@metabase/rde 0.1.17 → 0.5.0

package/dist/cli.mjs

@@ -11,6 +11,7 @@ import { pipeline } from "node:stream/promises";
 import { spawn } from "node:child_process";
 import { connect, createServer } from "node:net";
 import { confirm, intro, isCancel, log, multiselect, note, outro, password, select, spinner, text } from "@clack/prompts";
+import { isDeepStrictEqual } from "node:util";
 import semver from "semver";
 //#region src/errors.ts
 var AbortError = class extends Error {
@@ -33,6 +34,12 @@ var PortTakenError = class extends ConfigError {
 		this.port = port;
 	}
 };
+var UnsupportedMetabaseError = class extends ConfigError {
+	constructor(message) {
+		super(message);
+		this.name = "UnsupportedMetabaseError";
+	}
+};
 var PromptUnavailableError = class extends ConfigError {
 	constructor(message) {
 		super(message);
@@ -260,9 +267,9 @@ function withoutEscapes(text) {
 const StepId = z.enum([
 	"preflight",
 	"install-mb",
-	"agents-skills",
 	"runtime",
 	"start-metabase",
+	"agents-skills",
 	"admin-user",
 	"api-key",
 	"transforms",
@@ -362,7 +369,7 @@ const StepRecord = z.object({
 	completedAt: z.string()
 });
 const InstanceState = z.object({
-	schemaVersion: z.literal(7),
+	schemaVersion: z.literal(8),
 	name: z.string(),
 	runtime: RuntimeState.nullable(),
 	url: z.string().nullable(),
@@ -373,7 +380,6 @@ const InstanceState = z.object({
 	databases: z.array(DatabaseRecord),
 	gitRemote: GitRemoteState.nullable(),
 	movedFrom: z.string().nullable(),
-	syncRoot: z.int().nullable(),
 	steps: z.partialRecord(StepId, StepRecord)
 });
 function configuredRuntime(state) {
@@ -403,7 +409,7 @@ function mbCommand(profile) {
 }
 function emptyInstanceState(name) {
 	return {
-		schemaVersion: 7,
+		schemaVersion: 8,
 		name,
 		runtime: null,
 		url: null,
@@ -414,7 +420,6 @@ function emptyInstanceState(name) {
 		databases: [],
 		gitRemote: null,
 		movedFrom: null,
-		syncRoot: null,
 		steps: {}
 	};
 }
@@ -427,6 +432,7 @@ const V3 = 3;
 const V4 = 4;
 const V5 = 5;
 const V6 = 6;
+const V7 = 7;
 const StateV1 = z.object({ schemaVersion: z.literal(V1) }).loose();
 const StateV2 = z.object({ schemaVersion: z.literal(V2) }).loose();
 const AdminV3 = z.discriminatedUnion("kind", [z.object({
@@ -443,6 +449,7 @@ const StateV5 = z.object({
 	steps: z.record(z.string(), z.unknown())
 }).loose();
 const StateV6 = z.object({ schemaVersion: z.literal(V6) }).loose();
+const StateV7 = z.object({ schemaVersion: z.literal(V7) }).loose();
 const StateV3 = z.object({
 	schemaVersion: z.literal(V3),
 	admin: AdminV3.nullable(),
@@ -480,8 +487,14 @@ function liftV5(raw) {
 function liftV6(raw) {
 	return {
 		...StateV6.parse(raw),
-		schemaVersion: 7,
-		syncRoot: null
+		schemaVersion: V7
+	};
+}
+function liftV7(raw) {
+	const { syncRoot: _syncRoot, ...state } = StateV7.parse(raw);
+	return {
+		...state,
+		schemaVersion: 8
 	};
 }
 function adminV4(admin) {
@@ -523,24 +536,29 @@ function migrateInstanceState(raw) {
 		case V3: return liftV3(raw);
 		case V4: return migrateInstanceState(liftV4(raw));
 		case V5: return migrateInstanceState(liftV5(raw));
-		case V6: return {
-			state: InstanceState.parse(liftV6(raw)),
+		case V6: return migrateInstanceState(liftV6(raw));
+		case V7: return {
+			state: InstanceState.parse(liftV7(raw)),
 			movedSecrets: null
 		};
-		case 7: return {
+		case 8: return {
 			state: InstanceState.parse(raw),
 			movedSecrets: null
 		};
-		default: throw new ConfigError(`state schemaVersion ${schemaVersion} is not supported by this build (expected 7)`);
+		default: throw new ConfigError(`state schemaVersion ${schemaVersion} is not supported by this build (expected 8)`);
 	}
 }
 //#endregion
 //#region src/env.ts
 const ENV_RDE_HOME = "RDE_HOME";
-const ENV_RDE_SKILL_SOURCE = "RDE_SKILL_SOURCE";
+const ENV_RDE_DEV = "RDE_DEV";
 function readEnv(name) {
 	return process.env[name];
 }
+function readSetEnv(name) {
+	const value = readEnv(name);
+	return value === void 0 || value.length === 0 ? null : value;
+}
 const ENV_PATH = "PATH";
 const ENV_NO_COLOR = "NO_COLOR";
 const ENV_XDG_STATE_HOME = "XDG_STATE_HOME";
@@ -548,6 +566,9 @@ const ENV_JAVA_HOME = "JAVA_HOME";
 const ENV_MB_PROFILE = "MB_PROFILE";
 const ENV_MB_URL = "MB_URL";
 const ENV_MB_API_KEY = "MB_API_KEY";
+function developmentMode() {
+	return readSetEnv(ENV_RDE_DEV) === "1";
+}
 function hostEnvironment() {
 	return { ...process.env };
 }
@@ -566,8 +587,8 @@ const INSTANCE_NAME = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
 const INSTANCE_NAME_RULE = "letters, digits, - and _, starting with a letter or digit";
 const HOME_TAG_LENGTH = 8;
 function rdeHome() {
-	const override = readEnv(ENV_RDE_HOME);
-	if (override !== void 0) return resolve(override);
+	const override = readSetEnv(ENV_RDE_HOME);
+	if (override !== null) return resolve(override);
 	return join(homedir(), RDE_DIR_NAME);
 }
 function homeTag(home) {
@@ -700,6 +721,7 @@ async function requireInstanceState(name) {
 }
 const LOCK_SUFFIX = ".lock";
 const STALE_SUFFIX = ".stale";
+const PENDING_SUFFIX = ".pending";
 const LOCK_RETRY_MS = 25;
 const LOCK_WAIT_MS = 3e4;
 function lockToken() {
@@ -717,6 +739,15 @@ function isRunning(pid) {
 		return !hasCode(error, "ESRCH");
 	}
 }
+async function createLock(path, token) {
+	const pending = `${path}${PENDING_SUFFIX}.${token.replaceAll(" ", "-")}`;
+	await promises.writeFile(pending, token, { mode: 384 });
+	try {
+		await promises.link(pending, path);
+	} finally {
+		await promises.rm(pending, { force: true });
+	}
+}
 async function takeOverDeadLock(path, held) {
 	const aside = `${path}${STALE_SUFFIX}.${held.replaceAll(" ", "-")}`;
 	try {
@@ -741,10 +772,7 @@ async function acquireLock(name, signal) {
 	const deadline = Date.now() + LOCK_WAIT_MS;
 	for (;;) {
 		try {
-			await promises.writeFile(path, token, {
-				flag: "wx",
-				mode: 384
-			});
+			await createLock(path, token);
 			return token;
 		} catch (error) {
 			if (isFileNotFound$1(error)) await requireInstanceState(name);
@@ -958,6 +986,7 @@ function lookupFailure(error) {
 }
 function createHttp(options) {
 	const fetchImpl = options.fetchImpl ?? fetch;
+	const timeoutMs = options.timeoutMs ?? REQUEST_TIMEOUT_MS;
 	const baseUrl = options.baseUrl.replace(/\/+$/, "");
 	async function send(method, path, body) {
 		const url = `${baseUrl}${path}`;
@@ -968,7 +997,7 @@ function createHttp(options) {
 		const init = {
 			method,
 			headers,
-			signal: AbortSignal.any([options.signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)])
+			signal: AbortSignal.any([options.signal, AbortSignal.timeout(timeoutMs)])
 		};
 		if (body !== void 0) {
 			headers["content-type"] = JSON_CONTENT_TYPE;
@@ -982,7 +1011,7 @@ function createHttp(options) {
 			};
 		} catch (error) {
 			if (options.signal.aborted) throw new AbortError();
-			if (isTimeout(error)) throw new MetabaseUnreachableError(url, `no response within ${REQUEST_TIMEOUT_MS}ms`);
+			if (isTimeout(error)) throw new MetabaseUnreachableError(url, `no response within ${timeoutMs}ms`);
 			throw new MetabaseUnreachableError(url, describeCause(error));
 		}
 	}
@@ -2101,14 +2130,23 @@ async function whichCommand(name) {
 //#endregion
 //#region src/tools/agents.ts
 const AgentId = z.enum([
+	"opencode",
 	"claude-code",
 	"codex",
 	"cursor",
 	"gemini-cli",
-	"opencode",
 	"windsurf"
 ]);
 const AGENTS = [
+	{
+		id: "opencode",
+		displayName: "OpenCode",
+		skillsCliName: "opencode",
+		command: "opencode",
+		launch: "opencode",
+		readsSharedSkills: true,
+		configDir: (_home, configHome) => join(configHome, "opencode")
+	},
 	{
 		id: "claude-code",
 		displayName: "Claude Code",
@@ -2145,15 +2183,6 @@ const AGENTS = [
 		readsSharedSkills: true,
 		configDir: (home) => join(home, ".gemini")
 	},
-	{
-		id: "opencode",
-		displayName: "OpenCode",
-		skillsCliName: "opencode",
-		command: "opencode",
-		launch: "opencode",
-		readsSharedSkills: true,
-		configDir: (_home, configHome) => join(configHome, "opencode")
-	},
 	{
 		id: "windsurf",
 		displayName: "Windsurf",
@@ -2200,18 +2229,74 @@ async function detectAgents(probe) {
 }
 //#endregion
 //#region src/metabase/domain/version-info.ts
-const VersionInfo = z.object({ latest: z.object({ version: z.string() }).loose() }).loose();
+const VersionEntry = z.object({ version: z.string() }).loose();
+const VersionInfo = z.object({ latest: VersionEntry }).loose();
+const VersionHistory = z.object({
+	latest: VersionEntry,
+	older: z.array(VersionEntry)
+}).loose();
 //#endregion
 //#region src/metabase/releases.ts
 const DOWNLOADS_HOST = "https://downloads.metabase.com";
 const VERSION_INFO_HOST = "https://static.metabase.com";
 const VERSION_INFO_PATH = "/version-info-ee.json";
 const JAR_FILE = "metabase.jar";
-const RELEASE_TAG$1 = /^v(?<edition>[01])\.\d+\.\d+(?:\.\d+)?(?:-[\w.]+)?$/;
+const RELEASE_TAG$1 = /^v(?<edition>[01])\.(?<major>\d+)\.\d+(?:\.\d+)?(?:-[\w.]+)?$/;
+const MAJOR_LINE_TAG = /^v(?<edition>[01])\.(?<major>\d+)\.x$/;
+const FINAL_ENTERPRISE_RELEASE = /^v1\.\d+\.\d+(?:\.\d+)?$/;
 const ENTERPRISE_EDITION = "1";
+const OPEN_SOURCE_EDITION = "0";
+const SNAPSHOT_SUFFIX = "-SNAPSHOT";
 function isReleaseTag(value) {
 	return RELEASE_TAG$1.test(value);
 }
+function isMajorLineTag(value) {
+	return MAJOR_LINE_TAG.test(value);
+}
+function majorLineTag(major) {
+	return `v${ENTERPRISE_EDITION}.${major}.x`;
+}
+function tagGroups(tag) {
+	return (RELEASE_TAG$1.exec(tag) ?? MAJOR_LINE_TAG.exec(tag))?.groups;
+}
+function isOpenSourceRelease(version) {
+	return tagGroups(version)?.["edition"] === OPEN_SOURCE_EDITION;
+}
+function isMasterBuild(version) {
+	return !(isReleaseTag(version) || isMajorLineTag(version)) || version.endsWith(SNAPSHOT_SUFFIX);
+}
+function releaseMajor(version) {
+	const major = tagGroups(version)?.["major"];
+	return major === void 0 ? null : Number.parseInt(major, 10);
+}
+function releaseNumbers(version) {
+	return version.slice(1).split(".").map((part) => Number.parseInt(part, 10));
+}
+function compareReleases(left, right) {
+	const a = releaseNumbers(left);
+	const b = releaseNumbers(right);
+	for (let index = 0; index < Math.max(a.length, b.length); index += 1) {
+		const difference = (a[index] ?? 0) - (b[index] ?? 0);
+		if (difference !== 0) return difference;
+	}
+	return 0;
+}
+function supportedRelease(version) {
+	if (!FINAL_ENTERPRISE_RELEASE.test(version)) return null;
+	const major = releaseMajor(version);
+	return major !== null && major >= 65 ? {
+		version,
+		major
+	} : null;
+}
+function newestSupportedRelease(versions) {
+	let newest = null;
+	for (const version of versions) {
+		const release = supportedRelease(version);
+		if (release !== null && (newest === null || compareReleases(version, newest.version) > 0)) newest = release;
+	}
+	return newest;
+}
 function jarDownloadUrl(version) {
 	const edition = RELEASE_TAG$1.exec(version)?.groups?.["edition"];
 	if (edition === void 0) throw new Error(`${version} is not a Metabase release tag`);
@@ -2224,9 +2309,15 @@ function releaseLookup(signal, options = {}) {
 		signal,
 		...options
 	});
-	return { async latestVersion() {
-		return (await http.requestJson("GET", VERSION_INFO_PATH, { schema: VersionInfo })).latest.version;
-	} };
+	return {
+		async latestVersion() {
+			return (await http.requestJson("GET", VERSION_INFO_PATH, { schema: VersionInfo })).latest.version;
+		},
+		async newestSupportedRelease() {
+			const info = await http.requestJson("GET", VERSION_INFO_PATH, { schema: VersionHistory });
+			return newestSupportedRelease([info.latest, ...info.older].map((entry) => entry.version));
+		}
+	};
 }
 function fileDownloader(signal, options = {}) {
 	return (url, destination, onProgress) => downloadFile(url, destination, {
@@ -2294,11 +2385,13 @@ const PortBinding = z.array(z.object({
 	HostIp: z.string(),
 	HostPort: z.string()
 }).loose()).nullable();
+const EnvEntry = z.string().regex(/^[^=]+=/, "expected NAME=value");
 const InspectedContainer = z.object({
 	State: z.object({ Running: z.boolean() }).loose(),
 	Config: z.object({
