@metabase/rde 0.1.16 → 0.1.17

package/README.md

@@ -64,8 +64,9 @@ The git step reads `–` until a license with remote sync is active; it is check
 | Enable transforms | Turns transforms on, unless someone already set them either way: turned off in the admin settings, they stay off on every later `rde init`, and the admin settings turn them back on |
 | Activate your license | Optional. Paste a token, or press Enter to skip. The token unlocks remote sync (the `remote-sync` feature, which the git step needs), data apps (`data-apps`), and transform tests (`transforms-testing`); skipping the license goes without all three, and an activated token that lacks some is named with the ones it lacks. A token Metabase refuses is asked for again at a terminal |
 | Connect a git repository | Only with a license. Initializes or reuses a repository and points Metabase's remote sync at it, with transforms included in the sync (the Transforms row under Collections to sync), and imports the content it already holds |
+| Choose what syncs to git | Only once a repository is connected. Creates the Library (when the license has the `library` feature) and an `Analytics` collection, unless the repository already brought synced top-level collections in, and marks them for sync. Before it changes anything it asks whether to push them to the branch (default yes); without the push, or when the branch has commits Metabase has not imported, it prints the export to run instead |
 | Connect your databases | Required: `init` goes no further until a database of your own is connected, as a user that can create the tables transforms write. At a terminal: pick the databases the imported content uses from a checklist, or, with none, paste a connection string (Enter goes to the engine list); review, test, add; repeat. `--database` names them ahead of time; with `--yes` or without a terminal and none named, the step fails naming `--database` and the answers file. `rde db add` starts from the same checklist, then the engine list, where the fields can also be filled one by one |
-| Summary | URL, login email, the `mb` command for the instance, databases, repository, and the command that opens each detected agent |
+| Summary | URL, login email, the `mb` command for the instance, databases, repository, the export still to run when Metabase has unexported changes, and the command that opens each detected agent |
 
 The second run on the same machine detects every step as done and prints the summary only:
 
@@ -151,7 +152,7 @@ Docker is used whenever it is available: the image is self-contained, and the co
 | --- | --- |
 | `rde start` | Starts the instance, and waits until Metabase is healthy; `--port <n>` moves the instance to another port first (see [The instance's port is taken](#troubleshooting)) |
 | `rde stop` | Stops the instance; the data stays |
-| `rde status` | The login email, the `mb` profile, the init checklist, whether setup is complete (or the first step `init` did not finish, with the `rde init --from` command that resumes there), runtime state, health, databases with their sync state, remote sync state and the content repository's working directory (`contentRepository`); `--json` for scripts and agents (`mbProfile`, `adminEmail`, `setup`, never a secret); exit 0 whatever it reports |
+| `rde status` | The login email, the `mb` profile, the init checklist, whether setup is complete (or the first step `init` did not finish, with the `rde init --from` command that resumes there), runtime state, health, databases with their sync state, remote sync state with the collections it syncs, and the content repository's working directory (`contentRepository`); `--json` for scripts and agents (`mbProfile`, `adminEmail`, `setup`, never a secret); exit 0 whatever it reports |
 | `rde credentials` | The Metabase URL, admin email, and password; `--json` for scripts and agents; `--api-key` for the API key alone |
 | `rde logs` | The container's log, or the jar's `metabase.log`; `-f` keeps streaming |
 | `rde open` | Opens the instance in the browser |
@@ -184,7 +185,11 @@ With a license that includes remote sync, the step after the license connects a
 - **Local remote inside `~/.rde`** (default): a bare repository at `instances/default/data/content.git`, mounted into the container and reached as `file:///rde/content.git`. No account, no token. Your working directory gets it as `origin` (or as `rde-remote` when `origin` already points elsewhere).
 - **Hosted remote**: a GitHub, GitLab, or Bitbucket `https://` URL plus a token with read and write access. `rde` tests the connection through Metabase before saving anything, then clones the repository into the working directory (an existing repository gets the URL as `origin` instead); an empty hosted repository gets the first commit pushed to it. The token is handed to Metabase and, for the clone and that first push, to git in its environment; it never lands in the clone's config, the remote URL, or a credential helper, so a later `git pull` uses your own git credentials.
 
-A fresh repository gets a first commit with a `README.md` and a `.gitignore` that keeps out what a data app built in it must not push: `.env`, `.env.local`, `.env.*.local`, `node_modules/`, `.vite/`, the rde skill's `.scratch/`, and `.DS_Store` (a data app's built `dist/` stays tracked, since that bundle is what Metabase serves); a `.gitignore` already there keeps its lines and gets the missing ones, and a repository that already has commits is left as it is. A repository that already holds Metabase content is imported on the spot; each database it names that this instance lacks becomes a stub, which the databases step right after offers to connect. Afterwards:
+A fresh repository gets a first commit with a `README.md` and a `.gitignore` that keeps out what a data app built in it must not push: `.env`, `.env.local`, `.env.*.local`, `node_modules/`, `.vite/`, the rde skill's `.scratch/`, and `.DS_Store` (a data app's built `dist/` stays tracked, since that bundle is what Metabase serves); a `.gitignore` already there keeps its lines and gets the missing ones, and a repository that already has commits is left as it is. A repository that already holds Metabase content is imported on the spot; each database it names that this instance lacks becomes a stub, which the databases step offers to connect.
+
+Remote sync carries only what is marked for it, so the step after the repository decides what that is: the Library (published tables with their measures and segments in Data, metrics in Metrics), and one top-level collection for dashboards, questions, models, and documents; transforms already sync through the repository step. The collection is `Analytics`, created for the purpose (beside any `Analytics` of the user's, which stays out of git), unless the import brought top-level collections the repository already syncs, in which case those are used and nothing is created; the Library is created only when the import did not bring one, since a second Library would conflict with the repository's on the next import. Anything filed outside these collections stays on this instance. The step refuses to run after an import that did not finish cleanly, and names the import to run first. While remote sync is read-only, the repository decides what syncs: `rde init` skips the step, and `rde init --only sync-scope` stops and asks for read-write in Admin. `rde init --only sync-scope` runs it again; it creates nothing that is already there.
+
+Marking the scope is itself a change Metabase has not exported, and until it is exported a plain `mb git-sync import` refuses ("There are unsaved changes in the Remote Sync collection"). So the step asks, before it creates or marks anything, whether to push the scope to the branch, and on yes runs `mb git-sync export` and checks that Metabase is in sync afterwards. It asks because the branch may be one others share. On no, or when the push fails, it prints `mb git-sync export -b <branch>` and the summary repeats it while Metabase has unexported changes. When the branch has commits Metabase has not imported, it asks nothing and pushes nothing: a plain export would end in a conflict, which counts the remote commit as synced, so it names `mb git-sync export-preflight` and `mb git-sync export -b <branch> --merge` instead. Afterwards:
 
 ```sh
 cd <your working directory>
@@ -195,7 +200,7 @@ git pull   # after an export, to see the YAML files
 
 ## Running `init` without a terminal
 
-Every prompt can be answered ahead of time, by a flag or by a JSON answers file, so an agent or a CI job can run `rde init` unattended. The choices `init` makes on its own need no answer, so a run without a terminal only has to cover the license, the databases, and the git repository. When stdin is not a terminal, the first prompt nothing answers fails with exit code 2 and a message naming the step, the prompt, and the flag or answers key that would have answered it; nothing hangs. A text prompt with a default (a display name) takes its default, as Enter would.
+Every prompt can be answered ahead of time, by a flag or by a JSON answers file, so an agent or a CI job can run `rde init` unattended. The choices `init` makes on its own need no answer, so a run without a terminal only has to cover the license, the databases, the git repository, and whether to push the sync scope. When stdin is not a terminal, the first prompt nothing answers fails with exit code 2 and a message naming the step, the prompt, and the flag or answers key that would have answered it; nothing hangs. A text prompt with a default (a display name) takes its default, as Enter would.
