@metabase/rde 0.1.15 → 0.1.17

package/dist/cli.mjs

@@ -79,6 +79,8 @@ var MetabaseApiError = class extends Error {
 	path;
 	errors;
 	reason;
+	code;
+	detail;
 	constructor(failure) {
 		super(`Metabase ${failure.status} on ${failure.path}: ${failure.message}`);
 		this.name = "MetabaseApiError";
@@ -86,6 +88,8 @@ var MetabaseApiError = class extends Error {
 		this.path = failure.path;
 		this.errors = failure.errors;
 		this.reason = failure.message;
+		this.code = failure.code;
+		this.detail = failure.detail;
 	}
 };
 const UNAUTHORIZED_STATUS = 401;
@@ -123,12 +127,10 @@ var DownloadError = class extends Error {
 };
 //#endregion
 //#region src/output/error.ts
-const INTERRUPTED_MESSAGE = "Interrupted. Run `rde init` again to resume.";
 const FAILURE_EXIT_CODE = 1;
 const USAGE_EXIT_CODE = 2;
 function exitCodeFor(error) {
 	if (error instanceof StepFailedError) return exitCodeFor(error.cause);
-	if (error instanceof AbortError) return 130;
 	if (error instanceof ConfigError) return USAGE_EXIT_CODE;
 	return FAILURE_EXIT_CODE;
 }
@@ -140,7 +142,6 @@ function stepFailureMessage(step, cause) {
 }
 function messageFor$1(error) {
 	if (error instanceof StepFailedError) return stepFailureMessage(error.step, messageFor$1(error.cause));
-	if (error instanceof AbortError) return INTERRUPTED_MESSAGE;
 	if (error instanceof Error) return error.message;
 	return String(error);
 }
@@ -148,10 +149,15 @@ function reportError(error) {
 	process.stderr.write(messageFor$1(error) + "\n");
 	process.exitCode = exitCodeFor(error);
 }
+function reportInterrupted(message) {
+	if (message !== null) process.stderr.write(message + "\n");
+	process.exitCode = 130;
+}
 //#endregion
 //#region src/commands/define.ts
 const SHORT_PREFIX = "-";
 const END_OF_OPTIONS = "--";
+const INTERRUPTED = "Interrupted.";
 function repeatedValues(rawArgs, flag) {
 	const values = [];
 	const inline = `${flag}=`;
@@ -174,9 +180,14 @@ function defineRdeCommand(def) {
 		meta: def.meta,
 		...def.args !== void 0 && { args: def.args },
 		async run({ args, rawArgs }) {
+			const interruption = { message: def.interrupted };
 			try {
-				await def.run(args, rawArgs);
+				await def.run(args, rawArgs, interruption);
 			} catch (error) {
+				if (error instanceof AbortError) {
+					reportInterrupted(interruption.message);
+					return;
+				}
 				reportError(error);
 			}
 		}
@@ -255,9 +266,9 @@ const StepId = z.enum([
 	"admin-user",
 	"api-key",
 	"transforms",
-	"sample-database",
 	"license",
 	"git-sync",
+	"sync-scope",
 	"databases",
 	"summary"
 ]);
@@ -326,18 +337,15 @@ const REMOTE_SYNC_FEATURE = "remote-sync";
 function hasRemoteSync(license) {
 	return license.activated && license.features.includes("remote-sync");
 }
+function hasLibrary(license) {
+	return license.activated && license.features.includes("library");
+}
 const DatabaseRecord = z.object({
 	id: z.int(),
 	name: z.string(),
 	engine: z.string(),
 	createdAt: z.string()
 });
-const SampleDatabaseState = z.object({
-	containerName: z.string(),
-	image: z.string(),
-	port: z.int().positive(),
-	databaseId: z.int().nullable()
-});
 const GitRemoteState = z.discriminatedUnion("kind", [z.object({
 	kind: z.literal("local-bare"),
 	barePath: z.string(),
@@ -354,7 +362,7 @@ const StepRecord = z.object({
 	completedAt: z.string()
 });
 const InstanceState = z.object({
-	schemaVersion: z.literal(5),
+	schemaVersion: z.literal(7),
 	name: z.string(),
 	runtime: RuntimeState.nullable(),
 	url: z.string().nullable(),
@@ -363,9 +371,9 @@ const InstanceState = z.object({
 	mbProfile: z.string(),
 	license: LicenseState,
 	databases: z.array(DatabaseRecord),
-	sampleDatabase: SampleDatabaseState.nullable(),
 	gitRemote: GitRemoteState.nullable(),
 	movedFrom: z.string().nullable(),
+	syncRoot: z.int().nullable(),
 	steps: z.partialRecord(StepId, StepRecord)
 });
 function configuredRuntime(state) {
@@ -395,7 +403,7 @@ function mbCommand(profile) {
 }
 function emptyInstanceState(name) {
 	return {
-		schemaVersion: 5,
+		schemaVersion: 7,
 		name,
 		runtime: null,
 		url: null,
@@ -404,9 +412,9 @@ function emptyInstanceState(name) {
 		mbProfile: mbProfileFor(name),
 		license: { activated: false },
 		databases: [],
-		sampleDatabase: null,
 		gitRemote: null,
 		movedFrom: null,
+		syncRoot: null,
 		steps: {}
 	};
 }
@@ -417,6 +425,8 @@ const V1 = 1;
 const V2 = 2;
 const V3 = 3;
 const V4 = 4;
+const V5 = 5;
+const V6 = 6;
 const StateV1 = z.object({ schemaVersion: z.literal(V1) }).loose();
 const StateV2 = z.object({ schemaVersion: z.literal(V2) }).loose();
 const AdminV3 = z.discriminatedUnion("kind", [z.object({
@@ -428,6 +438,11 @@ const AdminV3 = z.discriminatedUnion("kind", [z.object({
 	password: z.string()
 })]);
 const StateV4 = z.object({ schemaVersion: z.literal(V4) }).loose();
+const StateV5 = z.object({
+	schemaVersion: z.literal(V5),
+	steps: z.record(z.string(), z.unknown())
+}).loose();
+const StateV6 = z.object({ schemaVersion: z.literal(V6) }).loose();
 const StateV3 = z.object({
 	schemaVersion: z.literal(V3),
 	admin: AdminV3.nullable(),
@@ -443,17 +458,32 @@ function liftV1(raw) {
 function liftV2(raw) {
 	return {
 		...StateV2.parse(raw),
-		schemaVersion: V3,
-		sampleDatabase: null
+		schemaVersion: V3
 	};
 }
 function liftV4(raw) {
 	return {
 		...StateV4.parse(raw),
-		schemaVersion: 5,
+		schemaVersion: V5,
 		movedFrom: null
 	};
 }
+function liftV5(raw) {
+	const { sampleDatabase: _sampleDatabase, steps, ...state } = StateV5.parse(raw);
+	const { "sample-database": _sampleDatabaseStep, ...remainingSteps } = steps;
+	return {
+		...state,
+		schemaVersion: V6,
+		steps: remainingSteps
+	};
+}
+function liftV6(raw) {
+	return {
+		...StateV6.parse(raw),
+		schemaVersion: 7,
+		syncRoot: null
+	};
+}
 function adminV4(admin) {
 	switch (admin.kind) {
 		case "default": return {
@@ -473,11 +503,11 @@ function liftV3(raw) {
 		password: admin.password
 	} : null;
 	return {
-		state: InstanceState.parse(liftV4({
+		state: migrateInstanceState(liftV4({
 			...rest,
 			schemaVersion: V4,
 			admin: admin === null ? null : adminV4(admin)
-		})),
+		})).state,
 		movedSecrets: {
 			schemaVersion: 1,
 			admin: login,
@@ -491,15 +521,17 @@ function migrateInstanceState(raw) {
 		case V1: return migrateInstanceState(liftV1(raw));
 		case V2: return migrateInstanceState(liftV2(raw));
 		case V3: return liftV3(raw);
-		case V4: return {
-			state: InstanceState.parse(liftV4(raw)),
+		case V4: return migrateInstanceState(liftV4(raw));
+		case V5: return migrateInstanceState(liftV5(raw));
+		case V6: return {
+			state: InstanceState.parse(liftV6(raw)),
 			movedSecrets: null
 		};
-		case 5: return {
+		case 7: return {
 			state: InstanceState.parse(raw),
 			movedSecrets: null
 		};
-		default: throw new ConfigError(`state schemaVersion ${schemaVersion} is not supported by this build (expected 5)`);
+		default: throw new ConfigError(`state schemaVersion ${schemaVersion} is not supported by this build (expected 7)`);
 	}
 }
 //#endregion
@@ -807,8 +839,11 @@ const SESSION_HEADER = "X-Metabase-Session";
 const API_KEY_HEADER = "X-Api-Key";
 const JSON_CONTENT_TYPE = "application/json";
 const SERVICE_UNAVAILABLE_STATUS = 503;
+const NO_CONTENT_STATUS = 204;
 const NO_AUTH = { kind: "none" };
 const ErrorMessage = z.object({ message: z.string() }).loose();
+const ErrorTitle = z.object({ error: z.string() }).loose();
+const ErrorCode = z.object({ error_code: z.string() }).loose();
 const ErrorFields = z.object({ errors: z.record(z.string(), z.unknown()) }).loose();
 const ErrorText = z.string();
 const ErrorTexts = z.array(z.string());
@@ -871,6 +906,8 @@ function serverMessage(body) {
 	const value = jsonValue(body);
 	const parsed = ErrorMessage.safeParse(value);
 	if (parsed.success) return parsed.data.message;
+	const title = ErrorTitle.safeParse(value);
+	if (title.success) return title.data.error;
 	const errors = serverErrors(body);
 	if (errors !== null && Object.keys(errors).length > 0) return Object.entries(errors).map(([name, problem]) => `${name}: ${problem}`).join("; ");
 	const plain = ErrorText.safeParse(value);
@@ -879,6 +916,10 @@ function serverMessage(body) {
 	if (body.json.parsed || text.length === 0) return `HTTP ${body.status}`;
 	return text;
 }
+function errorCode(body) {
+	const parsed = ErrorCode.safeParse(jsonValue(body));
+	return parsed.success ? parsed.data.error_code : null;
+}
 function failureFor(path, body) {
 	if (body.status === SERVICE_UNAVAILABLE_STATUS) {
 		const initializing = Initializing.safeParse(jsonValue(body));
@@ -888,7 +929,9 @@ function failureFor(path, body) {
 		status: body.status,
 		path,
 		message: serverMessage(body),
-		errors: serverErrors(body)
+		errors: serverErrors(body),
+		code: errorCode(body),
+		detail: body.json.parsed ? body.json.value : null
 	});
 }
 function shapeError(path, body, reason) {
@@ -896,7 +939,9 @@ function shapeError(path, body, reason) {
 		status: body.status,
 		path,
 		message: reason,
-		errors: null
+		errors: null,
+		code: null,
+		detail: null
 	});
 }
 function isTimeout(error) {
@@ -946,19 +991,33 @@ function createHttp(options) {
 		if (!received.ok) throw failureFor(path, received.body);
 		return received.body;
 	}
+	function parseJson(path, body, schema) {
+		if (!body.json.parsed) throw shapeError(path, body, "expected a JSON body");
+		return parseShape(path, body, schema, body.json.value);
+	}
+	function parseShape(path, body, schema, value) {
+		try {
+			return schema.parse(value);
+		} catch (error) {
+			if (error instanceof ZodError) throw shapeError(path, body, `unexpected response shape:\n${z.prettifyError(error)}`);
+			throw error;
+		}
+	}
 	return {
 		async requestJson(method, path, request) {
+			return parseJson(path, await requestBody(method, path, request.body), request.schema);
+		},
+		async requestOptionalJson(method, path, request) {
 			const body = await requestBody(method, path, request.body);
-			if (!body.json.parsed) throw shapeError(path, body, "expected a JSON body");
-			try {
-				return request.schema.parse(body.json.value);
-			} catch (error) {
-				if (error instanceof ZodError) throw shapeError(path, body, `unexpected response shape:\n${z.prettifyError(error)}`);
-				throw error;
-			}
+			if (body.status === NO_CONTENT_STATUS && body.text.length === 0) return null;
+			return parseJson(path, body, request.schema);
 		},
 		async requestNoContent(method, path, request = {}) {
 			await requestBody(method, path, request.body);
+		},
+		async requestText(method, path, request) {
+			const body = await requestBody(method, path, request.body);
+			return parseShape(path, body, request.schema, body.text);
 		}
 	};
 }
@@ -1049,6 +1108,48 @@ function apiKeyResource(http) {
 		regenerate
 	};
 }
+const Collection = z.object({
+	id: z.int(),
+	name: z.string(),
+	location: z.string(),
+	type: z.string().nullable(),
+	namespace: z.string().nullable(),
+	personal_owner_id: z.int().nullable(),
+	is_remote_synced: z.boolean()
+}).loose();
+const RootCollection = z.object({ id: z.literal("root") }).loose();
+const CollectionList = z.array(z.union([Collection, RootCollection]));
+const CollectionRef = z.object({
+	id: z.int(),
+	name: z.string()
+}).loose();
+//#endregion
+//#region src/metabase/resources/collection.ts
+function collectionResource(http) {
+	/** GET /api/collection */
+	async function list() {
+		return http.requestJson("GET", "/api/collection", { schema: CollectionList });
+	}
+	/** POST /api/collection */
+	async function create(request) {
+		return http.requestJson("POST", "/api/collection", {
+			body: {
+				...request,
+				parent_id: null
+			},
+			schema: CollectionRef
+		});
+	}
+	/** POST /api/ee/library; 400 when the Library exists */
+	async function createLibrary() {
+		return http.requestJson("POST", "/api/ee/library", { schema: CollectionRef });
+	}
+	return {
+		list,
+		create,
+		createLibrary
+	};
+}
 //#endregion
 //#region src/metabase/domain/database.ts
 const InitialSyncStatus = z.enum([
@@ -1141,7 +1242,9 @@ function permissionsGroupResource(http) {
 	}
 	return { list };
 }
-z.enum(["read-only", "read-write"]);
+//#endregion
+//#region src/metabase/domain/remote-sync.ts
+const RemoteSyncType = z.enum(["read-only", "read-write"]);
 const RemoteSyncSettingsResult = z.object({
 	success: z.boolean(),
 	task_id: z.int().optional()
@@ -1162,6 +1265,38 @@ const SyncTask = z.object({
 	status: SyncTaskStatus$1,
 	error_message: z.string().nullable().optional()
 }).loose();
+const NamedCollection = z.object({
+	id: z.int(),
+	name: z.string()
+}).loose();
+const DependencyLocation = NamedCollection.nullable().optional();
+const DependencyItem = z.object({
+	model: z.string(),
+	id: z.int(),
+	name: z.string().nullable()
+}).loose();
+const UnsyncedDependency = DependencyItem.extend({
+	collection: DependencyLocation,
+	used_by: z.array(DependencyItem)
+});
+const SyncRemedy = z.discriminatedUnion("type", [
+	z.object({
+		type: z.literal("collection"),
+		collection: NamedCollection
+	}).loose(),
+	z.object({ type: z.literal("library") }).loose(),
+	z.object({
+		type: z.literal("none"),
+		collection: DependencyLocation
+	}).loose()
+]);
+const RequiredSync = z.object({
+	remedy: SyncRemedy,
+	syncable: z.boolean(),
+	blocks: z.array(NamedCollection),
+	dependencies: z.array(UnsyncedDependency)
+}).loose();
+const UnsyncedDependencies = z.object({ errors: z.object({ required: z.array(RequiredSync) }).loose() }).loose();
 //#endregion
 //#region src/metabase/resources/remote-sync.ts
 function remoteSyncResource(http) {
@@ -1172,6 +1307,13 @@ function remoteSyncResource(http) {
 			schema: RemoteSyncSettingsResult
 		});
 	}
+	/** PUT /api/ee/remote-sync/settings, without the git settings, which it leaves as they are */
+	async function updateScope(scope) {
+		return http.requestJson("PUT", "/api/ee/remote-sync/settings", {
+			body: scope,
+			schema: RemoteSyncSettingsResult
+		});
+	}
 	/** PUT /api/ee/remote-sync/settings with only `remote-sync-transforms`, which skips the repository check. */
