@metabase/rde 0.1.13 → 0.1.15

package/dist/cli.mjs

@@ -2,7 +2,7 @@
 import { defineCommand, renderUsage, runMain } from "citty";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { createWriteStream, promises } from "node:fs";
-import { delimiter, dirname, isAbsolute, join, resolve, sep } from "node:path";
+import { delimiter, dirname, isAbsolute, join, posix, resolve, sep } from "node:path";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { ZodError, z } from "zod";
 import { homedir, tmpdir, userInfo } from "node:os";
@@ -50,6 +50,7 @@ var StepFailedError = class extends Error {
 var ExternalToolError = class extends Error {
 	tool;
 	argv;
+	envNames;
 	exitCode;
 	stderrTail;
 	constructor(failure) {
@@ -57,26 +58,34 @@ var ExternalToolError = class extends Error {
 		this.name = "ExternalToolError";
 		this.tool = failure.tool;
 		this.argv = failure.argv;
+		this.envNames = failure.envNames;
 		this.exitCode = failure.exitCode;
 		this.stderrTail = failure.stderrTail;
 	}
 };
+function commandLabel(failure) {
+	const command = `\`${[failure.tool, ...failure.argv].join(" ")}\``;
+	if (failure.envNames.length === 0) return command;
+	return `${command}, run by rde with ${failure.envNames.join(" and ")} set,`;
+}
 function describeToolFailure(failure) {
-	const command = [failure.tool, ...failure.argv].join(" ");
+	const command = commandLabel(failure);
 	const exit = failure.exitCode === null ? "was killed" : `exited with ${failure.exitCode}`;
 	const tail = failure.stderrTail.trim();
-	return tail.length === 0 ? `\`${command}\` ${exit}` : `\`${command}\` ${exit}: ${tail}`;
+	return tail.length === 0 ? `${command} ${exit}` : `${command} ${exit}: ${tail}`;
 }
 var MetabaseApiError = class extends Error {
 	status;
 	path;
 	errors;
+	reason;
 	constructor(failure) {
 		super(`Metabase ${failure.status} on ${failure.path}: ${failure.message}`);
 		this.name = "MetabaseApiError";
 		this.status = failure.status;
 		this.path = failure.path;
 		this.errors = failure.errors;
+		this.reason = failure.message;
 	}
 };
 const UNAUTHORIZED_STATUS = 401;
@@ -93,12 +102,17 @@ var MetabaseInitializingError = class extends Error {
 };
 var MetabaseUnreachableError = class extends Error {
 	url;
+	reason;
 	constructor(url, reason) {
 		super(`Metabase at ${url} is unreachable: ${reason}`);
 		this.name = "MetabaseUnreachableError";
 		this.url = url;
+		this.reason = reason;
 	}
 };
+function isMetabaseNotServing(error) {
+	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
+}
 var DownloadError = class extends Error {
 	url;
 	constructor(url, reason) {
@@ -892,6 +906,11 @@ function describeCause(error) {
 	if (error instanceof Error && error.cause instanceof Error) return error.cause.message;
 	return error instanceof Error ? error.message : String(error);
 }
+function lookupFailure(error) {
+	if (error instanceof MetabaseUnreachableError) return `${error.url} is unreachable: ${error.reason}`;
+	if (error instanceof MetabaseApiError) return `HTTP ${error.status} on ${error.path}: ${error.reason}`;
+	return null;
+}
 function createHttp(options) {
 	const fetchImpl = options.fetchImpl ?? fetch;
 	const baseUrl = options.baseUrl.replace(/\/+$/, "");
@@ -911,7 +930,11 @@ function createHttp(options) {
 			init.body = JSON.stringify(body);
 		}
 		try {
-			return await fetchImpl(url, init);
+			const response = await fetchImpl(url, init);
+			return {
+				ok: response.ok,
+				body: parseBody(response.status, await response.text())
+			};
 		} catch (error) {
 			if (options.signal.aborted) throw new AbortError();
 			if (isTimeout(error)) throw new MetabaseUnreachableError(url, `no response within ${REQUEST_TIMEOUT_MS}ms`);
@@ -919,10 +942,9 @@ function createHttp(options) {
 		}
 	}
 	async function requestBody(method, path, body) {
-		const response = await send(method, path, body);
-		const parsed = parseBody(response.status, await response.text());
-		if (!response.ok) throw failureFor(path, parsed);
-		return parsed;
+		const received = await send(method, path, body);
+		if (!received.ok) throw failureFor(path, received.body);
+		return received.body;
 	}
 	return {
 		async requestJson(method, path, request) {
@@ -1336,9 +1358,6 @@ function createMetabaseClient(baseUrl, auth, signal, options = {}) {
 		user: userResource(http)
 	};
 }
-function isNotReadyYet(error) {
-	return error instanceof MetabaseInitializingError || error instanceof MetabaseUnreachableError;
-}
 async function waitForHealth(client, options) {
 	const deadline = Date.now() + options.timeoutMs;
 	const interval = options.pollIntervalMs ?? HEALTH_POLL_INTERVAL_MS;
@@ -1347,7 +1366,7 @@ async function waitForHealth(client, options) {
 			await client.health.get();
 			return;
 		} catch (error) {
-			if (!isNotReadyYet(error)) throw error;
+			if (!isMetabaseNotServing(error)) throw error;
 			if (error instanceof MetabaseInitializingError) options.onProgress(error.progress);
 		}
 		if (!await options.isRunning()) throw new MetabaseUnreachableError(client.baseUrl, "it exited before it became healthy");
@@ -1374,15 +1393,12 @@ function storedApiKey(state, secrets) {
 function hostCredentialsClient(signal) {
 	return (baseUrl, auth) => createMetabaseClient(baseUrl, auth, signal);
 }
-function isNotReady(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
-}
 async function hasAdminOutsideRde(state, client) {
 	if (state.url === null) return false;
 	try {
 		return (await client(state.url, NO_AUTH).session.properties())["has-user-setup"];
 	} catch (error) {
-		if (isNotReady(error)) return false;
+		if (isMetabaseNotServing(error)) return false;
 		throw error;
 	}
 }
@@ -1818,10 +1834,11 @@ function signalProcess(pid, signal) {
 function stderrTail(stderr) {
 	return stderr.trim().split("\n").slice(-5).join("\n");
 }
-function toolFailure(tool, argv, result) {
+function toolFailure(tool, argv, result, options = {}) {
 	return new ExternalToolError({
 		tool,
 		argv,
+		envNames: options.addedEnv === void 0 ? [] : Object.keys(options.addedEnv),
 		exitCode: result.exitCode,
 		stderrTail: stderrTail(result.stderr)
 	});
@@ -1833,6 +1850,7 @@ async function runShown(runner, output, command, args) {
 		if (exitCode !== 0) throw new ExternalToolError({
 			tool: command,
 			argv: args,
+			envNames: [],
 			exitCode,
 			stderrTail: ""
 		});
@@ -1844,6 +1862,7 @@ async function runShown(runner, output, command, args) {
 		throw new ExternalToolError({
 			tool: command,
 			argv: args,
+			envNames: [],
 			exitCode: result.exitCode,
 			stderrTail: stderrTail(printed.filter((line) => HAS_TEXT.test(line)).join("\n"))
 		});
@@ -1857,6 +1876,7 @@ function parseJsonOutput(tool, argv, stdout, schema) {
 		throw new ExternalToolError({
 			tool,
 			argv,
+			envNames: [],
 			exitCode: 0,
 			stderrTail: `output is not JSON: ${error instanceof Error ? error.message : String(error)}`
 		});
@@ -1867,6 +1887,7 @@ function parseJsonOutput(tool, argv, stdout, schema) {
 		if (error instanceof ZodError) throw new ExternalToolError({
 			tool,
 			argv,
+			envNames: [],
 			exitCode: 0,
 			stderrTail: `unexpected output shape:\n${z.prettifyError(error)}`
