@metabase/rde 0.1.14 → 0.1.16

package/dist/cli.mjs

@@ -50,6 +50,7 @@ var StepFailedError = class extends Error {
 var ExternalToolError = class extends Error {
 	tool;
 	argv;
+	envNames;
 	exitCode;
 	stderrTail;
 	constructor(failure) {
@@ -57,15 +58,21 @@ var ExternalToolError = class extends Error {
 		this.name = "ExternalToolError";
 		this.tool = failure.tool;
 		this.argv = failure.argv;
+		this.envNames = failure.envNames;
 		this.exitCode = failure.exitCode;
 		this.stderrTail = failure.stderrTail;
 	}
 };
+function commandLabel(failure) {
+	const command = `\`${[failure.tool, ...failure.argv].join(" ")}\``;
+	if (failure.envNames.length === 0) return command;
+	return `${command}, run by rde with ${failure.envNames.join(" and ")} set,`;
+}
 function describeToolFailure(failure) {
-	const command = [failure.tool, ...failure.argv].join(" ");
+	const command = commandLabel(failure);
 	const exit = failure.exitCode === null ? "was killed" : `exited with ${failure.exitCode}`;
 	const tail = failure.stderrTail.trim();
-	return tail.length === 0 ? `\`${command}\` ${exit}` : `\`${command}\` ${exit}: ${tail}`;
+	return tail.length === 0 ? `${command} ${exit}` : `${command} ${exit}: ${tail}`;
 }
 var MetabaseApiError = class extends Error {
 	status;
@@ -103,6 +110,9 @@ var MetabaseUnreachableError = class extends Error {
 		this.reason = reason;
 	}
 };
+function isMetabaseNotServing(error) {
+	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
+}
 var DownloadError = class extends Error {
 	url;
 	constructor(url, reason) {
@@ -113,12 +123,10 @@ var DownloadError = class extends Error {
 };
 //#endregion
 //#region src/output/error.ts
-const INTERRUPTED_MESSAGE = "Interrupted. Run `rde init` again to resume.";
 const FAILURE_EXIT_CODE = 1;
 const USAGE_EXIT_CODE = 2;
 function exitCodeFor(error) {
 	if (error instanceof StepFailedError) return exitCodeFor(error.cause);
-	if (error instanceof AbortError) return 130;
 	if (error instanceof ConfigError) return USAGE_EXIT_CODE;
 	return FAILURE_EXIT_CODE;
 }
@@ -130,7 +138,6 @@ function stepFailureMessage(step, cause) {
 }
 function messageFor$1(error) {
 	if (error instanceof StepFailedError) return stepFailureMessage(error.step, messageFor$1(error.cause));
-	if (error instanceof AbortError) return INTERRUPTED_MESSAGE;
 	if (error instanceof Error) return error.message;
 	return String(error);
 }
@@ -138,10 +145,15 @@ function reportError(error) {
 	process.stderr.write(messageFor$1(error) + "\n");
 	process.exitCode = exitCodeFor(error);
 }
+function reportInterrupted(message) {
+	if (message !== null) process.stderr.write(message + "\n");
+	process.exitCode = 130;
+}
 //#endregion
 //#region src/commands/define.ts
 const SHORT_PREFIX = "-";
 const END_OF_OPTIONS = "--";
+const INTERRUPTED = "Interrupted.";
 function repeatedValues(rawArgs, flag) {
 	const values = [];
 	const inline = `${flag}=`;
@@ -164,9 +176,14 @@ function defineRdeCommand(def) {
 		meta: def.meta,
 		...def.args !== void 0 && { args: def.args },
 		async run({ args, rawArgs }) {
+			const interruption = { message: def.interrupted };
 			try {
-				await def.run(args, rawArgs);
+				await def.run(args, rawArgs, interruption);
 			} catch (error) {
+				if (error instanceof AbortError) {
+					reportInterrupted(interruption.message);
+					return;
+				}
 				reportError(error);
 			}
 		}
@@ -245,7 +262,6 @@ const StepId = z.enum([
 	"admin-user",
 	"api-key",
 	"transforms",
-	"sample-database",
 	"license",
 	"git-sync",
 	"databases",
@@ -322,12 +338,6 @@ const DatabaseRecord = z.object({
 	engine: z.string(),
 	createdAt: z.string()
 });
-const SampleDatabaseState = z.object({
-	containerName: z.string(),
-	image: z.string(),
-	port: z.int().positive(),
-	databaseId: z.int().nullable()
-});
 const GitRemoteState = z.discriminatedUnion("kind", [z.object({
 	kind: z.literal("local-bare"),
 	barePath: z.string(),
@@ -344,7 +354,7 @@ const StepRecord = z.object({
 	completedAt: z.string()
 });
 const InstanceState = z.object({
-	schemaVersion: z.literal(5),
+	schemaVersion: z.literal(6),
 	name: z.string(),
 	runtime: RuntimeState.nullable(),
 	url: z.string().nullable(),
@@ -353,7 +363,6 @@ const InstanceState = z.object({
 	mbProfile: z.string(),
 	license: LicenseState,
 	databases: z.array(DatabaseRecord),
-	sampleDatabase: SampleDatabaseState.nullable(),
 	gitRemote: GitRemoteState.nullable(),
 	movedFrom: z.string().nullable(),
 	steps: z.partialRecord(StepId, StepRecord)
@@ -385,7 +394,7 @@ function mbCommand(profile) {
 }
 function emptyInstanceState(name) {
 	return {
-		schemaVersion: 5,
+		schemaVersion: 6,
 		name,
 		runtime: null,
 		url: null,
@@ -394,7 +403,6 @@ function emptyInstanceState(name) {
 		mbProfile: mbProfileFor(name),
 		license: { activated: false },
 		databases: [],
-		sampleDatabase: null,
 		gitRemote: null,
 		movedFrom: null,
 		steps: {}
@@ -407,6 +415,7 @@ const V1 = 1;
 const V2 = 2;
 const V3 = 3;
 const V4 = 4;
+const V5 = 5;
 const StateV1 = z.object({ schemaVersion: z.literal(V1) }).loose();
 const StateV2 = z.object({ schemaVersion: z.literal(V2) }).loose();
 const AdminV3 = z.discriminatedUnion("kind", [z.object({
@@ -418,6 +427,7 @@ const AdminV3 = z.discriminatedUnion("kind", [z.object({
 	password: z.string()
 })]);
 const StateV4 = z.object({ schemaVersion: z.literal(V4) }).loose();
+const StateV5 = z.object({ schemaVersion: z.literal(V5) }).loose();
 const StateV3 = z.object({
 	schemaVersion: z.literal(V3),
 	admin: AdminV3.nullable(),
@@ -433,17 +443,23 @@ function liftV1(raw) {
 function liftV2(raw) {
 	return {
 		...StateV2.parse(raw),
-		schemaVersion: V3,
-		sampleDatabase: null
+		schemaVersion: V3
 	};
 }
 function liftV4(raw) {
 	return {
 		...StateV4.parse(raw),
-		schemaVersion: 5,
+		schemaVersion: V5,
 		movedFrom: null
 	};
 }
+function liftV5(raw) {
+	const { sampleDatabase: _sampleDatabase, ...state } = StateV5.parse(raw);
+	return {
+		...state,
+		schemaVersion: 6
+	};
+}
 function adminV4(admin) {
 	switch (admin.kind) {
 		case "default": return {
@@ -463,11 +479,11 @@ function liftV3(raw) {
 		password: admin.password
 	} : null;
 	return {
-		state: InstanceState.parse(liftV4({
+		state: migrateInstanceState(liftV4({
 			...rest,
 			schemaVersion: V4,
 			admin: admin === null ? null : adminV4(admin)
-		})),
+		})).state,
 		movedSecrets: {
 			schemaVersion: 1,
 			admin: login,
@@ -481,15 +497,16 @@ function migrateInstanceState(raw) {
 		case V1: return migrateInstanceState(liftV1(raw));
 		case V2: return migrateInstanceState(liftV2(raw));
 		case V3: return liftV3(raw);
-		case V4: return {
-			state: InstanceState.parse(liftV4(raw)),
+		case V4: return migrateInstanceState(liftV4(raw));
+		case V5: return {
+			state: InstanceState.parse(liftV5(raw)),
 			movedSecrets: null
 		};
-		case 5: return {
+		case 6: return {
 			state: InstanceState.parse(raw),
 			movedSecrets: null
 		};
-		default: throw new ConfigError(`state schemaVersion ${schemaVersion} is not supported by this build (expected 5)`);
+		default: throw new ConfigError(`state schemaVersion ${schemaVersion} is not supported by this build (expected 6)`);
 	}
 }
 //#endregion
@@ -1348,9 +1365,6 @@ function createMetabaseClient(baseUrl, auth, signal, options = {}) {
 		user: userResource(http)
 	};
 }
-function isNotReadyYet(error) {
-	return error instanceof MetabaseInitializingError || error instanceof MetabaseUnreachableError;
-}
 async function waitForHealth(client, options) {
 	const deadline = Date.now() + options.timeoutMs;
 	const interval = options.pollIntervalMs ?? HEALTH_POLL_INTERVAL_MS;
@@ -1359,7 +1373,7 @@ async function waitForHealth(client, options) {
 			await client.health.get();
 			return;
 		} catch (error) {
-			if (!isNotReadyYet(error)) throw error;
+			if (!isMetabaseNotServing(error)) throw error;
 			if (error instanceof MetabaseInitializingError) options.onProgress(error.progress);
 		}
 		if (!await options.isRunning()) throw new MetabaseUnreachableError(client.baseUrl, "it exited before it became healthy");
@@ -1386,15 +1400,12 @@ function storedApiKey(state, secrets) {
 function hostCredentialsClient(signal) {
 	return (baseUrl, auth) => createMetabaseClient(baseUrl, auth, signal);
 }
-function isNotReady(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
-}
 async function hasAdminOutsideRde(state, client) {
 	if (state.url === null) return false;
 	try {
 		return (await client(state.url, NO_AUTH).session.properties())["has-user-setup"];
 	} catch (error) {
-		if (isNotReady(error)) return false;
+		if (isMetabaseNotServing(error)) return false;
 		throw error;
 	}
 }
@@ -1475,6 +1486,7 @@ const credentials = defineRdeCommand({
 			default: false
 		}
 	},
+	interrupted: INTERRUPTED,
 	async run(args) {
 		const name = await defaultInstanceName();
 		const state = await requireInstanceState(name);
@@ -1830,10 +1842,11 @@ function signalProcess(pid, signal) {
 function stderrTail(stderr) {
 	return stderr.trim().split("\n").slice(-5).join("\n");
 }
-function toolFailure(tool, argv, result) {
+function toolFailure(tool, argv, result, options = {}) {
 	return new ExternalToolError({
 		tool,
 		argv,
+		envNames: options.addedEnv === void 0 ? [] : Object.keys(options.addedEnv),
 		exitCode: result.exitCode,
 		stderrTail: stderrTail(result.stderr)
 	});
@@ -1845,6 +1858,7 @@ async function runShown(runner, output, command, args) {
 		if (exitCode !== 0) throw new ExternalToolError({
 			tool: command,
 			argv: args,
+			envNames: [],
 			exitCode,
 			stderrTail: ""
 		});
@@ -1856,6 +1870,7 @@ async function runShown(runner, output, command, args) {
 		throw new ExternalToolError({
 			tool: command,
 			argv: args,
+			envNames: [],
 			exitCode: result.exitCode,
 			stderrTail: stderrTail(printed.filter((line) => HAS_TEXT.test(line)).join("\n"))
 		});
@@ -1869,6 +1884,7 @@ function parseJsonOutput(tool, argv, stdout, schema) {
 		throw new ExternalToolError({
 			tool,
 			argv,
+			envNames: [],
 			exitCode: 0,
 			stderrTail: `output is not JSON: ${error instanceof Error ? error.message : String(error)}`
 		});
@@ -1879,6 +1895,7 @@ function parseJsonOutput(tool, argv, stdout, schema) {
 		if (error instanceof ZodError) throw new ExternalToolError({
 			tool,
 			argv,
+			envNames: [],
 			exitCode: 0,
 			stderrTail: `unexpected output shape:\n${z.prettifyError(error)}`
 		});
@@ -2179,10 +2196,10 @@ function createArgs(options) {
 		"--label",
 		`${IMAGE_LABEL}=${options.image}`,
 		"-p",
-		`${LOOPBACK_HOST}:${options.port.host ?? ""}:${options.port.container}`
+		`${LOOPBACK_HOST}:${options.port.host}:${options.port.container}`,
+		"-v",
+		`${options.mount.source}:${options.mount.target}`
 	];
-	if (options.port.alsoOn !== null) args.push("-p", `${options.port.alsoOn}:${options.port.host ?? ""}:${options.port.container}`);
-	if (options.mount !== null) args.push("-v", `${options.mount.source}:${options.mount.target}`);
 	for (const [name, value] of Object.entries(options.env)) args.push("-e", `${name}=${value}`);
 	if (options.hostUser !== null) {
 		args.push("-e", `${ENV_HOST_UID}=${options.hostUser.uid}`);
@@ -2241,17 +2258,6 @@ function dockerTool(runner) {
 		if (NO_SUCH_IMAGE.test(result.stderr)) return null;
 		throw toolFailure(DOCKER, args, result);
 	}
-	async function bridgeGateway() {
-		const gateway = (await docker([
-			"network",
-			"inspect",
-			"bridge",
-			"--format",
-			"{{range .IPAM.Config}}{{.Gateway}}{{end}}"
-		])).stdout.trim();
-		if (gateway.length === 0) throw new ConfigError("`docker network inspect bridge` names no gateway address");
-		return gateway;
-	}
 	async function imageRemove(image) {
 		await docker(["rmi", image]);
 	}
@@ -2328,33 +2334,6 @@ function dockerTool(runner) {
 			name
 		]);
 	}
-	async function containerLoopbackPort(name, containerPort) {
-		const args = [
-			"port",
-			name,
-			`${containerPort}/tcp`
-		];
-		const result = await docker(args);
-		const prefix = `${LOOPBACK_HOST}:`;
-		const line = result.stdout.split("\n").find((entry) => entry.startsWith(prefix));
-		if (line !== void 0) {
-			const port = Number.parseInt(line.slice(prefix.length), 10);
-			if (Number.isInteger(port)) return port;
-		}
-		throw new ExternalToolError({
-			tool: DOCKER,
-			argv: args,
-			exitCode: 0,
-			stderrTail: `no port published on ${LOOPBACK_HOST} in: ${result.stdout.trim()}`
-		});
-	}
-	async function containerExecSucceeds(name, command) {
-		return (await runner.run(DOCKER, [
-			"exec",
-			name,
-			...command
-		])).exitCode === 0;
-	}
 	async function containerLogs(name, options) {
 		const args = ["logs"];
 		if (options.follow) args.push("--follow");
@@ -2367,7 +2346,6 @@ function dockerTool(runner) {
 		imagePull,
 		imageId,
 		imageRemove,
-		bridgeGateway,
 		containerInspect,
 		containerImageId,
 		portClaims,
@@ -2377,8 +2355,6 @@ function dockerTool(runner) {
 		containerRestart,
 		containerRemove,
 		containerForceRemove,
-		containerLoopbackPort,
-		containerExecSucceeds,
 		containerLogs
 	};
 }
@@ -2556,8 +2532,7 @@ function dockerRuntime(state, deps) {
 			imageId,
 			port: {
 				host: state.port,
-				container: CONTAINER_PORT,
-				alsoOn: null
+				container: CONTAINER_PORT
 			},
 			mount: {
 				source: deps.dataDir,
@@ -2871,148 +2846,21 @@ function runtimeFromState(state, deps) {
 	}
 }
 //#endregion
-//#region src/runtime/sample-database.ts
-const SAMPLE_DATABASE_IMAGE = "metabase/qa-databases:postgres-sample-15";
-const SAMPLE_DATABASE_USER = "metabase";
-const SAMPLE_DATABASE_PASSWORD = "metasample123";
-const SAMPLE_DATABASE_NAME = "sample";
-const SAMPLE_DATABASE_PORT = 25432;
-const SAMPLE_DATABASE_READY_TIMEOUT_MS = 12e4;
-const SAMPLE_DATABASE_STOP_GRACE_MS = 1e4;
-const POSTGRES_PORT = 5432;
+//#region src/runtime/leftover-sample-database.ts
 const CONTAINER_NAME_PREFIX = "rde-sampledb";
-const READY_POLL_MS = 1e3;
-const READY_PROBE = [
-	"pg_isready",
-	"-h",
-	LOOPBACK_HOST,
-	"-U",
-	SAMPLE_DATABASE_USER,
-	"-d",
-	SAMPLE_DATABASE_NAME
-];
-function sampleContainerName(instanceName, home) {
+const SAMPLE_DATABASE_STOP_GRACE_MS = 1e4;
+function sampleDatabaseContainerName(instanceName, home) {
 	const tag = homeTag(home);
 	const name = `${CONTAINER_NAME_PREFIX}-${instanceName}`;
 	return tag === null ? name : `${name}-${tag}`;
 }
-function sampleDatabaseUrl(port) {
-	return `postgres://${SAMPLE_DATABASE_USER}:${SAMPLE_DATABASE_PASSWORD}@localhost:${port}/${SAMPLE_DATABASE_NAME}`;
-}
-function publishesOnLoopback$1(inspection, port) {
-	return inspection.ports.some((mapping) => mapping.container === POSTGRES_PORT && mapping.host === port && mapping.hostIp === "127.0.0.1");