 		Image: z.string(),
-		Labels: z.record(z.string(), z.string()).nullish()
+		Labels: z.record(z.string(), z.string()).nullish(),
+		Env: z.array(EnvEntry).nullish()
 	}).loose(),
 	HostConfig: z.object({ PortBindings: z.record(z.string(), PortBinding).nullable() }).loose(),
 	NetworkSettings: z.object({ Ports: z.record(z.string(), PortBinding).nullish() }).loose()
@@ -2329,6 +2422,14 @@ function portMappings(bindings) {
 	}
 	return mappings;
 }
+function containerEnv(entries) {
+	const env = {};
+	for (const entry of entries) {
+		const separator = entry.indexOf("=");
+		env[entry.slice(0, separator)] = entry.slice(separator + 1);
+	}
+	return env;
+}
 function createArgs(options) {
 	const args = [
 		"create",
@@ -2420,7 +2521,8 @@ function dockerTool(runner) {
 			image: labels?.[IMAGE_LABEL] ?? container.Config.Image,
 			ports: portMappings(container.HostConfig.PortBindings),
 			forwarded: portMappings(container.NetworkSettings.Ports ?? null),
-			home: labels?.[HOME_LABEL] ?? null
+			home: labels?.[HOME_LABEL] ?? null,
+			env: containerEnv(container.Config.Env ?? [])
 		};
 	}
 	async function portClaims() {
@@ -2617,6 +2719,10 @@ const PLUGINS_DIR = "plugins";
 const METABASE_STOP_GRACE_MS = 3e4;
 const DB_DIR = "metabase.db";
 const DB_FILE = "metabase.db";
+const STAGING_STORE_ENV = {
+	MB_RUN_MODE: "e2e",
+	MB_STORE_USE_STAGING: "true"
+};
 function instanceUrl(port) {
 	return `http://localhost:${port}`;
 }
@@ -2625,13 +2731,15 @@ function serverEnv(options) {
 		MB_DB_FILE: options.dbFile,
 		MB_PLUGINS_DIR: options.pluginsDir,
 		MB_SITE_URL: instanceUrl(options.port),
-		MB_RUN_MODE: "e2e",
-		MB_STORE_USE_STAGING: "true",
+		...developmentMode() ? STAGING_STORE_ENV : {},
 		MB_WAREHOUSE_ALLOWED_NETWORKS: "allow-all",
 		MB_LOAD_SAMPLE_CONTENT: "false",
 		MB_INSTALL_ANALYTICS_DATABASE: "false"
 	};
 }
+function envDrift(actual, expected) {
+	return [.../* @__PURE__ */ new Set([...Object.keys(expected), ...Object.keys(STAGING_STORE_ENV)])].filter((name) => actual[name] !== expected[name]);
+}
 function jettyEnv(port) {
 	return {
 		MB_JETTY_HOST: LOOPBACK_HOST,
@@ -2640,7 +2748,34 @@ function jettyEnv(port) {
 }
 //#endregion
 //#region src/runtime/docker.ts
-const DEFAULT_IMAGE = "metabase/metabase-enterprise-head:latest";
+const RELEASE_REPOSITORY = "metabase/metabase-enterprise";
+const DEVELOPMENT_IMAGE = "metabase/metabase-enterprise-head:latest";
+const HEAD_SUFFIX = "-head";
+const METABASE_REPOSITORIES = /* @__PURE__ */ new Set([
+	RELEASE_REPOSITORY,
+	`${RELEASE_REPOSITORY}${HEAD_SUFFIX}`,
+	"metabase/metabase"
+]);
+function majorLineImage(major) {
+	return `${RELEASE_REPOSITORY}:${majorLineTag(major)}`;
+}
+function imageTag(ref) {
+	const colon = ref.lastIndexOf(":");
+	if (colon === -1 || colon < ref.lastIndexOf("/")) return null;
+	return ref.slice(colon + 1);
+}
+function imageRepository(ref) {
+	const digest = ref.indexOf("@");
+	const named = digest === -1 ? ref : ref.slice(0, digest);
+	const tag = imageTag(named);
+	return tag === null ? named : named.slice(0, named.length - tag.length - 1);
+}
+function isMasterBuildImage(ref) {
+	return imageRepository(ref).endsWith(HEAD_SUFFIX);
+}
+function isMetabaseImage(ref) {
+	return METABASE_REPOSITORIES.has(imageRepository(ref));
+}
 const CONTAINER_NAME_PREFIX$1 = "rde-metabase";
 const CONTAINER_PORT = 3e3;
 const STOP = { graceMs: METABASE_STOP_GRACE_MS };
@@ -2655,6 +2790,16 @@ function onLoopback(mappings, port) {
 function hostUserFor(platform, hostUser) {
 	return platform === "linux" ? hostUser : null;
 }
+function containerServerEnv(port) {
+	return serverEnv({
+		dbFile: `${CONTAINER_DATA_DIR}/${DB_DIR}`,
+		pluginsDir: `${CONTAINER_DATA_DIR}/${PLUGINS_DIR}`,
+		port
+	});
+}
+function containerEnvDrift(container, state) {
+	return envDrift(container.env, containerServerEnv(state.port));
+}
 function dockerRuntime(state, deps) {
 	const { docker } = deps;
 	const url = instanceUrl(state.port);
@@ -2681,11 +2826,7 @@ function dockerRuntime(state, deps) {
 				source: deps.dataDir,
 				target: CONTAINER_DATA_DIR
 			},
-			env: serverEnv({
-				dbFile: `${CONTAINER_DATA_DIR}/${DB_DIR}`,
-				pluginsDir: `${CONTAINER_DATA_DIR}/${PLUGINS_DIR}`,
-				port: state.port
-			}),
+			env: containerServerEnv(state.port),
 			addHostGateway: deps.platform === "linux",
 			hostUser: hostUserFor(deps.platform, deps.hostUser)
 		};
@@ -2791,6 +2932,7 @@ function parseJarSpec(value) {
 		path: resolve(trimmed)
 	};
 	const tagged = trimmed.startsWith(TAG_PREFIX) ? trimmed : `${TAG_PREFIX}${trimmed}`;
+	if (isOpenSourceRelease(tagged)) throw new ConfigError(`${trimmed} is a release of the open-source edition, which rde does not support; enterprise release tags start with v1`);
 	return isReleaseTag(tagged) ? {
 		kind: "release",
 		version: tagged
@@ -3277,7 +3419,7 @@ function adminUserStep(options, deps = hostDeps$14) {
 //#region src/tools/mb.ts
 const MB = "mb";
 const MB_PACKAGE = "@metabase/cli";
-const MB_DIST_TAG = "alpha-release-65-integration-branch";
+const MB_DIST_TAG = "latest";
 const MB_INSTALL_SPEC = `${MB_PACKAGE}@${MB_DIST_TAG}`;
 const GLOBAL_INSTALL = {
 	npm: {
@@ -3408,15 +3550,11 @@ function mbRemoveCommand(binary) {
 	const name = owner === "homebrew" ? firstSegmentAfter(binary.resolved, CELLAR) : packageName(binary.resolved);
 	return name === null ? null : REMOVE_COMMANDS[owner](name);
 }
-function setValue(name) {
-	const value = readEnv(name);
-	return value === void 0 || value.length === 0 ? null : value;
-}
 function mbEnvironment() {
 	return {
-		profile: setValue(ENV_MB_PROFILE),
-		url: setValue(ENV_MB_URL),
-		apiKeySet: setValue(ENV_MB_API_KEY) !== null
+		profile: readSetEnv(ENV_MB_PROFILE),
+		url: readSetEnv(ENV_MB_URL),
+		apiKeySet: readSetEnv(ENV_MB_API_KEY) !== null
 	};
 }
 const ProbedUser = z.object({
@@ -5598,6 +5736,14 @@ function gitTool(runner) {
 			"HEAD"
 		], { cwd: dir })).exitCode === 0;
 	}
+	async function gitPath(dir, name) {
+		const result = await git([
+			"rev-parse",
+			"--git-path",
+			name
+		], { cwd: dir });
+		return resolve(dir, result.stdout.trim());
+	}
 	async function hasIdentity(dir) {
 		const result = await runner.run(GIT, [
 			"config",
@@ -5715,6 +5861,7 @@ function gitTool(runner) {
 		initBare,
 		init,
 		hasCommits,
+		gitPath,
 		commitPaths,
 		addRemote,
 		clone,
@@ -5728,14 +5875,201 @@ function gitTool(runner) {
 	};
 }
 //#endregion
+//#region src/steps/license.ts
+const STEP_ID$7 = "license";
+const LICENSE_KEYS = { token: `${STEP_ID$7}.token` };
+const TOKEN_PATTERN = /^[0-9a-f]{64}$/i;
+const NOT_FOUND_STATUS$1 = 404;
+const TOKEN_REFUSED_STATUS = 400;
+const STORE_UNREACHABLE_STATUS = 503;
+const TOKEN_CHECK_HOST = "token-check.metabase.com";
+const ACTIVATION_FAILED = "License activation failed";
+const LICENSED_FEATURES = {
+	[REMOTE_SYNC_FEATURE]: "remote sync",
+	"data-apps": "data apps",
+	"transforms-testing": "transform tests"
+};
+const LICENSED_FEATURE_NAMES = Object.values(LICENSED_FEATURES);
+function licensedFeatureCoverage(features) {
+	const entries = Object.entries(LICENSED_FEATURES);
+	return {
+		included: entries.filter(([key]) => features.includes(key)).map(([, name]) => name),
+		missing: entries.filter(([key]) => !features.includes(key)).map(([, name]) => name)
+	};
+}
+function listOf(names, type) {
+	return new Intl.ListFormat("en", { type }).format(names);
+}
+function hostDeps$12(ctx) {
+	return {
+		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
+		runner: processRunner(ctx.signal),
+		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal)),
+		terminal: stdinIsTty()
+	};
+}
+function isNoTokenYet(error) {
+	if (error instanceof MetabaseApiError) return error.status === NOT_FOUND_STATUS$1;
+	return isMetabaseNotServing(error);
+}
+function validateToken(value) {
+	if (value.length === 0 || TOKEN_PATTERN.test(value)) return;
+	return "A license token is 64 hexadecimal characters";
+}
+function requireApiKey$1(ctx) {
+	if (ctx.secrets.apiKey === null) throw new ConfigError("no API key yet; the api-key step comes first");
+	return ctx.secrets.apiKey;
+}
+function licenseOf(status) {
+	if (!status.valid) return { activated: false };
+	return {
+		activated: true,
+		features: status.features,
+		validThru: status["valid-thru"] ?? null
+	};
+}
+async function liveLicense(client) {
+	try {
+		return licenseOf(await client.tokenStatus.get());
+	} catch (error) {
+		if (error instanceof MetabaseApiError && error.status === NOT_FOUND_STATUS$1) return { activated: false };
+		throw error;
+	}
+}
+async function recordLiveLicense(ctx, client) {
+	const live = await liveLicense(client);
+	if (!isDeepStrictEqual(live, ctx.state.license)) await ctx.saveState({
+		...ctx.state,
+		license: live
+	});
+	return live;
+}
+function activeLabel(status) {
+	const plan = status["plan-alias"];
+	return plan === void 0 ? "License active" : `License active (plan ${plan})`;
+}
+function refusalOf(error) {
+	if (!(error instanceof MetabaseApiError)) return null;
+	if (error.status === TOKEN_REFUSED_STATUS) return new ConfigError(`The license token was refused: ${error.reason}`);
+	if (error.status === STORE_UNREACHABLE_STATUS) return new ConfigError(`The instance could not reach ${TOKEN_CHECK_HOST} to check the license token; it needs outbound network access`);
+	return null;
+}
+async function activate(client, token) {
+	try {
+		await client.setting.setPremiumEmbeddingToken(token);
+	} catch (error) {
+		const refusal = refusalOf(error);
+		if (refusal === null) throw error;
+		return {
+			kind: "refused",
+			error: refusal
+		};
+	}
+	const status = await client.tokenStatus.get();
+	if (!status.valid) return {
+		kind: "refused",
+		error: new ConfigError(`Metabase reports the token as ${status.status}`)
+	};
+	return {
+		kind: "activated",
+		status
+	};
+}
+async function activateAskedToken(ctx, client, terminal) {
+	const token = await ctx.prompts.password({
+		key: LICENSE_KEYS.token,
+		message: "Paste your Metabase license token (Enter to skip)",
+		validate: validateToken
+	});
+	if (token.length === 0) return null;
+	const spinner = ctx.ui.spinner("Activating the license…");
+	let activation;
+	try {
+		activation = await activate(client, token);
+	} catch (error) {
+		spinner.fail(ACTIVATION_FAILED);
+		throw error;
+	}
+	if (activation.kind === "activated") {
+		spinner.stop(activeLabel(activation.status));
+		ctx.session.licenseToken.set(token);
+		return activation.status;
+	}
+	spinner.fail(ACTIVATION_FAILED);
+	if (!terminal) throw activation.error;
+	ctx.ui.warn(activation.error.message);
+	return activateAskedToken(ctx, client, terminal);
+}
+function reportFeatures(ctx, features) {
+	const { missing } = licensedFeatureCoverage(features);
+	const remoteSync = features.includes(REMOTE_SYNC_FEATURE);
+	if (remoteSync) ctx.ui.info("Remote sync is included; the git step will set it up");
+	if (missing.length > 0) {
+		const gitNote = remoteSync ? "" : "; the git step will be skipped";
+		ctx.ui.warn(`This license does not include ${listOf(missing, "disjunction")}${gitNote}`);
+	}
+}
+function licenseStep(deps = hostDeps$12) {
+	return {
+		id: STEP_ID$7,
+		title: "Activate your license",
+		redoHint: "`rde init --from license` with it activates the license and runs the steps after it again.",
+		async detect(ctx) {
+			if (ctx.state.steps[STEP_ID$7]?.status === "skipped") return "not-applicable";
+			const configured = configuredRuntime(ctx.state);
+			if (configured === null || ctx.secrets.apiKey === null) return "todo";
+			const resolved = deps(ctx);
+			if (!await resolved.instanceRunning()) return "todo";
+			const client = resolved.client(configured.url, {
+				kind: "api-key",
+				key: ctx.secrets.apiKey
+			});
+			try {
+				return (await client.tokenStatus.get()).valid ? "done" : "todo";
+			} catch (error) {
+				if (isNoTokenYet(error) || isRejectedCredential(error)) return "todo";
+				throw error;
+			}
+		},
+		async run(ctx) {
+			const configured = requireConfiguredRuntime(ctx.state);
+			const apiKey = requireApiKey$1(ctx);
