@metabase/rde 0.1.5 → 0.1.7

package/dist/cli.mjs

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
-import { defineCommand, runMain, showUsage } from "citty";
+import { defineCommand, renderUsage, runMain } from "citty";
 import { createWriteStream, promises } from "node:fs";
 import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
 import { ZodError, z } from "zod";
+import { createHash, randomBytes } from "node:crypto";
 import { homedir, tmpdir, userInfo } from "node:os";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { Readable } from "node:stream";
@@ -11,7 +12,6 @@ import { confirm, intro, isCancel, log, multiselect, note, outro, password, sele
 import { spawn } from "node:child_process";
 import { connect, createServer } from "node:net";
 import semver from "semver";
-import { randomBytes } from "node:crypto";
 //#region src/errors.ts
 var AbortError = class extends Error {
 	constructor(message = "interrupted") {
@@ -25,6 +25,14 @@ var ConfigError = class extends Error {
 		this.name = "ConfigError";
 	}
 };
+var StepFailedError = class extends Error {
+	step;
+	constructor(step, cause) {
+		super(`step ${step.id} failed`, { cause });
+		this.name = "StepFailedError";
+		this.step = step;
+	}
+};
 var ExternalToolError = class extends Error {
 	tool;
 	argv;
@@ -91,11 +99,19 @@ const INTERRUPTED_MESSAGE = "Interrupted. Run `rde init` again to resume.";
 const FAILURE_EXIT_CODE = 1;
 const USAGE_EXIT_CODE = 2;
 function exitCodeFor(error) {
+	if (error instanceof StepFailedError) return exitCodeFor(error.cause);
 	if (error instanceof AbortError) return 130;
 	if (error instanceof ConfigError) return USAGE_EXIT_CODE;
 	return FAILURE_EXIT_CODE;
 }
+function stepFailureMessage(step, cause) {
+	const stopped = `rde init stopped at "${step.title}"`;
+	const resume = `Resume with rde init --from ${step.id}.`;
+	if (cause.includes("\n")) return `${cause}\n${stopped}. ${resume}`;
+	return `${stopped}: ${cause.replace(/\.$/, "")}. ${resume}`;
+}
 function messageFor$1(error) {
+	if (error instanceof StepFailedError) return stepFailureMessage(error.step, messageFor$1(error.cause));
 	if (error instanceof AbortError) return INTERRUPTED_MESSAGE;
 	if (error instanceof Error) return error.message;
 	return String(error);
@@ -130,6 +146,10 @@ function printLines(lines) {
 function printJson(value) {
 	process.stdout.write(JSON.stringify(value, null, 2) + "\n");
 }
+const ESCAPE_SEQUENCE = new RegExp(`${String.fromCodePoint(27)}(?:\\[[0-?]*[ -/]*[@-~]|[@-Z\\\\-_])`, "g");
+function withoutEscapes(text) {
+	return text.replace(ESCAPE_SEQUENCE, "");
+}
 const StepId = z.enum([
 	"preflight",
 	"install-mb",
@@ -378,16 +398,14 @@ function readEnv(name) {
 	return process.env[name];
 }
 const ENV_PATH = "PATH";
+const ENV_NO_COLOR = "NO_COLOR";
 const ENV_XDG_STATE_HOME = "XDG_STATE_HOME";
 const ENV_JAVA_HOME = "JAVA_HOME";
 const ENV_MB_PROFILE = "MB_PROFILE";
 const ENV_MB_URL = "MB_URL";
 const ENV_MB_API_KEY = "MB_API_KEY";
-function environmentWith(overrides) {
-	return {
-		...process.env,
-		...overrides
-	};
+function hostEnvironment() {
+	return { ...process.env };
 }
 //#endregion
 //#region src/state/paths.ts
@@ -400,11 +418,16 @@ const SECRETS_FILE = "secrets.json";
 const GLOBAL_CONFIG_FILE = "config.json";
 const JARS_DIR = "jars";
 const JAR_FILE$1 = "metabase.jar";
+const HOME_TAG_LENGTH = 8;
 function rdeHome() {
 	const override = readEnv(ENV_RDE_HOME);
-	if (override !== void 0) return override;
+	if (override !== void 0) return resolve(override);
 	return join(homedir(), RDE_DIR_NAME);
 }
+function homeTag(home) {
+	if (home === join(homedir(), RDE_DIR_NAME)) return null;
+	return createHash("sha256").update(home).digest("hex").slice(0, HOME_TAG_LENGTH);
+}
 function instancesDir() {
 	return join(rdeHome(), INSTANCES_DIR);
 }
@@ -544,509 +567,183 @@ async function writeGlobalConfig(config) {
 	await writeJsonFile(globalConfigPath(), config);
 }
 //#endregion
-//#region src/steps/credentials.ts
-const LEGACY_NOTE = "This is the public default password; when the instance holds nothing you need, `rde uninstall` then `rde init` recreates it with a generated one";
-const PROMPTED_NOTE = "The password is the one entered during `rde init`; rde never stored it";
-function storedPassword(state, secrets) {
-	if (secrets === null || secrets.admin === null) throw new ConfigError(`the secrets file of instance ${state.name} holds no admin password; \`rde doctor\` says what to do`);
-	return secrets.admin.password;
+//#region src/metabase/domain/health.ts
+const Health = z.object({ status: z.literal("ok") }).loose();
+const Initializing = z.object({
+	status: z.literal("initializing"),
+	progress: z.number()
+}).loose();
+//#endregion
+//#region src/metabase/http.ts
+const REQUEST_TIMEOUT_MS = 3e4;
+const PARTIAL_SUFFIX = ".part";
+const CONTENT_LENGTH_HEADER = "content-length";
+const SESSION_HEADER = "X-Metabase-Session";
+const API_KEY_HEADER = "X-Api-Key";
+const JSON_CONTENT_TYPE = "application/json";
+const SERVICE_UNAVAILABLE_STATUS = 503;
+const NO_AUTH = { kind: "none" };
+const ErrorMessage = z.object({ message: z.string() }).loose();
+const ErrorFields = z.object({ errors: z.record(z.string(), z.string()) }).loose();
+function authHeaders(auth) {
+	switch (auth.kind) {
+		case "none": return {};
+		case "session": return { [SESSION_HEADER]: auth.id };
+		case "api-key": return { [API_KEY_HEADER]: auth.key };
+	}
 }
-function credentialsReport(state, secrets) {
-	const admin = state.admin;
-	if (admin === null) throw new ConfigError(`instance ${state.name} has no admin user yet; run \`rde init\``);
-	const login = {
-		instance: state.name,
-		url: state.url,
-		email: admin.email
+function parseBody(status, text) {
+	if (text.length === 0) return {
+		status,
+		text,
+		json: { parsed: false }
 	};
-	switch (admin.kind) {
-		case "generated": return {
-			...login,
-			password: storedPassword(state, secrets),
-			note: null
-		};
-		case "legacy-default": return {
-			...login,
-			password: storedPassword(state, secrets),
-			note: LEGACY_NOTE
+	try {
+		return {
+			status,
+			text,
+			json: {
+				parsed: true,
+				value: JSON.parse(text)
+			}
 		};
-		case "prompted": return {
-			...login,
-			password: null,
-			note: PROMPTED_NOTE
+	} catch {
+		return {
+			status,
+			text,
+			json: { parsed: false }
 		};
 	}
 }
-function credentialsLines(report) {
-	const url = report.url === null ? [] : [`Metabase: ${report.url}`];
-	const password = report.password === null ? [] : [`Password: ${report.password}`];
-	const note = report.note === null ? [] : [report.note];
-	return [
-		...url,
-		`Email: ${report.email}`,
-		...password,
-		...note
-	];
+function jsonValue(body) {
+	return body.json.parsed ? body.json.value : void 0;
 }
-//#endregion
-//#region src/commands/define.ts
-function repeatedValues(rawArgs, flag) {
-	const values = [];
-	const inline = `${flag}=`;
-	for (let index = 0; index < rawArgs.length; index += 1) {
-		const arg = rawArgs[index];
-		if (arg === void 0) continue;
-		if (arg.startsWith(inline)) values.push(arg.slice(inline.length));
-		else if (arg === flag) {
-			const next = rawArgs[index + 1];
-			if (next !== void 0) {
-				values.push(next);
-				index += 1;
-			}
-		}
+function serverMessage(body) {
+	const parsed = ErrorMessage.safeParse(jsonValue(body));
+	if (parsed.success) return parsed.data.message;
+	const text = body.text.trim();
+	return text.length === 0 ? `HTTP ${body.status}` : text;
+}
+function serverErrors(body) {
+	const parsed = ErrorFields.safeParse(jsonValue(body));
+	return parsed.success ? parsed.data.errors : null;
+}
+function failureFor(path, body) {
+	if (body.status === SERVICE_UNAVAILABLE_STATUS) {
+		const initializing = Initializing.safeParse(jsonValue(body));
+		if (initializing.success) return new MetabaseInitializingError(initializing.data.progress);
 	}
-	return values;
+	return new MetabaseApiError({
+		status: body.status,
+		path,
+		message: serverMessage(body),
+		errors: serverErrors(body)
+	});
 }
-function defineRdeCommand(def) {
-	return defineCommand({
-		meta: def.meta,
-		...def.args !== void 0 && { args: def.args },
-		async run({ args, rawArgs }) {
+function shapeError(path, body, reason) {
+	return new MetabaseApiError({
+		status: body.status,
+		path,
+		message: reason,
+		errors: null
+	});
+}
+function isTimeout(error) {
+	return error instanceof Error && error.name === "TimeoutError";
+}
+function describeCause(error) {
+	if (error instanceof Error && error.cause instanceof Error) return error.cause.message;
+	return error instanceof Error ? error.message : String(error);
+}
+function createHttp(options) {
+	const fetchImpl = options.fetchImpl ?? fetch;
+	const baseUrl = options.baseUrl.replace(/\/+$/, "");
+	async function send(method, path, body) {
+		const url = `${baseUrl}${path}`;
+		const headers = {
+			accept: JSON_CONTENT_TYPE,
+			...authHeaders(options.auth)
+		};
+		const init = {
+			method,
+			headers,
+			signal: AbortSignal.any([options.signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)])
+		};
+		if (body !== void 0) {
+			headers["content-type"] = JSON_CONTENT_TYPE;
+			init.body = JSON.stringify(body);
+		}
+		try {
+			return await fetchImpl(url, init);
+		} catch (error) {
+			if (options.signal.aborted) throw new AbortError();
+			if (isTimeout(error)) throw new MetabaseUnreachableError(url, `no response within ${REQUEST_TIMEOUT_MS}ms`);
+			throw new MetabaseUnreachableError(url, describeCause(error));
+		}
+	}
+	async function requestBody(method, path, body) {
+		const response = await send(method, path, body);
+		const parsed = parseBody(response.status, await response.text());
+		if (!response.ok) throw failureFor(path, parsed);
+		return parsed;
+	}
+	return {
+		async requestJson(method, path, request) {
+			const body = await requestBody(method, path, request.body);