 	async function syncTransforms() {
 		return http.requestJson("PUT", "/api/ee/remote-sync/settings", {
@@ -1188,10 +1330,11 @@ function remoteSyncResource(http) {
 	}
 	/** GET /api/ee/remote-sync/current-task */
 	async function currentTask() {
-		return http.requestJson("GET", "/api/ee/remote-sync/current-task", { schema: SyncTask.nullable() });
+		return http.requestOptionalJson("GET", "/api/ee/remote-sync/current-task", { schema: SyncTask });
 	}
 	return {
 		updateSettings,
+		updateScope,
 		syncTransforms,
 		testConnection,
 		currentTask
@@ -1264,6 +1407,7 @@ const PREMIUM_EMBEDDING_TOKEN_SETTING = "premium-embedding-token";
 const ENGINES_SETTING = "engines";
 const TRANSFORMS_ENABLED_SETTING = "transforms-enabled";
 const TRANSFORMS_SETUP_COMPLETE_SETTING = "transforms-setup-complete";
+const REMOTE_SYNC_TYPE_SETTING = "remote-sync-type";
 function settingResource(http) {
 	/** PUT /api/setting/premium-embedding-token */
 	async function setPremiumEmbeddingToken(value) {
@@ -1281,11 +1425,16 @@ function settingResource(http) {
 	async function engines() {
 		return http.requestJson("GET", `/api/setting/${ENGINES_SETTING}`, { schema: Engines });
 	}
+	/** GET /api/setting/remote-sync-type; Metabase answers its default, read-only, while unset. */
+	async function remoteSyncType() {
+		return http.requestText("GET", `/api/setting/${REMOTE_SYNC_TYPE_SETTING}`, { schema: RemoteSyncType });
+	}
 	return {
 		setPremiumEmbeddingToken,
 		enableTransforms,
 		transformsDecided,
-		engines
+		engines,
+		remoteSyncType
 	};
 }
 //#endregion
@@ -1355,6 +1504,7 @@ function createMetabaseClient(baseUrl, auth, signal, options = {}) {
 		tokenStatus: tokenStatusResource(http),
 		database: databaseResource(http),
 		remoteSync: remoteSyncResource(http),
+		collection: collectionResource(http),
 		user: userResource(http)
 	};
 }
@@ -1479,6 +1629,7 @@ const credentials = defineRdeCommand({
 			default: false
 		}
 	},
+	interrupted: INTERRUPTED,
 	async run(args) {
 		const name = await defaultInstanceName();
 		const state = await requireInstanceState(name);
@@ -2188,10 +2339,10 @@ function createArgs(options) {
 		"--label",
 		`${IMAGE_LABEL}=${options.image}`,
 		"-p",
-		`${LOOPBACK_HOST}:${options.port.host ?? ""}:${options.port.container}`
+		`${LOOPBACK_HOST}:${options.port.host}:${options.port.container}`,
+		"-v",
+		`${options.mount.source}:${options.mount.target}`
 	];
-	if (options.port.alsoOn !== null) args.push("-p", `${options.port.alsoOn}:${options.port.host ?? ""}:${options.port.container}`);
-	if (options.mount !== null) args.push("-v", `${options.mount.source}:${options.mount.target}`);
 	for (const [name, value] of Object.entries(options.env)) args.push("-e", `${name}=${value}`);
 	if (options.hostUser !== null) {
 		args.push("-e", `${ENV_HOST_UID}=${options.hostUser.uid}`);
@@ -2250,17 +2401,6 @@ function dockerTool(runner) {
 		if (NO_SUCH_IMAGE.test(result.stderr)) return null;
 		throw toolFailure(DOCKER, args, result);
 	}
-	async function bridgeGateway() {
-		const gateway = (await docker([
-			"network",
-			"inspect",
-			"bridge",
-			"--format",
-			"{{range .IPAM.Config}}{{.Gateway}}{{end}}"
-		])).stdout.trim();
-		if (gateway.length === 0) throw new ConfigError("`docker network inspect bridge` names no gateway address");
-		return gateway;
-	}
 	async function imageRemove(image) {
 		await docker(["rmi", image]);
 	}
@@ -2337,34 +2477,6 @@ function dockerTool(runner) {
 			name
 		]);
 	}
-	async function containerLoopbackPort(name, containerPort) {
-		const args = [
-			"port",
-			name,
-			`${containerPort}/tcp`
-		];
-		const result = await docker(args);
-		const prefix = `${LOOPBACK_HOST}:`;
-		const line = result.stdout.split("\n").find((entry) => entry.startsWith(prefix));
-		if (line !== void 0) {
-			const port = Number.parseInt(line.slice(prefix.length), 10);
-			if (Number.isInteger(port)) return port;
-		}
-		throw new ExternalToolError({
-			tool: DOCKER,
-			argv: args,
-			envNames: [],
-			exitCode: 0,
-			stderrTail: `no port published on ${LOOPBACK_HOST} in: ${result.stdout.trim()}`
-		});
-	}
-	async function containerExecSucceeds(name, command) {
-		return (await runner.run(DOCKER, [
-			"exec",
-			name,
-			...command
-		])).exitCode === 0;
-	}
 	async function containerLogs(name, options) {
 		const args = ["logs"];
 		if (options.follow) args.push("--follow");
@@ -2377,7 +2489,6 @@ function dockerTool(runner) {
 		imagePull,
 		imageId,
 		imageRemove,
-		bridgeGateway,
 		containerInspect,
 		containerImageId,
 		portClaims,
@@ -2387,8 +2498,6 @@ function dockerTool(runner) {
 		containerRestart,
 		containerRemove,
 		containerForceRemove,
-		containerLoopbackPort,
-		containerExecSucceeds,
 		containerLogs
 	};
 }
@@ -2566,8 +2675,7 @@ function dockerRuntime(state, deps) {
 			imageId,
 			port: {
 				host: state.port,
-				container: CONTAINER_PORT,
-				alsoOn: null
+				container: CONTAINER_PORT
 			},
 			mount: {
 				source: deps.dataDir,
@@ -2881,148 +2989,21 @@ function runtimeFromState(state, deps) {
 	}
 }
 //#endregion
-//#region src/runtime/sample-database.ts
-const SAMPLE_DATABASE_IMAGE = "metabase/qa-databases:postgres-sample-15";
-const SAMPLE_DATABASE_USER = "metabase";
-const SAMPLE_DATABASE_PASSWORD = "metasample123";
-const SAMPLE_DATABASE_NAME = "sample";
-const SAMPLE_DATABASE_PORT = 25432;
-const SAMPLE_DATABASE_READY_TIMEOUT_MS = 12e4;
-const SAMPLE_DATABASE_STOP_GRACE_MS = 1e4;
-const POSTGRES_PORT = 5432;
+//#region src/runtime/leftover-sample-database.ts
 const CONTAINER_NAME_PREFIX = "rde-sampledb";
-const READY_POLL_MS = 1e3;
-const READY_PROBE = [
-	"pg_isready",
-	"-h",
-	LOOPBACK_HOST,
-	"-U",
-	SAMPLE_DATABASE_USER,
-	"-d",
-	SAMPLE_DATABASE_NAME
-];
-function sampleContainerName(instanceName, home) {
+const SAMPLE_DATABASE_STOP_GRACE_MS = 1e4;
+function sampleDatabaseContainerName(instanceName, home) {
 	const tag = homeTag(home);
 	const name = `${CONTAINER_NAME_PREFIX}-${instanceName}`;
 	return tag === null ? name : `${name}-${tag}`;
 }
-function sampleDatabaseUrl(port) {
-	return `postgres://${SAMPLE_DATABASE_USER}:${SAMPLE_DATABASE_PASSWORD}@localhost:${port}/${SAMPLE_DATABASE_NAME}`;
-}
-function publishesOnLoopback$1(inspection, port) {
-	return inspection.ports.some((mapping) => mapping.container === POSTGRES_PORT && mapping.host === port && mapping.hostIp === "127.0.0.1");
-}
-function createOptions(state, home, hostPort, alsoOn) {
-	return {
-		name: state.containerName,
-		home,
-		image: state.image,
-		imageId: null,
-		port: {
-			host: hostPort,
-			container: POSTGRES_PORT,
-			alsoOn
-		},
-		mount: null,
-		env: {},
-		addHostGateway: false,
-		hostUser: null
-	};
-}
-function requireOwnContainer(name, existing, home) {
-	if (existing.home !== null && existing.home !== home) throw new ConfigError(`container ${name} belongs to the rde home ${existing.home} and is left alone`);
-}
-function sampleDatabaseContainer(state, docker, home) {
-	const name = state.containerName;
-	function conflict(reason) {
-		return new ConfigError(`container ${name} already exists ${reason}; remove it with \`docker rm -f ${name}\` and run \`rde init\` again`);
-	}
-	async function install(options) {
-		const existing = await docker.containerInspect(name);
-		if (existing.exists) {
-			if (existing.image !== state.image) throw conflict(`with image ${existing.image}, not ${state.image}`);
-			if (publishesOnLoopback$1(existing, state.port)) return;
-			requireOwnContainer(name, existing, home);
-			await docker.containerForceRemove(name);
-		}
-		await docker.imagePull(state.image, { onLine: options.onProgress });
-		await docker.containerCreate(createOptions(state, home, state.port, options.alsoOn));
-	}
-	async function start() {
-		const existing = await docker.containerInspect(name);
-		if (!existing.exists) return "missing";
-		if (existing.running) return "running";
-		await docker.containerStart(name);
-		return "started";
-	}
-	async function stop() {
-		const existing = await docker.containerInspect(name);
-		if (existing.exists && existing.running) await docker.containerStop(name, { graceMs: SAMPLE_DATABASE_STOP_GRACE_MS });
-	}
-	async function status() {
-		const existing = await docker.containerInspect(name);
-		return {
-			installed: existing.exists,
-			running: existing.exists && existing.running
-		};
-	}
-	async function waitReady(options) {
-		const deadline = Date.now() + options.timeoutMs;
-		const interval = options.pollMs ?? READY_POLL_MS;
-		for (;;) {
-			if (await docker.containerExecSucceeds(name, READY_PROBE)) return;
-			const existing = await docker.containerInspect(name);
-			if (!existing.exists || !existing.running) throw new ConfigError(`container ${name} stopped before Postgres was ready; \`docker logs ${name}\` shows why`);
-			if (Date.now() >= deadline) throw new ConfigError(`Postgres in ${name} is not ready after ${Math.round(options.timeoutMs / 1e3)}s; \`docker logs ${name}\` shows what it is doing`);
-			try {
-				await setTimeout$1(interval, void 0, { signal: options.signal });
-			} catch {
-				throw new AbortError();
-			}
-		}
-	}
-	return {
-		install,
-		start,
-		stop,
-		status,
-		waitReady
-	};
-}
-function extraAddress(inspection) {
-	const extra = inspection.ports.find((mapping) => mapping.container === POSTGRES_PORT && mapping.hostIp !== "127.0.0.1");
-	return extra === void 0 ? null : extra.hostIp;
-}
-async function startOnDockerPort(state, docker, home, alsoOn) {
-	const name = state.containerName;
-	await docker.containerForceRemove(name);
-	await docker.containerCreate(createOptions(state, home, null, null));
-	await docker.containerStart(name);
-	const port = await docker.containerLoopbackPort(name, POSTGRES_PORT);
+async function removeLeftoverSampleDatabase(docker, instanceName, home) {
+	if (!(await docker.available()).available) return null;
+	const name = sampleDatabaseContainerName(instanceName, home);
+	const existing = await docker.containerInspect(name);
+	if (!existing.exists || existing.home !== null && existing.home !== home) return null;
 	await docker.containerForceRemove(name);
-	const pinned = {
-		...state,
-		port
-	};
-	await docker.containerCreate(createOptions(pinned, home, port, alsoOn));
-	await docker.containerStart(name);
-	return pinned;
-}
-async function startOnFreePort(state, docker, home) {
-	try {
-		return {
-			outcome: await sampleDatabaseContainer(state, docker, home).start(),
-			state
-		};
-	} catch (error) {
-		if (!isPortTakenError(error)) throw error;
-	}
-	const existing = await docker.containerInspect(state.containerName);
-	if (existing.exists) requireOwnContainer(state.containerName, existing, home);
-	return {
-		outcome: "started",
-		state: await startOnDockerPort(state, docker, home, existing.exists ? extraAddress(existing) : null)
-	};
+	return name;
 }
 //#endregion
 //#region src/steps/lifecycle.ts
@@ -3033,10 +3014,14 @@ async function loadInstance(name, signal) {
 	return {
 		state,
 		url: configured.url,
-		runtime: runtimeFromState(configured.runtime, deps),
-		sampleDatabase: state.sampleDatabase === null ? null : sampleDatabaseContainer(state.sampleDatabase, deps.docker, deps.rdeHome)
+		runtime: runtimeFromState(configured.runtime, deps)
 	};
 }
+async function removeLeftovers(name, signal) {
+	const deps = hostRuntimeDeps(name, signal);
+	const removed = await removeLeftoverSampleDatabase(deps.docker, name, deps.rdeHome);
+	return removed === null ? null : `Removed container ${removed}, the sample database of an older rde`;
+}
 async function isInstanceRunning(state, runtime) {
 	const configured = configuredRuntime(state);
 	if (configured === null) return false;
@@ -3045,44 +3030,29 @@ async function isInstanceRunning(state, runtime) {
 function openInstance(url) {
 	return openBrowser(url);
 }
-function ownContainers(state) {
-	const names = /* @__PURE__ */ new Set();
-	if (state.runtime?.kind === "docker") names.add(state.runtime.containerName);
-	if (state.sampleDatabase !== null) names.add(state.sampleDatabase.containerName);
-	return names;
-}
-function instanceClaims(other) {
-	const claims = [];
-	if (other.runtime !== null) claims.push({
-		port: other.runtime.port,
-		holder: `rde instance ${other.name}`
-	});
-	if (other.sampleDatabase !== null) claims.push({
-		port: other.sampleDatabase.port,
-		holder: `the sample database of rde instance ${other.name}`
-	});
-	return claims;
-}
 async function portClaims(state, runtime) {
 	const claims = [];
 	if ((await runtime.docker.available()).available) {
-		const own = ownContainers(state);
-		for (const claim of await runtime.docker.portClaims()) if (!own.has(claim.container)) claims.push({
+		const own = state.runtime?.kind === "docker" ? state.runtime.containerName : null;
+		for (const claim of await runtime.docker.portClaims()) if (claim.container !== own) claims.push({
 			port: claim.port,
 			holder: `container ${claim.container}`
 		});
 	}
-	for (const other of await runtime.instances()) if (other.name !== state.name) claims.push(...instanceClaims(other));
+	for (const other of await runtime.instances()) if (other.name !== state.name && other.runtime !== null) claims.push({
+		port: other.runtime.port,
+		holder: `rde instance ${other.name}`
+	});
 	return claims;
 }
 //#endregion
 //#region src/steps/admin-user.ts
-const STEP_ID$10 = "admin-user";
+const STEP_ID$9 = "admin-user";
 const ADMIN_USER_KEYS = {
-	email: `${STEP_ID$10}.email`,
-	password: `${STEP_ID$10}.password`,
-	firstName: `${STEP_ID$10}.first-name`,
-	lastName: `${STEP_ID$10}.last-name`
+	email: `${STEP_ID$9}.email`,
+	password: `${STEP_ID$9}.password`,
+	firstName: `${STEP_ID$9}.first-name`,
+	lastName: `${STEP_ID$9}.last-name`
 };
 const GENERATED_ADMIN_EMAIL = "admin@metabase.local";
 const GENERATED_PASSWORD_BYTES = 24;
@@ -3237,7 +3207,7 @@ async function recordExistingAdmin(ctx, variant, client, url) {
 }
 function adminUserStep(options, deps = hostDeps$14) {
 	return {
-		id: STEP_ID$10,
+		id: STEP_ID$9,
 		title: "Create the admin user",