 
 ### Flags
 
@@ -237,11 +242,12 @@ rde init --license-token '$RDE_LICENSE_TOKEN' …
     { "engine": "postgres", "uri": "$RDE_DATABASE_1_URI" },
     { "engine": "bigquery-cloud-sdk", "fields": { "project-id": "acme", "service-account-json": "/keys/acme.json" }, "name": "Warehouse" }
   ],
-  "git-sync": { "location": "new", "path": "~/analytics", "remote": "local-bare" }
+  "git-sync": { "location": "new", "path": "~/analytics", "remote": "local-bare" },
+  "sync-scope": { "export": true }
 }
 ```
 
-`"runtime"` takes `"kind": "docker"` or `"jar"`, which `"image"` and `"jar"` imply on their own (`"runtime": { "jar": "latest" }` runs the latest release with Java). `"license": { "token": null }` skips the license and `"git-sync": { "location": "skip" }` leaves the repository for later. `"databases"` lists at least one database: an empty list is refused, since `init` needs one; leave the section out to be asked at a terminal. A database is pasted as a `uri` or entered with `fields`, keyed by the driver's field names as the admin form shows them; a file field takes a path. Anything a `fields` entry leaves out is asked in the terminal, or named in the error without one. A field that engine does not ask with the others given, such as one behind the admin form's advanced options, is named in a warning and ignored.
+`"runtime"` takes `"kind": "docker"` or `"jar"`, which `"image"` and `"jar"` imply on their own (`"runtime": { "jar": "latest" }` runs the latest release with Java). `"license": { "token": null }` skips the license and `"git-sync": { "location": "skip" }` leaves the repository for later. `"sync-scope": { "export": false }` leaves the first export of the sync scope to you. `"databases"` lists at least one database: an empty list is refused, since `init` needs one; leave the section out to be asked at a terminal. A database is pasted as a `uri` or entered with `fields`, keyed by the driver's field names as the admin form shows them; a file field takes a path. Anything a `fields` entry leaves out is asked in the terminal, or named in the error without one. A field that engine does not ask with the others given, such as one behind the admin form's advanced options, is named in a warning and ignored.
 
 ### Recording a run
 

package/dist/cli.mjs

@@ -79,6 +79,8 @@ var MetabaseApiError = class extends Error {
 	path;
 	errors;
 	reason;
+	code;
+	detail;
 	constructor(failure) {
 		super(`Metabase ${failure.status} on ${failure.path}: ${failure.message}`);
 		this.name = "MetabaseApiError";
@@ -86,6 +88,8 @@ var MetabaseApiError = class extends Error {
 		this.path = failure.path;
 		this.errors = failure.errors;
 		this.reason = failure.message;
+		this.code = failure.code;
+		this.detail = failure.detail;
 	}
 };
 const UNAUTHORIZED_STATUS = 401;
@@ -264,6 +268,7 @@ const StepId = z.enum([
 	"transforms",
 	"license",
 	"git-sync",
+	"sync-scope",
 	"databases",
 	"summary"
 ]);
@@ -332,6 +337,9 @@ const REMOTE_SYNC_FEATURE = "remote-sync";
 function hasRemoteSync(license) {
 	return license.activated && license.features.includes("remote-sync");
 }
+function hasLibrary(license) {
+	return license.activated && license.features.includes("library");
+}
 const DatabaseRecord = z.object({
 	id: z.int(),
 	name: z.string(),
@@ -354,7 +362,7 @@ const StepRecord = z.object({
 	completedAt: z.string()
 });
 const InstanceState = z.object({
-	schemaVersion: z.literal(6),
+	schemaVersion: z.literal(7),
 	name: z.string(),
 	runtime: RuntimeState.nullable(),
 	url: z.string().nullable(),
@@ -365,6 +373,7 @@ const InstanceState = z.object({
 	databases: z.array(DatabaseRecord),
 	gitRemote: GitRemoteState.nullable(),
 	movedFrom: z.string().nullable(),
+	syncRoot: z.int().nullable(),
 	steps: z.partialRecord(StepId, StepRecord)
 });
 function configuredRuntime(state) {
@@ -394,7 +403,7 @@ function mbCommand(profile) {
 }
 function emptyInstanceState(name) {
 	return {
-		schemaVersion: 6,
+		schemaVersion: 7,
 		name,
 		runtime: null,
 		url: null,
@@ -405,6 +414,7 @@ function emptyInstanceState(name) {
 		databases: [],
 		gitRemote: null,
 		movedFrom: null,
+		syncRoot: null,
 		steps: {}
 	};
 }
@@ -416,6 +426,7 @@ const V2 = 2;
 const V3 = 3;
 const V4 = 4;
 const V5 = 5;
+const V6 = 6;
 const StateV1 = z.object({ schemaVersion: z.literal(V1) }).loose();
 const StateV2 = z.object({ schemaVersion: z.literal(V2) }).loose();
 const AdminV3 = z.discriminatedUnion("kind", [z.object({
@@ -427,7 +438,11 @@ const AdminV3 = z.discriminatedUnion("kind", [z.object({
 	password: z.string()
 })]);
 const StateV4 = z.object({ schemaVersion: z.literal(V4) }).loose();
-const StateV5 = z.object({ schemaVersion: z.literal(V5) }).loose();
+const StateV5 = z.object({
+	schemaVersion: z.literal(V5),
+	steps: z.record(z.string(), z.unknown())
+}).loose();
+const StateV6 = z.object({ schemaVersion: z.literal(V6) }).loose();
 const StateV3 = z.object({
 	schemaVersion: z.literal(V3),
 	admin: AdminV3.nullable(),
@@ -454,10 +469,19 @@ function liftV4(raw) {
 	};
 }
 function liftV5(raw) {
-	const { sampleDatabase: _sampleDatabase, ...state } = StateV5.parse(raw);
+	const { sampleDatabase: _sampleDatabase, steps, ...state } = StateV5.parse(raw);
+	const { "sample-database": _sampleDatabaseStep, ...remainingSteps } = steps;
 	return {
 		...state,
-		schemaVersion: 6
+		schemaVersion: V6,
+		steps: remainingSteps
+	};
+}
+function liftV6(raw) {
+	return {
+		...StateV6.parse(raw),
+		schemaVersion: 7,
+		syncRoot: null
 	};
 }
 function adminV4(admin) {
@@ -498,15 +522,16 @@ function migrateInstanceState(raw) {
 		case V2: return migrateInstanceState(liftV2(raw));
 		case V3: return liftV3(raw);
 		case V4: return migrateInstanceState(liftV4(raw));
-		case V5: return {
-			state: InstanceState.parse(liftV5(raw)),
+		case V5: return migrateInstanceState(liftV5(raw));
+		case V6: return {
+			state: InstanceState.parse(liftV6(raw)),
 			movedSecrets: null
 		};
-		case 6: return {
+		case 7: return {
 			state: InstanceState.parse(raw),
 			movedSecrets: null
 		};
-		default: throw new ConfigError(`state schemaVersion ${schemaVersion} is not supported by this build (expected 6)`);
+		default: throw new ConfigError(`state schemaVersion ${schemaVersion} is not supported by this build (expected 7)`);
 	}
 }
 //#endregion
@@ -814,8 +839,11 @@ const SESSION_HEADER = "X-Metabase-Session";
 const API_KEY_HEADER = "X-Api-Key";
 const JSON_CONTENT_TYPE = "application/json";
 const SERVICE_UNAVAILABLE_STATUS = 503;
+const NO_CONTENT_STATUS = 204;
 const NO_AUTH = { kind: "none" };
 const ErrorMessage = z.object({ message: z.string() }).loose();
+const ErrorTitle = z.object({ error: z.string() }).loose();
+const ErrorCode = z.object({ error_code: z.string() }).loose();
