@metabase/rde 0.1.16 → 0.1.18

package/dist/cli.mjs

@@ -11,6 +11,7 @@ import { pipeline } from "node:stream/promises";
 import { spawn } from "node:child_process";
 import { connect, createServer } from "node:net";
 import { confirm, intro, isCancel, log, multiselect, note, outro, password, select, spinner, text } from "@clack/prompts";
+import { isDeepStrictEqual } from "node:util";
 import semver from "semver";
 //#region src/errors.ts
 var AbortError = class extends Error {
@@ -33,6 +34,12 @@ var PortTakenError = class extends ConfigError {
 		this.port = port;
 	}
 };
+var UnsupportedMetabaseError = class extends ConfigError {
+	constructor(message) {
+		super(message);
+		this.name = "UnsupportedMetabaseError";
+	}
+};
 var PromptUnavailableError = class extends ConfigError {
 	constructor(message) {
 		super(message);
@@ -79,6 +86,8 @@ var MetabaseApiError = class extends Error {
 	path;
 	errors;
 	reason;
+	code;
+	detail;
 	constructor(failure) {
 		super(`Metabase ${failure.status} on ${failure.path}: ${failure.message}`);
 		this.name = "MetabaseApiError";
@@ -86,6 +95,8 @@ var MetabaseApiError = class extends Error {
 		this.path = failure.path;
 		this.errors = failure.errors;
 		this.reason = failure.message;
+		this.code = failure.code;
+		this.detail = failure.detail;
 	}
 };
 const UNAUTHORIZED_STATUS = 401;
@@ -256,14 +267,15 @@ function withoutEscapes(text) {
 const StepId = z.enum([
 	"preflight",
 	"install-mb",
-	"agents-skills",
 	"runtime",
 	"start-metabase",
+	"agents-skills",
 	"admin-user",
 	"api-key",
 	"transforms",
 	"license",
 	"git-sync",
+	"sync-scope",
 	"databases",
 	"summary"
 ]);
@@ -332,6 +344,9 @@ const REMOTE_SYNC_FEATURE = "remote-sync";
 function hasRemoteSync(license) {
 	return license.activated && license.features.includes("remote-sync");
 }
+function hasLibrary(license) {
+	return license.activated && license.features.includes("library");
+}
 const DatabaseRecord = z.object({
 	id: z.int(),
 	name: z.string(),
@@ -354,7 +369,7 @@ const StepRecord = z.object({
 	completedAt: z.string()
 });
 const InstanceState = z.object({
-	schemaVersion: z.literal(6),
+	schemaVersion: z.literal(7),
 	name: z.string(),
 	runtime: RuntimeState.nullable(),
 	url: z.string().nullable(),
@@ -365,6 +380,7 @@ const InstanceState = z.object({
 	databases: z.array(DatabaseRecord),
 	gitRemote: GitRemoteState.nullable(),
 	movedFrom: z.string().nullable(),
+	syncRoot: z.int().nullable(),
 	steps: z.partialRecord(StepId, StepRecord)
 });
 function configuredRuntime(state) {
@@ -394,7 +410,7 @@ function mbCommand(profile) {
 }
 function emptyInstanceState(name) {
 	return {
-		schemaVersion: 6,
+		schemaVersion: 7,
 		name,
 		runtime: null,
 		url: null,
@@ -405,6 +421,7 @@ function emptyInstanceState(name) {
 		databases: [],
 		gitRemote: null,
 		movedFrom: null,
+		syncRoot: null,
 		steps: {}
 	};
 }
@@ -416,6 +433,7 @@ const V2 = 2;
 const V3 = 3;
 const V4 = 4;
 const V5 = 5;
+const V6 = 6;
 const StateV1 = z.object({ schemaVersion: z.literal(V1) }).loose();
 const StateV2 = z.object({ schemaVersion: z.literal(V2) }).loose();
 const AdminV3 = z.discriminatedUnion("kind", [z.object({
@@ -427,7 +445,11 @@ const AdminV3 = z.discriminatedUnion("kind", [z.object({
 	password: z.string()
 })]);
 const StateV4 = z.object({ schemaVersion: z.literal(V4) }).loose();
-const StateV5 = z.object({ schemaVersion: z.literal(V5) }).loose();
+const StateV5 = z.object({
+	schemaVersion: z.literal(V5),
+	steps: z.record(z.string(), z.unknown())
+}).loose();
+const StateV6 = z.object({ schemaVersion: z.literal(V6) }).loose();
 const StateV3 = z.object({
 	schemaVersion: z.literal(V3),
 	admin: AdminV3.nullable(),
@@ -454,10 +476,19 @@ function liftV4(raw) {
 	};
 }
 function liftV5(raw) {
-	const { sampleDatabase: _sampleDatabase, ...state } = StateV5.parse(raw);
+	const { sampleDatabase: _sampleDatabase, steps, ...state } = StateV5.parse(raw);
+	const { "sample-database": _sampleDatabaseStep, ...remainingSteps } = steps;
 	return {
 		...state,
-		schemaVersion: 6
+		schemaVersion: V6,
+		steps: remainingSteps
+	};
+}
+function liftV6(raw) {
+	return {
+		...StateV6.parse(raw),
+		schemaVersion: 7,
+		syncRoot: null
 	};
 }
 function adminV4(admin) {
@@ -498,24 +529,29 @@ function migrateInstanceState(raw) {
 		case V2: return migrateInstanceState(liftV2(raw));
 		case V3: return liftV3(raw);
 		case V4: return migrateInstanceState(liftV4(raw));
-		case V5: return {
-			state: InstanceState.parse(liftV5(raw)),
+		case V5: return migrateInstanceState(liftV5(raw));
+		case V6: return {
+			state: InstanceState.parse(liftV6(raw)),
 			movedSecrets: null
 		};
-		case 6: return {
+		case 7: return {
 			state: InstanceState.parse(raw),
 			movedSecrets: null
 		};
-		default: throw new ConfigError(`state schemaVersion ${schemaVersion} is not supported by this build (expected 6)`);
+		default: throw new ConfigError(`state schemaVersion ${schemaVersion} is not supported by this build (expected 7)`);
 	}
 }
 //#endregion
 //#region src/env.ts
 const ENV_RDE_HOME = "RDE_HOME";
-const ENV_RDE_SKILL_SOURCE = "RDE_SKILL_SOURCE";
+const ENV_RDE_DEV = "RDE_DEV";
 function readEnv(name) {
 	return process.env[name];
 }
+function readSetEnv(name) {
+	const value = readEnv(name);
+	return value === void 0 || value.length === 0 ? null : value;
+}
 const ENV_PATH = "PATH";
 const ENV_NO_COLOR = "NO_COLOR";
 const ENV_XDG_STATE_HOME = "XDG_STATE_HOME";
@@ -523,6 +559,9 @@ const ENV_JAVA_HOME = "JAVA_HOME";
 const ENV_MB_PROFILE = "MB_PROFILE";
 const ENV_MB_URL = "MB_URL";
 const ENV_MB_API_KEY = "MB_API_KEY";
+function developmentMode() {
+	return readSetEnv(ENV_RDE_DEV) === "1";
+}
 function hostEnvironment() {
 	return { ...process.env };
 }
@@ -541,8 +580,8 @@ const INSTANCE_NAME = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
 const INSTANCE_NAME_RULE = "letters, digits, - and _, starting with a letter or digit";
 const HOME_TAG_LENGTH = 8;
 function rdeHome() {
-	const override = readEnv(ENV_RDE_HOME);
-	if (override !== void 0) return resolve(override);
+	const override = readSetEnv(ENV_RDE_HOME);
+	if (override !== null) return resolve(override);
 	return join(homedir(), RDE_DIR_NAME);
 }
 function homeTag(home) {
@@ -814,8 +853,11 @@ const SESSION_HEADER = "X-Metabase-Session";
 const API_KEY_HEADER = "X-Api-Key";
 const JSON_CONTENT_TYPE = "application/json";
 const SERVICE_UNAVAILABLE_STATUS = 503;
+const NO_CONTENT_STATUS = 204;
 const NO_AUTH = { kind: "none" };
 const ErrorMessage = z.object({ message: z.string() }).loose();
+const ErrorTitle = z.object({ error: z.string() }).loose();
+const ErrorCode = z.object({ error_code: z.string() }).loose();
 const ErrorFields = z.object({ errors: z.record(z.string(), z.unknown()) }).loose();
 const ErrorText = z.string();
 const ErrorTexts = z.array(z.string());
@@ -878,6 +920,8 @@ function serverMessage(body) {
 	const value = jsonValue(body);
 	const parsed = ErrorMessage.safeParse(value);
 	if (parsed.success) return parsed.data.message;
+	const title = ErrorTitle.safeParse(value);
+	if (title.success) return title.data.error;
 	const errors = serverErrors(body);
 	if (errors !== null && Object.keys(errors).length > 0) return Object.entries(errors).map(([name, problem]) => `${name}: ${problem}`).join("; ");
 	const plain = ErrorText.safeParse(value);
@@ -886,6 +930,10 @@ function serverMessage(body) {
 	if (body.json.parsed || text.length === 0) return `HTTP ${body.status}`;
 	return text;
 }
+function errorCode(body) {
+	const parsed = ErrorCode.safeParse(jsonValue(body));
+	return parsed.success ? parsed.data.error_code : null;
+}
 function failureFor(path, body) {
 	if (body.status === SERVICE_UNAVAILABLE_STATUS) {
 		const initializing = Initializing.safeParse(jsonValue(body));
@@ -895,7 +943,9 @@ function failureFor(path, body) {
 		status: body.status,
 		path,
 		message: serverMessage(body),
-		errors: serverErrors(body)
+		errors: serverErrors(body),
+		code: errorCode(body),
+		detail: body.json.parsed ? body.json.value : null
 	});
 }
 function shapeError(path, body, reason) {
@@ -903,7 +953,9 @@ function shapeError(path, body, reason) {
 		status: body.status,
 		path,
 		message: reason,
-		errors: null
+		errors: null,
+		code: null,
+		detail: null
 	});
 }
 function isTimeout(error) {
@@ -920,6 +972,7 @@ function lookupFailure(error) {
 }
 function createHttp(options) {
 	const fetchImpl = options.fetchImpl ?? fetch;
+	const timeoutMs = options.timeoutMs ?? REQUEST_TIMEOUT_MS;
 	const baseUrl = options.baseUrl.replace(/\/+$/, "");
 	async function send(method, path, body) {
 		const url = `${baseUrl}${path}`;
@@ -930,7 +983,7 @@ function createHttp(options) {
 		const init = {
 			method,
 			headers,
-			signal: AbortSignal.any([options.signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)])
+			signal: AbortSignal.any([options.signal, AbortSignal.timeout(timeoutMs)])
 		};
 		if (body !== void 0) {
 			headers["content-type"] = JSON_CONTENT_TYPE;
@@ -944,7 +997,7 @@ function createHttp(options) {
 			};
 		} catch (error) {
 			if (options.signal.aborted) throw new AbortError();
-			if (isTimeout(error)) throw new MetabaseUnreachableError(url, `no response within ${REQUEST_TIMEOUT_MS}ms`);
+			if (isTimeout(error)) throw new MetabaseUnreachableError(url, `no response within ${timeoutMs}ms`);
 			throw new MetabaseUnreachableError(url, describeCause(error));
 		}
 	}
@@ -953,19 +1006,33 @@ function createHttp(options) {
 		if (!received.ok) throw failureFor(path, received.body);
 		return received.body;
 	}
+	function parseJson(path, body, schema) {
+		if (!body.json.parsed) throw shapeError(path, body, "expected a JSON body");
+		return parseShape(path, body, schema, body.json.value);
+	}
+	function parseShape(path, body, schema, value) {
+		try {
+			return schema.parse(value);
+		} catch (error) {
+			if (error instanceof ZodError) throw shapeError(path, body, `unexpected response shape:\n${z.prettifyError(error)}`);
+			throw error;
+		}
+	}
 	return {
 		async requestJson(method, path, request) {
+			return parseJson(path, await requestBody(method, path, request.body), request.schema);
+		},
+		async requestOptionalJson(method, path, request) {
 			const body = await requestBody(method, path, request.body);
-			if (!body.json.parsed) throw shapeError(path, body, "expected a JSON body");
-			try {
-				return request.schema.parse(body.json.value);
-			} catch (error) {
-				if (error instanceof ZodError) throw shapeError(path, body, `unexpected response shape:\n${z.prettifyError(error)}`);
-				throw error;
-			}
+			if (body.status === NO_CONTENT_STATUS && body.text.length === 0) return null;
+			return parseJson(path, body, request.schema);
 		},
 		async requestNoContent(method, path, request = {}) {
 			await requestBody(method, path, request.body);
+		},
+		async requestText(method, path, request) {
+			const body = await requestBody(method, path, request.body);
+			return parseShape(path, body, request.schema, body.text);
 		}
 	};
 }
@@ -1056,6 +1123,48 @@ function apiKeyResource(http) {
 		regenerate
 	};
 }
+const Collection = z.object({
+	id: z.int(),
+	name: z.string(),
+	location: z.string(),
+	type: z.string().nullable(),
+	namespace: z.string().nullable(),
+	personal_owner_id: z.int().nullable(),
+	is_remote_synced: z.boolean()
+}).loose();
+const RootCollection = z.object({ id: z.literal("root") }).loose();
+const CollectionList = z.array(z.union([Collection, RootCollection]));
+const CollectionRef = z.object({
+	id: z.int(),
+	name: z.string()
+}).loose();
+//#endregion
+//#region src/metabase/resources/collection.ts
+function collectionResource(http) {
+	/** GET /api/collection */
+	async function list() {
+		return http.requestJson("GET", "/api/collection", { schema: CollectionList });
+	}
+	/** POST /api/collection */
+	async function create(request) {
+		return http.requestJson("POST", "/api/collection", {
+			body: {
+				...request,
+				parent_id: null
+			},
+			schema: CollectionRef
+		});
+	}
+	/** POST /api/ee/library; 400 when the Library exists */
+	async function createLibrary() {
+		return http.requestJson("POST", "/api/ee/library", { schema: CollectionRef });
+	}
+	return {
+		list,
+		create,
+		createLibrary
+	};
+}
 //#endregion
 //#region src/metabase/domain/database.ts
 const InitialSyncStatus = z.enum([
@@ -1148,7 +1257,9 @@ function permissionsGroupResource(http) {
 	}
 	return { list };
 }
-z.enum(["read-only", "read-write"]);
+//#endregion
+//#region src/metabase/domain/remote-sync.ts
+const RemoteSyncType = z.enum(["read-only", "read-write"]);
 const RemoteSyncSettingsResult = z.object({
 	success: z.boolean(),
 	task_id: z.int().optional()