+			const resolved = deps(ctx);
+			const client = resolved.client(configured.url, {
+				kind: "api-key",
+				key: apiKey
+			});
+			const status = await activateAskedToken(ctx, client, resolved.terminal);
+			if (status === null) {
+				await recordLiveLicense(ctx, client);
+				const lost = listOf(LICENSED_FEATURE_NAMES, "conjunction");
+				ctx.ui.info(`Skipping the license; ${lost} need one. Run \`rde init --from license\` to add it later`);
+				return { outcome: "skipped" };
+			}
+			await ctx.saveState({
+				...ctx.state,
+				license: licenseOf(status)
+			});
+			const mb = mbTool(resolved.runner);
+			if (isApiKeyLoginAt(await mb.authStatus(ctx.state.mbProfile), configured.url)) await mb.authLogin({
+				url: configured.url,
+				profile: ctx.state.mbProfile,
+				apiKey
+			});
+			reportFeatures(ctx, status.features);
+			return { outcome: "completed" };
+		}
+	};
+}
+//#endregion
 //#region src/steps/git-sync.ts
-const STEP_ID$7 = "git-sync";
+const STEP_ID$6 = "git-sync";
 const GIT_SYNC_KEYS = {
-	location: `${STEP_ID$7}.location`,
-	path: `${STEP_ID$7}.path`,
-	remote: `${STEP_ID$7}.remote`,
-	url: `${STEP_ID$7}.url`,
-	token: `${STEP_ID$7}.token`
+	location: `${STEP_ID$6}.location`,
+	path: `${STEP_ID$6}.path`,
+	remote: `${STEP_ID$6}.remote`,
+	url: `${STEP_ID$6}.url`,
+	token: `${STEP_ID$6}.token`
 };
 const BARE_REPO_NAME = "content.git";
 const DEFAULT_BRANCH = "main";
@@ -5745,6 +6079,7 @@ const README_NAME = "README.md";
 const README_CONTENT = "# Metabase content\n\nMetabase content synced by rde.\n";
 const INITIAL_COMMIT_MESSAGE = "Initial commit";
 const GITIGNORE_NAME = ".gitignore";
+const EXCLUDE_GIT_PATH = "info/exclude";
 const IGNORED_PATHS = [
 	".env",
 	".env.local",
@@ -5765,11 +6100,8 @@ const TERMINAL_TASK_STATUSES = /* @__PURE__ */ new Set([
 	"timed-out",
 	"conflict"
 ]);
-const SYNC_MODE_SETTINGS = {
-	"remote-sync-type": "read-write",
-	"remote-sync-transforms": true
-};
-function hostDeps$12(ctx) {
+const SYNC_MODE_SETTINGS = { "remote-sync-type": "read-write" };
+function hostDeps$11(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
@@ -6007,20 +6339,21 @@ function hostedScreen(run) {
 		}
 	};
 }
-async function ignoreDataAppFiles(workdir) {
-	const path = join(workdir, GITIGNORE_NAME);
+async function ignoreDataAppFiles(path) {
 	const existing = await readTextFile(path);
 	const present = new Set(existing === null ? [] : existing.split("\n").map((line) => line.trim()));
 	const missing = IGNORED_PATHS.filter((entry) => !present.has(entry));
 	if (missing.length === 0) return;
 	const separator = existing === null || existing.endsWith("\n") ? "" : "\n";
+	await promises.mkdir(dirname(path), { recursive: true });
 	await promises.appendFile(path, `${separator}${missing.join("\n")}\n`);
 }
 async function prepareWorkdir(run, workdir) {
 	if (!await run.git.isRepo(workdir)) await run.git.init(workdir, { branch: DEFAULT_BRANCH });
-	if (!await run.git.hasCommits(workdir)) {
+	if (await run.git.hasCommits(workdir)) await ignoreDataAppFiles(await run.git.gitPath(workdir, EXCLUDE_GIT_PATH));
+	else {
 		await promises.writeFile(join(workdir, README_NAME), README_CONTENT);
-		await ignoreDataAppFiles(workdir);
+		await ignoreDataAppFiles(join(workdir, GITIGNORE_NAME));
 		await run.git.commitPaths(workdir, [README_NAME, GITIGNORE_NAME], INITIAL_COMMIT_MESSAGE);
 	}
 	return {
@@ -6074,12 +6407,9 @@ async function cloneHosted(run, workdir, credentials) {
 		throw error;
 	}
 	spinner.stop(`Cloned into ${workdir}`);
-	if (await run.git.hasCommits(workdir)) return {
-		workdir,
-		branch: await run.git.currentBranch(workdir)
-	};
+	const hadCommits = await run.git.hasCommits(workdir);
 	const prepared = await prepareWorkdir(run, workdir);
-	await run.git.push(workdir, ORIGIN, prepared.branch, credentials);
+	if (!hadCommits) await run.git.push(workdir, ORIGIN, prepared.branch, credentials);
 	return prepared;
 }
 async function adoptRepository(run, workdir, url) {
@@ -6158,7 +6488,8 @@ function unfinishedImport(outcome) {
 }
 async function importExistingContent(run, gitRemote) {
 	if (!await remoteHasContent(run, gitRemote)) {
-		run.ctx.ui.info(`The repository holds no Metabase content yet; the first \`${exportCommand(run.ctx.state.mbProfile, gitRemote.branch)}\` populates it`);
+		await run.client.remoteSync.syncTransforms();
+		run.ctx.ui.info(`Nothing to import from the repository; \`${exportCommand(run.ctx.state.mbProfile, gitRemote.branch)}\` publishes this Metabase's content to it`);
 		return;
 	}
 	const spinner = run.ctx.ui.spinner("Importing the repository's content into Metabase…");
@@ -6206,6 +6537,9 @@ function configureRemote(run, runtime, model) {
 function isMbUnavailable(error) {
 	return error instanceof ProcessNotFoundError || error instanceof ExternalToolError;
 }
+function remoteSyncGap(license) {
+	return license.activated ? "Remote sync needs a license with the remote-sync feature, and this instance's license lacks it" : "Remote sync needs a license, and this instance has no valid one";
+}
 async function runGitSync(ctx, deps) {
 	const configured = requireConfiguredRuntime(ctx.state);
 	const instance = mbInstanceOf(ctx.state, ctx.secrets);
@@ -6220,6 +6554,8 @@ async function runGitSync(ctx, deps) {
 		}),
 		instance
 	};
+	const license = await recordLiveLicense(ctx, run.client);
+	if (!hasRemoteSync(license)) throw new ConfigError(`${remoteSyncGap(license)}; \`rde init --from license\` activates one`);
 	const flow = await runFlow({
 		remote: remoteScreen(run),
 		hosted: hostedScreen(run),
@@ -6239,15 +6575,15 @@ async function runGitSync(ctx, deps) {
 	ctx.ui.note(usageLines(ctx.state, remote.gitRemote).join("\n"), "Working with the repository");
 	return "completed";
 }
-function gitSyncStep(deps = hostDeps$12) {
+function gitSyncStep(deps = hostDeps$11) {
 	return {
-		id: STEP_ID$7,
+		id: STEP_ID$6,
 		title: "Connect a git repository",
 		redoHint: "`rde init --only git-sync` with it points Metabase's remote sync at that repository instead.",
 		async detect(ctx) {
 			if (!hasRemoteSync(ctx.state.license)) return "not-applicable";
-			if (ctx.state.steps[STEP_ID$7]?.status === "skipped") return "not-applicable";
-			if (ctx.state.gitRemote === null || ctx.state.steps[STEP_ID$7]?.status !== "done") return "todo";
+			if (ctx.state.steps[STEP_ID$6]?.status === "skipped") return "not-applicable";
+			if (ctx.state.gitRemote === null || ctx.state.steps[STEP_ID$6]?.status !== "done") return "todo";
 			const instance = mbInstanceOf(ctx.state, ctx.secrets);
 			if (instance === null) return "todo";
 			try {
@@ -6291,21 +6627,20 @@ function githubContents(signal, options = {}) {
 //#region src/tools/skills-cli.ts
 const NPX = "npx";
 const SKILLS_PACKAGE = "skills@latest";
+const LIST_INTERNAL_SKILLS = { INSTALL_INTERNAL_SKILLS: "1" };
 const DEFAULT_RDE_SKILL_SOURCE = "https://github.com/metabase/agent-skills/tree/main";
-const RDE_SOURCE_SKILL_NAMES = ["rde", "rde-data-apps"];
-const DATA_APP_REPOSITORY = "metabase/metabase";
-const DATA_APP_BRANCH = "master";
-const DATA_APP_SKILLS_SOURCE = `${DATA_APP_REPOSITORY}/skills#${DATA_APP_BRANCH}`;
-const DATA_APP_SKILL_NAMES = [
-	"metabase-data-app-setup",
-	"metabase-data-app-routing",
-	"metabase-data-app-actions",
-	"metabase-data-app-semantic-layer",
-	"metabase-data-app-migrate"
-];
+const RDE_SKILL_NAME = "metabase-rde";
+const DATA_APPS_SKILL_NAME = "metabase-data-apps";
+const RDE_INSTALLED_SKILL_NAMES = [DATA_APPS_SKILL_NAME, RDE_SKILL_NAME];
+const REPLACED_RDE_SKILL_NAMES = ["rde", "rde-data-apps"];
+const RDE_OWNED_SKILL_NAMES = [...RDE_INSTALLED_SKILL_NAMES, ...REPLACED_RDE_SKILL_NAMES];
+const SKILL_VERSIONS = {
+	[DATA_APPS_SKILL_NAME]: 1,
+	[RDE_SKILL_NAME]: 1
+};
+const SOURCE_SKILLS_DIR = "skills";
 function rdeSkillSource() {
-	const override = readEnv(ENV_RDE_SKILL_SOURCE);
-	return override === void 0 || override.length === 0 ? DEFAULT_RDE_SKILL_SOURCE : override;
+	return readSetEnv("RDE_SKILL_SOURCE") ?? "https://github.com/metabase/agent-skills/tree/main";
 }
 const InstalledSkill = z.object({
 	name: z.string(),
@@ -6331,8 +6666,7 @@ function projectSkillLockPath(project) {
 	return join(project, PROJECT_LOCK_FILE);
 }
 function xdgStateHome() {
-	const value = readEnv(ENV_XDG_STATE_HOME);
-	return value === void 0 || value.length === 0 ? null : value;
+	return readSetEnv(ENV_XDG_STATE_HOME);
 }
 function lockedSkill(path, raw, skill) {
 	if (raw === null) return null;
@@ -6344,11 +6678,6 @@ const hostSkillFiles = {
 	readJson: readJsonFile,
 	readText: readTextFile
 };
-const DATA_APP_SKILLS_ORIGIN = {
-	kind: "github",
-	repository: DATA_APP_REPOSITORY,
-	ref: DATA_APP_BRANCH
-};
 const GITHUB_URL = /^https:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?(?:\/tree\/([^/]+)(?:\/.*)?)?\/?$/;
 function skillOrigin(source, cwd) {
 	const github = GITHUB_URL.exec(source);
@@ -6369,6 +6698,23 @@ function skillOrigin(source, cwd) {
 		source
 	};
 }
+function sourceSkillDirectory(skill) {
+	return posix.join(SOURCE_SKILLS_DIR, skill, `v${SKILL_VERSIONS[skill]}`);
+}
+function skillSource(rdeSource, skill, cwd) {
+	const directory = sourceSkillDirectory(skill);
+	const origin = skillOrigin(rdeSource, cwd);
+	switch (origin.kind) {
+		case "github":
+			if (origin.ref === null) throw new ConfigError(`RDE_SKILL_SOURCE must name a branch: https://github.com/${origin.repository}/tree/<branch>`);
+			return `https://github.com/${origin.repository}/tree/${origin.ref}/${directory}`;
+		case "local": return join(origin.path, directory);
+		case "other": {
+			const [path, ref] = origin.source.split("#", 2);
+			return ref === void 0 ? `${path}/${directory}` : `${path}/${directory}#${ref}`;
+		}
+	}
+}
 function skillsCli(runner) {
 	async function add(options) {
 		const argv = [
@@ -6402,7 +6748,10 @@ function skillsCli(runner) {
 			"-g",
 			"--json"
 		];
-		const result = await runner.run(NPX, argv, { stdoutToFile: true });
+		const result = await runner.run(NPX, argv, {
+			stdoutToFile: true,
+			addedEnv: LIST_INTERNAL_SKILLS
+		});
 		if (result.exitCode !== 0) throw toolFailure(NPX, argv, result);
 		return parseJsonOutput(NPX, argv, result.stdout, InstalledSkillList);
 	}
@@ -6415,7 +6764,8 @@ function skillsCli(runner) {
 		];
 		const result = await runner.run(NPX, argv, {
 			cwd,
-			stdoutToFile: true
+			stdoutToFile: true,
+			addedEnv: LIST_INTERNAL_SKILLS
 		});
 		if (result.exitCode !== 0) throw toolFailure(NPX, argv, result);
 		return parseJsonOutput(NPX, argv, result.stdout, InstalledSkillList);
@@ -6429,12 +6779,29 @@ function skillsCli(runner) {
 }
 //#endregion
 //#region src/steps/agents-skills.ts
-const STEP_ID$6 = "agents-skills";
-const AGENTS_SKILLS_KEYS = { agents: `${STEP_ID$6}.agents` };
+const STEP_ID$5 = "agents-skills";
+const AGENTS_SKILLS_KEYS = { agents: `${STEP_ID$5}.agents` };
 const MECHANICS_NOTE = "The rde skill's mechanics come from `mb skills get <name>` at runtime, so nothing else needs installing.";
-const REQUIRED_SKILL_NAMES = [...DATA_APP_SKILL_NAMES, ...RDE_SOURCE_SKILL_NAMES];
+const REQUIRED_SKILL_NAMES = RDE_INSTALLED_SKILL_NAMES;
+const LEGACY_DATA_APP_REPOSITORY = "metabase/metabase";
+const LEGACY_DATA_APP_SKILL_NAMES = [
+	"metabase-data-app-setup",
+	"metabase-data-app-routing",
+	"metabase-data-app-actions",
+	"metabase-data-app-semantic-layer",
+	"metabase-data-app-migrate"
+];
+const REPLACED_RDE_NAMES = REPLACED_RDE_SKILL_NAMES;
+const REPLACEMENTS = [{
+	by: DATA_APPS_SKILL_NAME,
+	names: LEGACY_DATA_APP_SKILL_NAMES
+}, {
+	by: RDE_SKILL_NAME,
+	names: REPLACED_RDE_NAMES
+}];
 const DETECT_AGENTS = { kind: "detected" };
-function hostDeps$11(ctx) {
+const ASK_AGENTS = { kind: "ask" };
+function hostDeps$10(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
 		probe: hostAgentProbe(),
@@ -6458,9 +6825,6 @@ function skillCoversAgent(entry, agent) {
 function coversAny(entry, agents) {
 	return agents.some((agent) => skillCoversAgent(entry, agent));
 }
-async function rdeSkillEntries(runner) {