 		redoHint: "An instance keeps the admin it was set up with; `rde credentials` shows it.",
 		async detect(ctx) {
@@ -3502,10 +3472,15 @@ const GitSyncTask = z.object({
 	progress: z.number().nullable(),
 	error_message: z.string().nullable().optional()
 }).loose();
+const SyncedCollection = z.object({
+	id: z.int(),
+	name: z.string()
+}).loose();
 const GitSyncStatus = z.object({
 	branch: z.string().nullable(),
 	is_dirty: z.boolean(),
-	current_task: GitSyncTask.nullable()
+	current_task: GitSyncTask.nullable(),
+	synced_collections: z.array(SyncedCollection)
 }).loose();
 const GitSyncOutcome = z.object({
 	message: z.string().nullable(),
@@ -3517,6 +3492,9 @@ const RemoteChanges = z.object({
 	remote_version: z.string().nullable(),
 	local_version: z.string().nullable()
 }).loose();
+function remoteMoved(changes) {
+	return changes.has_changes && changes.local_version !== null;
+}
 function comparableUrl(url) {
 	const parsed = new URL(url);
 	return `${parsed.origin}${parsed.pathname.replace(/\/+$/, "")}`;
@@ -3652,11 +3630,11 @@ function mbTool(runner) {
 }
 //#endregion
 //#region src/steps/api-key.ts
-const STEP_ID$9 = "api-key";
+const STEP_ID$8 = "api-key";
 const API_KEY_KEYS = {
-	email: `${STEP_ID$9}.email`,
-	password: `${STEP_ID$9}.password`,
-	profile: `${STEP_ID$9}.profile`
+	email: `${STEP_ID$8}.email`,
+	password: `${STEP_ID$8}.password`,
+	profile: `${STEP_ID$8}.profile`
 };
 const ADMINISTRATORS_GROUP_NAME = "Administrators";
 function hostDeps$13(ctx) {
@@ -3720,7 +3698,7 @@ async function authenticates(client) {
 	}
 }
 async function forgetCompletion(ctx) {
-	const { [STEP_ID$9]: record, ...steps } = ctx.state.steps;
+	const { [STEP_ID$8]: record, ...steps } = ctx.state.steps;
 	if (record !== void 0) await ctx.saveState({
 		...ctx.state,
 		steps
@@ -3799,13 +3777,13 @@ function usageNote(profile) {
 }
 function apiKeyStep(deps = hostDeps$13) {
 	return {
-		id: STEP_ID$9,
+		id: STEP_ID$8,
 		title: "Connect the Metabase CLI",
 		redoHint: "`rde status` shows the mb profile it uses.",
 		async detect(ctx) {
 			const configured = configuredRuntime(ctx.state);
 			const apiKey = ctx.secrets.apiKey;
-			if (configured === null || apiKey === null || ctx.state.steps[STEP_ID$9]?.status !== "done") return "todo";
+			if (configured === null || apiKey === null || ctx.state.steps[STEP_ID$8]?.status !== "done") return "todo";
 			const resolved = deps(ctx);
 			if (!await resolved.instanceRunning()) return "todo";
 			if (!isLoggedInAt(await mbTool(resolved.runner).authStatusIfInstalled(ctx.state.mbProfile), configured.url)) return "todo";
@@ -4827,7 +4805,7 @@ const RSA_KEY_UNAVAILABLE_ERROR = "RSA public key is not available";
 const KEY_RETRIEVAL_NOTE = "allowPublicKeyRetrieval=true is added: MySQL 8 needs it to log in to a local server without SSL; to leave it out, paste a connection string with allowPublicKeyRetrieval=false instead";
 const KEY_RETRIEVAL_HINT = "MySQL 8 without SSL needs allowPublicKeyRetrieval=true: go back and add ?allowPublicKeyRetrieval=true to the connection string, or turn on SSL";
 const CONNECTION_PLACEHOLDER = "leave empty to skip";
-const STUB_CONNECTION_PLACEHOLDER = "leave empty to pick the engine";
+const ENGINE_PLACEHOLDER = "leave empty to pick the engine";
 const START_SCREEN = {
 	engine: "pick-engine",
 	"connection-string": "connection-string"
@@ -4853,6 +4831,9 @@ function targeting(stub) {
 function restart(model) {
 	return model.target === null ? FRESH$1 : targeting(model.target);
 }
+function mayFinish(run) {
+	return !run.deps.required || run.deps.existingCount + run.created.length > 0;
+}
 function nextStub(run, model) {
 	const stub = run.queue.shift();
 	if (stub !== void 0) return {
@@ -4860,13 +4841,18 @@ function nextStub(run, model) {
 		to: "connection-string",
 		model: targeting(stub)
 	};
-	return run.created.length > 0 ? {
+	if (run.created.length > 0) return {
 		type: "next",
 		to: "another",
 		model
-	} : {
+	};
+	return mayFinish(run) ? {
 		type: "done",
 		model
+	} : {
+		type: "next",
+		to: "connection-string",
+		model: FRESH$1
 	};
 }
 function stubNamed(run, name) {
@@ -4956,9 +4942,13 @@ function pickStubsScreen(run) {
 			run.queue = run.stubs.filter((stub) => picked.includes(stub.id));
 			return nextStub(run, model);
 		}
-		if (run.deps.start === "connection-string" && run.created.length === 0) return {
+		if (run.deps.start === "connection-string" && run.created.length === 0) return mayFinish(run) ? {
 			type: "done",
 			model
+		} : {
+			type: "next",
+			to: "connection-string",
+			model: FRESH$1
 		};
 		return {
 			type: "next",
@@ -4968,6 +4958,11 @@ function pickStubsScreen(run) {
 	};
 }
 function connectionQuestion(run, target) {
+	if (target === null && !mayFinish(run)) return {
+		key: DATABASE_KEYS.connection,
+		message: "Connection string of your database (Enter to pick its engine instead)",
+		placeholder: ENGINE_PLACEHOLDER
+	};
 	if (target === null) return {
 		key: DATABASE_KEYS.connection,
 		message: "Connection string of your database (Enter to skip; `rde db add` connects one later)",
@@ -4976,7 +4971,7 @@ function connectionQuestion(run, target) {
 	return {
 		key: databaseKey(ordinalOf(run), "connection"),
 		message: `Connection string of ${target.name} (Enter to pick its engine instead)`,
-		placeholder: STUB_CONNECTION_PLACEHOLDER
+		placeholder: ENGINE_PLACEHOLDER
 	};
 }
 function connectionStringScreen(run) {
@@ -4988,7 +4983,7 @@ function connectionStringScreen(run) {
 				...draft !== null && { initialValue: draft }
 			})).trim();
 			draft = uri;
-			if (uri.length === 0) return model.target === null ? {
+			if (uri.length === 0) return model.target === null && mayFinish(run) ? {
 				type: "done",
 				model
 			} : {
@@ -5027,22 +5022,28 @@ function connectionStringScreen(run) {
 		}
 	};
 }
-function finishLabel(run, model) {
-	if (model.target !== null) return `Leave ${model.target.name} unconnected`;
-	return run.deps.existingCount + run.created.length > 0 ? "Finish" : "Skip for now";
+function finishChoices(run, model) {
+	if (model.target !== null) return [{
+		value: FINISH,
+		label: `Leave ${model.target.name} unconnected`
+	}];
+	if (run.deps.existingCount + run.created.length > 0) return [{
+		value: FINISH,
+		label: "Finish"
+	}];
+	return mayFinish(run) ? [{
+		value: FINISH,
+		label: "Skip for now"
+	}] : [];
 }
 function pickEngineScreen(run) {
 	return async (model) => {
 		const total = run.deps.existingCount + run.created.length;
-		const finishChoice = {
-			value: FINISH,
-			label: finishLabel(run, model)
-		};
 		for (;;) {
 			const picked = await run.deps.prompts.select({
 				key: databaseKey(ordinalOf(run), "engine"),
 				message: "Which database engine?",
-				choices: [...run.deps.catalog.list().map(engineChoice), finishChoice],
+				choices: [...run.deps.catalog.list().map(engineChoice), ...finishChoices(run, model)],
 				...model.engine !== null && { initialValue: model.engine.key }
 			});
 			if (picked === "finish" && model.target !== null) return nextStub(run, model);
@@ -5518,6 +5519,13 @@ const METABASE_CONTENT_DIRS = [
 ];
 const TOKEN_USERNAMES = { "bitbucket.org": "x-token-auth" };
 const DEFAULT_TOKEN_USERNAME = "x-access-token";
+const MISSING_REF_EXIT_CODE = 1;
+const FIELD_SEPARATOR = "";
+const COMMIT_FORMAT = [
+	"%H",
+	"%h",
+	"%s"
+].join("%x1f");
 function credentialEnv(credentials) {
 	const { origin, hostname } = new URL(credentials.url);
 	const username = TOKEN_USERNAMES[hostname] ?? DEFAULT_TOKEN_USERNAME;
@@ -5531,6 +5539,18 @@ function credentialEnv(credentials) {
 		GIT_TERMINAL_PROMPT: "0"
 	};
 }
+function parseCommitLine(line) {
+	const [sha, shortSha, subject] = line.split(FIELD_SEPARATOR);
+	if (sha === void 0 || shortSha === void 0 || subject === void 0) throw new Error(`unexpected \`git log\` line: ${line}`);
+	return {
+		sha,
+		shortSha,
+		subject
+	};
+}
+function outputLines(stdout) {
+	return stdout.split("\n").filter((line) => line.length > 0);
+}
 async function directoryExists(path) {
 	try {
 		return (await promises.stat(path)).isDirectory();
@@ -5586,8 +5606,12 @@ function gitTool(runner) {
 		], { cwd: dir });
 		return result.exitCode === 0 && result.stdout.trim().length > 0;
 	}
-	async function commitAll(dir, message) {
-		await git(["add", "--all"], { cwd: dir });
+	async function commitPaths(dir, paths, message) {
+		await git([
+			"add",
+			"--",
+			...paths
+		], { cwd: dir });
 		await git([
 			...await hasIdentity(dir) ? [] : [
 				"-c",
@@ -5597,7 +5621,9 @@ function gitTool(runner) {
 			],
 			"commit",
 			"--message",
-			message
+			message,
+			"--",
+			...paths
 		], { cwd: dir });
 	}
 	async function addRemote(dir, name, url) {
@@ -5643,6 +5669,42 @@ function gitTool(runner) {
 		if (result.exitCode !== 0) return null;
 		return result.stdout.trim();
 	}
+	async function isBareRepo(path) {
+		const args = [
+			`--git-dir=${path}`,
+			"rev-parse",
+			"--is-bare-repository"
+		];
+		const result = await runner.run(GIT, args);
+		return result.exitCode === 0 && result.stdout.trim() === "true";
+	}
+	async function bareBranchCommits(path, branch) {
+		const gitDir = `--git-dir=${path}`;
+		const ref = `refs/heads/${branch}`;
+		const verifyArgs = [
+			gitDir,
+			"rev-parse",
+			"--verify",
+			"--quiet",
+			`${ref}^{commit}`
+		];
+		const verified = await runner.run(GIT, verifyArgs);
+		if (verified.exitCode === MISSING_REF_EXIT_CODE) return null;
+		if (verified.exitCode !== 0) throw toolFailure(GIT, verifyArgs, verified);
+		return outputLines((await git([
+			gitDir,
+			"-c",
+			"log.showSignature=false",
+			"log",
+			`--format=${COMMIT_FORMAT}`,
+			ref,
+			"--"
+		])).stdout).map(parseCommitLine);
+	}
+	async function reachableCommits(dir) {
+		const result = await git(["rev-list", "--all"], { cwd: dir });
+		return new Set(outputLines(result.stdout));
+	}
 	async function hasMetabaseContent(dir) {
 		for (const name of METABASE_CONTENT_DIRS) if (await directoryExists(join(dir, name))) return true;
 		return false;
@@ -5653,24 +5715,27 @@ function gitTool(runner) {
 		initBare,
 		init,
 		hasCommits,
-		commitAll,
+		commitPaths,
 		addRemote,
 		clone,
 		push,
 		currentBranch,
 		remoteUrl,
+		isBareRepo,
+		bareBranchCommits,
+		reachableCommits,
 		hasMetabaseContent
 	};
 }
 //#endregion
 //#region src/steps/git-sync.ts
-const STEP_ID$8 = "git-sync";
+const STEP_ID$7 = "git-sync";
 const GIT_SYNC_KEYS = {
-	location: `${STEP_ID$8}.location`,
-	path: `${STEP_ID$8}.path`,
-	remote: `${STEP_ID$8}.remote`,
-	url: `${STEP_ID$8}.url`,
-	token: `${STEP_ID$8}.token`
+	location: `${STEP_ID$7}.location`,
+	path: `${STEP_ID$7}.path`,
+	remote: `${STEP_ID$7}.remote`,
+	url: `${STEP_ID$7}.url`,
+	token: `${STEP_ID$7}.token`
 };
 const BARE_REPO_NAME = "content.git";
 const DEFAULT_BRANCH = "main";
@@ -5956,7 +6021,7 @@ async function prepareWorkdir(run, workdir) {
 	if (!await run.git.hasCommits(workdir)) {
 		await promises.writeFile(join(workdir, README_NAME), README_CONTENT);
 		await ignoreDataAppFiles(workdir);
-		await run.git.commitAll(workdir, INITIAL_COMMIT_MESSAGE);
+		await run.git.commitPaths(workdir, [README_NAME, GITIGNORE_NAME], INITIAL_COMMIT_MESSAGE);
 	}
 	return {
 		workdir,
@@ -6120,7 +6185,7 @@ function shellWord(value) {
 function exportCommand(profile, branch) {
 	return `${mbCommand(profile)} git-sync export -b ${shellWord(branch)}`;
 }
-function usageLines$1(state, gitRemote) {
+function usageLines(state, gitRemote) {
 	const profile = state.mbProfile;
 	return [
 		`cd ${gitRemote.workdir}`,
@@ -6171,18 +6236,18 @@ async function runGitSync(ctx, deps) {
 		...ctx.state,
 		gitRemote: remote.gitRemote
 	});
-	ctx.ui.note(usageLines$1(ctx.state, remote.gitRemote).join("\n"), "Working with the repository");
+	ctx.ui.note(usageLines(ctx.state, remote.gitRemote).join("\n"), "Working with the repository");
 	return "completed";
 }
 function gitSyncStep(deps = hostDeps$12) {
 	return {
-		id: STEP_ID$8,
+		id: STEP_ID$7,
 		title: "Connect a git repository",
 		redoHint: "`rde init --only git-sync` with it points Metabase's remote sync at that repository instead.",
 		async detect(ctx) {
 			if (!hasRemoteSync(ctx.state.license)) return "not-applicable";
-			if (ctx.state.steps[STEP_ID$8]?.status === "skipped") return "not-applicable";
-			if (ctx.state.gitRemote === null || ctx.state.steps[STEP_ID$8]?.status !== "done") return "todo";
+			if (ctx.state.steps[STEP_ID$7]?.status === "skipped") return "not-applicable";
+			if (ctx.state.gitRemote === null || ctx.state.steps[STEP_ID$7]?.status !== "done") return "todo";
 			const instance = mbInstanceOf(ctx.state, ctx.secrets);
 			if (instance === null) return "todo";
 			try {
@@ -6364,8 +6429,8 @@ function skillsCli(runner) {
 }
 //#endregion
 //#region src/steps/agents-skills.ts
-const STEP_ID$7 = "agents-skills";
-const AGENTS_SKILLS_KEYS = { agents: `${STEP_ID$7}.agents` };
+const STEP_ID$6 = "agents-skills";
+const AGENTS_SKILLS_KEYS = { agents: `${STEP_ID$6}.agents` };
 const MECHANICS_NOTE = "The rde skill's mechanics come from `mb skills get <name>` at runtime, so nothing else needs installing.";
 const REQUIRED_SKILL_NAMES = [...DATA_APP_SKILL_NAMES, ...RDE_SOURCE_SKILL_NAMES];
 const DETECT_AGENTS = { kind: "detected" };
@@ -6548,8 +6613,8 @@ function skipLine(all, source) {
 	switch (source) {
 		case "override":
 		case "chosen":
-		case "installed": return `Skipping the skills; run \`rde init --only ${STEP_ID$7}\` to install it later`;
-		case "detected": return `No coding agent found (${displayNames(all)}); run \`rde init --only ${STEP_ID$7} --agents <name>\` once one is installed`;
+		case "installed": return `Skipping the skills; run \`rde init --only ${STEP_ID$6}\` to install it later`;
+		case "detected": return `No coding agent found (${displayNames(all)}); run \`rde init --only ${STEP_ID$6} --agents <name>\` once one is installed`;
 	}
 }
 function agentsSkillsStep(options, updates, deps = hostDeps$11) {
@@ -6563,13 +6628,13 @@ function agentsSkillsStep(options, updates, deps = hostDeps$11) {