 const ErrorFields = z.object({ errors: z.record(z.string(), z.unknown()) }).loose();
 const ErrorText = z.string();
 const ErrorTexts = z.array(z.string());
@@ -878,6 +906,8 @@ function serverMessage(body) {
 	const value = jsonValue(body);
 	const parsed = ErrorMessage.safeParse(value);
 	if (parsed.success) return parsed.data.message;
+	const title = ErrorTitle.safeParse(value);
+	if (title.success) return title.data.error;
 	const errors = serverErrors(body);
 	if (errors !== null && Object.keys(errors).length > 0) return Object.entries(errors).map(([name, problem]) => `${name}: ${problem}`).join("; ");
 	const plain = ErrorText.safeParse(value);
@@ -886,6 +916,10 @@ function serverMessage(body) {
 	if (body.json.parsed || text.length === 0) return `HTTP ${body.status}`;
 	return text;
 }
+function errorCode(body) {
+	const parsed = ErrorCode.safeParse(jsonValue(body));
+	return parsed.success ? parsed.data.error_code : null;
+}
 function failureFor(path, body) {
 	if (body.status === SERVICE_UNAVAILABLE_STATUS) {
 		const initializing = Initializing.safeParse(jsonValue(body));
@@ -895,7 +929,9 @@ function failureFor(path, body) {
 		status: body.status,
 		path,
 		message: serverMessage(body),
-		errors: serverErrors(body)
+		errors: serverErrors(body),
+		code: errorCode(body),
+		detail: body.json.parsed ? body.json.value : null
 	});
 }
 function shapeError(path, body, reason) {
@@ -903,7 +939,9 @@ function shapeError(path, body, reason) {
 		status: body.status,
 		path,
 		message: reason,
-		errors: null
+		errors: null,
+		code: null,
+		detail: null
 	});
 }
 function isTimeout(error) {
@@ -953,19 +991,33 @@ function createHttp(options) {
 		if (!received.ok) throw failureFor(path, received.body);
 		return received.body;
 	}
+	function parseJson(path, body, schema) {
+		if (!body.json.parsed) throw shapeError(path, body, "expected a JSON body");
+		return parseShape(path, body, schema, body.json.value);
+	}
+	function parseShape(path, body, schema, value) {
+		try {
+			return schema.parse(value);
+		} catch (error) {
+			if (error instanceof ZodError) throw shapeError(path, body, `unexpected response shape:\n${z.prettifyError(error)}`);
+			throw error;
+		}
+	}
 	return {
 		async requestJson(method, path, request) {
+			return parseJson(path, await requestBody(method, path, request.body), request.schema);
+		},
+		async requestOptionalJson(method, path, request) {
 			const body = await requestBody(method, path, request.body);
-			if (!body.json.parsed) throw shapeError(path, body, "expected a JSON body");
-			try {
-				return request.schema.parse(body.json.value);
-			} catch (error) {
-				if (error instanceof ZodError) throw shapeError(path, body, `unexpected response shape:\n${z.prettifyError(error)}`);
-				throw error;
-			}
+			if (body.status === NO_CONTENT_STATUS && body.text.length === 0) return null;
+			return parseJson(path, body, request.schema);
 		},
 		async requestNoContent(method, path, request = {}) {
 			await requestBody(method, path, request.body);
+		},
+		async requestText(method, path, request) {
+			const body = await requestBody(method, path, request.body);
+			return parseShape(path, body, request.schema, body.text);
 		}
 	};
 }
@@ -1056,6 +1108,48 @@ function apiKeyResource(http) {
 		regenerate
 	};
 }
+const Collection = z.object({
+	id: z.int(),
+	name: z.string(),
+	location: z.string(),
+	type: z.string().nullable(),
+	namespace: z.string().nullable(),
+	personal_owner_id: z.int().nullable(),
+	is_remote_synced: z.boolean()
+}).loose();
+const RootCollection = z.object({ id: z.literal("root") }).loose();
+const CollectionList = z.array(z.union([Collection, RootCollection]));
+const CollectionRef = z.object({
+	id: z.int(),
+	name: z.string()
+}).loose();
+//#endregion
+//#region src/metabase/resources/collection.ts
+function collectionResource(http) {
+	/** GET /api/collection */
+	async function list() {
+		return http.requestJson("GET", "/api/collection", { schema: CollectionList });
+	}
+	/** POST /api/collection */
+	async function create(request) {
+		return http.requestJson("POST", "/api/collection", {
+			body: {
+				...request,
+				parent_id: null
+			},
+			schema: CollectionRef
+		});
+	}
+	/** POST /api/ee/library; 400 when the Library exists */
+	async function createLibrary() {
+		return http.requestJson("POST", "/api/ee/library", { schema: CollectionRef });
+	}
+	return {
+		list,
+		create,
+		createLibrary
+	};
+}
 //#endregion
 //#region src/metabase/domain/database.ts
 const InitialSyncStatus = z.enum([
@@ -1148,7 +1242,9 @@ function permissionsGroupResource(http) {
 	}
 	return { list };
 }
-z.enum(["read-only", "read-write"]);
+//#endregion
+//#region src/metabase/domain/remote-sync.ts
+const RemoteSyncType = z.enum(["read-only", "read-write"]);
 const RemoteSyncSettingsResult = z.object({
 	success: z.boolean(),
 	task_id: z.int().optional()
@@ -1169,6 +1265,38 @@ const SyncTask = z.object({
 	status: SyncTaskStatus$1,
 	error_message: z.string().nullable().optional()
 }).loose();
+const NamedCollection = z.object({
+	id: z.int(),
+	name: z.string()
+}).loose();
+const DependencyLocation = NamedCollection.nullable().optional();
+const DependencyItem = z.object({
+	model: z.string(),
+	id: z.int(),
+	name: z.string().nullable()
+}).loose();
+const UnsyncedDependency = DependencyItem.extend({
+	collection: DependencyLocation,
+	used_by: z.array(DependencyItem)
+});
+const SyncRemedy = z.discriminatedUnion("type", [
+	z.object({
+		type: z.literal("collection"),
+		collection: NamedCollection
+	}).loose(),
+	z.object({ type: z.literal("library") }).loose(),
+	z.object({
+		type: z.literal("none"),
+		collection: DependencyLocation
+	}).loose()
+]);
+const RequiredSync = z.object({
+	remedy: SyncRemedy,
+	syncable: z.boolean(),
+	blocks: z.array(NamedCollection),
+	dependencies: z.array(UnsyncedDependency)
+}).loose();
+const UnsyncedDependencies = z.object({ errors: z.object({ required: z.array(RequiredSync) }).loose() }).loose();
 //#endregion
 //#region src/metabase/resources/remote-sync.ts
 function remoteSyncResource(http) {
@@ -1179,6 +1307,13 @@ function remoteSyncResource(http) {
 			schema: RemoteSyncSettingsResult
 		});
 	}
+	/** PUT /api/ee/remote-sync/settings, without the git settings, which it leaves as they are */
+	async function updateScope(scope) {
+		return http.requestJson("PUT", "/api/ee/remote-sync/settings", {
+			body: scope,
+			schema: RemoteSyncSettingsResult
+		});
+	}
 	/** PUT /api/ee/remote-sync/settings with only `remote-sync-transforms`, which skips the repository check. */
 	async function syncTransforms() {
 		return http.requestJson("PUT", "/api/ee/remote-sync/settings", {