@@ -1169,6 +1280,38 @@ const SyncTask = z.object({
 	status: SyncTaskStatus$1,
 	error_message: z.string().nullable().optional()
 }).loose();
+const NamedCollection = z.object({
+	id: z.int(),
+	name: z.string()
+}).loose();
+const DependencyLocation = NamedCollection.nullable().optional();
+const DependencyItem = z.object({
+	model: z.string(),
+	id: z.int(),
+	name: z.string().nullable()
+}).loose();
+const UnsyncedDependency = DependencyItem.extend({
+	collection: DependencyLocation,
+	used_by: z.array(DependencyItem)
+});
+const SyncRemedy = z.discriminatedUnion("type", [
+	z.object({
+		type: z.literal("collection"),
+		collection: NamedCollection
+	}).loose(),
+	z.object({ type: z.literal("library") }).loose(),
+	z.object({
+		type: z.literal("none"),
+		collection: DependencyLocation
+	}).loose()
+]);
+const RequiredSync = z.object({
+	remedy: SyncRemedy,
+	syncable: z.boolean(),
+	blocks: z.array(NamedCollection),
+	dependencies: z.array(UnsyncedDependency)
+}).loose();
+const UnsyncedDependencies = z.object({ errors: z.object({ required: z.array(RequiredSync) }).loose() }).loose();
 //#endregion
 //#region src/metabase/resources/remote-sync.ts
 function remoteSyncResource(http) {
@@ -1179,6 +1322,13 @@ function remoteSyncResource(http) {
 			schema: RemoteSyncSettingsResult
 		});
 	}
+	/** PUT /api/ee/remote-sync/settings, without the git settings, which it leaves as they are */
+	async function updateScope(scope) {
+		return http.requestJson("PUT", "/api/ee/remote-sync/settings", {
+			body: scope,
+			schema: RemoteSyncSettingsResult
+		});
+	}
 	/** PUT /api/ee/remote-sync/settings with only `remote-sync-transforms`, which skips the repository check. */
 	async function syncTransforms() {
 		return http.requestJson("PUT", "/api/ee/remote-sync/settings", {
@@ -1195,10 +1345,11 @@ function remoteSyncResource(http) {
 	}
 	/** GET /api/ee/remote-sync/current-task */
 	async function currentTask() {
-		return http.requestJson("GET", "/api/ee/remote-sync/current-task", { schema: SyncTask.nullable() });
+		return http.requestOptionalJson("GET", "/api/ee/remote-sync/current-task", { schema: SyncTask });
 	}
 	return {
 		updateSettings,
+		updateScope,
 		syncTransforms,
 		testConnection,
 		currentTask
@@ -1271,6 +1422,7 @@ const PREMIUM_EMBEDDING_TOKEN_SETTING = "premium-embedding-token";
 const ENGINES_SETTING = "engines";
 const TRANSFORMS_ENABLED_SETTING = "transforms-enabled";
 const TRANSFORMS_SETUP_COMPLETE_SETTING = "transforms-setup-complete";
+const REMOTE_SYNC_TYPE_SETTING = "remote-sync-type";
 function settingResource(http) {
 	/** PUT /api/setting/premium-embedding-token */
 	async function setPremiumEmbeddingToken(value) {
@@ -1288,11 +1440,16 @@ function settingResource(http) {
 	async function engines() {
 		return http.requestJson("GET", `/api/setting/${ENGINES_SETTING}`, { schema: Engines });
 	}
+	/** GET /api/setting/remote-sync-type; Metabase answers its default, read-only, while unset. */
+	async function remoteSyncType() {
+		return http.requestText("GET", `/api/setting/${REMOTE_SYNC_TYPE_SETTING}`, { schema: RemoteSyncType });
+	}
 	return {
 		setPremiumEmbeddingToken,
 		enableTransforms,
 		transformsDecided,
-		engines
+		engines,
+		remoteSyncType
 	};
 }
 //#endregion
@@ -1362,6 +1519,7 @@ function createMetabaseClient(baseUrl, auth, signal, options = {}) {
 		tokenStatus: tokenStatusResource(http),
 		database: databaseResource(http),
 		remoteSync: remoteSyncResource(http),
+		collection: collectionResource(http),
 		user: userResource(http)
 	};
 }
@@ -2057,18 +2215,74 @@ async function detectAgents(probe) {
 }
 //#endregion
 //#region src/metabase/domain/version-info.ts
-const VersionInfo = z.object({ latest: z.object({ version: z.string() }).loose() }).loose();
+const VersionEntry = z.object({ version: z.string() }).loose();
+const VersionInfo = z.object({ latest: VersionEntry }).loose();
+const VersionHistory = z.object({
+	latest: VersionEntry,
+	older: z.array(VersionEntry)
+}).loose();
 //#endregion
 //#region src/metabase/releases.ts
 const DOWNLOADS_HOST = "https://downloads.metabase.com";
 const VERSION_INFO_HOST = "https://static.metabase.com";
 const VERSION_INFO_PATH = "/version-info-ee.json";
 const JAR_FILE = "metabase.jar";
-const RELEASE_TAG$1 = /^v(?<edition>[01])\.\d+\.\d+(?:\.\d+)?(?:-[\w.]+)?$/;
+const RELEASE_TAG$1 = /^v(?<edition>[01])\.(?<major>\d+)\.\d+(?:\.\d+)?(?:-[\w.]+)?$/;
+const MAJOR_LINE_TAG = /^v(?<edition>[01])\.(?<major>\d+)\.x$/;
+const FINAL_ENTERPRISE_RELEASE = /^v1\.\d+\.\d+(?:\.\d+)?$/;
 const ENTERPRISE_EDITION = "1";
+const OPEN_SOURCE_EDITION = "0";
+const SNAPSHOT_SUFFIX = "-SNAPSHOT";
 function isReleaseTag(value) {
 	return RELEASE_TAG$1.test(value);
 }
+function isMajorLineTag(value) {
+	return MAJOR_LINE_TAG.test(value);
+}
+function majorLineTag(major) {
+	return `v${ENTERPRISE_EDITION}.${major}.x`;
+}
+function tagGroups(tag) {
+	return (RELEASE_TAG$1.exec(tag) ?? MAJOR_LINE_TAG.exec(tag))?.groups;
+}
+function isOpenSourceRelease(version) {
+	return tagGroups(version)?.["edition"] === OPEN_SOURCE_EDITION;
+}
+function isMasterBuild(version) {
+	return !(isReleaseTag(version) || isMajorLineTag(version)) || version.endsWith(SNAPSHOT_SUFFIX);
+}
+function releaseMajor(version) {
+	const major = tagGroups(version)?.["major"];
+	return major === void 0 ? null : Number.parseInt(major, 10);
+}
+function releaseNumbers(version) {
+	return version.slice(1).split(".").map((part) => Number.parseInt(part, 10));
+}
+function compareReleases(left, right) {
+	const a = releaseNumbers(left);
+	const b = releaseNumbers(right);
+	for (let index = 0; index < Math.max(a.length, b.length); index += 1) {
+		const difference = (a[index] ?? 0) - (b[index] ?? 0);
+		if (difference !== 0) return difference;
+	}
+	return 0;
+}
+function supportedRelease(version) {
+	if (!FINAL_ENTERPRISE_RELEASE.test(version)) return null;
+	const major = releaseMajor(version);
+	return major !== null && major >= 65 ? {
+		version,
+		major
+	} : null;
+}
+function newestSupportedRelease(versions) {
+	let newest = null;
+	for (const version of versions) {
+		const release = supportedRelease(version);
+		if (release !== null && (newest === null || compareReleases(version, newest.version) > 0)) newest = release;
+	}
+	return newest;
+}
 function jarDownloadUrl(version) {
 	const edition = RELEASE_TAG$1.exec(version)?.groups?.["edition"];
 	if (edition === void 0) throw new Error(`${version} is not a Metabase release tag`);
@@ -2081,9 +2295,15 @@ function releaseLookup(signal, options = {}) {
 		signal,
 		...options
 	});
-	return { async latestVersion() {
-		return (await http.requestJson("GET", VERSION_INFO_PATH, { schema: VersionInfo })).latest.version;
-	} };
+	return {
+		async latestVersion() {
+			return (await http.requestJson("GET", VERSION_INFO_PATH, { schema: VersionInfo })).latest.version;
+		},
+		async newestSupportedRelease() {
+			const info = await http.requestJson("GET", VERSION_INFO_PATH, { schema: VersionHistory });
+			return newestSupportedRelease([info.latest, ...info.older].map((entry) => entry.version));
+		}
+	};
 }
 function fileDownloader(signal, options = {}) {
 	return (url, destination, onProgress) => downloadFile(url, destination, {
@@ -2151,11 +2371,13 @@ const PortBinding = z.array(z.object({
 	HostIp: z.string(),
 	HostPort: z.string()
 }).loose()).nullable();
+const EnvEntry = z.string().regex(/^[^=]+=/, "expected NAME=value");
 const InspectedContainer = z.object({
 	State: z.object({ Running: z.boolean() }).loose(),
 	Config: z.object({
 		Image: z.string(),
-		Labels: z.record(z.string(), z.string()).nullish()
+		Labels: z.record(z.string(), z.string()).nullish(),
+		Env: z.array(EnvEntry).nullish()
 	}).loose(),
 	HostConfig: z.object({ PortBindings: z.record(z.string(), PortBinding).nullable() }).loose(),
 	NetworkSettings: z.object({ Ports: z.record(z.string(), PortBinding).nullish() }).loose()
@@ -2186,6 +2408,14 @@ function portMappings(bindings) {
 	}
 	return mappings;
 }
+function containerEnv(entries) {
+	const env = {};
+	for (const entry of entries) {
+		const separator = entry.indexOf("=");
+		env[entry.slice(0, separator)] = entry.slice(separator + 1);
+	}
+	return env;
+}
 function createArgs(options) {
 	const args = [
 		"create",
@@ -2277,7 +2507,8 @@ function dockerTool(runner) {
 			image: labels?.[IMAGE_LABEL] ?? container.Config.Image,
 			ports: portMappings(container.HostConfig.PortBindings),
 			forwarded: portMappings(container.NetworkSettings.Ports ?? null),
-			home: labels?.[HOME_LABEL] ?? null
+			home: labels?.[HOME_LABEL] ?? null,
+			env: containerEnv(container.Config.Env ?? [])
 		};
 	}
 	async function portClaims() {
@@ -2474,6 +2705,10 @@ const PLUGINS_DIR = "plugins";
 const METABASE_STOP_GRACE_MS = 3e4;
 const DB_DIR = "metabase.db";
 const DB_FILE = "metabase.db";
+const STAGING_STORE_ENV = {
+	MB_RUN_MODE: "e2e",
+	MB_STORE_USE_STAGING: "true"
+};
 function instanceUrl(port) {
 	return `http://localhost:${port}`;
 }
@@ -2482,13 +2717,15 @@ function serverEnv(options) {
 		MB_DB_FILE: options.dbFile,
 		MB_PLUGINS_DIR: options.pluginsDir,
 		MB_SITE_URL: instanceUrl(options.port),
-		MB_RUN_MODE: "e2e",
-		MB_STORE_USE_STAGING: "true",
+		...developmentMode() ? STAGING_STORE_ENV : {},
 		MB_WAREHOUSE_ALLOWED_NETWORKS: "allow-all",
 		MB_LOAD_SAMPLE_CONTENT: "false",
 		MB_INSTALL_ANALYTICS_DATABASE: "false"
 	};
 }
+function envDrift(actual, expected) {
+	return [.../* @__PURE__ */ new Set([...Object.keys(expected), ...Object.keys(STAGING_STORE_ENV)])].filter((name) => actual[name] !== expected[name]);
+}
 function jettyEnv(port) {
 	return {
 		MB_JETTY_HOST: LOOPBACK_HOST,
@@ -2497,7 +2734,34 @@ function jettyEnv(port) {
 }
 //#endregion
 //#region src/runtime/docker.ts
-const DEFAULT_IMAGE = "metabase/metabase-enterprise-head:latest";
+const RELEASE_REPOSITORY = "metabase/metabase-enterprise";
+const DEVELOPMENT_IMAGE = "metabase/metabase-enterprise-head:latest";
+const HEAD_SUFFIX = "-head";
+const METABASE_REPOSITORIES = /* @__PURE__ */ new Set([
+	RELEASE_REPOSITORY,
+	`${RELEASE_REPOSITORY}${HEAD_SUFFIX}`,
+	"metabase/metabase"
+]);
+function majorLineImage(major) {
+	return `${RELEASE_REPOSITORY}:${majorLineTag(major)}`;
+}
+function imageTag(ref) {
+	const colon = ref.lastIndexOf(":");
+	if (colon === -1 || colon < ref.lastIndexOf("/")) return null;
+	return ref.slice(colon + 1);
+}
+function imageRepository(ref) {
+	const digest = ref.indexOf("@");
+	const named = digest === -1 ? ref : ref.slice(0, digest);
+	const tag = imageTag(named);
+	return tag === null ? named : named.slice(0, named.length - tag.length - 1);
+}
+function isMasterBuildImage(ref) {
+	return imageRepository(ref).endsWith(HEAD_SUFFIX);
+}
+function isMetabaseImage(ref) {
+	return METABASE_REPOSITORIES.has(imageRepository(ref));
+}
 const CONTAINER_NAME_PREFIX$1 = "rde-metabase";
 const CONTAINER_PORT = 3e3;
 const STOP = { graceMs: METABASE_STOP_GRACE_MS };
@@ -2512,6 +2776,16 @@ function onLoopback(mappings, port) {
 function hostUserFor(platform, hostUser) {
 	return platform === "linux" ? hostUser : null;
 }
+function containerServerEnv(port) {
+	return serverEnv({
+		dbFile: `${CONTAINER_DATA_DIR}/${DB_DIR}`,
+		pluginsDir: `${CONTAINER_DATA_DIR}/${PLUGINS_DIR}`,
+		port
+	});
+}
+function containerEnvDrift(container, state) {
+	return envDrift(container.env, containerServerEnv(state.port));
+}
 function dockerRuntime(state, deps) {
 	const { docker } = deps;
 	const url = instanceUrl(state.port);
@@ -2538,11 +2812,7 @@ function dockerRuntime(state, deps) {
 				source: deps.dataDir,
 				target: CONTAINER_DATA_DIR
 			},
-			env: serverEnv({
-				dbFile: `${CONTAINER_DATA_DIR}/${DB_DIR}`,
-				pluginsDir: `${CONTAINER_DATA_DIR}/${PLUGINS_DIR}`,
-				port: state.port
-			}),
+			env: containerServerEnv(state.port),
 			addHostGateway: deps.platform === "linux",
 			hostUser: hostUserFor(deps.platform, deps.hostUser)
 		};
@@ -2648,6 +2918,7 @@ function parseJarSpec(value) {
 		path: resolve(trimmed)
 	};
 	const tagged = trimmed.startsWith(TAG_PREFIX) ? trimmed : `${TAG_PREFIX}${trimmed}`;
+	if (isOpenSourceRelease(tagged)) throw new ConfigError(`${trimmed} is a release of the open-source edition, which rde does not support; enterprise release tags start with v1`);
 	return isReleaseTag(tagged) ? {
 		kind: "release",
 		version: tagged
@@ -2904,12 +3175,12 @@ async function portClaims(state, runtime) {
 }
 //#endregion
 //#region src/steps/admin-user.ts
-const STEP_ID$8 = "admin-user";
+const STEP_ID$9 = "admin-user";
 const ADMIN_USER_KEYS = {
-	email: `${STEP_ID$8}.email`,
-	password: `${STEP_ID$8}.password`,
-	firstName: `${STEP_ID$8}.first-name`,
