kind === "jar" ? state.runtime.source : null;
+	const jarProcess = await findJarProcess(options.instance, jarSource, deps.daemon);
+	if (jarProcess !== null) removals.push(jarProcess);
+	for (const image of [container.image, sidecar.image]) {
+		if (image === null) continue;
+		const finding = await findImage(image, deps.docker, options.removeImage);
+		if (finding.removal !== null) removals.push(finding.removal);
+		if (finding.kept !== null) kept.push(finding.kept);
+	}
+	if (jarSource !== null) {
+		const jar = await findJar(jarSource, options.removeImage);
+		if (jar.removal !== null) removals.push(jar.removal);
+		if (jar.kept !== null) kept.push(jar.kept);
 	}
 	const profiles = state === null ? await findMbProfiles([DEFAULT_MB_PROFILE, "rde"], null, deps.runner) : await findMbProfiles([state.mbProfile], state.url, deps.runner);
 	removals.push(...profiles);
@@ -6628,7 +7674,7 @@ async function planUninstall(options, deps) {
 		problems
 	};
 }
-function planLines(plan) {
+function planLines$1(plan) {
 	return [
 		"Removing:",
 		...plan.removals.map((removal) => `  ${removal.label}`),
@@ -6679,7 +7725,7 @@ async function uninstall(options, deps, io) {
 			problems: plan.problems
 		};
 	}
-	io.ui.note(planLines(plan).join("\n"), `rde uninstall ${options.instance}`);
+	io.ui.note(planLines$1(plan).join("\n"), `rde uninstall ${options.instance}`);
 	if (!options.yes) {
 		if (!await io.prompts.confirm({
 			message: "Remove everything listed?",
@@ -6719,7 +7765,7 @@ const uninstallCommand = defineRdeCommand({
 		},
 		"remove-image": {
 			type: "boolean",
-			description: "Also delete the Docker image",
+			description: "Also delete the Docker image or the downloaded jar",
 			default: false
 		},
 		yes: {
@@ -6745,11 +7791,274 @@ const uninstallCommand = defineRdeCommand({
 	}
 });
 //#endregion
+//#region src/steps/upgrade.ts
+const BACKUPS_DIR_MODE = 448;
+const RELEASE_TAG = /^v?[01]\.(\d+\.\d+(?:\.\d+)?)/;
+function hostDeps(ctx) {
+	return {
+		runtime: hostRuntimeDeps(ctx.state.name, ctx.signal),
+		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
+		timing: DEFAULT_HEALTH_TIMING,
+		releases: releaseLookup(ctx.signal),
+		now: () => /* @__PURE__ */ new Date()
+	};
+}
+function imageTag(ref) {
+	const colon = ref.lastIndexOf(":");
+	if (colon === -1 || colon < ref.lastIndexOf("/")) return null;
+	return ref.slice(colon + 1);
+}
+function releaseOf(tag) {
+	const match = RELEASE_TAG.exec(tag);
+	if (match === null || match[1] === void 0) return null;
+	return semver.coerce(match[1]);
+}
+function downgradeReason(current, targetTag) {
+	if (targetTag === null) return null;
+	const running = releaseOf(current);
+	const target = releaseOf(targetTag);
+	if (running === null || target === null || !semver.lt(target, running)) return null;
+	return `refusing to downgrade from ${current} to ${targetTag}: Metabase migrates its application database forward only; a fresh instance (\`rde uninstall\`, then \`rde init\`) is the way to run an older release`;
+}
+function backupStamp(now) {
+	return now.toISOString().replace(/\.\d{3}Z$/, "Z").replaceAll(":", "-");
+}
+async function ensureRunning(ctx, deps, client) {
+	await startMetabaseStep(() => deps).run(ctx);
+	return runningVersion(client);
+}
+function dockerTarget(runtime, to) {
+	const image = to ?? runtime.image;
+	return {
+		kind: "docker",
+		next: {
+			...runtime,
+			image
+		},
+		label: image,
+		releaseTag: imageTag(image)
+	};
+}
+async function jarTarget(ctx, runtime, to, releases) {
+	const spec = to ?? "latest";
+	const parsed = parseJarSpec(spec);
+	if (parsed === null) throw new ConfigError(`--to ${spec} is not latest, a release tag such as v1.63.18, or the path of a .jar file`);
+	let source;
+	if (parsed.kind === "latest") {
+		const version = await releases.latestVersion();
+		ctx.ui.info(`The latest Metabase release is ${version}`);
+		source = {