-}
-function createOptions(state, home, hostPort, alsoOn) {
-	return {
-		name: state.containerName,
-		home,
-		image: state.image,
-		imageId: null,
-		port: {
-			host: hostPort,
-			container: POSTGRES_PORT,
-			alsoOn
-		},
-		mount: null,
-		env: {},
-		addHostGateway: false,
-		hostUser: null
-	};
-}
-function requireOwnContainer(name, existing, home) {
-	if (existing.home !== null && existing.home !== home) throw new ConfigError(`container ${name} belongs to the rde home ${existing.home} and is left alone`);
-}
-function sampleDatabaseContainer(state, docker, home) {
-	const name = state.containerName;
-	function conflict(reason) {
-		return new ConfigError(`container ${name} already exists ${reason}; remove it with \`docker rm -f ${name}\` and run \`rde init\` again`);
-	}
-	async function install(options) {
-		const existing = await docker.containerInspect(name);
-		if (existing.exists) {
-			if (existing.image !== state.image) throw conflict(`with image ${existing.image}, not ${state.image}`);
-			if (publishesOnLoopback$1(existing, state.port)) return;
-			requireOwnContainer(name, existing, home);
-			await docker.containerForceRemove(name);
-		}
-		await docker.imagePull(state.image, { onLine: options.onProgress });
-		await docker.containerCreate(createOptions(state, home, state.port, options.alsoOn));
-	}
-	async function start() {
-		const existing = await docker.containerInspect(name);
-		if (!existing.exists) return "missing";
-		if (existing.running) return "running";
-		await docker.containerStart(name);
-		return "started";
-	}
-	async function stop() {
-		const existing = await docker.containerInspect(name);
-		if (existing.exists && existing.running) await docker.containerStop(name, { graceMs: SAMPLE_DATABASE_STOP_GRACE_MS });
-	}
-	async function status() {
-		const existing = await docker.containerInspect(name);
-		return {
-			installed: existing.exists,
-			running: existing.exists && existing.running
-		};
-	}
-	async function waitReady(options) {
-		const deadline = Date.now() + options.timeoutMs;
-		const interval = options.pollMs ?? READY_POLL_MS;
-		for (;;) {
-			if (await docker.containerExecSucceeds(name, READY_PROBE)) return;
-			const existing = await docker.containerInspect(name);
-			if (!existing.exists || !existing.running) throw new ConfigError(`container ${name} stopped before Postgres was ready; \`docker logs ${name}\` shows why`);
-			if (Date.now() >= deadline) throw new ConfigError(`Postgres in ${name} is not ready after ${Math.round(options.timeoutMs / 1e3)}s; \`docker logs ${name}\` shows what it is doing`);
-			try {
-				await setTimeout$1(interval, void 0, { signal: options.signal });
-			} catch {
-				throw new AbortError();
-			}
-		}
-	}
-	return {
-		install,
-		start,
-		stop,
-		status,
-		waitReady
-	};
-}
-function extraAddress(inspection) {
-	const extra = inspection.ports.find((mapping) => mapping.container === POSTGRES_PORT && mapping.hostIp !== "127.0.0.1");
-	return extra === void 0 ? null : extra.hostIp;
-}
-async function startOnDockerPort(state, docker, home, alsoOn) {
-	const name = state.containerName;
-	await docker.containerForceRemove(name);
-	await docker.containerCreate(createOptions(state, home, null, null));
-	await docker.containerStart(name);
-	const port = await docker.containerLoopbackPort(name, POSTGRES_PORT);
+async function removeLeftoverSampleDatabase(docker, instanceName, home) {
+	if (!(await docker.available()).available) return null;
+	const name = sampleDatabaseContainerName(instanceName, home);
+	const existing = await docker.containerInspect(name);
+	if (!existing.exists || existing.home !== null && existing.home !== home) return null;
 	await docker.containerForceRemove(name);
-	const pinned = {
-		...state,
-		port
-	};
-	await docker.containerCreate(createOptions(pinned, home, port, alsoOn));
-	await docker.containerStart(name);
-	return pinned;
-}
-async function startOnFreePort(state, docker, home) {
-	try {
-		return {
-			outcome: await sampleDatabaseContainer(state, docker, home).start(),
-			state
-		};
-	} catch (error) {
-		if (!isPortTakenError(error)) throw error;
-	}
-	const existing = await docker.containerInspect(state.containerName);
-	if (existing.exists) requireOwnContainer(state.containerName, existing, home);
-	return {
-		outcome: "started",
-		state: await startOnDockerPort(state, docker, home, existing.exists ? extraAddress(existing) : null)
-	};
+	return name;
 }
 //#endregion
 //#region src/steps/lifecycle.ts
@@ -3023,10 +2871,14 @@ async function loadInstance(name, signal) {
 	return {
 		state,
 		url: configured.url,
-		runtime: runtimeFromState(configured.runtime, deps),
-		sampleDatabase: state.sampleDatabase === null ? null : sampleDatabaseContainer(state.sampleDatabase, deps.docker, deps.rdeHome)
+		runtime: runtimeFromState(configured.runtime, deps)
 	};
 }
+async function removeLeftovers(name, signal) {
+	const deps = hostRuntimeDeps(name, signal);
+	const removed = await removeLeftoverSampleDatabase(deps.docker, name, deps.rdeHome);
+	return removed === null ? null : `Removed container ${removed}, the sample database of an older rde`;
+}
 async function isInstanceRunning(state, runtime) {
 	const configured = configuredRuntime(state);
 	if (configured === null) return false;
@@ -3035,44 +2887,29 @@ async function isInstanceRunning(state, runtime) {
 function openInstance(url) {
 	return openBrowser(url);
 }
-function ownContainers(state) {
-	const names = /* @__PURE__ */ new Set();
-	if (state.runtime?.kind === "docker") names.add(state.runtime.containerName);
-	if (state.sampleDatabase !== null) names.add(state.sampleDatabase.containerName);
-	return names;
-}
-function instanceClaims(other) {
-	const claims = [];
-	if (other.runtime !== null) claims.push({
-		port: other.runtime.port,
-		holder: `rde instance ${other.name}`
-	});
-	if (other.sampleDatabase !== null) claims.push({
-		port: other.sampleDatabase.port,
-		holder: `the sample database of rde instance ${other.name}`
-	});
-	return claims;
-}
 async function portClaims(state, runtime) {
 	const claims = [];
 	if ((await runtime.docker.available()).available) {
-		const own = ownContainers(state);
-		for (const claim of await runtime.docker.portClaims()) if (!own.has(claim.container)) claims.push({
+		const own = state.runtime?.kind === "docker" ? state.runtime.containerName : null;
+		for (const claim of await runtime.docker.portClaims()) if (claim.container !== own) claims.push({
 			port: claim.port,
 			holder: `container ${claim.container}`
 		});
 	}
-	for (const other of await runtime.instances()) if (other.name !== state.name) claims.push(...instanceClaims(other));
+	for (const other of await runtime.instances()) if (other.name !== state.name && other.runtime !== null) claims.push({
+		port: other.runtime.port,
+		holder: `rde instance ${other.name}`
+	});
 	return claims;
 }
 //#endregion
 //#region src/steps/admin-user.ts
-const STEP_ID$10 = "admin-user";
+const STEP_ID$8 = "admin-user";
 const ADMIN_USER_KEYS = {
-	email: `${STEP_ID$10}.email`,
-	password: `${STEP_ID$10}.password`,
-	firstName: `${STEP_ID$10}.first-name`,
-	lastName: `${STEP_ID$10}.last-name`
+	email: `${STEP_ID$8}.email`,
+	password: `${STEP_ID$8}.password`,
+	firstName: `${STEP_ID$8}.first-name`,
+	lastName: `${STEP_ID$8}.last-name`
 };
 const GENERATED_ADMIN_EMAIL = "admin@metabase.local";
 const GENERATED_PASSWORD_BYTES = 24;
@@ -3087,7 +2924,7 @@ function generatePassword(random) {
 		if (DIGIT.test(candidate)) return candidate;
 	}
 }
-function hostDeps$14(ctx) {
+function hostDeps$13(ctx) {
 	return {
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
 		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal)),
@@ -3095,7 +2932,7 @@ function hostDeps$14(ctx) {
 	};
 }
 function isNotMetabaseYet(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError || error instanceof MetabaseApiError;
+	return isMetabaseNotServing(error) || error instanceof MetabaseApiError;
 }
 function validateEmail(value) {
 	return EMAIL.test(value) ? void 0 : "Enter an email address";
@@ -3225,9 +3062,9 @@ async function recordExistingAdmin(ctx, variant, client, url) {
 	ctx.ui.success(`Admin user ${email} recorded`);
 	return "completed";
 }
-function adminUserStep(options, deps = hostDeps$14) {
+function adminUserStep(options, deps = hostDeps$13) {
 	return {
-		id: STEP_ID$10,
+		id: STEP_ID$8,
 		title: "Create the admin user",
 		redoHint: "An instance keeps the admin it was set up with; `rde credentials` shows it.",
 		async detect(ctx) {
@@ -3455,11 +3292,12 @@ const LogoutResult = z.object({
 	cleared: z.boolean(),
 	aborted: z.boolean()
 }).loose();
+const MbAuthMethod = z.enum(["oauth", "apiKey"]);
 const AuthStatus = z.object({
 	profile: z.string(),
 	present: z.boolean(),
 	url: z.string().nullable(),
-	method: z.string().nullable(),
+	method: MbAuthMethod.nullable(),
 	user: ProbedUser.nullable()
 }).loose();
 const AuthProfileStatus = z.enum([
@@ -3506,11 +3344,41 @@ const RemoteChanges = z.object({
 	remote_version: z.string().nullable(),
 	local_version: z.string().nullable()
 }).loose();
+function comparableUrl(url) {
+	const parsed = new URL(url);
+	return `${parsed.origin}${parsed.pathname.replace(/\/+$/, "")}`;
+}
+function sameMetabaseUrl(a, b) {
+	return comparableUrl(a) === comparableUrl(b);
+}
+function isLoggedInAt(status, url) {
+	return status !== null && status.present && status.url !== null && sameMetabaseUrl(status.url, url);
+}
+function isOAuthLoginAt(status, url) {
+	return status !== null && status.method === MbAuthMethod.enum.oauth && isLoggedInAt(status, url);
+}
+function isApiKeyLoginAt(status, url) {
+	return status !== null && status.method === MbAuthMethod.enum.apiKey && isLoggedInAt(status, url);
+}
+function mbInstanceOf(state, secrets) {
+	const configured = configuredRuntime(state);
+	if (configured === null || secrets === null || secrets.apiKey === null) return null;
+	return {
+		url: configured.url,
+		apiKey: secrets.apiKey
+	};
+}
+function instanceEnv(instance) {
+	return { addedEnv: {
+		[ENV_MB_URL]: instance.url,
+		[ENV_MB_API_KEY]: instance.apiKey
+	} };
+}
 function mbTool(runner) {
-	async function mbJson(args, schema, stdin) {
+	async function mbJson(args, schema, options = {}) {
 		const argv = [...args, "--json"];
-		const result = await runner.run(MB, argv, stdin === void 0 ? {} : { stdin });
-		if (result.exitCode !== 0) throw toolFailure(MB, argv, result);
+		const result = await runner.run(MB, argv, options);
+		if (result.exitCode !== 0) throw toolFailure(MB, argv, result, options);
 		return parseJsonOutput(MB, argv, result.stdout, schema);
 	}
 	async function version(command = MB) {
@@ -3533,7 +3401,7 @@ function mbTool(runner) {
 			options.url,
 			"--profile",
 			options.profile
-		], LoginResult, `${options.apiKey}\n`);
+		], LoginResult, { stdin: `${options.apiKey}\n` });
 	}
 	async function authStatus(profile) {
 		return mbJson([
@@ -3543,6 +3411,14 @@ function mbTool(runner) {
 			profile
 		], AuthStatus);
 	}
+	async function authStatusIfInstalled(profile) {
+		try {
+			return await authStatus(profile);
+		} catch (error) {
+			if (error instanceof ProcessNotFoundError) return null;
+			throw error;
+		}
+	}
 	async function authLogout(profile) {
 		return mbJson([
 			"auth",
@@ -3562,50 +3438,37 @@ function mbTool(runner) {
 			"0"
 		], AuthList)).data;
 	}
-	async function gitSyncStatus(profile) {
-		return mbJson([
-			"git-sync",
-			"status",
-			"--profile",
-			profile
-		], GitSyncStatus);
+	async function gitSyncStatus(instance) {
+		return mbJson(["git-sync", "status"], GitSyncStatus, instanceEnv(instance));
 	}
-	async function gitSyncHasRemoteChanges(profile) {
-		return mbJson([
-			"git-sync",
-			"has-remote-changes",
-			"--profile",
-			profile
-		], RemoteChanges);
+	async function gitSyncHasRemoteChanges(instance) {
+		return mbJson(["git-sync", "has-remote-changes"], RemoteChanges, instanceEnv(instance));
 	}
-	async function gitSyncImport(profile, options) {
+	async function gitSyncImport(instance, options) {
 		return mbJson([
 			"git-sync",
 			"import",
-			"--profile",
-			profile,
 			"--branch",
 			options.branch,
 			"--wait"
-		], GitSyncOutcome);
+		], GitSyncOutcome, instanceEnv(instance));
 	}
-	async function gitSyncExport(profile, options) {
+	async function gitSyncExport(instance, options) {
 		return mbJson([
 			"git-sync",
 			"export",
-			"--profile",
-			profile,
 			"--branch",
 			options.branch,
 			"--message",
 			options.message,
 			"--wait"
-		], GitSyncOutcome);
+		], GitSyncOutcome, instanceEnv(instance));
 	}
 	return {
 		version,
 		authLogin,
 		authStatus,
+		authStatusIfInstalled,
 		authLogout,
 		authList,
 		gitSyncStatus,
@@ -3616,17 +3479,18 @@ function mbTool(runner) {
 }
 //#endregion
 //#region src/steps/api-key.ts
-const STEP_ID$9 = "api-key";
+const STEP_ID$7 = "api-key";
 const API_KEY_KEYS = {
-	email: `${STEP_ID$9}.email`,
-	password: `${STEP_ID$9}.password`,
-	profile: `${STEP_ID$9}.profile`
+	email: `${STEP_ID$7}.email`,
+	password: `${STEP_ID$7}.password`,
+	profile: `${STEP_ID$7}.profile`
 };
 const ADMINISTRATORS_GROUP_NAME = "Administrators";
-function hostDeps$13(ctx) {
+function hostDeps$12(ctx) {
 	return {
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
-		runner: processRunner(ctx.signal)
+		runner: processRunner(ctx.signal),
+		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal))
 	};
 }
 async function adminCredentials(ctx) {
@@ -3682,6 +3546,13 @@ async function authenticates(client) {
 		throw error;
 	}
 }
+async function forgetCompletion(ctx) {
+	const { [STEP_ID$7]: record, ...steps } = ctx.state.steps;
+	if (record !== void 0) await ctx.saveState({
+		...ctx.state,
+		steps
+	});
+}
 async function workingApiKey(ctx, deps, url) {
 	const stored = ctx.secrets.apiKey;
 	if (stored !== null) {
@@ -3691,6 +3562,7 @@ async function workingApiKey(ctx, deps, url) {
 		}))) return stored;
 		ctx.ui.warn("Metabase rejects the stored API key; replacing it");
 	}
+	await forgetCompletion(ctx);
 	const sessionId = await superuserSession(ctx, deps, url);
 	const apiKey = await freshApiKey(ctx, deps.client(url, {
 		kind: "session",
@@ -3702,20 +3574,24 @@ async function workingApiKey(ctx, deps, url) {
 	});
 	return apiKey;
 }
-async function defaultProfileStatus(mb) {
-	try {
-		return await mb.authStatus(DEFAULT_MB_PROFILE);
-	} catch (error) {
-		if (error instanceof ProcessNotFoundError) return null;
-		throw error;
-	}
+function elsewhereUrl(status, url, movedFrom) {
+	if (status === null || !status.present || status.url === null) return null;