-	lastName: `${STEP_ID$8}.last-name`
+	email: `${STEP_ID$9}.email`,
+	password: `${STEP_ID$9}.password`,
+	firstName: `${STEP_ID$9}.first-name`,
+	lastName: `${STEP_ID$9}.last-name`
 };
 const GENERATED_ADMIN_EMAIL = "admin@metabase.local";
 const GENERATED_PASSWORD_BYTES = 24;
@@ -2924,7 +3195,7 @@ function generatePassword(random) {
 		if (DIGIT.test(candidate)) return candidate;
 	}
 }
-function hostDeps$13(ctx) {
+function hostDeps$14(ctx) {
 	return {
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
 		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal)),
@@ -3062,9 +3333,9 @@ async function recordExistingAdmin(ctx, variant, client, url) {
 	ctx.ui.success(`Admin user ${email} recorded`);
 	return "completed";
 }
-function adminUserStep(options, deps = hostDeps$13) {
+function adminUserStep(options, deps = hostDeps$14) {
 	return {
-		id: STEP_ID$8,
+		id: STEP_ID$9,
 		title: "Create the admin user",
 		redoHint: "An instance keeps the admin it was set up with; `rde credentials` shows it.",
 		async detect(ctx) {
@@ -3134,7 +3405,7 @@ function adminUserStep(options, deps = hostDeps$13) {
 //#region src/tools/mb.ts
 const MB = "mb";
 const MB_PACKAGE = "@metabase/cli";
-const MB_DIST_TAG = "alpha-release-65-integration-branch";
+const MB_DIST_TAG = "latest";
 const MB_INSTALL_SPEC = `${MB_PACKAGE}@${MB_DIST_TAG}`;
 const GLOBAL_INSTALL = {
 	npm: {
@@ -3265,15 +3536,11 @@ function mbRemoveCommand(binary) {
 	const name = owner === "homebrew" ? firstSegmentAfter(binary.resolved, CELLAR) : packageName(binary.resolved);
 	return name === null ? null : REMOVE_COMMANDS[owner](name);
 }
-function setValue(name) {
-	const value = readEnv(name);
-	return value === void 0 || value.length === 0 ? null : value;
-}
 function mbEnvironment() {
 	return {
-		profile: setValue(ENV_MB_PROFILE),
-		url: setValue(ENV_MB_URL),
-		apiKeySet: setValue(ENV_MB_API_KEY) !== null
+		profile: readSetEnv(ENV_MB_PROFILE),
+		url: readSetEnv(ENV_MB_URL),
+		apiKeySet: readSetEnv(ENV_MB_API_KEY) !== null
 	};
 }
 const ProbedUser = z.object({
@@ -3329,10 +3596,15 @@ const GitSyncTask = z.object({
 	progress: z.number().nullable(),
 	error_message: z.string().nullable().optional()
 }).loose();
+const SyncedCollection = z.object({
+	id: z.int(),
+	name: z.string()
+}).loose();
 const GitSyncStatus = z.object({
 	branch: z.string().nullable(),
 	is_dirty: z.boolean(),
-	current_task: GitSyncTask.nullable()
+	current_task: GitSyncTask.nullable(),
+	synced_collections: z.array(SyncedCollection)
 }).loose();
 const GitSyncOutcome = z.object({
 	message: z.string().nullable(),
@@ -3344,6 +3616,9 @@ const RemoteChanges = z.object({
 	remote_version: z.string().nullable(),
 	local_version: z.string().nullable()
 }).loose();
+function remoteMoved(changes) {
+	return changes.has_changes && changes.local_version !== null;
+}
 function comparableUrl(url) {
 	const parsed = new URL(url);
 	return `${parsed.origin}${parsed.pathname.replace(/\/+$/, "")}`;
@@ -3479,14 +3754,14 @@ function mbTool(runner) {
 }
 //#endregion
 //#region src/steps/api-key.ts
-const STEP_ID$7 = "api-key";
+const STEP_ID$8 = "api-key";
 const API_KEY_KEYS = {
-	email: `${STEP_ID$7}.email`,
-	password: `${STEP_ID$7}.password`,
-	profile: `${STEP_ID$7}.profile`
+	email: `${STEP_ID$8}.email`,
+	password: `${STEP_ID$8}.password`,
+	profile: `${STEP_ID$8}.profile`
 };
 const ADMINISTRATORS_GROUP_NAME = "Administrators";
-function hostDeps$12(ctx) {
+function hostDeps$13(ctx) {
 	return {
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
 		runner: processRunner(ctx.signal),
@@ -3547,7 +3822,7 @@ async function authenticates(client) {
 	}
 }
 async function forgetCompletion(ctx) {
-	const { [STEP_ID$7]: record, ...steps } = ctx.state.steps;
+	const { [STEP_ID$8]: record, ...steps } = ctx.state.steps;
 	if (record !== void 0) await ctx.saveState({
 		...ctx.state,
 		steps
@@ -3624,15 +3899,15 @@ function usageNote(profile) {
 	if (profile === "default") return `${mbCommand(profile)} <command> uses this instance`;
 	return `${mbCommand(profile)} <command>\nMB_PROFILE=${profile} for agents and scripts`;
 }
-function apiKeyStep(deps = hostDeps$12) {
+function apiKeyStep(deps = hostDeps$13) {
 	return {
-		id: STEP_ID$7,
+		id: STEP_ID$8,
 		title: "Connect the Metabase CLI",
 		redoHint: "`rde status` shows the mb profile it uses.",
 		async detect(ctx) {
 			const configured = configuredRuntime(ctx.state);
 			const apiKey = ctx.secrets.apiKey;
-			if (configured === null || apiKey === null || ctx.state.steps[STEP_ID$7]?.status !== "done") return "todo";
+			if (configured === null || apiKey === null || ctx.state.steps[STEP_ID$8]?.status !== "done") return "todo";
 			const resolved = deps(ctx);
 			if (!await resolved.instanceRunning()) return "todo";
 			if (!isLoggedInAt(await mbTool(resolved.runner).authStatusIfInstalled(ctx.state.mbProfile), configured.url)) return "todo";
@@ -5577,102 +5852,289 @@ function gitTool(runner) {
 	};
 }
 //#endregion
-//#region src/steps/git-sync.ts
-const STEP_ID$6 = "git-sync";
-const GIT_SYNC_KEYS = {
-	location: `${STEP_ID$6}.location`,
-	path: `${STEP_ID$6}.path`,
-	remote: `${STEP_ID$6}.remote`,
-	url: `${STEP_ID$6}.url`,
-	token: `${STEP_ID$6}.token`
-};
-const BARE_REPO_NAME = "content.git";
-const DEFAULT_BRANCH = "main";
-const ORIGIN = "origin";
-const FALLBACK_REMOTE_NAME = "rde-remote";
-const README_NAME = "README.md";
-const README_CONTENT = "# Metabase content\n\nMetabase content synced by rde.\n";
-const INITIAL_COMMIT_MESSAGE = "Initial commit";
-const GITIGNORE_NAME = ".gitignore";
-const IGNORED_PATHS = [
-	".env",
-	".env.local",
-	".env.*.local",
-	"node_modules/",
-	".vite/",
-	".scratch/",
-	".DS_Store"
-];
-const HTTPS_PREFIX = "https://";
-const HOME_PREFIX = "~/";
-const BAD_REQUEST_STATUS = 400;
-const TASK_POLL_INTERVAL_MS = 1e3;
-const TERMINAL_TASK_STATUSES = /* @__PURE__ */ new Set([
-	"successful",
-	"errored",
-	"cancelled",
-	"timed-out",
-	"conflict"
-]);
-const SYNC_MODE_SETTINGS = {
-	"remote-sync-type": "read-write",
-	"remote-sync-transforms": true
+//#region src/steps/license.ts
+const STEP_ID$7 = "license";
+const LICENSE_KEYS = { token: `${STEP_ID$7}.token` };
+const TOKEN_PATTERN = /^[0-9a-f]{64}$/i;
+const NOT_FOUND_STATUS$1 = 404;
+const TOKEN_REFUSED_STATUS = 400;
+const STORE_UNREACHABLE_STATUS = 503;
+const TOKEN_CHECK_HOST = "token-check.metabase.com";
+const ACTIVATION_FAILED = "License activation failed";
+const LICENSED_FEATURES = {
+	[REMOTE_SYNC_FEATURE]: "remote sync",
+	"data-apps": "data apps",
+	"transforms-testing": "transform tests"
 };
-function hostDeps$11(ctx) {
+const LICENSED_FEATURE_NAMES = Object.values(LICENSED_FEATURES);
+function licensedFeatureCoverage(features) {
+	const entries = Object.entries(LICENSED_FEATURES);
+	return {
+		included: entries.filter(([key]) => features.includes(key)).map(([, name]) => name),
+		missing: entries.filter(([key]) => !features.includes(key)).map(([, name]) => name)
+	};
+}
+function listOf(names, type) {
+	return new Intl.ListFormat("en", { type }).format(names);
+}
+function hostDeps$12(ctx) {
 	return {
-		runner: processRunner(ctx.signal),
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
-		cwd: process.cwd(),
-		dataDir: instanceDataDir(ctx.state.name),
-		taskPollIntervalMs: TASK_POLL_INTERVAL_MS
+		runner: processRunner(ctx.signal),
+		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal)),
+		terminal: stdinIsTty()
 	};
 }
-const SKIP_GIT_SYNC = "skip";
-const FRESH = {
-	remoteKind: null,
-	hostedUrl: null,
-	workdir: null
-};
-function expandHome(path) {
-	return path.startsWith(HOME_PREFIX) ? join(homedir(), path.slice(2)) : path;
+function isNoTokenYet(error) {
+	if (error instanceof MetabaseApiError) return error.status === NOT_FOUND_STATUS$1;
+	return isMetabaseNotServing(error);
 }
-async function directoryState(path) {
-	let stat;
+function validateToken(value) {
+	if (value.length === 0 || TOKEN_PATTERN.test(value)) return;
+	return "A license token is 64 hexadecimal characters";
+}
+function requireApiKey$1(ctx) {
+	if (ctx.secrets.apiKey === null) throw new ConfigError("no API key yet; the api-key step comes first");
+	return ctx.secrets.apiKey;
+}
+function licenseOf(status) {
+	if (!status.valid) return { activated: false };
+	return {
+		activated: true,
+		features: status.features,
+		validThru: status["valid-thru"] ?? null
+	};
+}
+async function liveLicense(client) {
 	try {
-		stat = await promises.stat(path);
+		return licenseOf(await client.tokenStatus.get());
 	} catch (error) {
-		if (error instanceof Error && "code" in error && error.code === "ENOENT") return "missing";
+		if (error instanceof MetabaseApiError && error.status === NOT_FOUND_STATUS$1) return { activated: false };
 		throw error;
 	}
-	if (!stat.isDirectory()) return "file";
-	return (await promises.readdir(path)).length === 0 ? "empty" : "populated";
-}
-async function isCloneTarget(path) {
-	const state = await directoryState(path);
-	return state === "missing" || state === "empty";
 }
-async function initTargetProblem(run, path) {
-	switch (await directoryState(path)) {
-		case "missing":
-			await promises.mkdir(path, { recursive: true });
-			return null;
-		case "file": return `${path} is not a directory`;
-		case "empty": return null;
-		case "populated": return await run.git.isRepo(path) ? null : `${path} is not empty and not a git repository; pick an empty directory or a repository`;
-	}
+async function recordLiveLicense(ctx, client) {
+	const live = await liveLicense(client);
+	if (!isDeepStrictEqual(live, ctx.state.license)) await ctx.saveState({
+		...ctx.state,
+		license: live
+	});
+	return live;
 }
-async function isCloneOf(run, path, url) {
-	return await run.git.isRepo(path) && await run.git.remoteUrl(path, ORIGIN) === url;
+function activeLabel(status) {
+	const plan = status["plan-alias"];
+	return plan === void 0 ? "License active" : `License active (plan ${plan})`;
 }
-async function cloneTargetProblem(run, path, url) {
-	switch (await directoryState(path)) {
-		case "missing":
-		case "empty": return null;
-		case "file": return `${path} is not a directory`;
-		case "populated": return await isCloneOf(run, path, url) ? null : `${path} is not empty; pick an empty directory, or use an existing repository`;
-	}
+function refusalOf(error) {
+	if (!(error instanceof MetabaseApiError)) return null;
+	if (error.status === TOKEN_REFUSED_STATUS) return new ConfigError(`The license token was refused: ${error.reason}`);
+	if (error.status === STORE_UNREACHABLE_STATUS) return new ConfigError(`The instance could not reach ${TOKEN_CHECK_HOST} to check the license token; it needs outbound network access`);
+	return null;
 }
-async function existingRepoProblem(run, path) {
+async function activate(client, token) {
+	try {
+		await client.setting.setPremiumEmbeddingToken(token);
+	} catch (error) {
+		const refusal = refusalOf(error);
+		if (refusal === null) throw error;
+		return {
+			kind: "refused",
+			error: refusal
+		};
+	}
+	const status = await client.tokenStatus.get();
+	if (!status.valid) return {
+		kind: "refused",
+		error: new ConfigError(`Metabase reports the token as ${status.status}`)
+	};
+	return {
+		kind: "activated",
+		status
+	};
+}
+async function activateAskedToken(ctx, client, terminal) {
+	const token = await ctx.prompts.password({
+		key: LICENSE_KEYS.token,
+		message: "Paste your Metabase license token (Enter to skip)",
+		validate: validateToken
+	});
+	if (token.length === 0) return null;
+	const spinner = ctx.ui.spinner("Activating the license…");
+	let activation;
+	try {
+		activation = await activate(client, token);
+	} catch (error) {
+		spinner.fail(ACTIVATION_FAILED);
+		throw error;
+	}
+	if (activation.kind === "activated") {
+		spinner.stop(activeLabel(activation.status));
+		ctx.session.licenseToken.set(token);
+		return activation.status;
+	}
+	spinner.fail(ACTIVATION_FAILED);
+	if (!terminal) throw activation.error;
+	ctx.ui.warn(activation.error.message);
+	return activateAskedToken(ctx, client, terminal);
+}
+function reportFeatures(ctx, features) {
+	const { missing } = licensedFeatureCoverage(features);
+	const remoteSync = features.includes(REMOTE_SYNC_FEATURE);
+	if (remoteSync) ctx.ui.info("Remote sync is included; the git step will set it up");
+	if (missing.length > 0) {
+		const gitNote = remoteSync ? "" : "; the git step will be skipped";
+		ctx.ui.warn(`This license does not include ${listOf(missing, "disjunction")}${gitNote}`);
+	}
+}
+function licenseStep(deps = hostDeps$12) {
+	return {
+		id: STEP_ID$7,
+		title: "Activate your license",
+		redoHint: "`rde init --from license` with it activates the license and runs the steps after it again.",