@@ -1195,10 +1330,11 @@ function remoteSyncResource(http) {
 	}
 	/** GET /api/ee/remote-sync/current-task */
 	async function currentTask() {
-		return http.requestJson("GET", "/api/ee/remote-sync/current-task", { schema: SyncTask.nullable() });
+		return http.requestOptionalJson("GET", "/api/ee/remote-sync/current-task", { schema: SyncTask });
 	}
 	return {
 		updateSettings,
+		updateScope,
 		syncTransforms,
 		testConnection,
 		currentTask
@@ -1271,6 +1407,7 @@ const PREMIUM_EMBEDDING_TOKEN_SETTING = "premium-embedding-token";
 const ENGINES_SETTING = "engines";
 const TRANSFORMS_ENABLED_SETTING = "transforms-enabled";
 const TRANSFORMS_SETUP_COMPLETE_SETTING = "transforms-setup-complete";
+const REMOTE_SYNC_TYPE_SETTING = "remote-sync-type";
 function settingResource(http) {
 	/** PUT /api/setting/premium-embedding-token */
 	async function setPremiumEmbeddingToken(value) {
@@ -1288,11 +1425,16 @@ function settingResource(http) {
 	async function engines() {
 		return http.requestJson("GET", `/api/setting/${ENGINES_SETTING}`, { schema: Engines });
 	}
+	/** GET /api/setting/remote-sync-type; Metabase answers its default, read-only, while unset. */
+	async function remoteSyncType() {
+		return http.requestText("GET", `/api/setting/${REMOTE_SYNC_TYPE_SETTING}`, { schema: RemoteSyncType });
+	}
 	return {
 		setPremiumEmbeddingToken,
 		enableTransforms,
 		transformsDecided,
-		engines
+		engines,
+		remoteSyncType
 	};
 }
 //#endregion
@@ -1362,6 +1504,7 @@ function createMetabaseClient(baseUrl, auth, signal, options = {}) {
 		tokenStatus: tokenStatusResource(http),
 		database: databaseResource(http),
 		remoteSync: remoteSyncResource(http),
+		collection: collectionResource(http),
 		user: userResource(http)
 	};
 }
@@ -2904,12 +3047,12 @@ async function portClaims(state, runtime) {
 }
 //#endregion
 //#region src/steps/admin-user.ts
-const STEP_ID$8 = "admin-user";
+const STEP_ID$9 = "admin-user";
 const ADMIN_USER_KEYS = {
-	email: `${STEP_ID$8}.email`,
-	password: `${STEP_ID$8}.password`,
-	firstName: `${STEP_ID$8}.first-name`,
-	lastName: `${STEP_ID$8}.last-name`
+	email: `${STEP_ID$9}.email`,
+	password: `${STEP_ID$9}.password`,
+	firstName: `${STEP_ID$9}.first-name`,
+	lastName: `${STEP_ID$9}.last-name`
 };
 const GENERATED_ADMIN_EMAIL = "admin@metabase.local";
 const GENERATED_PASSWORD_BYTES = 24;
@@ -2924,7 +3067,7 @@ function generatePassword(random) {
 		if (DIGIT.test(candidate)) return candidate;
 	}
 }
-function hostDeps$13(ctx) {
+function hostDeps$14(ctx) {
 	return {
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
 		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal)),
@@ -3062,9 +3205,9 @@ async function recordExistingAdmin(ctx, variant, client, url) {
 	ctx.ui.success(`Admin user ${email} recorded`);
 	return "completed";
 }
-function adminUserStep(options, deps = hostDeps$13) {
+function adminUserStep(options, deps = hostDeps$14) {
 	return {
-		id: STEP_ID$8,
+		id: STEP_ID$9,
 		title: "Create the admin user",
 		redoHint: "An instance keeps the admin it was set up with; `rde credentials` shows it.",
 		async detect(ctx) {
@@ -3329,10 +3472,15 @@ const GitSyncTask = z.object({
 	progress: z.number().nullable(),
 	error_message: z.string().nullable().optional()
 }).loose();
+const SyncedCollection = z.object({
+	id: z.int(),
+	name: z.string()
+}).loose();
 const GitSyncStatus = z.object({
 	branch: z.string().nullable(),
 	is_dirty: z.boolean(),
-	current_task: GitSyncTask.nullable()
+	current_task: GitSyncTask.nullable(),
+	synced_collections: z.array(SyncedCollection)
 }).loose();
 const GitSyncOutcome = z.object({
 	message: z.string().nullable(),
@@ -3344,6 +3492,9 @@ const RemoteChanges = z.object({
 	remote_version: z.string().nullable(),
 	local_version: z.string().nullable()
 }).loose();
+function remoteMoved(changes) {
+	return changes.has_changes && changes.local_version !== null;
+}
 function comparableUrl(url) {
 	const parsed = new URL(url);
 	return `${parsed.origin}${parsed.pathname.replace(/\/+$/, "")}`;
@@ -3479,14 +3630,14 @@ function mbTool(runner) {
 }
 //#endregion
 //#region src/steps/api-key.ts
-const STEP_ID$7 = "api-key";
+const STEP_ID$8 = "api-key";
 const API_KEY_KEYS = {
-	email: `${STEP_ID$7}.email`,
-	password: `${STEP_ID$7}.password`,
-	profile: `${STEP_ID$7}.profile`
+	email: `${STEP_ID$8}.email`,
+	password: `${STEP_ID$8}.password`,
+	profile: `${STEP_ID$8}.profile`
 };
 const ADMINISTRATORS_GROUP_NAME = "Administrators";
-function hostDeps$12(ctx) {
+function hostDeps$13(ctx) {
 	return {
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
 		runner: processRunner(ctx.signal),
@@ -3547,7 +3698,7 @@ async function authenticates(client) {
 	}
 }
 async function forgetCompletion(ctx) {
-	const { [STEP_ID$7]: record, ...steps } = ctx.state.steps;
+	const { [STEP_ID$8]: record, ...steps } = ctx.state.steps;
 	if (record !== void 0) await ctx.saveState({
 		...ctx.state,
 		steps
@@ -3624,15 +3775,15 @@ function usageNote(profile) {
 	if (profile === "default") return `${mbCommand(profile)} <command> uses this instance`;
 	return `${mbCommand(profile)} <command>\nMB_PROFILE=${profile} for agents and scripts`;
 }
-function apiKeyStep(deps = hostDeps$12) {
+function apiKeyStep(deps = hostDeps$13) {
 	return {
-		id: STEP_ID$7,
+		id: STEP_ID$8,
 		title: "Connect the Metabase CLI",
 		redoHint: "`rde status` shows the mb profile it uses.",
 		async detect(ctx) {
 			const configured = configuredRuntime(ctx.state);
 			const apiKey = ctx.secrets.apiKey;
-			if (configured === null || apiKey === null || ctx.state.steps[STEP_ID$7]?.status !== "done") return "todo";
+			if (configured === null || apiKey === null || ctx.state.steps[STEP_ID$8]?.status !== "done") return "todo";
 			const resolved = deps(ctx);
 			if (!await resolved.instanceRunning()) return "todo";
 			if (!isLoggedInAt(await mbTool(resolved.runner).authStatusIfInstalled(ctx.state.mbProfile), configured.url)) return "todo";
@@ -5578,13 +5729,13 @@ function gitTool(runner) {
 }
 //#endregion
 //#region src/steps/git-sync.ts
-const STEP_ID$6 = "git-sync";
+const STEP_ID$7 = "git-sync";
 const GIT_SYNC_KEYS = {
-	location: `${STEP_ID$6}.location`,
-	path: `${STEP_ID$6}.path`,
-	remote: `${STEP_ID$6}.remote`,
-	url: `${STEP_ID$6}.url`,
-	token: `${STEP_ID$6}.token`
+	location: `${STEP_ID$7}.location`,
+	path: `${STEP_ID$7}.path`,
+	remote: `${STEP_ID$7}.remote`,
+	url: `${STEP_ID$7}.url`,
+	token: `${STEP_ID$7}.token`
 };
 const BARE_REPO_NAME = "content.git";
 const DEFAULT_BRANCH = "main";
@@ -5618,7 +5769,7 @@ const SYNC_MODE_SETTINGS = {
 	"remote-sync-type": "read-write",
 	"remote-sync-transforms": true
 };
-function hostDeps$11(ctx) {