+			if (!body.json.parsed) throw shapeError(path, body, "expected a JSON body");
 			try {
-				await def.run(args, rawArgs);
+				return request.schema.parse(body.json.value);
 			} catch (error) {
-				reportError(error);
+				if (error instanceof ZodError) throw shapeError(path, body, `unexpected response shape:\n${z.prettifyError(error)}`);
+				throw error;
 			}
+		},
+		async requestNoContent(method, path, request = {}) {
+			await requestBody(method, path, request.body);
 		}
-	});
+	};
 }
-//#endregion
-//#region src/commands/instance.ts
-async function defaultInstanceName() {
-	const config = await readGlobalConfig();
-	if (config === null) throw new ConfigError("no Metabase instance yet; run `rde init` first");
-	return config.defaultInstance;
+function contentLength(response) {
+	const header = response.headers.get(CONTENT_LENGTH_HEADER);
+	if (header === null) return null;
+	const total = Number.parseInt(header, 10);
+	return Number.isNaN(total) ? null : total;
 }
-async function instanceNameOrDefault() {
+function progressCounter(total, onProgress) {
+	let received = 0;
+	return (chunk) => {
+		received += chunk.byteLength;
+		onProgress({
+			received,
+			total
+		});
+		return chunk;
+	};
+}
+async function downloadFile(url, destination, options) {
+	const fetchImpl = options.fetchImpl ?? fetch;
+	let response;
 	try {
-		return (await readGlobalConfig())?.defaultInstance ?? "default";
+		response = await fetchImpl(url, { signal: options.signal });
 	} catch (error) {
-		if (error instanceof ConfigError) return DEFAULT_INSTANCE_NAME;
-		throw error;
+		if (options.signal.aborted) throw new AbortError();
+		throw new DownloadError(url, describeCause(error));
 	}
-}
-//#endregion
-//#region src/commands/credentials.ts
-const credentials = defineRdeCommand({
-	meta: {
-		name: "credentials",
-		description: "Print the admin login of the instance: URL, email, and password"
-	},
-	args: { json: {
-		type: "boolean",
-		description: "Print the login as JSON",
-		default: false
-	} },
-	async run(args) {
-		const name = await defaultInstanceName();
-		const report = credentialsReport(await requireInstanceState(name), await readInstanceSecrets(name));
-		if (args.json) {
-			printJson(report);
-			return;
-		}
-		printLines(credentialsLines(report));
+	if (!response.ok) throw new DownloadError(url, `HTTP ${response.status}`);
+	if (response.body === null) throw new DownloadError(url, "empty response");
+	const partial = `${destination}${PARTIAL_SUFFIX}`;
+	const count = progressCounter(contentLength(response), options.onProgress);
+	try {
+		await pipeline(Readable.fromWeb(response.body), async function* (chunks) {
+			for await (const chunk of chunks) yield count(chunk);
+		}, createWriteStream(partial), { signal: options.signal });
+	} catch (error) {
+		await promises.rm(partial, { force: true });
+		if (options.signal.aborted) throw new AbortError();
+		throw new DownloadError(url, describeCause(error));
 	}
-});
-//#endregion
-//#region src/connections/parse-uri.ts
-var UriParseError = class extends Error {
-	engine;
-	reason;
-	example;
-	constructor(engine, reason) {
-		const example = EXAMPLE_URIS[engine] ?? null;
-		super(describeFailure(engine, reason, example));
-		this.name = "UriParseError";
-		this.engine = engine;
-		this.reason = reason;
-		this.example = example;
-	}
-};
-function describeFailure(engine, reason, example) {
-	if (reason === "unsupported-engine") return `Connection strings for ${engine} can't be parsed here; enter the fields one by one instead`;
-	return `That doesn't look like a ${engine} connection string${example === null ? "" : `, for example ${example}`}`;
-}
-const EXAMPLE_URIS = {
-	athena: "jdbc:athena://WorkGroup=primary;Region=us-east-1;",
-	"bigquery-cloud-sdk": "jdbc:bigquery://https://www.googleapis.com/bigquery/v2:443;ProjectId=MyBigQueryProject;OAuthType=1;",
-	clickhouse: "jdbc:clickhouse:https://localhost:8443?ssl=true",
-	druid: "jdbc:avatica:remote:url=http://localhost:8888/druid/v2/sql/avatica/;transparent_reconnection=true",
-	"druid-jdbc": "jdbc:avatica:remote:url=http://localhost:8888/druid/v2/sql/avatica/;transparent_reconnection=true",
-	databricks: "jdbc:databricks://127.0.0.1:8123;httpPath=/sql/1.0/endpoints/abc;OAuthSecret=1234567890;OAuth2ClientId=xyz",
-	mongo: "mongodb://user:pass@localhost:27017/dbname?authSource=admin",
-	mysql: "jdbc:mysql://user:pass@host:3306/dbname?ssl=true",
-	oracle: "jdbc:oracle:thin:@mydbhost:1521/mydbservice?ssl_server_cert_dn=ServerDN",
-	postgres: "jdbc:postgresql://localhost:5432/mydb",
-	"presto-jdbc": "jdbc:presto://host:1234/sample-catalog/sample-schema?SSL=true&SSLTrustStorePassword=1234",
-	redshift: "jdbc:redshift://examplecluster.abc123xyz789.us-west-2.redshift.amazonaws.com:5439/dev",
-	snowflake: "snowflake://example.snowflakecomputing.com/?db=maindb&warehouse=mainwarehouse",
-	sparksql: "jdbc:sparksql:Server=127.0.0.1;",
-	sqlite: "jdbc:sqlite:///C:/path/to/database.db",
-	sqlserver: "jdbc:sqlserver://mydbhost:1433;databaseName=mydb",
-	starburst: "jdbc:trino://starburst.example.com:43011/hive/sales?user=test&password=secret&SSL=true&roles=system:myrole",
-	vertica: "jdbc:vertica://vertica.example.com:1234/databaseName?user=jane"
-};
-const jdbcPrefix = "(?<hasJdbcPrefix>jdbc:)?";
-const userPass = "(?:(?<username>[^:/?#]+)(?::(?<password>[^@/?#]*))?@)?";
-const hostAndPort = "(?<host>[^:/?#]+)?(?::(?<port>\\d+)?)?";
-const params = "(?:(?<params>.*))?";
-const semicolonParams = ";?(?<semicolonParams>.*)?;?";
-const druidRegex = new RegExp("^" + jdbcPrefix + "(?<protocol>avatica)" + ":remote:url=(https?://)?(?<host>[^:/]+):(?<port>\\d+)(?<path>/[^;]*)" + semicolonParams + "$", "i");
-const mongoRegex = new RegExp("^(?<protocol>mongodb(?:\\+srv)?)://" + userPass + "(?<host>[^/?#]+)?" + "(?:/(?<database>[^/?#]*))?" + "(?:\\?(?<params>.*))?" + "$", "i");
-const CONNECTION_STRING_REGEXES = {
-	athena: [/* @__PURE__ */ new RegExp("^(?<hasJdbcPrefix>jdbc:)?(?<protocol>awsathena|athena)://((?<host>athena.*com)(?::(?<port>\\d+)?)?)?;?(?<semicolonParams>.*)?$", "i")],
-	redshift: [new RegExp("^" + jdbcPrefix + "(?<protocol>redshift)://" + userPass + hostAndPort + "(?:/(?<database>[^/?#;]*))?" + ";?" + "(?<semicolonParams>.*)?" + "$", "i")],
-	"bigquery-cloud-sdk": [new RegExp("^" + jdbcPrefix + "(?<protocol>bigquery)://" + "(https?://)?(?<host>[^:/]+)(?<path>/[^;]*):(?<port>\\d+)" + semicolonParams + "$", "i")],
-	clickhouse: [new RegExp("^" + jdbcPrefix + "(?<protocol>clickhouse|ch):(?:https?:)?//" + userPass + hostAndPort + "(?:/(?<database>[^/?#]*))?" + params)],
-	databricks: [new RegExp("^" + jdbcPrefix + "(?<protocol>databricks)://" + hostAndPort + "(?:/(?<schema>[^/?#]*))?" + semicolonParams + "$", "i")],
-	druid: [druidRegex],
-	"druid-jdbc": [druidRegex],
-	mongo: [mongoRegex],
-	mysql: [new RegExp("^" + jdbcPrefix + "(?<protocol>mysql)://" + userPass + hostAndPort + "(?:/(?<database>[^/?#]*))?" + params + "$", "i")],
-	postgres: [new RegExp("^" + jdbcPrefix + "(?<protocol>postgres(?:ql)?)://" + userPass + hostAndPort + "(?:/(?<database>[^/?#]*))?" + params + "$", "i")],
-	"presto-jdbc": [new RegExp("^" + jdbcPrefix + "(?<protocol>presto)://" + hostAndPort + "(?:/(?<catalog>[^/?#]*)/(?<schema>[^/?#]*))?" + params + "$", "i")],
-	oracle: [new RegExp("^" + jdbcPrefix + "(?<protocol>oracle):(?<subprotocol>thin):" + "(?:(?<username>[^@/]+)/(?<password>[^@/]+))?" + "@" + "(?<host>[^:/?#]+)(?::(?<port>\\d+))?(?:/(?<database>[^/?#]+))?" + params + "$", "i")],
-	snowflake: [new RegExp("^" + jdbcPrefix + "(?<protocol>snowflake)://" + userPass + hostAndPort + "(?:/(?<database>[^/?#]*)?)?" + params + "$", "i")],
-	sparksql: [new RegExp("^" + jdbcPrefix + "(?<protocol>sparksql):" + semicolonParams + "$", "i"), new RegExp("^" + jdbcPrefix + "(?<protocol>hive2)://" + hostAndPort + "(?:/(?<database>[^/?#;]*))?" + semicolonParams + "$", "i")],
-	sqlite: [new RegExp("^" + jdbcPrefix + "(?<protocol>sqlite):///(?<path>.+)$", "i")],
-	sqlserver: [new RegExp("^" + jdbcPrefix + "(?<protocol>sqlserver)://" + hostAndPort + semicolonParams + "$", "i")],
-	starburst: [new RegExp("^" + jdbcPrefix + "(?<protocol>trino)://" + hostAndPort + "(?:/(?<catalog>[^/?#]*)/(?<schema>[^/?#]*))?" + params + "$", "i")],
-	vertica: [new RegExp("^" + jdbcPrefix + "(?<protocol>vertica)://" + hostAndPort + "(?:/(?<database>[^/?#]*))?" + params + "$", "i")]
-};
-function parseUri(uri, engine) {
-	const regexes = CONNECTION_STRING_REGEXES[engine];
-	if (regexes === void 0) return new UriParseError(engine, "unsupported-engine");
-	const trimmed = uri.trim();
-	for (const regex of regexes) {
-		const match = trimmed.match(regex);
-		if (match !== null) return fromMatch(engine, trimmed, match);
-	}
-	return new UriParseError(engine, "no-match");
-}
-function detectEngine(uri) {
-	const trimmed = uri.trim();
-	return Object.entries(CONNECTION_STRING_REGEXES).filter(([, regexes]) => regexes.some((regex) => regex.test(trimmed))).map(([engine]) => engine);
-}
-function fromMatch(engine, uri, match) {
-	const groups = match.groups;
-	if (groups === void 0) throw new Error(`the ${engine} connection string pattern has no named groups`);
-	const group = (name) => groups[name] ?? null;
-	const protocol = group("protocol");
-	if (protocol === null) throw new Error(`the ${engine} connection string pattern has no protocol group`);
-	return {
-		engine,
-		uri,
-		protocol,
-		hasJdbcPrefix: group("hasJdbcPrefix") !== null,
-		username: safeDecode(group("username")),
-		password: safeDecode(group("password")),
-		host: group("host"),
-		port: group("port"),
-		database: group("database"),
-		catalog: group("catalog"),
-		schema: group("schema"),
-		path: group("path"),
-		...parseParams(group("params"), group("semicolonParams"))
-	};
-}
-function parseParams(query, semicolon) {
-	if (semicolon !== null) return {
-		params: parseSemicolonParams(semicolon),
-		paramSeparator: ";"
-	};
-	return {