+		async detect(ctx) {
+			if (ctx.state.steps[STEP_ID$7]?.status === "skipped") return "not-applicable";
+			const configured = configuredRuntime(ctx.state);
+			if (configured === null || ctx.secrets.apiKey === null) return "todo";
+			const resolved = deps(ctx);
+			if (!await resolved.instanceRunning()) return "todo";
+			const client = resolved.client(configured.url, {
+				kind: "api-key",
+				key: ctx.secrets.apiKey
+			});
+			try {
+				return (await client.tokenStatus.get()).valid ? "done" : "todo";
+			} catch (error) {
+				if (isNoTokenYet(error) || isRejectedCredential(error)) return "todo";
+				throw error;
+			}
+		},
+		async run(ctx) {
+			const configured = requireConfiguredRuntime(ctx.state);
+			const apiKey = requireApiKey$1(ctx);
+			const resolved = deps(ctx);
+			const client = resolved.client(configured.url, {
+				kind: "api-key",
+				key: apiKey
+			});
+			const status = await activateAskedToken(ctx, client, resolved.terminal);
+			if (status === null) {
+				await recordLiveLicense(ctx, client);
+				const lost = listOf(LICENSED_FEATURE_NAMES, "conjunction");
+				ctx.ui.info(`Skipping the license; ${lost} need one. Run \`rde init --from license\` to add it later`);
+				return { outcome: "skipped" };
+			}
+			await ctx.saveState({
+				...ctx.state,
+				license: licenseOf(status)
+			});
+			const mb = mbTool(resolved.runner);
+			if (isApiKeyLoginAt(await mb.authStatus(ctx.state.mbProfile), configured.url)) await mb.authLogin({
+				url: configured.url,
+				profile: ctx.state.mbProfile,
+				apiKey
+			});
+			reportFeatures(ctx, status.features);
+			return { outcome: "completed" };
+		}
+	};
+}
+//#endregion
+//#region src/steps/git-sync.ts
+const STEP_ID$6 = "git-sync";
+const GIT_SYNC_KEYS = {
+	location: `${STEP_ID$6}.location`,
+	path: `${STEP_ID$6}.path`,
+	remote: `${STEP_ID$6}.remote`,
+	url: `${STEP_ID$6}.url`,
+	token: `${STEP_ID$6}.token`
+};
+const BARE_REPO_NAME = "content.git";
+const DEFAULT_BRANCH = "main";
+const ORIGIN = "origin";
+const FALLBACK_REMOTE_NAME = "rde-remote";
+const README_NAME = "README.md";
+const README_CONTENT = "# Metabase content\n\nMetabase content synced by rde.\n";
+const INITIAL_COMMIT_MESSAGE = "Initial commit";
+const GITIGNORE_NAME = ".gitignore";
+const IGNORED_PATHS = [
+	".env",
+	".env.local",
+	".env.*.local",
+	"node_modules/",
+	".vite/",
+	".scratch/",
+	".DS_Store"
+];
+const HTTPS_PREFIX = "https://";
+const HOME_PREFIX = "~/";
+const BAD_REQUEST_STATUS = 400;
+const TASK_POLL_INTERVAL_MS = 1e3;
+const TERMINAL_TASK_STATUSES = /* @__PURE__ */ new Set([
+	"successful",
+	"errored",
+	"cancelled",
+	"timed-out",
+	"conflict"
+]);
+const SYNC_MODE_SETTINGS = {
+	"remote-sync-type": "read-write",
+	"remote-sync-transforms": true
+};
+function hostDeps$11(ctx) {
+	return {
+		runner: processRunner(ctx.signal),
+		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
+		cwd: process.cwd(),
+		dataDir: instanceDataDir(ctx.state.name),
+		taskPollIntervalMs: TASK_POLL_INTERVAL_MS
+	};
+}
+const SKIP_GIT_SYNC = "skip";
+const FRESH = {
+	remoteKind: null,
+	hostedUrl: null,
+	workdir: null
+};
+function expandHome(path) {
+	return path.startsWith(HOME_PREFIX) ? join(homedir(), path.slice(2)) : path;
+}
+async function directoryState(path) {
+	let stat;
+	try {
+		stat = await promises.stat(path);
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return "missing";
+		throw error;
+	}
+	if (!stat.isDirectory()) return "file";
+	return (await promises.readdir(path)).length === 0 ? "empty" : "populated";
+}
+async function isCloneTarget(path) {
+	const state = await directoryState(path);
+	return state === "missing" || state === "empty";
+}
+async function initTargetProblem(run, path) {
+	switch (await directoryState(path)) {
+		case "missing":
+			await promises.mkdir(path, { recursive: true });
+			return null;
+		case "file": return `${path} is not a directory`;
+		case "empty": return null;
+		case "populated": return await run.git.isRepo(path) ? null : `${path} is not empty and not a git repository; pick an empty directory or a repository`;
+	}
+}
+async function isCloneOf(run, path, url) {
+	return await run.git.isRepo(path) && await run.git.remoteUrl(path, ORIGIN) === url;
+}
+async function cloneTargetProblem(run, path, url) {
+	switch (await directoryState(path)) {
+		case "missing":
+		case "empty": return null;
+		case "file": return `${path} is not a directory`;
+		case "populated": return await isCloneOf(run, path, url) ? null : `${path} is not empty; pick an empty directory, or use an existing repository`;
+	}
+}
+async function existingRepoProblem(run, path) {
 	return await run.git.isRepo(path) ? null : `${path} is not a git repository`;
 }
 const FRESH_WORKDIRS = {
@@ -6055,6 +6517,9 @@ function configureRemote(run, runtime, model) {
 function isMbUnavailable(error) {
 	return error instanceof ProcessNotFoundError || error instanceof ExternalToolError;
 }
+function remoteSyncGap(license) {
+	return license.activated ? "Remote sync needs a license with the remote-sync feature, and this instance's license lacks it" : "Remote sync needs a license, and this instance has no valid one";
+}
 async function runGitSync(ctx, deps) {
 	const configured = requireConfiguredRuntime(ctx.state);
 	const instance = mbInstanceOf(ctx.state, ctx.secrets);
@@ -6069,6 +6534,8 @@ async function runGitSync(ctx, deps) {
 		}),
 		instance
 	};
+	const license = await recordLiveLicense(ctx, run.client);
+	if (!hasRemoteSync(license)) throw new ConfigError(`${remoteSyncGap(license)}; \`rde init --from license\` activates one`);
 	const flow = await runFlow({
 		remote: remoteScreen(run),
 		hosted: hostedScreen(run),
@@ -6140,11 +6607,9 @@ function githubContents(signal, options = {}) {
 //#region src/tools/skills-cli.ts
 const NPX = "npx";
 const SKILLS_PACKAGE = "skills@latest";
-const DEFAULT_RDE_SKILL_SOURCE = "https://github.com/metabase/agent-skills/tree/main";
-const RDE_SOURCE_SKILL_NAMES = ["rde", "rde-data-apps"];
+const RDE_DATA_APPS_SKILL_NAME = "rde-data-apps";
+const RDE_SOURCE_SKILL_NAMES = ["rde", RDE_DATA_APPS_SKILL_NAME];
 const DATA_APP_REPOSITORY = "metabase/metabase";
-const DATA_APP_BRANCH = "master";
-const DATA_APP_SKILLS_SOURCE = `${DATA_APP_REPOSITORY}/skills#${DATA_APP_BRANCH}`;
 const DATA_APP_SKILL_NAMES = [
 	"metabase-data-app-setup",
 	"metabase-data-app-routing",
@@ -6153,8 +6618,7 @@ const DATA_APP_SKILL_NAMES = [
 	"metabase-data-app-migrate"
 ];
 function rdeSkillSource() {
-	const override = readEnv(ENV_RDE_SKILL_SOURCE);
-	return override === void 0 || override.length === 0 ? DEFAULT_RDE_SKILL_SOURCE : override;
+	return readSetEnv("RDE_SKILL_SOURCE") ?? "https://github.com/metabase/agent-skills/tree/main";
 }
 const InstalledSkill = z.object({
 	name: z.string(),
@@ -6180,8 +6644,7 @@ function projectSkillLockPath(project) {
 	return join(project, PROJECT_LOCK_FILE);
 }
 function xdgStateHome() {
-	const value = readEnv(ENV_XDG_STATE_HOME);
-	return value === void 0 || value.length === 0 ? null : value;
+	return readSetEnv(ENV_XDG_STATE_HOME);
 }
 function lockedSkill(path, raw, skill) {
 	if (raw === null) return null;
@@ -6193,11 +6656,16 @@ const hostSkillFiles = {
 	readJson: readJsonFile,
 	readText: readTextFile
 };
-const DATA_APP_SKILLS_ORIGIN = {
-	kind: "github",
-	repository: DATA_APP_REPOSITORY,
-	ref: DATA_APP_BRANCH
-};
+function dataAppSkillsSource(ref) {
+	return `${DATA_APP_REPOSITORY}/skills#${ref}`;
+}
+function dataAppSkillsOrigin(ref) {
+	return {
+		kind: "github",
+		repository: DATA_APP_REPOSITORY,
+		ref
+	};
+}
 const GITHUB_URL = /^https:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?(?:\/tree\/([^/]+)(?:\/.*)?)?\/?$/;
 function skillOrigin(source, cwd) {
 	const github = GITHUB_URL.exec(source);
@@ -6283,6 +6751,7 @@ const AGENTS_SKILLS_KEYS = { agents: `${STEP_ID$5}.agents` };
 const MECHANICS_NOTE = "The rde skill's mechanics come from `mb skills get <name>` at runtime, so nothing else needs installing.";
 const REQUIRED_SKILL_NAMES = [...DATA_APP_SKILL_NAMES, ...RDE_SOURCE_SKILL_NAMES];
 const DETECT_AGENTS = { kind: "detected" };
+const ASK_AGENTS = { kind: "ask" };
 function hostDeps$10(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
@@ -6307,9 +6776,6 @@ function skillCoversAgent(entry, agent) {
 function coversAny(entry, agents) {
 	return agents.some((agent) => skillCoversAgent(entry, agent));
 }
-async function rdeSkillEntries(runner) {
-	return (await skillsCli(runner).list()).filter((entry) => entry.name === "rde");
-}
 function requiredEntries(installed) {
 	return installed.filter((entry) => REQUIRED_SKILL_NAMES.includes(entry.name));
 }
@@ -6326,12 +6792,26 @@ function coveredAgentNames(entry, agents) {
 function installedLines(entries, agents) {
 	return entries.map((entry) => `${entry.name} (${coveredAgentNames(entry, agents).join(", ")}): ${entry.path}`).join("\n");
 }
-function skillSets(deps) {
+const DEVELOPMENT_BRANCH = "master";
+function releaseBranch(major) {
+	return `release-x.${major}.x`;
+}
+function dataAppSkillsRef(metabaseVersion, development) {
+	if (metabaseVersion === null) return releaseBranch(65);
+	if (development && isMasterBuild(metabaseVersion)) return DEVELOPMENT_BRANCH;
+	const major = releaseMajor(metabaseVersion) ?? 65;
+	return releaseBranch(Math.max(major, 65));
+}
+function wantedDataAppRef(metabaseVersion) {
+	return dataAppSkillsRef(metabaseVersion, developmentMode());
+}
+function skillSets(deps, metabaseVersion) {
+	const dataAppRef = wantedDataAppRef(metabaseVersion);
 	return [{
 		label: "data-app",
-		source: DATA_APP_SKILLS_SOURCE,
-		sourceNote: "",
-		origin: DATA_APP_SKILLS_ORIGIN,
+		source: dataAppSkillsSource(dataAppRef),
+		sourceNote: ` from ${dataAppRef}`,
+		origin: dataAppSkillsOrigin(dataAppRef),
 		skills: DATA_APP_SKILL_NAMES
 	}, {
 		label: "rde",
@@ -6486,7 +6966,7 @@ function agentsSkillsStep(options, updates, deps = hostDeps$10) {
 			if (detected.length === 0) return ctx.state.steps[STEP_ID$5]?.status === "skipped" ? "not-applicable" : "todo";
 			if (missingSkills(await skillsCli(resolved.runner).list(), detected).length > 0) return "todo";
 			const check = await setCheck(resolved);
-			for (const set of skillSets(resolved)) if (await setBehind(set, check)) return "outdated";
+			for (const set of skillSets(resolved, ctx.state.version)) if (await setBehind(set, check)) return "outdated";
 			return "done";
 		},
 		async run(ctx) {
@@ -6503,7 +6983,7 @@ function agentsSkillsStep(options, updates, deps = hostDeps$10) {
 			const before = await installedNow();
 			const check = await setCheck(resolved);
 			const pending = [];
-			for (const set of skillSets(resolved)) if (!coversAll(before, set.skills, selection.agents) || await setBehind(set, check)) pending.push(set);
+			for (const set of skillSets(resolved, ctx.state.version)) if (!coversAll(before, set.skills, selection.agents) || await setBehind(set, check)) pending.push(set);
 			const names = displayNames(selection.agents);
 			if (pending.length === 0) {
 				ctx.ui.success(`The rde and data-app skills are current for ${names}`);
@@ -6542,7 +7022,7 @@ function hostDatabasesDeps(signal) {
 		now: () => /* @__PURE__ */ new Date()
 	};
 }
-function requireApiKey$1(state, apiKey) {
+function requireApiKey(state, apiKey) {
 	if (apiKey === null) throw new ConfigError(`instance ${state.name} has no API key yet; run \`rde init\``);
 	return apiKey;
 }
@@ -6564,7 +7044,7 @@ function authenticatedClient(state, apiKey, deps) {
 	const configured = requireConfiguredRuntime(state);
 	return deps.client(configured.url, {
 		kind: "api-key",
-		key: requireApiKey$1(state, apiKey)
+		key: requireApiKey(state, apiKey)
 	});
 }
 async function listDatabases(state, apiKey, deps) {
@@ -6772,6 +7252,33 @@ function updateTo(release, installed) {
 function displayCommand(install) {
 	return [install.command, ...install.args].join(" ");
 }
+const NPM_EACCES_EXIT = 243;
+const NPM_PERMISSION_TEXT = [
+	"EACCES",
+	"EPERM",
+	"might be a permissions issue"
+];
+function deniedGlobalWrite(install, error) {
+	if (install.command !== "npm" || !(error instanceof ExternalToolError)) return false;
+	return NPM_PERMISSION_TEXT.some((text) => error.stderrTail.includes(text)) || error.exitCode === NPM_EACCES_EXIT;
+}
+function globalWriteDenied(install) {
+	return new ConfigError([
+		`\`${displayCommand(install)}\` failed because npm cannot write its global directory.`,
+		"Give npm a prefix you own with `npm config set prefix ~/.npm-global`,",
+		"add ~/.npm-global/bin to PATH and open a new terminal,",
+		"or install Node with a version manager such as nvm, fnm or mise;",
+		"then run rde init again."