+	if (sameMetabaseUrl(status.url, url)) return null;
+	if (movedFrom !== null && sameMetabaseUrl(status.url, movedFrom)) return null;
+	return status.url;
 }
 async function chooseProfile(ctx, mb, url) {
 	const profile = ctx.state.mbProfile;
-	if (profile !== "default") return profile;
-	const existing = await defaultProfileStatus(mb);
-	if (existing === null || !existing.present || existing.url === null || existing.url === url || existing.url === ctx.state.movedFrom) return profile;
-	const previous = existing.url;
+	const status = await mb.authStatusIfInstalled(profile);
+	if (profile !== "default") return {
+		profile,
+		status
+	};
+	const previous = elsewhereUrl(status, url, ctx.state.movedFrom);
+	if (previous === null) return {
+		profile,
+		status
+	};
 	const named = namedMbProfile(ctx.state.name);
 	if (await ctx.prompts.select({
 		key: API_KEY_KEYS.profile,
@@ -3730,49 +3606,58 @@ async function chooseProfile(ctx, mb, url) {
 		recommended: "default"
 	}) === "default") {
 		ctx.ui.info(`Replacing mb profile ${DEFAULT_MB_PROFILE}, which pointed at ${previous}`);
-		return profile;
+		return {
+			profile,
+			status
+		};
 	}
 	await ctx.saveState({
 		...ctx.state,
 		mbProfile: named
 	});
-	return named;
+	return {
+		profile: named,
+		status: await mb.authStatusIfInstalled(named)
+	};
 }
 function usageNote(profile) {
 	if (profile === "default") return `${mbCommand(profile)} <command> uses this instance`;
 	return `${mbCommand(profile)} <command>\nMB_PROFILE=${profile} for agents and scripts`;
 }
-function apiKeyStep(deps = hostDeps$13) {
+function apiKeyStep(deps = hostDeps$12) {
 	return {
-		id: STEP_ID$9,
+		id: STEP_ID$7,
 		title: "Connect the Metabase CLI",
 		redoHint: "`rde status` shows the mb profile it uses.",
 		async detect(ctx) {
-			if (ctx.secrets.apiKey === null) return "todo";
-			const mb = mbTool(deps(ctx).runner);
-			const profile = ctx.state.mbProfile;
+			const configured = configuredRuntime(ctx.state);
+			const apiKey = ctx.secrets.apiKey;
+			if (configured === null || apiKey === null || ctx.state.steps[STEP_ID$7]?.status !== "done") return "todo";
+			const resolved = deps(ctx);
+			if (!await resolved.instanceRunning()) return "todo";
+			if (!isLoggedInAt(await mbTool(resolved.runner).authStatusIfInstalled(ctx.state.mbProfile), configured.url)) return "todo";
 			try {
-				if (!(await mb.authStatus(profile)).present) return "todo";
+				return await authenticates(resolved.client(configured.url, {
+					kind: "api-key",
+					key: apiKey
+				})) ? "done" : "todo";
 			} catch (error) {
-				if (error instanceof ProcessNotFoundError) return "todo";
+				if (isMetabaseNotServing(error) || error instanceof MetabaseApiError) return "todo";
 				throw error;
 			}
-			return (await mb.authList()).find((candidate) => candidate.profile === profile)?.status === "ok" ? "done" : "todo";
 		},
 		async run(ctx) {
 			const resolved = deps(ctx);
 			const configured = requireConfiguredRuntime(ctx.state);
 			const apiKey = await workingApiKey(ctx, resolved, configured.url);
 			const mb = mbTool(resolved.runner);
-			const profile = await chooseProfile(ctx, mb, configured.url);
-			await mb.authLogin({
+			const { profile, status } = await chooseProfile(ctx, mb, configured.url);
+			if (isOAuthLoginAt(status, configured.url)) ctx.ui.info(`mb profile ${profile} is logged in to this instance with OAuth; leaving it as it is (\`mb auth logout --profile ${profile}\` first to use rde's API key instead)`);
+			else await mb.authLogin({
 				url: configured.url,
 				profile,
 				apiKey
 			});
-			const entry = (await mb.authList()).find((candidate) => candidate.profile === profile);
-			if (entry === void 0) throw new ConfigError(`\`mb auth list\` does not show profile ${profile} after login`);
-			if (entry.status !== "ok") throw new ConfigError(`mb profile ${profile} reports ${entry.status} after login`);
 			if (ctx.state.movedFrom !== null) await ctx.saveState({
 				...ctx.state,
 				movedFrom: null
@@ -4769,7 +4654,7 @@ const RSA_KEY_UNAVAILABLE_ERROR = "RSA public key is not available";
 const KEY_RETRIEVAL_NOTE = "allowPublicKeyRetrieval=true is added: MySQL 8 needs it to log in to a local server without SSL; to leave it out, paste a connection string with allowPublicKeyRetrieval=false instead";
 const KEY_RETRIEVAL_HINT = "MySQL 8 without SSL needs allowPublicKeyRetrieval=true: go back and add ?allowPublicKeyRetrieval=true to the connection string, or turn on SSL";
 const CONNECTION_PLACEHOLDER = "leave empty to skip";
-const STUB_CONNECTION_PLACEHOLDER = "leave empty to pick the engine";
+const ENGINE_PLACEHOLDER = "leave empty to pick the engine";
 const START_SCREEN = {
 	engine: "pick-engine",
 	"connection-string": "connection-string"
@@ -4795,6 +4680,9 @@ function targeting(stub) {
 function restart(model) {
 	return model.target === null ? FRESH$1 : targeting(model.target);
 }
+function mayFinish(run) {
+	return !run.deps.required || run.deps.existingCount + run.created.length > 0;
+}
 function nextStub(run, model) {
 	const stub = run.queue.shift();
 	if (stub !== void 0) return {
@@ -4802,13 +4690,18 @@ function nextStub(run, model) {
 		to: "connection-string",
 		model: targeting(stub)
 	};
-	return run.created.length > 0 ? {
+	if (run.created.length > 0) return {
 		type: "next",
 		to: "another",
 		model
-	} : {
+	};
+	return mayFinish(run) ? {
 		type: "done",
 		model
+	} : {
+		type: "next",
+		to: "connection-string",
+		model: FRESH$1
 	};
 }
 function stubNamed(run, name) {
@@ -4898,9 +4791,13 @@ function pickStubsScreen(run) {
 			run.queue = run.stubs.filter((stub) => picked.includes(stub.id));
 			return nextStub(run, model);
 		}
-		if (run.deps.start === "connection-string" && run.created.length === 0) return {
+		if (run.deps.start === "connection-string" && run.created.length === 0) return mayFinish(run) ? {
 			type: "done",
 			model
+		} : {
+			type: "next",
+			to: "connection-string",
+			model: FRESH$1
 		};
 		return {
 			type: "next",
@@ -4910,6 +4807,11 @@ function pickStubsScreen(run) {
 	};
 }
 function connectionQuestion(run, target) {
+	if (target === null && !mayFinish(run)) return {
+		key: DATABASE_KEYS.connection,
+		message: "Connection string of your database (Enter to pick its engine instead)",
+		placeholder: ENGINE_PLACEHOLDER
+	};
 	if (target === null) return {
 		key: DATABASE_KEYS.connection,
 		message: "Connection string of your database (Enter to skip; `rde db add` connects one later)",
@@ -4918,7 +4820,7 @@ function connectionQuestion(run, target) {
 	return {
 		key: databaseKey(ordinalOf(run), "connection"),
 		message: `Connection string of ${target.name} (Enter to pick its engine instead)`,
-		placeholder: STUB_CONNECTION_PLACEHOLDER
+		placeholder: ENGINE_PLACEHOLDER
 	};
 }
 function connectionStringScreen(run) {
@@ -4930,7 +4832,7 @@ function connectionStringScreen(run) {
 				...draft !== null && { initialValue: draft }
 			})).trim();
 			draft = uri;
-			if (uri.length === 0) return model.target === null ? {
+			if (uri.length === 0) return model.target === null && mayFinish(run) ? {
 				type: "done",
 				model
 			} : {
@@ -4969,22 +4871,28 @@ function connectionStringScreen(run) {
 		}
 	};
 }
-function finishLabel(run, model) {
-	if (model.target !== null) return `Leave ${model.target.name} unconnected`;
-	return run.deps.existingCount + run.created.length > 0 ? "Finish" : "Skip for now";
+function finishChoices(run, model) {
+	if (model.target !== null) return [{
+		value: FINISH,
+		label: `Leave ${model.target.name} unconnected`
+	}];
+	if (run.deps.existingCount + run.created.length > 0) return [{
+		value: FINISH,
+		label: "Finish"
+	}];
+	return mayFinish(run) ? [{
+		value: FINISH,
+		label: "Skip for now"
+	}] : [];
 }
 function pickEngineScreen(run) {
 	return async (model) => {
 		const total = run.deps.existingCount + run.created.length;
-		const finishChoice = {
-			value: FINISH,
-			label: finishLabel(run, model)
-		};
 		for (;;) {
 			const picked = await run.deps.prompts.select({
 				key: databaseKey(ordinalOf(run), "engine"),
 				message: "Which database engine?",
-				choices: [...run.deps.catalog.list().map(engineChoice), finishChoice],
+				choices: [...run.deps.catalog.list().map(engineChoice), ...finishChoices(run, model)],
 				...model.engine !== null && { initialValue: model.engine.key }
 			});
 			if (picked === "finish" && model.target !== null) return nextStub(run, model);
@@ -5460,6 +5368,13 @@ const METABASE_CONTENT_DIRS = [
 ];
 const TOKEN_USERNAMES = { "bitbucket.org": "x-token-auth" };
 const DEFAULT_TOKEN_USERNAME = "x-access-token";
+const MISSING_REF_EXIT_CODE = 1;
+const FIELD_SEPARATOR = "";
+const COMMIT_FORMAT = [
+	"%H",
+	"%h",
+	"%s"
+].join("%x1f");
 function credentialEnv(credentials) {
 	const { origin, hostname } = new URL(credentials.url);
 	const username = TOKEN_USERNAMES[hostname] ?? DEFAULT_TOKEN_USERNAME;
@@ -5473,6 +5388,18 @@ function credentialEnv(credentials) {
 		GIT_TERMINAL_PROMPT: "0"
 	};
 }
+function parseCommitLine(line) {
+	const [sha, shortSha, subject] = line.split(FIELD_SEPARATOR);
+	if (sha === void 0 || shortSha === void 0 || subject === void 0) throw new Error(`unexpected \`git log\` line: ${line}`);
+	return {
+		sha,
+		shortSha,
+		subject
+	};
+}
+function outputLines(stdout) {
+	return stdout.split("\n").filter((line) => line.length > 0);
+}
 async function directoryExists(path) {
 	try {
 		return (await promises.stat(path)).isDirectory();
@@ -5528,8 +5455,12 @@ function gitTool(runner) {
 		], { cwd: dir });
 		return result.exitCode === 0 && result.stdout.trim().length > 0;
 	}
-	async function commitAll(dir, message) {
-		await git(["add", "--all"], { cwd: dir });
+	async function commitPaths(dir, paths, message) {
+		await git([
+			"add",
+			"--",
+			...paths
+		], { cwd: dir });
 		await git([
 			...await hasIdentity(dir) ? [] : [
 				"-c",
@@ -5539,7 +5470,9 @@ function gitTool(runner) {
 			],
 			"commit",
 			"--message",
-			message
+			message,
+			"--",
+			...paths
 		], { cwd: dir });
 	}
 	async function addRemote(dir, name, url) {
@@ -5585,6 +5518,42 @@ function gitTool(runner) {
 		if (result.exitCode !== 0) return null;
 		return result.stdout.trim();
 	}
+	async function isBareRepo(path) {
+		const args = [
+			`--git-dir=${path}`,
+			"rev-parse",
+			"--is-bare-repository"
+		];
+		const result = await runner.run(GIT, args);
+		return result.exitCode === 0 && result.stdout.trim() === "true";
+	}
+	async function bareBranchCommits(path, branch) {
+		const gitDir = `--git-dir=${path}`;
+		const ref = `refs/heads/${branch}`;
+		const verifyArgs = [
+			gitDir,
+			"rev-parse",
+			"--verify",
+			"--quiet",
+			`${ref}^{commit}`
+		];
+		const verified = await runner.run(GIT, verifyArgs);
+		if (verified.exitCode === MISSING_REF_EXIT_CODE) return null;
+		if (verified.exitCode !== 0) throw toolFailure(GIT, verifyArgs, verified);
+		return outputLines((await git([
+			gitDir,
+			"-c",
+			"log.showSignature=false",
+			"log",
+			`--format=${COMMIT_FORMAT}`,
+			ref,
+			"--"
+		])).stdout).map(parseCommitLine);
+	}
+	async function reachableCommits(dir) {
+		const result = await git(["rev-list", "--all"], { cwd: dir });
+		return new Set(outputLines(result.stdout));
+	}
 	async function hasMetabaseContent(dir) {
 		for (const name of METABASE_CONTENT_DIRS) if (await directoryExists(join(dir, name))) return true;
 		return false;
@@ -5595,24 +5564,27 @@ function gitTool(runner) {
 		initBare,
 		init,
 		hasCommits,
-		commitAll,
+		commitPaths,
 		addRemote,
 		clone,
 		push,
 		currentBranch,
 		remoteUrl,
+		isBareRepo,
+		bareBranchCommits,
+		reachableCommits,
 		hasMetabaseContent
 	};
 }
 //#endregion
 //#region src/steps/git-sync.ts
-const STEP_ID$8 = "git-sync";
+const STEP_ID$6 = "git-sync";
 const GIT_SYNC_KEYS = {
-	location: `${STEP_ID$8}.location`,
-	path: `${STEP_ID$8}.path`,
-	remote: `${STEP_ID$8}.remote`,
-	url: `${STEP_ID$8}.url`,
-	token: `${STEP_ID$8}.token`
+	location: `${STEP_ID$6}.location`,
+	path: `${STEP_ID$6}.path`,
+	remote: `${STEP_ID$6}.remote`,
+	url: `${STEP_ID$6}.url`,
+	token: `${STEP_ID$6}.token`
 };
 const BARE_REPO_NAME = "content.git";
 const DEFAULT_BRANCH = "main";
@@ -5646,7 +5618,7 @@ const SYNC_MODE_SETTINGS = {
 	"remote-sync-type": "read-write",
 	"remote-sync-transforms": true
 };
-function hostDeps$12(ctx) {
+function hostDeps$11(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
@@ -5898,7 +5870,7 @@ async function prepareWorkdir(run, workdir) {
 	if (!await run.git.hasCommits(workdir)) {
 		await promises.writeFile(join(workdir, README_NAME), README_CONTENT);
 		await ignoreDataAppFiles(workdir);
-		await run.git.commitAll(workdir, INITIAL_COMMIT_MESSAGE);
+		await run.git.commitPaths(workdir, [README_NAME, GITIGNORE_NAME], INITIAL_COMMIT_MESSAGE);
 	}
 	return {
 		workdir,
@@ -6019,7 +5991,7 @@ async function applySettings(run, configured) {
 async function remoteHasContent(run, gitRemote) {
 	switch (gitRemote.kind) {
 		case "local-bare": return run.git.hasMetabaseContent(gitRemote.workdir);
-		case "hosted": return (await mbTool(run.deps.runner).gitSyncHasRemoteChanges(run.ctx.state.mbProfile)).has_changes;
+		case "hosted": return (await mbTool(run.deps.runner).gitSyncHasRemoteChanges(run.instance)).has_changes;
 	}
 }
 function reportImport(run, outcome) {
@@ -6041,7 +6013,7 @@ async function importExistingContent(run, gitRemote) {
 	const spinner = run.ctx.ui.spinner("Importing the repository's content into Metabase…");
 	let outcome;
 	try {
-		outcome = await mbTool(run.deps.runner).gitSyncImport(run.ctx.state.mbProfile, { branch: gitRemote.branch });
+		outcome = await mbTool(run.deps.runner).gitSyncImport(run.instance, { branch: gitRemote.branch });
 	} catch (error) {
 		spinner.fail("Import failed");
 		throw error;
@@ -6062,7 +6034,7 @@ function shellWord(value) {
 function exportCommand(profile, branch) {
 	return `${mbCommand(profile)} git-sync export -b ${shellWord(branch)}`;
 }
-function usageLines$1(state, gitRemote) {
+function usageLines(state, gitRemote) {
 	const profile = state.mbProfile;
 	return [
 		`cd ${gitRemote.workdir}`,
@@ -6085,15 +6057,17 @@ function isMbUnavailable(error) {
 }
 async function runGitSync(ctx, deps) {
 	const configured = requireConfiguredRuntime(ctx.state);
-	if (ctx.secrets.apiKey === null) throw new ConfigError("no API key yet; the api-key step comes first");
+	const instance = mbInstanceOf(ctx.state, ctx.secrets);
+	if (instance === null) throw new ConfigError("no API key yet; the api-key step comes first");
 	const run = {