 		};
 	}
 	return {
-		id: STEP_ID$7,
+		id: STEP_ID$6,
 		title: "Install the rde and data-app skills for your coding agents",
 		redoHint: "`rde init --only agents-skills` with it installs the skills for those agents.",
 		async detect(ctx) {
 			const resolved = deps(ctx);
 			const detected = detectedOnly(await detectAgents(resolved.probe));
-			if (detected.length === 0) return ctx.state.steps[STEP_ID$7]?.status === "skipped" ? "not-applicable" : "todo";
+			if (detected.length === 0) return ctx.state.steps[STEP_ID$6]?.status === "skipped" ? "not-applicable" : "todo";
 			if (missingSkills(await skillsCli(resolved.runner).list(), detected).length > 0) return "todo";
 			const check = await setCheck(resolved);
 			for (const set of skillSets(resolved)) if (await setBehind(set, check)) return "outdated";
@@ -6617,8 +6682,10 @@ function agentsSkillsStep(options, updates, deps = hostDeps$11) {
 }
 //#endregion
 //#region src/steps/databases.ts
-const STEP_ID$6 = "databases";
-const SAMPLE_STANDS_IN = { request: "sample-stands-in" };
+const DATABASE_REQUIRED = { request: "required" };
+const WRITE_ACCESS = "Transforms write their tables to it, so connect it as a user that can create tables.";
+const NONE_CONNECTED = `rde init needs a database of your own to go on. ${WRITE_ACCESS}`;
+const NONE_NAMED = `rde init needs a database of your own and asks for one only at a terminal without --yes: pass --database <connection string>, or list it under "databases" in the --answers file. ${WRITE_ACCESS}`;
 function hostDatabasesDeps(signal) {
 	return {
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, signal),
@@ -6626,7 +6693,7 @@ function hostDatabasesDeps(signal) {
 		now: () => /* @__PURE__ */ new Date()
 	};
 }
-function requireApiKey$2(state, apiKey) {
+function requireApiKey$1(state, apiKey) {
 	if (apiKey === null) throw new ConfigError(`instance ${state.name} has no API key yet; run \`rde init\``);
 	return apiKey;
 }
@@ -6636,7 +6703,7 @@ function hostAliasOf(runtime) {
 		case "jar": return null;
 	}
 }
-function toRecord$1(database, createdAt) {
+function toRecord(database, createdAt) {
 	return {
 		id: database.id,
 		name: database.name,
@@ -6648,7 +6715,7 @@ function authenticatedClient(state, apiKey, deps) {
 	const configured = requireConfiguredRuntime(state);
 	return deps.client(configured.url, {
 		kind: "api-key",
-		key: requireApiKey$2(state, apiKey)
+		key: requireApiKey$1(state, apiKey)
 	});
 }
 async function listDatabases(state, apiKey, deps) {
@@ -6691,7 +6758,7 @@ async function connectDatabases(ctx, deps, opening) {
 		existingCount: existing.length,
 		readTextFile: deps.readTextFile,
 		onCreated: async (database) => {
-			const record = toRecord$1(database, deps.now().toISOString());
+			const record = toRecord(database, deps.now().toISOString());
 			await ctx.saveState({
 				...ctx.state,
 				databases: [...ctx.state.databases, record]
@@ -6708,6 +6775,7 @@ async function connectDatabases(ctx, deps, opening) {
 async function addDatabases(ctx, deps, options) {
 	const connected = await connectDatabases(ctx, deps, {
 		start: "engine",
+		required: false,
 		...options
 	});
 	return {
@@ -6715,13 +6783,11 @@ async function addDatabases(ctx, deps, options) {
 		result: { addedDatabases: connected.added }
 	};
 }
-async function askForOwnDatabase(ctx, deps) {
-	const connected = await connectDatabases(ctx, deps, {
-		start: "connection-string",
-		offerStubs: true
-	});
+async function connectRequired(ctx, deps, opening) {
+	const connected = await connectDatabases(ctx, deps, opening);
+	if (connected.existing + connected.created === 0) throw new ConfigError(NONE_CONNECTED);
 	return {
-		outcome: connected.created > 0 ? "completed" : "skipped",
+		outcome: "completed",
 		result: { addedDatabases: connected.added }
 	};
 }
@@ -6731,34 +6797,19 @@ function hostDeps$10(ctx) {
 		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal))
 	};
 }
-function sampleDatabaseId(state) {
-	return state.sampleDatabase === null ? null : state.sampleDatabase.databaseId;
-}
-function skippedBefore(state) {
-	return state.steps[STEP_ID$6]?.status === "skipped";
-}
-function ownDatabaseIds(state) {
-	const sampleId = sampleDatabaseId(state);
-	return new Set(state.databases.filter((record) => record.id !== sampleId).map((record) => record.id));
-}
 function databasesStep(options, deps = hostDeps$10) {
 	return {
-		id: STEP_ID$6,
+		id: "databases",
 		title: "Connect your databases",
 		redoHint: "Connect another with `rde db add --url <connection string>`.",
 		async detect(ctx) {
 			const configured = configuredRuntime(ctx.state);
 			if (configured === null || ctx.secrets.apiKey === null) return "todo";
-			const own = ownDatabaseIds(ctx.state);
-			const sampleId = sampleDatabaseId(ctx.state);
-			const asking = options.request === "ask-once" && !skippedBefore(ctx.state);
-			if (own.size === 0 && !asking) {
-				if (options.request === "named") return "todo";
-				return sampleId !== null || skippedBefore(ctx.state) ? "done" : "todo";
-			}
+			const recorded = new Set(ctx.state.databases.map((record) => record.id));
+			if (recorded.size === 0 && options.request === "named") return "todo";
 			const resolved = deps(ctx);
 			if (!await resolved.instanceRunning()) return "todo";
-			const isOwn = (id) => own.size > 0 ? own.has(id) : id !== sampleId;
+			const isOwn = (id) => recorded.size === 0 || recorded.has(id);
 			const client = resolved.client(configured.url, {
 				kind: "api-key",
 				key: ctx.secrets.apiKey
@@ -6772,9 +6823,19 @@ function databasesStep(options, deps = hostDeps$10) {
 		},
 		async run(ctx) {
 			switch (options.request) {
-				case "ask-once": return askForOwnDatabase(ctx, deps(ctx));
-				case "named": return addDatabases(ctx, deps(ctx), { offerStubs: false });
-				case "sample-stands-in": return { outcome: "skipped" };
+				case "ask":
+					ctx.ui.info(NONE_CONNECTED);
+					return connectRequired(ctx, deps(ctx), {
+						start: "connection-string",
+						offerStubs: true,
+						required: true
+					});
+				case "named": return connectRequired(ctx, deps(ctx), {
+					start: "engine",
+					offerStubs: false,
+					required: true
+				});
+				case "required": throw new ConfigError(NONE_NAMED);
 			}
 		}
 	};
@@ -7028,23 +7089,44 @@ function installMbStep(updates, deps = hostDeps$9) {
 const STEP_ID$4 = "license";
 const LICENSE_KEYS = { token: `${STEP_ID$4}.token` };
 const TOKEN_PATTERN = /^[0-9a-f]{64}$/i;
-const NOT_FOUND_STATUS$2 = 404;
+const NOT_FOUND_STATUS$1 = 404;
+const TOKEN_REFUSED_STATUS = 400;
+const STORE_UNREACHABLE_STATUS = 503;
+const TOKEN_CHECK_HOST = "token-check.metabase.com";
+const ACTIVATION_FAILED = "License activation failed";
+const LICENSED_FEATURES = {
+	[REMOTE_SYNC_FEATURE]: "remote sync",
+	"data-apps": "data apps",
+	"transforms-testing": "transform tests"
+};
+const LICENSED_FEATURE_NAMES = Object.values(LICENSED_FEATURES);
+function licensedFeatureCoverage(features) {
+	const entries = Object.entries(LICENSED_FEATURES);
+	return {
+		included: entries.filter(([key]) => features.includes(key)).map(([, name]) => name),
+		missing: entries.filter(([key]) => !features.includes(key)).map(([, name]) => name)
+	};
+}
+function listOf(names, type) {
+	return new Intl.ListFormat("en", { type }).format(names);
+}
 function hostDeps$8(ctx) {
 	return {
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
 		runner: processRunner(ctx.signal),
-		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal))
+		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal)),
+		terminal: stdinIsTty()
 	};
 }
 function isNoTokenYet(error) {
-	if (error instanceof MetabaseApiError) return error.status === NOT_FOUND_STATUS$2;
+	if (error instanceof MetabaseApiError) return error.status === NOT_FOUND_STATUS$1;
 	return isMetabaseNotServing(error);
 }
 function validateToken(value) {
 	if (value.length === 0 || TOKEN_PATTERN.test(value)) return;
 	return "A license token is 64 hexadecimal characters";
 }
-function requireApiKey$1(ctx) {
+function requireApiKey(ctx) {
 	if (ctx.secrets.apiKey === null) throw new ConfigError("no API key yet; the api-key step comes first");
 	return ctx.secrets.apiKey;
 }
@@ -7052,6 +7134,67 @@ function activeLabel(status) {
 	const plan = status["plan-alias"];
 	return plan === void 0 ? "License active" : `License active (plan ${plan})`;
 }
+function refusalOf(error) {
+	if (!(error instanceof MetabaseApiError)) return null;
+	if (error.status === TOKEN_REFUSED_STATUS) return new ConfigError(`The license token was refused: ${error.reason}`);
+	if (error.status === STORE_UNREACHABLE_STATUS) return new ConfigError(`The instance could not reach ${TOKEN_CHECK_HOST} to check the license token; it needs outbound network access`);
+	return null;
+}
+async function activate(client, token) {
+	try {
+		await client.setting.setPremiumEmbeddingToken(token);
+	} catch (error) {
+		const refusal = refusalOf(error);
+		if (refusal === null) throw error;
+		return {
+			kind: "refused",
+			error: refusal
+		};
+	}
+	const status = await client.tokenStatus.get();
+	if (!status.valid) return {
+		kind: "refused",
+		error: new ConfigError(`Metabase reports the token as ${status.status}`)
+	};
+	return {
+		kind: "activated",
+		status
+	};
+}
+async function activateAskedToken(ctx, client, terminal) {
+	const token = await ctx.prompts.password({
+		key: LICENSE_KEYS.token,
+		message: "Paste your Metabase license token (Enter to skip)",
+		validate: validateToken
+	});
+	if (token.length === 0) return null;
+	const spinner = ctx.ui.spinner("Activating the license…");
+	let activation;
+	try {
+		activation = await activate(client, token);
+	} catch (error) {
+		spinner.fail(ACTIVATION_FAILED);
+		throw error;
+	}
+	if (activation.kind === "activated") {
+		spinner.stop(activeLabel(activation.status));
+		ctx.session.licenseToken.set(token);
+		return activation.status;
+	}
+	spinner.fail(ACTIVATION_FAILED);
+	if (!terminal) throw activation.error;
+	ctx.ui.warn(activation.error.message);
+	return activateAskedToken(ctx, client, terminal);
+}
+function reportFeatures(ctx, features) {
+	const { missing } = licensedFeatureCoverage(features);
+	const remoteSync = features.includes(REMOTE_SYNC_FEATURE);
+	if (remoteSync) ctx.ui.info("Remote sync is included; the git step will set it up");
+	if (missing.length > 0) {
+		const gitNote = remoteSync ? "" : "; the git step will be skipped";
+		ctx.ui.warn(`This license does not include ${listOf(missing, "disjunction")}${gitNote}`);
+	}
+}
 function licenseStep(deps = hostDeps$8) {
 	return {
 		id: STEP_ID$4,
@@ -7076,36 +7219,17 @@ function licenseStep(deps = hostDeps$8) {
 		},
 		async run(ctx) {
 			const configured = requireConfiguredRuntime(ctx.state);
-			const apiKey = requireApiKey$1(ctx);
-			const token = await ctx.prompts.password({
-				key: LICENSE_KEYS.token,
-				message: "Paste your Metabase license token (Enter to skip)",
-				validate: validateToken
-			});
-			if (token.length === 0) {
-				ctx.ui.info("Skipping the license; remote sync needs one. Run `rde init --from license` to add it later");
-				return { outcome: "skipped" };
-			}
-			ctx.session.licenseToken.set(token);
+			const apiKey = requireApiKey(ctx);
 			const resolved = deps(ctx);
-			const client = resolved.client(configured.url, {
+			const status = await activateAskedToken(ctx, resolved.client(configured.url, {
 				kind: "api-key",
 				key: apiKey
-			});
-			const spinner = ctx.ui.spinner("Activating the license…");
-			let status;
-			try {
-				await client.setting.setPremiumEmbeddingToken(token);
-				status = await client.tokenStatus.get();
-			} catch (error) {
-				spinner.fail("License activation failed");
-				throw error;
-			}
-			if (!status.valid) {
-				spinner.fail("License activation failed");
-				throw new ConfigError(`Metabase reports the token as ${status.status}`);
+			}), resolved.terminal);
+			if (status === null) {
+				const lost = listOf(LICENSED_FEATURE_NAMES, "conjunction");
+				ctx.ui.info(`Skipping the license; ${lost} need one. Run \`rde init --from license\` to add it later`);
+				return { outcome: "skipped" };
 			}
-			spinner.stop(activeLabel(status));
 			await ctx.saveState({
 				...ctx.state,
 				license: {
@@ -7120,8 +7244,7 @@ function licenseStep(deps = hostDeps$8) {
 				profile: ctx.state.mbProfile,
 				apiKey
 			});
-			if (status.features.includes("remote-sync")) ctx.ui.info("Remote sync is included; the git step will set it up");
-			else ctx.ui.warn("This license does not include remote sync; the git step will be skipped");
+			reportFeatures(ctx, status.features);
 			return { outcome: "completed" };
 		}
 	};
@@ -7134,7 +7257,7 @@ const NODE_HINT = `Install Node ${MIN_NODE_VERSION} or newer from https://nodejs
 const MARK_OK = "✓";
 const MARK_MISSING = "✗";
 const MARK_OPTIONAL = "–";
-const DOCKER_OPTIONAL_NOTE = `Metabase can run as a jar with Java instead, without the sample database`;
+const DOCKER_OPTIONAL_NOTE = `Metabase can run as a jar with Java instead`;
 const JAVA_OPTIONAL_NOTE = `Metabase can run in Docker instead`;
 const PLATFORMS = {
 	darwin: {
@@ -7460,210 +7583,12 @@ function runtimeStep(options, deps = hostDeps$6) {
 		}
 	};
 }
-//#endregion
-//#region src/steps/sample-database.ts
-const STEP_ID$2 = "sample-database";
-const SAMPLE_DATABASE_DISPLAY_NAME = "Sample Database";
-const POSTGRES_ENGINE = "postgres";
-const NOT_FOUND_STATUS$1 = 404;
-function hostDeps$5(ctx) {
-	return {
-		runtime: hostRuntimeDeps(ctx.state.name, ctx.signal),
-		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
-		readyTimeoutMs: SAMPLE_DATABASE_READY_TIMEOUT_MS,
-		now: () => /* @__PURE__ */ new Date()
-	};
-}
-function isNotFound$2(error) {
-	return error instanceof MetabaseApiError && error.status === NOT_FOUND_STATUS$1;
-}
-function requireApiKey(ctx) {
-	if (ctx.secrets.apiKey === null) throw new ConfigError(`instance ${ctx.state.name} has no API key yet; run \`rde init\``);
-	return ctx.secrets.apiKey;
-}