+			kind: "release",
+			version
+		};
+	} else source = parsed;
+	return {
+		kind: "jar",
+		previous: runtime,
+		next: {
+			...runtime,
+			source
+		},
+		label: describeJar(source),
+		releaseTag: source.kind === "release" ? source.version : null
+	};
+}
+function resolveTarget(ctx, configured, to, releases) {
+	switch (configured.runtime.kind) {
+		case "docker": return Promise.resolve(dockerTarget(configured.runtime, to));
+		case "jar": return jarTarget(ctx, configured.runtime, to, releases);
+	}
+}
+async function pullImage(ctx, docker, target) {
+	const image = target.next.image;
+	const spinner = ctx.ui.spinner(`Pulling ${image}`);
+	try {
+		await docker.imagePull(image, { onLine: (line) => spinner.update(line) });
+	} catch (error) {
+		spinner.fail(`Pulling ${image} failed`);
+		throw error;
+	}
+	const id = await docker.imageId(image);
+	if (id === null) {
+		spinner.fail(`Pulled ${image}, but Docker has no such image`);
+		throw new ConfigError(`docker pull ${image} succeeded, yet \`docker image inspect\` finds nothing`);
+	}
+	const running = await docker.containerImageId(target.next.containerName);
+	spinner.stop(`Pulled ${image}`);
+	return id === running;
+}
+function jarUnchanged(target, current, jarsDir) {
+	const source = target.next.source;
+	if (source.kind === "release") return source.version === current;
+	return jarPathOf(source, jarsDir) === jarPathOf(target.previous.source, jarsDir);
+}
+async function fetchJar(ctx, deps, target, current) {
+	if (jarUnchanged(target, current, deps.runtime.jarsDir)) return true;
+	const spinner = ctx.ui.spinner(`Fetching ${target.label}`);
+	try {
+		await runtimeFromState(target.next, deps.runtime).install({ onProgress: (line) => spinner.update(line) });
+	} catch (error) {
+		spinner.fail(`Fetching ${target.label} failed`);
+		throw error;
+	}
+	spinner.stop(`Fetched ${target.label}`);
+	return false;
+}
+function fetchTarget(ctx, deps, target, current) {
+	switch (target.kind) {
+		case "docker": return pullImage(ctx, deps.runtime.docker, target);
+		case "jar": return fetchJar(ctx, deps, target, current);
+	}
+}
+const SWITCH_TEXT = {
+	docker: "Metabase stops while the container is recreated from the target image.",
+	jar: "Metabase stops and starts again from the target jar."
+};
+function planLines(configured, current, target, backup) {
+	return [
+		`Running:  ${current} (${describeRuntime(configured.runtime)})`,
+		`Target:   ${target.label}`,
+		`Backup:   ${backup}`,
+		"",
+		SWITCH_TEXT[configured.runtime.kind],
+		"Its application database is migrated forward on the first start and cannot be moved back, so",
+		"the whole data directory is copied to the backup path first."
+	];
+}
+async function backUp(ctx, dataDir, backup) {
+	const spinner = ctx.ui.spinner(`Backing up ${dataDir}`);
+	try {
+		await promises.mkdir(instanceBackupsDir(ctx.state.name), {
+			recursive: true,
+			mode: BACKUPS_DIR_MODE
+		});
+		await promises.cp(dataDir, backup, { recursive: true });
+	} catch (error) {
+		spinner.fail("Backup failed; nothing was changed");
+		throw error;
+	}
+	spinner.stop(`Backed up to ${backup}`);
+}
+function restoreSteps(runtime, statePath) {
+	switch (runtime.kind) {
+		case "docker": return [
+			`  set runtime.image to "${runtime.image}" in ${statePath}`,
+			`  docker rm -f ${runtime.containerName}`,
+			"  rde init --only runtime"
+		];
+		case "jar": return [`  set runtime.source to ${JSON.stringify(runtime.source)} in ${statePath}`];
+	}
+}
+function restoreLines(ctx, configured, dataDir, backup) {
+	return [
+		`The data directory as it was before the upgrade is at ${backup}.`,
+		`To go back to ${describeRuntime(configured.runtime)}:`,
+		"  rde stop",
+		`  rm -rf ${dataDir} && cp -R ${backup} ${dataDir}`,
+		...restoreSteps(configured.runtime, instanceStatePath(ctx.state.name)),
+		"  rde start"
+	];
+}