 		});
@@ -2332,6 +2353,7 @@ function dockerTool(runner) {
 		throw new ExternalToolError({
 			tool: DOCKER,
 			argv: args,
+			envNames: [],
 			exitCode: 0,
 			stderrTail: `no port published on ${LOOPBACK_HOST} in: ${result.stdout.trim()}`
 		});
@@ -3083,7 +3105,7 @@ function hostDeps$14(ctx) {
 	};
 }
 function isNotMetabaseYet(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError || error instanceof MetabaseApiError;
+	return isMetabaseNotServing(error) || error instanceof MetabaseApiError;
 }
 function validateEmail(value) {
 	return EMAIL.test(value) ? void 0 : "Enter an email address";
@@ -3284,7 +3306,9 @@ function adminUserStep(options, deps = hostDeps$14) {
 //#endregion
 //#region src/tools/mb.ts
 const MB = "mb";
-const MB_INSTALL_SPEC = `@metabase/cli@alpha-release-65-integration-branch`;
+const MB_PACKAGE = "@metabase/cli";
+const MB_DIST_TAG = "alpha-release-65-integration-branch";
+const MB_INSTALL_SPEC = `${MB_PACKAGE}@${MB_DIST_TAG}`;
 const GLOBAL_INSTALL = {
 	npm: {
 		command: "npm",
@@ -3441,11 +3465,12 @@ const LogoutResult = z.object({
 	cleared: z.boolean(),
 	aborted: z.boolean()
 }).loose();
+const MbAuthMethod = z.enum(["oauth", "apiKey"]);
 const AuthStatus = z.object({
 	profile: z.string(),
 	present: z.boolean(),
 	url: z.string().nullable(),
-	method: z.string().nullable(),
+	method: MbAuthMethod.nullable(),
 	user: ProbedUser.nullable()
 }).loose();
 const AuthProfileStatus = z.enum([
@@ -3458,7 +3483,6 @@ const AuthProfileStatus = z.enum([
 const AuthProfile = z.object({
 	profile: z.string(),
 	url: z.string(),
-	authenticated: z.boolean(),
 	status: AuthProfileStatus,
 	user: ProbedUser.nullable()
 }).loose();
@@ -3493,11 +3517,41 @@ const RemoteChanges = z.object({
 	remote_version: z.string().nullable(),
 	local_version: z.string().nullable()
 }).loose();
+function comparableUrl(url) {
+	const parsed = new URL(url);
+	return `${parsed.origin}${parsed.pathname.replace(/\/+$/, "")}`;
+}
+function sameMetabaseUrl(a, b) {
+	return comparableUrl(a) === comparableUrl(b);
+}
+function isLoggedInAt(status, url) {
+	return status !== null && status.present && status.url !== null && sameMetabaseUrl(status.url, url);
+}
+function isOAuthLoginAt(status, url) {
+	return status !== null && status.method === MbAuthMethod.enum.oauth && isLoggedInAt(status, url);
+}
+function isApiKeyLoginAt(status, url) {
+	return status !== null && status.method === MbAuthMethod.enum.apiKey && isLoggedInAt(status, url);
+}
+function mbInstanceOf(state, secrets) {
+	const configured = configuredRuntime(state);
+	if (configured === null || secrets === null || secrets.apiKey === null) return null;
+	return {
+		url: configured.url,
+		apiKey: secrets.apiKey
+	};
+}
+function instanceEnv(instance) {
+	return { addedEnv: {
+		[ENV_MB_URL]: instance.url,
+		[ENV_MB_API_KEY]: instance.apiKey
+	} };
+}
 function mbTool(runner) {
-	async function mbJson(args, schema, stdin) {
+	async function mbJson(args, schema, options = {}) {
 		const argv = [...args, "--json"];
-		const result = await runner.run(MB, argv, stdin === void 0 ? {} : { stdin });
-		if (result.exitCode !== 0) throw toolFailure(MB, argv, result);
+		const result = await runner.run(MB, argv, options);
+		if (result.exitCode !== 0) throw toolFailure(MB, argv, result, options);
 		return parseJsonOutput(MB, argv, result.stdout, schema);
 	}
 	async function version(command = MB) {
@@ -3520,7 +3574,7 @@ function mbTool(runner) {
 			options.url,
 			"--profile",
 			options.profile
-		], LoginResult, `${options.apiKey}\n`);
+		], LoginResult, { stdin: `${options.apiKey}\n` });
 	}
 	async function authStatus(profile) {
 		return mbJson([
@@ -3530,6 +3584,14 @@ function mbTool(runner) {
 			profile
 		], AuthStatus);
 	}
+	async function authStatusIfInstalled(profile) {
+		try {
+			return await authStatus(profile);
+		} catch (error) {
+			if (error instanceof ProcessNotFoundError) return null;
+			throw error;
+		}
+	}
 	async function authLogout(profile) {
 		return mbJson([
 			"auth",
@@ -3540,52 +3602,46 @@ function mbTool(runner) {
 		], LogoutResult);
 	}
 	async function authList() {
-		return (await mbJson(["auth", "list"], AuthList)).data;
+		return (await mbJson([
+			"auth",
+			"list",
+			"--fields",
+			"profile,url,status,user",
+			"--max-bytes",
+			"0"
+		], AuthList)).data;
 	}
-	async function gitSyncStatus(profile) {
-		return mbJson([
-			"git-sync",
-			"status",
-			"--profile",
-			profile
-		], GitSyncStatus);
+	async function gitSyncStatus(instance) {
+		return mbJson(["git-sync", "status"], GitSyncStatus, instanceEnv(instance));
 	}
-	async function gitSyncHasRemoteChanges(profile) {
-		return mbJson([
-			"git-sync",
-			"has-remote-changes",
-			"--profile",
-			profile
-		], RemoteChanges);
+	async function gitSyncHasRemoteChanges(instance) {
+		return mbJson(["git-sync", "has-remote-changes"], RemoteChanges, instanceEnv(instance));
 	}
-	async function gitSyncImport(profile, options) {
+	async function gitSyncImport(instance, options) {
 		return mbJson([
 			"git-sync",
 			"import",
-			"--profile",
-			profile,
 			"--branch",
 			options.branch,
 			"--wait"
-		], GitSyncOutcome);
+		], GitSyncOutcome, instanceEnv(instance));
 	}
-	async function gitSyncExport(profile, options) {
+	async function gitSyncExport(instance, options) {
 		return mbJson([
 			"git-sync",
 			"export",
-			"--profile",
-			profile,
 			"--branch",
 			options.branch,
 			"--message",
 			options.message,
 			"--wait"
-		], GitSyncOutcome);
+		], GitSyncOutcome, instanceEnv(instance));
 	}
 	return {
 		version,
 		authLogin,
 		authStatus,
+		authStatusIfInstalled,
 		authLogout,
 		authList,
 		gitSyncStatus,
@@ -3606,7 +3662,8 @@ const ADMINISTRATORS_GROUP_NAME = "Administrators";
 function hostDeps$13(ctx) {
 	return {
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
-		runner: processRunner(ctx.signal)
+		runner: processRunner(ctx.signal),
+		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal))
 	};
 }
 async function adminCredentials(ctx) {
@@ -3662,6 +3719,13 @@ async function authenticates(client) {
 		throw error;
 	}
 }
+async function forgetCompletion(ctx) {
+	const { [STEP_ID$9]: record, ...steps } = ctx.state.steps;
+	if (record !== void 0) await ctx.saveState({
+		...ctx.state,
+		steps
+	});
+}
 async function workingApiKey(ctx, deps, url) {
 	const stored = ctx.secrets.apiKey;
 	if (stored !== null) {
@@ -3671,6 +3735,7 @@ async function workingApiKey(ctx, deps, url) {
 		}))) return stored;
 		ctx.ui.warn("Metabase rejects the stored API key; replacing it");
 	}
+	await forgetCompletion(ctx);
 	const sessionId = await superuserSession(ctx, deps, url);
 	const apiKey = await freshApiKey(ctx, deps.client(url, {
 		kind: "session",
@@ -3682,20 +3747,24 @@ async function workingApiKey(ctx, deps, url) {
 	});
 	return apiKey;
 }
-async function defaultProfileStatus(mb) {
-	try {
-		return await mb.authStatus(DEFAULT_MB_PROFILE);
-	} catch (error) {
-		if (error instanceof ProcessNotFoundError) return null;
-		throw error;
-	}
+function elsewhereUrl(status, url, movedFrom) {
