@metabase/rde 0.1.17 → 0.1.18

package/dist/cli.mjs

@@ -11,6 +11,7 @@ import { pipeline } from "node:stream/promises";
 import { spawn } from "node:child_process";
 import { connect, createServer } from "node:net";
 import { confirm, intro, isCancel, log, multiselect, note, outro, password, select, spinner, text } from "@clack/prompts";
+import { isDeepStrictEqual } from "node:util";
 import semver from "semver";
 //#region src/errors.ts
 var AbortError = class extends Error {
@@ -33,6 +34,12 @@ var PortTakenError = class extends ConfigError {
 		this.port = port;
 	}
 };
+var UnsupportedMetabaseError = class extends ConfigError {
+	constructor(message) {
+		super(message);
+		this.name = "UnsupportedMetabaseError";
+	}
+};
 var PromptUnavailableError = class extends ConfigError {
 	constructor(message) {
 		super(message);
@@ -260,9 +267,9 @@ function withoutEscapes(text) {
 const StepId = z.enum([
 	"preflight",
 	"install-mb",
-	"agents-skills",
 	"runtime",
 	"start-metabase",
+	"agents-skills",
 	"admin-user",
 	"api-key",
 	"transforms",
@@ -537,10 +544,14 @@ function migrateInstanceState(raw) {
 //#endregion
 //#region src/env.ts
 const ENV_RDE_HOME = "RDE_HOME";
-const ENV_RDE_SKILL_SOURCE = "RDE_SKILL_SOURCE";
+const ENV_RDE_DEV = "RDE_DEV";
 function readEnv(name) {
 	return process.env[name];
 }
+function readSetEnv(name) {
+	const value = readEnv(name);
+	return value === void 0 || value.length === 0 ? null : value;
+}
 const ENV_PATH = "PATH";
 const ENV_NO_COLOR = "NO_COLOR";
 const ENV_XDG_STATE_HOME = "XDG_STATE_HOME";
@@ -548,6 +559,9 @@ const ENV_JAVA_HOME = "JAVA_HOME";
 const ENV_MB_PROFILE = "MB_PROFILE";
 const ENV_MB_URL = "MB_URL";
 const ENV_MB_API_KEY = "MB_API_KEY";
+function developmentMode() {
+	return readSetEnv(ENV_RDE_DEV) === "1";
+}
 function hostEnvironment() {
 	return { ...process.env };
 }
@@ -566,8 +580,8 @@ const INSTANCE_NAME = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
 const INSTANCE_NAME_RULE = "letters, digits, - and _, starting with a letter or digit";
 const HOME_TAG_LENGTH = 8;
 function rdeHome() {
-	const override = readEnv(ENV_RDE_HOME);
-	if (override !== void 0) return resolve(override);
+	const override = readSetEnv(ENV_RDE_HOME);
+	if (override !== null) return resolve(override);
 	return join(homedir(), RDE_DIR_NAME);
 }
 function homeTag(home) {
@@ -958,6 +972,7 @@ function lookupFailure(error) {
 }
 function createHttp(options) {
 	const fetchImpl = options.fetchImpl ?? fetch;
+	const timeoutMs = options.timeoutMs ?? REQUEST_TIMEOUT_MS;
 	const baseUrl = options.baseUrl.replace(/\/+$/, "");
 	async function send(method, path, body) {
 		const url = `${baseUrl}${path}`;
@@ -968,7 +983,7 @@ function createHttp(options) {
 		const init = {
 			method,
 			headers,
-			signal: AbortSignal.any([options.signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)])
+			signal: AbortSignal.any([options.signal, AbortSignal.timeout(timeoutMs)])
 		};
 		if (body !== void 0) {
 			headers["content-type"] = JSON_CONTENT_TYPE;
@@ -982,7 +997,7 @@ function createHttp(options) {
 			};
 		} catch (error) {
 			if (options.signal.aborted) throw new AbortError();
-			if (isTimeout(error)) throw new MetabaseUnreachableError(url, `no response within ${REQUEST_TIMEOUT_MS}ms`);
+			if (isTimeout(error)) throw new MetabaseUnreachableError(url, `no response within ${timeoutMs}ms`);
 			throw new MetabaseUnreachableError(url, describeCause(error));
 		}
 	}
@@ -2200,18 +2215,74 @@ async function detectAgents(probe) {
 }
 //#endregion
 //#region src/metabase/domain/version-info.ts
-const VersionInfo = z.object({ latest: z.object({ version: z.string() }).loose() }).loose();
+const VersionEntry = z.object({ version: z.string() }).loose();
+const VersionInfo = z.object({ latest: VersionEntry }).loose();
+const VersionHistory = z.object({
+	latest: VersionEntry,
+	older: z.array(VersionEntry)
+}).loose();
 //#endregion
 //#region src/metabase/releases.ts
 const DOWNLOADS_HOST = "https://downloads.metabase.com";
 const VERSION_INFO_HOST = "https://static.metabase.com";
 const VERSION_INFO_PATH = "/version-info-ee.json";
 const JAR_FILE = "metabase.jar";
-const RELEASE_TAG$1 = /^v(?<edition>[01])\.\d+\.\d+(?:\.\d+)?(?:-[\w.]+)?$/;
+const RELEASE_TAG$1 = /^v(?<edition>[01])\.(?<major>\d+)\.\d+(?:\.\d+)?(?:-[\w.]+)?$/;
+const MAJOR_LINE_TAG = /^v(?<edition>[01])\.(?<major>\d+)\.x$/;
+const FINAL_ENTERPRISE_RELEASE = /^v1\.\d+\.\d+(?:\.\d+)?$/;
 const ENTERPRISE_EDITION = "1";
+const OPEN_SOURCE_EDITION = "0";
+const SNAPSHOT_SUFFIX = "-SNAPSHOT";
 function isReleaseTag(value) {
 	return RELEASE_TAG$1.test(value);
 }
+function isMajorLineTag(value) {
+	return MAJOR_LINE_TAG.test(value);
+}
+function majorLineTag(major) {
+	return `v${ENTERPRISE_EDITION}.${major}.x`;
+}
+function tagGroups(tag) {
+	return (RELEASE_TAG$1.exec(tag) ?? MAJOR_LINE_TAG.exec(tag))?.groups;
+}
+function isOpenSourceRelease(version) {
+	return tagGroups(version)?.["edition"] === OPEN_SOURCE_EDITION;
+}
+function isMasterBuild(version) {
+	return !(isReleaseTag(version) || isMajorLineTag(version)) || version.endsWith(SNAPSHOT_SUFFIX);
+}
+function releaseMajor(version) {
+	const major = tagGroups(version)?.["major"];
+	return major === void 0 ? null : Number.parseInt(major, 10);
+}
+function releaseNumbers(version) {
+	return version.slice(1).split(".").map((part) => Number.parseInt(part, 10));
+}
+function compareReleases(left, right) {
+	const a = releaseNumbers(left);
+	const b = releaseNumbers(right);
+	for (let index = 0; index < Math.max(a.length, b.length); index += 1) {
+		const difference = (a[index] ?? 0) - (b[index] ?? 0);
+		if (difference !== 0) return difference;
+	}
+	return 0;
+}
+function supportedRelease(version) {
+	if (!FINAL_ENTERPRISE_RELEASE.test(version)) return null;
+	const major = releaseMajor(version);
+	return major !== null && major >= 65 ? {
+		version,
+		major
+	} : null;
+}
+function newestSupportedRelease(versions) {
+	let newest = null;
+	for (const version of versions) {
+		const release = supportedRelease(version);
+		if (release !== null && (newest === null || compareReleases(version, newest.version) > 0)) newest = release;
+	}
+	return newest;
+}
 function jarDownloadUrl(version) {
 	const edition = RELEASE_TAG$1.exec(version)?.groups?.["edition"];
 	if (edition === void 0) throw new Error(`${version} is not a Metabase release tag`);
@@ -2224,9 +2295,15 @@ function releaseLookup(signal, options = {}) {
 		signal,
 		...options
 	});
-	return { async latestVersion() {
-		return (await http.requestJson("GET", VERSION_INFO_PATH, { schema: VersionInfo })).latest.version;
-	} };
+	return {
+		async latestVersion() {
+			return (await http.requestJson("GET", VERSION_INFO_PATH, { schema: VersionInfo })).latest.version;
+		},
+		async newestSupportedRelease() {
+			const info = await http.requestJson("GET", VERSION_INFO_PATH, { schema: VersionHistory });
+			return newestSupportedRelease([info.latest, ...info.older].map((entry) => entry.version));
+		}
+	};
 }
 function fileDownloader(signal, options = {}) {
 	return (url, destination, onProgress) => downloadFile(url, destination, {
@@ -2294,11 +2371,13 @@ const PortBinding = z.array(z.object({
 	HostIp: z.string(),
 	HostPort: z.string()
 }).loose()).nullable();
+const EnvEntry = z.string().regex(/^[^=]+=/, "expected NAME=value");
 const InspectedContainer = z.object({
 	State: z.object({ Running: z.boolean() }).loose(),
 	Config: z.object({
 		Image: z.string(),
-		Labels: z.record(z.string(), z.string()).nullish()
+		Labels: z.record(z.string(), z.string()).nullish(),
+		Env: z.array(EnvEntry).nullish()
 	}).loose(),
 	HostConfig: z.object({ PortBindings: z.record(z.string(), PortBinding).nullable() }).loose(),
 	NetworkSettings: z.object({ Ports: z.record(z.string(), PortBinding).nullish() }).loose()
@@ -2329,6 +2408,14 @@ function portMappings(bindings) {
 	}
 	return mappings;
 }
+function containerEnv(entries) {
+	const env = {};
+	for (const entry of entries) {
+		const separator = entry.indexOf("=");
+		env[entry.slice(0, separator)] = entry.slice(separator + 1);