-	return (await skillsCli(runner).list()).filter((entry) => entry.name === "rde");
-}
 function requiredEntries(installed) {
 	return installed.filter((entry) => REQUIRED_SKILL_NAMES.includes(entry.name));
 }
@@ -6477,20 +6841,17 @@ function coveredAgentNames(entry, agents) {
 function installedLines(entries, agents) {
 	return entries.map((entry) => `${entry.name} (${coveredAgentNames(entry, agents).join(", ")}): ${entry.path}`).join("\n");
 }
-function skillSets(deps) {
-	return [{
-		label: "data-app",
-		source: DATA_APP_SKILLS_SOURCE,
-		sourceNote: "",
-		origin: DATA_APP_SKILLS_ORIGIN,
-		skills: DATA_APP_SKILL_NAMES
-	}, {
-		label: "rde",
-		source: deps.skillSource,
-		sourceNote: deps.skillSource === "https://github.com/metabase/agent-skills/tree/main" ? "" : ` from ${deps.skillSource}`,
-		origin: skillOrigin(deps.skillSource, deps.cwd),
-		skills: RDE_SOURCE_SKILL_NAMES
-	}];
+function skillInstalls(deps) {
+	const defaultSource = deps.skillSource === DEFAULT_RDE_SKILL_SOURCE;
+	return RDE_INSTALLED_SKILL_NAMES.map((skill) => {
+		const source = skillSource(deps.skillSource, skill, deps.cwd);
+		return {
+			skill,
+			source,
+			sourceNote: ` from ${defaultSource ? sourceSkillDirectory(skill) : source}`,
+			origin: skillOrigin(source, deps.cwd)
+		};
+	});
 }
 function hashLookup(github) {
 	const asked = /* @__PURE__ */ new Map();
@@ -6515,7 +6876,8 @@ async function readLockedSkills(deps) {
 	const lockPath = globalSkillLockPath(deps.probe.home, deps.stateHome);
 	try {
 		const lock = await deps.files.readJson(lockPath);
-		return new Map(REQUIRED_SKILL_NAMES.map((name) => [name, lockedSkill(lockPath, lock, name)]));
+		const names = [...REQUIRED_SKILL_NAMES, ...LEGACY_DATA_APP_SKILL_NAMES];
+		return new Map(names.map((name) => [name, lockedSkill(lockPath, lock, name)]));
 	} catch (error) {
 		if (error instanceof ConfigError) return null;
 		throw error;
@@ -6535,25 +6897,54 @@ function lockedCopy(locked, origin) {
 		hash: locked.skillFolderHash
 	};
 }
-async function setBehind(set, check) {
-	const { origin } = set;
+async function installBehind(install, check) {
+	const { origin } = install;
 	if (origin.kind !== "github" || check.locked === null) return true;
-	const copies = [];
-	for (const skill of set.skills) {
-		const copy = lockedCopy(check.locked.get(skill) ?? null, origin);
-		if (copy === null) return true;
-		copies.push(copy);
-	}
+	const copy = lockedCopy(check.locked.get(install.skill) ?? null, origin);
+	if (copy === null) return true;
 	if (check.updates === "installed") return false;
-	for (const copy of copies) {
-		const current = await check.hashes(origin.repository, copy.ref, copy.directory);
-		if (current !== null && current.get(copy.folder) !== copy.hash) return true;
+	const current = await check.hashes(origin.repository, copy.ref, copy.directory);
+	return current !== null && current.get(copy.folder) !== copy.hash;
+}
+function isLegacyDataAppCopy(name, source) {
+	return LEGACY_DATA_APP_SKILL_NAMES.includes(name) && source === LEGACY_DATA_APP_REPOSITORY;
+}
+function isReplacedRdeCopy(name) {
+	return REPLACED_RDE_NAMES.includes(name);
+}
+function replacedCopies(installed, locked) {
+	const found = /* @__PURE__ */ new Map();
+	for (const { by, names } of REPLACEMENTS) {
+		const present = names.filter((name) => by === "metabase-data-apps" ? isLegacyDataAppCopy(name, locked?.get(name)?.source) : installed.some((entry) => entry.name === name));
+		if (present.length > 0) found.set(by, present);
 	}
-	return false;
+	return found;
 }
 function hasSkill(installed, skill, agent) {
 	return installed.some((entry) => entry.name === skill && skillCoversAgent(entry, agent));
 }
+function splitReplaced(by, replaced, installed, all) {
+	const split = {
+		removable: [],
+		kept: [],
+		uncovered: []
+	};
+	for (const name of replaced) {
+		const copies = installed.filter((entry) => entry.name === name);
+		const uncovered = all.filter((agent) => copies.some((entry) => skillCoversAgent(entry, agent)) && !hasSkill(installed, by, agent));
+		if (uncovered.length === 0) {
+			split.removable.push(name);
+			continue;
+		}
+		split.kept.push(name);
+		for (const agent of uncovered) if (!split.uncovered.includes(agent)) split.uncovered.push(agent);
+	}
+	return split;
+}
+function keptReplacedLine(by, split) {
+	const ids = split.uncovered.map((agent) => agent.id).join(",");
+	return `${by} is not installed for ${displayNames(split.uncovered)}, so rde keeps ${split.kept.join(", ")}; \`rde init --only ${STEP_ID$5} --agents ${ids}\` installs it there and removes what it replaces`;
+}
 function coversAll(installed, skills, agents) {
 	return agents.every((agent) => skills.every((skill) => hasSkill(installed, skill, agent)));
 }
@@ -6613,13 +7004,13 @@ function skipLine(all, source) {
 	switch (source) {
 		case "override":
 		case "chosen":
-		case "installed": return `Skipping the skills; run \`rde init --only ${STEP_ID$6}\` to install it later`;
-		case "detected": return `No coding agent found (${displayNames(all)}); run \`rde init --only ${STEP_ID$6} --agents <name>\` once one is installed`;
+		case "installed": return `Skipping the skills; run \`rde init --only ${STEP_ID$5}\` to install it later`;
+		case "detected": return `No coding agent found (${displayNames(all)}); run \`rde init --only ${STEP_ID$5} --agents <name>\` once one is installed`;
 	}
 }
-function agentsSkillsStep(options, updates, deps = hostDeps$11) {
+function agentsSkillsStep(options, updates, deps = hostDeps$10) {
 	let hashes = null;
-	async function setCheck(resolved) {
+	async function installCheck(resolved) {
 		hashes ??= hashLookup(resolved.github);
 		return {
 			updates,
@@ -6628,16 +7019,18 @@ function agentsSkillsStep(options, updates, deps = hostDeps$11) {
 		};
 	}
 	return {
-		id: STEP_ID$6,
+		id: STEP_ID$5,
 		title: "Install the rde and data-app skills for your coding agents",
 		redoHint: "`rde init --only agents-skills` with it installs the skills for those agents.",
 		async detect(ctx) {
 			const resolved = deps(ctx);
 			const detected = detectedOnly(await detectAgents(resolved.probe));
-			if (detected.length === 0) return ctx.state.steps[STEP_ID$6]?.status === "skipped" ? "not-applicable" : "todo";
-			if (missingSkills(await skillsCli(resolved.runner).list(), detected).length > 0) return "todo";
-			const check = await setCheck(resolved);
-			for (const set of skillSets(resolved)) if (await setBehind(set, check)) return "outdated";
+			if (detected.length === 0) return ctx.state.steps[STEP_ID$5]?.status === "skipped" ? "not-applicable" : "todo";
+			const installed = await skillsCli(resolved.runner).list();
+			if (missingSkills(installed, detected).length > 0) return "todo";
+			const check = await installCheck(resolved);
+			if (replacedCopies(installed, check.locked).size > 0) return "outdated";
+			for (const install of skillInstalls(resolved)) if (await installBehind(install, check)) return "outdated";
 			return "done";
 		},
 		async run(ctx) {
@@ -6652,28 +7045,37 @@ function agentsSkillsStep(options, updates, deps = hostDeps$11) {
 				return { outcome: "skipped" };
 			}
 			const before = await installedNow();
-			const check = await setCheck(resolved);
+			const check = await installCheck(resolved);
 			const pending = [];
-			for (const set of skillSets(resolved)) if (!coversAll(before, set.skills, selection.agents) || await setBehind(set, check)) pending.push(set);
+			for (const install of skillInstalls(resolved)) if (!coversAll(before, [install.skill], selection.agents) || await installBehind(install, check)) pending.push(install);
+			const replaced = replacedCopies(before, check.locked);
 			const names = displayNames(selection.agents);
-			if (pending.length === 0) {
+			if (pending.length === 0 && replaced.size === 0) {
 				ctx.ui.success(`The rde and data-app skills are current for ${names}`);
 				return { outcome: "completed" };
 			}
 			const agents = selection.agents.map((agent) => agent.skillsCliName);
 			const forWhom = `for ${names} (${SOURCE_NOTES[selection.source]})`;
-			for (const set of pending) {
-				ctx.ui.info(`Installing the ${set.label} skills ${forWhom}${set.sourceNote}`);
+			for (const install of pending) {
+				ctx.ui.info(`Installing ${install.skill} ${forWhom}${install.sourceNote}`);
 				await skills.add({
-					source: set.source,
-					skills: set.skills,
+					source: install.source,
+					skills: [install.skill],
 					agents,
 					output: ctx.ui.childOutput
 				});
 			}
-			const installed = await skills.list();
+			const installed = pending.length === 0 ? before : await skills.list();
 			const missing = unlistedSkills(installed);
 			if (missing.length > 0) throw new ConfigError(`the skills installer finished but \`skills list\` does not show ${missing.join(", ")}`);
+			for (const [by, old] of replaced) {
+				const split = splitReplaced(by, old, installed, all);
+				if (split.removable.length > 0) {
+					ctx.ui.info(`Removing ${split.removable.join(", ")}, which ${by} replaces`);
+					await skills.remove(split.removable, ctx.ui.childOutput);
+				}
+				if (split.kept.length > 0) ctx.ui.warn(keptReplacedLine(by, split));
+			}
 			ctx.ui.note(installedLines(requiredEntries(installed), selection.agents), "Skills installed");
 			ctx.ui.info(MECHANICS_NOTE);
 			return { outcome: "completed" };
@@ -6693,7 +7095,7 @@ function hostDatabasesDeps(signal) {
 		now: () => /* @__PURE__ */ new Date()
 	};
 }
-function requireApiKey$1(state, apiKey) {
+function requireApiKey(state, apiKey) {
 	if (apiKey === null) throw new ConfigError(`instance ${state.name} has no API key yet; run \`rde init\``);
 	return apiKey;
 }
@@ -6715,7 +7117,7 @@ function authenticatedClient(state, apiKey, deps) {
 	const configured = requireConfiguredRuntime(state);
 	return deps.client(configured.url, {
 		kind: "api-key",
-		key: requireApiKey$1(state, apiKey)
+		key: requireApiKey(state, apiKey)
 	});
 }
 async function listDatabases(state, apiKey, deps) {
@@ -6791,13 +7193,13 @@ async function connectRequired(ctx, deps, opening) {
 		result: { addedDatabases: connected.added }
 	};
 }
-function hostDeps$10(ctx) {
+function hostDeps$9(ctx) {
 	return {
 		...hostDatabasesDeps(ctx.signal),
 		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal))
 	};
 }
-function databasesStep(options, deps = hostDeps$10) {
+function databasesStep(options, deps = hostDeps$9) {
 	return {
 		id: "databases",
 		title: "Connect your databases",
@@ -6860,8 +7262,8 @@ function npmRegistry(signal, options = {}) {
 }
 //#endregion
 //#region src/steps/install-mb.ts
-const STEP_ID$5 = "install-mb";
-const MIN_MB_VERSION = "0.3.0";
+const STEP_ID$4 = "install-mb";
+const MIN_MB_VERSION = "0.5.1";
 const MB_RANGE = `>=${MIN_MB_VERSION}`;
 function installedWith(scriptPath) {
 	return scriptPath === void 0 ? "npm" : packageManagerFor(scriptPath);
@@ -6869,7 +7271,7 @@ function installedWith(scriptPath) {
 function rdeInstalledWith() {
 	return installedWith(process.argv[1]);
 }
-function hostDeps$9(ctx) {
+function hostDeps$8(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
 		installedWith: rdeInstalledWith(),
@@ -6923,6 +7325,33 @@ function updateTo(release, installed) {
 function displayCommand(install) {
 	return [install.command, ...install.args].join(" ");
 }
+const NPM_EACCES_EXIT = 243;
+const NPM_PERMISSION_TEXT = [
+	"EACCES",
+	"EPERM",
+	"might be a permissions issue"
+];
+function deniedGlobalWrite(install, error) {
+	if (install.command !== "npm" || !(error instanceof ExternalToolError)) return false;
+	return NPM_PERMISSION_TEXT.some((text) => error.stderrTail.includes(text)) || error.exitCode === NPM_EACCES_EXIT;
+}
+function globalWriteDenied(install) {
+	return new ConfigError([
+		`\`${displayCommand(install)}\` failed because npm cannot write its global directory.`,
+		"Give npm a prefix you own with `npm config set prefix ~/.npm-global`,",
+		"add ~/.npm-global/bin to PATH and open a new terminal,",
+		"or install Node with a version manager such as nvm, fnm or mise;",
+		"then run rde init again."