+	if (status === null || !status.present || status.url === null) return null;
+	if (sameMetabaseUrl(status.url, url)) return null;
+	if (movedFrom !== null && sameMetabaseUrl(status.url, movedFrom)) return null;
+	return status.url;
 }
 async function chooseProfile(ctx, mb, url) {
 	const profile = ctx.state.mbProfile;
-	if (profile !== "default") return profile;
-	const existing = await defaultProfileStatus(mb);
-	if (existing === null || !existing.present || existing.url === null || existing.url === url || existing.url === ctx.state.movedFrom) return profile;
-	const previous = existing.url;
+	const status = await mb.authStatusIfInstalled(profile);
+	if (profile !== "default") return {
+		profile,
+		status
+	};
+	const previous = elsewhereUrl(status, url, ctx.state.movedFrom);
+	if (previous === null) return {
+		profile,
+		status
+	};
 	const named = namedMbProfile(ctx.state.name);
 	if (await ctx.prompts.select({
 		key: API_KEY_KEYS.profile,
@@ -3710,13 +3779,19 @@ async function chooseProfile(ctx, mb, url) {
 		recommended: "default"
 	}) === "default") {
 		ctx.ui.info(`Replacing mb profile ${DEFAULT_MB_PROFILE}, which pointed at ${previous}`);
-		return profile;
+		return {
+			profile,
+			status
+		};
 	}
 	await ctx.saveState({
 		...ctx.state,
 		mbProfile: named
 	});
-	return named;
+	return {
+		profile: named,
+		status: await mb.authStatusIfInstalled(named)
+	};
 }
 function usageNote(profile) {
 	if (profile === "default") return `${mbCommand(profile)} <command> uses this instance`;
@@ -3728,31 +3803,34 @@ function apiKeyStep(deps = hostDeps$13) {
 		title: "Connect the Metabase CLI",
 		redoHint: "`rde status` shows the mb profile it uses.",
 		async detect(ctx) {
-			if (ctx.secrets.apiKey === null) return "todo";
-			const mb = mbTool(deps(ctx).runner);
-			const profile = ctx.state.mbProfile;
+			const configured = configuredRuntime(ctx.state);
+			const apiKey = ctx.secrets.apiKey;
+			if (configured === null || apiKey === null || ctx.state.steps[STEP_ID$9]?.status !== "done") return "todo";
+			const resolved = deps(ctx);
+			if (!await resolved.instanceRunning()) return "todo";
+			if (!isLoggedInAt(await mbTool(resolved.runner).authStatusIfInstalled(ctx.state.mbProfile), configured.url)) return "todo";
 			try {
-				if (!(await mb.authStatus(profile)).present) return "todo";
+				return await authenticates(resolved.client(configured.url, {
+					kind: "api-key",
+					key: apiKey
+				})) ? "done" : "todo";
 			} catch (error) {
-				if (error instanceof ProcessNotFoundError) return "todo";
+				if (isMetabaseNotServing(error) || error instanceof MetabaseApiError) return "todo";
 				throw error;
 			}
-			return (await mb.authList()).find((candidate) => candidate.profile === profile)?.status === "ok" ? "done" : "todo";
 		},
 		async run(ctx) {
 			const resolved = deps(ctx);
 			const configured = requireConfiguredRuntime(ctx.state);
 			const apiKey = await workingApiKey(ctx, resolved, configured.url);
 			const mb = mbTool(resolved.runner);
-			const profile = await chooseProfile(ctx, mb, configured.url);
-			await mb.authLogin({
+			const { profile, status } = await chooseProfile(ctx, mb, configured.url);
+			if (isOAuthLoginAt(status, configured.url)) ctx.ui.info(`mb profile ${profile} is logged in to this instance with OAuth; leaving it as it is (\`mb auth logout --profile ${profile}\` first to use rde's API key instead)`);
+			else await mb.authLogin({
 				url: configured.url,
 				profile,
 				apiKey
 			});
-			const entry = (await mb.authList()).find((candidate) => candidate.profile === profile);
-			if (entry === void 0) throw new ConfigError(`\`mb auth list\` does not show profile ${profile} after login`);
-			if (entry.status !== "ok") throw new ConfigError(`mb profile ${profile} reports ${entry.status} after login`);
 			if (ctx.state.movedFrom !== null) await ctx.saveState({
 				...ctx.state,
 				movedFrom: null
@@ -5999,7 +6077,7 @@ async function applySettings(run, configured) {
 async function remoteHasContent(run, gitRemote) {
 	switch (gitRemote.kind) {
 		case "local-bare": return run.git.hasMetabaseContent(gitRemote.workdir);
-		case "hosted": return (await mbTool(run.deps.runner).gitSyncHasRemoteChanges(run.ctx.state.mbProfile)).has_changes;
+		case "hosted": return (await mbTool(run.deps.runner).gitSyncHasRemoteChanges(run.instance)).has_changes;
 	}
 }
 function reportImport(run, outcome) {
@@ -6021,7 +6099,7 @@ async function importExistingContent(run, gitRemote) {
 	const spinner = run.ctx.ui.spinner("Importing the repository's content into Metabase…");
 	let outcome;
 	try {
-		outcome = await mbTool(run.deps.runner).gitSyncImport(run.ctx.state.mbProfile, { branch: gitRemote.branch });
+		outcome = await mbTool(run.deps.runner).gitSyncImport(run.instance, { branch: gitRemote.branch });
 	} catch (error) {
 		spinner.fail("Import failed");
 		throw error;
@@ -6065,15 +6143,17 @@ function isMbUnavailable(error) {
 }
 async function runGitSync(ctx, deps) {
 	const configured = requireConfiguredRuntime(ctx.state);
-	if (ctx.secrets.apiKey === null) throw new ConfigError("no API key yet; the api-key step comes first");
+	const instance = mbInstanceOf(ctx.state, ctx.secrets);
+	if (instance === null) throw new ConfigError("no API key yet; the api-key step comes first");
 	const run = {
 		ctx,
 		deps,
 		git: gitTool(deps.runner),
-		client: deps.client(configured.url, {
+		client: deps.client(instance.url, {
 			kind: "api-key",
-			key: ctx.secrets.apiKey
-		})
+			key: instance.apiKey
+		}),
+		instance
 	};
 	const flow = await runFlow({
 		remote: remoteScreen(run),
@@ -6103,8 +6183,10 @@ function gitSyncStep(deps = hostDeps$12) {
 			if (!hasRemoteSync(ctx.state.license)) return "not-applicable";
 			if (ctx.state.steps[STEP_ID$8]?.status === "skipped") return "not-applicable";
 			if (ctx.state.gitRemote === null || ctx.state.steps[STEP_ID$8]?.status !== "done") return "todo";
+			const instance = mbInstanceOf(ctx.state, ctx.secrets);
+			if (instance === null) return "todo";
 			try {
-				return (await mbTool(deps(ctx).runner).gitSyncStatus(ctx.state.mbProfile)).branch === null ? "todo" : "done";
+				return (await mbTool(deps(ctx).runner).gitSyncStatus(instance)).branch === null ? "todo" : "done";
 			} catch (error) {
 				if (isMbUnavailable(error)) return "todo";
 				throw error;
@@ -6116,17 +6198,45 @@ function gitSyncStep(deps = hostDeps$12) {
 	};
 }
 //#endregion
+//#region src/metabase/domain/github-content.ts
+const GitHubContentEntry = z.object({
+	name: z.string(),
+	type: z.string(),
+	sha: z.string()
+}).loose();
+const GitHubDirectory = z.array(GitHubContentEntry);
+//#endregion
+//#region src/metabase/github.ts
+const GITHUB_API = "https://api.github.com";
+const DIRECTORY_TYPE = "dir";
+function githubContents(signal, options = {}) {
+	const http = createHttp({
+		baseUrl: GITHUB_API,
+		auth: NO_AUTH,
+		signal,
+		...options
+	});
+	return { async subdirectoryHashes(repository, ref, directory) {
+		const path = `/repos/${repository}/contents/${directory}${ref === null ? "" : `?ref=${encodeURIComponent(ref)}`}`;