+function hostDeps$12(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
@@ -6088,15 +6239,15 @@ async function runGitSync(ctx, deps) {
 	ctx.ui.note(usageLines(ctx.state, remote.gitRemote).join("\n"), "Working with the repository");
 	return "completed";
 }
-function gitSyncStep(deps = hostDeps$11) {
+function gitSyncStep(deps = hostDeps$12) {
 	return {
-		id: STEP_ID$6,
+		id: STEP_ID$7,
 		title: "Connect a git repository",
 		redoHint: "`rde init --only git-sync` with it points Metabase's remote sync at that repository instead.",
 		async detect(ctx) {
 			if (!hasRemoteSync(ctx.state.license)) return "not-applicable";
-			if (ctx.state.steps[STEP_ID$6]?.status === "skipped") return "not-applicable";
-			if (ctx.state.gitRemote === null || ctx.state.steps[STEP_ID$6]?.status !== "done") return "todo";
+			if (ctx.state.steps[STEP_ID$7]?.status === "skipped") return "not-applicable";
+			if (ctx.state.gitRemote === null || ctx.state.steps[STEP_ID$7]?.status !== "done") return "todo";
 			const instance = mbInstanceOf(ctx.state, ctx.secrets);
 			if (instance === null) return "todo";
 			try {
@@ -6278,12 +6429,12 @@ function skillsCli(runner) {
 }
 //#endregion
 //#region src/steps/agents-skills.ts
-const STEP_ID$5 = "agents-skills";
-const AGENTS_SKILLS_KEYS = { agents: `${STEP_ID$5}.agents` };
+const STEP_ID$6 = "agents-skills";
+const AGENTS_SKILLS_KEYS = { agents: `${STEP_ID$6}.agents` };
 const MECHANICS_NOTE = "The rde skill's mechanics come from `mb skills get <name>` at runtime, so nothing else needs installing.";
 const REQUIRED_SKILL_NAMES = [...DATA_APP_SKILL_NAMES, ...RDE_SOURCE_SKILL_NAMES];
 const DETECT_AGENTS = { kind: "detected" };
-function hostDeps$10(ctx) {
+function hostDeps$11(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
 		probe: hostAgentProbe(),
@@ -6462,11 +6613,11 @@ function skipLine(all, source) {
 	switch (source) {
 		case "override":
 		case "chosen":
-		case "installed": return `Skipping the skills; run \`rde init --only ${STEP_ID$5}\` to install it later`;
-		case "detected": return `No coding agent found (${displayNames(all)}); run \`rde init --only ${STEP_ID$5} --agents <name>\` once one is installed`;
+		case "installed": return `Skipping the skills; run \`rde init --only ${STEP_ID$6}\` to install it later`;
+		case "detected": return `No coding agent found (${displayNames(all)}); run \`rde init --only ${STEP_ID$6} --agents <name>\` once one is installed`;
 	}
 }
-function agentsSkillsStep(options, updates, deps = hostDeps$10) {
+function agentsSkillsStep(options, updates, deps = hostDeps$11) {
 	let hashes = null;
 	async function setCheck(resolved) {
 		hashes ??= hashLookup(resolved.github);
@@ -6477,13 +6628,13 @@ function agentsSkillsStep(options, updates, deps = hostDeps$10) {
 		};
 	}
 	return {
-		id: STEP_ID$5,
+		id: STEP_ID$6,
 		title: "Install the rde and data-app skills for your coding agents",
 		redoHint: "`rde init --only agents-skills` with it installs the skills for those agents.",
 		async detect(ctx) {
 			const resolved = deps(ctx);
 			const detected = detectedOnly(await detectAgents(resolved.probe));
-			if (detected.length === 0) return ctx.state.steps[STEP_ID$5]?.status === "skipped" ? "not-applicable" : "todo";
+			if (detected.length === 0) return ctx.state.steps[STEP_ID$6]?.status === "skipped" ? "not-applicable" : "todo";
 			if (missingSkills(await skillsCli(resolved.runner).list(), detected).length > 0) return "todo";
 			const check = await setCheck(resolved);
 			for (const set of skillSets(resolved)) if (await setBehind(set, check)) return "outdated";
@@ -6640,13 +6791,13 @@ async function connectRequired(ctx, deps, opening) {
 		result: { addedDatabases: connected.added }
 	};
 }
-function hostDeps$9(ctx) {
+function hostDeps$10(ctx) {
 	return {
 		...hostDatabasesDeps(ctx.signal),
 		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal))
 	};
 }
-function databasesStep(options, deps = hostDeps$9) {
+function databasesStep(options, deps = hostDeps$10) {
 	return {
 		id: "databases",
 		title: "Connect your databases",
@@ -6709,7 +6860,7 @@ function npmRegistry(signal, options = {}) {
 }
 //#endregion
 //#region src/steps/install-mb.ts
-const STEP_ID$4 = "install-mb";
+const STEP_ID$5 = "install-mb";
 const MIN_MB_VERSION = "0.3.0";
 const MB_RANGE = `>=${MIN_MB_VERSION}`;
 function installedWith(scriptPath) {
@@ -6718,7 +6869,7 @@ function installedWith(scriptPath) {
 function rdeInstalledWith() {
 	return installedWith(process.argv[1]);
 }
-function hostDeps$8(ctx) {
+function hostDeps$9(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
 		installedWith: rdeInstalledWith(),
@@ -6885,7 +7036,7 @@ async function updateFor(release, installed, deps) {
 		version
 	};
 }
-function installMbStep(updates, deps = hostDeps$8) {
+function installMbStep(updates, deps = hostDeps$9) {
 	let published = null;
 	function release(resolved) {
 		if (updates === "installed") return Promise.resolve(UNCHECKED);
@@ -6893,7 +7044,7 @@ function installMbStep(updates, deps = hostDeps$8) {
 		return published;
 	}
 	return {
-		id: STEP_ID$4,
+		id: STEP_ID$5,
 		title: "Install the Metabase CLI",
 		async detect(ctx) {
 			const resolved = deps(ctx);
@@ -6935,8 +7086,8 @@ function installMbStep(updates, deps = hostDeps$8) {
 }
 //#endregion
 //#region src/steps/license.ts
-const STEP_ID$3 = "license";
-const LICENSE_KEYS = { token: `${STEP_ID$3}.token` };
+const STEP_ID$4 = "license";
+const LICENSE_KEYS = { token: `${STEP_ID$4}.token` };
 const TOKEN_PATTERN = /^[0-9a-f]{64}$/i;
 const NOT_FOUND_STATUS$1 = 404;
 const TOKEN_REFUSED_STATUS = 400;
@@ -6959,7 +7110,7 @@ function licensedFeatureCoverage(features) {
 function listOf(names, type) {
 	return new Intl.ListFormat("en", { type }).format(names);
 }
-function hostDeps$7(ctx) {
+function hostDeps$8(ctx) {
 	return {
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
 		runner: processRunner(ctx.signal),
@@ -7044,13 +7195,13 @@ function reportFeatures(ctx, features) {
 		ctx.ui.warn(`This license does not include ${listOf(missing, "disjunction")}${gitNote}`);
 	}
 }
-function licenseStep(deps = hostDeps$7) {
+function licenseStep(deps = hostDeps$8) {
 	return {
-		id: STEP_ID$3,
+		id: STEP_ID$4,
 		title: "Activate your license",
 		redoHint: "`rde init --from license` with it activates the license and runs the steps after it again.",
 		async detect(ctx) {
-			if (ctx.state.steps[STEP_ID$3]?.status === "skipped") return "not-applicable";
+			if (ctx.state.steps[STEP_ID$4]?.status === "skipped") return "not-applicable";
 			const configured = configuredRuntime(ctx.state);
 			if (configured === null || ctx.secrets.apiKey === null) return "todo";
 			const resolved = deps(ctx);