+	}
+	return env;
+}
 function createArgs(options) {
 	const args = [
 		"create",
@@ -2420,7 +2507,8 @@ function dockerTool(runner) {
 			image: labels?.[IMAGE_LABEL] ?? container.Config.Image,
 			ports: portMappings(container.HostConfig.PortBindings),
 			forwarded: portMappings(container.NetworkSettings.Ports ?? null),
-			home: labels?.[HOME_LABEL] ?? null
+			home: labels?.[HOME_LABEL] ?? null,
+			env: containerEnv(container.Config.Env ?? [])
 		};
 	}
 	async function portClaims() {
@@ -2617,6 +2705,10 @@ const PLUGINS_DIR = "plugins";
 const METABASE_STOP_GRACE_MS = 3e4;
 const DB_DIR = "metabase.db";
 const DB_FILE = "metabase.db";
+const STAGING_STORE_ENV = {
+	MB_RUN_MODE: "e2e",
+	MB_STORE_USE_STAGING: "true"
+};
 function instanceUrl(port) {
 	return `http://localhost:${port}`;
 }
@@ -2625,13 +2717,15 @@ function serverEnv(options) {
 		MB_DB_FILE: options.dbFile,
 		MB_PLUGINS_DIR: options.pluginsDir,
 		MB_SITE_URL: instanceUrl(options.port),
-		MB_RUN_MODE: "e2e",
-		MB_STORE_USE_STAGING: "true",
+		...developmentMode() ? STAGING_STORE_ENV : {},
 		MB_WAREHOUSE_ALLOWED_NETWORKS: "allow-all",
 		MB_LOAD_SAMPLE_CONTENT: "false",
 		MB_INSTALL_ANALYTICS_DATABASE: "false"
 	};
 }
+function envDrift(actual, expected) {
+	return [.../* @__PURE__ */ new Set([...Object.keys(expected), ...Object.keys(STAGING_STORE_ENV)])].filter((name) => actual[name] !== expected[name]);
+}
 function jettyEnv(port) {
 	return {
 		MB_JETTY_HOST: LOOPBACK_HOST,
@@ -2640,7 +2734,34 @@ function jettyEnv(port) {
 }
 //#endregion
 //#region src/runtime/docker.ts
-const DEFAULT_IMAGE = "metabase/metabase-enterprise-head:latest";
+const RELEASE_REPOSITORY = "metabase/metabase-enterprise";
+const DEVELOPMENT_IMAGE = "metabase/metabase-enterprise-head:latest";
+const HEAD_SUFFIX = "-head";
+const METABASE_REPOSITORIES = /* @__PURE__ */ new Set([
+	RELEASE_REPOSITORY,
+	`${RELEASE_REPOSITORY}${HEAD_SUFFIX}`,
+	"metabase/metabase"
+]);
+function majorLineImage(major) {
+	return `${RELEASE_REPOSITORY}:${majorLineTag(major)}`;
+}
+function imageTag(ref) {
+	const colon = ref.lastIndexOf(":");
+	if (colon === -1 || colon < ref.lastIndexOf("/")) return null;
+	return ref.slice(colon + 1);
+}
+function imageRepository(ref) {
+	const digest = ref.indexOf("@");
+	const named = digest === -1 ? ref : ref.slice(0, digest);
+	const tag = imageTag(named);
+	return tag === null ? named : named.slice(0, named.length - tag.length - 1);
+}
+function isMasterBuildImage(ref) {
+	return imageRepository(ref).endsWith(HEAD_SUFFIX);
+}
+function isMetabaseImage(ref) {
+	return METABASE_REPOSITORIES.has(imageRepository(ref));
+}
 const CONTAINER_NAME_PREFIX$1 = "rde-metabase";
 const CONTAINER_PORT = 3e3;
 const STOP = { graceMs: METABASE_STOP_GRACE_MS };
@@ -2655,6 +2776,16 @@ function onLoopback(mappings, port) {
 function hostUserFor(platform, hostUser) {
 	return platform === "linux" ? hostUser : null;
 }
+function containerServerEnv(port) {
+	return serverEnv({
+		dbFile: `${CONTAINER_DATA_DIR}/${DB_DIR}`,
+		pluginsDir: `${CONTAINER_DATA_DIR}/${PLUGINS_DIR}`,
+		port
+	});
+}
+function containerEnvDrift(container, state) {
+	return envDrift(container.env, containerServerEnv(state.port));
+}
 function dockerRuntime(state, deps) {
 	const { docker } = deps;
 	const url = instanceUrl(state.port);
@@ -2681,11 +2812,7 @@ function dockerRuntime(state, deps) {
 				source: deps.dataDir,
 				target: CONTAINER_DATA_DIR
 			},
-			env: serverEnv({
-				dbFile: `${CONTAINER_DATA_DIR}/${DB_DIR}`,
-				pluginsDir: `${CONTAINER_DATA_DIR}/${PLUGINS_DIR}`,
-				port: state.port
-			}),
+			env: containerServerEnv(state.port),
 			addHostGateway: deps.platform === "linux",
 			hostUser: hostUserFor(deps.platform, deps.hostUser)
 		};
@@ -2791,6 +2918,7 @@ function parseJarSpec(value) {
 		path: resolve(trimmed)
 	};
 	const tagged = trimmed.startsWith(TAG_PREFIX) ? trimmed : `${TAG_PREFIX}${trimmed}`;
+	if (isOpenSourceRelease(tagged)) throw new ConfigError(`${trimmed} is a release of the open-source edition, which rde does not support; enterprise release tags start with v1`);
 	return isReleaseTag(tagged) ? {
 		kind: "release",
 		version: tagged
@@ -3277,7 +3405,7 @@ function adminUserStep(options, deps = hostDeps$14) {
 //#region src/tools/mb.ts
 const MB = "mb";
 const MB_PACKAGE = "@metabase/cli";
-const MB_DIST_TAG = "alpha-release-65-integration-branch";
+const MB_DIST_TAG = "latest";
 const MB_INSTALL_SPEC = `${MB_PACKAGE}@${MB_DIST_TAG}`;
 const GLOBAL_INSTALL = {
 	npm: {
@@ -3408,15 +3536,11 @@ function mbRemoveCommand(binary) {
 	const name = owner === "homebrew" ? firstSegmentAfter(binary.resolved, CELLAR) : packageName(binary.resolved);
 	return name === null ? null : REMOVE_COMMANDS[owner](name);
 }
-function setValue(name) {
-	const value = readEnv(name);
-	return value === void 0 || value.length === 0 ? null : value;
-}
 function mbEnvironment() {
 	return {
-		profile: setValue(ENV_MB_PROFILE),
-		url: setValue(ENV_MB_URL),
-		apiKeySet: setValue(ENV_MB_API_KEY) !== null
+		profile: readSetEnv(ENV_MB_PROFILE),
+		url: readSetEnv(ENV_MB_URL),
+		apiKeySet: readSetEnv(ENV_MB_API_KEY) !== null
 	};
 }
 const ProbedUser = z.object({
@@ -5728,14 +5852,201 @@ function gitTool(runner) {
 	};
 }
 //#endregion
+//#region src/steps/license.ts
+const STEP_ID$7 = "license";
+const LICENSE_KEYS = { token: `${STEP_ID$7}.token` };
+const TOKEN_PATTERN = /^[0-9a-f]{64}$/i;
+const NOT_FOUND_STATUS$1 = 404;
+const TOKEN_REFUSED_STATUS = 400;
+const STORE_UNREACHABLE_STATUS = 503;
+const TOKEN_CHECK_HOST = "token-check.metabase.com";
+const ACTIVATION_FAILED = "License activation failed";
+const LICENSED_FEATURES = {
+	[REMOTE_SYNC_FEATURE]: "remote sync",
+	"data-apps": "data apps",
+	"transforms-testing": "transform tests"
+};
+const LICENSED_FEATURE_NAMES = Object.values(LICENSED_FEATURES);
+function licensedFeatureCoverage(features) {
+	const entries = Object.entries(LICENSED_FEATURES);
+	return {
+		included: entries.filter(([key]) => features.includes(key)).map(([, name]) => name),
+		missing: entries.filter(([key]) => !features.includes(key)).map(([, name]) => name)
+	};
+}
+function listOf(names, type) {
+	return new Intl.ListFormat("en", { type }).format(names);
+}
+function hostDeps$12(ctx) {
+	return {
+		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
+		runner: processRunner(ctx.signal),
+		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal)),
+		terminal: stdinIsTty()
+	};
+}
+function isNoTokenYet(error) {
+	if (error instanceof MetabaseApiError) return error.status === NOT_FOUND_STATUS$1;
+	return isMetabaseNotServing(error);
+}
+function validateToken(value) {
+	if (value.length === 0 || TOKEN_PATTERN.test(value)) return;
+	return "A license token is 64 hexadecimal characters";
+}
+function requireApiKey$1(ctx) {
+	if (ctx.secrets.apiKey === null) throw new ConfigError("no API key yet; the api-key step comes first");
+	return ctx.secrets.apiKey;
+}
+function licenseOf(status) {
+	if (!status.valid) return { activated: false };
+	return {
+		activated: true,
+		features: status.features,
+		validThru: status["valid-thru"] ?? null
+	};
+}
+async function liveLicense(client) {
+	try {
+		return licenseOf(await client.tokenStatus.get());
+	} catch (error) {
+		if (error instanceof MetabaseApiError && error.status === NOT_FOUND_STATUS$1) return { activated: false };
+		throw error;
+	}
+}
+async function recordLiveLicense(ctx, client) {
+	const live = await liveLicense(client);
+	if (!isDeepStrictEqual(live, ctx.state.license)) await ctx.saveState({
+		...ctx.state,
+		license: live
+	});
+	return live;
+}
+function activeLabel(status) {
+	const plan = status["plan-alias"];
+	return plan === void 0 ? "License active" : `License active (plan ${plan})`;
+}
+function refusalOf(error) {
+	if (!(error instanceof MetabaseApiError)) return null;
+	if (error.status === TOKEN_REFUSED_STATUS) return new ConfigError(`The license token was refused: ${error.reason}`);