+	].join(" "));
+}
+async function installMb(install, ctx, deps) {
+	try {
+		await runShown(deps.runner, ctx.ui.childOutput, install.command, install.args);
+	} catch (error) {
+		if (deniedGlobalWrite(install, error)) throw globalWriteDenied(install);
+		throw error;
+	}
+}
 async function versionAt(runner, path) {
 	try {
 		const raw = await mbTool(runner).version(path);
@@ -6897,203 +7404,38 @@ function installMbStep(updates, deps = hostDeps$8) {
 		title: "Install the Metabase CLI",
 		async detect(ctx) {
 			const resolved = deps(ctx);
-			const found = await inspectMb(resolved.runner);
-			if (!found.installed || !found.satisfies) return "todo";
-			return (await updateFor(await release(resolved), found.version, resolved)).kind === "update" ? "outdated" : "done";
-		},
-		async run(ctx) {
-			const resolved = deps(ctx);
-			const before = await inspectMb(resolved.runner);
-			const target = await release(resolved);
-			if (before.installed && before.satisfies) {
-				if (target.kind === "unknown") ctx.ui.warn(`Could not check for a newer mb: ${target.reason}`);
-				const update = await updateFor(target, before.version, resolved);
-				if (update.kind === "shadowed") {
-					const lead = `mb ${before.version} runs first; ${update.version} is installed later on PATH.`;
-					ctx.ui.warn(await shadowedWarning(lead, resolved));
-				}
-				if (update.kind !== "update") {
-					ctx.ui.success(`mb ${before.version} is installed`);
-					return { outcome: "completed" };
-				}
-				ctx.ui.info(`mb ${before.version} is installed; updating to ${update.version}`);
-			} else if (before.installed) ctx.ui.warn(`mb ${before.version} is installed; ${MIN_MB_VERSION} or newer is required`);
-			const install = mbInstallCommand(resolved.installedWith);
-			ctx.ui.info(`Running ${displayCommand(install)}`);
-			await runShown(resolved.runner, ctx.ui.childOutput, install.command, install.args);
-			const after = await inspectMb(resolved.runner);
-			if (!after.installed || !after.satisfies) throw await stillWrong(install, after, resolved);
-			const stillNewer = updateTo(target, after.version);
-			if (stillNewer !== null) {
-				const lead = `mb ${after.version} still runs first, not the ${stillNewer} just installed.`;
-				ctx.ui.warn(await shadowedWarning(lead, resolved));
-			}
-			ctx.ui.success(`mb ${after.version} is installed`);
-			return { outcome: "completed" };
-		}
-	};
-}
-//#endregion
-//#region src/steps/license.ts
-const STEP_ID$3 = "license";
-const LICENSE_KEYS = { token: `${STEP_ID$3}.token` };
-const TOKEN_PATTERN = /^[0-9a-f]{64}$/i;
-const NOT_FOUND_STATUS$1 = 404;
-const TOKEN_REFUSED_STATUS = 400;
-const STORE_UNREACHABLE_STATUS = 503;
-const TOKEN_CHECK_HOST = "token-check.metabase.com";
-const ACTIVATION_FAILED = "License activation failed";
-const LICENSED_FEATURES = {
-	[REMOTE_SYNC_FEATURE]: "remote sync",
-	"data-apps": "data apps",
-	"transforms-testing": "transform tests"
-};
-const LICENSED_FEATURE_NAMES = Object.values(LICENSED_FEATURES);
-function licensedFeatureCoverage(features) {
-	const entries = Object.entries(LICENSED_FEATURES);
-	return {
-		included: entries.filter(([key]) => features.includes(key)).map(([, name]) => name),
-		missing: entries.filter(([key]) => !features.includes(key)).map(([, name]) => name)
-	};
-}
-function listOf(names, type) {
-	return new Intl.ListFormat("en", { type }).format(names);
-}
-function hostDeps$7(ctx) {
-	return {
-		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
-		runner: processRunner(ctx.signal),
-		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal)),
-		terminal: stdinIsTty()
-	};
-}
-function isNoTokenYet(error) {
-	if (error instanceof MetabaseApiError) return error.status === NOT_FOUND_STATUS$1;
-	return isMetabaseNotServing(error);
-}
-function validateToken(value) {
-	if (value.length === 0 || TOKEN_PATTERN.test(value)) return;
-	return "A license token is 64 hexadecimal characters";
-}
-function requireApiKey(ctx) {
-	if (ctx.secrets.apiKey === null) throw new ConfigError("no API key yet; the api-key step comes first");
-	return ctx.secrets.apiKey;
-}
-function activeLabel(status) {
-	const plan = status["plan-alias"];
-	return plan === void 0 ? "License active" : `License active (plan ${plan})`;
-}
-function refusalOf(error) {
-	if (!(error instanceof MetabaseApiError)) return null;
-	if (error.status === TOKEN_REFUSED_STATUS) return new ConfigError(`The license token was refused: ${error.reason}`);
-	if (error.status === STORE_UNREACHABLE_STATUS) return new ConfigError(`The instance could not reach ${TOKEN_CHECK_HOST} to check the license token; it needs outbound network access`);
-	return null;
-}
-async function activate(client, token) {
-	try {
-		await client.setting.setPremiumEmbeddingToken(token);
-	} catch (error) {
-		const refusal = refusalOf(error);
-		if (refusal === null) throw error;
-		return {
-			kind: "refused",
-			error: refusal
-		};
-	}
-	const status = await client.tokenStatus.get();
-	if (!status.valid) return {
-		kind: "refused",
-		error: new ConfigError(`Metabase reports the token as ${status.status}`)
-	};
-	return {
-		kind: "activated",
-		status
-	};
-}
-async function activateAskedToken(ctx, client, terminal) {
-	const token = await ctx.prompts.password({
-		key: LICENSE_KEYS.token,
-		message: "Paste your Metabase license token (Enter to skip)",
-		validate: validateToken
-	});
-	if (token.length === 0) return null;
-	const spinner = ctx.ui.spinner("Activating the license…");
-	let activation;
-	try {
-		activation = await activate(client, token);
-	} catch (error) {
-		spinner.fail(ACTIVATION_FAILED);
-		throw error;
-	}
-	if (activation.kind === "activated") {
-		spinner.stop(activeLabel(activation.status));
-		ctx.session.licenseToken.set(token);
-		return activation.status;
-	}
-	spinner.fail(ACTIVATION_FAILED);
-	if (!terminal) throw activation.error;
-	ctx.ui.warn(activation.error.message);
-	return activateAskedToken(ctx, client, terminal);
-}
-function reportFeatures(ctx, features) {
-	const { missing } = licensedFeatureCoverage(features);
-	const remoteSync = features.includes(REMOTE_SYNC_FEATURE);
-	if (remoteSync) ctx.ui.info("Remote sync is included; the git step will set it up");
-	if (missing.length > 0) {
-		const gitNote = remoteSync ? "" : "; the git step will be skipped";
-		ctx.ui.warn(`This license does not include ${listOf(missing, "disjunction")}${gitNote}`);
-	}
-}
-function licenseStep(deps = hostDeps$7) {
-	return {
-		id: STEP_ID$3,
-		title: "Activate your license",
-		redoHint: "`rde init --from license` with it activates the license and runs the steps after it again.",
-		async detect(ctx) {
-			if (ctx.state.steps[STEP_ID$3]?.status === "skipped") return "not-applicable";
-			const configured = configuredRuntime(ctx.state);
-			if (configured === null || ctx.secrets.apiKey === null) return "todo";
-			const resolved = deps(ctx);
-			if (!await resolved.instanceRunning()) return "todo";
-			const client = resolved.client(configured.url, {
-				kind: "api-key",
-				key: ctx.secrets.apiKey
-			});
-			try {
-				return (await client.tokenStatus.get()).valid ? "done" : "todo";
-			} catch (error) {
-				if (isNoTokenYet(error) || isRejectedCredential(error)) return "todo";
-				throw error;
-			}
+			const found = await inspectMb(resolved.runner);
+			if (!found.installed || !found.satisfies) return "todo";
+			return (await updateFor(await release(resolved), found.version, resolved)).kind === "update" ? "outdated" : "done";
 		},
 		async run(ctx) {
-			const configured = requireConfiguredRuntime(ctx.state);
-			const apiKey = requireApiKey(ctx);
 			const resolved = deps(ctx);
-			const status = await activateAskedToken(ctx, resolved.client(configured.url, {
-				kind: "api-key",
-				key: apiKey
-			}), resolved.terminal);
-			if (status === null) {
-				const lost = listOf(LICENSED_FEATURE_NAMES, "conjunction");
-				ctx.ui.info(`Skipping the license; ${lost} need one. Run \`rde init --from license\` to add it later`);
-				return { outcome: "skipped" };
-			}
-			await ctx.saveState({
-				...ctx.state,
-				license: {
-					activated: true,
-					features: status.features,
-					validThru: status["valid-thru"] ?? null
+			const before = await inspectMb(resolved.runner);
+			const target = await release(resolved);
+			if (before.installed && before.satisfies) {
+				if (target.kind === "unknown") ctx.ui.warn(`Could not check for a newer mb: ${target.reason}`);
+				const update = await updateFor(target, before.version, resolved);
+				if (update.kind === "shadowed") {
+					const lead = `mb ${before.version} runs first; ${update.version} is installed later on PATH.`;
+					ctx.ui.warn(await shadowedWarning(lead, resolved));
 				}
-			});
-			const mb = mbTool(resolved.runner);
-			if (isApiKeyLoginAt(await mb.authStatus(ctx.state.mbProfile), configured.url)) await mb.authLogin({
-				url: configured.url,
-				profile: ctx.state.mbProfile,
-				apiKey
-			});
-			reportFeatures(ctx, status.features);
+				if (update.kind !== "update") {
+					ctx.ui.success(`mb ${before.version} is installed`);
+					return { outcome: "completed" };
+				}
+				ctx.ui.info(`mb ${before.version} is installed; updating to ${update.version}`);
+			} else if (before.installed) ctx.ui.warn(`mb ${before.version} is installed; ${MIN_MB_VERSION} or newer is required`);
+			const install = mbInstallCommand(resolved.installedWith);
+			ctx.ui.info(`Running ${displayCommand(install)}`);
+			await installMb(install, ctx, resolved);
+			const after = await inspectMb(resolved.runner);
+			if (!after.installed || !after.satisfies) throw await stillWrong(install, after, resolved);
+			const stillNewer = updateTo(target, after.version);
+			if (stillNewer !== null) {
+				const lead = `mb ${after.version} still runs first, not the ${stillNewer} just installed.`;
+				ctx.ui.warn(await shadowedWarning(lead, resolved));
+			}
+			ctx.ui.success(`mb ${after.version} is installed`);
 			return { outcome: "completed" };
 		}
 	};
@@ -7122,7 +7464,7 @@ const PLATFORMS = {
 		javaHint: `Install Java 21 or newer with your distribution's package manager (openjdk-21-jre) or from https://adoptium.net`
 	}
 };
-function hostDeps$6(ctx) {
+function hostDeps$7(ctx) {
 	const runner = processRunner(ctx.signal);
 	return {
 		platform: process.platform,
@@ -7244,7 +7586,7 @@ function checkLine(check) {
 function checkLines(checks) {
 	return checks.map(checkLine);
 }
-function preflightStep(deps = hostDeps$6) {
+function preflightStep(deps = hostDeps$7) {
 	return {
 		id: "preflight",
 		title: "Check this machine",
@@ -7263,7 +7605,7 @@ function preflightStep(deps = hostDeps$6) {
 }
 //#endregion
 //#region src/steps/runtime.ts
-const STEP_ID$2 = "runtime";
+const STEP_ID$3 = "runtime";
 const MIN_PORT = 1;
 const MAX_PORT = 65535;
 const PORT_PATTERN = /^\d+$/;
@@ -7277,7 +7619,7 @@ const NO_RUNTIME_FLAGS = {
 	jar: null,
 	port: null
 };
-function hostDeps$5(ctx) {
+function hostDeps$6(ctx) {
 	return {
 		runtime: hostRuntimeDeps(ctx.state.name, ctx.signal),
 		releases: releaseLookup(ctx.signal)
@@ -7329,22 +7671,56 @@ async function chooseKind(ctx, options, runtime) {
 	ctx.ui.info(`Docker is not available (${available.docker.reason}); using the jar runtime with ${javaLabel(available.java)}`);
 	return "jar";
 }
-function chooseImage(ctx, options) {
+const NAME_ONE = "`--image <image>` or `--jar <release tag>` names a Metabase to run";
+const INIT_WAYS_OUT = {
+	named: NAME_ONE,
+	unreleased: `${NAME_ONE}, and \`RDE_DEV=1\` runs the development build`
+};
+function isFeedFailure(error) {
+	return error instanceof MetabaseApiError || error instanceof MetabaseUnreachableError;
+}
+async function requireNewestRelease(releases, waysOut) {
+	let newest;
+	try {
+		newest = await releases.newestSupportedRelease();
+	} catch (error) {
+		if (!isFeedFailure(error)) throw error;
+		throw new ConfigError(`the Metabase release feed could not be read (${error.reason}); ${waysOut.named}`);
+	}
+	if (newest === null) throw new ConfigError(`no release of Metabase Enterprise 65 or newer is out yet; ${waysOut.unreleased}`);
+	return newest;
+}
+async function releaseImage(ctx, releases, waysOut) {
+	const newest = await requireNewestRelease(releases, waysOut);
+	const image = majorLineImage(newest.major);
+	ctx.ui.info(`The newest Metabase release is ${newest.version}; ${image} carries the newest build of ${newest.major}`);
+	return image;
+}
+async function latestJarRelease(ctx, releases, waysOut) {
+	if (developmentMode()) {
+		const version = await releases.latestVersion();
+		ctx.ui.info(`The latest Metabase release is ${version}`);
+		return version;
+	}
+	const newest = await requireNewestRelease(releases, waysOut);
+	ctx.ui.info(`The newest Metabase release is ${newest.version}`);
+	return newest.version;
+}
+async function chooseImage(ctx, options, releases) {
 	if (options.image !== null) {
 		ctx.ui.info(`Using image ${options.image} from --image`);
 		return options.image;
 	}
-	return DEFAULT_IMAGE;
+	if (developmentMode()) return DEVELOPMENT_IMAGE;
+	return releaseImage(ctx, releases, INIT_WAYS_OUT);
 }
 async function resolveJar(ctx, spec, releases) {
 	const parsed = parseJarSpec(spec);
-	if (parsed === null) throw new ConfigError(`${spec} is not latest, a release tag such as v1.63.18, or the path of a .jar file`);
+	if (parsed === null) throw new ConfigError(`${spec} is not latest, an enterprise release tag such as v1.65.0, or the path of a .jar file`);
 	if (parsed.kind !== "latest") return parsed;
-	const version = await releases.latestVersion();
-	ctx.ui.info(`The latest Metabase release is ${version}`);
 	return {
 		kind: "release",
-		version
+		version: await latestJarRelease(ctx, releases, INIT_WAYS_OUT)
 	};
 }
 async function chooseJar(ctx, options, releases) {
@@ -7369,7 +7745,7 @@ async function chooseRuntime(ctx, options, deps) {
 	const kind = await chooseKind(ctx, options, deps.runtime);
 	switch (kind) {
 		case "docker": {
-			const image = chooseImage(ctx, options);
+			const image = await chooseImage(ctx, options, deps.releases);
 			const port = await choosePort(ctx, options, deps.runtime);
 			return {
 				kind,
@@ -7406,9 +7782,9 @@ async function persistedRuntime(ctx, options, deps) {
 	});
 	return chosen;
 }
-function runtimeStep(options, deps = hostDeps$5) {
+function runtimeStep(options, deps = hostDeps$6) {
 	return {
-		id: STEP_ID$2,
+		id: STEP_ID$3,
 		title: "Install Metabase",