 		ctx,
 		deps,
 		git: gitTool(deps.runner),
-		client: deps.client(configured.url, {
+		client: deps.client(instance.url, {
 			kind: "api-key",
-			key: ctx.secrets.apiKey
-		})
+			key: instance.apiKey
+		}),
+		instance
 	};
 	const flow = await runFlow({
 		remote: remoteScreen(run),
@@ -6111,20 +6085,22 @@ async function runGitSync(ctx, deps) {
 		...ctx.state,
 		gitRemote: remote.gitRemote
 	});
-	ctx.ui.note(usageLines$1(ctx.state, remote.gitRemote).join("\n"), "Working with the repository");
+	ctx.ui.note(usageLines(ctx.state, remote.gitRemote).join("\n"), "Working with the repository");
 	return "completed";
 }
-function gitSyncStep(deps = hostDeps$12) {
+function gitSyncStep(deps = hostDeps$11) {
 	return {
-		id: STEP_ID$8,
+		id: STEP_ID$6,
 		title: "Connect a git repository",
 		redoHint: "`rde init --only git-sync` with it points Metabase's remote sync at that repository instead.",
 		async detect(ctx) {
 			if (!hasRemoteSync(ctx.state.license)) return "not-applicable";
-			if (ctx.state.steps[STEP_ID$8]?.status === "skipped") return "not-applicable";
-			if (ctx.state.gitRemote === null || ctx.state.steps[STEP_ID$8]?.status !== "done") return "todo";
+			if (ctx.state.steps[STEP_ID$6]?.status === "skipped") return "not-applicable";
+			if (ctx.state.gitRemote === null || ctx.state.steps[STEP_ID$6]?.status !== "done") return "todo";
+			const instance = mbInstanceOf(ctx.state, ctx.secrets);
+			if (instance === null) return "todo";
 			try {
-				return (await mbTool(deps(ctx).runner).gitSyncStatus(ctx.state.mbProfile)).branch === null ? "todo" : "done";
+				return (await mbTool(deps(ctx).runner).gitSyncStatus(instance)).branch === null ? "todo" : "done";
 			} catch (error) {
 				if (isMbUnavailable(error)) return "todo";
 				throw error;
@@ -6302,12 +6278,12 @@ function skillsCli(runner) {
 }
 //#endregion
 //#region src/steps/agents-skills.ts
-const STEP_ID$7 = "agents-skills";
-const AGENTS_SKILLS_KEYS = { agents: `${STEP_ID$7}.agents` };
+const STEP_ID$5 = "agents-skills";
+const AGENTS_SKILLS_KEYS = { agents: `${STEP_ID$5}.agents` };
 const MECHANICS_NOTE = "The rde skill's mechanics come from `mb skills get <name>` at runtime, so nothing else needs installing.";
 const REQUIRED_SKILL_NAMES = [...DATA_APP_SKILL_NAMES, ...RDE_SOURCE_SKILL_NAMES];
 const DETECT_AGENTS = { kind: "detected" };
-function hostDeps$11(ctx) {
+function hostDeps$10(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
 		probe: hostAgentProbe(),
@@ -6486,11 +6462,11 @@ function skipLine(all, source) {
 	switch (source) {
 		case "override":
 		case "chosen":
-		case "installed": return `Skipping the skills; run \`rde init --only ${STEP_ID$7}\` to install it later`;
-		case "detected": return `No coding agent found (${displayNames(all)}); run \`rde init --only ${STEP_ID$7} --agents <name>\` once one is installed`;
+		case "installed": return `Skipping the skills; run \`rde init --only ${STEP_ID$5}\` to install it later`;
+		case "detected": return `No coding agent found (${displayNames(all)}); run \`rde init --only ${STEP_ID$5} --agents <name>\` once one is installed`;
 	}
 }
-function agentsSkillsStep(options, updates, deps = hostDeps$11) {
+function agentsSkillsStep(options, updates, deps = hostDeps$10) {
 	let hashes = null;
 	async function setCheck(resolved) {
 		hashes ??= hashLookup(resolved.github);
@@ -6501,13 +6477,13 @@ function agentsSkillsStep(options, updates, deps = hostDeps$11) {
 		};
 	}
 	return {
-		id: STEP_ID$7,
+		id: STEP_ID$5,
 		title: "Install the rde and data-app skills for your coding agents",
 		redoHint: "`rde init --only agents-skills` with it installs the skills for those agents.",
 		async detect(ctx) {
 			const resolved = deps(ctx);
 			const detected = detectedOnly(await detectAgents(resolved.probe));
-			if (detected.length === 0) return ctx.state.steps[STEP_ID$7]?.status === "skipped" ? "not-applicable" : "todo";
+			if (detected.length === 0) return ctx.state.steps[STEP_ID$5]?.status === "skipped" ? "not-applicable" : "todo";
 			if (missingSkills(await skillsCli(resolved.runner).list(), detected).length > 0) return "todo";
 			const check = await setCheck(resolved);
 			for (const set of skillSets(resolved)) if (await setBehind(set, check)) return "outdated";
@@ -6555,8 +6531,10 @@ function agentsSkillsStep(options, updates, deps = hostDeps$11) {
 }
 //#endregion
 //#region src/steps/databases.ts
-const STEP_ID$6 = "databases";
-const SAMPLE_STANDS_IN = { request: "sample-stands-in" };
+const DATABASE_REQUIRED = { request: "required" };
+const WRITE_ACCESS = "Transforms write their tables to it, so connect it as a user that can create tables.";
+const NONE_CONNECTED = `rde init needs a database of your own to go on. ${WRITE_ACCESS}`;
+const NONE_NAMED = `rde init needs a database of your own and asks for one only at a terminal without --yes: pass --database <connection string>, or list it under "databases" in the --answers file. ${WRITE_ACCESS}`;
 function hostDatabasesDeps(signal) {
 	return {
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, signal),
@@ -6564,10 +6542,7 @@ function hostDatabasesDeps(signal) {
 		now: () => /* @__PURE__ */ new Date()
 	};
 }
-function isNotServingYet$2(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
-}
-function requireApiKey$2(state, apiKey) {
+function requireApiKey$1(state, apiKey) {
 	if (apiKey === null) throw new ConfigError(`instance ${state.name} has no API key yet; run \`rde init\``);
 	return apiKey;
 }
@@ -6577,7 +6552,7 @@ function hostAliasOf(runtime) {
 		case "jar": return null;
 	}
 }
-function toRecord$1(database, createdAt) {
+function toRecord(database, createdAt) {
 	return {
 		id: database.id,
 		name: database.name,
@@ -6589,7 +6564,7 @@ function authenticatedClient(state, apiKey, deps) {
 	const configured = requireConfiguredRuntime(state);
 	return deps.client(configured.url, {
 		kind: "api-key",
-		key: requireApiKey$2(state, apiKey)
+		key: requireApiKey$1(state, apiKey)
 	});
 }
 async function listDatabases(state, apiKey, deps) {
@@ -6632,7 +6607,7 @@ async function connectDatabases(ctx, deps, opening) {
 		existingCount: existing.length,
 		readTextFile: deps.readTextFile,
 		onCreated: async (database) => {
-			const record = toRecord$1(database, deps.now().toISOString());
+			const record = toRecord(database, deps.now().toISOString());
 			await ctx.saveState({
 				...ctx.state,
 				databases: [...ctx.state.databases, record]
@@ -6649,6 +6624,7 @@ async function connectDatabases(ctx, deps, opening) {
 async function addDatabases(ctx, deps, options) {
 	const connected = await connectDatabases(ctx, deps, {
 		start: "engine",
+		required: false,
 		...options
 	});
 	return {
@@ -6656,50 +6632,33 @@ async function addDatabases(ctx, deps, options) {
 		result: { addedDatabases: connected.added }
 	};
 }
-async function askForOwnDatabase(ctx, deps) {
-	const connected = await connectDatabases(ctx, deps, {
-		start: "connection-string",
-		offerStubs: true
-	});
+async function connectRequired(ctx, deps, opening) {
+	const connected = await connectDatabases(ctx, deps, opening);
+	if (connected.existing + connected.created === 0) throw new ConfigError(NONE_CONNECTED);
 	return {
-		outcome: connected.created > 0 ? "completed" : "skipped",
+		outcome: "completed",
 		result: { addedDatabases: connected.added }
 	};
 }
-function hostDeps$10(ctx) {
+function hostDeps$9(ctx) {
 	return {
 		...hostDatabasesDeps(ctx.signal),
 		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal))
 	};
 }
-function sampleDatabaseId(state) {
-	return state.sampleDatabase === null ? null : state.sampleDatabase.databaseId;
-}
-function skippedBefore(state) {
-	return state.steps[STEP_ID$6]?.status === "skipped";
-}
-function ownDatabaseIds(state) {
-	const sampleId = sampleDatabaseId(state);
-	return new Set(state.databases.filter((record) => record.id !== sampleId).map((record) => record.id));
-}
-function databasesStep(options, deps = hostDeps$10) {
+function databasesStep(options, deps = hostDeps$9) {
 	return {
-		id: STEP_ID$6,
+		id: "databases",
 		title: "Connect your databases",
 		redoHint: "Connect another with `rde db add --url <connection string>`.",
 		async detect(ctx) {
 			const configured = configuredRuntime(ctx.state);
 			if (configured === null || ctx.secrets.apiKey === null) return "todo";
-			const own = ownDatabaseIds(ctx.state);
-			const sampleId = sampleDatabaseId(ctx.state);
-			const asking = options.request === "ask-once" && !skippedBefore(ctx.state);
-			if (own.size === 0 && !asking) {
-				if (options.request === "named") return "todo";
-				return sampleId !== null || skippedBefore(ctx.state) ? "done" : "todo";
-			}
+			const recorded = new Set(ctx.state.databases.map((record) => record.id));
+			if (recorded.size === 0 && options.request === "named") return "todo";
 			const resolved = deps(ctx);
 			if (!await resolved.instanceRunning()) return "todo";
-			const isOwn = (id) => own.size > 0 ? own.has(id) : id !== sampleId;
+			const isOwn = (id) => recorded.size === 0 || recorded.has(id);
 			const client = resolved.client(configured.url, {
 				kind: "api-key",
 				key: ctx.secrets.apiKey
@@ -6707,15 +6666,25 @@ function databasesStep(options, deps = hostDeps$10) {
 			try {
 				return (await client.database.list()).data.some((database) => isOwn(database.id)) ? "done" : "todo";
 			} catch (error) {
-				if (isNotServingYet$2(error) || isRejectedCredential(error)) return "todo";
+				if (isMetabaseNotServing(error) || isRejectedCredential(error)) return "todo";
 				throw error;
 			}
 		},
 		async run(ctx) {
 			switch (options.request) {
-				case "ask-once": return askForOwnDatabase(ctx, deps(ctx));
-				case "named": return addDatabases(ctx, deps(ctx), { offerStubs: false });
-				case "sample-stands-in": return { outcome: "skipped" };
+				case "ask":
+					ctx.ui.info(NONE_CONNECTED);
+					return connectRequired(ctx, deps(ctx), {
+						start: "connection-string",
+						offerStubs: true,
+						required: true
+					});
+				case "named": return connectRequired(ctx, deps(ctx), {
+					start: "engine",
+					offerStubs: false,
+					required: true
+				});
+				case "required": throw new ConfigError(NONE_NAMED);
 			}
 		}
 	};
@@ -6740,7 +6709,7 @@ function npmRegistry(signal, options = {}) {
 }
 //#endregion
 //#region src/steps/install-mb.ts
-const STEP_ID$5 = "install-mb";
+const STEP_ID$4 = "install-mb";
 const MIN_MB_VERSION = "0.3.0";
 const MB_RANGE = `>=${MIN_MB_VERSION}`;
 function installedWith(scriptPath) {
@@ -6749,7 +6718,7 @@ function installedWith(scriptPath) {
 function rdeInstalledWith() {
 	return installedWith(process.argv[1]);
 }
-function hostDeps$9(ctx) {
+function hostDeps$8(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
 		installedWith: rdeInstalledWith(),
@@ -6886,6 +6855,7 @@ async function stillWrong(install, after, deps) {
 	const fail = (stderrTail) => new ExternalToolError({
 		tool: install.command,
 		argv: install.args,
+		envNames: [],
 		exitCode: 0,
 		stderrTail
 	});
@@ -6915,7 +6885,7 @@ async function updateFor(release, installed, deps) {
 		version
 	};
 }
-function installMbStep(updates, deps = hostDeps$9) {
+function installMbStep(updates, deps = hostDeps$8) {
 	let published = null;
 	function release(resolved) {
 		if (updates === "installed") return Promise.resolve(UNCHECKED);
@@ -6923,7 +6893,7 @@ function installMbStep(updates, deps = hostDeps$9) {
 		return published;
 	}
 	return {
-		id: STEP_ID$5,
+		id: STEP_ID$4,
 		title: "Install the Metabase CLI",
 		async detect(ctx) {
 			const resolved = deps(ctx);
@@ -6965,26 +6935,47 @@ function installMbStep(updates, deps = hostDeps$9) {
 }
 //#endregion
 //#region src/steps/license.ts
-const STEP_ID$4 = "license";
-const LICENSE_KEYS = { token: `${STEP_ID$4}.token` };
+const STEP_ID$3 = "license";
+const LICENSE_KEYS = { token: `${STEP_ID$3}.token` };
 const TOKEN_PATTERN = /^[0-9a-f]{64}$/i;
-const NOT_FOUND_STATUS$2 = 404;
-function hostDeps$8(ctx) {
+const NOT_FOUND_STATUS$1 = 404;
+const TOKEN_REFUSED_STATUS = 400;
+const STORE_UNREACHABLE_STATUS = 503;
+const TOKEN_CHECK_HOST = "token-check.metabase.com";
+const ACTIVATION_FAILED = "License activation failed";
+const LICENSED_FEATURES = {
+	[REMOTE_SYNC_FEATURE]: "remote sync",
+	"data-apps": "data apps",
+	"transforms-testing": "transform tests"
+};
+const LICENSED_FEATURE_NAMES = Object.values(LICENSED_FEATURES);
+function licensedFeatureCoverage(features) {
+	const entries = Object.entries(LICENSED_FEATURES);
+	return {
+		included: entries.filter(([key]) => features.includes(key)).map(([, name]) => name),
+		missing: entries.filter(([key]) => !features.includes(key)).map(([, name]) => name)
+	};
+}
+function listOf(names, type) {
+	return new Intl.ListFormat("en", { type }).format(names);
+}
+function hostDeps$7(ctx) {
 	return {
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
 		runner: processRunner(ctx.signal),
-		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal))
+		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal)),
+		terminal: stdinIsTty()
 	};
 }
 function isNoTokenYet(error) {
-	if (error instanceof MetabaseApiError) return error.status === NOT_FOUND_STATUS$2;
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
+	if (error instanceof MetabaseApiError) return error.status === NOT_FOUND_STATUS$1;
+	return isMetabaseNotServing(error);
 }
 function validateToken(value) {
 	if (value.length === 0 || TOKEN_PATTERN.test(value)) return;
 	return "A license token is 64 hexadecimal characters";
 }
-function requireApiKey$1(ctx) {
+function requireApiKey(ctx) {
 	if (ctx.secrets.apiKey === null) throw new ConfigError("no API key yet; the api-key step comes first");
 	return ctx.secrets.apiKey;
 }
@@ -6992,13 +6983,74 @@ function activeLabel(status) {
 	const plan = status["plan-alias"];
 	return plan === void 0 ? "License active" : `License active (plan ${plan})`;
 }
-function licenseStep(deps = hostDeps$8) {
+function refusalOf(error) {
+	if (!(error instanceof MetabaseApiError)) return null;
+	if (error.status === TOKEN_REFUSED_STATUS) return new ConfigError(`The license token was refused: ${error.reason}`);
+	if (error.status === STORE_UNREACHABLE_STATUS) return new ConfigError(`The instance could not reach ${TOKEN_CHECK_HOST} to check the license token; it needs outbound network access`);
+	return null;
+}
+async function activate(client, token) {
+	try {
+		await client.setting.setPremiumEmbeddingToken(token);
+	} catch (error) {
+		const refusal = refusalOf(error);
+		if (refusal === null) throw error;
+		return {
+			kind: "refused",