+	if (error.status === STORE_UNREACHABLE_STATUS) return new ConfigError(`The instance could not reach ${TOKEN_CHECK_HOST} to check the license token; it needs outbound network access`);
+	return null;
+}
+async function activate(client, token) {
+	try {
+		await client.setting.setPremiumEmbeddingToken(token);
+	} catch (error) {
+		const refusal = refusalOf(error);
+		if (refusal === null) throw error;
+		return {
+			kind: "refused",
+			error: refusal
+		};
+	}
+	const status = await client.tokenStatus.get();
+	if (!status.valid) return {
+		kind: "refused",
+		error: new ConfigError(`Metabase reports the token as ${status.status}`)
+	};
+	return {
+		kind: "activated",
+		status
+	};
+}
+async function activateAskedToken(ctx, client, terminal) {
+	const token = await ctx.prompts.password({
+		key: LICENSE_KEYS.token,
+		message: "Paste your Metabase license token (Enter to skip)",
+		validate: validateToken
+	});
+	if (token.length === 0) return null;
+	const spinner = ctx.ui.spinner("Activating the license…");
+	let activation;
+	try {
+		activation = await activate(client, token);
+	} catch (error) {
+		spinner.fail(ACTIVATION_FAILED);
+		throw error;
+	}
+	if (activation.kind === "activated") {
+		spinner.stop(activeLabel(activation.status));
+		ctx.session.licenseToken.set(token);
+		return activation.status;
+	}
+	spinner.fail(ACTIVATION_FAILED);
+	if (!terminal) throw activation.error;
+	ctx.ui.warn(activation.error.message);
+	return activateAskedToken(ctx, client, terminal);
+}
+function reportFeatures(ctx, features) {
+	const { missing } = licensedFeatureCoverage(features);
+	const remoteSync = features.includes(REMOTE_SYNC_FEATURE);
+	if (remoteSync) ctx.ui.info("Remote sync is included; the git step will set it up");
+	if (missing.length > 0) {
+		const gitNote = remoteSync ? "" : "; the git step will be skipped";
+		ctx.ui.warn(`This license does not include ${listOf(missing, "disjunction")}${gitNote}`);
+	}
+}
+function licenseStep(deps = hostDeps$12) {
+	return {
+		id: STEP_ID$7,
+		title: "Activate your license",
+		redoHint: "`rde init --from license` with it activates the license and runs the steps after it again.",
+		async detect(ctx) {
+			if (ctx.state.steps[STEP_ID$7]?.status === "skipped") return "not-applicable";
+			const configured = configuredRuntime(ctx.state);
+			if (configured === null || ctx.secrets.apiKey === null) return "todo";
+			const resolved = deps(ctx);
+			if (!await resolved.instanceRunning()) return "todo";
+			const client = resolved.client(configured.url, {
+				kind: "api-key",
+				key: ctx.secrets.apiKey
+			});
+			try {
+				return (await client.tokenStatus.get()).valid ? "done" : "todo";
+			} catch (error) {
+				if (isNoTokenYet(error) || isRejectedCredential(error)) return "todo";
+				throw error;
+			}
+		},
+		async run(ctx) {
+			const configured = requireConfiguredRuntime(ctx.state);
+			const apiKey = requireApiKey$1(ctx);
+			const resolved = deps(ctx);
+			const client = resolved.client(configured.url, {
+				kind: "api-key",
+				key: apiKey
+			});
+			const status = await activateAskedToken(ctx, client, resolved.terminal);
+			if (status === null) {
+				await recordLiveLicense(ctx, client);
+				const lost = listOf(LICENSED_FEATURE_NAMES, "conjunction");
+				ctx.ui.info(`Skipping the license; ${lost} need one. Run \`rde init --from license\` to add it later`);
+				return { outcome: "skipped" };
+			}
+			await ctx.saveState({
+				...ctx.state,
+				license: licenseOf(status)
+			});
+			const mb = mbTool(resolved.runner);
+			if (isApiKeyLoginAt(await mb.authStatus(ctx.state.mbProfile), configured.url)) await mb.authLogin({
+				url: configured.url,
+				profile: ctx.state.mbProfile,
+				apiKey
+			});
+			reportFeatures(ctx, status.features);
+			return { outcome: "completed" };
+		}
+	};
+}
+//#endregion
 //#region src/steps/git-sync.ts
-const STEP_ID$7 = "git-sync";
+const STEP_ID$6 = "git-sync";
 const GIT_SYNC_KEYS = {
-	location: `${STEP_ID$7}.location`,
-	path: `${STEP_ID$7}.path`,
-	remote: `${STEP_ID$7}.remote`,
-	url: `${STEP_ID$7}.url`,
-	token: `${STEP_ID$7}.token`
+	location: `${STEP_ID$6}.location`,
+	path: `${STEP_ID$6}.path`,
+	remote: `${STEP_ID$6}.remote`,
+	url: `${STEP_ID$6}.url`,
+	token: `${STEP_ID$6}.token`
 };
 const BARE_REPO_NAME = "content.git";
 const DEFAULT_BRANCH = "main";
@@ -5769,7 +6080,7 @@ const SYNC_MODE_SETTINGS = {
 	"remote-sync-type": "read-write",
 	"remote-sync-transforms": true
 };
-function hostDeps$12(ctx) {
+function hostDeps$11(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
@@ -6206,6 +6517,9 @@ function configureRemote(run, runtime, model) {
 function isMbUnavailable(error) {
 	return error instanceof ProcessNotFoundError || error instanceof ExternalToolError;
 }
+function remoteSyncGap(license) {
+	return license.activated ? "Remote sync needs a license with the remote-sync feature, and this instance's license lacks it" : "Remote sync needs a license, and this instance has no valid one";
+}
 async function runGitSync(ctx, deps) {
 	const configured = requireConfiguredRuntime(ctx.state);
 	const instance = mbInstanceOf(ctx.state, ctx.secrets);
@@ -6220,6 +6534,8 @@ async function runGitSync(ctx, deps) {
 		}),
 		instance
 	};
+	const license = await recordLiveLicense(ctx, run.client);
+	if (!hasRemoteSync(license)) throw new ConfigError(`${remoteSyncGap(license)}; \`rde init --from license\` activates one`);
 	const flow = await runFlow({
 		remote: remoteScreen(run),
 		hosted: hostedScreen(run),
@@ -6239,15 +6555,15 @@ async function runGitSync(ctx, deps) {
 	ctx.ui.note(usageLines(ctx.state, remote.gitRemote).join("\n"), "Working with the repository");
 	return "completed";
 }
-function gitSyncStep(deps = hostDeps$12) {
+function gitSyncStep(deps = hostDeps$11) {
 	return {
-		id: STEP_ID$7,
+		id: STEP_ID$6,
 		title: "Connect a git repository",
 		redoHint: "`rde init --only git-sync` with it points Metabase's remote sync at that repository instead.",
 		async detect(ctx) {
 			if (!hasRemoteSync(ctx.state.license)) return "not-applicable";
-			if (ctx.state.steps[STEP_ID$7]?.status === "skipped") return "not-applicable";
-			if (ctx.state.gitRemote === null || ctx.state.steps[STEP_ID$7]?.status !== "done") return "todo";
+			if (ctx.state.steps[STEP_ID$6]?.status === "skipped") return "not-applicable";
+			if (ctx.state.gitRemote === null || ctx.state.steps[STEP_ID$6]?.status !== "done") return "todo";
 			const instance = mbInstanceOf(ctx.state, ctx.secrets);
 			if (instance === null) return "todo";
 			try {
@@ -6291,11 +6607,9 @@ function githubContents(signal, options = {}) {
 //#region src/tools/skills-cli.ts
 const NPX = "npx";
 const SKILLS_PACKAGE = "skills@latest";
-const DEFAULT_RDE_SKILL_SOURCE = "https://github.com/metabase/agent-skills/tree/main";
-const RDE_SOURCE_SKILL_NAMES = ["rde", "rde-data-apps"];
+const RDE_DATA_APPS_SKILL_NAME = "rde-data-apps";
+const RDE_SOURCE_SKILL_NAMES = ["rde", RDE_DATA_APPS_SKILL_NAME];
 const DATA_APP_REPOSITORY = "metabase/metabase";
-const DATA_APP_BRANCH = "master";
-const DATA_APP_SKILLS_SOURCE = `${DATA_APP_REPOSITORY}/skills#${DATA_APP_BRANCH}`;
 const DATA_APP_SKILL_NAMES = [
 	"metabase-data-app-setup",
 	"metabase-data-app-routing",
@@ -6304,8 +6618,7 @@ const DATA_APP_SKILL_NAMES = [
 	"metabase-data-app-migrate"
 ];
 function rdeSkillSource() {
-	const override = readEnv(ENV_RDE_SKILL_SOURCE);
-	return override === void 0 || override.length === 0 ? DEFAULT_RDE_SKILL_SOURCE : override;
+	return readSetEnv("RDE_SKILL_SOURCE") ?? "https://github.com/metabase/agent-skills/tree/main";
 }
 const InstalledSkill = z.object({
 	name: z.string(),
@@ -6331,8 +6644,7 @@ function projectSkillLockPath(project) {
 	return join(project, PROJECT_LOCK_FILE);
 }
 function xdgStateHome() {
-	const value = readEnv(ENV_XDG_STATE_HOME);
-	return value === void 0 || value.length === 0 ? null : value;
+	return readSetEnv(ENV_XDG_STATE_HOME);
 }
 function lockedSkill(path, raw, skill) {
 	if (raw === null) return null;
@@ -6344,11 +6656,16 @@ const hostSkillFiles = {
 	readJson: readJsonFile,
 	readText: readTextFile
 };
-const DATA_APP_SKILLS_ORIGIN = {