+	].join(" "));
+}
+async function installMb(install, ctx, deps) {
+	try {
+		await runShown(deps.runner, ctx.ui.childOutput, install.command, install.args);
+	} catch (error) {
+		if (deniedGlobalWrite(install, error)) throw globalWriteDenied(install);
+		throw error;
+	}
+}
 async function versionAt(runner, path) {
 	try {
 		const raw = await mbTool(runner).version(path);
@@ -7036,7 +7465,7 @@ async function updateFor(release, installed, deps) {
 		version
 	};
 }
-function installMbStep(updates, deps = hostDeps$9) {
+function installMbStep(updates, deps = hostDeps$8) {
 	let published = null;
 	function release(resolved) {
 		if (updates === "installed") return Promise.resolve(UNCHECKED);
@@ -7044,7 +7473,7 @@ function installMbStep(updates, deps = hostDeps$9) {
 		return published;
 	}
 	return {
-		id: STEP_ID$5,
+		id: STEP_ID$4,
 		title: "Install the Metabase CLI",
 		async detect(ctx) {
 			const resolved = deps(ctx);
@@ -7071,7 +7500,7 @@ function installMbStep(updates, deps = hostDeps$9) {
 			} else if (before.installed) ctx.ui.warn(`mb ${before.version} is installed; ${MIN_MB_VERSION} or newer is required`);
 			const install = mbInstallCommand(resolved.installedWith);
 			ctx.ui.info(`Running ${displayCommand(install)}`);
-			await runShown(resolved.runner, ctx.ui.childOutput, install.command, install.args);
+			await installMb(install, ctx, resolved);
 			const after = await inspectMb(resolved.runner);
 			if (!after.installed || !after.satisfies) throw await stillWrong(install, after, resolved);
 			const stillNewer = updateTo(target, after.version);
@@ -7085,171 +7514,6 @@ function installMbStep(updates, deps = hostDeps$9) {
 	};
 }
 //#endregion
-//#region src/steps/license.ts
-const STEP_ID$4 = "license";
-const LICENSE_KEYS = { token: `${STEP_ID$4}.token` };
-const TOKEN_PATTERN = /^[0-9a-f]{64}$/i;
-const NOT_FOUND_STATUS$1 = 404;
-const TOKEN_REFUSED_STATUS = 400;
-const STORE_UNREACHABLE_STATUS = 503;
-const TOKEN_CHECK_HOST = "token-check.metabase.com";
-const ACTIVATION_FAILED = "License activation failed";
-const LICENSED_FEATURES = {
-	[REMOTE_SYNC_FEATURE]: "remote sync",
-	"data-apps": "data apps",
-	"transforms-testing": "transform tests"
-};
-const LICENSED_FEATURE_NAMES = Object.values(LICENSED_FEATURES);
-function licensedFeatureCoverage(features) {
-	const entries = Object.entries(LICENSED_FEATURES);
-	return {
-		included: entries.filter(([key]) => features.includes(key)).map(([, name]) => name),
-		missing: entries.filter(([key]) => !features.includes(key)).map(([, name]) => name)
-	};
-}
-function listOf(names, type) {
-	return new Intl.ListFormat("en", { type }).format(names);
-}
-function hostDeps$8(ctx) {
-	return {
-		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
-		runner: processRunner(ctx.signal),
-		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal)),
-		terminal: stdinIsTty()
-	};
-}
-function isNoTokenYet(error) {
-	if (error instanceof MetabaseApiError) return error.status === NOT_FOUND_STATUS$1;
-	return isMetabaseNotServing(error);
-}
-function validateToken(value) {
-	if (value.length === 0 || TOKEN_PATTERN.test(value)) return;
-	return "A license token is 64 hexadecimal characters";
-}
-function requireApiKey(ctx) {
-	if (ctx.secrets.apiKey === null) throw new ConfigError("no API key yet; the api-key step comes first");
-	return ctx.secrets.apiKey;
-}
-function activeLabel(status) {
-	const plan = status["plan-alias"];
-	return plan === void 0 ? "License active" : `License active (plan ${plan})`;
-}
-function refusalOf(error) {
-	if (!(error instanceof MetabaseApiError)) return null;
-	if (error.status === TOKEN_REFUSED_STATUS) return new ConfigError(`The license token was refused: ${error.reason}`);
-	if (error.status === STORE_UNREACHABLE_STATUS) return new ConfigError(`The instance could not reach ${TOKEN_CHECK_HOST} to check the license token; it needs outbound network access`);
-	return null;
-}
-async function activate(client, token) {
-	try {
-		await client.setting.setPremiumEmbeddingToken(token);
-	} catch (error) {
-		const refusal = refusalOf(error);
-		if (refusal === null) throw error;
-		return {
-			kind: "refused",
-			error: refusal
-		};
-	}
-	const status = await client.tokenStatus.get();
-	if (!status.valid) return {
-		kind: "refused",
-		error: new ConfigError(`Metabase reports the token as ${status.status}`)
-	};
-	return {
-		kind: "activated",
-		status
-	};
-}
-async function activateAskedToken(ctx, client, terminal) {
-	const token = await ctx.prompts.password({
-		key: LICENSE_KEYS.token,
-		message: "Paste your Metabase license token (Enter to skip)",
-		validate: validateToken
-	});
-	if (token.length === 0) return null;
-	const spinner = ctx.ui.spinner("Activating the license…");
-	let activation;
-	try {
-		activation = await activate(client, token);
-	} catch (error) {
-		spinner.fail(ACTIVATION_FAILED);
-		throw error;
-	}
-	if (activation.kind === "activated") {
-		spinner.stop(activeLabel(activation.status));
-		ctx.session.licenseToken.set(token);
-		return activation.status;
-	}
-	spinner.fail(ACTIVATION_FAILED);
-	if (!terminal) throw activation.error;
-	ctx.ui.warn(activation.error.message);
-	return activateAskedToken(ctx, client, terminal);
-}
-function reportFeatures(ctx, features) {
-	const { missing } = licensedFeatureCoverage(features);
-	const remoteSync = features.includes(REMOTE_SYNC_FEATURE);
-	if (remoteSync) ctx.ui.info("Remote sync is included; the git step will set it up");
-	if (missing.length > 0) {
-		const gitNote = remoteSync ? "" : "; the git step will be skipped";
-		ctx.ui.warn(`This license does not include ${listOf(missing, "disjunction")}${gitNote}`);
-	}
-}
-function licenseStep(deps = hostDeps$8) {
-	return {
-		id: STEP_ID$4,
-		title: "Activate your license",
-		redoHint: "`rde init --from license` with it activates the license and runs the steps after it again.",
-		async detect(ctx) {
-			if (ctx.state.steps[STEP_ID$4]?.status === "skipped") return "not-applicable";
-			const configured = configuredRuntime(ctx.state);
-			if (configured === null || ctx.secrets.apiKey === null) return "todo";
-			const resolved = deps(ctx);
-			if (!await resolved.instanceRunning()) return "todo";
-			const client = resolved.client(configured.url, {
-				kind: "api-key",
-				key: ctx.secrets.apiKey
-			});
-			try {
-				return (await client.tokenStatus.get()).valid ? "done" : "todo";
-			} catch (error) {
-				if (isNoTokenYet(error) || isRejectedCredential(error)) return "todo";
-				throw error;
-			}
-		},
-		async run(ctx) {
-			const configured = requireConfiguredRuntime(ctx.state);
-			const apiKey = requireApiKey(ctx);
-			const resolved = deps(ctx);
-			const status = await activateAskedToken(ctx, resolved.client(configured.url, {
-				kind: "api-key",
-				key: apiKey
-			}), resolved.terminal);
-			if (status === null) {
-				const lost = listOf(LICENSED_FEATURE_NAMES, "conjunction");
-				ctx.ui.info(`Skipping the license; ${lost} need one. Run \`rde init --from license\` to add it later`);
-				return { outcome: "skipped" };
-			}
-			await ctx.saveState({
-				...ctx.state,
-				license: {
-					activated: true,
-					features: status.features,
-					validThru: status["valid-thru"] ?? null
-				}
-			});
-			const mb = mbTool(resolved.runner);
-			if (isApiKeyLoginAt(await mb.authStatus(ctx.state.mbProfile), configured.url)) await mb.authLogin({
-				url: configured.url,
-				profile: ctx.state.mbProfile,
-				apiKey
-			});
-			reportFeatures(ctx, status.features);
-			return { outcome: "completed" };
-		}
-	};
-}
-//#endregion
 //#region src/steps/preflight.ts
 const MIN_NODE_VERSION = "20.19.0";
 const NODE_RANGE = `>=${MIN_NODE_VERSION}`;
@@ -7480,22 +7744,56 @@ async function chooseKind(ctx, options, runtime) {
 	ctx.ui.info(`Docker is not available (${available.docker.reason}); using the jar runtime with ${javaLabel(available.java)}`);
 	return "jar";
 }
-function chooseImage(ctx, options) {
+const NAME_ONE = "`--image <image>` or `--jar <release tag>` names a Metabase to run";
+const INIT_WAYS_OUT = {
+	named: NAME_ONE,
+	unreleased: `${NAME_ONE}, and \`RDE_DEV=1\` runs the development build`
+};
+function isFeedFailure(error) {
+	return error instanceof MetabaseApiError || error instanceof MetabaseUnreachableError;
+}
+async function requireNewestRelease(releases, waysOut) {
+	let newest;
+	try {
+		newest = await releases.newestSupportedRelease();
+	} catch (error) {
+		if (!isFeedFailure(error)) throw error;
+		throw new ConfigError(`the Metabase release feed could not be read (${error.reason}); ${waysOut.named}`);
+	}
+	if (newest === null) throw new ConfigError(`no release of Metabase Enterprise 65 or newer is out yet; ${waysOut.unreleased}`);
+	return newest;
+}
+async function releaseImage(ctx, releases, waysOut) {
+	const newest = await requireNewestRelease(releases, waysOut);
+	const image = majorLineImage(newest.major);
+	ctx.ui.info(`The newest Metabase release is ${newest.version}; ${image} carries the newest build of ${newest.major}`);
+	return image;
+}
+async function latestJarRelease(ctx, releases, waysOut) {
+	if (developmentMode()) {
+		const version = await releases.latestVersion();
+		ctx.ui.info(`The latest Metabase release is ${version}`);
+		return version;
+	}
+	const newest = await requireNewestRelease(releases, waysOut);
+	ctx.ui.info(`The newest Metabase release is ${newest.version}`);
+	return newest.version;
+}
+async function chooseImage(ctx, options, releases) {
 	if (options.image !== null) {
 		ctx.ui.info(`Using image ${options.image} from --image`);
 		return options.image;
 	}
-	return DEFAULT_IMAGE;
+	if (developmentMode()) return DEVELOPMENT_IMAGE;
+	return releaseImage(ctx, releases, INIT_WAYS_OUT);
 }
 async function resolveJar(ctx, spec, releases) {
 	const parsed = parseJarSpec(spec);
-	if (parsed === null) throw new ConfigError(`${spec} is not latest, a release tag such as v1.63.18, or the path of a .jar file`);
+	if (parsed === null) throw new ConfigError(`${spec} is not latest, an enterprise release tag such as v1.65.0, or the path of a .jar file`);
 	if (parsed.kind !== "latest") return parsed;
-	const version = await releases.latestVersion();
-	ctx.ui.info(`The latest Metabase release is ${version}`);
 	return {
 		kind: "release",
-		version
+		version: await latestJarRelease(ctx, releases, INIT_WAYS_OUT)
 	};
 }
 async function chooseJar(ctx, options, releases) {
@@ -7520,7 +7818,7 @@ async function chooseRuntime(ctx, options, deps) {
 	const kind = await chooseKind(ctx, options, deps.runtime);
 	switch (kind) {
 		case "docker": {
-			const image = chooseImage(ctx, options);
+			const image = await chooseImage(ctx, options, deps.releases);
 			const port = await choosePort(ctx, options, deps.runtime);
 			return {
 				kind,
@@ -7601,6 +7899,16 @@ function isNotHealthy(error) {
 async function runningVersion(client) {
 	return (await client.session.properties()).version.tag;
 }
+const PICK_ANOTHER = "`rde upgrade --to <image or release tag>` moves this instance to one, or `rde uninstall`, then `rde init --image <image>` or `rde init --jar <release tag>`, sets up a new instance on one";
+function unsupportedVersionReason(version, development) {
+	if (development) return null;
+	const needs = `rde needs Metabase Enterprise 65 or newer: ${PICK_ANOTHER}`;
+	if (isOpenSourceRelease(version)) return `Metabase ${version} is the open-source edition; ${needs}`;
+	if (isMasterBuild(version)) return `Metabase ${version} is a development build of master, which only development mode (RDE_DEV=1) runs; ${needs}`;
+	const major = releaseMajor(version);
+	if (major !== null && major < 65) return `Metabase ${version} is older than 65; ${needs}`;
+	return null;
+}
 function progressLabel(progress) {
 	return `Starting Metabase… ${Math.round(progress * PERCENT)}%`;
 }
@@ -7617,7 +7925,7 @@ async function startRuntime(ctx, runtime, deps) {
 		throw error;
 	}
 }
-function startMetabaseStep(deps = hostDeps$5) {
+function startMetabaseStep(deps = hostDeps$5, accepted = "supported") {
 	return {
 		id: "start-metabase",
 		title: "Start Metabase",
@@ -7669,6 +7977,11 @@ function startMetabaseStep(deps = hostDeps$5) {
 				...ctx.state,
 				version
 			});
+			const refusal = accepted === "supported" ? unsupportedVersionReason(version, developmentMode()) : null;
+			if (refusal !== null) {
+				spinner.fail(`Metabase ${version} is running at ${configured.url}, but rde does not run it`);
+				throw new UnsupportedMetabaseError(refusal);
+			}
 			spinner.stop(`Metabase ${version} is running at ${configured.url}`);
 			return { outcome: "completed" };
 		}
@@ -7678,10 +7991,8 @@ function startMetabaseStep(deps = hostDeps$5) {
 //#region src/steps/sync-scope.ts
 const STEP_ID$2 = "sync-scope";
 const SYNC_SCOPE_KEYS = { export: `${STEP_ID$2}.export` };
-const AGENT_COLLECTION_NAME = "Analytics";
 const LIBRARY_NAME = "Library";
 const ROOT_COLLECTION_NAME = "Our analytics";
-const AGENT_COLLECTION_DESCRIPTION = "Dashboards, questions, models, and documents that reach git on export.";
 function hostDeps$4(ctx) {
 	return {
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
@@ -7692,22 +8003,11 @@ function hostDeps$4(ctx) {
 function isCollection(entry) {
 	return typeof entry.id === "number";
 }
-function isOrdinary(collection) {
-	return collection.type === null && collection.namespace === null && collection.personal_owner_id === null;
+function findLibrary(list) {
+	return list.filter(isCollection).find((collection) => collection.location === "/" && collection.type === "library") ?? null;
 }
-function readScope(list, syncRoot) {
-	const topLevel = list.filter(isCollection).filter((collection) => collection.location === "/");