-async function recordedDatabase(record, client) {
-	if (record.databaseId === null) return null;
-	try {
-		return await client.database.get(record.databaseId);
-	} catch (error) {
-		if (isNotFound$2(error)) return null;
-		throw error;
-	}
-}
-async function persistedRecord(ctx, deps) {
-	const existing = ctx.state.sampleDatabase;
-	if (existing !== null) {
-		if ((await sampleDatabaseContainer(existing, deps.runtime.docker, deps.runtime.rdeHome).status()).installed || await deps.runtime.ports.isFree(existing.port)) return {
-			record: existing,
-			staleDatabaseId: null
-		};
-		const pointer = existing.databaseId === null ? "" : `; Metabase database ${existing.databaseId} still points at the old one`;
-		ctx.ui.warn(`Port ${existing.port} is in use by another program; the sample database moves to a new port${pointer}`);
-	}
-	const claims = await portClaims(ctx.state, deps.runtime);
-	const port = await deps.runtime.ports.findFree(SAMPLE_DATABASE_PORT, claims);
-	if (port !== 25432) ctx.ui.warn(`Port ${SAMPLE_DATABASE_PORT} is in use or claimed; using ${port} for the sample database`);
-	const record = {
-		containerName: sampleContainerName(ctx.state.name, deps.runtime.rdeHome),
-		image: SAMPLE_DATABASE_IMAGE,
-		port,
-		databaseId: null
-	};
-	await ctx.saveState({
-		...ctx.state,
-		sampleDatabase: record
-	});
-	return {
-		record,
-		staleDatabaseId: existing?.databaseId ?? null
-	};
-}
-const LINUX = "linux";
-async function gatewayAddress(ctx, deps) {
-	if (!(ctx.state.runtime?.kind === "docker") || deps.runtime.platform !== LINUX) return null;
-	return deps.runtime.docker.bridgeGateway();
-}
-async function recordSampleDatabaseMove(ctx, from, to) {
-	ctx.ui.warn(`Port ${from.port} is taken; the sample database moved to ${to.port}`);
-	const record = {
-		...to,
-		databaseId: null
-	};
-	await ctx.saveState({
-		...ctx.state,
-		sampleDatabase: record,
-		databases: ctx.state.databases.filter((entry) => entry.id !== from.databaseId)
-	});
-	return record;
-}
-async function installAndStart(ctx, sidecar, installed, deps) {
-	const installing = ctx.ui.spinner(`Installing the sample database from ${installed.image}`);
-	try {
-		await sidecar.install({
-			onProgress: (line) => installing.update(line),
-			alsoOn: await gatewayAddress(ctx, deps)
-		});
-	} catch (error) {
-		installing.fail("Sample database install failed");
-		throw error;
-	}
-	installing.stop(`Sample database container ${installed.containerName} on port ${installed.port}`);
-	const started = await startOnFreePort(installed, deps.runtime.docker, deps.runtime.rdeHome);
-	const record = started.state.port === installed.port ? installed : await recordSampleDatabaseMove(ctx, installed, started.state);
-	const waiting = ctx.ui.spinner("Waiting for Postgres to accept connections…");
-	try {
-		await sidecar.waitReady({
-			timeoutMs: deps.readyTimeoutMs,
-			signal: ctx.signal
-		});
-	} catch (error) {
-		waiting.fail("Postgres did not become ready");
-		throw error;
-	}
-	waiting.stop(`Postgres is ready on ${LOOPBACK_HOST}:${record.port}`);
-	return record;
-}
-function connectionDetails(record, configured, deps) {
-	const alias = runtimeFromState(configured.runtime, deps.runtime).hostAlias();
-	return applyHostAlias({
-		host: "localhost",
-		port: record.port,
-		dbname: SAMPLE_DATABASE_NAME,
-		user: SAMPLE_DATABASE_USER,
-		password: SAMPLE_DATABASE_PASSWORD
-	}, alias).details;
-}
-function toRecord(database, createdAt) {
-	return {
-		id: database.id,
-		name: database.name,
-		engine: database.engine,
-		createdAt
-	};
-}
-async function connectDatabase(ctx, choice, configured, client, deps) {
-	const { record } = choice;
-	const known = await recordedDatabase(record, client);
-	if (known !== null) {
-		ctx.ui.info(`${known.name} is already connected as database ${known.id}`);
-		return known;
-	}
-	const spinner = ctx.ui.spinner(`Connecting ${SAMPLE_DATABASE_DISPLAY_NAME}…`);
-	let database;
-	try {
-		database = await client.database.create({
-			name: SAMPLE_DATABASE_DISPLAY_NAME,
-			engine: POSTGRES_ENGINE,
-			details: connectionDetails(record, configured, deps)
-		});
-	} catch (error) {
-		spinner.fail(`Could not connect ${SAMPLE_DATABASE_DISPLAY_NAME}`);
-		throw error;
-	}
-	const stale = /* @__PURE__ */ new Set([record.databaseId, choice.staleDatabaseId]);
-	const others = ctx.state.databases.filter((entry) => !stale.has(entry.id));
-	await ctx.saveState({
-		...ctx.state,
-		sampleDatabase: {
-			...record,
-			databaseId: database.id
-		},
-		databases: [...others, toRecord(database, deps.now().toISOString())]
-	});
-	spinner.stop(`Connected ${database.name} as database ${database.id}`);
-	return database;
-}
-function usageLines(record) {
-	return [`psql "${sampleDatabaseUrl(record.port)}"`, "Transforms can write to this database."].join("\n");
-}
-function sampleDatabaseStep(deps = hostDeps$5) {
-	return {
-		id: STEP_ID$2,
-		title: "Connect a sample database",
-		async detect(ctx) {
-			const resolved = deps(ctx);
-			if (!(await resolved.runtime.docker.available()).available) return "not-applicable";
-			const record = ctx.state.sampleDatabase;
-			const configured = configuredRuntime(ctx.state);
-			if (record === null || configured === null || ctx.secrets.apiKey === null) return "todo";
-			if (!(await sampleDatabaseContainer(record, resolved.runtime.docker, resolved.runtime.rdeHome).status()).installed || !await isInstanceRunning(ctx.state, resolved.runtime)) return "todo";
-			const client = resolved.client(configured.url, {
-				kind: "api-key",
-				key: ctx.secrets.apiKey
-			});
-			try {
-				return await recordedDatabase(record, client) === null ? "todo" : "done";
-			} catch (error) {
-				if (isMetabaseNotServing(error) || isRejectedCredential(error)) return "todo";
-				throw error;
-			}
-		},
-		async run(ctx) {
-			const resolved = deps(ctx);
-			const configured = requireConfiguredRuntime(ctx.state);
-			const apiKey = requireApiKey(ctx);
-			const docker = await resolved.runtime.docker.available();
-			if (!docker.available) throw new ConfigError(`the sample database runs in Docker, which is not available: ${docker.reason}`);
-			const persisted = await persistedRecord(ctx, resolved);
-			const record = await installAndStart(ctx, sampleDatabaseContainer(persisted.record, resolved.runtime.docker, resolved.runtime.rdeHome), persisted.record, resolved);
-			await connectDatabase(ctx, {
-				...persisted,
-				record
-			}, configured, resolved.client(configured.url, {
-				kind: "api-key",
-				key: apiKey
-			}), resolved);
-			ctx.ui.note(usageLines(record), "Sample database");
-			return { outcome: "completed" };
-		}
-	};
-}
 const DEFAULT_HEALTH_TIMING = { timeoutMs: 3e5 };
 //#endregion
 //#region src/steps/start-metabase.ts
 const LOG_TAIL_ON_TIMEOUT = 30;
 const PERCENT = 100;
-function hostDeps$4(ctx) {
+function hostDeps$5(ctx) {
 	return {
 		runtime: hostRuntimeDeps(ctx.state.name, ctx.signal),
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
@@ -7679,21 +7604,6 @@ async function runningVersion(client) {
 function progressLabel(progress) {
 	return `Starting Metabase… ${Math.round(progress * PERCENT)}%`;
 }
-async function startSampleDatabase(ctx, deps) {
-	const record = ctx.state.sampleDatabase;
-	if (record === null) return;
-	const started = await startOnFreePort(record, deps.runtime.docker, deps.runtime.rdeHome);
-	if (started.state.port !== record.port) await recordSampleDatabaseMove(ctx, record, started.state);
-	switch (started.outcome) {
-		case "missing":
-			ctx.ui.warn(`Sample database container ${record.containerName} is missing; \`rde init\` recreates it`);
-			return;
-		case "started":
-			ctx.ui.info(`Sample database container ${record.containerName} started`);
-			return;
-		case "running": return;
-	}
-}
 async function withMoveHint(ctx, deps, taken) {
 	const claims = await portClaims(ctx.state, deps.runtime);
 	const free = await deps.runtime.ports.findFree(taken.port + 1, claims);
@@ -7707,7 +7617,7 @@ async function startRuntime(ctx, runtime, deps) {
 		throw error;
 	}
 }
-function startMetabaseStep(deps = hostDeps$4) {
+function startMetabaseStep(deps = hostDeps$5) {
 	return {
 		id: "start-metabase",
 		title: "Start Metabase",
@@ -7730,7 +7640,6 @@ function startMetabaseStep(deps = hostDeps$4) {
 			const runtime = runtimeFromState(configured.runtime, resolved.runtime);
 			const client = resolved.client(configured.url, NO_AUTH);
 			await startRuntime(ctx, runtime, resolved);
-			await startSampleDatabase(ctx, resolved);
 			const spinner = ctx.ui.spinner("Starting Metabase…");
 			let shown = 0;
 			try {
@@ -7766,6 +7675,261 @@ function startMetabaseStep(deps = hostDeps$4) {
 	};
 }
 //#endregion
+//#region src/steps/sync-scope.ts
+const STEP_ID$2 = "sync-scope";
+const SYNC_SCOPE_KEYS = { export: `${STEP_ID$2}.export` };
+const AGENT_COLLECTION_NAME = "Analytics";
+const LIBRARY_NAME = "Library";
+const ROOT_COLLECTION_NAME = "Our analytics";
+const AGENT_COLLECTION_DESCRIPTION = "Dashboards, questions, models, and documents that reach git on export.";
+function hostDeps$4(ctx) {
+	return {
+		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
+		runner: processRunner(ctx.signal),
+		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal))
+	};
+}
+function isCollection(entry) {
+	return typeof entry.id === "number";
+}
+function isOrdinary(collection) {
+	return collection.type === null && collection.namespace === null && collection.personal_owner_id === null;
+}
+function readScope(list, syncRoot) {
+	const topLevel = list.filter(isCollection).filter((collection) => collection.location === "/");
+	const ordinary = topLevel.filter(isOrdinary);
+	const unsynced = ordinary.filter((collection) => !collection.is_remote_synced);
+	return {
+		library: topLevel.find((collection) => collection.type === "library") ?? null,
+		syncedRoots: ordinary.filter((collection) => collection.is_remote_synced),
+		unsyncedRecordedRoot: unsynced.find((collection) => collection.id === syncRoot) ?? null,
+		foreignNamesake: unsynced.some((collection) => collection.id !== syncRoot && collection.name === "Analytics")
+	};
+}
+function isComplete(scope, libraryLicensed) {
+	return (!libraryLicensed || scope.library !== null && scope.library.is_remote_synced) && scope.syncedRoots.length > 0;
+}
+function isNotAnsweringYet(error) {
+	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError || isRejectedCredential(error);
+}
+function requireMbInstance(ctx) {
+	const instance = mbInstanceOf(ctx.state, ctx.secrets);
+	if (instance === null) throw new ConfigError("no API key yet; the api-key step comes first");
+	return instance;
+}
+function requireGitRemote(ctx) {
+	if (ctx.state.gitRemote === null) throw new ConfigError("no repository yet; the git-sync step comes first");
+	return ctx.state.gitRemote;
+}
+async function requireSettledImport(ctx, client, gitRemote) {
+	const task = await client.remoteSync.currentTask();
+	if (task === null) return;
+	if (task.status === "running") throw new ConfigError(`a remote sync ${task.sync_task_type} is running; run \`rde init --only ${STEP_ID$2}\` once it finishes`);
+	if (task.sync_task_type === "import" && task.status !== "successful") {
+		const importCommand = `${mbCommand(ctx.state.mbProfile)} git-sync import --branch ${shellWord(gitRemote.branch)}`;
+		throw new ConfigError(`the last import from the repository ended ${task.status}; run \`${importCommand}\`, then \`rde init --only ${STEP_ID$2}\``);
+	}
+}
+async function isReadOnly(client) {
+	return await client.setting.remoteSyncType() === "read-only";
+}
+async function requireReadWrite(client) {
+	if (await isReadOnly(client)) throw new ConfigError(`remote sync is read-only; the repository decides what syncs. Switch it to read-write in Admin, then \`rde init --only ${STEP_ID$2}\``);
+}
+async function ensureLibrary(client, scope, libraryLicensed) {
+	if (!libraryLicensed) return null;
+	return scope.library ?? client.collection.createLibrary();
+}
+async function ensureRoots(ctx, client, scope) {
+	if (scope.syncedRoots.length > 0) return {
+		roots: scope.syncedRoots,
+		created: false,
+		besideNamesake: false
+	};
+	if (scope.unsyncedRecordedRoot !== null) return {
+		roots: [scope.unsyncedRecordedRoot],
+		created: false,
+		besideNamesake: false
+	};
+	const created = await client.collection.create({
+		name: AGENT_COLLECTION_NAME,
+		description: AGENT_COLLECTION_DESCRIPTION
+	});
+	await ctx.saveState({
+		...ctx.state,
+		syncRoot: created.id
+	});
+	return {
+		roots: [created],
+		created: true,
+		besideNamesake: scope.foreignNamesake
+	};
+}
+function itemLabel(item) {
+	return item.name === null ? `${item.model} ${item.id}` : `${item.model} ${item.id} "${item.name}"`;
+}
+function locationLabel(location) {
+	if (location === void 0) return "in a collection Metabase could not find";
+	return `in ${location === null ? ROOT_COLLECTION_NAME : location.name}`;
+}
+function dependencyLine(dependency) {
+	const line = `  ${itemLabel(dependency)} ${locationLabel(dependency.collection)}`;
+	if (dependency.used_by.length === 0) return line;
+	return `${line}, used by ${dependency.used_by.map(itemLabel).join(", ")}`;
+}
+function remedyLine(required) {
+	const remedy = required.remedy;
+	switch (remedy.type) {
+		case "collection":
+			if (required.syncable) return `  Fix: sync ${remedy.collection.name} too, or move that content into a synced collection.`;
+			return `  Fix: move that content into a synced collection; ${remedy.collection.name} cannot sync.`;
+		case "library": return "  Fix: stop using that content; it syncs only through a Library, and this instance has none.";
+		case "none": return "  Fix: move that content into a synced collection, or stop using it.";
+	}
+}
+function requiredSyncLines(required) {
+	return [
+		`Metabase will not sync ${required.blocks.map((collection) => collection.name).join(", ")}, because content there uses:`,
+		...required.dependencies.map(dependencyLine),
+		remedyLine(required)
+	];
+}
+function explainRefusal(error) {