-	kind: "github",
-	repository: DATA_APP_REPOSITORY,
-	ref: DATA_APP_BRANCH
-};
+function dataAppSkillsSource(ref) {
+	return `${DATA_APP_REPOSITORY}/skills#${ref}`;
+}
+function dataAppSkillsOrigin(ref) {
+	return {
+		kind: "github",
+		repository: DATA_APP_REPOSITORY,
+		ref
+	};
+}
 const GITHUB_URL = /^https:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?(?:\/tree\/([^/]+)(?:\/.*)?)?\/?$/;
 function skillOrigin(source, cwd) {
 	const github = GITHUB_URL.exec(source);
@@ -6429,12 +6746,13 @@ function skillsCli(runner) {
 }
 //#endregion
 //#region src/steps/agents-skills.ts
-const STEP_ID$6 = "agents-skills";
-const AGENTS_SKILLS_KEYS = { agents: `${STEP_ID$6}.agents` };
+const STEP_ID$5 = "agents-skills";
+const AGENTS_SKILLS_KEYS = { agents: `${STEP_ID$5}.agents` };
 const MECHANICS_NOTE = "The rde skill's mechanics come from `mb skills get <name>` at runtime, so nothing else needs installing.";
 const REQUIRED_SKILL_NAMES = [...DATA_APP_SKILL_NAMES, ...RDE_SOURCE_SKILL_NAMES];
 const DETECT_AGENTS = { kind: "detected" };
-function hostDeps$11(ctx) {
+const ASK_AGENTS = { kind: "ask" };
+function hostDeps$10(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
 		probe: hostAgentProbe(),
@@ -6458,9 +6776,6 @@ function skillCoversAgent(entry, agent) {
 function coversAny(entry, agents) {
 	return agents.some((agent) => skillCoversAgent(entry, agent));
 }
-async function rdeSkillEntries(runner) {
-	return (await skillsCli(runner).list()).filter((entry) => entry.name === "rde");
-}
 function requiredEntries(installed) {
 	return installed.filter((entry) => REQUIRED_SKILL_NAMES.includes(entry.name));
 }
@@ -6477,12 +6792,26 @@ function coveredAgentNames(entry, agents) {
 function installedLines(entries, agents) {
 	return entries.map((entry) => `${entry.name} (${coveredAgentNames(entry, agents).join(", ")}): ${entry.path}`).join("\n");
 }
-function skillSets(deps) {
+const DEVELOPMENT_BRANCH = "master";
+function releaseBranch(major) {
+	return `release-x.${major}.x`;
+}
+function dataAppSkillsRef(metabaseVersion, development) {
+	if (metabaseVersion === null) return releaseBranch(65);
+	if (development && isMasterBuild(metabaseVersion)) return DEVELOPMENT_BRANCH;
+	const major = releaseMajor(metabaseVersion) ?? 65;
+	return releaseBranch(Math.max(major, 65));
+}
+function wantedDataAppRef(metabaseVersion) {
+	return dataAppSkillsRef(metabaseVersion, developmentMode());
+}
+function skillSets(deps, metabaseVersion) {
+	const dataAppRef = wantedDataAppRef(metabaseVersion);
 	return [{
 		label: "data-app",
-		source: DATA_APP_SKILLS_SOURCE,
-		sourceNote: "",
-		origin: DATA_APP_SKILLS_ORIGIN,
+		source: dataAppSkillsSource(dataAppRef),
+		sourceNote: ` from ${dataAppRef}`,
+		origin: dataAppSkillsOrigin(dataAppRef),
 		skills: DATA_APP_SKILL_NAMES
 	}, {
 		label: "rde",
@@ -6613,11 +6942,11 @@ function skipLine(all, source) {
 	switch (source) {
 		case "override":
 		case "chosen":
-		case "installed": return `Skipping the skills; run \`rde init --only ${STEP_ID$6}\` to install it later`;
-		case "detected": return `No coding agent found (${displayNames(all)}); run \`rde init --only ${STEP_ID$6} --agents <name>\` once one is installed`;
+		case "installed": return `Skipping the skills; run \`rde init --only ${STEP_ID$5}\` to install it later`;
+		case "detected": return `No coding agent found (${displayNames(all)}); run \`rde init --only ${STEP_ID$5} --agents <name>\` once one is installed`;
 	}
 }
-function agentsSkillsStep(options, updates, deps = hostDeps$11) {
+function agentsSkillsStep(options, updates, deps = hostDeps$10) {
 	let hashes = null;
 	async function setCheck(resolved) {
 		hashes ??= hashLookup(resolved.github);
@@ -6628,16 +6957,16 @@ function agentsSkillsStep(options, updates, deps = hostDeps$11) {
 		};
 	}
 	return {
-		id: STEP_ID$6,
+		id: STEP_ID$5,
 		title: "Install the rde and data-app skills for your coding agents",
 		redoHint: "`rde init --only agents-skills` with it installs the skills for those agents.",
 		async detect(ctx) {
 			const resolved = deps(ctx);
 			const detected = detectedOnly(await detectAgents(resolved.probe));
-			if (detected.length === 0) return ctx.state.steps[STEP_ID$6]?.status === "skipped" ? "not-applicable" : "todo";
+			if (detected.length === 0) return ctx.state.steps[STEP_ID$5]?.status === "skipped" ? "not-applicable" : "todo";
 			if (missingSkills(await skillsCli(resolved.runner).list(), detected).length > 0) return "todo";
 			const check = await setCheck(resolved);
-			for (const set of skillSets(resolved)) if (await setBehind(set, check)) return "outdated";
+			for (const set of skillSets(resolved, ctx.state.version)) if (await setBehind(set, check)) return "outdated";
 			return "done";
 		},
 		async run(ctx) {
@@ -6654,7 +6983,7 @@ function agentsSkillsStep(options, updates, deps = hostDeps$11) {
 			const before = await installedNow();
 			const check = await setCheck(resolved);
 			const pending = [];
-			for (const set of skillSets(resolved)) if (!coversAll(before, set.skills, selection.agents) || await setBehind(set, check)) pending.push(set);
+			for (const set of skillSets(resolved, ctx.state.version)) if (!coversAll(before, set.skills, selection.agents) || await setBehind(set, check)) pending.push(set);
 			const names = displayNames(selection.agents);
 			if (pending.length === 0) {
 				ctx.ui.success(`The rde and data-app skills are current for ${names}`);
@@ -6693,7 +7022,7 @@ function hostDatabasesDeps(signal) {
 		now: () => /* @__PURE__ */ new Date()
 	};
 }
-function requireApiKey$1(state, apiKey) {
+function requireApiKey(state, apiKey) {
 	if (apiKey === null) throw new ConfigError(`instance ${state.name} has no API key yet; run \`rde init\``);
 	return apiKey;
 }
@@ -6715,7 +7044,7 @@ function authenticatedClient(state, apiKey, deps) {
 	const configured = requireConfiguredRuntime(state);
 	return deps.client(configured.url, {
 		kind: "api-key",
-		key: requireApiKey$1(state, apiKey)
+		key: requireApiKey(state, apiKey)
 	});
 }
 async function listDatabases(state, apiKey, deps) {
@@ -6791,13 +7120,13 @@ async function connectRequired(ctx, deps, opening) {
 		result: { addedDatabases: connected.added }
 	};
 }
-function hostDeps$10(ctx) {
+function hostDeps$9(ctx) {
 	return {
 		...hostDatabasesDeps(ctx.signal),
 		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal))
 	};
 }
-function databasesStep(options, deps = hostDeps$10) {
+function databasesStep(options, deps = hostDeps$9) {
 	return {
 		id: "databases",
 		title: "Connect your databases",
@@ -6860,7 +7189,7 @@ function npmRegistry(signal, options = {}) {
 }
 //#endregion
 //#region src/steps/install-mb.ts
-const STEP_ID$5 = "install-mb";
+const STEP_ID$4 = "install-mb";
 const MIN_MB_VERSION = "0.3.0";
 const MB_RANGE = `>=${MIN_MB_VERSION}`;
 function installedWith(scriptPath) {
@@ -6869,7 +7198,7 @@ function installedWith(scriptPath) {
 function rdeInstalledWith() {
 	return installedWith(process.argv[1]);
 }
-function hostDeps$9(ctx) {
+function hostDeps$8(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
 		installedWith: rdeInstalledWith(),
@@ -6923,6 +7252,33 @@ function updateTo(release, installed) {
 function displayCommand(install) {
 	return [install.command, ...install.args].join(" ");
 }
+const NPM_EACCES_EXIT = 243;
+const NPM_PERMISSION_TEXT = [
+	"EACCES",
+	"EPERM",
+	"might be a permissions issue"
+];
+function deniedGlobalWrite(install, error) {
+	if (install.command !== "npm" || !(error instanceof ExternalToolError)) return false;
+	return NPM_PERMISSION_TEXT.some((text) => error.stderrTail.includes(text)) || error.exitCode === NPM_EACCES_EXIT;
+}
+function globalWriteDenied(install) {
+	return new ConfigError([
+		`\`${displayCommand(install)}\` failed because npm cannot write its global directory.`,
+		"Give npm a prefix you own with `npm config set prefix ~/.npm-global`,",
+		"add ~/.npm-global/bin to PATH and open a new terminal,",
+		"or install Node with a version manager such as nvm, fnm or mise;",
+		"then run rde init again."