-		params: query === null ? {} : Object.fromEntries(new URLSearchParams(query)),
-		paramSeparator: "&"
-	};
-}
-function parseSemicolonParams(text) {
-	const result = {};
-	for (const param of text.split(";")) {
-		const separator = param.indexOf("=");
-		const key = separator === -1 ? param : param.slice(0, separator);
-		if (key.length === 0) continue;
-		result[key] = decodeComponent(separator === -1 ? "" : param.slice(separator + 1));
-	}
-	return result;
-}
-function safeDecode(text) {
-	return text === null ? null : decodeComponent(text);
-}
-function decodeComponent(text) {
-	try {
-		return decodeURIComponent(text);
-	} catch {
-		return text;
-	}
-}
-//#endregion
-//#region src/connections/engines.ts
-const ELEVATED_ENGINES = [
-	"postgres",
-	"mysql",
-	"clickhouse",
-	"snowflake",
-	"bigquery-cloud-sdk",
-	"redshift",
-	"databricks",
-	"sqlserver",
-	"athena",
-	"starburst",
-	"presto-jdbc",
-	"mongo",
-	"sqlite",
-	"druid-jdbc"
-];
-const HIDDEN_ENGINES = /* @__PURE__ */ new Set(["h2"]);
-const PROMPT_KINDS = {
-	string: "text",
-	password: "password",
-	integer: "integer",
-	boolean: "boolean",
-	select: "select",
-	text: "multiline",
-	textFile: "file",
-	section: "none",
-	info: "none",
-	hidden: "none"
-};
-function promptKindFor(field) {
-	if (field.type === void 0) return "text";
-	return PROMPT_KINDS[field.type] ?? "text";
-}
-function fieldLabel(field) {
-	return field["display-name"] ?? field.name;
-}
-function flattenFields(fields) {
-	return fields.flatMap((field) => isFieldGroup(field) ? field.fields : [field]);
-}
-function isFieldGroup(field) {
-	return "fields" in field && field.type === "group";
-}
-function toEntry(key, engine) {
-	return {
-		key,
-		displayName: engine["driver-name"],
-		creatable: engine["creatable?"] !== false,
-		supersededBy: engine["superseded-by"],
-		exampleUri: EXAMPLE_URIS[key] ?? null
-	};
-}
-function rank(key) {
-	const position = ELEVATED_ENGINES.indexOf(key);
-	return position === -1 ? ELEVATED_ENGINES.length : position;
-}
-function compareEntries(a, b) {
-	const byRank = rank(a.key) - rank(b.key);
-	return byRank !== 0 ? byRank : a.displayName.localeCompare(b.displayName);
-}
-function engineCatalog(engines) {
-	const entries = /* @__PURE__ */ new Map();
-	const fieldsByEngine = /* @__PURE__ */ new Map();
-	for (const [key, engine] of Object.entries(engines)) {
-		if (HIDDEN_ENGINES.has(key)) continue;
-		entries.set(key, toEntry(key, engine));
-		fieldsByEngine.set(key, flattenFields(engine["details-fields"] ?? []));
-	}
-	const ordered = [...entries.values()].toSorted(compareEntries);
-	return {
-		list: () => [...ordered],
-		entry: (engine) => entries.get(engine) ?? null,
-		fields: (engine) => {
-			const fields = fieldsByEngine.get(engine);
-			if (fields === void 0) throw new Error(`unknown engine ${engine}`);
-			return [...fields];
-		}
-	};
-}
-//#endregion
-//#region src/metabase/domain/health.ts
-const Health = z.object({ status: z.literal("ok") }).loose();
-const Initializing = z.object({
-	status: z.literal("initializing"),
-	progress: z.number()
-}).loose();
-//#endregion
-//#region src/metabase/http.ts
-const REQUEST_TIMEOUT_MS = 3e4;
-const PARTIAL_SUFFIX = ".part";
-const CONTENT_LENGTH_HEADER = "content-length";
-const SESSION_HEADER = "X-Metabase-Session";
-const API_KEY_HEADER = "X-Api-Key";
-const JSON_CONTENT_TYPE = "application/json";
-const SERVICE_UNAVAILABLE_STATUS = 503;
-const NO_AUTH = { kind: "none" };
-const ErrorMessage = z.object({ message: z.string() }).loose();
-const ErrorFields = z.object({ errors: z.record(z.string(), z.string()) }).loose();
-function authHeaders(auth) {
-	switch (auth.kind) {
-		case "none": return {};
-		case "session": return { [SESSION_HEADER]: auth.id };
-		case "api-key": return { [API_KEY_HEADER]: auth.key };
-	}
-}
-function parseBody(status, text) {
-	if (text.length === 0) return {
-		status,
-		text,
-		json: { parsed: false }
-	};
-	try {
-		return {
-			status,
-			text,
-			json: {
-				parsed: true,
-				value: JSON.parse(text)
-			}
-		};
-	} catch {
-		return {
-			status,
-			text,
-			json: { parsed: false }
-		};
-	}
-}
-function jsonValue(body) {
-	return body.json.parsed ? body.json.value : void 0;
-}
-function serverMessage(body) {
-	const parsed = ErrorMessage.safeParse(jsonValue(body));
-	if (parsed.success) return parsed.data.message;
-	const text = body.text.trim();
-	return text.length === 0 ? `HTTP ${body.status}` : text;
-}
-function serverErrors(body) {
-	const parsed = ErrorFields.safeParse(jsonValue(body));
-	return parsed.success ? parsed.data.errors : null;
-}
-function failureFor(path, body) {
-	if (body.status === SERVICE_UNAVAILABLE_STATUS) {
-		const initializing = Initializing.safeParse(jsonValue(body));
-		if (initializing.success) return new MetabaseInitializingError(initializing.data.progress);
-	}
-	return new MetabaseApiError({
-		status: body.status,
-		path,
-		message: serverMessage(body),
-		errors: serverErrors(body)
-	});
-}
-function shapeError(path, body, reason) {
-	return new MetabaseApiError({
-		status: body.status,
-		path,
-		message: reason,
-		errors: null
-	});
-}
-function isTimeout(error) {
-	return error instanceof Error && error.name === "TimeoutError";
-}
-function describeCause(error) {
-	if (error instanceof Error && error.cause instanceof Error) return error.cause.message;
-	return error instanceof Error ? error.message : String(error);
-}
-function createHttp(options) {
-	const fetchImpl = options.fetchImpl ?? fetch;
-	const baseUrl = options.baseUrl.replace(/\/+$/, "");
-	async function send(method, path, body) {
-		const url = `${baseUrl}${path}`;
-		const headers = {
-			accept: JSON_CONTENT_TYPE,
-			...authHeaders(options.auth)
-		};
-		const init = {
-			method,
-			headers,
-			signal: AbortSignal.any([options.signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)])
-		};
-		if (body !== void 0) {
-			headers["content-type"] = JSON_CONTENT_TYPE;
-			init.body = JSON.stringify(body);
-		}
-		try {
-			return await fetchImpl(url, init);
-		} catch (error) {
-			if (options.signal.aborted) throw new AbortError();
-			if (isTimeout(error)) throw new MetabaseUnreachableError(url, `no response within ${REQUEST_TIMEOUT_MS}ms`);
-			throw new MetabaseUnreachableError(url, describeCause(error));
-		}
-	}
-	async function requestBody(method, path, body) {
-		const response = await send(method, path, body);
-		const parsed = parseBody(response.status, await response.text());
-		if (!response.ok) throw failureFor(path, parsed);
-		return parsed;
-	}
-	return {
-		async requestJson(method, path, request) {
-			const body = await requestBody(method, path, request.body);
-			if (!body.json.parsed) throw shapeError(path, body, "expected a JSON body");
-			try {
-				return request.schema.parse(body.json.value);
-			} catch (error) {
-				if (error instanceof ZodError) throw shapeError(path, body, `unexpected response shape:\n${z.prettifyError(error)}`);
-				throw error;
-			}
-		},
-		async requestNoContent(method, path, request = {}) {
-			await requestBody(method, path, request.body);
-		}
-	};
-}
-function contentLength(response) {
-	const header = response.headers.get(CONTENT_LENGTH_HEADER);
-	if (header === null) return null;
-	const total = Number.parseInt(header, 10);
-	return Number.isNaN(total) ? null : total;
-}
-function progressCounter(total, onProgress) {
-	let received = 0;
-	return (chunk) => {
-		received += chunk.byteLength;
-		onProgress({
-			received,
-			total
-		});
-		return chunk;
-	};
-}
-async function downloadFile(url, destination, options) {
-	const fetchImpl = options.fetchImpl ?? fetch;
-	let response;
-	try {
-		response = await fetchImpl(url, { signal: options.signal });
-	} catch (error) {
-		if (options.signal.aborted) throw new AbortError();
-		throw new DownloadError(url, describeCause(error));
-	}
-	if (!response.ok) throw new DownloadError(url, `HTTP ${response.status}`);
-	if (response.body === null) throw new DownloadError(url, "empty response");
-	const partial = `${destination}${PARTIAL_SUFFIX}`;
-	const count = progressCounter(contentLength(response), options.onProgress);
-	try {
-		await pipeline(Readable.fromWeb(response.body), async function* (chunks) {
-			for await (const chunk of chunks) yield count(chunk);
-		}, createWriteStream(partial), { signal: options.signal });
-	} catch (error) {
-		await promises.rm(partial, { force: true });
-		if (options.signal.aborted) throw new AbortError();
-		throw new DownloadError(url, describeCause(error));
-	}
-	await promises.rename(partial, destination);
-}
+	await promises.rename(partial, destination);
+}
 //#endregion
 //#region src/metabase/domain/permissions-group.ts
 const PermissionsGroup = z.object({
@@ -1094,293 +791,657 @@ function apiKeyResource(http) {
 	};
 }
 //#endregion
-//#region src/metabase/domain/database.ts
-const InitialSyncStatus = z.enum([
-	"incomplete",
-	"complete",
-	"aborted"
-]);
-const Database = z.object({
-	id: z.int(),
-	name: z.string(),
-	engine: z.string(),
-	initial_sync_status: InitialSyncStatus
-}).loose();
-const DatabaseList = z.object({
-	data: z.array(Database),
-	total: z.int()
-}).loose();
-const DatabaseValidation = z.discriminatedUnion("valid", [z.object({ valid: z.literal(true) }).loose(), z.object({
-	valid: z.literal(false),
-	message: z.string().optional(),
-	errors: z.record(z.string(), z.string()).optional()
-}).loose()]);
+//#region src/metabase/domain/database.ts
+const InitialSyncStatus = z.enum([
+	"incomplete",
+	"complete",
+	"aborted"
+]);
+const Database = z.object({
+	id: z.int(),
+	name: z.string(),
+	engine: z.string(),
+	initial_sync_status: InitialSyncStatus
+}).loose();
+const DatabaseList = z.object({
+	data: z.array(Database),
+	total: z.int()
+}).loose();
+const DatabaseValidation = z.discriminatedUnion("valid", [z.object({ valid: z.literal(true) }).loose(), z.object({
+	valid: z.literal(false),
+	message: z.string().optional(),