@@ -7122,7 +7273,7 @@ const PLATFORMS = {
 		javaHint: `Install Java 21 or newer with your distribution's package manager (openjdk-21-jre) or from https://adoptium.net`
 	}
 };
-function hostDeps$6(ctx) {
+function hostDeps$7(ctx) {
 	const runner = processRunner(ctx.signal);
 	return {
 		platform: process.platform,
@@ -7244,7 +7395,7 @@ function checkLine(check) {
 function checkLines(checks) {
 	return checks.map(checkLine);
 }
-function preflightStep(deps = hostDeps$6) {
+function preflightStep(deps = hostDeps$7) {
 	return {
 		id: "preflight",
 		title: "Check this machine",
@@ -7263,7 +7414,7 @@ function preflightStep(deps = hostDeps$6) {
 }
 //#endregion
 //#region src/steps/runtime.ts
-const STEP_ID$2 = "runtime";
+const STEP_ID$3 = "runtime";
 const MIN_PORT = 1;
 const MAX_PORT = 65535;
 const PORT_PATTERN = /^\d+$/;
@@ -7277,7 +7428,7 @@ const NO_RUNTIME_FLAGS = {
 	jar: null,
 	port: null
 };
-function hostDeps$5(ctx) {
+function hostDeps$6(ctx) {
 	return {
 		runtime: hostRuntimeDeps(ctx.state.name, ctx.signal),
 		releases: releaseLookup(ctx.signal)
@@ -7406,9 +7557,9 @@ async function persistedRuntime(ctx, options, deps) {
 	});
 	return chosen;
 }
-function runtimeStep(options, deps = hostDeps$5) {
+function runtimeStep(options, deps = hostDeps$6) {
 	return {
-		id: STEP_ID$2,
+		id: STEP_ID$3,
 		title: "Install Metabase",
 		redoHint: "Move it with `rde start --port`, or change its Metabase with `rde upgrade --to`.",
 		async detect(ctx) {
@@ -7437,7 +7588,7 @@ const DEFAULT_HEALTH_TIMING = { timeoutMs: 3e5 };
 //#region src/steps/start-metabase.ts
 const LOG_TAIL_ON_TIMEOUT = 30;
 const PERCENT = 100;
-function hostDeps$4(ctx) {
+function hostDeps$5(ctx) {
 	return {
 		runtime: hostRuntimeDeps(ctx.state.name, ctx.signal),
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
@@ -7466,7 +7617,7 @@ async function startRuntime(ctx, runtime, deps) {
 		throw error;
 	}
 }
-function startMetabaseStep(deps = hostDeps$4) {
+function startMetabaseStep(deps = hostDeps$5) {
 	return {
 		id: "start-metabase",
 		title: "Start Metabase",
@@ -7524,6 +7675,261 @@ function startMetabaseStep(deps = hostDeps$4) {
 	};
 }
 //#endregion
+//#region src/steps/sync-scope.ts
+const STEP_ID$2 = "sync-scope";
+const SYNC_SCOPE_KEYS = { export: `${STEP_ID$2}.export` };
+const AGENT_COLLECTION_NAME = "Analytics";
+const LIBRARY_NAME = "Library";
+const ROOT_COLLECTION_NAME = "Our analytics";
+const AGENT_COLLECTION_DESCRIPTION = "Dashboards, questions, models, and documents that reach git on export.";
+function hostDeps$4(ctx) {
+	return {
+		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
+		runner: processRunner(ctx.signal),
+		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal))
+	};
+}
+function isCollection(entry) {
+	return typeof entry.id === "number";
+}
+function isOrdinary(collection) {
+	return collection.type === null && collection.namespace === null && collection.personal_owner_id === null;
+}
+function readScope(list, syncRoot) {
+	const topLevel = list.filter(isCollection).filter((collection) => collection.location === "/");
+	const ordinary = topLevel.filter(isOrdinary);
+	const unsynced = ordinary.filter((collection) => !collection.is_remote_synced);
+	return {
+		library: topLevel.find((collection) => collection.type === "library") ?? null,
+		syncedRoots: ordinary.filter((collection) => collection.is_remote_synced),
+		unsyncedRecordedRoot: unsynced.find((collection) => collection.id === syncRoot) ?? null,
+		foreignNamesake: unsynced.some((collection) => collection.id !== syncRoot && collection.name === "Analytics")
+	};
+}
+function isComplete(scope, libraryLicensed) {
+	return (!libraryLicensed || scope.library !== null && scope.library.is_remote_synced) && scope.syncedRoots.length > 0;
+}
+function isNotAnsweringYet(error) {
+	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError || isRejectedCredential(error);
+}
+function requireMbInstance(ctx) {
+	const instance = mbInstanceOf(ctx.state, ctx.secrets);
+	if (instance === null) throw new ConfigError("no API key yet; the api-key step comes first");
+	return instance;
+}
+function requireGitRemote(ctx) {
+	if (ctx.state.gitRemote === null) throw new ConfigError("no repository yet; the git-sync step comes first");
+	return ctx.state.gitRemote;
+}
+async function requireSettledImport(ctx, client, gitRemote) {
+	const task = await client.remoteSync.currentTask();
+	if (task === null) return;
+	if (task.status === "running") throw new ConfigError(`a remote sync ${task.sync_task_type} is running; run \`rde init --only ${STEP_ID$2}\` once it finishes`);
+	if (task.sync_task_type === "import" && task.status !== "successful") {
+		const importCommand = `${mbCommand(ctx.state.mbProfile)} git-sync import --branch ${shellWord(gitRemote.branch)}`;
+		throw new ConfigError(`the last import from the repository ended ${task.status}; run \`${importCommand}\`, then \`rde init --only ${STEP_ID$2}\``);
+	}
+}
+async function isReadOnly(client) {
+	return await client.setting.remoteSyncType() === "read-only";
+}
+async function requireReadWrite(client) {
+	if (await isReadOnly(client)) throw new ConfigError(`remote sync is read-only; the repository decides what syncs. Switch it to read-write in Admin, then \`rde init --only ${STEP_ID$2}\``);
+}
+async function ensureLibrary(client, scope, libraryLicensed) {
+	if (!libraryLicensed) return null;
+	return scope.library ?? client.collection.createLibrary();
+}
+async function ensureRoots(ctx, client, scope) {
+	if (scope.syncedRoots.length > 0) return {
+		roots: scope.syncedRoots,
+		created: false,
+		besideNamesake: false
+	};
+	if (scope.unsyncedRecordedRoot !== null) return {
+		roots: [scope.unsyncedRecordedRoot],
+		created: false,
+		besideNamesake: false
+	};
+	const created = await client.collection.create({
+		name: AGENT_COLLECTION_NAME,
+		description: AGENT_COLLECTION_DESCRIPTION
+	});
+	await ctx.saveState({
+		...ctx.state,
+		syncRoot: created.id
+	});
+	return {
+		roots: [created],
+		created: true,
+		besideNamesake: scope.foreignNamesake
+	};
+}
+function itemLabel(item) {
+	return item.name === null ? `${item.model} ${item.id}` : `${item.model} ${item.id} "${item.name}"`;
+}
+function locationLabel(location) {
+	if (location === void 0) return "in a collection Metabase could not find";
+	return `in ${location === null ? ROOT_COLLECTION_NAME : location.name}`;
+}
+function dependencyLine(dependency) {
+	const line = `  ${itemLabel(dependency)} ${locationLabel(dependency.collection)}`;
+	if (dependency.used_by.length === 0) return line;
+	return `${line}, used by ${dependency.used_by.map(itemLabel).join(", ")}`;
+}
+function remedyLine(required) {
+	const remedy = required.remedy;