 		redoHint: "Move it with `rde start --port`, or change its Metabase with `rde upgrade --to`.",
 		async detect(ctx) {
@@ -7437,7 +7813,7 @@ const DEFAULT_HEALTH_TIMING = { timeoutMs: 3e5 };
 //#region src/steps/start-metabase.ts
 const LOG_TAIL_ON_TIMEOUT = 30;
 const PERCENT = 100;
-function hostDeps$4(ctx) {
+function hostDeps$5(ctx) {
 	return {
 		runtime: hostRuntimeDeps(ctx.state.name, ctx.signal),
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
@@ -7450,6 +7826,16 @@ function isNotHealthy(error) {
 async function runningVersion(client) {
 	return (await client.session.properties()).version.tag;
 }
+const PICK_ANOTHER = "`rde upgrade --to <image or release tag>` moves this instance to one, or `rde uninstall`, then `rde init --image <image>` or `rde init --jar <release tag>`, sets up a new instance on one";
+function unsupportedVersionReason(version, development) {
+	if (development) return null;
+	const needs = `rde needs Metabase Enterprise 65 or newer: ${PICK_ANOTHER}`;
+	if (isOpenSourceRelease(version)) return `Metabase ${version} is the open-source edition; ${needs}`;
+	if (isMasterBuild(version)) return `Metabase ${version} is a development build of master, which only development mode (RDE_DEV=1) runs; ${needs}`;
+	const major = releaseMajor(version);
+	if (major !== null && major < 65) return `Metabase ${version} is older than 65; ${needs}`;
+	return null;
+}
 function progressLabel(progress) {
 	return `Starting Metabase… ${Math.round(progress * PERCENT)}%`;
 }
@@ -7466,7 +7852,7 @@ async function startRuntime(ctx, runtime, deps) {
 		throw error;
 	}
 }
-function startMetabaseStep(deps = hostDeps$4) {
+function startMetabaseStep(deps = hostDeps$5, accepted = "supported") {
 	return {
 		id: "start-metabase",
 		title: "Start Metabase",
@@ -7518,12 +7904,272 @@ function startMetabaseStep(deps = hostDeps$4) {
 				...ctx.state,
 				version
 			});
+			const refusal = accepted === "supported" ? unsupportedVersionReason(version, developmentMode()) : null;
+			if (refusal !== null) {
+				spinner.fail(`Metabase ${version} is running at ${configured.url}, but rde does not run it`);
+				throw new UnsupportedMetabaseError(refusal);
+			}
 			spinner.stop(`Metabase ${version} is running at ${configured.url}`);
 			return { outcome: "completed" };
 		}
 	};
 }
 //#endregion
+//#region src/steps/sync-scope.ts
+const STEP_ID$2 = "sync-scope";
+const SYNC_SCOPE_KEYS = { export: `${STEP_ID$2}.export` };
+const AGENT_COLLECTION_NAME = "Analytics";
+const LIBRARY_NAME = "Library";
+const ROOT_COLLECTION_NAME = "Our analytics";
+const AGENT_COLLECTION_DESCRIPTION = "Dashboards, questions, models, and documents that reach git on export.";
+function hostDeps$4(ctx) {
+	return {
+		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
+		runner: processRunner(ctx.signal),
+		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal))
+	};
+}
+function isCollection(entry) {
+	return typeof entry.id === "number";
+}
+function isOrdinary(collection) {
+	return collection.type === null && collection.namespace === null && collection.personal_owner_id === null;
+}
+function readScope(list, syncRoot) {
+	const topLevel = list.filter(isCollection).filter((collection) => collection.location === "/");
+	const ordinary = topLevel.filter(isOrdinary);
+	const unsynced = ordinary.filter((collection) => !collection.is_remote_synced);
+	return {
+		library: topLevel.find((collection) => collection.type === "library") ?? null,
+		syncedRoots: ordinary.filter((collection) => collection.is_remote_synced),
+		unsyncedRecordedRoot: unsynced.find((collection) => collection.id === syncRoot) ?? null,
+		foreignNamesake: unsynced.some((collection) => collection.id !== syncRoot && collection.name === "Analytics")
+	};
+}
+function isComplete(scope, libraryLicensed) {
+	return (!libraryLicensed || scope.library !== null && scope.library.is_remote_synced) && scope.syncedRoots.length > 0;
+}
+function isNotAnsweringYet(error) {
+	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError || isRejectedCredential(error);
+}
+function requireMbInstance(ctx) {
+	const instance = mbInstanceOf(ctx.state, ctx.secrets);
+	if (instance === null) throw new ConfigError("no API key yet; the api-key step comes first");
+	return instance;
+}
+function requireGitRemote(ctx) {
+	if (ctx.state.gitRemote === null) throw new ConfigError("no repository yet; the git-sync step comes first");
+	return ctx.state.gitRemote;
+}
+async function requireSettledImport(ctx, client, gitRemote) {
+	const task = await client.remoteSync.currentTask();
+	if (task === null) return;
+	if (task.status === "running") throw new ConfigError(`a remote sync ${task.sync_task_type} is running; run \`rde init --only ${STEP_ID$2}\` once it finishes`);
+	if (task.sync_task_type === "import" && task.status !== "successful") {
+		const importCommand = `${mbCommand(ctx.state.mbProfile)} git-sync import --branch ${shellWord(gitRemote.branch)}`;
+		throw new ConfigError(`the last import from the repository ended ${task.status}; run \`${importCommand}\`, then \`rde init --only ${STEP_ID$2}\``);
+	}
+}
+async function isReadOnly(client) {
+	return await client.setting.remoteSyncType() === "read-only";
+}
+async function requireReadWrite(client) {
+	if (await isReadOnly(client)) throw new ConfigError(`remote sync is read-only; the repository decides what syncs. Switch it to read-write in Admin, then \`rde init --only ${STEP_ID$2}\``);
+}
+async function ensureLibrary(client, scope, libraryLicensed) {
+	if (!libraryLicensed) return null;
+	return scope.library ?? client.collection.createLibrary();
+}
+async function ensureRoots(ctx, client, scope) {
+	if (scope.syncedRoots.length > 0) return {
+		roots: scope.syncedRoots,
+		created: false,
+		besideNamesake: false
+	};
+	if (scope.unsyncedRecordedRoot !== null) return {
+		roots: [scope.unsyncedRecordedRoot],
+		created: false,
+		besideNamesake: false
+	};
+	const created = await client.collection.create({
+		name: AGENT_COLLECTION_NAME,
+		description: AGENT_COLLECTION_DESCRIPTION
+	});
+	await ctx.saveState({
+		...ctx.state,
+		syncRoot: created.id
+	});
+	return {
+		roots: [created],
+		created: true,
+		besideNamesake: scope.foreignNamesake
+	};
+}
+function itemLabel(item) {
+	return item.name === null ? `${item.model} ${item.id}` : `${item.model} ${item.id} "${item.name}"`;
+}
+function locationLabel(location) {
+	if (location === void 0) return "in a collection Metabase could not find";
+	return `in ${location === null ? ROOT_COLLECTION_NAME : location.name}`;
+}
+function dependencyLine(dependency) {
+	const line = `  ${itemLabel(dependency)} ${locationLabel(dependency.collection)}`;
+	if (dependency.used_by.length === 0) return line;
+	return `${line}, used by ${dependency.used_by.map(itemLabel).join(", ")}`;
+}
+function remedyLine(required) {
+	const remedy = required.remedy;
+	switch (remedy.type) {
+		case "collection":
+			if (required.syncable) return `  Fix: sync ${remedy.collection.name} too, or move that content into a synced collection.`;
+			return `  Fix: move that content into a synced collection; ${remedy.collection.name} cannot sync.`;
+		case "library": return "  Fix: stop using that content; it syncs only through a Library, and this instance has none.";
+		case "none": return "  Fix: move that content into a synced collection, or stop using it.";
+	}
+}
+function requiredSyncLines(required) {
+	return [
+		`Metabase will not sync ${required.blocks.map((collection) => collection.name).join(", ")}, because content there uses:`,
+		...required.dependencies.map(dependencyLine),
+		remedyLine(required)
+	];
+}
+function explainRefusal(error) {
+	if (!(error instanceof MetabaseApiError) || error.code !== "unsynced-dependencies") return error;
+	const refusal = UnsyncedDependencies.safeParse(error.detail);
+	if (!refusal.success) return error;
+	return new ConfigError([...refusal.data.errors.required.flatMap(requiredSyncLines), `After the fix, run \`rde init --only ${STEP_ID$2}\`.`].join("\n"));
+}
+function plannedNames(scope, libraryLicensed) {
+	const library = libraryLicensed ? [scope.library?.name ?? LIBRARY_NAME] : [];
+	if (scope.syncedRoots.length > 0) return [...library, ...scope.syncedRoots.map((collection) => collection.name)];
+	return [...library, scope.unsyncedRecordedRoot?.name ?? "Analytics"];
+}
+function nameList(names) {
+	if (names.length <= 2) return names.join(" and ");
+	return `${names.slice(0, -1).join(", ")}, and ${names.at(-1)}`;
+}
+function exportAdvice(profile, branch, changes) {
+	const command = exportCommand(profile, branch);
+	if (!remoteMoved(changes)) return `\`${command}\``;
+	return `the branch has commits Metabase has not imported; \`${mbCommand(profile)} git-sync export-preflight\`, then \`${command} --merge\``;
+}
+async function planExport(ctx, runner, instance, names) {
+	const changes = await mbTool(runner).gitSyncHasRemoteChanges(instance);
+	if (remoteMoved(changes)) return {
+		changes,
+		push: false
+	};
+	return {
+		changes,
+		push: await ctx.prompts.confirm({
+			key: SYNC_SCOPE_KEYS.export,
+			message: `Push ${nameList(names)} to ${requireGitRemote(ctx).branch} now?`,
+			initialValue: true
+		})
+	};
+}
+function describeExport(task) {
+	const ended = `the export ended ${task.status}`;
+	return task.error_message === null || task.error_message === void 0 ? ended : `${ended}: ${task.error_message}`;
+}
+function reportPending(run) {
+	const advice = exportAdvice(run.ctx.state.mbProfile, run.gitRemote.branch, run.changes);
+	run.ctx.ui.info(`First export pending: ${advice}`);
+}
+async function exportScope(run, runner) {
+	const mb = mbTool(runner);
+	const label = nameList(run.names);
+	const spinner = run.ctx.ui.spinner(`Pushing ${label} to ${run.gitRemote.branch}…`);
+	try {
+		const final = (await mb.gitSyncExport(run.instance, {
+			branch: run.gitRemote.branch,
+			message: `Sync ${label}`
+		})).final ?? null;
+		if (final !== null && final.status !== "successful") {
+			spinner.fail(describeExport(final));
+			reportPending(run);
+			return;
+		}
+		const status = await mb.gitSyncStatus(run.instance);
+		spinner.stop(`Pushed ${label} to ${run.gitRemote.branch}`);
+		if (status.is_dirty) run.ctx.ui.warn(`Metabase still has changes the export did not carry; \`${mbCommand(run.ctx.state.mbProfile)} git-sync dirty\` lists them`);
+	} catch (error) {
+		if (!(error instanceof ExternalToolError)) throw error;
+		spinner.fail(`Could not push ${label}: ${error.message}`);
+		reportPending(run);
+	}
+}
+function scopeLabel(synced) {
+	return `Synced to git: ${synced.map((collection) => collection.name).join(", ")}`;
+}
+function syncScopeStep(deps = hostDeps$4) {
+	return {
+		id: STEP_ID$2,
+		title: "Choose what syncs to git",
+		async detect(ctx) {
+			if (!hasRemoteSync(ctx.state.license) || ctx.state.gitRemote === null) return "not-applicable";
+			const configured = configuredRuntime(ctx.state);
+			if (configured === null || ctx.secrets.apiKey === null) return "todo";
+			const resolved = deps(ctx);
+			if (!await resolved.instanceRunning()) return "todo";
+			const client = resolved.client(configured.url, {
+				kind: "api-key",
+				key: ctx.secrets.apiKey
+			});
+			try {
+				if (isComplete(readScope(await client.collection.list(), ctx.state.syncRoot), hasLibrary(ctx.state.license))) return "done";
+				return await isReadOnly(client) ? "not-applicable" : "todo";
+			} catch (error) {
+				if (isNotAnsweringYet(error)) return "todo";
+				throw error;
+			}
+		},
+		async run(ctx) {
+			requireConfiguredRuntime(ctx.state);
+			const gitRemote = requireGitRemote(ctx);
+			const instance = requireMbInstance(ctx);
+			const resolved = deps(ctx);
+			const client = resolved.client(instance.url, {
+				kind: "api-key",
+				key: instance.apiKey
+			});
+			await requireReadWrite(client);
+			await requireSettledImport(ctx, client, gitRemote);
+			const libraryLicensed = hasLibrary(ctx.state.license);
+			const scope = readScope(await client.collection.list(), ctx.state.syncRoot);
+			const names = plannedNames(scope, libraryLicensed);
+			const plan = isComplete(scope, libraryLicensed) ? null : await planExport(ctx, resolved.runner, instance, names);
+			const spinner = ctx.ui.spinner("Choosing what syncs to git…");
+			let synced;
+			let chosen;
+			try {
+				const library = await ensureLibrary(client, scope, libraryLicensed);
+				chosen = await ensureRoots(ctx, client, scope);
+				synced = library === null ? chosen.roots : [library, ...chosen.roots];
+				await client.remoteSync.updateScope({ collections: Object.fromEntries(synced.map((collection) => [collection.id, true])) });
+			} catch (error) {
+				spinner.fail("Could not choose what syncs to git");
+				throw explainRefusal(error);
+			}
+			spinner.stop(scopeLabel(synced));
+			if (chosen.created) ctx.ui.info(`Created the ${AGENT_COLLECTION_NAME} collection: dashboards, questions, models, and documents filed under it reach git on the next export`);
+			if (chosen.besideNamesake) ctx.ui.info(`Another collection is also named ${AGENT_COLLECTION_NAME}; rde did not create it, so it stays out of git`);
+			if (plan === null) return { outcome: "completed" };
+			const exportRun = {
+				ctx,
+				instance,
+				gitRemote,
+				names,
+				changes: plan.changes
+			};
+			if (plan.push) await exportScope(exportRun, resolved.runner);
+			else reportPending(exportRun);
+			return { outcome: "completed" };
+		}
+	};
+}
+//#endregion
 //#region src/steps/summary.ts
 const STEP_ID$1 = "summary";
 const GIT_SYNC_STEP_ID = "git-sync";
@@ -7570,16 +8216,36 @@ function remoteLine(remote) {
 		case "hosted": return `Remote: ${remote.url}`;
 	}
 }
-function notConfiguredReason(state) {
-	const license = state.license;
+function licenseGap(license) {
 	if (!license.activated) return "no license";
 	if (!hasRemoteSync(license)) return "the license has no remote-sync feature";
+	return null;
+}
+function notConfiguredReason(state) {
+	const gap = licenseGap(state.license);
+	if (gap !== null) return gap;
 	if (state.steps[GIT_SYNC_STEP_ID]?.status === "skipped") return "skipped; `rde init --only git-sync` sets it up";
 	return "not set up yet; `rde init --only git-sync`";
 }
 function gitLines(state) {
 	if (state.gitRemote === null) return [`Remote sync: not configured (${notConfiguredReason(state)})`];
-	return [`Content repository: ${state.gitRemote.workdir} (branch ${state.gitRemote.branch})`, remoteLine(state.gitRemote)];
+	const repository = [`Content repository: ${state.gitRemote.workdir} (branch ${state.gitRemote.branch})`, remoteLine(state.gitRemote)];