+	errors: z.record(z.string(), z.string()).optional()
+}).loose()]);
+//#endregion
+//#region src/metabase/resources/database.ts
+function databaseResource(http) {
+	/** POST /api/database/validate */
+	async function validate(connection) {
+		return http.requestJson("POST", "/api/database/validate", {
+			body: { details: connection },
+			schema: DatabaseValidation
+		});
+	}
+	/** POST /api/database */
+	async function create(request) {
+		return http.requestJson("POST", "/api/database", {
+			body: {
+				...request,
+				is_full_sync: true
+			},
+			schema: Database
+		});
+	}
+	/** GET /api/database */
+	async function list() {
+		return http.requestJson("GET", "/api/database", { schema: DatabaseList });
+	}
+	/** GET /api/database/:id */
+	async function get(id) {
+		return http.requestJson("GET", `/api/database/${id}`, { schema: Database });
+	}
+	return {
+		validate,
+		create,
+		list,
+		get
+	};
+}
+//#endregion
+//#region src/metabase/resources/health.ts
+function healthResource(http) {
+	/** GET /api/health */
+	async function get() {
+		return http.requestJson("GET", "/api/health", { schema: Health });
+	}
+	return { get };
+}
+//#endregion
+//#region src/metabase/resources/permissions-group.ts
+function permissionsGroupResource(http) {
+	/** GET /api/permissions/group */
+	async function list() {
+		return http.requestJson("GET", "/api/permissions/group", { schema: PermissionsGroupList });
+	}
+	return { list };
+}
+z.enum(["read-only", "read-write"]);
+const RemoteSyncSettingsResult = z.object({
+	success: z.boolean(),
+	task_id: z.int().optional()
+}).loose();
+const RemoteSyncTestConnection = z.object({ status: z.literal("success") }).loose();
+const SyncTaskStatus$1 = z.enum([
+	"running",
+	"successful",
+	"errored",
+	"cancelled",
+	"timed-out",
+	"conflict"
+]);
+const SyncTask = z.object({
+	id: z.int(),
+	sync_task_type: z.enum(["import", "export"]),
+	progress: z.number().nullable(),
+	status: SyncTaskStatus$1,
+	error_message: z.string().nullable().optional()
+}).loose();
+//#endregion
+//#region src/metabase/resources/remote-sync.ts
+function remoteSyncResource(http) {
+	/** PUT /api/ee/remote-sync/settings */
+	async function updateSettings(settings) {
+		return http.requestJson("PUT", "/api/ee/remote-sync/settings", {
+			body: settings,
+			schema: RemoteSyncSettingsResult
+		});
+	}
+	/** POST /api/ee/remote-sync/test-connection; an empty body tests the saved url and token. */
+	async function testConnection(connection = {}) {
+		return http.requestJson("POST", "/api/ee/remote-sync/test-connection", {
+			body: connection,
+			schema: RemoteSyncTestConnection
+		});
+	}
+	/** GET /api/ee/remote-sync/current-task */
+	async function currentTask() {
+		return http.requestJson("GET", "/api/ee/remote-sync/current-task", { schema: SyncTask.nullable() });
+	}
+	return {
+		updateSettings,
+		testConnection,
+		currentTask
+	};
+}
+//#endregion
+//#region src/metabase/domain/session.ts
+const Session = z.object({ id: z.string() }).loose();
+//#endregion
+//#region src/metabase/domain/session-properties.ts
+const EngineFieldOption = z.object({
+	name: z.string(),
+	value: z.unknown()
+}).loose();
+const EngineField = z.object({
+	name: z.string(),
+	"display-name": z.string().optional(),
+	type: z.string().optional(),
+	required: z.boolean().optional(),
+	default: z.unknown().optional(),
+	placeholder: z.unknown().optional(),
+	"visible-if": z.record(z.string(), z.unknown()).optional(),
+	options: z.array(EngineFieldOption).optional(),
+	"helper-text": z.string().optional()
+}).loose();
+const EngineFieldGroup = z.object({
+	type: z.literal("group"),
+	fields: z.array(EngineField)
+}).loose();
+const Engine = z.object({
+	"driver-name": z.string(),
+	"details-fields": z.array(z.union([EngineFieldGroup, EngineField])).optional(),
+	"superseded-by": z.string().nullable(),
+	"creatable?": z.boolean().optional()
+}).loose();
+const SessionProperties = z.object({
+	"setup-token": z.string().nullable(),
+	"has-user-setup": z.boolean(),
+	version: z.object({ tag: z.string() }).loose(),
+	"token-features": z.record(z.string(), z.boolean()),
+	engines: z.record(z.string(), Engine)
+}).loose();
+//#endregion
+//#region src/metabase/resources/session.ts
+function sessionResource(http) {
+	/** GET /api/session/properties */
+	async function properties() {
+		return http.requestJson("GET", "/api/session/properties", { schema: SessionProperties });
+	}
+	/** POST /api/session */
+	async function create(credentials) {
+		return http.requestJson("POST", "/api/session", {
+			body: credentials,
+			schema: Session
+		});
+	}
+	return {
+		properties,
+		create
+	};
+}
+//#endregion
+//#region src/metabase/resources/setting.ts
+const PREMIUM_EMBEDDING_TOKEN_SETTING = "premium-embedding-token";
+const TRANSFORMS_ENABLED_SETTING = "transforms-enabled";
+function settingResource(http) {
+	/** PUT /api/setting/premium-embedding-token */
+	async function setPremiumEmbeddingToken(value) {
+		await http.requestNoContent("PUT", `/api/setting/${PREMIUM_EMBEDDING_TOKEN_SETTING}`, { body: { value } });
+	}
+	/** PUT /api/setting/transforms-enabled */
+	async function enableTransforms() {
+		await http.requestNoContent("PUT", `/api/setting/${TRANSFORMS_ENABLED_SETTING}`, { body: { value: true } });
+	}
+	return {
+		setPremiumEmbeddingToken,
+		enableTransforms
+	};
+}
+//#endregion
+//#region src/metabase/domain/setup.ts
+const SetupResult = z.object({ id: z.string() }).loose();
+//#endregion
+//#region src/metabase/resources/setup.ts
+function setupResource(http) {
+	/** POST /api/setup */
+	async function create(request) {
+		return http.requestJson("POST", "/api/setup", {
+			body: request,
+			schema: SetupResult
+		});
+	}
+	return { create };
+}
+//#endregion
+//#region src/metabase/domain/token-status.ts
+const TokenStatus = z.object({
+	valid: z.boolean(),
+	status: z.string(),
+	features: z.array(z.string()).default([]),
+	"valid-thru": z.string().optional(),
+	"plan-alias": z.string().optional()
+}).loose();
+//#endregion
+//#region src/metabase/resources/token-status.ts
+function tokenStatusResource(http) {
+	/** GET /api/premium-features/token/status */
+	async function get() {
+		return http.requestJson("GET", "/api/premium-features/token/status", { schema: TokenStatus });
+	}
+	return { get };
+}
+//#endregion
+//#region src/metabase/domain/user.ts
+const CurrentUser = z.object({ id: z.int() }).loose();
 //#endregion
-//#region src/metabase/resources/database.ts
-function databaseResource(http) {
-	/** POST /api/database/validate */
-	async function validate(connection) {
-		return http.requestJson("POST", "/api/database/validate", {
-			body: { details: connection },
-			schema: DatabaseValidation
-		});
+//#region src/metabase/resources/user.ts
+function userResource(http) {
+	/** GET /api/user/current */
+	async function current() {
+		return http.requestJson("GET", "/api/user/current", { schema: CurrentUser });
 	}
-	/** POST /api/database */
-	async function create(request) {
-		return http.requestJson("POST", "/api/database", {
-			body: {
-				...request,
-				is_full_sync: true
-			},
-			schema: Database
-		});
+	return { current };
+}
+//#endregion
+//#region src/metabase/client.ts
+const HEALTH_POLL_INTERVAL_MS = 2e3;
+function createMetabaseClient(baseUrl, auth, signal, options = {}) {
+	const http = createHttp({
+		baseUrl,
+		auth,
+		signal,
+		...options
+	});
+	return {
+		baseUrl,
+		signal,
+		health: healthResource(http),
+		session: sessionResource(http),
+		setup: setupResource(http),
+		permissionsGroup: permissionsGroupResource(http),
+		apiKey: apiKeyResource(http),
+		setting: settingResource(http),
+		tokenStatus: tokenStatusResource(http),
+		database: databaseResource(http),
+		remoteSync: remoteSyncResource(http),
+		user: userResource(http)
+	};
+}
+function isNotReadyYet(error) {
+	return error instanceof MetabaseInitializingError || error instanceof MetabaseUnreachableError;
+}
+async function waitForHealth(client, options) {
+	const deadline = Date.now() + options.timeoutMs;
+	const interval = options.pollIntervalMs ?? HEALTH_POLL_INTERVAL_MS;
+	for (;;) {
+		try {
+			await client.health.get();
+			return;
+		} catch (error) {
+			if (!isNotReadyYet(error)) throw error;
+			if (error instanceof MetabaseInitializingError) options.onProgress(error.progress);
+		}
+		if (Date.now() >= deadline) throw new MetabaseUnreachableError(client.baseUrl, `not healthy after ${Math.round(options.timeoutMs / 1e3)}s`);
+		try {
+			await setTimeout$1(interval, void 0, { signal: client.signal });
+		} catch {
+			throw new AbortError();
+		}
 	}
-	/** GET /api/database */
-	async function list() {
-		return http.requestJson("GET", "/api/database", { schema: DatabaseList });
+}
+//#endregion
+//#region src/steps/credentials.ts
+const LEGACY_NOTE = "This is the public default password; when the instance holds nothing you need, `rde uninstall` then `rde init` recreates it with a generated one";
+const PROMPTED_NOTE = "The password is the one entered during `rde init`; rde never stored it";
+function storedPassword(state, secrets) {
+	if (secrets === null || secrets.admin === null) throw new ConfigError(`the secrets file of instance ${state.name} holds no admin password; \`rde doctor\` says what to do`);
+	return secrets.admin.password;
+}
+function storedApiKey(state, secrets) {
+	if (secrets === null || secrets.apiKey === null) throw new ConfigError(`the secrets file of instance ${state.name} holds no API key; run \`rde init --only api-key\``);
+	return secrets.apiKey;
+}
+function hostCredentialsClient(signal) {
+	return (baseUrl, auth) => createMetabaseClient(baseUrl, auth, signal);
+}
+function isNotReady$1(error) {
+	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
+}
+async function hasAdminOutsideRde(state, client) {
+	if (state.url === null) return false;
+	try {
+		return (await client(state.url, NO_AUTH).session.properties())["has-user-setup"];