+		const entries = await http.requestJson("GET", path, { schema: GitHubDirectory });
+		return new Map(entries.filter((entry) => entry.type === DIRECTORY_TYPE).map((entry) => [entry.name, entry.sha]));
+	} };
+}
+//#endregion
 //#region src/tools/skills-cli.ts
 const NPX = "npx";
 const SKILLS_PACKAGE = "skills@latest";
 const DEFAULT_RDE_SKILL_SOURCE = "https://github.com/metabase/agent-skills/tree/main";
 const RDE_SOURCE_SKILL_NAMES = ["rde", "rde-data-apps"];
-const DATA_APP_SKILLS_SOURCE = "metabase/metabase/skills#master";
+const DATA_APP_REPOSITORY = "metabase/metabase";
+const DATA_APP_BRANCH = "master";
+const DATA_APP_SKILLS_SOURCE = `${DATA_APP_REPOSITORY}/skills#${DATA_APP_BRANCH}`;
 const DATA_APP_SKILL_NAMES = [
 	"metabase-data-app-setup",
 	"metabase-data-app-routing",
 	"metabase-data-app-actions",
-	"metabase-data-app-semantic-layer"
+	"metabase-data-app-semantic-layer",
+	"metabase-data-app-migrate"
 ];
 function rdeSkillSource() {
 	const override = readEnv(ENV_RDE_SKILL_SOURCE);
@@ -6140,7 +6250,13 @@ const InstalledSkill = z.object({
 	source: z.string().nullable()
 }).loose();
 const InstalledSkillList = z.array(InstalledSkill);
-const SkillLock = z.object({ skills: z.record(z.string(), z.object({ ref: z.string().nullish() }).loose()) }).loose();
+const LockedSkill = z.object({
+	source: z.string().nullish(),
+	ref: z.string().nullish(),
+	skillPath: z.string().nullish(),
+	skillFolderHash: z.string().nullish()
+}).loose();
+const SkillLock = z.object({ skills: z.record(z.string(), LockedSkill) }).loose();
 const GLOBAL_LOCK_FILE = ".skill-lock.json";
 const PROJECT_LOCK_FILE = "skills-lock.json";
 function globalSkillLockPath(home, stateHome) {
@@ -6153,16 +6269,21 @@ function xdgStateHome() {
 	const value = readEnv(ENV_XDG_STATE_HOME);
 	return value === void 0 || value.length === 0 ? null : value;
 }
-function lockedRef(path, raw, skill) {
+function lockedSkill(path, raw, skill) {
 	if (raw === null) return null;
 	const parsed = SkillLock.safeParse(raw);
 	if (!parsed.success) throw new ConfigError(`${path} is not a skills lock file: ${parsed.error.message}`);
-	return parsed.data.skills[skill]?.ref ?? null;
+	return parsed.data.skills[skill] ?? null;
 }
 const hostSkillFiles = {
 	readJson: readJsonFile,
 	readText: readTextFile
 };
+const DATA_APP_SKILLS_ORIGIN = {
+	kind: "github",
+	repository: DATA_APP_REPOSITORY,
+	ref: DATA_APP_BRANCH
+};
 const GITHUB_URL = /^https:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?(?:\/tree\/([^/]+)(?:\/.*)?)?\/?$/;
 function skillOrigin(source, cwd) {
 	const github = GITHUB_URL.exec(source);
@@ -6252,7 +6373,11 @@ function hostDeps$11(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
 		probe: hostAgentProbe(),
-		skillSource: rdeSkillSource()
+		skillSource: rdeSkillSource(),
+		stateHome: xdgStateHome(),
+		files: hostSkillFiles,
+		github: githubContents(ctx.signal),
+		cwd: process.cwd()
 	};
 }
 function detectedOnly(agents) {
@@ -6287,10 +6412,91 @@ function coveredAgentNames(entry, agents) {
 function installedLines(entries, agents) {
 	return entries.map((entry) => `${entry.name} (${coveredAgentNames(entry, agents).join(", ")}): ${entry.path}`).join("\n");
 }
+function skillSets(deps) {
+	return [{
+		label: "data-app",
+		source: DATA_APP_SKILLS_SOURCE,
+		sourceNote: "",
+		origin: DATA_APP_SKILLS_ORIGIN,
+		skills: DATA_APP_SKILL_NAMES
+	}, {
+		label: "rde",
+		source: deps.skillSource,
+		sourceNote: deps.skillSource === "https://github.com/metabase/agent-skills/tree/main" ? "" : ` from ${deps.skillSource}`,
+		origin: skillOrigin(deps.skillSource, deps.cwd),
+		skills: RDE_SOURCE_SKILL_NAMES
+	}];
+}
+function hashLookup(github) {
+	const asked = /* @__PURE__ */ new Map();
+	return (repository, ref, directory) => {
+		const key = JSON.stringify([
+			repository,
+			ref,
+			directory
+		]);
+		let hashes = asked.get(key);
+		if (hashes === void 0) {
+			hashes = github.subdirectoryHashes(repository, ref, directory).catch((error) => {
+				if (lookupFailure(error) === null) throw error;
+				return null;
+			});
+			asked.set(key, hashes);
+		}
+		return hashes;
+	};
+}
+async function readLockedSkills(deps) {
+	const lockPath = globalSkillLockPath(deps.probe.home, deps.stateHome);
+	try {
+		const lock = await deps.files.readJson(lockPath);
+		return new Map(REQUIRED_SKILL_NAMES.map((name) => [name, lockedSkill(lockPath, lock, name)]));
+	} catch (error) {
+		if (error instanceof ConfigError) return null;
+		throw error;
+	}
+}
+function lockedCopy(locked, origin) {
+	if (locked === null || locked.source !== origin.repository) return null;
+	const ref = locked.ref ?? null;
+	if (origin.ref !== null && ref !== origin.ref) return null;
+	if (locked.skillPath === null || locked.skillPath === void 0) return null;
+	if (locked.skillFolderHash === null || locked.skillFolderHash === void 0) return null;
+	const folder = posix.dirname(locked.skillPath);
+	return {
+		ref,
+		directory: posix.dirname(folder),
+		folder: posix.basename(folder),
+		hash: locked.skillFolderHash
+	};
+}
+async function setBehind(set, check) {
+	const { origin } = set;
+	if (origin.kind !== "github" || check.locked === null) return true;
+	const copies = [];
+	for (const skill of set.skills) {
+		const copy = lockedCopy(check.locked.get(skill) ?? null, origin);
+		if (copy === null) return true;
+		copies.push(copy);
+	}
+	if (check.updates === "installed") return false;
+	for (const copy of copies) {
+		const current = await check.hashes(origin.repository, copy.ref, copy.directory);
+		if (current !== null && current.get(copy.folder) !== copy.hash) return true;
+	}
+	return false;
+}
+function hasSkill(installed, skill, agent) {
+	return installed.some((entry) => entry.name === skill && skillCoversAgent(entry, agent));
+}
+function coversAll(installed, skills, agents) {
+	return agents.every((agent) => skills.every((skill) => hasSkill(installed, skill, agent)));
+}
 const SOURCE_NOTES = {
 	override: "from --agents",
 	detected: "detected on this machine",
-	chosen: "as chosen"
+	chosen: "as chosen",
+	installed: "updating the installed copies"
 };
 function agentChoice(agent) {
 	return {
@@ -6308,7 +6514,7 @@ async function askAgents(ctx, detected) {
 	});
 	return detected.filter((agent) => picked.includes(agent.id));
 }
-async function selectAgents(ctx, all, options) {
+async function selectAgents(ctx, all, options, installedNow) {
 	switch (options.kind) {
 		case "detected": return {
 			agents: detectedOnly(all),
@@ -6327,6 +6533,10 @@ async function selectAgents(ctx, all, options) {
 				agents: [],
 				source: "detected"
 			};
+			if (coversAll(await installedNow(), REQUIRED_SKILL_NAMES, detected)) return {
+				agents: detected,
+				source: "installed"
+			};
 			return {
 				agents: await askAgents(ctx, detected),
 				source: "chosen"
@@ -6337,11 +6547,21 @@ async function selectAgents(ctx, all, options) {
 function skipLine(all, source) {
 	switch (source) {
 		case "override":
-		case "chosen": return `Skipping the skills; run \`rde init --only ${STEP_ID$7}\` to install it later`;
+		case "chosen":