+	if (!(error instanceof MetabaseApiError) || error.code !== "unsynced-dependencies") return error;
+	const refusal = UnsyncedDependencies.safeParse(error.detail);
+	if (!refusal.success) return error;
+	return new ConfigError([...refusal.data.errors.required.flatMap(requiredSyncLines), `After the fix, run \`rde init --only ${STEP_ID$2}\`.`].join("\n"));
+}
+function plannedNames(scope, libraryLicensed) {
+	const library = libraryLicensed ? [scope.library?.name ?? LIBRARY_NAME] : [];
+	if (scope.syncedRoots.length > 0) return [...library, ...scope.syncedRoots.map((collection) => collection.name)];
+	return [...library, scope.unsyncedRecordedRoot?.name ?? "Analytics"];
+}
+function nameList(names) {
+	if (names.length <= 2) return names.join(" and ");
+	return `${names.slice(0, -1).join(", ")}, and ${names.at(-1)}`;
+}
+function exportAdvice(profile, branch, changes) {
+	const command = exportCommand(profile, branch);
+	if (!remoteMoved(changes)) return `\`${command}\``;
+	return `the branch has commits Metabase has not imported; \`${mbCommand(profile)} git-sync export-preflight\`, then \`${command} --merge\``;
+}
+async function planExport(ctx, runner, instance, names) {
+	const changes = await mbTool(runner).gitSyncHasRemoteChanges(instance);
+	if (remoteMoved(changes)) return {
+		changes,
+		push: false
+	};
+	return {
+		changes,
+		push: await ctx.prompts.confirm({
+			key: SYNC_SCOPE_KEYS.export,
+			message: `Push ${nameList(names)} to ${requireGitRemote(ctx).branch} now?`,
+			initialValue: true
+		})
+	};
+}
+function describeExport(task) {
+	const ended = `the export ended ${task.status}`;
+	return task.error_message === null || task.error_message === void 0 ? ended : `${ended}: ${task.error_message}`;
+}
+function reportPending(run) {
+	const advice = exportAdvice(run.ctx.state.mbProfile, run.gitRemote.branch, run.changes);
+	run.ctx.ui.info(`First export pending: ${advice}`);
+}
+async function exportScope(run, runner) {
+	const mb = mbTool(runner);
+	const label = nameList(run.names);
+	const spinner = run.ctx.ui.spinner(`Pushing ${label} to ${run.gitRemote.branch}…`);
+	try {
+		const final = (await mb.gitSyncExport(run.instance, {
+			branch: run.gitRemote.branch,
+			message: `Sync ${label}`
+		})).final ?? null;
+		if (final !== null && final.status !== "successful") {
+			spinner.fail(describeExport(final));
+			reportPending(run);
+			return;
+		}
+		const status = await mb.gitSyncStatus(run.instance);
+		spinner.stop(`Pushed ${label} to ${run.gitRemote.branch}`);
+		if (status.is_dirty) run.ctx.ui.warn(`Metabase still has changes the export did not carry; \`${mbCommand(run.ctx.state.mbProfile)} git-sync dirty\` lists them`);
+	} catch (error) {
+		if (!(error instanceof ExternalToolError)) throw error;
+		spinner.fail(`Could not push ${label}: ${error.message}`);
+		reportPending(run);
+	}
+}
+function scopeLabel(synced) {
+	return `Synced to git: ${synced.map((collection) => collection.name).join(", ")}`;
+}
+function syncScopeStep(deps = hostDeps$4) {
+	return {
+		id: STEP_ID$2,
+		title: "Choose what syncs to git",
+		async detect(ctx) {
+			if (!hasRemoteSync(ctx.state.license) || ctx.state.gitRemote === null) return "not-applicable";
+			const configured = configuredRuntime(ctx.state);
+			if (configured === null || ctx.secrets.apiKey === null) return "todo";
+			const resolved = deps(ctx);
+			if (!await resolved.instanceRunning()) return "todo";
+			const client = resolved.client(configured.url, {
+				kind: "api-key",
+				key: ctx.secrets.apiKey
+			});
+			try {
+				if (isComplete(readScope(await client.collection.list(), ctx.state.syncRoot), hasLibrary(ctx.state.license))) return "done";
+				return await isReadOnly(client) ? "not-applicable" : "todo";
+			} catch (error) {
+				if (isNotAnsweringYet(error)) return "todo";
+				throw error;
+			}
+		},
+		async run(ctx) {
+			requireConfiguredRuntime(ctx.state);
+			const gitRemote = requireGitRemote(ctx);
+			const instance = requireMbInstance(ctx);
+			const resolved = deps(ctx);
+			const client = resolved.client(instance.url, {
+				kind: "api-key",
+				key: instance.apiKey
+			});
+			await requireReadWrite(client);
+			await requireSettledImport(ctx, client, gitRemote);
+			const libraryLicensed = hasLibrary(ctx.state.license);
+			const scope = readScope(await client.collection.list(), ctx.state.syncRoot);
+			const names = plannedNames(scope, libraryLicensed);
+			const plan = isComplete(scope, libraryLicensed) ? null : await planExport(ctx, resolved.runner, instance, names);
+			const spinner = ctx.ui.spinner("Choosing what syncs to git…");
+			let synced;
+			let chosen;
+			try {
+				const library = await ensureLibrary(client, scope, libraryLicensed);
+				chosen = await ensureRoots(ctx, client, scope);
+				synced = library === null ? chosen.roots : [library, ...chosen.roots];
+				await client.remoteSync.updateScope({ collections: Object.fromEntries(synced.map((collection) => [collection.id, true])) });
+			} catch (error) {
+				spinner.fail("Could not choose what syncs to git");
+				throw explainRefusal(error);
+			}
+			spinner.stop(scopeLabel(synced));
+			if (chosen.created) ctx.ui.info(`Created the ${AGENT_COLLECTION_NAME} collection: dashboards, questions, models, and documents filed under it reach git on the next export`);
+			if (chosen.besideNamesake) ctx.ui.info(`Another collection is also named ${AGENT_COLLECTION_NAME}; rde did not create it, so it stays out of git`);
+			if (plan === null) return { outcome: "completed" };
+			const exportRun = {
+				ctx,
+				instance,
+				gitRemote,
+				names,
+				changes: plan.changes
+			};
+			if (plan.push) await exportScope(exportRun, resolved.runner);
+			else reportPending(exportRun);
+			return { outcome: "completed" };
+		}
+	};
+}
+//#endregion
 //#region src/steps/summary.ts
 const STEP_ID$1 = "summary";
 const GIT_SYNC_STEP_ID = "git-sync";
@@ -7823,6 +7987,19 @@ function gitLines(state) {
 	if (state.gitRemote === null) return [`Remote sync: not configured (${notConfiguredReason(state)})`];
 	return [`Content repository: ${state.gitRemote.workdir} (branch ${state.gitRemote.branch})`, remoteLine(state.gitRemote)];
 }
+async function pendingExportLines(state, secrets, runner) {
+	const instance = mbInstanceOf(state, secrets);
+	if (state.gitRemote === null || instance === null) return [];
+	try {
+		const mb = mbTool(runner);
+		if (!(await mb.gitSyncStatus(instance)).is_dirty) return [];
+		const changes = await mb.gitSyncHasRemoteChanges(instance);
+		return [`Export pending: ${exportAdvice(state.mbProfile, state.gitRemote.branch, changes)}`];
+	} catch (error) {
+		if (error instanceof ProcessNotFoundError || error instanceof ExternalToolError) return [`Remote sync: ${error.message}`];
+		throw error;
+	}
+}
 function skillLine(entries, detected) {
 	const agents = [...new Set(entries.flatMap((entry) => coveredAgentNames(entry, detected)))];
 	if (agents.length === 0) return `rde skill: not installed; \`rde init --only agents-skills\``;
@@ -7834,15 +8011,15 @@ function launchLines(agents, workdir) {
 	const prefix = workdir === null ? "" : `cd ${workdir} && `;
 	return ["Start working:", ...detected.map((agent) => `  ${prefix}${agent.launch}  (${agent.displayName})`)];
 }
-async function summaryLines(state, apiKey, deps) {
+async function summaryLines(state, secrets, deps) {
 	const profile = state.mbProfile;
 	const lines = [];
 	if (state.url !== null) lines.push(`Metabase: ${state.url}`);
 	if (state.admin !== null) lines.push(loginLine(state.admin.kind, state.admin.email));
 	lines.push(profile === "default" ? `Metabase CLI: ${mbCommand(profile)} <command>` : `Metabase CLI: ${mbCommand(profile)} <command>  or  export MB_PROFILE=${profile}`);
-	lines.push(...await databaseLines$1(state, apiKey, deps));
-	if (state.sampleDatabase !== null) lines.push(`Sample database: psql "${sampleDatabaseUrl(state.sampleDatabase.port)}"`);
+	lines.push(...await databaseLines$1(state, secrets.apiKey, deps));
 	lines.push(...gitLines(state));
+	lines.push(...await pendingExportLines(state, secrets, deps.runner));
 	const installed = await skillsCli(deps.runner).list();
 	const agents = await detectAgents(deps.probe);
 	const detected = agents.filter((agent) => agent.detected);
@@ -7859,7 +8036,7 @@ function summaryStep(deps = hostDeps$3) {
 			return "todo";
 		},
 		async run(ctx) {
-			const lines = await summaryLines(ctx.state, ctx.secrets.apiKey, deps(ctx));
+			const lines = await summaryLines(ctx.state, ctx.secrets, deps(ctx));
 			ctx.ui.note(lines.join("\n"), "Your environment");
 			return { outcome: "completed" };
 		}
@@ -7917,7 +8094,7 @@ const DEFAULT_STEP_OPTIONS = {
 	runtime: NO_RUNTIME_FLAGS,
 	agents: DETECT_AGENTS,
 	admin: DEFAULT_ADMIN,
-	databases: SAMPLE_STANDS_IN,
+	databases: DATABASE_REQUIRED,
 	updates: "published"
 };
 const LOCAL_STEP_OPTIONS = {
@@ -7933,10 +8110,10 @@ const STEP_BY_ID = {
 	"admin-user": (options) => adminUserStep(options.admin),
 	"api-key": () => apiKeyStep(),
 	transforms: () => transformsStep(),
-	"sample-database": () => sampleDatabaseStep(),
 	license: () => licenseStep(),
 	databases: (options) => databasesStep(options.databases),
 	"git-sync": () => gitSyncStep(),
+	"sync-scope": () => syncScopeStep(),
 	summary: () => summaryStep()
 };
 function initSteps(options) {
@@ -8009,7 +8186,7 @@ const SECTIONS = {
 	}).optional(),
 	"api-key": z.strictObject({ profile: MbProfileChoice }).optional(),
 	license: z.strictObject({ token: EnvString.nullable() }).optional(),
-	databases: z.array(DatabaseEntry).optional(),
+	databases: z.array(DatabaseEntry).min(1, "a database is required: list one, or leave the section out to be asked at a terminal").optional(),
 	"git-sync": z.strictObject({
 		location: z.enum([
 			"here",
@@ -8021,7 +8198,8 @@ const SECTIONS = {
 		remote: RemoteKind.optional(),
 		url: EnvString.optional(),
 		token: EnvString.optional()
-	}).optional()
+	}).optional(),
+	"sync-scope": z.strictObject({ export: z.boolean() }).optional()
 };
 const InitAnswers = z.strictObject(SECTIONS);
 const select$1 = (value) => ({
@@ -8081,8 +8259,8 @@ function runtimeKindOf(runtime) {
 	return null;
 }
 function databasesRequest(databases, run) {
-	if (databases !== void 0) return databases.length > 0 ? "named" : "sample-stands-in";
-	return run.interactive ? "ask-once" : "sample-stands-in";
+	if (databases !== void 0) return "named";
+	return run.interactive ? "ask" : "required";
 }
 function agentsOption(agents, run) {
 	if (agents !== void 0) return {
@@ -8130,6 +8308,8 @@ function keyedAnswers(answers) {
 		if (git.url !== void 0) add(map, GIT_SYNC_KEYS.url, text$1(git.url));
 		if (git.token !== void 0) add(map, GIT_SYNC_KEYS.token, password$1(git.token));
 	}
+	const scope = answers["sync-scope"];
+	if (scope !== void 0) add(map, SYNC_SCOPE_KEYS.export, confirm$1(scope.export));
 	return map;
 }
 function parseInitAnswers(raw, source) {
@@ -8144,7 +8324,6 @@ async function loadInitAnswers(path) {
 }
 function stepsAskingForWork(answers) {
 	const license = answers.license;
-	const databases = answers.databases;
 	const git = answers["git-sync"];
 	const agents = answers["agents-skills"];
 	return [
@@ -8166,12 +8345,16 @@ function stepsAskingForWork(answers) {
 		},
 		{
 			step: "databases",
-			asks: databases !== void 0 && databases.length > 0
+			asks: answers.databases !== void 0
 		},
 		{
 			step: "git-sync",
 			asks: git !== void 0 && git.location !== "skip"
 		},
+		{
+			step: "sync-scope",
+			asks: answers["sync-scope"]?.export === true
+		},
 		{
 			step: "agents-skills",
 			asks: agents !== void 0 && agents.agents.length > 0
@@ -8203,7 +8386,6 @@ const FLAG_FOR_KEY$1 = {
 	[API_KEY_KEYS.password]: "--admin-password",
 	[API_KEY_KEYS.profile]: "--mb-profile",
 	[LICENSE_KEYS.token]: "--license-token or --skip-license",
-	[DATABASE_KEYS.skip]: "--skip-databases",
 	[GIT_SYNC_KEYS.location]: "--git-dir",
 	[GIT_SYNC_KEYS.path]: "--git-dir",
 	[GIT_SYNC_KEYS.remote]: "--git-remote or --skip-git",
@@ -8211,7 +8393,7 @@ const FLAG_FOR_KEY$1 = {
 	[GIT_SYNC_KEYS.token]: "--git-token"
 };
 const DATABASE_FLAG_FOR_NAME = {
-	engine: "--database or --skip-databases",
+	engine: "--database",
 	uri: "--database"
 };
 function howToAnswer(key) {
@@ -8302,13 +8484,6 @@ function licenseSection(flags, secrets) {
 	}
 	return secrets.has("--license-token") ? { token: secrets.get("--license-token") } : void 0;
 }
-function databasesSection(flags) {
-	if (flags.skipDatabases) {
-		if (flags.database.length > 0) throw conflict("--skip-databases", "--database");
-		return [];
-	}
-	return flags.database.length > 0 ? flags.database.map(parseDatabase) : void 0;
-}
 function gitRemoteKind(flag, url) {
 	if (flag === void 0) return url === void 0 ? void 0 : "hosted";
 	const kind = GIT_REMOTE_NAMES[flag];
@@ -8429,7 +8604,7 @@ async function answersFromFlags(flags, readStdin) {
 		runtime: runtimeSection(flags),
 		"admin-user": adminSection(flags, secrets),
 		license: licenseSection(flags, secrets),
-		databases: databasesSection(flags),
+		databases: flags.database.length > 0 ? flags.database.map(parseDatabase) : void 0,
 		"git-sync": gitSection(flags, secrets),
 		"agents-skills": agentsSection(flags),
 		"api-key": flags.mbProfile === void 0 ? void 0 : { profile: flags.mbProfile }
@@ -8854,6 +9029,7 @@ const dbAdd = defineRdeCommand({
 			description: "Engine of a --url that fits several engines; the error names them"
 		}
 	},
+	interrupted: INTERRUPTED,
 	async run(args) {
 		if (args.url === void 0 && !stdinIsTty()) throw new ConfigError(NEEDS_URL_ERROR);
 		const name = await defaultInstanceName();
@@ -8885,6 +9061,7 @@ const dbList = defineRdeCommand({
 		description: "Print the list as JSON",
 		default: false
 	} },
+	interrupted: INTERRUPTED,
 	async run(args) {
 		const name = await defaultInstanceName();
 		const state = await requireInstanceState(name);
@@ -9508,6 +9685,11 @@ async function otherMetabasesRow(env, rdeProfile, profiles, mbUnusableReason) {
 function isNotFound$1(error) {