+	} catch (error) {
+		if (isNotReady$1(error)) return false;
+		throw error;
 	}
-	/** GET /api/database/:id */
-	async function get(id) {
-		return http.requestJson("GET", `/api/database/${id}`, { schema: Database });
+}
+async function credentialsReport(state, secrets, client) {
+	const admin = state.admin;
+	if (admin === null) {
+		if (await hasAdminOutsideRde(state, client)) {
+			if (secrets !== null && secrets.admin !== null) throw new ConfigError(`instance ${state.name} has an admin user rde has not recorded yet; run \`rde init\` to record it`);
+			throw new ConfigError(`instance ${state.name} has an admin user created outside rde; rde has no password for it`);
+		}
+		throw new ConfigError(`instance ${state.name} has no admin user yet; run \`rde init\``);
 	}
-	return {
-		validate,
-		create,
-		list,
-		get
+	const login = {
+		instance: state.name,
+		url: state.url,
+		email: admin.email
 	};
+	switch (admin.kind) {
+		case "generated": return {
+			...login,
+			password: storedPassword(state, secrets),
+			note: null
+		};
+		case "legacy-default": return {
+			...login,
+			password: storedPassword(state, secrets),
+			note: LEGACY_NOTE
+		};
+		case "prompted": return {
+			...login,
+			password: null,
+			note: PROMPTED_NOTE
+		};
+	}
+}
+function credentialsLines(report) {
+	const url = report.url === null ? [] : [`Metabase: ${report.url}`];
+	const password = report.password === null ? [] : [`Password: ${report.password}`];
+	const note = report.note === null ? [] : [report.note];
+	return [
+		...url,
+		`Email: ${report.email}`,
+		...password,
+		...note
+	];
 }
 //#endregion
-//#region src/metabase/resources/health.ts
-function healthResource(http) {
-	/** GET /api/health */
-	async function get() {
-		return http.requestJson("GET", "/api/health", { schema: Health });
+//#region src/commands/define.ts
+function repeatedValues(rawArgs, flag) {
+	const values = [];
+	const inline = `${flag}=`;
+	for (let index = 0; index < rawArgs.length; index += 1) {
+		const arg = rawArgs[index];
+		if (arg === void 0) continue;
+		if (arg.startsWith(inline)) values.push(arg.slice(inline.length));
+		else if (arg === flag) {
+			const next = rawArgs[index + 1];
+			if (next !== void 0) {
+				values.push(next);
+				index += 1;
+			}
+		}
 	}
-	return { get };
+	return values;
+}
+function defineRdeCommand(def) {
+	return defineCommand({
+		meta: def.meta,
+		...def.args !== void 0 && { args: def.args },
+		async run({ args, rawArgs }) {
+			try {
+				await def.run(args, rawArgs);
+			} catch (error) {
+				reportError(error);
+			}
+		}
+	});
 }
 //#endregion
-//#region src/metabase/resources/permissions-group.ts
-function permissionsGroupResource(http) {
-	/** GET /api/permissions/group */
-	async function list() {
-		return http.requestJson("GET", "/api/permissions/group", { schema: PermissionsGroupList });
+//#region src/commands/instance.ts
+async function defaultInstanceName() {
+	const config = await readGlobalConfig();
+	if (config === null) throw new ConfigError("no Metabase instance yet; run `rde init` first");
+	return config.defaultInstance;
+}
+async function instanceNameOrDefault() {
+	try {
+		return (await readGlobalConfig())?.defaultInstance ?? "default";
+	} catch (error) {
+		if (error instanceof ConfigError) return DEFAULT_INSTANCE_NAME;
+		throw error;
 	}
-	return { list };
 }
-z.enum(["read-only", "read-write"]);
-const RemoteSyncSettingsResult = z.object({
-	success: z.boolean(),
-	task_id: z.int().optional()
-}).loose();
-const RemoteSyncTestConnection = z.object({ status: z.literal("success") }).loose();
-const SyncTaskStatus$1 = z.enum([
-	"running",
-	"successful",
-	"errored",
-	"cancelled",
-	"timed-out",
-	"conflict"
-]);
-const SyncTask = z.object({
-	id: z.int(),
-	sync_task_type: z.enum(["import", "export"]),
-	progress: z.number().nullable(),
-	status: SyncTaskStatus$1,
-	error_message: z.string().nullable().optional()
-}).loose();
 //#endregion
-//#region src/metabase/resources/remote-sync.ts
-function remoteSyncResource(http) {
-	/** PUT /api/ee/remote-sync/settings */
-	async function updateSettings(settings) {
-		return http.requestJson("PUT", "/api/ee/remote-sync/settings", {
-			body: settings,
-			schema: RemoteSyncSettingsResult
-		});
+//#region src/commands/credentials.ts
+const credentials = defineRdeCommand({
+	meta: {
+		name: "credentials",
+		description: "Print the admin login of the instance: URL, email, and password"
+	},
+	args: {
+		json: {
+			type: "boolean",
+			description: "Print the login as JSON",
+			default: false
+		},
+		"api-key": {
+			type: "boolean",
+			description: "Print only the API key rde and mb use, for a script to read",
+			default: false
+		}
+	},
+	async run(args) {
+		const name = await defaultInstanceName();
+		const state = await requireInstanceState(name);
+		const secrets = await readInstanceSecrets(name);
+		if (args["api-key"]) {
+			printLines([storedApiKey(state, secrets)]);
+			return;
+		}
+		const report = await credentialsReport(state, secrets, hostCredentialsClient(interruptSignal));
+		if (args.json) {
+			printJson(report);
+			return;
+		}
+		printLines(credentialsLines(report));
 	}
-	/** POST /api/ee/remote-sync/test-connection; an empty body tests the saved url and token. */
-	async function testConnection(connection = {}) {
-		return http.requestJson("POST", "/api/ee/remote-sync/test-connection", {
-			body: connection,
-			schema: RemoteSyncTestConnection
-		});
+});
+//#endregion
+//#region src/connections/parse-uri.ts
+var UriParseError = class extends Error {
+	engine;
+	reason;
+	example;
+	constructor(engine, reason) {
+		const example = EXAMPLE_URIS[engine] ?? null;
+		super(describeFailure(engine, reason, example));
+		this.name = "UriParseError";
+		this.engine = engine;
+		this.reason = reason;
+		this.example = example;
 	}
-	/** GET /api/ee/remote-sync/current-task */
-	async function currentTask() {
-		return http.requestJson("GET", "/api/ee/remote-sync/current-task", { schema: SyncTask.nullable() });
+};
+function describeFailure(engine, reason, example) {
+	if (reason === "unsupported-engine") return `Connection strings for ${engine} can't be parsed here; enter the fields one by one instead`;
+	return `That doesn't look like a ${engine} connection string${example === null ? "" : `, for example ${example}`}`;
+}
+const EXAMPLE_URIS = {
+	athena: "jdbc:athena://WorkGroup=primary;Region=us-east-1;",
+	"bigquery-cloud-sdk": "jdbc:bigquery://https://www.googleapis.com/bigquery/v2:443;ProjectId=MyBigQueryProject;OAuthType=1;",
+	clickhouse: "jdbc:clickhouse:https://localhost:8443?ssl=true",
+	druid: "jdbc:avatica:remote:url=http://localhost:8888/druid/v2/sql/avatica/;transparent_reconnection=true",
+	"druid-jdbc": "jdbc:avatica:remote:url=http://localhost:8888/druid/v2/sql/avatica/;transparent_reconnection=true",
+	databricks: "jdbc:databricks://127.0.0.1:8123;httpPath=/sql/1.0/endpoints/abc;OAuthSecret=1234567890;OAuth2ClientId=xyz",
+	mongo: "mongodb://user:pass@localhost:27017/dbname?authSource=admin",
+	mysql: "jdbc:mysql://user:pass@host:3306/dbname?ssl=true",
+	oracle: "jdbc:oracle:thin:@mydbhost:1521/mydbservice?ssl_server_cert_dn=ServerDN",
+	postgres: "jdbc:postgresql://localhost:5432/mydb",
+	"presto-jdbc": "jdbc:presto://host:1234/sample-catalog/sample-schema?SSL=true&SSLTrustStorePassword=1234",
+	redshift: "jdbc:redshift://examplecluster.abc123xyz789.us-west-2.redshift.amazonaws.com:5439/dev",
+	snowflake: "snowflake://example.snowflakecomputing.com/?db=maindb&warehouse=mainwarehouse",
+	sparksql: "jdbc:sparksql:Server=127.0.0.1;",
+	sqlite: "jdbc:sqlite:///C:/path/to/database.db",
+	sqlserver: "jdbc:sqlserver://mydbhost:1433;databaseName=mydb",
+	starburst: "jdbc:trino://starburst.example.com:43011/hive/sales?user=test&password=secret&SSL=true&roles=system:myrole",
+	vertica: "jdbc:vertica://vertica.example.com:1234/databaseName?user=jane"
+};
+const jdbcPrefix = "(?<hasJdbcPrefix>jdbc:)?";
+const userPass = "(?:(?<username>[^:/?#]+)(?::(?<password>[^@/?#]*))?@)?";
+const hostAndPort = "(?<host>[^:/?#]+)?(?::(?<port>\\d+)?)?";
+const params = "(?:(?<params>.*))?";
+const semicolonParams = ";?(?<semicolonParams>.*)?;?";
+const druidRegex = new RegExp("^" + jdbcPrefix + "(?<protocol>avatica)" + ":remote:url=(https?://)?(?<host>[^:/]+):(?<port>\\d+)(?<path>/[^;]*)" + semicolonParams + "$", "i");
+const mongoRegex = new RegExp("^(?<protocol>mongodb(?:\\+srv)?)://" + userPass + "(?<host>[^/?#]+)?" + "(?:/(?<database>[^/?#]*))?" + "(?:\\?(?<params>.*))?" + "$", "i");
+const CONNECTION_STRING_REGEXES = {
+	athena: [/* @__PURE__ */ new RegExp("^(?<hasJdbcPrefix>jdbc:)?(?<protocol>awsathena|athena)://((?<host>athena.*com)(?::(?<port>\\d+)?)?)?;?(?<semicolonParams>.*)?$", "i")],
+	redshift: [new RegExp("^" + jdbcPrefix + "(?<protocol>redshift)://" + userPass + hostAndPort + "(?:/(?<database>[^/?#;]*))?" + ";?" + "(?<semicolonParams>.*)?" + "$", "i")],
+	"bigquery-cloud-sdk": [new RegExp("^" + jdbcPrefix + "(?<protocol>bigquery)://" + "(https?://)?(?<host>[^:/]+)(?<path>/[^;]*):(?<port>\\d+)" + semicolonParams + "$", "i")],
+	clickhouse: [new RegExp("^" + jdbcPrefix + "(?<protocol>clickhouse|ch):(?:https?:)?//" + userPass + hostAndPort + "(?:/(?<database>[^/?#]*))?" + params)],
+	databricks: [new RegExp("^" + jdbcPrefix + "(?<protocol>databricks)://" + hostAndPort + "(?:/(?<schema>[^/?#]*))?" + semicolonParams + "$", "i")],
+	druid: [druidRegex],
+	"druid-jdbc": [druidRegex],
+	mongo: [mongoRegex],
+	mysql: [new RegExp("^" + jdbcPrefix + "(?<protocol>mysql)://" + userPass + hostAndPort + "(?:/(?<database>[^/?#]*))?" + params + "$", "i")],
+	postgres: [new RegExp("^" + jdbcPrefix + "(?<protocol>postgres(?:ql)?)://" + userPass + hostAndPort + "(?:/(?<database>[^/?#]*))?" + params + "$", "i")],
+	"presto-jdbc": [new RegExp("^" + jdbcPrefix + "(?<protocol>presto)://" + hostAndPort + "(?:/(?<catalog>[^/?#]*)/(?<schema>[^/?#]*))?" + params + "$", "i")],