+	].join(" "));
+}
+async function installMb(install, ctx, deps) {
+	try {
+		await runShown(deps.runner, ctx.ui.childOutput, install.command, install.args);
+	} catch (error) {
+		if (deniedGlobalWrite(install, error)) throw globalWriteDenied(install);
+		throw error;
+	}
+}
 async function versionAt(runner, path) {
 	try {
 		const raw = await mbTool(runner).version(path);
@@ -7036,7 +7392,7 @@ async function updateFor(release, installed, deps) {
 		version
 	};
 }
-function installMbStep(updates, deps = hostDeps$9) {
+function installMbStep(updates, deps = hostDeps$8) {
 	let published = null;
 	function release(resolved) {
 		if (updates === "installed") return Promise.resolve(UNCHECKED);
@@ -7044,7 +7400,7 @@ function installMbStep(updates, deps = hostDeps$9) {
 		return published;
 	}
 	return {
-		id: STEP_ID$5,
+		id: STEP_ID$4,
 		title: "Install the Metabase CLI",
 		async detect(ctx) {
 			const resolved = deps(ctx);
@@ -7071,7 +7427,7 @@ function installMbStep(updates, deps = hostDeps$9) {
 			} else if (before.installed) ctx.ui.warn(`mb ${before.version} is installed; ${MIN_MB_VERSION} or newer is required`);
 			const install = mbInstallCommand(resolved.installedWith);
 			ctx.ui.info(`Running ${displayCommand(install)}`);
-			await runShown(resolved.runner, ctx.ui.childOutput, install.command, install.args);
+			await installMb(install, ctx, resolved);
 			const after = await inspectMb(resolved.runner);
 			if (!after.installed || !after.satisfies) throw await stillWrong(install, after, resolved);
 			const stillNewer = updateTo(target, after.version);
@@ -7085,171 +7441,6 @@ function installMbStep(updates, deps = hostDeps$9) {
 	};
 }
 //#endregion
-//#region src/steps/license.ts
-const STEP_ID$4 = "license";
-const LICENSE_KEYS = { token: `${STEP_ID$4}.token` };
-const TOKEN_PATTERN = /^[0-9a-f]{64}$/i;
-const NOT_FOUND_STATUS$1 = 404;
-const TOKEN_REFUSED_STATUS = 400;
-const STORE_UNREACHABLE_STATUS = 503;
-const TOKEN_CHECK_HOST = "token-check.metabase.com";
-const ACTIVATION_FAILED = "License activation failed";
-const LICENSED_FEATURES = {
-	[REMOTE_SYNC_FEATURE]: "remote sync",
-	"data-apps": "data apps",
-	"transforms-testing": "transform tests"
-};
-const LICENSED_FEATURE_NAMES = Object.values(LICENSED_FEATURES);
-function licensedFeatureCoverage(features) {
-	const entries = Object.entries(LICENSED_FEATURES);
-	return {
-		included: entries.filter(([key]) => features.includes(key)).map(([, name]) => name),
-		missing: entries.filter(([key]) => !features.includes(key)).map(([, name]) => name)
-	};
-}
-function listOf(names, type) {
-	return new Intl.ListFormat("en", { type }).format(names);
-}
-function hostDeps$8(ctx) {
-	return {
-		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
-		runner: processRunner(ctx.signal),
-		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal)),
-		terminal: stdinIsTty()
-	};
-}
-function isNoTokenYet(error) {
-	if (error instanceof MetabaseApiError) return error.status === NOT_FOUND_STATUS$1;
-	return isMetabaseNotServing(error);
-}
-function validateToken(value) {
-	if (value.length === 0 || TOKEN_PATTERN.test(value)) return;
-	return "A license token is 64 hexadecimal characters";
-}
-function requireApiKey(ctx) {
-	if (ctx.secrets.apiKey === null) throw new ConfigError("no API key yet; the api-key step comes first");
-	return ctx.secrets.apiKey;
-}
-function activeLabel(status) {
-	const plan = status["plan-alias"];
-	return plan === void 0 ? "License active" : `License active (plan ${plan})`;
-}
-function refusalOf(error) {
-	if (!(error instanceof MetabaseApiError)) return null;
-	if (error.status === TOKEN_REFUSED_STATUS) return new ConfigError(`The license token was refused: ${error.reason}`);
-	if (error.status === STORE_UNREACHABLE_STATUS) return new ConfigError(`The instance could not reach ${TOKEN_CHECK_HOST} to check the license token; it needs outbound network access`);
-	return null;
-}
-async function activate(client, token) {
-	try {
-		await client.setting.setPremiumEmbeddingToken(token);
-	} catch (error) {
-		const refusal = refusalOf(error);
-		if (refusal === null) throw error;
-		return {
-			kind: "refused",
-			error: refusal
-		};
-	}
-	const status = await client.tokenStatus.get();
-	if (!status.valid) return {
-		kind: "refused",
-		error: new ConfigError(`Metabase reports the token as ${status.status}`)
-	};
-	return {
-		kind: "activated",
-		status
-	};
-}
-async function activateAskedToken(ctx, client, terminal) {
-	const token = await ctx.prompts.password({
-		key: LICENSE_KEYS.token,
-		message: "Paste your Metabase license token (Enter to skip)",
-		validate: validateToken
-	});
-	if (token.length === 0) return null;
-	const spinner = ctx.ui.spinner("Activating the license…");
-	let activation;
-	try {
-		activation = await activate(client, token);
-	} catch (error) {
-		spinner.fail(ACTIVATION_FAILED);
-		throw error;
-	}
-	if (activation.kind === "activated") {
-		spinner.stop(activeLabel(activation.status));
-		ctx.session.licenseToken.set(token);
-		return activation.status;
-	}
-	spinner.fail(ACTIVATION_FAILED);
-	if (!terminal) throw activation.error;
-	ctx.ui.warn(activation.error.message);
-	return activateAskedToken(ctx, client, terminal);
-}
-function reportFeatures(ctx, features) {
-	const { missing } = licensedFeatureCoverage(features);
-	const remoteSync = features.includes(REMOTE_SYNC_FEATURE);
-	if (remoteSync) ctx.ui.info("Remote sync is included; the git step will set it up");
-	if (missing.length > 0) {
-		const gitNote = remoteSync ? "" : "; the git step will be skipped";
-		ctx.ui.warn(`This license does not include ${listOf(missing, "disjunction")}${gitNote}`);
-	}
-}
-function licenseStep(deps = hostDeps$8) {
-	return {
-		id: STEP_ID$4,
-		title: "Activate your license",
-		redoHint: "`rde init --from license` with it activates the license and runs the steps after it again.",
-		async detect(ctx) {
-			if (ctx.state.steps[STEP_ID$4]?.status === "skipped") return "not-applicable";
-			const configured = configuredRuntime(ctx.state);
-			if (configured === null || ctx.secrets.apiKey === null) return "todo";
-			const resolved = deps(ctx);
-			if (!await resolved.instanceRunning()) return "todo";
-			const client = resolved.client(configured.url, {
-				kind: "api-key",
-				key: ctx.secrets.apiKey
-			});
-			try {
-				return (await client.tokenStatus.get()).valid ? "done" : "todo";
-			} catch (error) {
-				if (isNoTokenYet(error) || isRejectedCredential(error)) return "todo";
-				throw error;
-			}
-		},
-		async run(ctx) {
-			const configured = requireConfiguredRuntime(ctx.state);
-			const apiKey = requireApiKey(ctx);
-			const resolved = deps(ctx);
-			const status = await activateAskedToken(ctx, resolved.client(configured.url, {
-				kind: "api-key",
-				key: apiKey
-			}), resolved.terminal);
-			if (status === null) {
-				const lost = listOf(LICENSED_FEATURE_NAMES, "conjunction");
-				ctx.ui.info(`Skipping the license; ${lost} need one. Run \`rde init --from license\` to add it later`);
-				return { outcome: "skipped" };
-			}
-			await ctx.saveState({
-				...ctx.state,
-				license: {
-					activated: true,
-					features: status.features,
-					validThru: status["valid-thru"] ?? null
-				}
-			});
-			const mb = mbTool(resolved.runner);
-			if (isApiKeyLoginAt(await mb.authStatus(ctx.state.mbProfile), configured.url)) await mb.authLogin({
-				url: configured.url,
-				profile: ctx.state.mbProfile,
-				apiKey
-			});
-			reportFeatures(ctx, status.features);
-			return { outcome: "completed" };
-		}
-	};
-}
-//#endregion
 //#region src/steps/preflight.ts
 const MIN_NODE_VERSION = "20.19.0";
 const NODE_RANGE = `>=${MIN_NODE_VERSION}`;
@@ -7480,22 +7671,56 @@ async function chooseKind(ctx, options, runtime) {
 	ctx.ui.info(`Docker is not available (${available.docker.reason}); using the jar runtime with ${javaLabel(available.java)}`);
 	return "jar";
 }
-function chooseImage(ctx, options) {
+const NAME_ONE = "`--image <image>` or `--jar <release tag>` names a Metabase to run";
+const INIT_WAYS_OUT = {
+	named: NAME_ONE,
+	unreleased: `${NAME_ONE}, and \`RDE_DEV=1\` runs the development build`
+};
+function isFeedFailure(error) {
+	return error instanceof MetabaseApiError || error instanceof MetabaseUnreachableError;
+}
+async function requireNewestRelease(releases, waysOut) {
+	let newest;
+	try {
+		newest = await releases.newestSupportedRelease();
+	} catch (error) {
+		if (!isFeedFailure(error)) throw error;
+		throw new ConfigError(`the Metabase release feed could not be read (${error.reason}); ${waysOut.named}`);
+	}
+	if (newest === null) throw new ConfigError(`no release of Metabase Enterprise 65 or newer is out yet; ${waysOut.unreleased}`);
+	return newest;
+}
+async function releaseImage(ctx, releases, waysOut) {
+	const newest = await requireNewestRelease(releases, waysOut);
+	const image = majorLineImage(newest.major);
+	ctx.ui.info(`The newest Metabase release is ${newest.version}; ${image} carries the newest build of ${newest.major}`);
+	return image;
+}
+async function latestJarRelease(ctx, releases, waysOut) {
+	if (developmentMode()) {
+		const version = await releases.latestVersion();
+		ctx.ui.info(`The latest Metabase release is ${version}`);