+		case "installed": return `Skipping the skills; run \`rde init --only ${STEP_ID$7}\` to install it later`;
 		case "detected": return `No coding agent found (${displayNames(all)}); run \`rde init --only ${STEP_ID$7} --agents <name>\` once one is installed`;
 	}
 }
-function agentsSkillsStep(options, deps = hostDeps$11) {
+function agentsSkillsStep(options, updates, deps = hostDeps$11) {
+	let hashes = null;
+	async function setCheck(resolved) {
+		hashes ??= hashLookup(resolved.github);
+		return {
+			updates,
+			locked: await readLockedSkills(resolved),
+			hashes
+		};
+	}
 	return {
 		id: STEP_ID$7,
 		title: "Install the rde and data-app skills for your coding agents",
@@ -6350,34 +6570,42 @@ function agentsSkillsStep(options, deps = hostDeps$11) {
 			const resolved = deps(ctx);
 			const detected = detectedOnly(await detectAgents(resolved.probe));
 			if (detected.length === 0) return ctx.state.steps[STEP_ID$7]?.status === "skipped" ? "not-applicable" : "todo";
-			return missingSkills(await skillsCli(resolved.runner).list(), detected).length === 0 ? "done" : "todo";
+			if (missingSkills(await skillsCli(resolved.runner).list(), detected).length > 0) return "todo";
+			const check = await setCheck(resolved);
+			for (const set of skillSets(resolved)) if (await setBehind(set, check)) return "outdated";
+			return "done";
 		},
 		async run(ctx) {
 			const resolved = deps(ctx);
+			const skills = skillsCli(resolved.runner);
 			const all = await detectAgents(resolved.probe);
-			const selection = await selectAgents(ctx, all, options);
+			let listing = null;
+			const installedNow = () => listing ??= skills.list();
+			const selection = await selectAgents(ctx, all, options, installedNow);
 			if (selection.agents.length === 0) {
 				ctx.ui.info(skipLine(all, selection.source));
 				return { outcome: "skipped" };
 			}
-			const skills = skillsCli(resolved.runner);
+			const before = await installedNow();
+			const check = await setCheck(resolved);
+			const pending = [];
+			for (const set of skillSets(resolved)) if (!coversAll(before, set.skills, selection.agents) || await setBehind(set, check)) pending.push(set);
+			const names = displayNames(selection.agents);
+			if (pending.length === 0) {
+				ctx.ui.success(`The rde and data-app skills are current for ${names}`);
+				return { outcome: "completed" };
+			}
 			const agents = selection.agents.map((agent) => agent.skillsCliName);
-			const forWhom = `for ${displayNames(selection.agents)} (${SOURCE_NOTES[selection.source]})`;
-			ctx.ui.info(`Installing the data-app skills ${forWhom}`);
-			await skills.add({
-				source: DATA_APP_SKILLS_SOURCE,
-				skills: DATA_APP_SKILL_NAMES,
-				agents,
-				output: ctx.ui.childOutput
-			});
-			const from = resolved.skillSource === "https://github.com/metabase/agent-skills/tree/main" ? "" : ` from ${resolved.skillSource}`;
-			ctx.ui.info(`Installing the rde skills ${forWhom}${from}`);
-			await skills.add({
-				source: resolved.skillSource,
-				skills: RDE_SOURCE_SKILL_NAMES,
-				agents,
-				output: ctx.ui.childOutput
-			});
+			const forWhom = `for ${names} (${SOURCE_NOTES[selection.source]})`;
+			for (const set of pending) {
+				ctx.ui.info(`Installing the ${set.label} skills ${forWhom}${set.sourceNote}`);
+				await skills.add({
+					source: set.source,
+					skills: set.skills,
+					agents,
+					output: ctx.ui.childOutput
+				});
+			}
 			const installed = await skills.list();
 			const missing = unlistedSkills(installed);
 			if (missing.length > 0) throw new ConfigError(`the skills installer finished but \`skills list\` does not show ${missing.join(", ")}`);
@@ -6398,9 +6626,6 @@ function hostDatabasesDeps(signal) {
 		now: () => /* @__PURE__ */ new Date()
 	};
 }
-function isNotServingYet$2(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
-}
 function requireApiKey$2(state, apiKey) {
 	if (apiKey === null) throw new ConfigError(`instance ${state.name} has no API key yet; run \`rde init\``);
 	return apiKey;
@@ -6541,7 +6766,7 @@ function databasesStep(options, deps = hostDeps$10) {
 			try {
 				return (await client.database.list()).data.some((database) => isOwn(database.id)) ? "done" : "todo";
 			} catch (error) {
-				if (isNotServingYet$2(error) || isRejectedCredential(error)) return "todo";
+				if (isMetabaseNotServing(error) || isRejectedCredential(error)) return "todo";
 				throw error;
 			}
 		},
@@ -6555,6 +6780,24 @@ function databasesStep(options, deps = hostDeps$10) {
 	};
 }
 //#endregion
+//#region src/metabase/domain/npm-package.ts
+const NpmVersionManifest = z.object({ version: z.string() }).loose();
+//#endregion
+//#region src/metabase/npm-registry.ts
+const NPM_REGISTRY = "https://registry.npmjs.org";
+function npmRegistry(signal, options = {}) {
+	const http = createHttp({
+		baseUrl: NPM_REGISTRY,
+		auth: NO_AUTH,
+		signal,
+		...options
+	});
+	return { async distTagVersion(packageName, tag) {
+		const path = `/${encodeURIComponent(packageName)}/${encodeURIComponent(tag)}`;
+		return (await http.requestJson("GET", path, { schema: NpmVersionManifest })).version;
+	} };
+}
+//#endregion
 //#region src/steps/install-mb.ts
 const STEP_ID$5 = "install-mb";
 const MIN_MB_VERSION = "0.3.0";
@@ -6569,7 +6812,8 @@ function hostDeps$9(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
 		installedWith: rdeInstalledWith(),
-		locate: locateMbOnPath
+		locate: locateMbOnPath,
+		publishedVersion: () => npmRegistry(ctx.signal).distTagVersion(MB_PACKAGE, MB_DIST_TAG)
 	};
 }
 async function inspectMb(runner) {
@@ -6583,6 +6827,38 @@ async function inspectMb(runner) {
 		satisfies: semver.satisfies(version, MB_RANGE, { includePrerelease: true })
 	};
 }
+const UNCHECKED = { kind: "unchecked" };
+async function publishedMb(deps) {
+	let raw;
+	try {
+		raw = await deps.publishedVersion();
+	} catch (error) {
+		const reason = lookupFailure(error);
+		if (reason === null) throw error;
+		return {
+			kind: "unknown",
+			reason
+		};
+	}
+	const version = semver.valid(raw);
+	if (version === null) return {
+		kind: "unknown",
+		reason: `the registry names "${raw}" for ${MB_DIST_TAG}, which is not a version`
+	};
+	return {
+		kind: "published",
+		version
+	};
+}
+function coreOf(version) {
+	return `${semver.major(version)}.${semver.minor(version)}.${semver.patch(version)}`;
+}
+function updateTo(release, installed) {
+	if (release.kind !== "published" || release.version === installed) return null;
+	const order = semver.compare(coreOf(installed), coreOf(release.version));
+	if (order === 0) return semver.prerelease(installed) === null ? null : release.version;
+	return order < 0 ? release.version : null;
+}
 function displayCommand(install) {
 	return [install.command, ...install.args].join(" ");
 }
@@ -6669,6 +6945,7 @@ async function stillWrong(install, after, deps) {
 	const fail = (stderrTail) => new ExternalToolError({
 		tool: install.command,
 		argv: install.args,
+		envNames: [],
 		exitCode: 0,
 		stderrTail
 	});
@@ -6681,27 +6958,66 @@ async function stillWrong(install, after, deps) {
 		`${stillWrongAdvice(diagnosis)}.`
 	].join(" "));
 }
-function installMbStep(deps = hostDeps$9) {