+	oracle: [new RegExp("^" + jdbcPrefix + "(?<protocol>oracle):(?<subprotocol>thin):" + "(?:(?<username>[^@/]+)/(?<password>[^@/]+))?" + "@" + "(?<host>[^:/?#]+)(?::(?<port>\\d+))?(?:/(?<database>[^/?#]+))?" + params + "$", "i")],
+	snowflake: [new RegExp("^" + jdbcPrefix + "(?<protocol>snowflake)://" + userPass + hostAndPort + "(?:/(?<database>[^/?#]*)?)?" + params + "$", "i")],
+	sparksql: [new RegExp("^" + jdbcPrefix + "(?<protocol>sparksql):" + semicolonParams + "$", "i"), new RegExp("^" + jdbcPrefix + "(?<protocol>hive2)://" + hostAndPort + "(?:/(?<database>[^/?#;]*))?" + semicolonParams + "$", "i")],
+	sqlite: [new RegExp("^" + jdbcPrefix + "(?<protocol>sqlite):///(?<path>.+)$", "i")],
+	sqlserver: [new RegExp("^" + jdbcPrefix + "(?<protocol>sqlserver)://" + hostAndPort + semicolonParams + "$", "i")],
+	starburst: [new RegExp("^" + jdbcPrefix + "(?<protocol>trino)://" + hostAndPort + "(?:/(?<catalog>[^/?#]*)/(?<schema>[^/?#]*))?" + params + "$", "i")],
+	vertica: [new RegExp("^" + jdbcPrefix + "(?<protocol>vertica)://" + hostAndPort + "(?:/(?<database>[^/?#]*))?" + params + "$", "i")]
+};
+function parseUri(uri, engine) {
+	const regexes = CONNECTION_STRING_REGEXES[engine];
+	if (regexes === void 0) return new UriParseError(engine, "unsupported-engine");
+	const trimmed = uri.trim();
+	for (const regex of regexes) {
+		const match = trimmed.match(regex);
+		if (match !== null) return fromMatch(engine, trimmed, match);
 	}
+	return new UriParseError(engine, "no-match");
+}
+function detectEngine(uri) {
+	const trimmed = uri.trim();
+	return Object.entries(CONNECTION_STRING_REGEXES).filter(([, regexes]) => regexes.some((regex) => regex.test(trimmed))).map(([engine]) => engine);
+}
+function fromMatch(engine, uri, match) {
+	const groups = match.groups;
+	if (groups === void 0) throw new Error(`the ${engine} connection string pattern has no named groups`);
+	const group = (name) => groups[name] ?? null;
+	const protocol = group("protocol");
+	if (protocol === null) throw new Error(`the ${engine} connection string pattern has no protocol group`);
 	return {
-		updateSettings,
-		testConnection,
-		currentTask
+		engine,
+		uri,
+		protocol,
+		hasJdbcPrefix: group("hasJdbcPrefix") !== null,
+		username: safeDecode(group("username")),
+		password: safeDecode(group("password")),
+		host: group("host"),
+		port: group("port"),
+		database: group("database"),
+		catalog: group("catalog"),
+		schema: group("schema"),
+		path: group("path"),
+		...parseParams(group("params"), group("semicolonParams"))
 	};
 }
-//#endregion
-//#region src/metabase/domain/session.ts
-const Session = z.object({ id: z.string() }).loose();
-//#endregion
-//#region src/metabase/domain/session-properties.ts
-const EngineFieldOption = z.object({
-	name: z.string(),
-	value: z.unknown()
-}).loose();
-const EngineField = z.object({
-	name: z.string(),
-	"display-name": z.string().optional(),
-	type: z.string().optional(),
-	required: z.boolean().optional(),
-	default: z.unknown().optional(),
-	placeholder: z.unknown().optional(),
-	"visible-if": z.record(z.string(), z.unknown()).optional(),
-	options: z.array(EngineFieldOption).optional(),
-	"helper-text": z.string().optional()
-}).loose();
-const EngineFieldGroup = z.object({
-	type: z.literal("group"),
-	fields: z.array(EngineField)
-}).loose();
-const Engine = z.object({
-	"driver-name": z.string(),
-	"details-fields": z.array(z.union([EngineFieldGroup, EngineField])).optional(),
-	"superseded-by": z.string().nullable(),
-	"creatable?": z.boolean().optional()
-}).loose();
-const SessionProperties = z.object({
-	"setup-token": z.string().nullable(),
-	"has-user-setup": z.boolean(),
-	version: z.object({ tag: z.string() }).loose(),
-	"token-features": z.record(z.string(), z.boolean()),
-	engines: z.record(z.string(), Engine)
-}).loose();
-//#endregion
-//#region src/metabase/resources/session.ts
-function sessionResource(http) {
-	/** GET /api/session/properties */
-	async function properties() {
-		return http.requestJson("GET", "/api/session/properties", { schema: SessionProperties });
-	}
-	/** POST /api/session */
-	async function create(credentials) {
-		return http.requestJson("POST", "/api/session", {
-			body: credentials,
-			schema: Session
-		});
-	}
+function parseParams(query, semicolon) {
+	if (semicolon !== null) return {
+		params: parseSemicolonParams(semicolon),
+		paramSeparator: ";"
+	};
 	return {
-		properties,
-		create
+		params: query === null ? {} : Object.fromEntries(new URLSearchParams(query)),
+		paramSeparator: "&"
 	};
 }
-//#endregion
-//#region src/metabase/resources/setting.ts
-const PREMIUM_EMBEDDING_TOKEN_SETTING = "premium-embedding-token";
-const TRANSFORMS_ENABLED_SETTING = "transforms-enabled";
-function settingResource(http) {
-	/** PUT /api/setting/premium-embedding-token */
-	async function setPremiumEmbeddingToken(value) {
-		await http.requestNoContent("PUT", `/api/setting/${PREMIUM_EMBEDDING_TOKEN_SETTING}`, { body: { value } });
+function parseSemicolonParams(text) {
+	const result = {};
+	for (const param of text.split(";")) {
+		const separator = param.indexOf("=");
+		const key = separator === -1 ? param : param.slice(0, separator);
+		if (key.length === 0) continue;
+		result[key] = decodeComponent(separator === -1 ? "" : param.slice(separator + 1));
 	}
-	/** PUT /api/setting/transforms-enabled */
-	async function enableTransforms() {
-		await http.requestNoContent("PUT", `/api/setting/${TRANSFORMS_ENABLED_SETTING}`, { body: { value: true } });
+	return result;
+}
+function safeDecode(text) {
+	return text === null ? null : decodeComponent(text);
+}
+function decodeComponent(text) {
+	try {
+		return decodeURIComponent(text);
+	} catch {
+		return text;
 	}
-	return {
-		setPremiumEmbeddingToken,
-		enableTransforms
-	};
 }
 //#endregion
-//#region src/metabase/domain/setup.ts
-const SetupResult = z.object({ id: z.string() }).loose();
-//#endregion
-//#region src/metabase/resources/setup.ts
-function setupResource(http) {
-	/** POST /api/setup */
-	async function create(request) {
-		return http.requestJson("POST", "/api/setup", {
-			body: request,
-			schema: SetupResult
-		});
-	}
-	return { create };
+//#region src/connections/engines.ts
+const ELEVATED_ENGINES = [
+	"postgres",
+	"mysql",
+	"clickhouse",
+	"snowflake",
+	"bigquery-cloud-sdk",
+	"redshift",
+	"databricks",
+	"sqlserver",
+	"athena",
+	"starburst",
+	"presto-jdbc",
+	"mongo",
+	"sqlite",
+	"druid-jdbc"
+];
+const HIDDEN_ENGINES = /* @__PURE__ */ new Set(["h2"]);
+const PROMPT_KINDS = {
+	string: "text",
+	password: "password",
+	integer: "integer",
+	boolean: "boolean",
+	select: "select",
+	text: "multiline",
+	textFile: "file",
+	section: "none",
+	info: "none",
+	hidden: "none"
+};
+function promptKindFor(field) {
+	if (field.type === void 0) return "text";
+	return PROMPT_KINDS[field.type] ?? "text";
 }
-//#endregion
-//#region src/metabase/domain/token-status.ts
-const TokenStatus = z.object({
-	valid: z.boolean(),
-	status: z.string(),
-	features: z.array(z.string()).default([]),
-	"valid-thru": z.string().optional(),
-	"plan-alias": z.string().optional()
-}).loose();
-//#endregion
-//#region src/metabase/resources/token-status.ts
-function tokenStatusResource(http) {
-	/** GET /api/premium-features/token/status */
-	async function get() {
-		return http.requestJson("GET", "/api/premium-features/token/status", { schema: TokenStatus });
-	}
-	return { get };
+function fieldLabel(field) {
+	return field["display-name"] ?? field.name;
 }
-//#endregion
-//#region src/metabase/domain/user.ts
-const CurrentUser = z.object({ id: z.int() }).loose();
-//#endregion
-//#region src/metabase/resources/user.ts
-function userResource(http) {
-	/** GET /api/user/current */
-	async function current() {
-		return http.requestJson("GET", "/api/user/current", { schema: CurrentUser });
-	}
-	return { current };
+function flattenFields(fields) {
+	return fields.flatMap((field) => isFieldGroup(field) ? field.fields : [field]);
 }
-//#endregion
-//#region src/metabase/client.ts
-const HEALTH_POLL_INTERVAL_MS = 2e3;
-function createMetabaseClient(baseUrl, auth, signal, options = {}) {
-	const http = createHttp({
-		baseUrl,
-		auth,
-		signal,
-		...options
-	});
+function isFieldGroup(field) {
+	return "fields" in field && field.type === "group";
+}
+function toEntry(key, engine) {
 	return {
-		baseUrl,
-		signal,
-		health: healthResource(http),
-		session: sessionResource(http),
-		setup: setupResource(http),
-		permissionsGroup: permissionsGroupResource(http),
-		apiKey: apiKeyResource(http),
-		setting: settingResource(http),
-		tokenStatus: tokenStatusResource(http),
-		database: databaseResource(http),
-		remoteSync: remoteSyncResource(http),
-		user: userResource(http)
+		key,
+		displayName: engine["driver-name"],
+		creatable: engine["creatable?"] !== false,
+		supersededBy: engine["superseded-by"],
+		exampleUri: EXAMPLE_URIS[key] ?? null
 	};
 }
-function isNotReadyYet(error) {
-	return error instanceof MetabaseInitializingError || error instanceof MetabaseUnreachableError;
+function rank(key) {
+	const position = ELEVATED_ENGINES.indexOf(key);
+	return position === -1 ? ELEVATED_ENGINES.length : position;
 }
-async function waitForHealth(client, options) {
-	const deadline = Date.now() + options.timeoutMs;
-	const interval = options.pollIntervalMs ?? HEALTH_POLL_INTERVAL_MS;
-	for (;;) {
-		try {
-			await client.health.get();
-			return;
-		} catch (error) {
-			if (!isNotReadyYet(error)) throw error;
-			if (error instanceof MetabaseInitializingError) options.onProgress(error.progress);
-		}
-		if (Date.now() >= deadline) throw new MetabaseUnreachableError(client.baseUrl, `not healthy after ${Math.round(options.timeoutMs / 1e3)}s`);
-		try {
-			await setTimeout$1(interval, void 0, { signal: client.signal });
-		} catch {
-			throw new AbortError();
-		}