 	return error instanceof MetabaseApiError && error.status === NOT_FOUND_STATUS;
 }
+function coverageDetail(coverage) {
+	const valid = coverage.included.length === 0 ? "valid" : `valid, with ${listOf(coverage.included, "conjunction")}`;
+	if (coverage.missing.length === 0) return valid;
+	return `${valid}; without ${listOf(coverage.missing, "disjunction")}`;
+}
 async function licenseRow(client) {
 	const label = "license";
 	try {
@@ -9517,9 +9699,9 @@ async function licenseRow(client) {
 			hint: "`rde init --from license` with a valid token",
 			step: "license"
 		});
-		return ok("license", label, `valid, ${status.features.includes("remote-sync") ? `with ${REMOTE_SYNC_FEATURE}` : `without ${REMOTE_SYNC_FEATURE}, so git sync is unavailable`}`);
+		return ok("license", label, coverageDetail(licensedFeatureCoverage(status.features)));
 	} catch (error) {
-		if (isNotFound$1(error)) return skipped("license", label, "not activated; `rde init --from license` adds one");
+		if (isNotFound$1(error)) return skipped("license", label, `not activated, so ${listOf(LICENSED_FEATURE_NAMES, "conjunction")} are unavailable; \`rde init --from license\` adds one`);
 		throw error;
 	}
 }
@@ -9537,46 +9719,6 @@ async function databasesRow(state, client) {
 	const names = state.databases.map((record) => record.name).join(", ");
 	return ok("databases", label, `${state.databases.length} connected: ${names}`);
 }
-const SAMPLE_DATABASE_STEP = "sample-database";
-const SAMPLE_LABEL = "sample database";
-async function sampleDatabaseRow(record, deps, dockerOk, access) {
-	const id = "sample-database";
-	if (!dockerOk) return skipped(id, SAMPLE_LABEL, "Docker is not available");
-	const status = await sampleDatabaseContainer(record, deps.runtime.docker, deps.runtime.rdeHome).status();
-	if (!status.installed) return failed(id, SAMPLE_LABEL, {
-		detail: `${record.containerName} does not exist`,
-		hint: "`rde init` recreates it",
-		step: SAMPLE_DATABASE_STEP
-	});
-	if (!status.running) return failed(id, SAMPLE_LABEL, {
-		detail: `${record.containerName} is stopped`,
-		hint: "`rde start`",
-		step: "start-metabase"
-	});
-	if (await deps.runtime.ports.isFree(record.port)) return failed(id, SAMPLE_LABEL, {
-		detail: `${record.containerName} runs but port ${record.port} is not answering`,
-		hint: `\`docker logs ${record.containerName}\` shows what Postgres is doing`,
-		step: null
-	});
-	const where = `${record.containerName} running on ${LOOPBACK_HOST}:${record.port}`;
-	if (record.databaseId === null) return failed(id, SAMPLE_LABEL, {
-		detail: `${where}; not connected to Metabase yet`,
-		hint: "`rde init` connects it",
-		step: SAMPLE_DATABASE_STEP
-	});
-	if (access.kind === "unusable") return skipped(id, SAMPLE_LABEL, `${where}; ${access.reason}, so the connection is unchecked`);
-	try {
-		const database = await access.client.database.get(record.databaseId);
-		return ok(id, SAMPLE_LABEL, `${where}, database ${database.id} ${syncLabel(database.initial_sync_status)}`);
-	} catch (error) {
-		if (isNotFound$1(error)) return failed(id, SAMPLE_LABEL, {
-			detail: `${where}; database ${record.databaseId} is gone from Metabase`,
-			hint: "`rde init` connects it again",
-			step: SAMPLE_DATABASE_STEP
-		});
-		throw error;
-	}
-}
 function isMbFailure$1(error) {
 	return error instanceof ProcessNotFoundError || error instanceof ExternalToolError;
 }
@@ -9730,7 +9872,6 @@ async function instanceRows(state, secrets, deps, dockerOk, profiles, mbUnusable
 		skipped("mb-profile", "mb profile", NO_INSTANCE_REASON),
 		skipped("license", "license", NO_INSTANCE_REASON),
 		skipped("databases", "databases", NO_INSTANCE_REASON),
-		skipped("sample-database", SAMPLE_LABEL, NO_INSTANCE_REASON),
 		skipped("git-sync", "remote sync", NO_INSTANCE_REASON)
 	];
 	const runtime = await runtimeRow(configured.runtime, deps, dockerOk);
@@ -9749,7 +9890,6 @@ async function instanceRows(state, secrets, deps, dockerOk, profiles, mbUnusable
 	const access = apiKey.access;
 	if (access.kind === "unusable") rows.push(skipped("license", "license", access.reason), skipped("databases", "databases", access.reason));
 	else rows.push(await licenseRow(access.client), await databasesRow(state, access.client));
-	rows.push(state.sampleDatabase === null ? skipped("sample-database", SAMPLE_LABEL, "not connected; `rde init` adds one") : await sampleDatabaseRow(state.sampleDatabase, deps, dockerOk, access));
 	rows.push(await gitSyncRow(state, mbInstanceOf(state, secrets), deps));
 	return rows;
 }
@@ -9759,7 +9899,7 @@ async function collectDoctor(instance, state, secrets, deps) {
 	const mb = await mbFinding(deps);
 	const profiles = sharedProfileList(deps);
 	const checks = [...machine, mb.row];
-	if (state === null) checks.push(...noRuntimeRows(), skipped("version", "Metabase version", NO_INSTANCE_REASON), skipped("admin", "admin user", NO_INSTANCE_REASON), skipped("admin-password", "admin password", NO_INSTANCE_REASON), skipped("api-key", "API key", NO_INSTANCE_REASON), skipped("secrets-file", "secrets file", NO_INSTANCE_REASON), skipped("state-file", "state file", NO_INSTANCE_REASON), skipped("mb-profile", "mb profile", NO_INSTANCE_REASON), skipped("license", "license", NO_INSTANCE_REASON), skipped("databases", "databases", NO_INSTANCE_REASON), skipped("sample-database", SAMPLE_LABEL, NO_INSTANCE_REASON), skipped("git-sync", "remote sync", NO_INSTANCE_REASON));
+	if (state === null) checks.push(...noRuntimeRows(), skipped("version", "Metabase version", NO_INSTANCE_REASON), skipped("admin", "admin user", NO_INSTANCE_REASON), skipped("admin-password", "admin password", NO_INSTANCE_REASON), skipped("api-key", "API key", NO_INSTANCE_REASON), skipped("secrets-file", "secrets file", NO_INSTANCE_REASON), skipped("state-file", "state file", NO_INSTANCE_REASON), skipped("mb-profile", "mb profile", NO_INSTANCE_REASON), skipped("license", "license", NO_INSTANCE_REASON), skipped("databases", "databases", NO_INSTANCE_REASON), skipped("git-sync", "remote sync", NO_INSTANCE_REASON));
 	else checks.push(...await instanceRows(state, secrets, deps, dockerOk, profiles, mb.unusable));
 	const rdeProfile = state === null ? null : state.mbProfile;
 	checks.push(...await environmentRows(deps.environment, rdeProfile, profiles, mb.unusable), await otherMetabasesRow(deps.environment, rdeProfile, profiles, mb.unusable), ...await skillRows(state, deps));
@@ -9866,6 +10006,7 @@ const doctor = defineRdeCommand({
 			default: false
 		}
 	},
+	interrupted: INTERRUPTED,
 	async run(args) {
 		const name = await instanceNameOrDefault();
 		const state = await readInstanceState(name);
@@ -9924,13 +10065,6 @@ function isLocation(value) {
 function isRemote(value) {
 	return value === "local-bare" || value === "hosted";
 }
-function applyDatabaseRecord(draft, record) {
-	const value = stringOf(record.answer);
-	const skippedConnection = record.key === DATABASE_KEYS.connection && value?.trim() === "";
-	const finished = parseDatabaseKey(record.key)?.name === "engine" && value === "finish";
-	const pickedNoStub = record.key === DATABASE_KEYS.stubs && record.answer.kind === "multiselect" && record.answer.values.length === 0;
-	if (skippedConnection || finished || pickedNoStub) draft.databasesFinished = true;
-}
 function applyAdminRecord(draft, key, value) {
 	if (key === ADMIN_USER_KEYS.email && value !== null) admin(draft).email = value;
 	else if (key === ADMIN_USER_KEYS.password) admin(draft).password = envReference(ENV_ADMIN_PASSWORD);
@@ -9954,14 +10088,14 @@ function agentIds(values) {
 function applyRecord(draft, record) {
 	const { key } = record;
 	const value = stringOf(record.answer);
-	if (key.startsWith("databases.")) applyDatabaseRecord(draft, record);
-	else if (key.startsWith("admin-user.")) applyAdminRecord(draft, key, value);
+	if (key.startsWith("admin-user.")) applyAdminRecord(draft, key, value);
 	else if (key.startsWith("git-sync.")) applyGitRecord(draft, key, value);
 	else if (key === AGENTS_SKILLS_KEYS.agents && record.answer.kind === "multiselect") draft.answers["agents-skills"] = { agents: agentIds(record.answer.values) };
 	else if (key === API_KEY_KEYS.profile && value !== null) {
 		const profile = MbProfileChoice.safeParse(value);
 		if (profile.success) draft.answers["api-key"] = { profile: profile.data };
-	} else if (key === LICENSE_KEYS.token && value !== null) draft.answers.license = { token: value.length === 0 ? null : envReference(ENV_LICENSE_TOKEN) };
+	} else if (key === SYNC_SCOPE_KEYS.export && record.answer.kind === "confirm") draft.answers["sync-scope"] = { export: record.answer.value };
+	else if (key === LICENSE_KEYS.token && value !== null) draft.answers.license = { token: value.length === 0 ? null : envReference(ENV_LICENSE_TOKEN) };
 }
 function writableUri(uri, index) {
 	const trimmed = uri.trim();
@@ -9981,13 +10115,9 @@ function databaseEntry(added, index) {
 	};
 }
 function answersFromRecords(records, overrides, added) {
-	const draft = {
-		answers: {},
-		databasesFinished: false
-	};
+	const draft = { answers: {} };
 	for (const record of records) applyRecord(draft, record);
-	const databases = added.map(databaseEntry);
-	if (databases.length > 0 || draft.databasesFinished) draft.answers.databases = databases;
+	if (added.length > 0) draft.answers.databases = added.map(databaseEntry);
 	return {
 		...draft.answers,
 		...overrides.runtime !== void 0 && { runtime: overrides.runtime },
@@ -10113,7 +10243,7 @@ const init = defineRdeCommand({
 		},
 		runtime: {
 			type: "string",
-			description: `How a new instance runs Metabase (${RUNTIME_LIST}); Docker when it is available; the sample database always runs in Docker`
+			description: `How a new instance runs Metabase (${RUNTIME_LIST}); Docker when it is available`
 		},
 		image: {
 			type: "string",
@@ -10158,12 +10288,7 @@ const init = defineRdeCommand({
 		},
 		database: {
 			type: "string",
-			description: "Database to connect, a connection string or <engine>=<connection string> when it fits several engines; repeatable"
-		},
-		"skip-databases": {
-			type: "boolean",
-			description: "Connect none of your own databases (the sample database is still connected)",
-			default: false
+			description: "Database to connect, a connection string or <engine>=<connection string> when it fits several engines; repeatable. init needs one, and asks for it only at a terminal"
 		},
 		"git-dir": {
 			type: "string",
@@ -10201,10 +10326,11 @@ const init = defineRdeCommand({
 		},
 		yes: {
 			type: "boolean",
-			description: "Answer yes to every confirmation and take the default of every setting; skips the question about your own databases (the sample database is still connected)",
+			description: "Answer yes to every confirmation and take the default of every setting; the database init needs then comes from --database or the answers file",
 			default: false
 		}
 	},
+	interrupted: "Interrupted. Run `rde init` again to resume.",
 	async run(args, rawArgs) {
 		const options = stepSelection(args.from, args.only);
 		const runOptions = {
@@ -10221,7 +10347,6 @@ const init = defineRdeCommand({
 				licenseToken: args["license-token"],
 				skipLicense: args["skip-license"],
 				database: repeatedValues(rawArgs, "--database"),
-				skipDatabases: args["skip-databases"],
 				gitDir: args["git-dir"],
 				gitRemote: args["git-remote"],
 				gitUrl: args["git-url"],
@@ -10268,6 +10393,7 @@ const logs = defineRdeCommand({
 		description: "Keep streaming new lines",
 		default: false
 	} },
+	interrupted: null,
 	async run(args) {
 		await (await loadInstance(await defaultInstanceName(), interruptSignal)).runtime.logs({
 			follow: args.follow,
@@ -10282,6 +10408,7 @@ const open = defineRdeCommand({
 		name: "open",
 		description: "Open the Metabase instance in the browser"
 	},
+	interrupted: INTERRUPTED,
 	async run() {
 		const instance = await loadInstance(await defaultInstanceName(), interruptSignal);
 		printLines([await openInstance(instance.url) ? `Opened ${instance.url}` : `Open ${instance.url} in your browser`]);
@@ -10361,6 +10488,7 @@ const start = defineRdeCommand({
 		type: "string",
 		description: "Move the instance to this host port first; the mb profile follows, the data stays"
 	} },
+	interrupted: INTERRUPTED,
 	async run(args) {
 		const port = args.port === void 0 ? null : requirePortFlag(args.port);
 		const name = await defaultInstanceName();
@@ -10422,26 +10550,13 @@ async function databasesOf(ctx, deps, health) {
 		throw error;
 	}
 }
-async function sampleDatabaseOf(ctx, deps, databases) {
-	const record = ctx.state.sampleDatabase;
-	if (record === null) return null;
-	const status = await sampleDatabaseContainer(record, deps.runtime.docker, deps.runtime.rdeHome).status();
-	const listed = databases?.find((database) => database.id === record.databaseId) ?? null;
-	return {
-		container: status.running ? "running" : status.installed ? "stopped" : "missing",
-		port: record.port,
-		url: sampleDatabaseUrl(record.port),
-		databaseId: record.databaseId,
-		initialSyncStatus: listed === null ? null : listed.initialSyncStatus
-	};
-}
 function taskLabel(status) {
 	const task = status.current_task;
 	return task === null ? null : `${task.sync_task_type} ${task.status}`;
 }
 function remoteContentOf(changes) {
 	if (!changes.has_changes) return "imported";
-	return changes.local_version === null ? "never-imported" : "changed";
+	return remoteMoved(changes) ? "changed" : "never-imported";
 }
 function isMbFailure(error) {
 	return error instanceof ProcessNotFoundError || error instanceof ExternalToolError;
@@ -10459,7 +10574,8 @@ async function gitSyncOf(ctx, deps) {
 			branch: status.branch,
 			dirty: status.is_dirty,
 			remote: remoteContentOf(changes),
-			task: taskLabel(status)
+			task: taskLabel(status),
+			syncedCollections: status.synced_collections.map((collection) => collection.name)
 		};
 	} catch (error) {
 		if (isMbFailure(error)) return { error: error.message };
@@ -10489,7 +10605,6 @@ async function collectStatus(ctx, deps) {
 		steps,
 		setup: setupOf(ctx, steps),