+async function shadowedWarning(lead, deps) {
+	const found = await inspectMbOnPath(deps.runner, deps.locate);
+	const diagnosis = diagnoseMb(found, deps.installedWith);
+	const advice = diagnosis.kind === "shadowed" ? ` ${shadowedHint(diagnosis)}.` : "";
+	return `${lead} Every mb on PATH, in order: ${mbPathLines(found).join("; ")}.${advice}`;
+}
+async function updateFor(release, installed, deps) {
+	const version = updateTo(release, installed);
+	if (version === null) return { kind: "current" };
+	return (await inspectMbOnPath(deps.runner, deps.locate)).some((entry) => entry.version === version) ? {
+		kind: "shadowed",
+		version
+	} : {
+		kind: "update",
+		version
+	};
+}
+function installMbStep(updates, deps = hostDeps$9) {
+	let published = null;
+	function release(resolved) {
+		if (updates === "installed") return Promise.resolve(UNCHECKED);
+		published ??= publishedMb(resolved);
+		return published;
+	}
 	return {
 		id: STEP_ID$5,
 		title: "Install the Metabase CLI",
 		async detect(ctx) {
-			const found = await inspectMb(deps(ctx).runner);
-			return found.installed && found.satisfies ? "done" : "todo";
+			const resolved = deps(ctx);
+			const found = await inspectMb(resolved.runner);
+			if (!found.installed || !found.satisfies) return "todo";
+			return (await updateFor(await release(resolved), found.version, resolved)).kind === "update" ? "outdated" : "done";
 		},
 		async run(ctx) {
 			const resolved = deps(ctx);
 			const before = await inspectMb(resolved.runner);
+			const target = await release(resolved);
 			if (before.installed && before.satisfies) {
-				ctx.ui.success(`mb ${before.version} is installed`);
-				return { outcome: "completed" };
-			}
-			if (before.installed) ctx.ui.warn(`mb ${before.version} is installed; ${MIN_MB_VERSION} or newer is required`);
+				if (target.kind === "unknown") ctx.ui.warn(`Could not check for a newer mb: ${target.reason}`);
+				const update = await updateFor(target, before.version, resolved);
+				if (update.kind === "shadowed") {
+					const lead = `mb ${before.version} runs first; ${update.version} is installed later on PATH.`;
+					ctx.ui.warn(await shadowedWarning(lead, resolved));
+				}
+				if (update.kind !== "update") {
+					ctx.ui.success(`mb ${before.version} is installed`);
+					return { outcome: "completed" };
+				}
+				ctx.ui.info(`mb ${before.version} is installed; updating to ${update.version}`);
+			} else if (before.installed) ctx.ui.warn(`mb ${before.version} is installed; ${MIN_MB_VERSION} or newer is required`);
 			const install = mbInstallCommand(resolved.installedWith);
 			ctx.ui.info(`Running ${displayCommand(install)}`);
 			await runShown(resolved.runner, ctx.ui.childOutput, install.command, install.args);
 			const after = await inspectMb(resolved.runner);
 			if (!after.installed || !after.satisfies) throw await stillWrong(install, after, resolved);
+			const stillNewer = updateTo(target, after.version);
+			if (stillNewer !== null) {
+				const lead = `mb ${after.version} still runs first, not the ${stillNewer} just installed.`;
+				ctx.ui.warn(await shadowedWarning(lead, resolved));
+			}
 			ctx.ui.success(`mb ${after.version} is installed`);
 			return { outcome: "completed" };
 		}
@@ -6722,7 +7038,7 @@ function hostDeps$8(ctx) {
 }
 function isNoTokenYet(error) {
 	if (error instanceof MetabaseApiError) return error.status === NOT_FOUND_STATUS$2;
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
+	return isMetabaseNotServing(error);
 }
 function validateToken(value) {
 	if (value.length === 0 || TOKEN_PATTERN.test(value)) return;
@@ -6798,7 +7114,8 @@ function licenseStep(deps = hostDeps$8) {
 					validThru: status["valid-thru"] ?? null
 				}
 			});
-			await mbTool(resolved.runner).authLogin({
+			const mb = mbTool(resolved.runner);
+			if (isApiKeyLoginAt(await mb.authStatus(ctx.state.mbProfile), configured.url)) await mb.authLogin({
 				url: configured.url,
 				profile: ctx.state.mbProfile,
 				apiKey
@@ -7157,9 +7474,6 @@ function hostDeps$5(ctx) {
 		now: () => /* @__PURE__ */ new Date()
 	};
 }
-function isNotServingYet$1(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
-}
 function isNotFound$2(error) {
 	return error instanceof MetabaseApiError && error.status === NOT_FOUND_STATUS$1;
 }
@@ -7320,7 +7634,7 @@ function sampleDatabaseStep(deps = hostDeps$5) {
 			try {
 				return await recordedDatabase(record, client) === null ? "todo" : "done";
 			} catch (error) {
-				if (isNotServingYet$1(error) || isRejectedCredential(error)) return "todo";
+				if (isMetabaseNotServing(error) || isRejectedCredential(error)) return "todo";
 				throw error;
 			}
 		},
@@ -7357,7 +7671,7 @@ function hostDeps$4(ctx) {
 	};
 }
 function isNotHealthy(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError || error instanceof MetabaseApiError;
+	return isMetabaseNotServing(error) || error instanceof MetabaseApiError;
 }
 async function runningVersion(client) {
 	return (await client.session.properties()).version.tag;
@@ -7462,9 +7776,6 @@ function hostDeps$3(ctx) {
 		probe: hostAgentProbe()
 	};
 }
-function isNotServing$1(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
-}
 function loginLine(kind, email) {
 	switch (kind) {
 		case "generated":
@@ -7481,7 +7792,7 @@ async function databaseLines$1(state, apiKey, deps) {
 			key: apiKey
 		}).database.listWithStubs()).data;
 	} catch (error) {
-		if (isNotServing$1(error)) return ["Databases: Metabase is not running; `rde start`"];
+		if (isMetabaseNotServing(error)) return ["Databases: Metabase is not running; `rde start`"];
 		if (isRejectedCredential(error)) return ["Databases: Metabase rejects the stored API key; `rde init --only api-key`"];
 		throw error;
 	}
@@ -7563,9 +7874,6 @@ function hostDeps$2(ctx) {
 		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal))
 	};
 }
-function isNotServingYet(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
-}
 function transformsStep(deps = hostDeps$2) {
 	return {
 		id: STEP_ID,
@@ -7582,7 +7890,7 @@ function transformsStep(deps = hostDeps$2) {
 			try {
 				return await client.setting.transformsDecided() ? "done" : "todo";
 			} catch (error) {
-				if (isNotServingYet(error) || isRejectedCredential(error)) return "todo";
+				if (isMetabaseNotServing(error) || isRejectedCredential(error)) return "todo";
 				throw error;
 			}
 		},
@@ -7609,12 +7917,17 @@ const DEFAULT_STEP_OPTIONS = {
 	runtime: NO_RUNTIME_FLAGS,
 	agents: DETECT_AGENTS,
 	admin: DEFAULT_ADMIN,
-	databases: SAMPLE_STANDS_IN
+	databases: SAMPLE_STANDS_IN,
+	updates: "published"
+};
+const LOCAL_STEP_OPTIONS = {
+	...DEFAULT_STEP_OPTIONS,
+	updates: "installed"
 };
 const STEP_BY_ID = {
 	preflight: () => preflightStep(),
-	"install-mb": () => installMbStep(),
-	"agents-skills": (options) => agentsSkillsStep(options.agents),
+	"install-mb": (options) => installMbStep(options.updates),
+	"agents-skills": (options) => agentsSkillsStep(options.agents, options.updates),
 	runtime: (options) => runtimeStep(options.runtime),
 	"start-metabase": () => startMetabaseStep(),