+	switch (remedy.type) {
+		case "collection":
+			if (required.syncable) return `  Fix: sync ${remedy.collection.name} too, or move that content into a synced collection.`;
+			return `  Fix: move that content into a synced collection; ${remedy.collection.name} cannot sync.`;
+		case "library": return "  Fix: stop using that content; it syncs only through a Library, and this instance has none.";
+		case "none": return "  Fix: move that content into a synced collection, or stop using it.";
+	}
+}
+function requiredSyncLines(required) {
+	return [
+		`Metabase will not sync ${required.blocks.map((collection) => collection.name).join(", ")}, because content there uses:`,
+		...required.dependencies.map(dependencyLine),
+		remedyLine(required)
+	];
+}
+function explainRefusal(error) {
+	if (!(error instanceof MetabaseApiError) || error.code !== "unsynced-dependencies") return error;
+	const refusal = UnsyncedDependencies.safeParse(error.detail);
+	if (!refusal.success) return error;
+	return new ConfigError([...refusal.data.errors.required.flatMap(requiredSyncLines), `After the fix, run \`rde init --only ${STEP_ID$2}\`.`].join("\n"));
+}
+function plannedNames(scope, libraryLicensed) {
+	const library = libraryLicensed ? [scope.library?.name ?? LIBRARY_NAME] : [];
+	if (scope.syncedRoots.length > 0) return [...library, ...scope.syncedRoots.map((collection) => collection.name)];
+	return [...library, scope.unsyncedRecordedRoot?.name ?? "Analytics"];
+}
+function nameList(names) {
+	if (names.length <= 2) return names.join(" and ");
+	return `${names.slice(0, -1).join(", ")}, and ${names.at(-1)}`;
+}
+function exportAdvice(profile, branch, changes) {
+	const command = exportCommand(profile, branch);
+	if (!remoteMoved(changes)) return `\`${command}\``;
+	return `the branch has commits Metabase has not imported; \`${mbCommand(profile)} git-sync export-preflight\`, then \`${command} --merge\``;
+}
+async function planExport(ctx, runner, instance, names) {
+	const changes = await mbTool(runner).gitSyncHasRemoteChanges(instance);
+	if (remoteMoved(changes)) return {
+		changes,
+		push: false
+	};
+	return {
+		changes,
+		push: await ctx.prompts.confirm({
+			key: SYNC_SCOPE_KEYS.export,
+			message: `Push ${nameList(names)} to ${requireGitRemote(ctx).branch} now?`,
+			initialValue: true
+		})
+	};
+}
+function describeExport(task) {
+	const ended = `the export ended ${task.status}`;
+	return task.error_message === null || task.error_message === void 0 ? ended : `${ended}: ${task.error_message}`;
+}
+function reportPending(run) {
+	const advice = exportAdvice(run.ctx.state.mbProfile, run.gitRemote.branch, run.changes);
+	run.ctx.ui.info(`First export pending: ${advice}`);
+}
+async function exportScope(run, runner) {
+	const mb = mbTool(runner);
+	const label = nameList(run.names);
+	const spinner = run.ctx.ui.spinner(`Pushing ${label} to ${run.gitRemote.branch}…`);
+	try {
+		const final = (await mb.gitSyncExport(run.instance, {
+			branch: run.gitRemote.branch,
+			message: `Sync ${label}`
+		})).final ?? null;
+		if (final !== null && final.status !== "successful") {
+			spinner.fail(describeExport(final));
+			reportPending(run);
+			return;
+		}
+		const status = await mb.gitSyncStatus(run.instance);
+		spinner.stop(`Pushed ${label} to ${run.gitRemote.branch}`);
+		if (status.is_dirty) run.ctx.ui.warn(`Metabase still has changes the export did not carry; \`${mbCommand(run.ctx.state.mbProfile)} git-sync dirty\` lists them`);
+	} catch (error) {
+		if (!(error instanceof ExternalToolError)) throw error;
+		spinner.fail(`Could not push ${label}: ${error.message}`);
+		reportPending(run);
+	}
+}
+function scopeLabel(synced) {
+	return `Synced to git: ${synced.map((collection) => collection.name).join(", ")}`;
+}
+function syncScopeStep(deps = hostDeps$4) {
+	return {
+		id: STEP_ID$2,
+		title: "Choose what syncs to git",
+		async detect(ctx) {
+			if (!hasRemoteSync(ctx.state.license) || ctx.state.gitRemote === null) return "not-applicable";
+			const configured = configuredRuntime(ctx.state);
+			if (configured === null || ctx.secrets.apiKey === null) return "todo";
+			const resolved = deps(ctx);
+			if (!await resolved.instanceRunning()) return "todo";
+			const client = resolved.client(configured.url, {
+				kind: "api-key",
+				key: ctx.secrets.apiKey
+			});
+			try {
+				if (isComplete(readScope(await client.collection.list(), ctx.state.syncRoot), hasLibrary(ctx.state.license))) return "done";
+				return await isReadOnly(client) ? "not-applicable" : "todo";
+			} catch (error) {
+				if (isNotAnsweringYet(error)) return "todo";
+				throw error;
+			}
+		},
+		async run(ctx) {
+			requireConfiguredRuntime(ctx.state);
+			const gitRemote = requireGitRemote(ctx);
+			const instance = requireMbInstance(ctx);
+			const resolved = deps(ctx);
+			const client = resolved.client(instance.url, {
+				kind: "api-key",
+				key: instance.apiKey
+			});
+			await requireReadWrite(client);
+			await requireSettledImport(ctx, client, gitRemote);
+			const libraryLicensed = hasLibrary(ctx.state.license);
+			const scope = readScope(await client.collection.list(), ctx.state.syncRoot);
+			const names = plannedNames(scope, libraryLicensed);
+			const plan = isComplete(scope, libraryLicensed) ? null : await planExport(ctx, resolved.runner, instance, names);
+			const spinner = ctx.ui.spinner("Choosing what syncs to git…");
+			let synced;
+			let chosen;
+			try {
+				const library = await ensureLibrary(client, scope, libraryLicensed);
+				chosen = await ensureRoots(ctx, client, scope);
+				synced = library === null ? chosen.roots : [library, ...chosen.roots];
+				await client.remoteSync.updateScope({ collections: Object.fromEntries(synced.map((collection) => [collection.id, true])) });
+			} catch (error) {
+				spinner.fail("Could not choose what syncs to git");
+				throw explainRefusal(error);
+			}
+			spinner.stop(scopeLabel(synced));
+			if (chosen.created) ctx.ui.info(`Created the ${AGENT_COLLECTION_NAME} collection: dashboards, questions, models, and documents filed under it reach git on the next export`);
+			if (chosen.besideNamesake) ctx.ui.info(`Another collection is also named ${AGENT_COLLECTION_NAME}; rde did not create it, so it stays out of git`);
+			if (plan === null) return { outcome: "completed" };
+			const exportRun = {
+				ctx,
+				instance,
+				gitRemote,
+				names,
+				changes: plan.changes
+			};
+			if (plan.push) await exportScope(exportRun, resolved.runner);
+			else reportPending(exportRun);
+			return { outcome: "completed" };
+		}
+	};
+}
+//#endregion
 //#region src/steps/summary.ts
 const STEP_ID$1 = "summary";
 const GIT_SYNC_STEP_ID = "git-sync";
@@ -7581,6 +7987,19 @@ function gitLines(state) {