+function compareEntries(a, b) {
+	const byRank = rank(a.key) - rank(b.key);
+	return byRank !== 0 ? byRank : a.displayName.localeCompare(b.displayName);
+}
+function engineCatalog(engines) {
+	const entries = /* @__PURE__ */ new Map();
+	const fieldsByEngine = /* @__PURE__ */ new Map();
+	for (const [key, engine] of Object.entries(engines)) {
+		if (HIDDEN_ENGINES.has(key)) continue;
+		entries.set(key, toEntry(key, engine));
+		fieldsByEngine.set(key, flattenFields(engine["details-fields"] ?? []));
 	}
+	const ordered = [...entries.values()].toSorted(compareEntries);
+	return {
+		list: () => [...ordered],
+		entry: (engine) => entries.get(engine) ?? null,
+		fields: (engine) => {
+			const fields = fieldsByEngine.get(engine);
+			if (fields === void 0) throw new Error(`unknown engine ${engine}`);
+			return [...fields];
+		}
+	};
 }
 //#endregion
 //#region src/connections/map-fields.ts
@@ -1747,8 +1808,11 @@ const BACK_PLACEHOLDER = "leave empty to go back";
 function stdinIsTty() {
 	return process.stdin.isTTY === true;
 }
+function refusal(prompt) {
+	return `cannot prompt "${prompt}" — stdin is not a TTY`;
+}
 function requireTty(prompt) {
-	if (!stdinIsTty()) throw new ConfigError(`cannot prompt "${prompt}" — stdin is not a TTY`);
+	if (!stdinIsTty()) throw new ConfigError(refusal(prompt));
 }
 function settled(value) {
 	if (isCancel(value)) throw new AbortError();
@@ -1790,7 +1854,8 @@ async function askText(opts) {
 		...validate !== void 0 && { validate }
 	}));
 }
-function clackPrompts() {
+const CONFIRM_WITH_YES = "pass --yes to confirm without a terminal";
+function clackPrompts(options) {
 	return {
 		text: askText,
 		async textOrBack(opts) {
@@ -1810,7 +1875,10 @@ function clackPrompts() {
 			}));
 		},
 		async confirm(opts) {
-			requireTty(opts.message);
+			if (!stdinIsTty()) {
+				const message = refusal(opts.message);
+				throw new ConfigError(options.confirmsWithYes ? `${message}; ${CONFIRM_WITH_YES}` : message);
+			}
 			return settled(await confirm({
 				message: opts.message,
 				...opts.initialValue !== void 0 && { initialValue: opts.initialValue }
@@ -2711,11 +2779,15 @@ const CHECKLIST_MARK = {
 	"not-applicable": "–"
 };
 const SPINNER_FAILURE_CODE = 1;
+const PLAIN_PROGRESS_INTERVAL_MS = 1e4;
+const MS_PER_SECOND = 1e3;
+const PLAIN_INDENT = "  ";
 function checklistLines(items) {
 	return items.map((item) => `${CHECKLIST_MARK[item.status]} ${item.title}`);
 }
 function clackUi() {
 	return {
+		childOutput: "inherit",
 		intro,
 		outro,
 		note: (message, title) => note(message, title),
@@ -2736,6 +2808,55 @@ function clackUi() {
 		}
 	};
 }
+function indented(text) {
+	return text.split("\n").map((line) => PLAIN_INDENT + line).join("\n");
+}
+function plainUi(output) {
+	const line = (text) => output.write(text + "\n");
+	return {
+		childOutput: "capture",
+		intro: line,
+		outro: line,
+		note(message, title) {
+			if (title !== void 0) line(title);
+			line(indented(message));
+		},
+		info: line,
+		warn: (message) => line(`Warning: ${message}`),
+		success: line,
+		spinner(label) {
+			const startedAt = output.now();
+			let printedAt = startedAt;
+			const elapsed = () => `${Math.round((output.now() - startedAt) / MS_PER_SECOND)}s`;
+			line(label);
+			return {
+				update(message) {
+					const now = output.now();
+					if (now - printedAt < PLAIN_PROGRESS_INTERVAL_MS) return;
+					printedAt = now;
+					line(indented(message));
+				},
+				stop: (message) => line(`${message} (${elapsed()})`),
+				fail: (message) => line(`Failed: ${message} (${elapsed()})`)
+			};
+		},
+		checklist: (items) => line(checklistLines(items).join("\n"))
+	};
+}
+function noColorRequested() {
+	const value = readEnv(ENV_NO_COLOR);
+	return value !== void 0 && value !== "";
+}
+function drawsOnTerminal() {
+	return process.stdout.isTTY === true && !noColorRequested();
+}
+function terminalUi() {
+	if (drawsOnTerminal()) return clackUi();
+	return plainUi({
+		write: (text) => process.stdout.write(text),
+		now: Date.now
+	});
+}
 //#endregion
 //#region src/wizard/context.ts
 async function createWizardContext(instanceName, options) {
@@ -2757,8 +2878,8 @@ async function createWizardContext(instanceName, options) {
 			await writeInstanceSecrets(instanceName, next);
 			ctx.secrets = next;
 		},
-		prompts: options.prompts ?? clackPrompts(),
-		ui: clackUi(),
+		prompts: options.prompts ?? clackPrompts({ confirmsWithYes: false }),
+		ui: terminalUi(),
 		signal: options.signal,
 		session: new SessionCache()
 	};
@@ -2811,7 +2932,8 @@ const db = defineCommand({
 	subCommands: {
 		add: dbAdd,
 		list: dbList
-	}
+	},
+	default: "list"
 });
 //#endregion
 //#region src/metabase/domain/version-info.ts
@@ -3017,7 +3139,7 @@ async function spawnDetached(command, args, options) {
 					log.fd
 				],
 				cwd: options.cwd,
-				env: environmentWith(options.env),
+				env: options.env,
 				detached: true
 			});
 			child.on("error", (error) => {
@@ -3060,6 +3182,29 @@ function toolFailure(tool, argv, result) {
 		stderrTail: stderrTail(result.stderr)
 	});
 }
+const HAS_TEXT = /[\p{L}\p{N}]/u;
+async function runShown(runner, output, command, args) {
+	if (output === "inherit") {
+		const exitCode = await runner.stream(command, args);
+		if (exitCode !== 0) throw new ExternalToolError({
+			tool: command,
+			argv: args,
+			exitCode,
+			stderrTail: ""
+		});
+		return;
+	}
+	const result = await runner.run(command, args, { stdoutToFile: true });
+	if (result.exitCode !== 0) {
+		const printed = withoutEscapes(`${result.stdout}\n${result.stderr}`).split(LINE_BREAK);
+		throw new ExternalToolError({
+			tool: command,
+			argv: args,
+			exitCode: result.exitCode,
+			stderrTail: stderrTail(printed.filter((line) => HAS_TEXT.test(line)).join("\n"))
+		});
+	}
+}
 function parseJsonOutput(tool, argv, stdout, schema) {
 	let raw;
 	try {
@@ -3203,6 +3348,7 @@ function javaTool(runner) {
 const DOCKER = "docker";
 const CONTAINER_DATA_DIR = "/rde";
 const LOOPBACK_HOST = "127.0.0.1";
+const HOME_LABEL = "rde.home";
 const ENV_HOST_UID = "MUID";
 const ENV_HOST_GID = "MGID";
 const ADD_HOST_GATEWAY = `--add-host=${DOCKER_HOST_ALIAS}:host-gateway`;
@@ -3215,7 +3361,10 @@ const PortBinding = z.array(z.object({
 }).loose()).nullable();
 const InspectedContainer = z.object({
 	State: z.object({ Running: z.boolean() }).loose(),
-	Config: z.object({ Image: z.string() }).loose(),
+	Config: z.object({
+		Image: z.string(),
+		Labels: z.record(z.string(), z.string()).nullish()
+	}).loose(),
 	HostConfig: z.object({ PortBindings: z.record(z.string(), PortBinding).nullable() }).loose()
 }).loose();
 const InspectOutput = z.array(InspectedContainer);
@@ -3237,6 +3386,8 @@ function createArgs(options) {
 		"create",
 		"--name",
 		options.name,
+		"--label",
+		`${HOME_LABEL}=${options.home}`,
 		"-p",
 		`${LOOPBACK_HOST}:${options.port.host}:${options.port.container}`
 	];
@@ -3315,7 +3466,8 @@ function dockerTool(runner) {
 			exists: true,
 			running: container.State.Running,
 			image: container.Config.Image,
-			ports: portMappings(container.HostConfig.PortBindings)
+			ports: portMappings(container.HostConfig.PortBindings),
+			home: container.Config.Labels?.[HOME_LABEL] ?? null
 		};
 	}
 	async function containerImageId(name) {
@@ -3439,6 +3591,23 @@ function logPathOf(instanceDir) {
 function pidPathOf(instanceDir) {
 	return join(instanceDir, PID_FILE);
 }
+const METABASE_VARIABLE_PREFIX = "MB_";
+function jarEnvironment(host, server) {
+	const env = {};
+	const ignored = [];
+	for (const [name, value] of Object.entries(host)) if (name.startsWith(METABASE_VARIABLE_PREFIX)) ignored.push(name);
+	else env[name] = value;
+	return {
+		env: {
+			...env,
+			...server
+		},
+		ignored: ignored.toSorted()
+	};
+}
+function ignoredVariablesNotice(ignored) {
+	return `Ignoring ${ignored.join(", ")} from your shell; rde configures Metabase itself`;
+}
 async function pathExists$1(path) {
 	try {
 		await promises.access(path);
@@ -3510,24 +3679,26 @@ function jarRuntime(state, deps) {
 		await promises.mkdir(join(deps.dataDir, DB_DIR), { recursive: true });
 		await ensureJar(options);
 	}
-	async function start() {
+	async function start(options) {
 		if (await runningPid() !== null) return;
 		if (!await pathExists$1(jarPath)) throw new ConfigError(`${jarPath} does not exist; run \`rde init\``);
 		const java = await requireJava(deps.java);
 		await promises.mkdir(deps.instanceDir, { recursive: true });
+		const { env, ignored } = jarEnvironment(deps.hostEnv, {
+			...serverEnv({
+				dbFile: join(deps.dataDir, DB_DIR, DB_FILE),
+				pluginsDir: join(deps.dataDir, PLUGINS_DIR),
+				port: state.port
+			}),
+			...jettyEnv(state.port)
+		});
+		if (ignored.length > 0) options.onNotice(ignoredVariablesNotice(ignored));
 		const pid = await daemon.start({
 			command: java.path,
 			args: ["-jar", jarPath],
 			options: {
 				cwd: deps.dataDir,
-				env: {
-					...serverEnv({
-						dbFile: join(deps.dataDir, DB_DIR, DB_FILE),
-						pluginsDir: join(deps.dataDir, PLUGINS_DIR),
-						port: state.port
-					}),
-					...jettyEnv(state.port)
-				},
+				env,
 				logPath
 			}
 		});
@@ -3646,8 +3817,10 @@ function daemonTool(runner) {
 const DEFAULT_IMAGE = "metabase/metabase-enterprise-head:latest";
 const CONTAINER_NAME_PREFIX$1 = "rde-metabase";
 const CONTAINER_PORT = 3e3;
-function containerName(instanceName) {
-	return `${CONTAINER_NAME_PREFIX$1}-${instanceName}`;
+function containerName(instanceName, home) {
+	const tag = homeTag(home);
+	const name = `${CONTAINER_NAME_PREFIX$1}-${instanceName}`;
+	return tag === null ? name : `${name}-${tag}`;
 }
 function publishesPortOnLoopback(inspection, port) {
 	return inspection.ports.some((mapping) => mapping.container === CONTAINER_PORT && mapping.host === port && mapping.hostIp === "127.0.0.1");
@@ -3675,6 +3848,7 @@ function dockerRuntime(state, deps) {
 		await docker.imagePull(state.image, { onLine: options.onProgress });