+			error: refusal
+		};
+	}
+	const status = await client.tokenStatus.get();
+	if (!status.valid) return {
+		kind: "refused",
+		error: new ConfigError(`Metabase reports the token as ${status.status}`)
+	};
 	return {
-		id: STEP_ID$4,
+		kind: "activated",
+		status
+	};
+}
+async function activateAskedToken(ctx, client, terminal) {
+	const token = await ctx.prompts.password({
+		key: LICENSE_KEYS.token,
+		message: "Paste your Metabase license token (Enter to skip)",
+		validate: validateToken
+	});
+	if (token.length === 0) return null;
+	const spinner = ctx.ui.spinner("Activating the license…");
+	let activation;
+	try {
+		activation = await activate(client, token);
+	} catch (error) {
+		spinner.fail(ACTIVATION_FAILED);
+		throw error;
+	}
+	if (activation.kind === "activated") {
+		spinner.stop(activeLabel(activation.status));
+		ctx.session.licenseToken.set(token);
+		return activation.status;
+	}
+	spinner.fail(ACTIVATION_FAILED);
+	if (!terminal) throw activation.error;
+	ctx.ui.warn(activation.error.message);
+	return activateAskedToken(ctx, client, terminal);
+}
+function reportFeatures(ctx, features) {
+	const { missing } = licensedFeatureCoverage(features);
+	const remoteSync = features.includes(REMOTE_SYNC_FEATURE);
+	if (remoteSync) ctx.ui.info("Remote sync is included; the git step will set it up");
+	if (missing.length > 0) {
+		const gitNote = remoteSync ? "" : "; the git step will be skipped";
+		ctx.ui.warn(`This license does not include ${listOf(missing, "disjunction")}${gitNote}`);
+	}
+}
+function licenseStep(deps = hostDeps$7) {
+	return {
+		id: STEP_ID$3,
 		title: "Activate your license",
 		redoHint: "`rde init --from license` with it activates the license and runs the steps after it again.",
 		async detect(ctx) {
-			if (ctx.state.steps[STEP_ID$4]?.status === "skipped") return "not-applicable";
+			if (ctx.state.steps[STEP_ID$3]?.status === "skipped") return "not-applicable";
 			const configured = configuredRuntime(ctx.state);
 			if (configured === null || ctx.secrets.apiKey === null) return "todo";
 			const resolved = deps(ctx);
@@ -7016,36 +7068,17 @@ function licenseStep(deps = hostDeps$8) {
 		},
 		async run(ctx) {
 			const configured = requireConfiguredRuntime(ctx.state);
-			const apiKey = requireApiKey$1(ctx);
-			const token = await ctx.prompts.password({
-				key: LICENSE_KEYS.token,
-				message: "Paste your Metabase license token (Enter to skip)",
-				validate: validateToken
-			});
-			if (token.length === 0) {
-				ctx.ui.info("Skipping the license; remote sync needs one. Run `rde init --from license` to add it later");
-				return { outcome: "skipped" };
-			}
-			ctx.session.licenseToken.set(token);
+			const apiKey = requireApiKey(ctx);
 			const resolved = deps(ctx);
-			const client = resolved.client(configured.url, {
+			const status = await activateAskedToken(ctx, resolved.client(configured.url, {
 				kind: "api-key",
 				key: apiKey
-			});
-			const spinner = ctx.ui.spinner("Activating the license…");
-			let status;
-			try {
-				await client.setting.setPremiumEmbeddingToken(token);
-				status = await client.tokenStatus.get();
-			} catch (error) {
-				spinner.fail("License activation failed");
-				throw error;
-			}
-			if (!status.valid) {
-				spinner.fail("License activation failed");
-				throw new ConfigError(`Metabase reports the token as ${status.status}`);
+			}), resolved.terminal);
+			if (status === null) {
+				const lost = listOf(LICENSED_FEATURE_NAMES, "conjunction");
+				ctx.ui.info(`Skipping the license; ${lost} need one. Run \`rde init --from license\` to add it later`);
+				return { outcome: "skipped" };
 			}
-			spinner.stop(activeLabel(status));
 			await ctx.saveState({
 				...ctx.state,
 				license: {
@@ -7054,13 +7087,13 @@ function licenseStep(deps = hostDeps$8) {
 					validThru: status["valid-thru"] ?? null
 				}
 			});
-			await mbTool(resolved.runner).authLogin({
+			const mb = mbTool(resolved.runner);
+			if (isApiKeyLoginAt(await mb.authStatus(ctx.state.mbProfile), configured.url)) await mb.authLogin({
 				url: configured.url,
 				profile: ctx.state.mbProfile,
 				apiKey
 			});
-			if (status.features.includes("remote-sync")) ctx.ui.info("Remote sync is included; the git step will set it up");
-			else ctx.ui.warn("This license does not include remote sync; the git step will be skipped");
+			reportFeatures(ctx, status.features);
 			return { outcome: "completed" };
 		}
 	};
@@ -7073,7 +7106,7 @@ const NODE_HINT = `Install Node ${MIN_NODE_VERSION} or newer from https://nodejs
 const MARK_OK = "✓";
 const MARK_MISSING = "✗";
 const MARK_OPTIONAL = "–";
-const DOCKER_OPTIONAL_NOTE = `Metabase can run as a jar with Java instead, without the sample database`;
+const DOCKER_OPTIONAL_NOTE = `Metabase can run as a jar with Java instead`;
 const JAVA_OPTIONAL_NOTE = `Metabase can run in Docker instead`;
 const PLATFORMS = {
 	darwin: {
@@ -7089,7 +7122,7 @@ const PLATFORMS = {
 		javaHint: `Install Java 21 or newer with your distribution's package manager (openjdk-21-jre) or from https://adoptium.net`
 	}
 };
-function hostDeps$7(ctx) {
+function hostDeps$6(ctx) {
 	const runner = processRunner(ctx.signal);
 	return {
 		platform: process.platform,
@@ -7211,7 +7244,7 @@ function checkLine(check) {
 function checkLines(checks) {
 	return checks.map(checkLine);
 }
-function preflightStep(deps = hostDeps$7) {
+function preflightStep(deps = hostDeps$6) {
 	return {
 		id: "preflight",
 		title: "Check this machine",
@@ -7230,7 +7263,7 @@ function preflightStep(deps = hostDeps$7) {
 }
 //#endregion
 //#region src/steps/runtime.ts
-const STEP_ID$3 = "runtime";
+const STEP_ID$2 = "runtime";
 const MIN_PORT = 1;
 const MAX_PORT = 65535;
 const PORT_PATTERN = /^\d+$/;
@@ -7244,7 +7277,7 @@ const NO_RUNTIME_FLAGS = {
 	jar: null,
 	port: null
 };
-function hostDeps$6(ctx) {
+function hostDeps$5(ctx) {
 	return {
 		runtime: hostRuntimeDeps(ctx.state.name, ctx.signal),
 		releases: releaseLookup(ctx.signal)
@@ -7373,9 +7406,9 @@ async function persistedRuntime(ctx, options, deps) {
 	});
 	return chosen;
 }
-function runtimeStep(options, deps = hostDeps$6) {
+function runtimeStep(options, deps = hostDeps$5) {
 	return {
-		id: STEP_ID$3,
+		id: STEP_ID$2,
 		title: "Install Metabase",
 		redoHint: "Move it with `rde start --port`, or change its Metabase with `rde upgrade --to`.",
 		async detect(ctx) {
@@ -7399,207 +7432,6 @@ function runtimeStep(options, deps = hostDeps$6) {
 		}
 	};
 }
-//#endregion
-//#region src/steps/sample-database.ts
-const STEP_ID$2 = "sample-database";
-const SAMPLE_DATABASE_DISPLAY_NAME = "Sample Database";
-const POSTGRES_ENGINE = "postgres";
-const NOT_FOUND_STATUS$1 = 404;
-function hostDeps$5(ctx) {
-	return {
-		runtime: hostRuntimeDeps(ctx.state.name, ctx.signal),
-		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
-		readyTimeoutMs: SAMPLE_DATABASE_READY_TIMEOUT_MS,
-		now: () => /* @__PURE__ */ new Date()
-	};
-}
-function isNotServingYet$1(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
-}
-function isNotFound$2(error) {
-	return error instanceof MetabaseApiError && error.status === NOT_FOUND_STATUS$1;
-}
-function requireApiKey(ctx) {
-	if (ctx.secrets.apiKey === null) throw new ConfigError(`instance ${ctx.state.name} has no API key yet; run \`rde init\``);
-	return ctx.secrets.apiKey;
-}
-async function recordedDatabase(record, client) {
-	if (record.databaseId === null) return null;
-	try {
-		return await client.database.get(record.databaseId);
-	} catch (error) {
-		if (isNotFound$2(error)) return null;
-		throw error;
-	}
-}
-async function persistedRecord(ctx, deps) {
-	const existing = ctx.state.sampleDatabase;
-	if (existing !== null) {
-		if ((await sampleDatabaseContainer(existing, deps.runtime.docker, deps.runtime.rdeHome).status()).installed || await deps.runtime.ports.isFree(existing.port)) return {
-			record: existing,
-			staleDatabaseId: null
-		};
-		const pointer = existing.databaseId === null ? "" : `; Metabase database ${existing.databaseId} still points at the old one`;
-		ctx.ui.warn(`Port ${existing.port} is in use by another program; the sample database moves to a new port${pointer}`);
-	}
-	const claims = await portClaims(ctx.state, deps.runtime);
-	const port = await deps.runtime.ports.findFree(SAMPLE_DATABASE_PORT, claims);
-	if (port !== 25432) ctx.ui.warn(`Port ${SAMPLE_DATABASE_PORT} is in use or claimed; using ${port} for the sample database`);
-	const record = {
-		containerName: sampleContainerName(ctx.state.name, deps.runtime.rdeHome),
-		image: SAMPLE_DATABASE_IMAGE,
-		port,
-		databaseId: null
-	};
-	await ctx.saveState({
-		...ctx.state,
-		sampleDatabase: record
-	});
-	return {
-		record,
-		staleDatabaseId: existing?.databaseId ?? null
-	};
-}
-const LINUX = "linux";
-async function gatewayAddress(ctx, deps) {
-	if (!(ctx.state.runtime?.kind === "docker") || deps.runtime.platform !== LINUX) return null;
-	return deps.runtime.docker.bridgeGateway();
-}
-async function recordSampleDatabaseMove(ctx, from, to) {
-	ctx.ui.warn(`Port ${from.port} is taken; the sample database moved to ${to.port}`);
-	const record = {
-		...to,
-		databaseId: null
-	};
-	await ctx.saveState({
-		...ctx.state,
-		sampleDatabase: record,
-		databases: ctx.state.databases.filter((entry) => entry.id !== from.databaseId)
-	});
-	return record;
-}
-async function installAndStart(ctx, sidecar, installed, deps) {
-	const installing = ctx.ui.spinner(`Installing the sample database from ${installed.image}`);
-	try {
-		await sidecar.install({
-			onProgress: (line) => installing.update(line),
-			alsoOn: await gatewayAddress(ctx, deps)
-		});
-	} catch (error) {
-		installing.fail("Sample database install failed");
-		throw error;
-	}
-	installing.stop(`Sample database container ${installed.containerName} on port ${installed.port}`);
-	const started = await startOnFreePort(installed, deps.runtime.docker, deps.runtime.rdeHome);
-	const record = started.state.port === installed.port ? installed : await recordSampleDatabaseMove(ctx, installed, started.state);
-	const waiting = ctx.ui.spinner("Waiting for Postgres to accept connections…");
-	try {
-		await sidecar.waitReady({
-			timeoutMs: deps.readyTimeoutMs,
-			signal: ctx.signal
-		});
-	} catch (error) {
-		waiting.fail("Postgres did not become ready");
-		throw error;
-	}
-	waiting.stop(`Postgres is ready on ${LOOPBACK_HOST}:${record.port}`);
-	return record;
-}
-function connectionDetails(record, configured, deps) {
-	const alias = runtimeFromState(configured.runtime, deps.runtime).hostAlias();
-	return applyHostAlias({
-		host: "localhost",
-		port: record.port,
-		dbname: SAMPLE_DATABASE_NAME,
-		user: SAMPLE_DATABASE_USER,
-		password: SAMPLE_DATABASE_PASSWORD
-	}, alias).details;
-}
-function toRecord(database, createdAt) {
-	return {
-		id: database.id,
-		name: database.name,
-		engine: database.engine,
-		createdAt
-	};
-}
-async function connectDatabase(ctx, choice, configured, client, deps) {
-	const { record } = choice;
-	const known = await recordedDatabase(record, client);
-	if (known !== null) {
-		ctx.ui.info(`${known.name} is already connected as database ${known.id}`);
-		return known;
-	}
-	const spinner = ctx.ui.spinner(`Connecting ${SAMPLE_DATABASE_DISPLAY_NAME}…`);
-	let database;
-	try {
-		database = await client.database.create({
-			name: SAMPLE_DATABASE_DISPLAY_NAME,
-			engine: POSTGRES_ENGINE,
-			details: connectionDetails(record, configured, deps)
-		});
-	} catch (error) {
-		spinner.fail(`Could not connect ${SAMPLE_DATABASE_DISPLAY_NAME}`);
-		throw error;
-	}
-	const stale = /* @__PURE__ */ new Set([record.databaseId, choice.staleDatabaseId]);
-	const others = ctx.state.databases.filter((entry) => !stale.has(entry.id));
-	await ctx.saveState({
-		...ctx.state,
-		sampleDatabase: {
-			...record,
-			databaseId: database.id
-		},
-		databases: [...others, toRecord(database, deps.now().toISOString())]
-	});
-	spinner.stop(`Connected ${database.name} as database ${database.id}`);
-	return database;
-}
-function usageLines(record) {
-	return [`psql "${sampleDatabaseUrl(record.port)}"`, "Transforms can write to this database."].join("\n");
-}
-function sampleDatabaseStep(deps = hostDeps$5) {
-	return {
-		id: STEP_ID$2,
-		title: "Connect a sample database",
-		async detect(ctx) {
-			const resolved = deps(ctx);
-			if (!(await resolved.runtime.docker.available()).available) return "not-applicable";
-			const record = ctx.state.sampleDatabase;
-			const configured = configuredRuntime(ctx.state);
-			if (record === null || configured === null || ctx.secrets.apiKey === null) return "todo";
-			if (!(await sampleDatabaseContainer(record, resolved.runtime.docker, resolved.runtime.rdeHome).status()).installed || !await isInstanceRunning(ctx.state, resolved.runtime)) return "todo";
-			const client = resolved.client(configured.url, {
-				kind: "api-key",
-				key: ctx.secrets.apiKey
-			});
-			try {
-				return await recordedDatabase(record, client) === null ? "todo" : "done";
-			} catch (error) {
-				if (isNotServingYet$1(error) || isRejectedCredential(error)) return "todo";
-				throw error;
-			}
-		},
-		async run(ctx) {
-			const resolved = deps(ctx);
-			const configured = requireConfiguredRuntime(ctx.state);
-			const apiKey = requireApiKey(ctx);
-			const docker = await resolved.runtime.docker.available();
-			if (!docker.available) throw new ConfigError(`the sample database runs in Docker, which is not available: ${docker.reason}`);
-			const persisted = await persistedRecord(ctx, resolved);
-			const record = await installAndStart(ctx, sampleDatabaseContainer(persisted.record, resolved.runtime.docker, resolved.runtime.rdeHome), persisted.record, resolved);
-			await connectDatabase(ctx, {
-				...persisted,
-				record
-			}, configured, resolved.client(configured.url, {
-				kind: "api-key",
-				key: apiKey
-			}), resolved);
-			ctx.ui.note(usageLines(record), "Sample database");
-			return { outcome: "completed" };
-		}
-	};
-}
 const DEFAULT_HEALTH_TIMING = { timeoutMs: 3e5 };
 //#endregion
 //#region src/steps/start-metabase.ts
@@ -7613,7 +7445,7 @@ function hostDeps$4(ctx) {
 	};
 }
 function isNotHealthy(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError || error instanceof MetabaseApiError;
+	return isMetabaseNotServing(error) || error instanceof MetabaseApiError;
 }
 async function runningVersion(client) {
 	return (await client.session.properties()).version.tag;
@@ -7621,21 +7453,6 @@ async function runningVersion(client) {
 function progressLabel(progress) {
 	return `Starting Metabase… ${Math.round(progress * PERCENT)}%`;