+		return version;
+	}
+	const newest = await requireNewestRelease(releases, waysOut);
+	ctx.ui.info(`The newest Metabase release is ${newest.version}`);
+	return newest.version;
+}
+async function chooseImage(ctx, options, releases) {
 	if (options.image !== null) {
 		ctx.ui.info(`Using image ${options.image} from --image`);
 		return options.image;
 	}
-	return DEFAULT_IMAGE;
+	if (developmentMode()) return DEVELOPMENT_IMAGE;
+	return releaseImage(ctx, releases, INIT_WAYS_OUT);
 }
 async function resolveJar(ctx, spec, releases) {
 	const parsed = parseJarSpec(spec);
-	if (parsed === null) throw new ConfigError(`${spec} is not latest, a release tag such as v1.63.18, or the path of a .jar file`);
+	if (parsed === null) throw new ConfigError(`${spec} is not latest, an enterprise release tag such as v1.65.0, or the path of a .jar file`);
 	if (parsed.kind !== "latest") return parsed;
-	const version = await releases.latestVersion();
-	ctx.ui.info(`The latest Metabase release is ${version}`);
 	return {
 		kind: "release",
-		version
+		version: await latestJarRelease(ctx, releases, INIT_WAYS_OUT)
 	};
 }
 async function chooseJar(ctx, options, releases) {
@@ -7520,7 +7745,7 @@ async function chooseRuntime(ctx, options, deps) {
 	const kind = await chooseKind(ctx, options, deps.runtime);
 	switch (kind) {
 		case "docker": {
-			const image = chooseImage(ctx, options);
+			const image = await chooseImage(ctx, options, deps.releases);
 			const port = await choosePort(ctx, options, deps.runtime);
 			return {
 				kind,
@@ -7601,6 +7826,16 @@ function isNotHealthy(error) {
 async function runningVersion(client) {
 	return (await client.session.properties()).version.tag;
 }
+const PICK_ANOTHER = "`rde upgrade --to <image or release tag>` moves this instance to one, or `rde uninstall`, then `rde init --image <image>` or `rde init --jar <release tag>`, sets up a new instance on one";
+function unsupportedVersionReason(version, development) {
+	if (development) return null;
+	const needs = `rde needs Metabase Enterprise 65 or newer: ${PICK_ANOTHER}`;
+	if (isOpenSourceRelease(version)) return `Metabase ${version} is the open-source edition; ${needs}`;
+	if (isMasterBuild(version)) return `Metabase ${version} is a development build of master, which only development mode (RDE_DEV=1) runs; ${needs}`;
+	const major = releaseMajor(version);
+	if (major !== null && major < 65) return `Metabase ${version} is older than 65; ${needs}`;
+	return null;
+}
 function progressLabel(progress) {
 	return `Starting Metabase… ${Math.round(progress * PERCENT)}%`;
 }
@@ -7617,7 +7852,7 @@ async function startRuntime(ctx, runtime, deps) {
 		throw error;
 	}
 }
-function startMetabaseStep(deps = hostDeps$5) {
+function startMetabaseStep(deps = hostDeps$5, accepted = "supported") {
 	return {
 		id: "start-metabase",
 		title: "Start Metabase",
@@ -7669,6 +7904,11 @@ function startMetabaseStep(deps = hostDeps$5) {
 				...ctx.state,
 				version
 			});
+			const refusal = accepted === "supported" ? unsupportedVersionReason(version, developmentMode()) : null;
+			if (refusal !== null) {
+				spinner.fail(`Metabase ${version} is running at ${configured.url}, but rde does not run it`);
+				throw new UnsupportedMetabaseError(refusal);
+			}
 			spinner.stop(`Metabase ${version} is running at ${configured.url}`);
 			return { outcome: "completed" };
 		}
@@ -7976,16 +8216,23 @@ function remoteLine(remote) {
 		case "hosted": return `Remote: ${remote.url}`;
 	}
 }
-function notConfiguredReason(state) {
-	const license = state.license;
+function licenseGap(license) {
 	if (!license.activated) return "no license";
 	if (!hasRemoteSync(license)) return "the license has no remote-sync feature";
+	return null;
+}
+function notConfiguredReason(state) {
+	const gap = licenseGap(state.license);
+	if (gap !== null) return gap;
 	if (state.steps[GIT_SYNC_STEP_ID]?.status === "skipped") return "skipped; `rde init --only git-sync` sets it up";
 	return "not set up yet; `rde init --only git-sync`";
 }
 function gitLines(state) {
 	if (state.gitRemote === null) return [`Remote sync: not configured (${notConfiguredReason(state)})`];
-	return [`Content repository: ${state.gitRemote.workdir} (branch ${state.gitRemote.branch})`, remoteLine(state.gitRemote)];
+	const repository = [`Content repository: ${state.gitRemote.workdir} (branch ${state.gitRemote.branch})`, remoteLine(state.gitRemote)];
+	const gap = licenseGap(state.license);
+	if (gap === null) return repository;
+	return [...repository, `Remote sync: unavailable (${gap}; \`rde init --from license\` activates one)`];
 }
 async function pendingExportLines(state, secrets, runner) {
 	const instance = mbInstanceOf(state, secrets);
@@ -8956,8 +9203,7 @@ function plainUi(output) {
 	};
 }
 function noColorRequested() {
-	const value = readEnv(ENV_NO_COLOR);
-	return value !== void 0 && value !== "";
+	return readSetEnv(ENV_NO_COLOR) !== null;
 }
 function drawsOnTerminal() {
 	return process.stdout.isTTY === true && !noColorRequested();
@@ -9088,6 +9334,20 @@ const db = defineCommand({
 	default: "list"
 });
 //#endregion
+//#region package.json
+var name = "@metabase/rde";
+var version = "0.1.18";
+var description = "Prepares a local machine for data-engineering work with Metabase and coding agents";
+//#endregion
+//#region src/version.ts
+const PACKAGE_NAME = name;
+const VERSION = version;
+const ROOT_META = {
+	name: "rde",
+	version: VERSION,
+	description
+};
+//#endregion
 //#region src/wizard/engine.ts
 function requireKnownStep(steps, id, flag) {
 	if (id === void 0) return;
@@ -9184,6 +9444,8 @@ async function runWizard(steps, ctx, options = {}) {
 }
 //#endregion
 //#region src/steps/doctor.ts
+const RDE_DIST_TAG = "latest";
+const RDE_RELEASE_TIMEOUT_MS = 3e3;
 function hostDoctorDeps(instanceName, signal) {
 	const runner = processRunner(signal);
 	const runtime = hostRuntimeDeps(instanceName, signal);
@@ -9203,7 +9465,8 @@ function hostDoctorDeps(instanceName, signal) {
 			cwd: process.cwd(),
 			stateHome: xdgStateHome(),
 			files: hostSkillFiles
-		}
+		},
+		publishedRdeVersion: () => npmRegistry(signal, { timeoutMs: RDE_RELEASE_TIMEOUT_MS }).distTagVersion(PACKAGE_NAME, RDE_DIST_TAG)
 	};
 }
 const NOT_FOUND_STATUS = 404;
@@ -9297,6 +9560,26 @@ function mbRow(diagnosis, lines, deps) {
 		case "current": return ok("mb", MB_LABEL, lines.join("\n"));
 	}
 }
+const RDE_LABEL = "rde";
+const RDE_UPDATE_HINT = `\`npm i -g ${PACKAGE_NAME}@${RDE_DIST_TAG}\``;
+function rdeUncheckedRow(reason) {
+	return skipped("rde", RDE_LABEL, `${VERSION}; could not check for a newer release: ${reason}`);
+}
+async function rdeRow(deps) {
+	let raw;
+	try {
+		raw = await deps.publishedRdeVersion();
+	} catch (error) {
+		const reason = lookupFailure(error);
+		if (reason === null) throw error;
+		return rdeUncheckedRow(reason);
+	}
+	const published = semver.valid(raw);
+	if (published === null) return rdeUncheckedRow(`the registry names "${raw}" for ${RDE_DIST_TAG}, which is not a version`);
+	if (semver.lt(VERSION, published)) return note$1("rde", RDE_LABEL, `${VERSION}; ${published} is released`, RDE_UPDATE_HINT);
+	if (semver.gt(VERSION, published)) return ok("rde", RDE_LABEL, `${VERSION}, ahead of the latest release ${published}`);
+	return ok("rde", RDE_LABEL, `${VERSION}, the latest release`);
+}
 async function mbFinding(deps) {
 	const found = await inspectMbOnPath(deps.runner, deps.locateMb);
 	const diagnosis = diagnoseMb(found, deps.installedWith);
@@ -9317,6 +9600,20 @@ function publishesOnLoopback(container, port) {
 }
 const CONTAINER = "the container";
 const CONTAINER_SILENT_PORT_HINT = "Docker's forward of the port is broken; `rde start` repairs it";
+function containerSettingsFailure(runtime, inspection) {
+	const onMaster = !developmentMode() && isMasterBuildImage(runtime.image);
+	const drift = containerEnvDrift(inspection, runtime);
+	const problems = [];
+	if (onMaster) problems.push(`${runtime.containerName} runs ${runtime.image}, a development build of Metabase`);
+	if (drift.length > 0) problems.push(`${runtime.containerName} was created with ${drift.join(", ")} set otherwise than rde sets them now`);
+	if (problems.length === 0) return null;
+	const hint = onMaster ? "a build of master is ahead of every release, so `rde uninstall`, then `rde init`, sets up an instance on a release; `RDE_DEV=1` keeps running this one" : "`rde upgrade` creates the container again with rde's settings";
+	return {
+		detail: problems.join("\n"),
+		hint,
+		step: null
+	};
+}
 async function containerRow(runtime, deps, dockerOk) {
 	const label = "container";
 	if (!dockerOk) return {
@@ -9357,6 +9654,11 @@ async function containerRow(runtime, deps, dockerOk) {
 		}),
 		...found
 	};
+	const settings = containerSettingsFailure(runtime, inspection);
+	if (settings !== null) return {
+		row: failed("container", label, settings),
+		...found
+	};
 	const state = inspection.running ? "running" : "stopped";
 	return {
 		row: ok("container", label, `${runtime.containerName} ${state} (${runtime.image})`),
@@ -9835,25 +10137,71 @@ async function skillCopiesRow(globalEntries, deps) {
 	const stale = judged.filter((copy) => !copy.current);