 	"admin-user": (options) => adminUserStep(options.admin),
@@ -7792,7 +8105,8 @@ function stepOptionsFrom(answers, run) {
 		},
 		agents: agentsOption(agents, run),
 		admin: admin === void 0 ? DEFAULT_STEP_OPTIONS.admin : { variant: admin.variant },
-		databases: { request: databasesRequest(databases, run) }
+		databases: { request: databasesRequest(databases, run) },
+		updates: DEFAULT_STEP_OPTIONS.updates
 	};
 }
 function keyedAnswers(answers) {
@@ -8398,6 +8712,7 @@ var SessionCache = class {
 const CHECKLIST_MARK = {
 	done: "✓",
 	todo: "○",
+	outdated: "↑",
 	"not-applicable": "–"
 };
 const SPINNER_FAILURE_CODE = 1;
@@ -8638,7 +8953,7 @@ async function turnOf(entry, ctx, options) {
 	if (options.only !== void 0) return "not-selected";
 	if (entry.status === "done") return "done";
 	const status = await entry.step.detect(ctx);
-	return status === "todo" ? "run" : status;
+	return status === "todo" || status === "outdated" ? "run" : status;
 }
 function unusedMessage(step, turn, given) {
 	const hint = step.redoHint === void 0 ? "" : ` ${step.redoHint}`;
@@ -9102,31 +9417,46 @@ async function credentialRows(state, secrets, apiKey, deps) {
 		stateFileRow(files)
 	];
 }
-function withoutTrailingSlash(url) {
-	return url.replace(/\/+$/, "");
+function brokenProfileRepair(profile, method) {
+	if (method === MbAuthMethod.enum.oauth) return {
+		hint: `\`mb auth login --profile ${profile}\` logs it in again; or \`mb auth logout --profile ${profile}\`, then \`rde init --only api-key\` hands the profile to rde's API key`,
+		step: null
+	};
+	return {
+		hint: "`rde init --only api-key` logs it in again",
+		step: API_KEY_STEP
+	};
+}
+function unprobedReason(method, healthy, access) {
+	if (access.kind === "accepted") return null;
+	if (method !== MbAuthMethod.enum.oauth) return access.reason;
+	return healthy ? null : NOT_HEALTHY_REASON;
 }
-async function mbProfileRow(state, url, profiles, mbUnusableReason, healthy) {
+async function mbProfileRow(state, url, deps, profiles, mbUnusableReason, healthy, access) {
+	const id = "mb-profile";
 	const label = "mb profile";
-	if (mbUnusableReason !== null) return skipped("mb-profile", label, mbUnusableReason);
-	if (!healthy) return skipped("mb-profile", label, NOT_HEALTHY_REASON);
-	const entry = (await profiles()).find((candidate) => candidate.profile === state.mbProfile);
-	if (entry === void 0) return failed("mb-profile", label, {
-		detail: `${state.mbProfile} is not configured`,
+	const profile = state.mbProfile;
+	if (mbUnusableReason !== null) return skipped(id, label, mbUnusableReason);
+	const status = await mbTool(deps.runner).authStatus(profile);
+	if (!status.present || status.url === null) return failed(id, label, {
+		detail: `${profile} is not configured`,
 		hint: "`rde init --only api-key`",
-		step: "api-key"
+		step: API_KEY_STEP
 	});
-	if (withoutTrailingSlash(entry.url) !== withoutTrailingSlash(url)) return failed("mb-profile", label, {
-		detail: `${state.mbProfile} points at ${entry.url}, not at this instance (${url})`,
+	if (!sameMetabaseUrl(status.url, url)) return failed(id, label, {
+		detail: `${profile} points at ${status.url}, not at this instance (${url})`,
 		hint: "`rde init --only api-key` logs it back in against the instance",
-		step: "api-key"
+		step: API_KEY_STEP
 	});
-	if (entry.status !== "ok") return failed("mb-profile", label, {
-		detail: `${state.mbProfile}: ${entry.status}`,
-		hint: "`rde init --only api-key` logs it in again",
-		step: "api-key"
+	const unprobed = unprobedReason(status.method, healthy, access);
+	if (unprobed !== null) return skipped(id, label, unprobed);
+	const how = status.method === MbAuthMethod.enum.oauth ? " (OAuth)" : "";
+	const entry = (await profiles()).find((candidate) => candidate.profile === profile);
+	if (entry === void 0 || entry.status !== "ok") return failed(id, label, {
+		detail: `${profile}${how}: ${entry === void 0 ? "not listed by `mb auth list`" : entry.status}`,
+		...brokenProfileRepair(profile, status.method)
 	});
-	const user = entry.user === null ? "" : ` as ${entry.user.name}`;
-	return ok("mb-profile", label, `${state.mbProfile}: ok${user}`);
+	return ok(id, label, `${profile}${how}: ok${entry.user === null ? "" : ` as ${entry.user.name}`}`);
 }
 function hostOf(url) {
 	return URL.canParse(url) ? new URL(url).host : "an address that is not a URL";
@@ -9147,8 +9477,8 @@ async function mbProfileEnvRow(name, rdeProfile, profiles, mbUnusableReason) {
 async function environmentRows(env, rdeProfile, profiles, mbUnusableReason) {
 	const rows = [];
 	if (env.profile !== null) rows.push(await mbProfileEnvRow(env.profile, rdeProfile, profiles, mbUnusableReason));
-	if (env.url !== null) rows.push(note$1(`env.${ENV_MB_URL}`, ENV_MB_URL, `every \`mb\` call goes to ${hostOf(env.url)}, whatever \`--profile\` says, rde's own included`, unsetHint(ENV_MB_URL)));
-	if (env.apiKeySet) rows.push(note$1(`env.${ENV_MB_API_KEY}`, ENV_MB_API_KEY, "set (value not shown): every `mb` call sends it, whatever `--profile` says, rde's own included", unsetHint(ENV_MB_API_KEY)));
+	if (env.url !== null) rows.push(note$1(`env.${ENV_MB_URL}`, ENV_MB_URL, `every \`mb\` call goes to ${hostOf(env.url)}, whatever \`--profile\` says`, unsetHint(ENV_MB_URL)));
+	if (env.apiKeySet) rows.push(note$1(`env.${ENV_MB_API_KEY}`, ENV_MB_API_KEY, "set (value not shown): every `mb` call sends it, whatever `--profile` says", unsetHint(ENV_MB_API_KEY)));
 	return rows;
 }
 const PROFILE_STATUS_WORDS = {
@@ -9250,12 +9580,13 @@ async function sampleDatabaseRow(record, deps, dockerOk, access) {
 function isMbFailure$1(error) {
 	return error instanceof ProcessNotFoundError || error instanceof ExternalToolError;
 }
-async function gitSyncRow(state, deps) {
+async function gitSyncRow(state, instance, deps) {
 	const label = "remote sync";
 	if (!hasRemoteSync(state.license)) return skipped("git-sync", label, `needs a license with ${REMOTE_SYNC_FEATURE}`);
 	if (state.gitRemote === null) return skipped("git-sync", label, "not configured; `rde init --from git-sync`");
+	if (instance === null) return skipped("git-sync", label, "no API key in the secrets file");
 	try {
-		const status = await mbTool(deps.runner).gitSyncStatus(state.mbProfile);
+		const status = await mbTool(deps.runner).gitSyncStatus(instance);
 		if (status.branch === null) return failed("git-sync", label, {
 			detail: "Metabase reports no branch",
 			hint: "`rde init --only git-sync`",
@@ -9286,7 +9617,7 @@ function withRef(source, ref) {
 }
 async function copyRef(entry, deps) {
 	const path = entry.scope === GLOBAL_SCOPE ? globalSkillLockPath(deps.probe.home, deps.skills.stateHome) : projectSkillLockPath(deps.skills.cwd);
-	return lockedRef(path, await deps.skills.files.readJson(path), entry.name);
+	return lockedSkill(path, await deps.skills.files.readJson(path), entry.name)?.ref ?? null;
 }
 async function judgeCopy(entry, origin, deps) {
 	const where = `${entry.scope} ${entry.path}`;
@@ -9413,13 +9744,13 @@ async function instanceRows(state, secrets, deps, dockerOk, profiles, mbUnusable
 		properties === null ? skipped("version", "Metabase version", NOT_HEALTHY_REASON) : versionRow(state, properties),