 }
-async function startSampleDatabase(ctx, deps) {
-	const record = ctx.state.sampleDatabase;
-	if (record === null) return;
-	const started = await startOnFreePort(record, deps.runtime.docker, deps.runtime.rdeHome);
-	if (started.state.port !== record.port) await recordSampleDatabaseMove(ctx, record, started.state);
-	switch (started.outcome) {
-		case "missing":
-			ctx.ui.warn(`Sample database container ${record.containerName} is missing; \`rde init\` recreates it`);
-			return;
-		case "started":
-			ctx.ui.info(`Sample database container ${record.containerName} started`);
-			return;
-		case "running": return;
-	}
-}
 async function withMoveHint(ctx, deps, taken) {
 	const claims = await portClaims(ctx.state, deps.runtime);
 	const free = await deps.runtime.ports.findFree(taken.port + 1, claims);
@@ -7672,7 +7489,6 @@ function startMetabaseStep(deps = hostDeps$4) {
 			const runtime = runtimeFromState(configured.runtime, resolved.runtime);
 			const client = resolved.client(configured.url, NO_AUTH);
 			await startRuntime(ctx, runtime, resolved);
-			await startSampleDatabase(ctx, resolved);
 			const spinner = ctx.ui.spinner("Starting Metabase…");
 			let shown = 0;
 			try {
@@ -7718,9 +7534,6 @@ function hostDeps$3(ctx) {
 		probe: hostAgentProbe()
 	};
 }
-function isNotServing$1(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
-}
 function loginLine(kind, email) {
 	switch (kind) {
 		case "generated":
@@ -7737,7 +7550,7 @@ async function databaseLines$1(state, apiKey, deps) {
 			key: apiKey
 		}).database.listWithStubs()).data;
 	} catch (error) {
-		if (isNotServing$1(error)) return ["Databases: Metabase is not running; `rde start`"];
+		if (isMetabaseNotServing(error)) return ["Databases: Metabase is not running; `rde start`"];
 		if (isRejectedCredential(error)) return ["Databases: Metabase rejects the stored API key; `rde init --only api-key`"];
 		throw error;
 	}
@@ -7786,7 +7599,6 @@ async function summaryLines(state, apiKey, deps) {
 	if (state.admin !== null) lines.push(loginLine(state.admin.kind, state.admin.email));
 	lines.push(profile === "default" ? `Metabase CLI: ${mbCommand(profile)} <command>` : `Metabase CLI: ${mbCommand(profile)} <command>  or  export MB_PROFILE=${profile}`);
 	lines.push(...await databaseLines$1(state, apiKey, deps));
-	if (state.sampleDatabase !== null) lines.push(`Sample database: psql "${sampleDatabaseUrl(state.sampleDatabase.port)}"`);
 	lines.push(...gitLines(state));
 	const installed = await skillsCli(deps.runner).list();
 	const agents = await detectAgents(deps.probe);
@@ -7819,9 +7631,6 @@ function hostDeps$2(ctx) {
 		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal))
 	};
 }
-function isNotServingYet(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
-}
 function transformsStep(deps = hostDeps$2) {
 	return {
 		id: STEP_ID,
@@ -7838,7 +7647,7 @@ function transformsStep(deps = hostDeps$2) {
 			try {
 				return await client.setting.transformsDecided() ? "done" : "todo";
 			} catch (error) {
-				if (isNotServingYet(error) || isRejectedCredential(error)) return "todo";
+				if (isMetabaseNotServing(error) || isRejectedCredential(error)) return "todo";
 				throw error;
 			}
 		},
@@ -7865,7 +7674,7 @@ const DEFAULT_STEP_OPTIONS = {
 	runtime: NO_RUNTIME_FLAGS,
 	agents: DETECT_AGENTS,
 	admin: DEFAULT_ADMIN,
-	databases: SAMPLE_STANDS_IN,
+	databases: DATABASE_REQUIRED,
 	updates: "published"
 };
 const LOCAL_STEP_OPTIONS = {
@@ -7881,7 +7690,6 @@ const STEP_BY_ID = {
 	"admin-user": (options) => adminUserStep(options.admin),
 	"api-key": () => apiKeyStep(),
 	transforms: () => transformsStep(),
-	"sample-database": () => sampleDatabaseStep(),
 	license: () => licenseStep(),
 	databases: (options) => databasesStep(options.databases),
 	"git-sync": () => gitSyncStep(),
@@ -7957,7 +7765,7 @@ const SECTIONS = {
 	}).optional(),
 	"api-key": z.strictObject({ profile: MbProfileChoice }).optional(),
 	license: z.strictObject({ token: EnvString.nullable() }).optional(),
-	databases: z.array(DatabaseEntry).optional(),
+	databases: z.array(DatabaseEntry).min(1, "a database is required: list one, or leave the section out to be asked at a terminal").optional(),
 	"git-sync": z.strictObject({
 		location: z.enum([
 			"here",
@@ -8029,8 +7837,8 @@ function runtimeKindOf(runtime) {
 	return null;
 }
 function databasesRequest(databases, run) {
-	if (databases !== void 0) return databases.length > 0 ? "named" : "sample-stands-in";
-	return run.interactive ? "ask-once" : "sample-stands-in";
+	if (databases !== void 0) return "named";
+	return run.interactive ? "ask" : "required";
 }
 function agentsOption(agents, run) {
 	if (agents !== void 0) return {
@@ -8092,7 +7900,6 @@ async function loadInitAnswers(path) {
 }
 function stepsAskingForWork(answers) {
 	const license = answers.license;
-	const databases = answers.databases;
 	const git = answers["git-sync"];
 	const agents = answers["agents-skills"];
 	return [
@@ -8114,7 +7921,7 @@ function stepsAskingForWork(answers) {
 		},
 		{
 			step: "databases",
-			asks: databases !== void 0 && databases.length > 0
+			asks: answers.databases !== void 0
 		},
 		{
 			step: "git-sync",
@@ -8151,7 +7958,6 @@ const FLAG_FOR_KEY$1 = {
 	[API_KEY_KEYS.password]: "--admin-password",
 	[API_KEY_KEYS.profile]: "--mb-profile",
 	[LICENSE_KEYS.token]: "--license-token or --skip-license",
-	[DATABASE_KEYS.skip]: "--skip-databases",
 	[GIT_SYNC_KEYS.location]: "--git-dir",
 	[GIT_SYNC_KEYS.path]: "--git-dir",
 	[GIT_SYNC_KEYS.remote]: "--git-remote or --skip-git",
@@ -8159,7 +7965,7 @@ const FLAG_FOR_KEY$1 = {
 	[GIT_SYNC_KEYS.token]: "--git-token"
 };
 const DATABASE_FLAG_FOR_NAME = {
-	engine: "--database or --skip-databases",
+	engine: "--database",
 	uri: "--database"
 };
 function howToAnswer(key) {
@@ -8250,13 +8056,6 @@ function licenseSection(flags, secrets) {
 	}
 	return secrets.has("--license-token") ? { token: secrets.get("--license-token") } : void 0;
 }
-function databasesSection(flags) {
-	if (flags.skipDatabases) {
-		if (flags.database.length > 0) throw conflict("--skip-databases", "--database");
-		return [];
-	}
-	return flags.database.length > 0 ? flags.database.map(parseDatabase) : void 0;
-}
 function gitRemoteKind(flag, url) {
 	if (flag === void 0) return url === void 0 ? void 0 : "hosted";
 	const kind = GIT_REMOTE_NAMES[flag];
@@ -8377,7 +8176,7 @@ async function answersFromFlags(flags, readStdin) {
 		runtime: runtimeSection(flags),
 		"admin-user": adminSection(flags, secrets),
 		license: licenseSection(flags, secrets),
-		databases: databasesSection(flags),
+		databases: flags.database.length > 0 ? flags.database.map(parseDatabase) : void 0,
 		"git-sync": gitSection(flags, secrets),
 		"agents-skills": agentsSection(flags),
 		"api-key": flags.mbProfile === void 0 ? void 0 : { profile: flags.mbProfile }
@@ -8802,6 +8601,7 @@ const dbAdd = defineRdeCommand({
 			description: "Engine of a --url that fits several engines; the error names them"
 		}
 	},
+	interrupted: INTERRUPTED,
 	async run(args) {
 		if (args.url === void 0 && !stdinIsTty()) throw new ConfigError(NEEDS_URL_ERROR);
 		const name = await defaultInstanceName();
@@ -8833,6 +8633,7 @@ const dbList = defineRdeCommand({
 		description: "Print the list as JSON",
 		default: false
 	} },
+	interrupted: INTERRUPTED,
 	async run(args) {
 		const name = await defaultInstanceName();
 		const state = await requireInstanceState(name);
@@ -9365,31 +9166,46 @@ async function credentialRows(state, secrets, apiKey, deps) {
 		stateFileRow(files)
 	];
 }
-function withoutTrailingSlash(url) {
-	return url.replace(/\/+$/, "");
+function brokenProfileRepair(profile, method) {
+	if (method === MbAuthMethod.enum.oauth) return {
+		hint: `\`mb auth login --profile ${profile}\` logs it in again; or \`mb auth logout --profile ${profile}\`, then \`rde init --only api-key\` hands the profile to rde's API key`,
+		step: null
+	};
+	return {
+		hint: "`rde init --only api-key` logs it in again",
+		step: API_KEY_STEP
+	};
+}
+function unprobedReason(method, healthy, access) {
+	if (access.kind === "accepted") return null;
+	if (method !== MbAuthMethod.enum.oauth) return access.reason;
+	return healthy ? null : NOT_HEALTHY_REASON;
 }
-async function mbProfileRow(state, url, profiles, mbUnusableReason, healthy) {
+async function mbProfileRow(state, url, deps, profiles, mbUnusableReason, healthy, access) {
+	const id = "mb-profile";
 	const label = "mb profile";
-	if (mbUnusableReason !== null) return skipped("mb-profile", label, mbUnusableReason);
-	if (!healthy) return skipped("mb-profile", label, NOT_HEALTHY_REASON);
-	const entry = (await profiles()).find((candidate) => candidate.profile === state.mbProfile);
-	if (entry === void 0) return failed("mb-profile", label, {
-		detail: `${state.mbProfile} is not configured`,
+	const profile = state.mbProfile;
+	if (mbUnusableReason !== null) return skipped(id, label, mbUnusableReason);
+	const status = await mbTool(deps.runner).authStatus(profile);
+	if (!status.present || status.url === null) return failed(id, label, {
+		detail: `${profile} is not configured`,
 		hint: "`rde init --only api-key`",
-		step: "api-key"
+		step: API_KEY_STEP
 	});
-	if (withoutTrailingSlash(entry.url) !== withoutTrailingSlash(url)) return failed("mb-profile", label, {
-		detail: `${state.mbProfile} points at ${entry.url}, not at this instance (${url})`,
+	if (!sameMetabaseUrl(status.url, url)) return failed(id, label, {
+		detail: `${profile} points at ${status.url}, not at this instance (${url})`,
 		hint: "`rde init --only api-key` logs it back in against the instance",
-		step: "api-key"
+		step: API_KEY_STEP
 	});
-	if (entry.status !== "ok") return failed("mb-profile", label, {
-		detail: `${state.mbProfile}: ${entry.status}`,
-		hint: "`rde init --only api-key` logs it in again",
-		step: "api-key"
+	const unprobed = unprobedReason(status.method, healthy, access);
+	if (unprobed !== null) return skipped(id, label, unprobed);
+	const how = status.method === MbAuthMethod.enum.oauth ? " (OAuth)" : "";
+	const entry = (await profiles()).find((candidate) => candidate.profile === profile);
+	if (entry === void 0 || entry.status !== "ok") return failed(id, label, {
+		detail: `${profile}${how}: ${entry === void 0 ? "not listed by `mb auth list`" : entry.status}`,
+		...brokenProfileRepair(profile, status.method)
 	});
-	const user = entry.user === null ? "" : ` as ${entry.user.name}`;
-	return ok("mb-profile", label, `${state.mbProfile}: ok${user}`);
+	return ok(id, label, `${profile}${how}: ok${entry.user === null ? "" : ` as ${entry.user.name}`}`);
 }
 function hostOf(url) {
 	return URL.canParse(url) ? new URL(url).host : "an address that is not a URL";
@@ -9410,8 +9226,8 @@ async function mbProfileEnvRow(name, rdeProfile, profiles, mbUnusableReason) {
 async function environmentRows(env, rdeProfile, profiles, mbUnusableReason) {
 	const rows = [];
 	if (env.profile !== null) rows.push(await mbProfileEnvRow(env.profile, rdeProfile, profiles, mbUnusableReason));
-	if (env.url !== null) rows.push(note$1(`env.${ENV_MB_URL}`, ENV_MB_URL, `every \`mb\` call goes to ${hostOf(env.url)}, whatever \`--profile\` says, rde's own included`, unsetHint(ENV_MB_URL)));
-	if (env.apiKeySet) rows.push(note$1(`env.${ENV_MB_API_KEY}`, ENV_MB_API_KEY, "set (value not shown): every `mb` call sends it, whatever `--profile` says, rde's own included", unsetHint(ENV_MB_API_KEY)));
+	if (env.url !== null) rows.push(note$1(`env.${ENV_MB_URL}`, ENV_MB_URL, `every \`mb\` call goes to ${hostOf(env.url)}, whatever \`--profile\` says`, unsetHint(ENV_MB_URL)));
+	if (env.apiKeySet) rows.push(note$1(`env.${ENV_MB_API_KEY}`, ENV_MB_API_KEY, "set (value not shown): every `mb` call sends it, whatever `--profile` says", unsetHint(ENV_MB_API_KEY)));
 	return rows;
 }
 const PROFILE_STATUS_WORDS = {
@@ -9441,6 +9257,11 @@ async function otherMetabasesRow(env, rdeProfile, profiles, mbUnusableReason) {
 function isNotFound$1(error) {
 	return error instanceof MetabaseApiError && error.status === NOT_FOUND_STATUS;
 }
+function coverageDetail(coverage) {
+	const valid = coverage.included.length === 0 ? "valid" : `valid, with ${listOf(coverage.included, "conjunction")}`;
+	if (coverage.missing.length === 0) return valid;
+	return `${valid}; without ${listOf(coverage.missing, "disjunction")}`;
+}
 async function licenseRow(client) {
 	const label = "license";
 	try {
@@ -9450,9 +9271,9 @@ async function licenseRow(client) {
 			hint: "`rde init --from license` with a valid token",
 			step: "license"
 		});
-		return ok("license", label, `valid, ${status.features.includes("remote-sync") ? `with ${REMOTE_SYNC_FEATURE}` : `without ${REMOTE_SYNC_FEATURE}, so git sync is unavailable`}`);
+		return ok("license", label, coverageDetail(licensedFeatureCoverage(status.features)));
 	} catch (error) {
-		if (isNotFound$1(error)) return skipped("license", label, "not activated; `rde init --from license` adds one");
+		if (isNotFound$1(error)) return skipped("license", label, `not activated, so ${listOf(LICENSED_FEATURE_NAMES, "conjunction")} are unavailable; \`rde init --from license\` adds one`);
 		throw error;
 	}
 }
@@ -9470,55 +9291,16 @@ async function databasesRow(state, client) {
 	const names = state.databases.map((record) => record.name).join(", ");
 	return ok("databases", label, `${state.databases.length} connected: ${names}`);
 }
-const SAMPLE_DATABASE_STEP = "sample-database";
-const SAMPLE_LABEL = "sample database";
-async function sampleDatabaseRow(record, deps, dockerOk, access) {
-	const id = "sample-database";
-	if (!dockerOk) return skipped(id, SAMPLE_LABEL, "Docker is not available");
-	const status = await sampleDatabaseContainer(record, deps.runtime.docker, deps.runtime.rdeHome).status();
-	if (!status.installed) return failed(id, SAMPLE_LABEL, {
-		detail: `${record.containerName} does not exist`,
-		hint: "`rde init` recreates it",
-		step: SAMPLE_DATABASE_STEP
-	});
-	if (!status.running) return failed(id, SAMPLE_LABEL, {
-		detail: `${record.containerName} is stopped`,
-		hint: "`rde start`",
-		step: "start-metabase"
-	});
-	if (await deps.runtime.ports.isFree(record.port)) return failed(id, SAMPLE_LABEL, {
-		detail: `${record.containerName} runs but port ${record.port} is not answering`,
-		hint: `\`docker logs ${record.containerName}\` shows what Postgres is doing`,
-		step: null
-	});
-	const where = `${record.containerName} running on ${LOOPBACK_HOST}:${record.port}`;
-	if (record.databaseId === null) return failed(id, SAMPLE_LABEL, {
-		detail: `${where}; not connected to Metabase yet`,