-	const ordinary = topLevel.filter(isOrdinary);
-	const unsynced = ordinary.filter((collection) => !collection.is_remote_synced);
-	return {
-		library: topLevel.find((collection) => collection.type === "library") ?? null,
-		syncedRoots: ordinary.filter((collection) => collection.is_remote_synced),
-		unsyncedRecordedRoot: unsynced.find((collection) => collection.id === syncRoot) ?? null,
-		foreignNamesake: unsynced.some((collection) => collection.id !== syncRoot && collection.name === "Analytics")
-	};
-}
-function isComplete(scope, libraryLicensed) {
-	return (!libraryLicensed || scope.library !== null && scope.library.is_remote_synced) && scope.syncedRoots.length > 0;
+function isComplete(library, libraryLicensed) {
+	return !libraryLicensed || library !== null && library.is_remote_synced;
 }
 function isNotAnsweringYet(error) {
 	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError || isRejectedCredential(error);
@@ -7736,34 +8036,8 @@ async function isReadOnly(client) {
 async function requireReadWrite(client) {
 	if (await isReadOnly(client)) throw new ConfigError(`remote sync is read-only; the repository decides what syncs. Switch it to read-write in Admin, then \`rde init --only ${STEP_ID$2}\``);
 }
-async function ensureLibrary(client, scope, libraryLicensed) {
-	if (!libraryLicensed) return null;
-	return scope.library ?? client.collection.createLibrary();
-}
-async function ensureRoots(ctx, client, scope) {
-	if (scope.syncedRoots.length > 0) return {
-		roots: scope.syncedRoots,
-		created: false,
-		besideNamesake: false
-	};
-	if (scope.unsyncedRecordedRoot !== null) return {
-		roots: [scope.unsyncedRecordedRoot],
-		created: false,
-		besideNamesake: false
-	};
-	const created = await client.collection.create({
-		name: AGENT_COLLECTION_NAME,
-		description: AGENT_COLLECTION_DESCRIPTION
-	});
-	await ctx.saveState({
-		...ctx.state,
-		syncRoot: created.id
-	});
-	return {
-		roots: [created],
-		created: true,
-		besideNamesake: scope.foreignNamesake
-	};
+async function ensureLibrary(client, library) {
+	return library ?? client.collection.createLibrary();
 }
 function itemLabel(item) {
 	return item.name === null ? `${item.model} ${item.id}` : `${item.model} ${item.id} "${item.name}"`;
@@ -7800,21 +8074,12 @@ function explainRefusal(error) {
 	if (!refusal.success) return error;
 	return new ConfigError([...refusal.data.errors.required.flatMap(requiredSyncLines), `After the fix, run \`rde init --only ${STEP_ID$2}\`.`].join("\n"));
 }
-function plannedNames(scope, libraryLicensed) {
-	const library = libraryLicensed ? [scope.library?.name ?? LIBRARY_NAME] : [];
-	if (scope.syncedRoots.length > 0) return [...library, ...scope.syncedRoots.map((collection) => collection.name)];
-	return [...library, scope.unsyncedRecordedRoot?.name ?? "Analytics"];
-}
-function nameList(names) {
-	if (names.length <= 2) return names.join(" and ");
-	return `${names.slice(0, -1).join(", ")}, and ${names.at(-1)}`;
-}
 function exportAdvice(profile, branch, changes) {
 	const command = exportCommand(profile, branch);
 	if (!remoteMoved(changes)) return `\`${command}\``;
 	return `the branch has commits Metabase has not imported; \`${mbCommand(profile)} git-sync export-preflight\`, then \`${command} --merge\``;
 }
-async function planExport(ctx, runner, instance, names) {
+async function planExport(ctx, runner, instance, name) {
 	const changes = await mbTool(runner).gitSyncHasRemoteChanges(instance);
 	if (remoteMoved(changes)) return {
 		changes,
@@ -7824,7 +8089,7 @@ async function planExport(ctx, runner, instance, names) {
 		changes,
 		push: await ctx.prompts.confirm({
 			key: SYNC_SCOPE_KEYS.export,
-			message: `Push ${nameList(names)} to ${requireGitRemote(ctx).branch} now?`,
+			message: `Push ${name} to ${requireGitRemote(ctx).branch} now?`,
 			initialValue: true
 		})
 	};
@@ -7839,7 +8104,7 @@ function reportPending(run) {
 }
 async function exportScope(run, runner) {
 	const mb = mbTool(runner);
-	const label = nameList(run.names);
+	const label = run.name;
 	const spinner = run.ctx.ui.spinner(`Pushing ${label} to ${run.gitRemote.branch}…`);
 	try {
 		const final = (await mb.gitSyncExport(run.instance, {
@@ -7860,9 +8125,6 @@ async function exportScope(run, runner) {
 		reportPending(run);
 	}
 }
-function scopeLabel(synced) {
-	return `Synced to git: ${synced.map((collection) => collection.name).join(", ")}`;
-}
 function syncScopeStep(deps = hostDeps$4) {
 	return {
 		id: STEP_ID$2,
@@ -7878,7 +8140,7 @@ function syncScopeStep(deps = hostDeps$4) {
 				key: ctx.secrets.apiKey
 			});
 			try {
-				if (isComplete(readScope(await client.collection.list(), ctx.state.syncRoot), hasLibrary(ctx.state.license))) return "done";
+				if (isComplete(findLibrary(await client.collection.list()), hasLibrary(ctx.state.license))) return "done";
 				return await isReadOnly(client) ? "not-applicable" : "todo";
 			} catch (error) {
 				if (isNotAnsweringYet(error)) return "todo";
@@ -7897,30 +8159,27 @@ function syncScopeStep(deps = hostDeps$4) {
 			await requireReadWrite(client);
 			await requireSettledImport(ctx, client, gitRemote);
 			const libraryLicensed = hasLibrary(ctx.state.license);
-			const scope = readScope(await client.collection.list(), ctx.state.syncRoot);
-			const names = plannedNames(scope, libraryLicensed);
-			const plan = isComplete(scope, libraryLicensed) ? null : await planExport(ctx, resolved.runner, instance, names);
+			const found = findLibrary(await client.collection.list());
+			if (isComplete(found, libraryLicensed)) {
+				ctx.ui.info(libraryLicensed ? `Synced to git: ${found?.name ?? LIBRARY_NAME}` : "The license has no Library, so there is nothing to mark for sync");
+				return { outcome: "completed" };
+			}
+			const name = found?.name ?? LIBRARY_NAME;
+			const plan = await planExport(ctx, resolved.runner, instance, name);
 			const spinner = ctx.ui.spinner("Choosing what syncs to git…");
-			let synced;
-			let chosen;
 			try {
-				const library = await ensureLibrary(client, scope, libraryLicensed);
-				chosen = await ensureRoots(ctx, client, scope);
-				synced = library === null ? chosen.roots : [library, ...chosen.roots];
-				await client.remoteSync.updateScope({ collections: Object.fromEntries(synced.map((collection) => [collection.id, true])) });
+				const library = await ensureLibrary(client, found);
+				await client.remoteSync.updateScope({ collections: { [library.id]: true } });
 			} catch (error) {
 				spinner.fail("Could not choose what syncs to git");
 				throw explainRefusal(error);
 			}
-			spinner.stop(scopeLabel(synced));
-			if (chosen.created) ctx.ui.info(`Created the ${AGENT_COLLECTION_NAME} collection: dashboards, questions, models, and documents filed under it reach git on the next export`);
-			if (chosen.besideNamesake) ctx.ui.info(`Another collection is also named ${AGENT_COLLECTION_NAME}; rde did not create it, so it stays out of git`);
-			if (plan === null) return { outcome: "completed" };
+			spinner.stop(`Synced to git: ${name}`);
 			const exportRun = {
 				ctx,
 				instance,
 				gitRemote,
-				names,
+				name,
 				changes: plan.changes
 			};
 			if (plan.push) await exportScope(exportRun, resolved.runner);
@@ -7976,16 +8235,23 @@ function remoteLine(remote) {
 		case "hosted": return `Remote: ${remote.url}`;
 	}
 }
-function notConfiguredReason(state) {
-	const license = state.license;
+function licenseGap(license) {
 	if (!license.activated) return "no license";
 	if (!hasRemoteSync(license)) return "the license has no remote-sync feature";
+	return null;
+}
+function notConfiguredReason(state) {
+	const gap = licenseGap(state.license);
+	if (gap !== null) return gap;
 	if (state.steps[GIT_SYNC_STEP_ID]?.status === "skipped") return "skipped; `rde init --only git-sync` sets it up";
 	return "not set up yet; `rde init --only git-sync`";
 }
 function gitLines(state) {
 	if (state.gitRemote === null) return [`Remote sync: not configured (${notConfiguredReason(state)})`];
-	return [`Content repository: ${state.gitRemote.workdir} (branch ${state.gitRemote.branch})`, remoteLine(state.gitRemote)];
+	const repository = [`Content repository: ${state.gitRemote.workdir} (branch ${state.gitRemote.branch})`, remoteLine(state.gitRemote)];
+	const gap = licenseGap(state.license);
+	if (gap === null) return repository;
+	return [...repository, `Remote sync: unavailable (${gap}; \`rde init --from license\` activates one)`];
 }
 async function pendingExportLines(state, secrets, runner) {
 	const instance = mbInstanceOf(state, secrets);
@@ -8000,10 +8266,11 @@ async function pendingExportLines(state, secrets, runner) {
 		throw error;
 	}
 }
-function skillLine(entries, detected) {
+function skillLine(entries, detected, skipped) {
 	const agents = [...new Set(entries.flatMap((entry) => coveredAgentNames(entry, detected)))];
-	if (agents.length === 0) return `rde skill: not installed; \`rde init --only agents-skills\``;
-	return `rde skill: installed for ${agents.join(", ")}`;
+	if (agents.length === 0) return `${RDE_SKILL_NAME} skill: not installed; \`rde init --only agents-skills\``;
+	if (skipped) return `${RDE_SKILL_NAME} skill: skipped by this run; an earlier install covers ${agents.join(", ")}`;
+	return `${RDE_SKILL_NAME} skill: installed for ${agents.join(", ")}`;
 }
 function launchLines(agents, workdir) {
 	const detected = agents.filter((agent) => agent.detected);
@@ -8023,7 +8290,7 @@ async function summaryLines(state, secrets, deps) {
 	const installed = await skillsCli(deps.runner).list();
 	const agents = await detectAgents(deps.probe);
 	const detected = agents.filter((agent) => agent.detected);
-	lines.push(skillLine(installed.filter((entry) => entry.name === "rde"), detected));
+	lines.push(skillLine(installed.filter((entry) => entry.name === RDE_SKILL_NAME), detected, state.steps["agents-skills"]?.status === "skipped"));
 	lines.push(...launchLines(agents, state.gitRemote?.workdir ?? null));
 	lines.push("Lifecycle: rde status (--json for scripts), rde stop, rde start");
 	return lines;
@@ -8467,6 +8734,18 @@ function parseDatabase(spec) {
 		uri
 	};
 }
+function databasesSection(flags) {
+	if (flags.databaseName.length > flags.database.length) throw new ConfigError("--database-name names a --database; give one --database for each name");
+	if (flags.database.length === 0) return;
+	return flags.database.map((spec, index) => {
+		const name = flags.databaseName[index];
+		if (name !== void 0 && name.trim().length === 0) throw new ConfigError("--database-name needs a display name");
+		return {
+			...parseDatabase(spec),
+			...name !== void 0 && { name }
+		};
+	});
+}
 function adminSection(flags, secrets) {
 	const prompted = flags.adminEmail !== void 0 || secrets.has("--admin-password");
 	if (flags.admin === void 0 && !prompted) return;
@@ -8604,7 +8883,7 @@ async function answersFromFlags(flags, readStdin) {
 		runtime: runtimeSection(flags),
 		"admin-user": adminSection(flags, secrets),
 		license: licenseSection(flags, secrets),
-		databases: flags.database.length > 0 ? flags.database.map(parseDatabase) : void 0,
+		databases: databasesSection(flags),
 		"git-sync": gitSection(flags, secrets),
 		"agents-skills": agentsSection(flags),
 		"api-key": flags.mbProfile === void 0 ? void 0 : { profile: flags.mbProfile }
@@ -8661,6 +8940,11 @@ function givenFlags(flags) {
 			flag: "--database",
 			given: flags.database.length > 0
 		},
+		{
+			step: "databases",
+			flag: "--database-name",
+			given: flags.databaseName.length > 0
+		},
 		{
 			step: "git-sync",
 			flag: "--git-dir",
@@ -8956,8 +9240,7 @@ function plainUi(output) {
 	};
 }
 function noColorRequested() {
-	const value = readEnv(ENV_NO_COLOR);
-	return value !== void 0 && value !== "";
+	return readSetEnv(ENV_NO_COLOR) !== null;
 }
 function drawsOnTerminal() {
 	return process.stdout.isTTY === true && !noColorRequested();
@@ -9088,6 +9371,20 @@ const db = defineCommand({
 	default: "list"
 });
 //#endregion
+//#region package.json
+var name = "@metabase/rde";
+var version = "0.5.0";
+var description = "Prepares a local machine for data-engineering work with Metabase and coding agents";
+//#endregion
+//#region src/version.ts
+const PACKAGE_NAME = name;
+const VERSION = version;
+const ROOT_META = {
+	name: "rde",
+	version: VERSION,
+	description
+};
+//#endregion
 //#region src/wizard/engine.ts
 function requireKnownStep(steps, id, flag) {
 	if (id === void 0) return;
@@ -9184,6 +9481,8 @@ async function runWizard(steps, ctx, options = {}) {
 }
 //#endregion
 //#region src/steps/doctor.ts
+const RDE_DIST_TAG = "latest";
+const RDE_RELEASE_TIMEOUT_MS = 3e3;
 function hostDoctorDeps(instanceName, signal) {
 	const runner = processRunner(signal);
 	const runtime = hostRuntimeDeps(instanceName, signal);
@@ -9203,7 +9502,8 @@ function hostDoctorDeps(instanceName, signal) {
 			cwd: process.cwd(),
 			stateHome: xdgStateHome(),
 			files: hostSkillFiles
-		}
+		},
+		publishedRdeVersion: () => npmRegistry(signal, { timeoutMs: RDE_RELEASE_TIMEOUT_MS }).distTagVersion(PACKAGE_NAME, RDE_DIST_TAG)
 	};
 }
 const NOT_FOUND_STATUS = 404;
@@ -9297,6 +9597,26 @@ function mbRow(diagnosis, lines, deps) {
 		case "current": return ok("mb", MB_LABEL, lines.join("\n"));
 	}
 }
+const RDE_LABEL = "rde";
+const RDE_UPDATE_HINT = `\`npm i -g ${PACKAGE_NAME}@${RDE_DIST_TAG}\``;
+function rdeUncheckedRow(reason) {
+	return skipped("rde", RDE_LABEL, `${VERSION}; could not check for a newer release: ${reason}`);
+}
+async function rdeRow(deps) {
+	let raw;
+	try {
+		raw = await deps.publishedRdeVersion();
+	} catch (error) {
+		const reason = lookupFailure(error);
+		if (reason === null) throw error;
+		return rdeUncheckedRow(reason);
+	}
+	const published = semver.valid(raw);