 		properties === null ? skipped("admin", "admin user", NOT_HEALTHY_REASON) : adminRow(state, properties),
 		...await credentialRows(state, secrets, apiKey, deps),
-		await mbProfileRow(state, configured.url, profiles, mbUnusableReason, healthy)
+		await mbProfileRow(state, configured.url, deps, profiles, mbUnusableReason, healthy, apiKey.access)
 	];
 	const access = apiKey.access;
 	if (access.kind === "unusable") rows.push(skipped("license", "license", access.reason), skipped("databases", "databases", access.reason));
 	else rows.push(await licenseRow(access.client), await databasesRow(state, access.client));
 	rows.push(state.sampleDatabase === null ? skipped("sample-database", SAMPLE_LABEL, "not connected; `rde init` adds one") : await sampleDatabaseRow(state.sampleDatabase, deps, dockerOk, access));
-	rows.push(await gitSyncRow(state, deps));
+	rows.push(await gitSyncRow(state, mbInstanceOf(state, secrets), deps));
 	return rows;
 }
 async function collectDoctor(instance, state, secrets, deps) {
@@ -9548,7 +9879,7 @@ const doctor = defineRdeCommand({
 				signal: interruptSignal,
 				prompts
 			});
-			if (await fixDoctor(report, initSteps(DEFAULT_STEP_OPTIONS), ctx, { yes: args.yes })) report = await collectDoctor(name, ctx.state, ctx.secrets, deps);
+			if (await fixDoctor(report, initSteps(LOCAL_STEP_OPTIONS), ctx, { yes: args.yes })) report = await collectDoctor(name, ctx.state, ctx.secrets, deps);
 		}
 		print(report, args.json);
 		if (report.failed > 0) throw new Error(doctorSummary(report));
@@ -9994,20 +10325,12 @@ async function moveToPort(ctx, port, deps) {
 	await runtimeFromState(next, deps.runtime).reconfigure();
 	ctx.ui.info(`Moved instance ${ctx.state.name} from port ${previous} to ${port}`);
 }
-async function profileStatus(runner, profile) {
-	try {
-		return await mbTool(runner).authStatus(profile);
-	} catch (error) {
-		if (error instanceof ProcessNotFoundError) return null;
-		throw error;
-	}
-}
 async function followMove(ctx, from, runner) {
 	const configured = requireConfiguredRuntime(ctx.state);
 	const apiKey = ctx.secrets.apiKey;
 	const profile = ctx.state.mbProfile;
-	const status = apiKey === null ? null : await profileStatus(runner, profile);
-	if (apiKey !== null && status !== null && status.present && status.url === from) {
+	const status = apiKey === null ? null : await mbTool(runner).authStatusIfInstalled(profile);
+	if (apiKey !== null && isLoggedInAt(status, from)) {
 		await mbTool(runner).authLogin({
 			url: configured.url,
 			profile,
@@ -10050,7 +10373,7 @@ const start = defineRdeCommand({
 const SUMMARY_STEP_ID = "summary";
 function hostStatusDeps(instanceName, signal) {
 	return {
-		steps: initSteps(DEFAULT_STEP_OPTIONS),
+		steps: initSteps(LOCAL_STEP_OPTIONS),
 		runtime: hostRuntimeDeps(instanceName, signal),
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, signal),
 		runner: processRunner(signal)
@@ -10090,15 +10413,12 @@ function setupOf(ctx, steps) {
 		resume: `rde init --from ${pending.id}`
 	};
 }
-function isNotServing(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
-}
 async function databasesOf(ctx, deps, health) {
 	if (health !== "healthy" || ctx.secrets.apiKey === null) return null;
 	try {
 		return await listDatabases(ctx.state, ctx.secrets.apiKey, { client: deps.client });
 	} catch (error) {
-		if (isNotServing(error) || isRejectedCredential(error)) return null;
+		if (isMetabaseNotServing(error) || isRejectedCredential(error)) return null;
 		throw error;
 	}
 }
@@ -10128,10 +10448,13 @@ function isMbFailure(error) {
 }
 async function gitSyncOf(ctx, deps) {
 	if (ctx.state.gitRemote === null) return null;
+	if (configuredRuntime(ctx.state) === null) return { error: "no Metabase runtime configured; `rde init`" };
+	const instance = mbInstanceOf(ctx.state, ctx.secrets);
+	if (instance === null) return { error: "no API key in the secrets file; `rde init --only api-key`" };
 	try {
 		const mb = mbTool(deps.runner);
-		const status = await mb.gitSyncStatus(ctx.state.mbProfile);
-		const changes = await mb.gitSyncHasRemoteChanges(ctx.state.mbProfile);
+		const status = await mb.gitSyncStatus(instance);
+		const changes = await mb.gitSyncHasRemoteChanges(instance);
 		return {
 			branch: status.branch,
 			dirty: status.is_dirty,
@@ -10292,7 +10615,6 @@ const stop = defineRdeCommand({
 });
 //#endregion
 //#region src/steps/uninstall.ts
-const API_KEY_METHOD = "apiKey";
 function hostUninstallDeps(signal, childOutput) {
 	const runner = processRunner(signal);
 	return {
@@ -10451,8 +10773,8 @@ async function findJar(source, removeImage) {
 }
 function isInstanceProfile(status, urls) {
 	if (!status.present) return false;
-	if (urls !== null) return status.url !== null && urls.includes(status.url);
-	return status.method === API_KEY_METHOD && status.user?.name === "rde";
+	if (urls !== null) return urls.some((url) => isLoggedInAt(status, url));
+	return status.method === MbAuthMethod.enum.apiKey && status.user?.name === "rde";
 }
 function instanceUrls(state) {
 	if (state.url === null) return null;
@@ -10460,23 +10782,34 @@ function instanceUrls(state) {
 }
 async function findMbProfiles(candidates, urls, runner) {
 	const mb = mbTool(runner);
-	const removals = [];
+	const found = {
+		removals: [],
+		kept: []
+	};
 	for (const profile of candidates) {
 		let status;
 		try {
 			status = await mb.authStatus(profile);
 		} catch (error) {
-			if (error instanceof ProcessNotFoundError) return [];
+			if (error instanceof ProcessNotFoundError) return {
+				removals: [],
+				kept: []
+			};
 			throw error;
 		}
-		if (isInstanceProfile(status, urls)) removals.push({
+		if (!isInstanceProfile(status, urls)) continue;
+		if (status.method === MbAuthMethod.enum.oauth) {
+			found.kept.push(`mb profile ${profile}, logged in with OAuth; \`mb auth logout --profile ${profile}\` logs it out`);
+			continue;
+		}
+		found.removals.push({
 			label: `mb profile ${profile}`,
 			remove: async () => {
 				await mb.authLogout(profile);
 			}
 		});
 	}
-	return removals;
+	return found;
 }
 function skillLabel(names, entries) {
 	const agents = [...new Set(entries.flatMap((entry) => entry.agents))];
@@ -10558,7 +10891,8 @@ async function planUninstall(options, deps) {
 		if (jar.kept !== null) kept.push(jar.kept);
 	}
 	const profiles = state === null ? await findMbProfiles([.../* @__PURE__ */ new Set([mbProfileFor(options.instance), namedMbProfile(options.instance)])], null, deps.runner) : await findMbProfiles([state.mbProfile], instanceUrls(state), deps.runner);
-	removals.push(...profiles);
+	removals.push(...profiles.removals);
+	kept.push(...profiles.kept);
 	if (options.removeSkill) {
 		const skill = await findSkill(deps.runner, deps.childOutput);
 		if (skill !== null) removals.push(skill);
@@ -10975,7 +11309,7 @@ const upgradeCommand = defineRdeCommand({
 const main = defineCommand({
 	meta: {
 		name: "rde",
-		version: "0.1.13",
+		version: "0.1.15",
 		description: "Prepares a local machine for data-engineering work with Metabase and coding agents"
 	},
 	subCommands: {