-		hint: "`rde init` connects it",
-		step: SAMPLE_DATABASE_STEP
-	});
-	if (access.kind === "unusable") return skipped(id, SAMPLE_LABEL, `${where}; ${access.reason}, so the connection is unchecked`);
-	try {
-		const database = await access.client.database.get(record.databaseId);
-		return ok(id, SAMPLE_LABEL, `${where}, database ${database.id} ${syncLabel(database.initial_sync_status)}`);
-	} catch (error) {
-		if (isNotFound$1(error)) return failed(id, SAMPLE_LABEL, {
-			detail: `${where}; database ${record.databaseId} is gone from Metabase`,
-			hint: "`rde init` connects it again",
-			step: SAMPLE_DATABASE_STEP
-		});
-		throw error;
-	}
-}
 function isMbFailure$1(error) {
 	return error instanceof ProcessNotFoundError || error instanceof ExternalToolError;
 }
-async function gitSyncRow(state, deps) {
+async function gitSyncRow(state, instance, deps) {
 	const label = "remote sync";
 	if (!hasRemoteSync(state.license)) return skipped("git-sync", label, `needs a license with ${REMOTE_SYNC_FEATURE}`);
 	if (state.gitRemote === null) return skipped("git-sync", label, "not configured; `rde init --from git-sync`");
+	if (instance === null) return skipped("git-sync", label, "no API key in the secrets file");
 	try {
-		const status = await mbTool(deps.runner).gitSyncStatus(state.mbProfile);
+		const status = await mbTool(deps.runner).gitSyncStatus(instance);
 		if (status.branch === null) return failed("git-sync", label, {
 			detail: "Metabase reports no branch",
 			hint: "`rde init --only git-sync`",
@@ -9662,7 +9444,6 @@ async function instanceRows(state, secrets, deps, dockerOk, profiles, mbUnusable
 		skipped("mb-profile", "mb profile", NO_INSTANCE_REASON),
 		skipped("license", "license", NO_INSTANCE_REASON),
 		skipped("databases", "databases", NO_INSTANCE_REASON),
-		skipped("sample-database", SAMPLE_LABEL, NO_INSTANCE_REASON),
 		skipped("git-sync", "remote sync", NO_INSTANCE_REASON)
 	];
 	const runtime = await runtimeRow(configured.runtime, deps, dockerOk);
@@ -9676,13 +9457,12 @@ async function instanceRows(state, secrets, deps, dockerOk, profiles, mbUnusable
 		properties === null ? skipped("version", "Metabase version", NOT_HEALTHY_REASON) : versionRow(state, properties),
 		properties === null ? skipped("admin", "admin user", NOT_HEALTHY_REASON) : adminRow(state, properties),
 		...await credentialRows(state, secrets, apiKey, deps),
-		await mbProfileRow(state, configured.url, profiles, mbUnusableReason, healthy)
+		await mbProfileRow(state, configured.url, deps, profiles, mbUnusableReason, healthy, apiKey.access)
 	];
 	const access = apiKey.access;
 	if (access.kind === "unusable") rows.push(skipped("license", "license", access.reason), skipped("databases", "databases", access.reason));
 	else rows.push(await licenseRow(access.client), await databasesRow(state, access.client));
-	rows.push(state.sampleDatabase === null ? skipped("sample-database", SAMPLE_LABEL, "not connected; `rde init` adds one") : await sampleDatabaseRow(state.sampleDatabase, deps, dockerOk, access));
-	rows.push(await gitSyncRow(state, deps));
+	rows.push(await gitSyncRow(state, mbInstanceOf(state, secrets), deps));
 	return rows;
 }
 async function collectDoctor(instance, state, secrets, deps) {
@@ -9691,7 +9471,7 @@ async function collectDoctor(instance, state, secrets, deps) {
 	const mb = await mbFinding(deps);
 	const profiles = sharedProfileList(deps);
 	const checks = [...machine, mb.row];
-	if (state === null) checks.push(...noRuntimeRows(), skipped("version", "Metabase version", NO_INSTANCE_REASON), skipped("admin", "admin user", NO_INSTANCE_REASON), skipped("admin-password", "admin password", NO_INSTANCE_REASON), skipped("api-key", "API key", NO_INSTANCE_REASON), skipped("secrets-file", "secrets file", NO_INSTANCE_REASON), skipped("state-file", "state file", NO_INSTANCE_REASON), skipped("mb-profile", "mb profile", NO_INSTANCE_REASON), skipped("license", "license", NO_INSTANCE_REASON), skipped("databases", "databases", NO_INSTANCE_REASON), skipped("sample-database", SAMPLE_LABEL, NO_INSTANCE_REASON), skipped("git-sync", "remote sync", NO_INSTANCE_REASON));
+	if (state === null) checks.push(...noRuntimeRows(), skipped("version", "Metabase version", NO_INSTANCE_REASON), skipped("admin", "admin user", NO_INSTANCE_REASON), skipped("admin-password", "admin password", NO_INSTANCE_REASON), skipped("api-key", "API key", NO_INSTANCE_REASON), skipped("secrets-file", "secrets file", NO_INSTANCE_REASON), skipped("state-file", "state file", NO_INSTANCE_REASON), skipped("mb-profile", "mb profile", NO_INSTANCE_REASON), skipped("license", "license", NO_INSTANCE_REASON), skipped("databases", "databases", NO_INSTANCE_REASON), skipped("git-sync", "remote sync", NO_INSTANCE_REASON));
 	else checks.push(...await instanceRows(state, secrets, deps, dockerOk, profiles, mb.unusable));
 	const rdeProfile = state === null ? null : state.mbProfile;
 	checks.push(...await environmentRows(deps.environment, rdeProfile, profiles, mb.unusable), await otherMetabasesRow(deps.environment, rdeProfile, profiles, mb.unusable), ...await skillRows(state, deps));
@@ -9798,6 +9578,7 @@ const doctor = defineRdeCommand({
 			default: false
 		}
 	},
+	interrupted: INTERRUPTED,
 	async run(args) {
 		const name = await instanceNameOrDefault();
 		const state = await readInstanceState(name);
@@ -9856,13 +9637,6 @@ function isLocation(value) {
 function isRemote(value) {
 	return value === "local-bare" || value === "hosted";
 }
-function applyDatabaseRecord(draft, record) {
-	const value = stringOf(record.answer);
-	const skippedConnection = record.key === DATABASE_KEYS.connection && value?.trim() === "";
-	const finished = parseDatabaseKey(record.key)?.name === "engine" && value === "finish";
-	const pickedNoStub = record.key === DATABASE_KEYS.stubs && record.answer.kind === "multiselect" && record.answer.values.length === 0;
-	if (skippedConnection || finished || pickedNoStub) draft.databasesFinished = true;
-}
 function applyAdminRecord(draft, key, value) {
 	if (key === ADMIN_USER_KEYS.email && value !== null) admin(draft).email = value;
 	else if (key === ADMIN_USER_KEYS.password) admin(draft).password = envReference(ENV_ADMIN_PASSWORD);
@@ -9886,8 +9660,7 @@ function agentIds(values) {
 function applyRecord(draft, record) {
 	const { key } = record;
 	const value = stringOf(record.answer);
-	if (key.startsWith("databases.")) applyDatabaseRecord(draft, record);
-	else if (key.startsWith("admin-user.")) applyAdminRecord(draft, key, value);
+	if (key.startsWith("admin-user.")) applyAdminRecord(draft, key, value);
 	else if (key.startsWith("git-sync.")) applyGitRecord(draft, key, value);
 	else if (key === AGENTS_SKILLS_KEYS.agents && record.answer.kind === "multiselect") draft.answers["agents-skills"] = { agents: agentIds(record.answer.values) };
 	else if (key === API_KEY_KEYS.profile && value !== null) {
@@ -9913,13 +9686,9 @@ function databaseEntry(added, index) {
 	};
 }
 function answersFromRecords(records, overrides, added) {
-	const draft = {
-		answers: {},
-		databasesFinished: false
-	};
+	const draft = { answers: {} };
 	for (const record of records) applyRecord(draft, record);
-	const databases = added.map(databaseEntry);
-	if (databases.length > 0 || draft.databasesFinished) draft.answers.databases = databases;
+	if (added.length > 0) draft.answers.databases = added.map(databaseEntry);
 	return {
 		...draft.answers,
 		...overrides.runtime !== void 0 && { runtime: overrides.runtime },
@@ -10045,7 +9814,7 @@ const init = defineRdeCommand({
 		},
 		runtime: {
 			type: "string",
-			description: `How a new instance runs Metabase (${RUNTIME_LIST}); Docker when it is available; the sample database always runs in Docker`
+			description: `How a new instance runs Metabase (${RUNTIME_LIST}); Docker when it is available`
 		},
 		image: {
 			type: "string",
@@ -10090,12 +9859,7 @@ const init = defineRdeCommand({
 		},
 		database: {
 			type: "string",
-			description: "Database to connect, a connection string or <engine>=<connection string> when it fits several engines; repeatable"
-		},
-		"skip-databases": {
-			type: "boolean",
-			description: "Connect none of your own databases (the sample database is still connected)",
-			default: false
+			description: "Database to connect, a connection string or <engine>=<connection string> when it fits several engines; repeatable. init needs one, and asks for it only at a terminal"
 		},
 		"git-dir": {
 			type: "string",
@@ -10133,10 +9897,11 @@ const init = defineRdeCommand({
 		},
 		yes: {
 			type: "boolean",
-			description: "Answer yes to every confirmation and take the default of every setting; skips the question about your own databases (the sample database is still connected)",
+			description: "Answer yes to every confirmation and take the default of every setting; the database init needs then comes from --database or the answers file",
 			default: false
 		}
 	},
+	interrupted: "Interrupted. Run `rde init` again to resume.",
 	async run(args, rawArgs) {
 		const options = stepSelection(args.from, args.only);
 		const runOptions = {
@@ -10153,7 +9918,6 @@ const init = defineRdeCommand({
 				licenseToken: args["license-token"],
 				skipLicense: args["skip-license"],
 				database: repeatedValues(rawArgs, "--database"),
-				skipDatabases: args["skip-databases"],
 				gitDir: args["git-dir"],
 				gitRemote: args["git-remote"],
 				gitUrl: args["git-url"],
@@ -10200,6 +9964,7 @@ const logs = defineRdeCommand({
 		description: "Keep streaming new lines",
 		default: false
 	} },
+	interrupted: null,
 	async run(args) {
 		await (await loadInstance(await defaultInstanceName(), interruptSignal)).runtime.logs({
 			follow: args.follow,
@@ -10214,6 +9979,7 @@ const open = defineRdeCommand({
 		name: "open",
 		description: "Open the Metabase instance in the browser"
 	},
+	interrupted: INTERRUPTED,
 	async run() {
 		const instance = await loadInstance(await defaultInstanceName(), interruptSignal);
 		printLines([await openInstance(instance.url) ? `Opened ${instance.url}` : `Open ${instance.url} in your browser`]);
@@ -10257,20 +10023,12 @@ async function moveToPort(ctx, port, deps) {
 	await runtimeFromState(next, deps.runtime).reconfigure();
 	ctx.ui.info(`Moved instance ${ctx.state.name} from port ${previous} to ${port}`);
 }
-async function profileStatus(runner, profile) {
-	try {
-		return await mbTool(runner).authStatus(profile);
-	} catch (error) {
-		if (error instanceof ProcessNotFoundError) return null;
-		throw error;
-	}
-}
 async function followMove(ctx, from, runner) {
 	const configured = requireConfiguredRuntime(ctx.state);
 	const apiKey = ctx.secrets.apiKey;
 	const profile = ctx.state.mbProfile;
-	const status = apiKey === null ? null : await profileStatus(runner, profile);
-	if (apiKey !== null && status !== null && status.present && status.url === from) {
+	const status = apiKey === null ? null : await mbTool(runner).authStatusIfInstalled(profile);
+	if (apiKey !== null && isLoggedInAt(status, from)) {
 		await mbTool(runner).authLogin({
 			url: configured.url,
 			profile,
@@ -10301,6 +10059,7 @@ const start = defineRdeCommand({
 		type: "string",
 		description: "Move the instance to this host port first; the mb profile follows, the data stays"
 	} },
+	interrupted: INTERRUPTED,
 	async run(args) {
 		const port = args.port === void 0 ? null : requirePortFlag(args.port);
 		const name = await defaultInstanceName();
@@ -10353,31 +10112,15 @@ function setupOf(ctx, steps) {
 		resume: `rde init --from ${pending.id}`
 	};
 }
-function isNotServing(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
-}
 async function databasesOf(ctx, deps, health) {
 	if (health !== "healthy" || ctx.secrets.apiKey === null) return null;
 	try {
 		return await listDatabases(ctx.state, ctx.secrets.apiKey, { client: deps.client });
 	} catch (error) {
-		if (isNotServing(error) || isRejectedCredential(error)) return null;
+		if (isMetabaseNotServing(error) || isRejectedCredential(error)) return null;
 		throw error;
 	}
 }
-async function sampleDatabaseOf(ctx, deps, databases) {
-	const record = ctx.state.sampleDatabase;
-	if (record === null) return null;
-	const status = await sampleDatabaseContainer(record, deps.runtime.docker, deps.runtime.rdeHome).status();
-	const listed = databases?.find((database) => database.id === record.databaseId) ?? null;
-	return {
-		container: status.running ? "running" : status.installed ? "stopped" : "missing",
-		port: record.port,
-		url: sampleDatabaseUrl(record.port),
-		databaseId: record.databaseId,
-		initialSyncStatus: listed === null ? null : listed.initialSyncStatus
-	};
-}
 function taskLabel(status) {
 	const task = status.current_task;
 	return task === null ? null : `${task.sync_task_type} ${task.status}`;
@@ -10391,10 +10134,13 @@ function isMbFailure(error) {
 }
 async function gitSyncOf(ctx, deps) {
 	if (ctx.state.gitRemote === null) return null;
+	if (configuredRuntime(ctx.state) === null) return { error: "no Metabase runtime configured; `rde init`" };
+	const instance = mbInstanceOf(ctx.state, ctx.secrets);
+	if (instance === null) return { error: "no API key in the secrets file; `rde init --only api-key`" };
 	try {
 		const mb = mbTool(deps.runner);
-		const status = await mb.gitSyncStatus(ctx.state.mbProfile);
-		const changes = await mb.gitSyncHasRemoteChanges(ctx.state.mbProfile);
+		const status = await mb.gitSyncStatus(instance);
+		const changes = await mb.gitSyncHasRemoteChanges(instance);
 		return {
 			branch: status.branch,
 			dirty: status.is_dirty,
@@ -10429,7 +10175,6 @@ async function collectStatus(ctx, deps) {
 		steps,
 		setup: setupOf(ctx, steps),
 		databases,
-		sampleDatabase: await sampleDatabaseOf(ctx, deps, databases),
 		gitSync: await gitSyncOf(ctx, deps),
 		contentRepository: ctx.state.gitRemote === null ? null : ctx.state.gitRemote.workdir
 	};
@@ -10473,22 +10218,6 @@ function syncStateLabel(profile, gitSync) {
 	if (gitSync.dirty) return `unsynced changes, ${remote}`;
 	return `${remote}; \`${mbCommand(profile)} git-sync import\``;
 }
-const CONTAINER_STATE_LABEL = {
-	running: "container running",
-	stopped: "container stopped; `rde start`",
-	missing: "container missing; `rde init` recreates it"
-};
-function sampleConnectionLabel(report, sample) {
-	if (sample.databaseId === null) return "not connected to Metabase yet; `rde init`";
-	if (report.databases === null) return "sync unknown while Metabase is not running";
-	if (sample.initialSyncStatus === null) return `database ${sample.databaseId} is gone from Metabase; \`rde init\` connects it again`;