+	const gap = licenseGap(state.license);
+	if (gap === null) return repository;
+	return [...repository, `Remote sync: unavailable (${gap}; \`rde init --from license\` activates one)`];
+}
+async function pendingExportLines(state, secrets, runner) {
+	const instance = mbInstanceOf(state, secrets);
+	if (state.gitRemote === null || instance === null) return [];
+	try {
+		const mb = mbTool(runner);
+		if (!(await mb.gitSyncStatus(instance)).is_dirty) return [];
+		const changes = await mb.gitSyncHasRemoteChanges(instance);
+		return [`Export pending: ${exportAdvice(state.mbProfile, state.gitRemote.branch, changes)}`];
+	} catch (error) {
+		if (error instanceof ProcessNotFoundError || error instanceof ExternalToolError) return [`Remote sync: ${error.message}`];
+		throw error;
+	}
 }
 function skillLine(entries, detected) {
 	const agents = [...new Set(entries.flatMap((entry) => coveredAgentNames(entry, detected)))];
@@ -7592,14 +8258,15 @@ function launchLines(agents, workdir) {
 	const prefix = workdir === null ? "" : `cd ${workdir} && `;
 	return ["Start working:", ...detected.map((agent) => `  ${prefix}${agent.launch}  (${agent.displayName})`)];
 }
-async function summaryLines(state, apiKey, deps) {
+async function summaryLines(state, secrets, deps) {
 	const profile = state.mbProfile;
 	const lines = [];
 	if (state.url !== null) lines.push(`Metabase: ${state.url}`);
 	if (state.admin !== null) lines.push(loginLine(state.admin.kind, state.admin.email));
 	lines.push(profile === "default" ? `Metabase CLI: ${mbCommand(profile)} <command>` : `Metabase CLI: ${mbCommand(profile)} <command>  or  export MB_PROFILE=${profile}`);
-	lines.push(...await databaseLines$1(state, apiKey, deps));
+	lines.push(...await databaseLines$1(state, secrets.apiKey, deps));
 	lines.push(...gitLines(state));
+	lines.push(...await pendingExportLines(state, secrets, deps.runner));
 	const installed = await skillsCli(deps.runner).list();
 	const agents = await detectAgents(deps.probe);
 	const detected = agents.filter((agent) => agent.detected);
@@ -7616,7 +8283,7 @@ function summaryStep(deps = hostDeps$3) {
 			return "todo";
 		},
 		async run(ctx) {
-			const lines = await summaryLines(ctx.state, ctx.secrets.apiKey, deps(ctx));
+			const lines = await summaryLines(ctx.state, ctx.secrets, deps(ctx));
 			ctx.ui.note(lines.join("\n"), "Your environment");
 			return { outcome: "completed" };
 		}
@@ -7693,6 +8360,7 @@ const STEP_BY_ID = {
 	license: () => licenseStep(),
 	databases: (options) => databasesStep(options.databases),
 	"git-sync": () => gitSyncStep(),
+	"sync-scope": () => syncScopeStep(),
 	summary: () => summaryStep()
 };
 function initSteps(options) {
@@ -7777,7 +8445,8 @@ const SECTIONS = {
 		remote: RemoteKind.optional(),
 		url: EnvString.optional(),
 		token: EnvString.optional()
-	}).optional()
+	}).optional(),
+	"sync-scope": z.strictObject({ export: z.boolean() }).optional()
 };
 const InitAnswers = z.strictObject(SECTIONS);
 const select$1 = (value) => ({
@@ -7886,6 +8555,8 @@ function keyedAnswers(answers) {
 		if (git.url !== void 0) add(map, GIT_SYNC_KEYS.url, text$1(git.url));
 		if (git.token !== void 0) add(map, GIT_SYNC_KEYS.token, password$1(git.token));
 	}
+	const scope = answers["sync-scope"];
+	if (scope !== void 0) add(map, SYNC_SCOPE_KEYS.export, confirm$1(scope.export));
 	return map;
 }
 function parseInitAnswers(raw, source) {
@@ -7927,6 +8598,10 @@ function stepsAskingForWork(answers) {
 			step: "git-sync",
 			asks: git !== void 0 && git.location !== "skip"
 		},
+		{
+			step: "sync-scope",
+			asks: answers["sync-scope"]?.export === true
+		},
 		{
 			step: "agents-skills",
 			asks: agents !== void 0 && agents.agents.length > 0
@@ -8528,8 +9203,7 @@ function plainUi(output) {
 	};
 }
 function noColorRequested() {
-	const value = readEnv(ENV_NO_COLOR);
-	return value !== void 0 && value !== "";
+	return readSetEnv(ENV_NO_COLOR) !== null;
 }
 function drawsOnTerminal() {
 	return process.stdout.isTTY === true && !noColorRequested();
@@ -8660,6 +9334,20 @@ const db = defineCommand({
 	default: "list"
 });
 //#endregion
+//#region package.json
+var name = "@metabase/rde";
+var version = "0.1.18";
+var description = "Prepares a local machine for data-engineering work with Metabase and coding agents";
+//#endregion
+//#region src/version.ts
+const PACKAGE_NAME = name;
+const VERSION = version;
+const ROOT_META = {
+	name: "rde",
+	version: VERSION,
+	description
+};
+//#endregion
 //#region src/wizard/engine.ts
 function requireKnownStep(steps, id, flag) {
 	if (id === void 0) return;
@@ -8756,6 +9444,8 @@ async function runWizard(steps, ctx, options = {}) {
 }
 //#endregion
 //#region src/steps/doctor.ts
+const RDE_DIST_TAG = "latest";
+const RDE_RELEASE_TIMEOUT_MS = 3e3;
 function hostDoctorDeps(instanceName, signal) {
 	const runner = processRunner(signal);
 	const runtime = hostRuntimeDeps(instanceName, signal);
@@ -8775,7 +9465,8 @@ function hostDoctorDeps(instanceName, signal) {
 			cwd: process.cwd(),
 			stateHome: xdgStateHome(),
 			files: hostSkillFiles
-		}
+		},
+		publishedRdeVersion: () => npmRegistry(signal, { timeoutMs: RDE_RELEASE_TIMEOUT_MS }).distTagVersion(PACKAGE_NAME, RDE_DIST_TAG)
 	};
 }
 const NOT_FOUND_STATUS = 404;
@@ -8869,6 +9560,26 @@ function mbRow(diagnosis, lines, deps) {
 		case "current": return ok("mb", MB_LABEL, lines.join("\n"));
 	}
 }
+const RDE_LABEL = "rde";
+const RDE_UPDATE_HINT = `\`npm i -g ${PACKAGE_NAME}@${RDE_DIST_TAG}\``;
+function rdeUncheckedRow(reason) {
+	return skipped("rde", RDE_LABEL, `${VERSION}; could not check for a newer release: ${reason}`);
+}
+async function rdeRow(deps) {
+	let raw;
+	try {
+		raw = await deps.publishedRdeVersion();
+	} catch (error) {
+		const reason = lookupFailure(error);
+		if (reason === null) throw error;
+		return rdeUncheckedRow(reason);
+	}
+	const published = semver.valid(raw);
+	if (published === null) return rdeUncheckedRow(`the registry names "${raw}" for ${RDE_DIST_TAG}, which is not a version`);
+	if (semver.lt(VERSION, published)) return note$1("rde", RDE_LABEL, `${VERSION}; ${published} is released`, RDE_UPDATE_HINT);
+	if (semver.gt(VERSION, published)) return ok("rde", RDE_LABEL, `${VERSION}, ahead of the latest release ${published}`);
+	return ok("rde", RDE_LABEL, `${VERSION}, the latest release`);
+}
 async function mbFinding(deps) {
 	const found = await inspectMbOnPath(deps.runner, deps.locateMb);
 	const diagnosis = diagnoseMb(found, deps.installedWith);
@@ -8889,6 +9600,20 @@ function publishesOnLoopback(container, port) {
 }
 const CONTAINER = "the container";
 const CONTAINER_SILENT_PORT_HINT = "Docker's forward of the port is broken; `rde start` repairs it";
+function containerSettingsFailure(runtime, inspection) {
+	const onMaster = !developmentMode() && isMasterBuildImage(runtime.image);
+	const drift = containerEnvDrift(inspection, runtime);
+	const problems = [];
+	if (onMaster) problems.push(`${runtime.containerName} runs ${runtime.image}, a development build of Metabase`);
+	if (drift.length > 0) problems.push(`${runtime.containerName} was created with ${drift.join(", ")} set otherwise than rde sets them now`);
+	if (problems.length === 0) return null;
+	const hint = onMaster ? "a build of master is ahead of every release, so `rde uninstall`, then `rde init`, sets up an instance on a release; `RDE_DEV=1` keeps running this one" : "`rde upgrade` creates the container again with rde's settings";
+	return {
+		detail: problems.join("\n"),
+		hint,
+		step: null
+	};
+}
 async function containerRow(runtime, deps, dockerOk) {
 	const label = "container";
 	if (!dockerOk) return {
@@ -8929,6 +9654,11 @@ async function containerRow(runtime, deps, dockerOk) {
 		}),
 		...found
 	};
+	const settings = containerSettingsFailure(runtime, inspection);
+	if (settings !== null) return {
+		row: failed("container", label, settings),
+		...found
+	};
 	const state = inspection.running ? "running" : "stopped";
 	return {
 		row: ok("container", label, `${runtime.containerName} ${state} (${runtime.image})`),
@@ -9407,25 +10137,71 @@ async function skillCopiesRow(globalEntries, deps) {
 	const stale = judged.filter((copy) => !copy.current);
 	return stale.length === 0 ? ok(id, label, detail) : staleCopiesRow(stale, detail, deps);
 }
+function dataAppBranchLine(version, origin) {
+	const wanted = withRef(origin.repository, origin.ref);
+	return version === null ? `Metabase has not reported its version yet; rde installs them from ${wanted}` : `Metabase ${version} takes them from ${wanted}`;
+}
+async function dataAppSkillsRow(state, installed, deps) {
+	const id = "data-app-skills";
+	const label = "data-app skills";
+	const branch = dataAppSkillsOrigin(wantedDataAppRef(state.version));
+	const wanted = [...DATA_APP_SKILL_NAMES.map((name) => ({
+		name,
+		origin: branch
+	})), {
+		name: RDE_DATA_APPS_SKILL_NAME,
+		origin: skillOrigin(deps.skills.source, deps.skills.cwd)
+	}];
+	const lines = [dataAppBranchLine(state.version, branch)];
+	let current = true;
+	for (const skill of wanted) {
+		const entry = installed.find((candidate) => candidate.name === skill.name);
+		if (entry === void 0) {
+			lines.push(`${skill.name}: not installed`);
+			current = false;
+			continue;
+		}
+		const judged = await judgeCopy(entry, skill.origin, deps);
+		lines.push(judged.line);
+		current &&= judged.current;
+	}
+	const detail = lines.join("\n");
+	if (current) return ok(id, label, detail);
+	return failed(id, label, {
+		detail,
+		hint: `\`rde init --only ${SKILL_STEP}\` installs them; then restart the agent session`,
+		step: SKILL_STEP
+	});
+}
 async function skillRows(state, deps) {
 	const label = "rde skill";
 	if (state === null) return [skipped("skill", label, NO_INSTANCE_REASON)];
 	if (state.steps[SKILL_STEP]?.status === "skipped") return [skipped("skill", label, `skipped during init; \`rde init --only ${SKILL_STEP}\``)];
 	const detected = (await detectAgents(deps.probe)).filter((agent) => agent.detected);
 	if (detected.length === 0) return [skipped("skill", label, "no coding agents detected")];
-	const entries = await rdeSkillEntries(deps.runner);
+	const installed = await skillsCli(deps.runner).list();
+	const entries = installed.filter((entry) => entry.name === "rde");
 	const copies = await skillCopiesRow(entries, deps);
-	if (detected.filter((agent) => entries.some((entry) => skillCoversAgent(entry, agent))).length === 0) return [failed("skill", label, {
-		detail: `not installed for ${detected.map((agent) => agent.displayName).join(", ")}`,
-		hint: `\`rde init --only ${SKILL_STEP}\``,
-		step: SKILL_STEP
-	}), copies];
-	return [...detected.map((agent) => {
-		const entry = entries.find((candidate) => skillCoversAgent(candidate, agent));
-		const agentLabel = `${label} (${agent.displayName})`;
-		if (entry === void 0) return skipped(skillRowId(agent), agentLabel, `not installed; \`rde init --only ${SKILL_STEP}\` adds it`);
-		return ok(skillRowId(agent), agentLabel, entry.path);
-	}), copies];
+	const dataApps = await dataAppSkillsRow(state, installed, deps);
+	if (detected.filter((agent) => entries.some((entry) => skillCoversAgent(entry, agent))).length === 0) return [
+		failed("skill", label, {
+			detail: `not installed for ${detected.map((agent) => agent.displayName).join(", ")}`,
+			hint: `\`rde init --only ${SKILL_STEP}\``,
+			step: SKILL_STEP
+		}),
+		copies,
+		dataApps
+	];
+	return [
+		...detected.map((agent) => {
+			const entry = entries.find((candidate) => skillCoversAgent(candidate, agent));
+			const agentLabel = `${label} (${agent.displayName})`;
+			if (entry === void 0) return skipped(skillRowId(agent), agentLabel, `not installed; \`rde init --only ${SKILL_STEP}\` adds it`);
+			return ok(skillRowId(agent), agentLabel, entry.path);
+		}),
+		copies,
+		dataApps
+	];
 }
 function noRuntimeRows() {
 	return [
@@ -9470,7 +10246,11 @@ async function collectDoctor(instance, state, secrets, deps) {
 	const dockerOk = machine.some((row) => row.id === "docker" && row.status === "ok");
 	const mb = await mbFinding(deps);
 	const profiles = sharedProfileList(deps);
-	const checks = [...machine, mb.row];
+	const checks = [
+		...machine,
+		mb.row,
+		await rdeRow(deps)
+	];
 	if (state === null) checks.push(...noRuntimeRows(), skipped("version", "Metabase version", NO_INSTANCE_REASON), skipped("admin", "admin user", NO_INSTANCE_REASON), skipped("admin-password", "admin password", NO_INSTANCE_REASON), skipped("api-key", "API key", NO_INSTANCE_REASON), skipped("secrets-file", "secrets file", NO_INSTANCE_REASON), skipped("state-file", "state file", NO_INSTANCE_REASON), skipped("mb-profile", "mb profile", NO_INSTANCE_REASON), skipped("license", "license", NO_INSTANCE_REASON), skipped("databases", "databases", NO_INSTANCE_REASON), skipped("git-sync", "remote sync", NO_INSTANCE_REASON));
 	else checks.push(...await instanceRows(state, secrets, deps, dockerOk, profiles, mb.unusable));
 	const rdeProfile = state === null ? null : state.mbProfile;
@@ -9666,7 +10446,8 @@ function applyRecord(draft, record) {
 	else if (key === API_KEY_KEYS.profile && value !== null) {
 		const profile = MbProfileChoice.safeParse(value);
 		if (profile.success) draft.answers["api-key"] = { profile: profile.data };
-	} else if (key === LICENSE_KEYS.token && value !== null) draft.answers.license = { token: value.length === 0 ? null : envReference(ENV_LICENSE_TOKEN) };
+	} else if (key === SYNC_SCOPE_KEYS.export && record.answer.kind === "confirm") draft.answers["sync-scope"] = { export: record.answer.value };
+	else if (key === LICENSE_KEYS.token && value !== null) draft.answers.license = { token: value.length === 0 ? null : envReference(ENV_LICENSE_TOKEN) };
 }
 function writableUri(uri, index) {
 	const trimmed = uri.trim();
@@ -10127,7 +10908,7 @@ function taskLabel(status) {
 }
 function remoteContentOf(changes) {
 	if (!changes.has_changes) return "imported";
-	return changes.local_version === null ? "never-imported" : "changed";
+	return remoteMoved(changes) ? "changed" : "never-imported";
 }
 function isMbFailure(error) {
 	return error instanceof ProcessNotFoundError || error instanceof ExternalToolError;
@@ -10145,7 +10926,8 @@ async function gitSyncOf(ctx, deps) {
 			branch: status.branch,
 			dirty: status.is_dirty,
 			remote: remoteContentOf(changes),
-			task: taskLabel(status)
+			task: taskLabel(status),
+			syncedCollections: status.synced_collections.map((collection) => collection.name)
 		};
 	} catch (error) {