+async function switchTo(ctx, deps, target) {
+	const configured = requireConfiguredRuntime(ctx.state);
+	if (configured.runtime.kind === "docker") await deps.runtime.docker.containerRemove(configured.runtime.containerName);
+	await ctx.saveState({
+		...ctx.state,
+		runtime: target.next,
+		version: null
+	});
+	const spinner = ctx.ui.spinner(`Installing ${target.label}`);
+	try {
+		await runtimeFromState(target.next, deps.runtime).install({ onProgress: (line) => spinner.update(line) });
+	} catch (error) {
+		spinner.fail(`Installing ${target.label} failed`);
+		throw error;
+	}
+	spinner.stop(`Installed ${target.label}`);
+}
+async function startUpgraded(ctx, deps, client, previous, backup) {
+	try {
+		return await ensureRunning(ctx, deps, client);
+	} catch (error) {
+		if (error instanceof MetabaseUnreachableError) ctx.ui.note(restoreLines(ctx, previous, deps.runtime.dataDir, backup).join("\n"), "Metabase did not come up on the new version");
+		throw error;
+	}
+}
+async function upgrade(ctx, options, deps = hostDeps) {
+	const resolved = deps(ctx);
+	const configured = requireConfiguredRuntime(ctx.state);
+	const client = resolved.client(configured.url, NO_AUTH);
+	const current = await ensureRunning(ctx, resolved, client);
+	const target = await resolveTarget(ctx, configured, options.to, resolved.releases);
+	const refusal = downgradeReason(current, target.releaseTag);
+	if (refusal !== null) throw new ConfigError(refusal);
+	if (await fetchTarget(ctx, resolved, target, current)) {
+		ctx.ui.success(`Already on ${current}: ${target.label} is what the instance runs`);
+		return {
+			outcome: "unchanged",
+			version: current
+		};
+	}
+	const backup = join(instanceBackupsDir(ctx.state.name), backupStamp(resolved.now()));
+	ctx.ui.note(planLines(configured, current, target, backup).join("\n"), "rde upgrade");
+	if (!options.yes) {
+		if (!await ctx.prompts.confirm({
+			message: "Upgrade now?",
+			initialValue: true
+		})) {
+			ctx.ui.info("Nothing changed");
+			return { outcome: "declined" };
+		}
+	}
+	const runtime = runtimeFromState(configured.runtime, resolved.runtime);
+	const stopping = ctx.ui.spinner("Stopping Metabase");
+	await runtime.stop();
+	stopping.stop("Metabase stopped");
+	await backUp(ctx, resolved.runtime.dataDir, backup);
+	await switchTo(ctx, resolved, target);
+	const to = await startUpgraded(ctx, resolved, client, configured, backup);
+	ctx.ui.success(`Upgraded Metabase from ${current} to ${to}; the backup at ${backup} can go once you are happy with it`);
+	return {
+		outcome: "upgraded",
+		from: current,
+		to,
+		backup
+	};
+}
+//#endregion
+//#region src/commands/upgrade.ts
+const upgradeCommand = defineRdeCommand({
+	meta: {
+		name: "upgrade",
+		description: "Move the instance to a newer Metabase, backing up its data first"
+	},
+	args: {
+		to: {
+			type: "string",
+			description: "Docker: image to upgrade to (default: the instance's image, pulled again); jar: latest, a release tag, or a .jar path (default: latest)"
+		},
+		yes: {
+			type: "boolean",
+			description: "Do not ask for confirmation",
+			default: false
+		}
+	},
+	async run(args) {
+		if (!args.yes && !stdinIsTty()) throw new ConfigError("`rde upgrade` asks for confirmation; pass --yes to upgrade without a terminal");
+		const name = await defaultInstanceName();
+		await requireInstanceState(name);
+		await upgrade(await createWizardContext(name, { signal: interruptSignal }), {
+			to: args.to ?? null,
+			yes: args.yes
+		});
+	}
+});
+//#endregion
 //#region src/main.ts
 const main = defineCommand({
 	meta: {
 		name: "rde",
-		version: "0.1.0",
+		version: "0.1.1",
 		description: "Prepares a local machine for data-engineering work with Metabase and coding agents"
 	},
 	subCommands: {
@@ -6761,6 +8070,7 @@ const main = defineCommand({
 		open,
 		db,
 		doctor,
+		upgrade: upgradeCommand,
 		uninstall: uninstallCommand
 	}
 });