 	if (state.gitRemote === null) return [`Remote sync: not configured (${notConfiguredReason(state)})`];
 	return [`Content repository: ${state.gitRemote.workdir} (branch ${state.gitRemote.branch})`, remoteLine(state.gitRemote)];
 }
+async function pendingExportLines(state, secrets, runner) {
+	const instance = mbInstanceOf(state, secrets);
+	if (state.gitRemote === null || instance === null) return [];
+	try {
+		const mb = mbTool(runner);
+		if (!(await mb.gitSyncStatus(instance)).is_dirty) return [];
+		const changes = await mb.gitSyncHasRemoteChanges(instance);
+		return [`Export pending: ${exportAdvice(state.mbProfile, state.gitRemote.branch, changes)}`];
+	} catch (error) {
+		if (error instanceof ProcessNotFoundError || error instanceof ExternalToolError) return [`Remote sync: ${error.message}`];
+		throw error;
+	}
+}
 function skillLine(entries, detected) {
 	const agents = [...new Set(entries.flatMap((entry) => coveredAgentNames(entry, detected)))];
 	if (agents.length === 0) return `rde skill: not installed; \`rde init --only agents-skills\``;
@@ -7592,14 +8011,15 @@ function launchLines(agents, workdir) {
 	const prefix = workdir === null ? "" : `cd ${workdir} && `;
 	return ["Start working:", ...detected.map((agent) => `  ${prefix}${agent.launch}  (${agent.displayName})`)];
 }
-async function summaryLines(state, apiKey, deps) {
+async function summaryLines(state, secrets, deps) {
 	const profile = state.mbProfile;
 	const lines = [];
 	if (state.url !== null) lines.push(`Metabase: ${state.url}`);
 	if (state.admin !== null) lines.push(loginLine(state.admin.kind, state.admin.email));
 	lines.push(profile === "default" ? `Metabase CLI: ${mbCommand(profile)} <command>` : `Metabase CLI: ${mbCommand(profile)} <command>  or  export MB_PROFILE=${profile}`);
-	lines.push(...await databaseLines$1(state, apiKey, deps));
+	lines.push(...await databaseLines$1(state, secrets.apiKey, deps));
 	lines.push(...gitLines(state));
+	lines.push(...await pendingExportLines(state, secrets, deps.runner));
 	const installed = await skillsCli(deps.runner).list();
 	const agents = await detectAgents(deps.probe);
 	const detected = agents.filter((agent) => agent.detected);
@@ -7616,7 +8036,7 @@ function summaryStep(deps = hostDeps$3) {
 			return "todo";
 		},
 		async run(ctx) {
-			const lines = await summaryLines(ctx.state, ctx.secrets.apiKey, deps(ctx));
+			const lines = await summaryLines(ctx.state, ctx.secrets, deps(ctx));
 			ctx.ui.note(lines.join("\n"), "Your environment");
 			return { outcome: "completed" };
 		}
@@ -7693,6 +8113,7 @@ const STEP_BY_ID = {
 	license: () => licenseStep(),
 	databases: (options) => databasesStep(options.databases),
 	"git-sync": () => gitSyncStep(),
+	"sync-scope": () => syncScopeStep(),
 	summary: () => summaryStep()
 };
 function initSteps(options) {
@@ -7777,7 +8198,8 @@ const SECTIONS = {
 		remote: RemoteKind.optional(),
 		url: EnvString.optional(),
 		token: EnvString.optional()
-	}).optional()
+	}).optional(),
+	"sync-scope": z.strictObject({ export: z.boolean() }).optional()
 };
 const InitAnswers = z.strictObject(SECTIONS);
 const select$1 = (value) => ({
@@ -7886,6 +8308,8 @@ function keyedAnswers(answers) {
 		if (git.url !== void 0) add(map, GIT_SYNC_KEYS.url, text$1(git.url));
 		if (git.token !== void 0) add(map, GIT_SYNC_KEYS.token, password$1(git.token));
 	}
+	const scope = answers["sync-scope"];
+	if (scope !== void 0) add(map, SYNC_SCOPE_KEYS.export, confirm$1(scope.export));
 	return map;
 }
 function parseInitAnswers(raw, source) {
@@ -7927,6 +8351,10 @@ function stepsAskingForWork(answers) {
 			step: "git-sync",
 			asks: git !== void 0 && git.location !== "skip"
 		},
+		{
+			step: "sync-scope",
+			asks: answers["sync-scope"]?.export === true
+		},
 		{
 			step: "agents-skills",
 			asks: agents !== void 0 && agents.agents.length > 0
@@ -9666,7 +10094,8 @@ function applyRecord(draft, record) {
 	else if (key === API_KEY_KEYS.profile && value !== null) {
 		const profile = MbProfileChoice.safeParse(value);
 		if (profile.success) draft.answers["api-key"] = { profile: profile.data };
-	} else if (key === LICENSE_KEYS.token && value !== null) draft.answers.license = { token: value.length === 0 ? null : envReference(ENV_LICENSE_TOKEN) };
+	} else if (key === SYNC_SCOPE_KEYS.export && record.answer.kind === "confirm") draft.answers["sync-scope"] = { export: record.answer.value };
+	else if (key === LICENSE_KEYS.token && value !== null) draft.answers.license = { token: value.length === 0 ? null : envReference(ENV_LICENSE_TOKEN) };
 }
 function writableUri(uri, index) {
 	const trimmed = uri.trim();
@@ -10127,7 +10556,7 @@ function taskLabel(status) {
 }
 function remoteContentOf(changes) {
 	if (!changes.has_changes) return "imported";
-	return changes.local_version === null ? "never-imported" : "changed";
+	return remoteMoved(changes) ? "changed" : "never-imported";
 }
 function isMbFailure(error) {
 	return error instanceof ProcessNotFoundError || error instanceof ExternalToolError;
@@ -10145,7 +10574,8 @@ async function gitSyncOf(ctx, deps) {
 			branch: status.branch,
 			dirty: status.is_dirty,
 			remote: remoteContentOf(changes),
-			task: taskLabel(status)
+			task: taskLabel(status),
+			syncedCollections: status.synced_collections.map((collection) => collection.name)
 		};
 	} catch (error) {
 		if (isMbFailure(error)) return { error: error.message };
@@ -10205,7 +10635,8 @@ function gitSyncLine(report) {
 	if (isGitSyncFailure(report.gitSync)) return `Remote sync: ${report.gitSync.error}`;
 	const branch = report.gitSync.branch === null ? "no branch" : `branch ${report.gitSync.branch}`;
 	const task = report.gitSync.task === null ? "no task running" : `task ${report.gitSync.task}`;
-	return `Remote sync: ${branch}, ${syncStateLabel(report.mbProfile, report.gitSync)}, ${task}`;
+	const scope = report.gitSync.syncedCollections.length === 0 ? "nothing synced; `rde init --only sync-scope`" : `synced: ${report.gitSync.syncedCollections.join(", ")}`;
+	return `Remote sync: ${branch}, ${syncStateLabel(report.mbProfile, report.gitSync)}, ${task}, ${scope}`;
 }
 const REMOTE_CONTENT_LABEL = {
 	imported: null,
@@ -11076,7 +11507,7 @@ const upgradeCommand = defineRdeCommand({
 const main = defineCommand({
 	meta: {
 		name: "rde",
-		version: "0.1.16",
+		version: "0.1.17",
 		description: "Prepares a local machine for data-engineering work with Metabase and coding agents"
 	},
 	subCommands: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metabase/rde",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Prepares a local machine for data-engineering work with Metabase and coding agents",
   "license": "AGPL-3.0",
   "bin": {