+	if (published === null) return rdeUncheckedRow(`the registry names "${raw}" for ${RDE_DIST_TAG}, which is not a version`);
+	if (semver.lt(VERSION, published)) return note$1("rde", RDE_LABEL, `${VERSION}; ${published} is released`, RDE_UPDATE_HINT);
+	if (semver.gt(VERSION, published)) return ok("rde", RDE_LABEL, `${VERSION}, ahead of the latest release ${published}`);
+	return ok("rde", RDE_LABEL, `${VERSION}, the latest release`);
+}
 async function mbFinding(deps) {
 	const found = await inspectMbOnPath(deps.runner, deps.locateMb);
 	const diagnosis = diagnoseMb(found, deps.installedWith);
@@ -9317,6 +9637,20 @@ function publishesOnLoopback(container, port) {
 }
 const CONTAINER = "the container";
 const CONTAINER_SILENT_PORT_HINT = "Docker's forward of the port is broken; `rde start` repairs it";
+function containerSettingsFailure(runtime, inspection) {
+	const onMaster = !developmentMode() && isMasterBuildImage(runtime.image);
+	const drift = containerEnvDrift(inspection, runtime);
+	const problems = [];
+	if (onMaster) problems.push(`${runtime.containerName} runs ${runtime.image}, a development build of Metabase`);
+	if (drift.length > 0) problems.push(`${runtime.containerName} was created with ${drift.join(", ")} set otherwise than rde sets them now`);
+	if (problems.length === 0) return null;
+	const hint = onMaster ? "a build of master is ahead of every release, so `rde uninstall`, then `rde init`, sets up an instance on a release; `RDE_DEV=1` keeps running this one" : "`rde upgrade` creates the container again with rde's settings";
+	return {
+		detail: problems.join("\n"),
+		hint,
+		step: null
+	};
+}
 async function containerRow(runtime, deps, dockerOk) {
 	const label = "container";
 	if (!dockerOk) return {
@@ -9357,6 +9691,11 @@ async function containerRow(runtime, deps, dockerOk) {
 		}),
 		...found
 	};
+	const settings = containerSettingsFailure(runtime, inspection);
+	if (settings !== null) return {
+		row: failed("container", label, settings),
+		...found
+	};
 	const state = inspection.running ? "running" : "stopped";
 	return {
 		row: ok("container", label, `${runtime.containerName} ${state} (${runtime.image})`),
@@ -9748,8 +10087,8 @@ async function gitSyncRow(state, instance, deps) {
 const SKILL_STEP = "agents-skills";
 const GLOBAL_SCOPE = "global";
 const SKILL_FILE = "SKILL.md";
-const SOURCE_SKILLS_DIR = "skills";
 const CLAUDE_CODE = "Claude Code";
+const COPIES_LABEL = `${RDE_SKILL_NAME} skill copies`;
 const CLAUDE_CODE_SKILL_RULE = "a personal skill wins over a project one: https://code.claude.com/docs/en/skills";
 function skillRowId(agent) {
 	return `skill.${agent.id}`;
@@ -9761,12 +10100,12 @@ async function copyRef(entry, deps) {
 	const path = entry.scope === GLOBAL_SCOPE ? globalSkillLockPath(deps.probe.home, deps.skills.stateHome) : projectSkillLockPath(deps.skills.cwd);
 	return lockedSkill(path, await deps.skills.files.readJson(path), entry.name)?.ref ?? null;
 }
-async function judgeCopy(entry, origin, deps) {
+async function judgeCopy(skill, entry, origin, deps) {
 	const where = `${entry.scope} ${entry.path}`;
 	switch (origin.kind) {
 		case "local": {
 			const installed = await deps.skills.files.readText(join(entry.path, SKILL_FILE));
-			const wanted = await deps.skills.files.readText(join(origin.path, SOURCE_SKILLS_DIR, entry.name, SKILL_FILE));
+			const wanted = await deps.skills.files.readText(join(origin.path, sourceSkillDirectory(skill), SKILL_FILE));
 			const current = installed !== null && installed === wanted;
 			return {
 				entry,
@@ -9807,53 +10146,99 @@ function loadedCopyLine(entries, cwd) {
 	if (loaded === void 0) return count;
 	return `${count}; ${CLAUDE_CODE} started in ${cwd} loads ${loaded.path} (${CLAUDE_CODE_SKILL_RULE})`;
 }
-function staleCopiesRow(stale, detail, deps) {
+function staleCopiesRow(stale, replaced, detail, deps) {
 	const globalStale = stale.some((copy) => copy.entry.scope === GLOBAL_SCOPE);
 	const projectStale = stale.some((copy) => copy.entry.scope !== GLOBAL_SCOPE);
 	const repairs = [];
-	if (globalStale) repairs.push(`\`rde init --only ${SKILL_STEP}\` reinstalls the global copy from ${deps.skills.source}`);
-	if (projectStale) repairs.push(`remove the project copy with \`npx -y skills@latest remove rde -y\` in ${deps.skills.cwd}`);
-	return failed("skill-copies", "rde skill copies", {
+	const stepFixes = [];
+	if (globalStale) stepFixes.push(`reinstalls the global copy from ${deps.skills.source}`);
+	if (replaced) stepFixes.push(`removes the copies ${RDE_SKILL_NAME} replaces`);
+	if (stepFixes.length > 0) repairs.push(`\`rde init --only ${SKILL_STEP}\` ${stepFixes.join(" and ")}`);
+	if (projectStale) repairs.push(`remove the project copy with \`npx -y skills@latest remove ${RDE_SKILL_NAME} -y\` in ${deps.skills.cwd}`);
+	return failed("skill-copies", COPIES_LABEL, {
 		detail,
 		hint: `${repairs.join("; ")}; then restart the agent session`,
-		step: globalStale ? SKILL_STEP : null
+		step: stepFixes.length > 0 ? SKILL_STEP : null
 	});
 }
-async function skillCopiesRow(globalEntries, deps) {
+async function skillCopiesRow(globalEntries, replaced, deps) {
 	const id = "skill-copies";
-	const label = "rde skill copies";
+	const label = COPIES_LABEL;
 	const cwd = deps.skills.cwd;
-	const projectEntries = cwd === deps.probe.home ? [] : (await skillsCli(deps.runner).listProject(cwd)).filter((entry) => entry.name === "rde");
+	const projectEntries = cwd === deps.probe.home ? [] : (await skillsCli(deps.runner).listProject(cwd)).filter((entry) => entry.name === RDE_SKILL_NAME);
 	const entries = [...globalEntries, ...projectEntries];
-	if (entries.length === 0) return skipped(id, label, "no copy installed");
+	if (entries.length === 0 && replaced.length === 0) return skipped(id, label, "no copy installed");
 	const origin = skillOrigin(deps.skills.source, cwd);
 	const judged = [];
-	for (const entry of entries) judged.push(await judgeCopy(entry, origin, deps));
+	for (const entry of entries) judged.push(await judgeCopy(RDE_SKILL_NAME, entry, origin, deps));
 	const loaded = loadedCopyLine(entries, cwd);
-	const lines = judged.map((copy) => copy.line);
+	const lines = [...judged.map((copy) => copy.line), ...replaced.map((entry) => `${entry.scope} ${entry.path}: replaced by ${RDE_SKILL_NAME}`)];
 	const detail = (loaded === null ? lines : [...lines, loaded]).join("\n");
 	const stale = judged.filter((copy) => !copy.current);
-	return stale.length === 0 ? ok(id, label, detail) : staleCopiesRow(stale, detail, deps);
+	if (stale.length === 0 && replaced.length === 0) return ok(id, label, detail);
+	return staleCopiesRow(stale, replaced.length > 0, detail, deps);
+}
+function dataAppSkillsFix({ current, legacy }) {
+	const command = `\`rde init --only ${SKILL_STEP}\``;
+	const removal = `the copies ${DATA_APPS_SKILL_NAME} replaces`;
+	if (!legacy) return `${command} installs it`;
+	return current ? `${command} removes ${removal}` : `${command} installs it and removes ${removal}`;
+}
+async function dataAppSkillsRow(installed, deps) {
+	const id = "data-app-skills";
+	const label = "data-app skills";
+	const origin = skillOrigin(deps.skills.source, deps.skills.cwd);
+	const lines = [];
+	const copy = installed.find((candidate) => candidate.name === DATA_APPS_SKILL_NAME);
+	let current = false;
+	if (copy === void 0) lines.push(`${DATA_APPS_SKILL_NAME}: not installed`);
+	else {
+		const judged = await judgeCopy(DATA_APPS_SKILL_NAME, copy, origin, deps);
+		lines.push(judged.line);
+		current = judged.current;
+	}
+	const legacy = installed.filter((entry) => isLegacyDataAppCopy(entry.name, entry.source));
+	for (const entry of legacy) lines.push(`${entry.scope} ${entry.path}: replaced by ${DATA_APPS_SKILL_NAME}`);
+	const detail = lines.join("\n");
+	if (current && legacy.length === 0) return ok(id, label, detail);
+	return failed(id, label, {
+		detail,
+		hint: `${dataAppSkillsFix({
+			current,
+			legacy: legacy.length > 0
+		})}; then restart the agent session`,
+		step: SKILL_STEP
+	});
 }
 async function skillRows(state, deps) {
-	const label = "rde skill";
+	const label = `${RDE_SKILL_NAME} skill`;
 	if (state === null) return [skipped("skill", label, NO_INSTANCE_REASON)];
 	if (state.steps[SKILL_STEP]?.status === "skipped") return [skipped("skill", label, `skipped during init; \`rde init --only ${SKILL_STEP}\``)];
 	const detected = (await detectAgents(deps.probe)).filter((agent) => agent.detected);
 	if (detected.length === 0) return [skipped("skill", label, "no coding agents detected")];
-	const entries = await rdeSkillEntries(deps.runner);
-	const copies = await skillCopiesRow(entries, deps);
-	if (detected.filter((agent) => entries.some((entry) => skillCoversAgent(entry, agent))).length === 0) return [failed("skill", label, {
-		detail: `not installed for ${detected.map((agent) => agent.displayName).join(", ")}`,
-		hint: `\`rde init --only ${SKILL_STEP}\``,
-		step: SKILL_STEP
-	}), copies];
-	return [...detected.map((agent) => {
-		const entry = entries.find((candidate) => skillCoversAgent(candidate, agent));
-		const agentLabel = `${label} (${agent.displayName})`;
-		if (entry === void 0) return skipped(skillRowId(agent), agentLabel, `not installed; \`rde init --only ${SKILL_STEP}\` adds it`);
-		return ok(skillRowId(agent), agentLabel, entry.path);
-	}), copies];
+	const installed = await skillsCli(deps.runner).list();
+	const entries = installed.filter((entry) => entry.name === RDE_SKILL_NAME);
+	const copies = await skillCopiesRow(entries, installed.filter((entry) => isReplacedRdeCopy(entry.name)), deps);
+	const dataApps = await dataAppSkillsRow(installed, deps);
+	if (detected.filter((agent) => entries.some((entry) => skillCoversAgent(entry, agent))).length === 0) return [
+		failed("skill", label, {
+			detail: `not installed for ${detected.map((agent) => agent.displayName).join(", ")}`,
+			hint: `\`rde init --only ${SKILL_STEP}\``,
+			step: SKILL_STEP
+		}),
+		copies,
+		dataApps
+	];
+	return [
+		...detected.map((agent) => {
+			const entry = entries.find((candidate) => skillCoversAgent(candidate, agent));
+			const agentLabel = `${label} (${agent.displayName})`;
+			if (entry === void 0) return skipped(skillRowId(agent), agentLabel, `not installed; \`rde init --only ${SKILL_STEP}\` adds it`);
+			return ok(skillRowId(agent), agentLabel, entry.path);
+		}),
+		copies,
+		dataApps
+	];
 }
 function noRuntimeRows() {
 	return [
@@ -9898,7 +10283,11 @@ async function collectDoctor(instance, state, secrets, deps) {
 	const dockerOk = machine.some((row) => row.id === "docker" && row.status === "ok");
 	const mb = await mbFinding(deps);
 	const profiles = sharedProfileList(deps);
-	const checks = [...machine, mb.row];
+	const checks = [
+		...machine,
+		mb.row,
+		await rdeRow(deps)
+	];
 	if (state === null) checks.push(...noRuntimeRows(), skipped("version", "Metabase version", NO_INSTANCE_REASON), skipped("admin", "admin user", NO_INSTANCE_REASON), skipped("admin-password", "admin password", NO_INSTANCE_REASON), skipped("api-key", "API key", NO_INSTANCE_REASON), skipped("secrets-file", "secrets file", NO_INSTANCE_REASON), skipped("state-file", "state file", NO_INSTANCE_REASON), skipped("mb-profile", "mb profile", NO_INSTANCE_REASON), skipped("license", "license", NO_INSTANCE_REASON), skipped("databases", "databases", NO_INSTANCE_REASON), skipped("git-sync", "remote sync", NO_INSTANCE_REASON));
 	else checks.push(...await instanceRows(state, secrets, deps, dockerOk, profiles, mb.unusable));
 	const rdeProfile = state === null ? null : state.mbProfile;
@@ -10290,6 +10679,10 @@ const init = defineRdeCommand({
 			type: "string",
 			description: "Database to connect, a connection string or <engine>=<connection string> when it fits several engines; repeatable. init needs one, and asks for it only at a terminal"
 		},
+		"database-name": {
+			type: "string",
+			description: "Display name of the --database in the same position, such as the name the production Metabase uses; repeatable"
+		},
 		"git-dir": {
 			type: "string",
 			description: "Directory for the content repository"
@@ -10347,6 +10740,7 @@ const init = defineRdeCommand({
 				licenseToken: args["license-token"],
 				skipLicense: args["skip-license"],
 				database: repeatedValues(rawArgs, "--database"),
+				databaseName: repeatedValues(rawArgs, "--database-name"),
 				gitDir: args["git-dir"],
 				gitRemote: args["git-remote"],
 				gitUrl: args["git-url"],
@@ -10912,17 +11306,22 @@ async function findMbProfiles(candidates, urls, runner) {
 	}
 	return found;
 }
+function spokenList(items) {
+	const last = items.at(-1);
+	if (last === void 0 || items.length <= 2) return items.join(" and ");
+	return `${items.slice(0, -1).join(", ")}, and ${last}`;
+}
 function skillLabel(names, entries) {
 	const agents = [...new Set(entries.flatMap((entry) => entry.agents))];
 	const noun = names.length === 1 ? "skill" : "skills";
-	return `${names.join(" and ")} ${noun} for ${agents.join(", ")}`;
+	return `${spokenList(names)} ${noun} for ${agents.join(", ")}`;
 }
+const OWNED_SKILL_NAMES = RDE_OWNED_SKILL_NAMES;
 async function findSkill(runner, childOutput) {
 	const skills = skillsCli(runner);
-	const owned = RDE_SOURCE_SKILL_NAMES;
-	const entries = (await skills.list()).filter((entry) => owned.includes(entry.name));
+	const entries = (await skills.list()).filter((entry) => OWNED_SKILL_NAMES.includes(entry.name));
 	if (entries.length === 0) return null;
-	const names = [...new Set(entries.map((entry) => entry.name))];
+	const names = OWNED_SKILL_NAMES.filter((name) => entries.some((entry) => entry.name === name));
 	return {
 		label: skillLabel(names, entries),
 		remove: () => skills.remove(names, childOutput)