 	return stale.length === 0 ? ok(id, label, detail) : staleCopiesRow(stale, detail, deps);
 }
+function dataAppBranchLine(version, origin) {
+	const wanted = withRef(origin.repository, origin.ref);
+	return version === null ? `Metabase has not reported its version yet; rde installs them from ${wanted}` : `Metabase ${version} takes them from ${wanted}`;
+}
+async function dataAppSkillsRow(state, installed, deps) {
+	const id = "data-app-skills";
+	const label = "data-app skills";
+	const branch = dataAppSkillsOrigin(wantedDataAppRef(state.version));
+	const wanted = [...DATA_APP_SKILL_NAMES.map((name) => ({
+		name,
+		origin: branch
+	})), {
+		name: RDE_DATA_APPS_SKILL_NAME,
+		origin: skillOrigin(deps.skills.source, deps.skills.cwd)
+	}];
+	const lines = [dataAppBranchLine(state.version, branch)];
+	let current = true;
+	for (const skill of wanted) {
+		const entry = installed.find((candidate) => candidate.name === skill.name);
+		if (entry === void 0) {
+			lines.push(`${skill.name}: not installed`);
+			current = false;
+			continue;
+		}
+		const judged = await judgeCopy(entry, skill.origin, deps);
+		lines.push(judged.line);
+		current &&= judged.current;
+	}
+	const detail = lines.join("\n");
+	if (current) return ok(id, label, detail);
+	return failed(id, label, {
+		detail,
+		hint: `\`rde init --only ${SKILL_STEP}\` installs them; then restart the agent session`,
+		step: SKILL_STEP
+	});
+}
 async function skillRows(state, deps) {
 	const label = "rde skill";
 	if (state === null) return [skipped("skill", label, NO_INSTANCE_REASON)];
 	if (state.steps[SKILL_STEP]?.status === "skipped") return [skipped("skill", label, `skipped during init; \`rde init --only ${SKILL_STEP}\``)];
 	const detected = (await detectAgents(deps.probe)).filter((agent) => agent.detected);
 	if (detected.length === 0) return [skipped("skill", label, "no coding agents detected")];
-	const entries = await rdeSkillEntries(deps.runner);
+	const installed = await skillsCli(deps.runner).list();
+	const entries = installed.filter((entry) => entry.name === "rde");
 	const copies = await skillCopiesRow(entries, deps);
-	if (detected.filter((agent) => entries.some((entry) => skillCoversAgent(entry, agent))).length === 0) return [failed("skill", label, {
-		detail: `not installed for ${detected.map((agent) => agent.displayName).join(", ")}`,
-		hint: `\`rde init --only ${SKILL_STEP}\``,
-		step: SKILL_STEP
-	}), copies];
-	return [...detected.map((agent) => {
-		const entry = entries.find((candidate) => skillCoversAgent(candidate, agent));
-		const agentLabel = `${label} (${agent.displayName})`;
-		if (entry === void 0) return skipped(skillRowId(agent), agentLabel, `not installed; \`rde init --only ${SKILL_STEP}\` adds it`);
-		return ok(skillRowId(agent), agentLabel, entry.path);
-	}), copies];
+	const dataApps = await dataAppSkillsRow(state, installed, deps);
+	if (detected.filter((agent) => entries.some((entry) => skillCoversAgent(entry, agent))).length === 0) return [
+		failed("skill", label, {
+			detail: `not installed for ${detected.map((agent) => agent.displayName).join(", ")}`,
+			hint: `\`rde init --only ${SKILL_STEP}\``,
+			step: SKILL_STEP
+		}),
+		copies,
+		dataApps
+	];
+	return [
+		...detected.map((agent) => {
+			const entry = entries.find((candidate) => skillCoversAgent(candidate, agent));
+			const agentLabel = `${label} (${agent.displayName})`;
+			if (entry === void 0) return skipped(skillRowId(agent), agentLabel, `not installed; \`rde init --only ${SKILL_STEP}\` adds it`);
+			return ok(skillRowId(agent), agentLabel, entry.path);
+		}),
+		copies,
+		dataApps
+	];
 }
 function noRuntimeRows() {
 	return [
@@ -9898,7 +10246,11 @@ async function collectDoctor(instance, state, secrets, deps) {
 	const dockerOk = machine.some((row) => row.id === "docker" && row.status === "ok");
 	const mb = await mbFinding(deps);
 	const profiles = sharedProfileList(deps);
-	const checks = [...machine, mb.row];
+	const checks = [
+		...machine,
+		mb.row,
+		await rdeRow(deps)
+	];
 	if (state === null) checks.push(...noRuntimeRows(), skipped("version", "Metabase version", NO_INSTANCE_REASON), skipped("admin", "admin user", NO_INSTANCE_REASON), skipped("admin-password", "admin password", NO_INSTANCE_REASON), skipped("api-key", "API key", NO_INSTANCE_REASON), skipped("secrets-file", "secrets file", NO_INSTANCE_REASON), skipped("state-file", "state file", NO_INSTANCE_REASON), skipped("mb-profile", "mb profile", NO_INSTANCE_REASON), skipped("license", "license", NO_INSTANCE_REASON), skipped("databases", "databases", NO_INSTANCE_REASON), skipped("git-sync", "remote sync", NO_INSTANCE_REASON));
 	else checks.push(...await instanceRows(state, secrets, deps, dockerOk, profiles, mb.unusable));
 	const rdeProfile = state === null ? null : state.mbProfile;
@@ -11024,7 +11376,7 @@ function keptOnDisk(options, state, dirPresent) {
 	const kept = [];
 	if (options.keepData && dirPresent) kept.push(`Instance directory ${instanceDir(options.instance)} (--keep-data); \`rde init\` reinstalls from it`);
 	if (state?.gitRemote !== null && state?.gitRemote !== void 0) kept.push(`Working directory ${state.gitRemote.workdir} and its git history`);
-	if (!options.removeSkill) kept.push(`The rde skill for your agents; pass --remove-skill to remove it`);
+	if (!options.removeSkill) kept.push(`The ${RDE_SOURCE_SKILL_NAMES.join(" and ")} skills for your agents; pass --remove-skill to remove them`);
 	return kept;
 }
 async function planUninstall(options, deps) {
@@ -11131,6 +11483,9 @@ function reportLines(report) {
 function leftBehind(report) {
 	return [...report.results.flatMap((result) => result.outcome === "failed" ? [result.label] : []), ...report.problems.map((problem) => problem.subject)];
 }
+function uninstallCommandLine(options) {
+	return options.instance === options.defaultInstance ? "rde uninstall" : `rde uninstall --instance ${options.instance}`;
+}
 async function uninstall(options, deps, io) {
 	const plan = await planUninstall(options, deps);
 	for (const problem of plan.problems) io.ui.warn(`${problem.subject} ${problem.reason}`);
@@ -11141,7 +11496,7 @@ async function uninstall(options, deps, io) {
 			problems: plan.problems
 		};
 	}
-	io.ui.note(planLines$1(plan).join("\n"), `rde uninstall ${options.instance}`);
+	io.ui.note(planLines$1(plan).join("\n"), uninstallCommandLine(options));
 	if (plan.unpulled !== null) {
 		io.ui.warn(unpulledWarning(plan.unpulled));
 		if ((options.yes || !options.terminal) && !options.force) throw new ConfigError(unpulledRefusal(plan.unpulled));
@@ -11180,7 +11535,7 @@ const uninstallCommand = defineRdeCommand({
 		},
 		"remove-skill": {
 			type: "boolean",
-			description: "Also remove the rde skill from your coding agents",
+			description: "Also remove the rde and rde-data-apps skills from your coding agents",
 			default: false
 		},
 		"remove-image": {
@@ -11201,11 +11556,13 @@ const uninstallCommand = defineRdeCommand({
 	},
 	interrupted: INTERRUPTED,
 	async run(args) {
-		const instance = args.instance ?? await instanceNameOrDefault();
+		const defaultInstance = await instanceNameOrDefault();
+		const instance = args.instance ?? defaultInstance;
 		if (!isInstanceName(instance)) throw new ConfigError(`${args.instance === void 0 ? `the default instance in ${globalConfigPath()},` : "--instance"} ${instance} is not an instance name (${INSTANCE_NAME_RULE})`);
 		const ui = terminalUi();
 		const report = await uninstall({
 			instance,
+			defaultInstance,
 			keepData: args["keep-data"],
 			removeSkill: args["remove-skill"],
 			removeImage: args["remove-image"],
@@ -11231,35 +11588,59 @@ function hostDeps(ctx) {
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
 		timing: DEFAULT_HEALTH_TIMING,
 		releases: releaseLookup(ctx.signal),
-		now: () => /* @__PURE__ */ new Date()
+		now: () => /* @__PURE__ */ new Date(),
+		skills: (agents) => agentsSkillsStep(agents, "published")
 	};
 }
-function imageTag(ref) {
-	const colon = ref.lastIndexOf(":");
-	if (colon === -1 || colon < ref.lastIndexOf("/")) return null;
-	return ref.slice(colon + 1);
+function majorMove(from, to) {
+	const fromMajor = releaseMajor(from);
+	const toMajor = to === null ? null : releaseMajor(to);
+	if (fromMajor === null || toMajor === null || fromMajor === toMajor) return null;
+	return {
+		from: fromMajor,
+		to: toMajor
+	};
 }
 function releaseOf(tag) {
 	const match = RELEASE_TAG.exec(tag);
 	if (match === null || match[1] === void 0) return null;
 	return semver.coerce(match[1]);
 }
-function downgradeReason(current, targetTag) {
-	if (targetTag === null) return null;
+function isDowngrade(current, targetTag) {
+	if (isMajorLineTag(targetTag)) {
+		const running = releaseMajor(current);
+		const target = releaseMajor(targetTag);
+		return running !== null && target !== null && target < running;
+	}
 	const running = releaseOf(current);
 	const target = releaseOf(targetTag);
-	if (running === null || target === null || !semver.lt(target, running)) return null;
+	return running !== null && target !== null && semver.lt(target, running);
+}
+function downgradeReason(current, targetTag) {
+	if (targetTag === null || !isDowngrade(current, targetTag)) return null;