 		if (isMbFailure(error)) return { error: error.message };
@@ -10205,7 +10987,8 @@ function gitSyncLine(report) {
 	if (isGitSyncFailure(report.gitSync)) return `Remote sync: ${report.gitSync.error}`;
 	const branch = report.gitSync.branch === null ? "no branch" : `branch ${report.gitSync.branch}`;
 	const task = report.gitSync.task === null ? "no task running" : `task ${report.gitSync.task}`;
-	return `Remote sync: ${branch}, ${syncStateLabel(report.mbProfile, report.gitSync)}, ${task}`;
+	const scope = report.gitSync.syncedCollections.length === 0 ? "nothing synced; `rde init --only sync-scope`" : `synced: ${report.gitSync.syncedCollections.join(", ")}`;
+	return `Remote sync: ${branch}, ${syncStateLabel(report.mbProfile, report.gitSync)}, ${task}, ${scope}`;
 }
 const REMOTE_CONTENT_LABEL = {
 	imported: null,
@@ -10593,7 +11376,7 @@ function keptOnDisk(options, state, dirPresent) {
 	const kept = [];
 	if (options.keepData && dirPresent) kept.push(`Instance directory ${instanceDir(options.instance)} (--keep-data); \`rde init\` reinstalls from it`);
 	if (state?.gitRemote !== null && state?.gitRemote !== void 0) kept.push(`Working directory ${state.gitRemote.workdir} and its git history`);
-	if (!options.removeSkill) kept.push(`The rde skill for your agents; pass --remove-skill to remove it`);
+	if (!options.removeSkill) kept.push(`The ${RDE_SOURCE_SKILL_NAMES.join(" and ")} skills for your agents; pass --remove-skill to remove them`);
 	return kept;
 }
 async function planUninstall(options, deps) {
@@ -10700,6 +11483,9 @@ function reportLines(report) {
 function leftBehind(report) {
 	return [...report.results.flatMap((result) => result.outcome === "failed" ? [result.label] : []), ...report.problems.map((problem) => problem.subject)];
 }
+function uninstallCommandLine(options) {
+	return options.instance === options.defaultInstance ? "rde uninstall" : `rde uninstall --instance ${options.instance}`;
+}
 async function uninstall(options, deps, io) {
 	const plan = await planUninstall(options, deps);
 	for (const problem of plan.problems) io.ui.warn(`${problem.subject} ${problem.reason}`);
@@ -10710,7 +11496,7 @@ async function uninstall(options, deps, io) {
 			problems: plan.problems
 		};
 	}
-	io.ui.note(planLines$1(plan).join("\n"), `rde uninstall ${options.instance}`);
+	io.ui.note(planLines$1(plan).join("\n"), uninstallCommandLine(options));
 	if (plan.unpulled !== null) {
 		io.ui.warn(unpulledWarning(plan.unpulled));
 		if ((options.yes || !options.terminal) && !options.force) throw new ConfigError(unpulledRefusal(plan.unpulled));
@@ -10749,7 +11535,7 @@ const uninstallCommand = defineRdeCommand({
 		},
 		"remove-skill": {
 			type: "boolean",
-			description: "Also remove the rde skill from your coding agents",
+			description: "Also remove the rde and rde-data-apps skills from your coding agents",
 			default: false
 		},
 		"remove-image": {
@@ -10770,11 +11556,13 @@ const uninstallCommand = defineRdeCommand({
 	},
 	interrupted: INTERRUPTED,
 	async run(args) {
-		const instance = args.instance ?? await instanceNameOrDefault();
+		const defaultInstance = await instanceNameOrDefault();
+		const instance = args.instance ?? defaultInstance;
 		if (!isInstanceName(instance)) throw new ConfigError(`${args.instance === void 0 ? `the default instance in ${globalConfigPath()},` : "--instance"} ${instance} is not an instance name (${INSTANCE_NAME_RULE})`);
 		const ui = terminalUi();
 		const report = await uninstall({
 			instance,
+			defaultInstance,
 			keepData: args["keep-data"],
 			removeSkill: args["remove-skill"],
 			removeImage: args["remove-image"],
@@ -10800,35 +11588,59 @@ function hostDeps(ctx) {
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
 		timing: DEFAULT_HEALTH_TIMING,
 		releases: releaseLookup(ctx.signal),
-		now: () => /* @__PURE__ */ new Date()
+		now: () => /* @__PURE__ */ new Date(),
+		skills: (agents) => agentsSkillsStep(agents, "published")
 	};
 }
-function imageTag(ref) {
-	const colon = ref.lastIndexOf(":");
-	if (colon === -1 || colon < ref.lastIndexOf("/")) return null;
-	return ref.slice(colon + 1);
+function majorMove(from, to) {
+	const fromMajor = releaseMajor(from);
+	const toMajor = to === null ? null : releaseMajor(to);
+	if (fromMajor === null || toMajor === null || fromMajor === toMajor) return null;
+	return {
+		from: fromMajor,
+		to: toMajor
+	};
 }
 function releaseOf(tag) {
 	const match = RELEASE_TAG.exec(tag);
 	if (match === null || match[1] === void 0) return null;
 	return semver.coerce(match[1]);
 }
-function downgradeReason(current, targetTag) {
-	if (targetTag === null) return null;
+function isDowngrade(current, targetTag) {
+	if (isMajorLineTag(targetTag)) {
+		const running = releaseMajor(current);
+		const target = releaseMajor(targetTag);
+		return running !== null && target !== null && target < running;
+	}
 	const running = releaseOf(current);
 	const target = releaseOf(targetTag);
-	if (running === null || target === null || !semver.lt(target, running)) return null;
+	return running !== null && target !== null && semver.lt(target, running);
+}
+function downgradeReason(current, targetTag) {
+	if (targetTag === null || !isDowngrade(current, targetTag)) return null;
 	return `refusing to downgrade from ${current} to ${targetTag}: Metabase migrates its application database forward only; a fresh instance (\`rde uninstall\`, then \`rde init\`) is the way to run an older release`;
 }
 function backupStamp(now) {
 	return now.toISOString().replace(/\.\d{3}Z$/, "Z").replaceAll(":", "-");
 }
-async function ensureRunning(ctx, deps, client) {
-	await startMetabaseStep(() => deps).run(ctx);
+async function ensureRunning(ctx, deps, client, accepted) {
+	await startMetabaseStep(() => deps, accepted).run(ctx);
 	return runningVersion(client);
 }
-function dockerTarget(runtime, to) {
-	const image = to ?? runtime.image;
+function requireSupported(version) {
+	const refusal = unsupportedVersionReason(version, developmentMode());
+	if (refusal !== null) throw new UnsupportedMetabaseError(refusal);
+}
+function knownTargetVersion(target) {
+	const tag = target.releaseTag;
+	return tag !== null && (isReleaseTag(tag) || isMajorLineTag(tag)) ? tag : null;
+}
+const TO_ONE = "`--to <image or release tag>` names a Metabase to move to";
+const UPGRADE_WAYS_OUT = {
+	named: TO_ONE,
+	unreleased: TO_ONE
+};
+function dockerTargetOf(runtime, image, ownImage) {
 	return {
 		kind: "docker",
 		next: {
@@ -10836,22 +11648,24 @@ function dockerTarget(runtime, to) {
 			image
 		},
 		label: image,
-		releaseTag: imageTag(image)
+		releaseTag: imageTag(image),
+		ownImage
 	};
 }
+async function dockerTarget(ctx, runtime, to, releases) {
+	if (to !== null) return dockerTargetOf(runtime, to, false);
+	if (developmentMode()) return dockerTargetOf(runtime, runtime.image, false);
+	if (!isMetabaseImage(runtime.image)) return dockerTargetOf(runtime, runtime.image, true);
+	return dockerTargetOf(runtime, await releaseImage(ctx, releases, UPGRADE_WAYS_OUT), false);
+}
 async function jarTarget(ctx, runtime, to, releases) {
 	const spec = to ?? "latest";
 	const parsed = parseJarSpec(spec);
-	if (parsed === null) throw new ConfigError(`--to ${spec} is not latest, a release tag such as v1.63.18, or the path of a .jar file`);
-	let source;
-	if (parsed.kind === "latest") {
-		const version = await releases.latestVersion();
-		ctx.ui.info(`The latest Metabase release is ${version}`);
-		source = {
-			kind: "release",
-			version
-		};
-	} else source = parsed;
+	if (parsed === null) throw new ConfigError(`--to ${spec} is not latest, an enterprise release tag such as v1.65.0, or the path of a .jar file`);
+	const source = parsed.kind === "latest" ? {
+		kind: "release",
+		version: await latestJarRelease(ctx, releases, UPGRADE_WAYS_OUT)
+	} : parsed;
 	return {
 		kind: "jar",
 		previous: runtime,
@@ -10865,7 +11679,7 @@ async function jarTarget(ctx, runtime, to, releases) {
 }
 function resolveTarget(ctx, configured, to, releases) {
 	switch (configured.runtime.kind) {
-		case "docker": return Promise.resolve(dockerTarget(configured.runtime, to));
+		case "docker": return dockerTarget(ctx, configured.runtime, to, releases);
 		case "jar": return jarTarget(ctx, configured.runtime, to, releases);
 	}
 }
@@ -10915,9 +11729,13 @@ const SWITCH_TEXT = {
 	jar: "Metabase stops and starts again from the target jar."
 };
 function planLines(configured, current, target, backup) {
+	const notes = [];
+	if (target.kind === "docker" && target.ownImage) notes.push("the instance's own image pulled again, since only Metabase's images move to the newest release");
+	if (target.releaseTag === null || !isReleaseTag(target.releaseTag)) notes.push("its version shows once it runs");
+	const annotation = notes.length === 0 ? "" : ` (${notes.join("; ")})`;
 	return [
 		`Running:  ${current} (${describeRuntime(configured.runtime)})`,
-		`Target:   ${target.label}`,
+		`Target:   ${target.label}${annotation}`,
 		`Backup:   ${backup}`,
 		"",
 		SWITCH_TEXT[configured.runtime.kind],
@@ -10976,31 +11794,70 @@ async function switchTo(ctx, deps, target) {
 	}
 	spinner.stop(`Installed ${target.label}`);
 }
+function failedStartTitle(error) {
+	if (error instanceof MetabaseUnreachableError) return "Metabase did not come up on the new version";
+	if (error instanceof UnsupportedMetabaseError) return "The new version is not one rde runs";
+	return null;
+}
 async function startUpgraded(ctx, deps, client, previous, backup) {
 	try {
-		return await ensureRunning(ctx, deps, client);
+		return await ensureRunning(ctx, deps, client, "supported");
 	} catch (error) {
-		if (error instanceof MetabaseUnreachableError) ctx.ui.note(restoreLines(ctx, previous, deps.runtime.dataDir, backup).join("\n"), "Metabase did not come up on the new version");
+		const title = failedStartTitle(error);
+		if (title !== null) ctx.ui.note(restoreLines(ctx, previous, deps.runtime.dataDir, backup).join("\n"), title);
 		throw error;
 	}
 }
+async function recreateStale(ctx, deps, previous, target) {
+	const next = target.next;
+	const container = await deps.runtime.docker.containerInspect(next.containerName);
+	const drift = container.exists ? containerEnvDrift(container, next) : [];
+	const renamed = previous.kind === "docker" && previous.image !== next.image;
+	if (drift.length === 0 && !renamed) return false;
+	if (renamed) {
+		ctx.ui.info(`${previous.image} is the image ${next.image} names; creating ${next.containerName} again under ${next.image}`);
+		await ctx.saveState({
+			...ctx.state,
+			runtime: next
+		});
+	}
+	if (drift.length > 0) ctx.ui.info(`${next.containerName} was created with ${drift.join(", ")} set otherwise than rde sets them now; creating it again from the image it runs`);
+	await runtimeFromState(next, deps.runtime).reconfigure();
+	return true;
+}
+async function alreadyOn(ctx, deps, client, configured, current, target) {
+	if (target.kind === "docker" && await recreateStale(ctx, deps, configured.runtime, target)) {
+		await ensureRunning(ctx, deps, client, "supported");
+		ctx.ui.success(`Already on ${current}; ${target.next.containerName} runs ${target.label} with rde's settings now`);
+		return {
+			outcome: "recreated",
+			version: current
+		};
+	}
+	ctx.ui.success(`Already on ${current}: ${target.label} is what the instance runs`);
+	return {
+		outcome: "unchanged",
+		version: current
+	};
+}
 async function upgrade(ctx, options, deps = hostDeps) {
 	const resolved = deps(ctx);
 	const configured = requireConfiguredRuntime(ctx.state);
 	const client = resolved.client(configured.url, NO_AUTH);
-	const current = await ensureRunning(ctx, resolved, client);
 	const target = await resolveTarget(ctx, configured, options.to, resolved.releases);
+	const current = await ensureRunning(ctx, resolved, client, "any");
 	const refusal = downgradeReason(current, target.releaseTag);
 	if (refusal !== null) throw new ConfigError(refusal);
+	const known = knownTargetVersion(target);
+	if (known !== null) requireSupported(known);
 	if (await fetchTarget(ctx, resolved, target, current)) {
-		ctx.ui.success(`Already on ${current}: ${target.label} is what the instance runs`);
-		return {
-			outcome: "unchanged",
-			version: current
-		};
+		requireSupported(current);
+		return alreadyOn(ctx, resolved, client, configured, current, target);
 	}
 	const backup = join(instanceBackupsDir(ctx.state.name), backupStamp(resolved.now()));
 	ctx.ui.note(planLines(configured, current, target, backup).join("\n"), "rde upgrade");
+	const announced = majorMove(current, target.releaseTag);
+	if (announced !== null) ctx.ui.warn(`This moves Metabase from ${announced.from} to ${announced.to}, a new major version; the data-app skills follow it after the upgrade`);
 	if (!options.yes) {
 		if (!await ctx.prompts.confirm({
 			message: "Upgrade now?",
@@ -11021,6 +11878,11 @@ async function upgrade(ctx, options, deps = hostDeps) {
 	options.onPhase("starting", backup);
 	const to = await startUpgraded(ctx, resolved, client, configured, backup);
 	ctx.ui.success(`Upgraded Metabase from ${current} to ${to}; the backup at ${backup} can go once you are happy with it`);
+	const moved = majorMove(current, to);
+	if (moved !== null) {
+		if (announced === null) ctx.ui.warn(`This moved Metabase from ${moved.from} to ${moved.to}, a new major version; the data-app skills follow it`);
+		await runWizard([resolved.skills(options.yes ? DETECT_AGENTS : ASK_AGENTS)], ctx);
+	}
 	return {
 		outcome: "upgraded",
 		from: current,
@@ -11046,7 +11908,7 @@ const upgradeCommand = defineRdeCommand({
 	args: {
 		to: {
 			type: "string",
-			description: "Docker: image to upgrade to (default: the instance's image, pulled again); jar: latest, a release tag, or a .jar path (default: latest)"
+			description: "Docker: image to upgrade to (default: the major line of the newest Metabase Enterprise release, such as metabase/metabase-enterprise:v1.65.x; the instance's own image pulled again with RDE_DEV=1 or for an image from outside Metabase's repositories); jar: latest (the newest release), a release tag, or a .jar path (default: latest)"
 		},
 		yes: {
 			type: "boolean",
@@ -11074,11 +11936,7 @@ const upgradeCommand = defineRdeCommand({
 //#endregion
 //#region src/main.ts
 const main = defineCommand({
-	meta: {
-		name: "rde",
-		version: "0.1.16",
-		description: "Prepares a local machine for data-engineering work with Metabase and coding agents"
-	},
+	meta: ROOT_META,
 	subCommands: {
 		init,
 		start,