@@ -11024,7 +11423,7 @@ function keptOnDisk(options, state, dirPresent) {
 	const kept = [];
 	if (options.keepData && dirPresent) kept.push(`Instance directory ${instanceDir(options.instance)} (--keep-data); \`rde init\` reinstalls from it`);
 	if (state?.gitRemote !== null && state?.gitRemote !== void 0) kept.push(`Working directory ${state.gitRemote.workdir} and its git history`);
-	if (!options.removeSkill) kept.push(`The rde skill for your agents; pass --remove-skill to remove it`);
+	if (!options.removeSkill) kept.push(`The ${spokenList(RDE_INSTALLED_SKILL_NAMES)} skills for your agents; pass --remove-skill to remove them`);
 	return kept;
 }
 async function planUninstall(options, deps) {
@@ -11131,6 +11530,9 @@ function reportLines(report) {
 function leftBehind(report) {
 	return [...report.results.flatMap((result) => result.outcome === "failed" ? [result.label] : []), ...report.problems.map((problem) => problem.subject)];
 }
+function uninstallCommandLine(options) {
+	return options.instance === options.defaultInstance ? "rde uninstall" : `rde uninstall --instance ${options.instance}`;
+}
 async function uninstall(options, deps, io) {
 	const plan = await planUninstall(options, deps);
 	for (const problem of plan.problems) io.ui.warn(`${problem.subject} ${problem.reason}`);
@@ -11141,7 +11543,7 @@ async function uninstall(options, deps, io) {
 			problems: plan.problems
 		};
 	}
-	io.ui.note(planLines$1(plan).join("\n"), `rde uninstall ${options.instance}`);
+	io.ui.note(planLines$1(plan).join("\n"), uninstallCommandLine(options));
 	if (plan.unpulled !== null) {
 		io.ui.warn(unpulledWarning(plan.unpulled));
 		if ((options.yes || !options.terminal) && !options.force) throw new ConfigError(unpulledRefusal(plan.unpulled));
@@ -11180,7 +11582,7 @@ const uninstallCommand = defineRdeCommand({
 		},
 		"remove-skill": {
 			type: "boolean",
-			description: "Also remove the rde skill from your coding agents",
+			description: "Also remove the metabase-data-apps and metabase-rde skills, and the rde and rde-data-apps skills they replace, from your coding agents",
 			default: false
 		},
 		"remove-image": {
@@ -11201,11 +11603,13 @@ const uninstallCommand = defineRdeCommand({
 	},
 	interrupted: INTERRUPTED,
 	async run(args) {
-		const instance = args.instance ?? await instanceNameOrDefault();
+		const defaultInstance = await instanceNameOrDefault();
+		const instance = args.instance ?? defaultInstance;
 		if (!isInstanceName(instance)) throw new ConfigError(`${args.instance === void 0 ? `the default instance in ${globalConfigPath()},` : "--instance"} ${instance} is not an instance name (${INSTANCE_NAME_RULE})`);
 		const ui = terminalUi();
 		const report = await uninstall({
 			instance,
+			defaultInstance,
 			keepData: args["keep-data"],
 			removeSkill: args["remove-skill"],
 			removeImage: args["remove-image"],
@@ -11231,35 +11635,59 @@ function hostDeps(ctx) {
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
 		timing: DEFAULT_HEALTH_TIMING,
 		releases: releaseLookup(ctx.signal),
-		now: () => /* @__PURE__ */ new Date()
+		now: () => /* @__PURE__ */ new Date(),
+		skills: (agents) => agentsSkillsStep(agents, "published")
 	};
 }
-function imageTag(ref) {
-	const colon = ref.lastIndexOf(":");
-	if (colon === -1 || colon < ref.lastIndexOf("/")) return null;
-	return ref.slice(colon + 1);
+function majorMove(from, to) {
+	const fromMajor = releaseMajor(from);
+	const toMajor = to === null ? null : releaseMajor(to);
+	if (fromMajor === null || toMajor === null || fromMajor === toMajor) return null;
+	return {
+		from: fromMajor,
+		to: toMajor
+	};
 }
 function releaseOf(tag) {
 	const match = RELEASE_TAG.exec(tag);
 	if (match === null || match[1] === void 0) return null;
 	return semver.coerce(match[1]);
 }
-function downgradeReason(current, targetTag) {
-	if (targetTag === null) return null;
+function isDowngrade(current, targetTag) {
+	if (isMajorLineTag(targetTag)) {
+		const running = releaseMajor(current);
+		const target = releaseMajor(targetTag);
+		return running !== null && target !== null && target < running;
+	}
 	const running = releaseOf(current);
 	const target = releaseOf(targetTag);
-	if (running === null || target === null || !semver.lt(target, running)) return null;
+	return running !== null && target !== null && semver.lt(target, running);
+}
+function downgradeReason(current, targetTag) {
+	if (targetTag === null || !isDowngrade(current, targetTag)) return null;
 	return `refusing to downgrade from ${current} to ${targetTag}: Metabase migrates its application database forward only; a fresh instance (\`rde uninstall\`, then \`rde init\`) is the way to run an older release`;
 }
 function backupStamp(now) {
 	return now.toISOString().replace(/\.\d{3}Z$/, "Z").replaceAll(":", "-");
 }
-async function ensureRunning(ctx, deps, client) {
-	await startMetabaseStep(() => deps).run(ctx);
+async function ensureRunning(ctx, deps, client, accepted) {
+	await startMetabaseStep(() => deps, accepted).run(ctx);
 	return runningVersion(client);
 }
-function dockerTarget(runtime, to) {
-	const image = to ?? runtime.image;
+function requireSupported(version) {
+	const refusal = unsupportedVersionReason(version, developmentMode());
+	if (refusal !== null) throw new UnsupportedMetabaseError(refusal);
+}
+function knownTargetVersion(target) {
+	const tag = target.releaseTag;
+	return tag !== null && (isReleaseTag(tag) || isMajorLineTag(tag)) ? tag : null;
+}
+const TO_ONE = "`--to <image or release tag>` names a Metabase to move to";
+const UPGRADE_WAYS_OUT = {
+	named: TO_ONE,
+	unreleased: TO_ONE
+};
+function dockerTargetOf(runtime, image, ownImage) {
 	return {
 		kind: "docker",
 		next: {
@@ -11267,22 +11695,24 @@ function dockerTarget(runtime, to) {
 			image
 		},
 		label: image,
-		releaseTag: imageTag(image)
+		releaseTag: imageTag(image),
+		ownImage
 	};
 }
+async function dockerTarget(ctx, runtime, to, releases) {
+	if (to !== null) return dockerTargetOf(runtime, to, false);
+	if (developmentMode()) return dockerTargetOf(runtime, runtime.image, false);
+	if (!isMetabaseImage(runtime.image)) return dockerTargetOf(runtime, runtime.image, true);
+	return dockerTargetOf(runtime, await releaseImage(ctx, releases, UPGRADE_WAYS_OUT), false);
+}
 async function jarTarget(ctx, runtime, to, releases) {
 	const spec = to ?? "latest";
 	const parsed = parseJarSpec(spec);
-	if (parsed === null) throw new ConfigError(`--to ${spec} is not latest, a release tag such as v1.63.18, or the path of a .jar file`);
-	let source;
-	if (parsed.kind === "latest") {
-		const version = await releases.latestVersion();
-		ctx.ui.info(`The latest Metabase release is ${version}`);
-		source = {
-			kind: "release",
-			version
-		};
-	} else source = parsed;
+	if (parsed === null) throw new ConfigError(`--to ${spec} is not latest, an enterprise release tag such as v1.65.0, or the path of a .jar file`);
+	const source = parsed.kind === "latest" ? {
+		kind: "release",
+		version: await latestJarRelease(ctx, releases, UPGRADE_WAYS_OUT)
+	} : parsed;
 	return {
 		kind: "jar",
 		previous: runtime,
@@ -11296,7 +11726,7 @@ async function jarTarget(ctx, runtime, to, releases) {
 }
 function resolveTarget(ctx, configured, to, releases) {
 	switch (configured.runtime.kind) {
-		case "docker": return Promise.resolve(dockerTarget(configured.runtime, to));
+		case "docker": return dockerTarget(ctx, configured.runtime, to, releases);
 		case "jar": return jarTarget(ctx, configured.runtime, to, releases);
 	}
 }
@@ -11346,9 +11776,13 @@ const SWITCH_TEXT = {
 	jar: "Metabase stops and starts again from the target jar."
 };
 function planLines(configured, current, target, backup) {
+	const notes = [];
+	if (target.kind === "docker" && target.ownImage) notes.push("the instance's own image pulled again, since only Metabase's images move to the newest release");
+	if (target.releaseTag === null || !isReleaseTag(target.releaseTag)) notes.push("its version shows once it runs");
+	const annotation = notes.length === 0 ? "" : ` (${notes.join("; ")})`;
 	return [
 		`Running:  ${current} (${describeRuntime(configured.runtime)})`,
-		`Target:   ${target.label}`,
+		`Target:   ${target.label}${annotation}`,
 		`Backup:   ${backup}`,
 		"",
 		SWITCH_TEXT[configured.runtime.kind],
@@ -11407,31 +11841,70 @@ async function switchTo(ctx, deps, target) {
 	}
 	spinner.stop(`Installed ${target.label}`);
 }
+function failedStartTitle(error) {
+	if (error instanceof MetabaseUnreachableError) return "Metabase did not come up on the new version";
+	if (error instanceof UnsupportedMetabaseError) return "The new version is not one rde runs";
+	return null;
+}
 async function startUpgraded(ctx, deps, client, previous, backup) {
 	try {
-		return await ensureRunning(ctx, deps, client);
+		return await ensureRunning(ctx, deps, client, "supported");
 	} catch (error) {
-		if (error instanceof MetabaseUnreachableError) ctx.ui.note(restoreLines(ctx, previous, deps.runtime.dataDir, backup).join("\n"), "Metabase did not come up on the new version");
+		const title = failedStartTitle(error);
+		if (title !== null) ctx.ui.note(restoreLines(ctx, previous, deps.runtime.dataDir, backup).join("\n"), title);
 		throw error;
 	}
 }
+async function recreateStale(ctx, deps, previous, target) {
+	const next = target.next;
+	const container = await deps.runtime.docker.containerInspect(next.containerName);
+	const drift = container.exists ? containerEnvDrift(container, next) : [];
+	const renamed = previous.kind === "docker" && previous.image !== next.image;
+	if (drift.length === 0 && !renamed) return false;
+	if (renamed) {
+		ctx.ui.info(`${previous.image} is the image ${next.image} names; creating ${next.containerName} again under ${next.image}`);
+		await ctx.saveState({
+			...ctx.state,
+			runtime: next
+		});
+	}
+	if (drift.length > 0) ctx.ui.info(`${next.containerName} was created with ${drift.join(", ")} set otherwise than rde sets them now; creating it again from the image it runs`);
+	await runtimeFromState(next, deps.runtime).reconfigure();
+	return true;
+}
+async function alreadyOn(ctx, deps, client, configured, current, target) {
+	if (target.kind === "docker" && await recreateStale(ctx, deps, configured.runtime, target)) {
+		await ensureRunning(ctx, deps, client, "supported");
+		ctx.ui.success(`Already on ${current}; ${target.next.containerName} runs ${target.label} with rde's settings now`);
+		return {
+			outcome: "recreated",
+			version: current
+		};
+	}
+	ctx.ui.success(`Already on ${current}: ${target.label} is what the instance runs`);
+	return {
+		outcome: "unchanged",
+		version: current
+	};
+}
 async function upgrade(ctx, options, deps = hostDeps) {
 	const resolved = deps(ctx);
 	const configured = requireConfiguredRuntime(ctx.state);
 	const client = resolved.client(configured.url, NO_AUTH);
-	const current = await ensureRunning(ctx, resolved, client);
 	const target = await resolveTarget(ctx, configured, options.to, resolved.releases);
+	const current = await ensureRunning(ctx, resolved, client, "any");
 	const refusal = downgradeReason(current, target.releaseTag);
 	if (refusal !== null) throw new ConfigError(refusal);
+	const known = knownTargetVersion(target);
+	if (known !== null) requireSupported(known);
 	if (await fetchTarget(ctx, resolved, target, current)) {
-		ctx.ui.success(`Already on ${current}: ${target.label} is what the instance runs`);
-		return {
-			outcome: "unchanged",
-			version: current
-		};
+		requireSupported(current);
+		return alreadyOn(ctx, resolved, client, configured, current, target);
 	}
 	const backup = join(instanceBackupsDir(ctx.state.name), backupStamp(resolved.now()));
 	ctx.ui.note(planLines(configured, current, target, backup).join("\n"), "rde upgrade");
+	const announced = majorMove(current, target.releaseTag);
+	if (announced !== null) ctx.ui.warn(`This moves Metabase from ${announced.from} to ${announced.to}, a new major version; rde updates your coding agents' skills after the upgrade`);
 	if (!options.yes) {
 		if (!await ctx.prompts.confirm({
 			message: "Upgrade now?",
@@ -11452,6 +11925,11 @@ async function upgrade(ctx, options, deps = hostDeps) {
 	options.onPhase("starting", backup);
 	const to = await startUpgraded(ctx, resolved, client, configured, backup);
 	ctx.ui.success(`Upgraded Metabase from ${current} to ${to}; the backup at ${backup} can go once you are happy with it`);
+	const moved = majorMove(current, to);
+	if (moved !== null) {
+		if (announced === null) ctx.ui.warn(`This moved Metabase from ${moved.from} to ${moved.to}, a new major version`);
+		await runWizard([resolved.skills(options.yes ? DETECT_AGENTS : ASK_AGENTS)], ctx);
+	}
 	return {
 		outcome: "upgraded",
 		from: current,
@@ -11477,7 +11955,7 @@ const upgradeCommand = defineRdeCommand({
 	args: {
 		to: {
 			type: "string",
-			description: "Docker: image to upgrade to (default: the instance's image, pulled again); jar: latest, a release tag, or a .jar path (default: latest)"
+			description: "Docker: image to upgrade to (default: the major line of the newest Metabase Enterprise release, such as metabase/metabase-enterprise:v1.65.x; the instance's own image pulled again with RDE_DEV=1 or for an image from outside Metabase's repositories); jar: latest (the newest release), a release tag, or a .jar path (default: latest)"
 		},
 		yes: {
 			type: "boolean",
@@ -11505,11 +11983,7 @@ const upgradeCommand = defineRdeCommand({
 //#endregion
 //#region src/main.ts
 const main = defineCommand({
-	meta: {
-		name: "rde",
-		version: "0.1.17",
-		description: "Prepares a local machine for data-engineering work with Metabase and coding agents"
-	},
+	meta: ROOT_META,
 	subCommands: {
 		init,
 		start,