-	return syncLabel(sample.initialSyncStatus);
-}
-function sampleDatabaseLine(report) {
-	const sample = report.sampleDatabase;
-	if (sample === null) return "Sample database: not connected; `rde init` adds one";
-	return `Sample database: ${sample.url}, ${CONTAINER_STATE_LABEL[sample.container]}, ${sampleConnectionLabel(report, sample)}`;
-}
 function databaseLines(report) {
 	if (report.databases === null) return ["Databases: unavailable while Metabase is not running"];
 	return ["Databases:", ...databaseListingLines(report.databases).map((line) => `  ${line}`)];
@@ -10505,7 +10234,6 @@ function statusLines(report) {
 		"Steps:",
 		...checklistLines(report.steps).map((line) => `  ${line}`),
 		...databaseLines(report),
-		sampleDatabaseLine(report),
 		gitSyncLine(report),
 		...report.contentRepository === null ? [] : [`Content repository: ${report.contentRepository}`]
 	];
@@ -10522,6 +10250,7 @@ const status = defineRdeCommand({
 		description: "Print the report as JSON",
 		default: false
 	} },
+	interrupted: INTERRUPTED,
 	async run(args) {
 		const name = await defaultInstanceName();
 		await requireInstanceState(name);
@@ -10538,34 +10267,34 @@ const status = defineRdeCommand({
 const stop = defineRdeCommand({
 	meta: {
 		name: "stop",
-		description: "Stop the Metabase instance and its sample database"
+		description: "Stop the Metabase instance"
 	},
+	interrupted: INTERRUPTED,
 	async run() {
-		const instance = await loadInstance(await defaultInstanceName(), interruptSignal);
+		const name = await defaultInstanceName();
+		const instance = await loadInstance(name, interruptSignal);
 		const before = await instance.runtime.status();
 		await instance.runtime.stop();
 		const lines = [before.running ? "Metabase stopped" : "Metabase is not running"];
-		if (instance.sampleDatabase !== null) {
-			const sidecar = await instance.sampleDatabase.status();
-			await instance.sampleDatabase.stop();
-			lines.push(sidecar.running ? "Sample database stopped" : "Sample database is not running");
-		}
+		const removed = await removeLeftovers(name, interruptSignal);
+		if (removed !== null) lines.push(removed);
 		printLines(lines);
 	}
 });
 //#endregion
 //#region src/steps/uninstall.ts
-const API_KEY_METHOD = "apiKey";
 function hostUninstallDeps(signal, childOutput) {
 	const runner = processRunner(signal);
 	return {
 		docker: dockerTool(runner),
 		daemon: daemonTool(runner),
+		git: gitTool(runner),
 		runner,
 		childOutput
 	};
 }
 const NOT_TOUCHED_LINE = "The mb CLI, Docker, and Java themselves";
+const UNPULLED_COMMITS_SHOWN = 10;
 const ANY_JAR = "-jar";
 function isFileSystemError(error) {
 	return error instanceof Error && "code" in error;
@@ -10714,8 +10443,8 @@ async function findJar(source, removeImage) {
 }
 function isInstanceProfile(status, urls) {
 	if (!status.present) return false;
-	if (urls !== null) return status.url !== null && urls.includes(status.url);
-	return status.method === API_KEY_METHOD && status.user?.name === "rde";
+	if (urls !== null) return urls.some((url) => isLoggedInAt(status, url));
+	return status.method === MbAuthMethod.enum.apiKey && status.user?.name === "rde";
 }
 function instanceUrls(state) {
 	if (state.url === null) return null;
@@ -10723,23 +10452,34 @@ function instanceUrls(state) {
 }
 async function findMbProfiles(candidates, urls, runner) {
 	const mb = mbTool(runner);
-	const removals = [];
+	const found = {
+		removals: [],
+		kept: []
+	};
 	for (const profile of candidates) {
 		let status;
 		try {
 			status = await mb.authStatus(profile);
 		} catch (error) {
-			if (error instanceof ProcessNotFoundError) return [];
+			if (error instanceof ProcessNotFoundError) return {
+				removals: [],
+				kept: []
+			};
 			throw error;
 		}
-		if (isInstanceProfile(status, urls)) removals.push({
+		if (!isInstanceProfile(status, urls)) continue;
+		if (status.method === MbAuthMethod.enum.oauth) {
+			found.kept.push(`mb profile ${profile}, logged in with OAuth; \`mb auth logout --profile ${profile}\` logs it out`);
+			continue;
+		}
+		found.removals.push({
 			label: `mb profile ${profile}`,
 			remove: async () => {
 				await mb.authLogout(profile);
 			}
 		});
 	}
-	return removals;
+	return found;
 }
 function skillLabel(names, entries) {
 	const agents = [...new Set(entries.flatMap((entry) => entry.agents))];
@@ -10760,6 +10500,71 @@ async function findSkill(runner, childOutput) {
 function instanceDirLabel(path, state) {
 	return `Instance directory ${path} (${state?.gitRemote?.kind === "local-bare" ? "Metabase data and the remote-sync repository content.git" : "Metabase data"})`;
 }
+async function findUnpulled(remote, git) {
+	if (!await pathExists(remote.barePath)) return null;
+	try {
+		if (!await git.isBareRepo(remote.barePath)) return null;
+		const commits = await git.bareBranchCommits(remote.barePath, remote.branch);
+		if (commits === null || commits.length === 0) return null;
+		if (!await git.isRepo(remote.workdir)) return {
+			kind: "orphaned",
+			remote,
+			commits
+		};
+		const reachable = await git.reachableCommits(remote.workdir);
+		const missing = commits.filter((commit) => !reachable.has(commit.sha));
+		return missing.length === 0 ? null : {
+			kind: "behind",
+			remote,
+			commits: missing
+		};
+	} catch (error) {
+		if (isToolFailure(error)) return {
+			kind: "unchecked",
+			remote,
+			reason: error.message
+		};
+		throw error;
+	}
+}
+function commitCount(commits) {
+	return commits.length === 1 ? "1 commit" : `${commits.length} commits`;
+}
+function unpulledSummary(unpulled) {
+	const { barePath, workdir, branch } = unpulled.remote;
+	switch (unpulled.kind) {
+		case "behind": return `${barePath} has ${commitCount(unpulled.commits)} on ${branch} that ${workdir} lacks; uninstalling deletes them`;
+		case "orphaned": return `${barePath} has ${commitCount(unpulled.commits)} on ${branch}, and ${workdir} is gone or no longer a git repository; uninstalling deletes them`;
+		case "unchecked": return `${barePath} cannot be compared with ${workdir} (${unpulled.reason}); uninstalling deletes it with any commits ${workdir} lacks`;
+	}
+}
+function unpulledRemedy(unpulled) {
+	const { barePath, workdir, branch } = unpulled.remote;
+	switch (unpulled.kind) {
+		case "behind": return `\`git -C ${workdir} pull\` brings them in first`;
+		case "orphaned": return `\`git clone --branch ${branch} ${barePath} <directory>\` copies them first`;
+		case "unchecked": return null;
+	}
+}
+function commitLines(unpulled) {
+	if (unpulled.kind === "unchecked") return [];
+	const shown = unpulled.commits.slice(0, UNPULLED_COMMITS_SHOWN).map((commit) => `  ${commit.shortSha} ${commit.subject}`);
+	const hidden = unpulled.commits.length - shown.length;
+	return hidden > 0 ? [...shown, `  and ${hidden} more`] : shown;
+}
+function unpulledWarning(unpulled) {
+	const remedy = unpulledRemedy(unpulled);
+	return [
+		unpulledSummary(unpulled),
+		...commitLines(unpulled),
+		...remedy === null ? [] : [remedy]
+	].join("\n");
+}
+function unpulledRefusal(unpulled) {
+	const remedy = unpulledRemedy(unpulled);
+	const force = "pass --force to uninstall anyway";
+	return remedy === null ? `${unpulledSummary(unpulled)}; ${force}` : `${unpulledSummary(unpulled)}; ${remedy}, or ${force}`;
+}
 async function findConfigEntry(instance) {
 	const path = globalConfigPath();
 	try {
@@ -10802,14 +10607,13 @@ async function planUninstall(options, deps) {
 	const container = await findContainer(runtime?.containerName ?? containerName(options.instance, home), deps.docker, runtime?.image ?? null, home, { graceMs: METABASE_STOP_GRACE_MS });
 	if (container.removal !== null) removals.push(container.removal);
 	if (container.problem !== null) problems.push(container.problem);
-	const sample = state?.sampleDatabase ?? null;
-	const sidecar = await findContainer(sample?.containerName ?? sampleContainerName(options.instance, home), deps.docker, sample?.image ?? null, home, { graceMs: SAMPLE_DATABASE_STOP_GRACE_MS });
-	if (sidecar.removal !== null) removals.push(sidecar.removal);
-	if (sidecar.problem !== null) problems.push(sidecar.problem);
+	const sampleDatabase = await findContainer(sampleDatabaseContainerName(options.instance, home), deps.docker, null, home, { graceMs: SAMPLE_DATABASE_STOP_GRACE_MS });
+	if (sampleDatabase.removal !== null) removals.push(sampleDatabase.removal);
+	if (sampleDatabase.problem !== null) problems.push(sampleDatabase.problem);
 	const jarSource = state?.runtime?.kind === "jar" ? state.runtime.source : null;
 	const jarProcess = await findJarProcess(options.instance, jarSource, deps.daemon);
 	if (jarProcess !== null) removals.push(jarProcess);
-	for (const image of [container.image, sidecar.image]) {
+	for (const image of [container.image, sampleDatabase.image]) {
 		if (image === null) continue;
 		const finding = await findImage(image, deps.docker, options.removeImage);
 		if (finding.removal !== null) removals.push(finding.removal);
@@ -10821,13 +10625,16 @@ async function planUninstall(options, deps) {
 		if (jar.kept !== null) kept.push(jar.kept);
 	}
 	const profiles = state === null ? await findMbProfiles([.../* @__PURE__ */ new Set([mbProfileFor(options.instance), namedMbProfile(options.instance)])], null, deps.runner) : await findMbProfiles([state.mbProfile], instanceUrls(state), deps.runner);
-	removals.push(...profiles);
+	removals.push(...profiles.removals);
+	kept.push(...profiles.kept);
 	if (options.removeSkill) {
 		const skill = await findSkill(deps.runner, deps.childOutput);
 		if (skill !== null) removals.push(skill);
 	}
 	const dir = instanceDir(options.instance);
 	const dirPresent = await pathExists(dir);
+	const bareRemote = state?.gitRemote?.kind === "local-bare" ? state.gitRemote : null;
+	const unpulled = options.keepData || !dirPresent || bareRemote === null ? null : await findUnpulled(bareRemote, deps.git);
 	if (!options.keepData) {
 		const secrets = instanceSecretsPath(options.instance);
 		if (await pathExists(secrets)) removals.push({
@@ -10848,7 +10655,8 @@ async function planUninstall(options, deps) {
 	return {
 		removals,
 		kept,
-		problems
+		problems,
+		unpulled
 	};
 }
 function planLines$1(plan) {
@@ -10903,6 +10711,10 @@ async function uninstall(options, deps, io) {
 		};
 	}
 	io.ui.note(planLines$1(plan).join("\n"), `rde uninstall ${options.instance}`);
+	if (plan.unpulled !== null) {
+		io.ui.warn(unpulledWarning(plan.unpulled));
+		if ((options.yes || !options.terminal) && !options.force) throw new ConfigError(unpulledRefusal(plan.unpulled));
+	}
 	if (!options.yes) {
 		if (!await io.prompts.confirm({
 			message: "Remove everything listed?",
@@ -10949,8 +10761,14 @@ const uninstallCommand = defineRdeCommand({
 			type: "boolean",
 			description: "Do not ask for confirmation",
 			default: false
+		},
+		force: {
+			type: "boolean",
+			description: "With --yes or without a terminal, also delete commits your working directory has not pulled",
+			default: false
 		}
 	},
+	interrupted: INTERRUPTED,
 	async run(args) {
 		const instance = args.instance ?? await instanceNameOrDefault();
 		if (!isInstanceName(instance)) throw new ConfigError(`${args.instance === void 0 ? `the default instance in ${globalConfigPath()},` : "--instance"} ${instance} is not an instance name (${INSTANCE_NAME_RULE})`);
@@ -10960,7 +10778,9 @@ const uninstallCommand = defineRdeCommand({
 			keepData: args["keep-data"],
 			removeSkill: args["remove-skill"],
 			removeImage: args["remove-image"],
-			yes: args.yes
+			yes: args.yes,
+			force: args.force,
+			terminal: stdinIsTty()
 		}, hostUninstallDeps(interruptSignal, ui.childOutput), {
 			prompts: clackPrompts({ confirmsWithYes: true }),
 			ui
@@ -11194,8 +11014,11 @@ async function upgrade(ctx, options, deps = hostDeps) {
 	const stopping = ctx.ui.spinner("Stopping Metabase");
 	await runtime.stop();
 	stopping.stop("Metabase stopped");
+	options.onPhase("backing-up", backup);
 	await backUp(ctx, resolved.runtime.dataDir, backup);
+	options.onPhase("switching", backup);
 	await switchTo(ctx, resolved, target);
+	options.onPhase("starting", backup);
 	const to = await startUpgraded(ctx, resolved, client, configured, backup);
 	ctx.ui.success(`Upgraded Metabase from ${current} to ${to}; the backup at ${backup} can go once you are happy with it`);
 	return {
@@ -11207,6 +11030,14 @@ async function upgrade(ctx, options, deps = hostDeps) {
 }
 //#endregion
 //#region src/commands/upgrade.ts
+const INTERRUPTED_IN = {
+	"backing-up": (backup) => `Interrupted before the backup finished; the instance is stopped on the version it had. The next \`rde upgrade\` starts it and takes a new backup; the partial copy at ${backup} can go.`,
+	switching: (backup) => `Interrupted after the backup to ${backup} finished, while installing the new version. Run \`rde init\` to reinstall the instance; the next \`rde upgrade\` then finds it upgraded, or upgrades it if \`rde init\` put back the version it had.`,
+	starting: (backup) => `Interrupted while Metabase starts on the new version, after the backup to ${backup} finished. The next \`rde upgrade\` waits for it to come up and finds it upgraded.`
+};
+function interruptedUpgrade(phase, backup) {
+	return INTERRUPTED_IN[phase](backup);
+}
 const upgradeCommand = defineRdeCommand({
 	meta: {
 		name: "upgrade",
@@ -11223,14 +11054,21 @@ const upgradeCommand = defineRdeCommand({
 			default: false
 		}
 	},
-	async run(args) {
+	interrupted: "Interrupted before the backup; the instance is on the version it had. The next `rde upgrade` starts it if it is stopped and begins again.",
+	async run(args, _rawArgs, interruption) {
 		if (!args.yes && !stdinIsTty()) throw new ConfigError("`rde upgrade` asks for confirmation; pass --yes to upgrade without a terminal");
 		const name = await defaultInstanceName();
 		await requireInstanceState(name);
-		await upgrade(await createWizardContext(name, { signal: interruptSignal }), {
+		const ctx = await createWizardContext(name, { signal: interruptSignal });
+		await upgrade(ctx, {
 			to: args.to ?? null,
-			yes: args.yes
+			yes: args.yes,
+			onPhase: (phase, backup) => {
+				interruption.message = interruptedUpgrade(phase, backup);
+			}
 		});
+		const removed = await removeLeftovers(name, interruptSignal);
+		if (removed !== null) ctx.ui.info(removed);
 	}
 });
 //#endregion
@@ -11238,7 +11076,7 @@ const upgradeCommand = defineRdeCommand({
 const main = defineCommand({
 	meta: {
 		name: "rde",
-		version: "0.1.14",
+		version: "0.1.16",
 		description: "Prepares a local machine for data-engineering work with Metabase and coding agents"
 	},
 	subCommands: {