 	return `refusing to downgrade from ${current} to ${targetTag}: Metabase migrates its application database forward only; a fresh instance (\`rde uninstall\`, then \`rde init\`) is the way to run an older release`;
 }
 function backupStamp(now) {
 	return now.toISOString().replace(/\.\d{3}Z$/, "Z").replaceAll(":", "-");
 }
-async function ensureRunning(ctx, deps, client) {
-	await startMetabaseStep(() => deps).run(ctx);
+async function ensureRunning(ctx, deps, client, accepted) {
+	await startMetabaseStep(() => deps, accepted).run(ctx);
 	return runningVersion(client);
 }
-function dockerTarget(runtime, to) {
-	const image = to ?? runtime.image;
+function requireSupported(version) {
+	const refusal = unsupportedVersionReason(version, developmentMode());
+	if (refusal !== null) throw new UnsupportedMetabaseError(refusal);
+}
+function knownTargetVersion(target) {
+	const tag = target.releaseTag;
+	return tag !== null && (isReleaseTag(tag) || isMajorLineTag(tag)) ? tag : null;
+}
+const TO_ONE = "`--to <image or release tag>` names a Metabase to move to";
+const UPGRADE_WAYS_OUT = {
+	named: TO_ONE,
+	unreleased: TO_ONE
+};
+function dockerTargetOf(runtime, image, ownImage) {
 	return {
 		kind: "docker",
 		next: {
@@ -11267,22 +11648,24 @@ function dockerTarget(runtime, to) {
 			image
 		},
 		label: image,
-		releaseTag: imageTag(image)
+		releaseTag: imageTag(image),
+		ownImage
 	};
 }
+async function dockerTarget(ctx, runtime, to, releases) {
+	if (to !== null) return dockerTargetOf(runtime, to, false);
+	if (developmentMode()) return dockerTargetOf(runtime, runtime.image, false);
+	if (!isMetabaseImage(runtime.image)) return dockerTargetOf(runtime, runtime.image, true);
+	return dockerTargetOf(runtime, await releaseImage(ctx, releases, UPGRADE_WAYS_OUT), false);
+}
 async function jarTarget(ctx, runtime, to, releases) {
 	const spec = to ?? "latest";
 	const parsed = parseJarSpec(spec);
-	if (parsed === null) throw new ConfigError(`--to ${spec} is not latest, a release tag such as v1.63.18, or the path of a .jar file`);
-	let source;
-	if (parsed.kind === "latest") {
-		const version = await releases.latestVersion();
-		ctx.ui.info(`The latest Metabase release is ${version}`);
-		source = {
-			kind: "release",
-			version
-		};
-	} else source = parsed;
+	if (parsed === null) throw new ConfigError(`--to ${spec} is not latest, an enterprise release tag such as v1.65.0, or the path of a .jar file`);
+	const source = parsed.kind === "latest" ? {
+		kind: "release",
+		version: await latestJarRelease(ctx, releases, UPGRADE_WAYS_OUT)
+	} : parsed;
 	return {
 		kind: "jar",
 		previous: runtime,
@@ -11296,7 +11679,7 @@ async function jarTarget(ctx, runtime, to, releases) {
 }
 function resolveTarget(ctx, configured, to, releases) {
 	switch (configured.runtime.kind) {
-		case "docker": return Promise.resolve(dockerTarget(configured.runtime, to));
+		case "docker": return dockerTarget(ctx, configured.runtime, to, releases);
 		case "jar": return jarTarget(ctx, configured.runtime, to, releases);
 	}
 }
@@ -11346,9 +11729,13 @@ const SWITCH_TEXT = {
 	jar: "Metabase stops and starts again from the target jar."
 };
 function planLines(configured, current, target, backup) {
+	const notes = [];
+	if (target.kind === "docker" && target.ownImage) notes.push("the instance's own image pulled again, since only Metabase's images move to the newest release");
+	if (target.releaseTag === null || !isReleaseTag(target.releaseTag)) notes.push("its version shows once it runs");
+	const annotation = notes.length === 0 ? "" : ` (${notes.join("; ")})`;
 	return [
 		`Running:  ${current} (${describeRuntime(configured.runtime)})`,
-		`Target:   ${target.label}`,
+		`Target:   ${target.label}${annotation}`,
 		`Backup:   ${backup}`,
 		"",
 		SWITCH_TEXT[configured.runtime.kind],
@@ -11407,31 +11794,70 @@ async function switchTo(ctx, deps, target) {
 	}
 	spinner.stop(`Installed ${target.label}`);
 }
+function failedStartTitle(error) {
+	if (error instanceof MetabaseUnreachableError) return "Metabase did not come up on the new version";
+	if (error instanceof UnsupportedMetabaseError) return "The new version is not one rde runs";
+	return null;
+}
 async function startUpgraded(ctx, deps, client, previous, backup) {
 	try {
-		return await ensureRunning(ctx, deps, client);
+		return await ensureRunning(ctx, deps, client, "supported");
 	} catch (error) {
-		if (error instanceof MetabaseUnreachableError) ctx.ui.note(restoreLines(ctx, previous, deps.runtime.dataDir, backup).join("\n"), "Metabase did not come up on the new version");
+		const title = failedStartTitle(error);
+		if (title !== null) ctx.ui.note(restoreLines(ctx, previous, deps.runtime.dataDir, backup).join("\n"), title);
 		throw error;
 	}
 }
+async function recreateStale(ctx, deps, previous, target) {
+	const next = target.next;
+	const container = await deps.runtime.docker.containerInspect(next.containerName);
+	const drift = container.exists ? containerEnvDrift(container, next) : [];
+	const renamed = previous.kind === "docker" && previous.image !== next.image;
+	if (drift.length === 0 && !renamed) return false;
+	if (renamed) {
+		ctx.ui.info(`${previous.image} is the image ${next.image} names; creating ${next.containerName} again under ${next.image}`);
+		await ctx.saveState({
+			...ctx.state,
+			runtime: next
+		});
+	}
+	if (drift.length > 0) ctx.ui.info(`${next.containerName} was created with ${drift.join(", ")} set otherwise than rde sets them now; creating it again from the image it runs`);
+	await runtimeFromState(next, deps.runtime).reconfigure();
+	return true;
+}
+async function alreadyOn(ctx, deps, client, configured, current, target) {
+	if (target.kind === "docker" && await recreateStale(ctx, deps, configured.runtime, target)) {
+		await ensureRunning(ctx, deps, client, "supported");
+		ctx.ui.success(`Already on ${current}; ${target.next.containerName} runs ${target.label} with rde's settings now`);
+		return {
+			outcome: "recreated",
+			version: current
+		};
+	}
+	ctx.ui.success(`Already on ${current}: ${target.label} is what the instance runs`);
+	return {
+		outcome: "unchanged",
+		version: current
+	};
+}
 async function upgrade(ctx, options, deps = hostDeps) {
 	const resolved = deps(ctx);
 	const configured = requireConfiguredRuntime(ctx.state);
 	const client = resolved.client(configured.url, NO_AUTH);
-	const current = await ensureRunning(ctx, resolved, client);
 	const target = await resolveTarget(ctx, configured, options.to, resolved.releases);
+	const current = await ensureRunning(ctx, resolved, client, "any");
 	const refusal = downgradeReason(current, target.releaseTag);
 	if (refusal !== null) throw new ConfigError(refusal);
+	const known = knownTargetVersion(target);
+	if (known !== null) requireSupported(known);
 	if (await fetchTarget(ctx, resolved, target, current)) {
-		ctx.ui.success(`Already on ${current}: ${target.label} is what the instance runs`);
-		return {
-			outcome: "unchanged",
-			version: current
-		};
+		requireSupported(current);
+		return alreadyOn(ctx, resolved, client, configured, current, target);
 	}
 	const backup = join(instanceBackupsDir(ctx.state.name), backupStamp(resolved.now()));
 	ctx.ui.note(planLines(configured, current, target, backup).join("\n"), "rde upgrade");
+	const announced = majorMove(current, target.releaseTag);
+	if (announced !== null) ctx.ui.warn(`This moves Metabase from ${announced.from} to ${announced.to}, a new major version; the data-app skills follow it after the upgrade`);
 	if (!options.yes) {
 		if (!await ctx.prompts.confirm({
 			message: "Upgrade now?",
@@ -11452,6 +11878,11 @@ async function upgrade(ctx, options, deps = hostDeps) {
 	options.onPhase("starting", backup);
 	const to = await startUpgraded(ctx, resolved, client, configured, backup);
 	ctx.ui.success(`Upgraded Metabase from ${current} to ${to}; the backup at ${backup} can go once you are happy with it`);
+	const moved = majorMove(current, to);
+	if (moved !== null) {
+		if (announced === null) ctx.ui.warn(`This moved Metabase from ${moved.from} to ${moved.to}, a new major version; the data-app skills follow it`);
+		await runWizard([resolved.skills(options.yes ? DETECT_AGENTS : ASK_AGENTS)], ctx);
+	}
 	return {
 		outcome: "upgraded",
 		from: current,
@@ -11477,7 +11908,7 @@ const upgradeCommand = defineRdeCommand({
 	args: {
 		to: {
 			type: "string",
-			description: "Docker: image to upgrade to (default: the instance's image, pulled again); jar: latest, a release tag, or a .jar path (default: latest)"
+			description: "Docker: image to upgrade to (default: the major line of the newest Metabase Enterprise release, such as metabase/metabase-enterprise:v1.65.x; the instance's own image pulled again with RDE_DEV=1 or for an image from outside Metabase's repositories); jar: latest (the newest release), a release tag, or a .jar path (default: latest)"
 		},
 		yes: {
 			type: "boolean",
@@ -11505,11 +11936,7 @@ const upgradeCommand = defineRdeCommand({
 //#endregion
 //#region src/main.ts
 const main = defineCommand({
-	meta: {
-		name: "rde",
-		version: "0.1.17",
-		description: "Prepares a local machine for data-engineering work with Metabase and coding agents"
-	},
+	meta: ROOT_META,
 	subCommands: {
 		init,
 		start,