 		databases,
-		sampleDatabase: await sampleDatabaseOf(ctx, deps, databases),
 		gitSync: await gitSyncOf(ctx, deps),
 		contentRepository: ctx.state.gitRemote === null ? null : ctx.state.gitRemote.workdir
 	};
@@ -10520,7 +10635,8 @@ function gitSyncLine(report) {
 	if (isGitSyncFailure(report.gitSync)) return `Remote sync: ${report.gitSync.error}`;
 	const branch = report.gitSync.branch === null ? "no branch" : `branch ${report.gitSync.branch}`;
 	const task = report.gitSync.task === null ? "no task running" : `task ${report.gitSync.task}`;
-	return `Remote sync: ${branch}, ${syncStateLabel(report.mbProfile, report.gitSync)}, ${task}`;
+	const scope = report.gitSync.syncedCollections.length === 0 ? "nothing synced; `rde init --only sync-scope`" : `synced: ${report.gitSync.syncedCollections.join(", ")}`;
+	return `Remote sync: ${branch}, ${syncStateLabel(report.mbProfile, report.gitSync)}, ${task}, ${scope}`;
 }
 const REMOTE_CONTENT_LABEL = {
 	imported: null,
@@ -10533,22 +10649,6 @@ function syncStateLabel(profile, gitSync) {
 	if (gitSync.dirty) return `unsynced changes, ${remote}`;
 	return `${remote}; \`${mbCommand(profile)} git-sync import\``;
 }
-const CONTAINER_STATE_LABEL = {
-	running: "container running",
-	stopped: "container stopped; `rde start`",
-	missing: "container missing; `rde init` recreates it"
-};
-function sampleConnectionLabel(report, sample) {
-	if (sample.databaseId === null) return "not connected to Metabase yet; `rde init`";
-	if (report.databases === null) return "sync unknown while Metabase is not running";
-	if (sample.initialSyncStatus === null) return `database ${sample.databaseId} is gone from Metabase; \`rde init\` connects it again`;
-	return syncLabel(sample.initialSyncStatus);
-}
-function sampleDatabaseLine(report) {
-	const sample = report.sampleDatabase;
-	if (sample === null) return "Sample database: not connected; `rde init` adds one";
-	return `Sample database: ${sample.url}, ${CONTAINER_STATE_LABEL[sample.container]}, ${sampleConnectionLabel(report, sample)}`;
-}
 function databaseLines(report) {
 	if (report.databases === null) return ["Databases: unavailable while Metabase is not running"];
 	return ["Databases:", ...databaseListingLines(report.databases).map((line) => `  ${line}`)];
@@ -10565,7 +10665,6 @@ function statusLines(report) {
 		"Steps:",
 		...checklistLines(report.steps).map((line) => `  ${line}`),
 		...databaseLines(report),
-		sampleDatabaseLine(report),
 		gitSyncLine(report),
 		...report.contentRepository === null ? [] : [`Content repository: ${report.contentRepository}`]
 	];
@@ -10582,6 +10681,7 @@ const status = defineRdeCommand({
 		description: "Print the report as JSON",
 		default: false
 	} },
+	interrupted: INTERRUPTED,
 	async run(args) {
 		const name = await defaultInstanceName();
 		await requireInstanceState(name);
@@ -10598,18 +10698,17 @@ const status = defineRdeCommand({
 const stop = defineRdeCommand({
 	meta: {
 		name: "stop",
-		description: "Stop the Metabase instance and its sample database"
+		description: "Stop the Metabase instance"
 	},
+	interrupted: INTERRUPTED,
 	async run() {
-		const instance = await loadInstance(await defaultInstanceName(), interruptSignal);
+		const name = await defaultInstanceName();
+		const instance = await loadInstance(name, interruptSignal);
 		const before = await instance.runtime.status();
 		await instance.runtime.stop();
 		const lines = [before.running ? "Metabase stopped" : "Metabase is not running"];
-		if (instance.sampleDatabase !== null) {
-			const sidecar = await instance.sampleDatabase.status();
-			await instance.sampleDatabase.stop();
-			lines.push(sidecar.running ? "Sample database stopped" : "Sample database is not running");
-		}
+		const removed = await removeLeftovers(name, interruptSignal);
+		if (removed !== null) lines.push(removed);
 		printLines(lines);
 	}
 });
@@ -10620,11 +10719,13 @@ function hostUninstallDeps(signal, childOutput) {
 	return {
 		docker: dockerTool(runner),
 		daemon: daemonTool(runner),
+		git: gitTool(runner),
 		runner,
 		childOutput
 	};
 }
 const NOT_TOUCHED_LINE = "The mb CLI, Docker, and Java themselves";
+const UNPULLED_COMMITS_SHOWN = 10;
 const ANY_JAR = "-jar";
 function isFileSystemError(error) {
 	return error instanceof Error && "code" in error;
@@ -10830,6 +10931,71 @@ async function findSkill(runner, childOutput) {
 function instanceDirLabel(path, state) {
 	return `Instance directory ${path} (${state?.gitRemote?.kind === "local-bare" ? "Metabase data and the remote-sync repository content.git" : "Metabase data"})`;
 }
+async function findUnpulled(remote, git) {
+	if (!await pathExists(remote.barePath)) return null;
+	try {
+		if (!await git.isBareRepo(remote.barePath)) return null;
+		const commits = await git.bareBranchCommits(remote.barePath, remote.branch);
+		if (commits === null || commits.length === 0) return null;
+		if (!await git.isRepo(remote.workdir)) return {
+			kind: "orphaned",
+			remote,
+			commits
+		};
+		const reachable = await git.reachableCommits(remote.workdir);
+		const missing = commits.filter((commit) => !reachable.has(commit.sha));
+		return missing.length === 0 ? null : {
+			kind: "behind",
+			remote,
+			commits: missing
+		};
+	} catch (error) {
+		if (isToolFailure(error)) return {
+			kind: "unchecked",
+			remote,
+			reason: error.message
+		};
+		throw error;
+	}
+}
+function commitCount(commits) {
+	return commits.length === 1 ? "1 commit" : `${commits.length} commits`;
+}
+function unpulledSummary(unpulled) {
+	const { barePath, workdir, branch } = unpulled.remote;
+	switch (unpulled.kind) {
+		case "behind": return `${barePath} has ${commitCount(unpulled.commits)} on ${branch} that ${workdir} lacks; uninstalling deletes them`;
+		case "orphaned": return `${barePath} has ${commitCount(unpulled.commits)} on ${branch}, and ${workdir} is gone or no longer a git repository; uninstalling deletes them`;
+		case "unchecked": return `${barePath} cannot be compared with ${workdir} (${unpulled.reason}); uninstalling deletes it with any commits ${workdir} lacks`;
+	}
+}
+function unpulledRemedy(unpulled) {
+	const { barePath, workdir, branch } = unpulled.remote;
+	switch (unpulled.kind) {
+		case "behind": return `\`git -C ${workdir} pull\` brings them in first`;
+		case "orphaned": return `\`git clone --branch ${branch} ${barePath} <directory>\` copies them first`;
+		case "unchecked": return null;
+	}
+}
+function commitLines(unpulled) {
+	if (unpulled.kind === "unchecked") return [];
+	const shown = unpulled.commits.slice(0, UNPULLED_COMMITS_SHOWN).map((commit) => `  ${commit.shortSha} ${commit.subject}`);
+	const hidden = unpulled.commits.length - shown.length;
+	return hidden > 0 ? [...shown, `  and ${hidden} more`] : shown;
+}
+function unpulledWarning(unpulled) {
+	const remedy = unpulledRemedy(unpulled);
+	return [
+		unpulledSummary(unpulled),
+		...commitLines(unpulled),
+		...remedy === null ? [] : [remedy]
+	].join("\n");
+}
+function unpulledRefusal(unpulled) {
+	const remedy = unpulledRemedy(unpulled);
+	const force = "pass --force to uninstall anyway";
+	return remedy === null ? `${unpulledSummary(unpulled)}; ${force}` : `${unpulledSummary(unpulled)}; ${remedy}, or ${force}`;
+}
 async function findConfigEntry(instance) {
 	const path = globalConfigPath();
 	try {
@@ -10872,14 +11038,13 @@ async function planUninstall(options, deps) {
 	const container = await findContainer(runtime?.containerName ?? containerName(options.instance, home), deps.docker, runtime?.image ?? null, home, { graceMs: METABASE_STOP_GRACE_MS });
 	if (container.removal !== null) removals.push(container.removal);
 	if (container.problem !== null) problems.push(container.problem);
-	const sample = state?.sampleDatabase ?? null;
-	const sidecar = await findContainer(sample?.containerName ?? sampleContainerName(options.instance, home), deps.docker, sample?.image ?? null, home, { graceMs: SAMPLE_DATABASE_STOP_GRACE_MS });
-	if (sidecar.removal !== null) removals.push(sidecar.removal);
-	if (sidecar.problem !== null) problems.push(sidecar.problem);
+	const sampleDatabase = await findContainer(sampleDatabaseContainerName(options.instance, home), deps.docker, null, home, { graceMs: SAMPLE_DATABASE_STOP_GRACE_MS });
+	if (sampleDatabase.removal !== null) removals.push(sampleDatabase.removal);
+	if (sampleDatabase.problem !== null) problems.push(sampleDatabase.problem);
 	const jarSource = state?.runtime?.kind === "jar" ? state.runtime.source : null;
 	const jarProcess = await findJarProcess(options.instance, jarSource, deps.daemon);
 	if (jarProcess !== null) removals.push(jarProcess);
-	for (const image of [container.image, sidecar.image]) {
+	for (const image of [container.image, sampleDatabase.image]) {
 		if (image === null) continue;
 		const finding = await findImage(image, deps.docker, options.removeImage);
 		if (finding.removal !== null) removals.push(finding.removal);
@@ -10899,6 +11064,8 @@ async function planUninstall(options, deps) {
 	}
 	const dir = instanceDir(options.instance);
 	const dirPresent = await pathExists(dir);
+	const bareRemote = state?.gitRemote?.kind === "local-bare" ? state.gitRemote : null;
+	const unpulled = options.keepData || !dirPresent || bareRemote === null ? null : await findUnpulled(bareRemote, deps.git);
 	if (!options.keepData) {
 		const secrets = instanceSecretsPath(options.instance);
 		if (await pathExists(secrets)) removals.push({
@@ -10919,7 +11086,8 @@ async function planUninstall(options, deps) {
 	return {
 		removals,
 		kept,
-		problems
+		problems,
+		unpulled
 	};
 }
 function planLines$1(plan) {
@@ -10974,6 +11142,10 @@ async function uninstall(options, deps, io) {
 		};
 	}
 	io.ui.note(planLines$1(plan).join("\n"), `rde uninstall ${options.instance}`);
+	if (plan.unpulled !== null) {
+		io.ui.warn(unpulledWarning(plan.unpulled));
+		if ((options.yes || !options.terminal) && !options.force) throw new ConfigError(unpulledRefusal(plan.unpulled));
+	}
 	if (!options.yes) {
 		if (!await io.prompts.confirm({
 			message: "Remove everything listed?",
@@ -11020,8 +11192,14 @@ const uninstallCommand = defineRdeCommand({
 			type: "boolean",
 			description: "Do not ask for confirmation",
 			default: false
+		},
+		force: {
+			type: "boolean",
+			description: "With --yes or without a terminal, also delete commits your working directory has not pulled",
+			default: false
 		}
 	},
+	interrupted: INTERRUPTED,
 	async run(args) {
 		const instance = args.instance ?? await instanceNameOrDefault();
 		if (!isInstanceName(instance)) throw new ConfigError(`${args.instance === void 0 ? `the default instance in ${globalConfigPath()},` : "--instance"} ${instance} is not an instance name (${INSTANCE_NAME_RULE})`);
@@ -11031,7 +11209,9 @@ const uninstallCommand = defineRdeCommand({
 			keepData: args["keep-data"],
 			removeSkill: args["remove-skill"],
 			removeImage: args["remove-image"],
-			yes: args.yes
+			yes: args.yes,
+			force: args.force,
+			terminal: stdinIsTty()
 		}, hostUninstallDeps(interruptSignal, ui.childOutput), {
 			prompts: clackPrompts({ confirmsWithYes: true }),
 			ui
@@ -11265,8 +11445,11 @@ async function upgrade(ctx, options, deps = hostDeps) {
 	const stopping = ctx.ui.spinner("Stopping Metabase");
 	await runtime.stop();
 	stopping.stop("Metabase stopped");
+	options.onPhase("backing-up", backup);
 	await backUp(ctx, resolved.runtime.dataDir, backup);
+	options.onPhase("switching", backup);
 	await switchTo(ctx, resolved, target);
+	options.onPhase("starting", backup);
 	const to = await startUpgraded(ctx, resolved, client, configured, backup);
 	ctx.ui.success(`Upgraded Metabase from ${current} to ${to}; the backup at ${backup} can go once you are happy with it`);
 	return {
@@ -11278,6 +11461,14 @@ async function upgrade(ctx, options, deps = hostDeps) {
 }
 //#endregion
 //#region src/commands/upgrade.ts
+const INTERRUPTED_IN = {
+	"backing-up": (backup) => `Interrupted before the backup finished; the instance is stopped on the version it had. The next \`rde upgrade\` starts it and takes a new backup; the partial copy at ${backup} can go.`,
+	switching: (backup) => `Interrupted after the backup to ${backup} finished, while installing the new version. Run \`rde init\` to reinstall the instance; the next \`rde upgrade\` then finds it upgraded, or upgrades it if \`rde init\` put back the version it had.`,
+	starting: (backup) => `Interrupted while Metabase starts on the new version, after the backup to ${backup} finished. The next \`rde upgrade\` waits for it to come up and finds it upgraded.`
+};
+function interruptedUpgrade(phase, backup) {
+	return INTERRUPTED_IN[phase](backup);
+}
 const upgradeCommand = defineRdeCommand({
 	meta: {
 		name: "upgrade",
@@ -11294,14 +11485,21 @@ const upgradeCommand = defineRdeCommand({
 			default: false
 		}
 	},
-	async run(args) {
+	interrupted: "Interrupted before the backup; the instance is on the version it had. The next `rde upgrade` starts it if it is stopped and begins again.",
+	async run(args, _rawArgs, interruption) {
 		if (!args.yes && !stdinIsTty()) throw new ConfigError("`rde upgrade` asks for confirmation; pass --yes to upgrade without a terminal");
 		const name = await defaultInstanceName();
 		await requireInstanceState(name);
-		await upgrade(await createWizardContext(name, { signal: interruptSignal }), {
+		const ctx = await createWizardContext(name, { signal: interruptSignal });
+		await upgrade(ctx, {
 			to: args.to ?? null,
-			yes: args.yes
+			yes: args.yes,
+			onPhase: (phase, backup) => {
+				interruption.message = interruptedUpgrade(phase, backup);
+			}
 		});
+		const removed = await removeLeftovers(name, interruptSignal);
+		if (removed !== null) ctx.ui.info(removed);
 	}
 });
 //#endregion
@@ -11309,7 +11507,7 @@ const upgradeCommand = defineRdeCommand({
 const main = defineCommand({
 	meta: {
 		name: "rde",
-		version: "0.1.15",
+		version: "0.1.17",
 		description: "Prepares a local machine for data-engineering work with Metabase and coding agents"
 	},
 	subCommands: {