 		await docker.containerCreate({
 			name: state.containerName,
+			home: deps.rdeHome,
 			image: state.image,
 			port: {
 				host: state.port,
@@ -3740,11 +3914,13 @@ function hostRuntimeDeps(instanceName, signal) {
 		dataDir: instanceDataDir(instanceName),
 		instanceDir: instanceDir(instanceName),
 		jarsDir: jarsDir(),
+		rdeHome: rdeHome(),
 		platform: process.platform,
 		hostUser: {
 			uid: user.uid,
 			gid: user.gid
-		}
+		},
+		hostEnv: hostEnvironment()
 	};
 }
 function runtimeFromState(state, deps) {
@@ -3764,6 +3940,7 @@ const SAMPLE_DATABASE_READY_TIMEOUT_MS = 12e4;
 const POSTGRES_PORT = 5432;
 const CONTAINER_NAME_PREFIX = "rde-sampledb";
 const READY_POLL_MS = 1e3;
+const PORT_TAKEN = /port is already allocated|address already in use/;
 const READY_PROBE = [
 	"pg_isready",
 	"-h",
@@ -3773,8 +3950,10 @@ const READY_PROBE = [
 	"-d",
 	SAMPLE_DATABASE_NAME
 ];
-function sampleContainerName(instanceName) {
-	return `${CONTAINER_NAME_PREFIX}-${instanceName}`;
+function sampleContainerName(instanceName, home) {
+	const tag = homeTag(home);
+	const name = `${CONTAINER_NAME_PREFIX}-${instanceName}`;
+	return tag === null ? name : `${name}-${tag}`;
 }
 function sampleDatabaseUrl(port) {
 	return `postgres://${SAMPLE_DATABASE_USER}:${SAMPLE_DATABASE_PASSWORD}@localhost:${port}/${SAMPLE_DATABASE_NAME}`;
@@ -3782,7 +3961,22 @@ function sampleDatabaseUrl(port) {
 function publishesOnLoopback$1(inspection, port) {
 	return inspection.ports.some((mapping) => mapping.container === POSTGRES_PORT && mapping.host === port && mapping.hostIp === "127.0.0.1");
 }
-function sampleDatabaseContainer(state, docker) {
+function createOptions(state, home) {
+	return {
+		name: state.containerName,
+		home,
+		image: state.image,
+		port: {
+			host: state.port,
+			container: POSTGRES_PORT
+		},
+		mount: null,
+		env: {},
+		addHostGateway: false,
+		hostUser: null
+	};
+}
+function sampleDatabaseContainer(state, docker, home) {
 	const name = state.containerName;
 	function conflict(reason) {
 		return new ConfigError(`container ${name} already exists ${reason}; remove it with \`docker rm -f ${name}\` and run \`rde init\` again`);
@@ -3795,18 +3989,7 @@ function sampleDatabaseContainer(state, docker) {
 			return;
 		}
 		await docker.imagePull(state.image, { onLine: options.onProgress });
-		await docker.containerCreate({
-			name,
-			image: state.image,
-			port: {
-				host: state.port,
-				container: POSTGRES_PORT
-			},
-			mount: null,
-			env: {},
-			addHostGateway: false,
-			hostUser: null
-		});
+		await docker.containerCreate(createOptions(state, home));
 	}
 	async function start() {
 		const existing = await docker.containerInspect(name);
@@ -3849,6 +4032,32 @@ function sampleDatabaseContainer(state, docker) {
 		waitReady
 	};
 }
+function isPortTaken(error) {
+	return error instanceof ExternalToolError && PORT_TAKEN.test(error.stderrTail);
+}
+async function startOnFreePort(state, docker, ports, home) {
+	try {
+		return {
+			outcome: await sampleDatabaseContainer(state, docker, home).start(),
+			state
+		};
+	} catch (error) {
+		if (!isPortTaken(error)) throw error;
+	}
+	const existing = await docker.containerInspect(state.containerName);
+	if (existing.exists && existing.home !== null && existing.home !== home) throw new ConfigError(`container ${state.containerName} belongs to the rde home ${existing.home} and is left alone`);
+	const moved = {
+		...state,
+		port: await ports.findFree(SAMPLE_DATABASE_PORT)
+	};
+	await docker.containerRemove(state.containerName);
+	await docker.containerCreate(createOptions(moved, home));
+	await docker.containerStart(moved.containerName);
+	return {
+		outcome: "started",
+		state: moved
+	};
+}
 //#endregion
 //#region src/tools/mb.ts
 const MB = "mb";
@@ -4259,7 +4468,15 @@ async function detectAgents(probe) {
 //#region src/tools/skills-cli.ts
 const NPX = "npx";
 const SKILLS_PACKAGE = "skills@latest";
-const DEFAULT_RDE_SKILL_SOURCE = "https://github.com/metabase/agent-skills/tree/rde-skill";
+const DEFAULT_RDE_SKILL_SOURCE = "https://github.com/metabase/agent-skills/tree/rde-generic-skills";
+const RDE_SOURCE_SKILL_NAMES = ["rde", "rde-data-apps"];
+const DATA_APP_SKILLS_SOURCE = "metabase/metabase/skills#master";
+const DATA_APP_SKILL_NAMES = [
+	"metabase-data-app-setup",
+	"metabase-data-app-routing",
+	"metabase-data-app-actions",
+	"metabase-data-app-semantic-layer"
+];
 function rdeSkillSource() {
 	const override = readEnv(ENV_RDE_SKILL_SOURCE);
 	return override === void 0 || override.length === 0 ? DEFAULT_RDE_SKILL_SOURCE : override;
@@ -4322,37 +4539,23 @@ function skillsCli(runner) {
 			SKILLS_PACKAGE,
 			"add",
 			options.source,
-			"--skill",
-			options.skill,
+			...options.skills.flatMap((skill) => ["--skill", skill]),
 			"-a",
 			...options.agents,
 			"-g",
 			"-y"
 		];
-		const exitCode = await runner.stream(NPX, argv);
-		if (exitCode !== 0) throw new ExternalToolError({
-			tool: NPX,
-			argv,
-			exitCode,
-			stderrTail: ""
-		});
+		await runShown(runner, options.output, NPX, argv);
 	}
-	async function remove(skill) {
-		const argv = [
+	async function remove(skills, output) {
+		await runShown(runner, output, NPX, [
 			"-y",
 			SKILLS_PACKAGE,
 			"remove",
-			skill,
+			...skills,
 			"-g",
 			"-y"
-		];
-		const exitCode = await runner.stream(NPX, argv);
-		if (exitCode !== 0) throw new ExternalToolError({
-			tool: NPX,
-			argv,
-			exitCode,
-			stderrTail: ""
-		});
+		]);
 	}
 	async function list() {
 		const argv = [
@@ -4427,6 +4630,12 @@ function withStepRecord(state, id, record) {
 		}
 	};
 }
+function failureAt(step, error) {
+	return error instanceof AbortError ? error : new StepFailedError({
+		id: step.id,
+		title: step.title
+	}, error);
+}
 async function runWizard(steps, ctx, options = {}) {
 	requireKnownStep(steps, options.from, "--from");
 	requireKnownStep(steps, options.only, "--only");
@@ -4436,10 +4645,12 @@ async function runWizard(steps, ctx, options = {}) {
 		title: step.title,
 		status
 	})));
-	for (const entry of detected) {
+	for (const entry of detected) try {
 		if (!await shouldRun(entry, ctx, options)) continue;
 		const outcome = await entry.step.run(ctx);
 		await ctx.saveState(withStepRecord(ctx.state, entry.step.id, recordFor(outcome, now())));
+	} catch (error) {
+		throw failureAt(entry.step, error);
 	}
 }
 //#endregion
@@ -4587,13 +4798,7 @@ function installMbStep(deps = hostDeps$11) {
 			if (before.installed) ctx.ui.warn(`mb ${before.version} is installed; ${MIN_MB_VERSION} or newer is required`);
 			const install = mbInstallCommand(resolved.installedWith);
 			ctx.ui.info(`Running ${displayCommand(install)}`);
-			const exitCode = await resolved.runner.stream(install.command, install.args);
-			if (exitCode !== 0) throw new ExternalToolError({
-				tool: install.command,
-				argv: install.args,
-				exitCode,
-				stderrTail: ""
-			});
+			await runShown(resolved.runner, ctx.ui.childOutput, install.command, install.args);
 			const after = await inspectMb(resolved.runner);
 			if (!after.installed || !after.satisfies) throw await stillWrong(install, after, resolved);
 			ctx.ui.success(`mb ${after.version} is installed`);
@@ -4605,7 +4810,8 @@ function installMbStep(deps = hostDeps$11) {
 //#region src/steps/agents-skills.ts
 const STEP_ID$7 = "agents-skills";
 const AGENTS_SKILLS_KEYS = { agents: `${STEP_ID$7}.agents` };
-const MECHANICS_NOTE = "The skill's mechanics come from `mb skills get <name>` at runtime, so nothing else needs installing.";
+const MECHANICS_NOTE = "The rde skill's mechanics come from `mb skills get <name>` at runtime, so nothing else needs installing.";
+const REQUIRED_SKILL_NAMES = [...DATA_APP_SKILL_NAMES, ...RDE_SOURCE_SKILL_NAMES];
 const DETECT_AGENTS = { kind: "detected" };
 function hostDeps$10(ctx) {
 	return {
@@ -4630,8 +4836,17 @@ function coversAny(entry, agents) {
 async function rdeSkillEntries(runner) {
 	return (await skillsCli(runner).list()).filter((entry) => entry.name === "rde");
 }
+function requiredEntries(installed) {
+	return installed.filter((entry) => REQUIRED_SKILL_NAMES.includes(entry.name));
+}
+function missingSkills(installed, agents) {
+	return REQUIRED_SKILL_NAMES.filter((name) => !installed.some((entry) => entry.name === name && coversAny(entry, agents)));
+}
+function unlistedSkills(installed) {
+	return REQUIRED_SKILL_NAMES.filter((name) => !installed.some((entry) => entry.name === name));
+}
 function installedLines(entries) {
-	return entries.map((entry) => `${entry.agents.join(", ")}: ${entry.path}`).join("\n");
+	return entries.map((entry) => `${entry.name} (${entry.agents.join(", ")}): ${entry.path}`).join("\n");
 }
 const SOURCE_NOTES = {
 	override: "from --agents",
@@ -4653,7 +4868,7 @@ async function askAgents(ctx, all) {
 	const offered = all.filter((agent) => agent.detected || agent.id === "opencode");
 	const picked = await ctx.prompts.multiselect({
 		key: AGENTS_SKILLS_KEYS.agents,
-		message: "Which coding agents should get the rde skill?",
+		message: "Which coding agents should get the rde and data-app skills?",
 		choices: offered.map(offeredChoice),
 		initialValues: detectedOnly(all).map((agent) => agent.id),
 		required: false
@@ -4683,8 +4898,7 @@ async function installOpencode(ctx, deps) {
 	const install = opencodeInstallCommand(deps.installedWith);
 	const commandLine = [install.command, ...install.args].join(" ");
 	ctx.ui.info(`Running ${commandLine}`);
-	const exitCode = await deps.runner.stream(install.command, install.args);
-	if (exitCode !== 0) throw new ConfigError(`\`${commandLine}\` exited with ${exitCode}`);
+	await runShown(deps.runner, ctx.ui.childOutput, install.command, install.args);
 	if (!(await detectAgents(deps.probe)).some((agent) => agent.id === "opencode" && agent.detected)) throw new ConfigError("OpenCode was installed but `opencode` is not on PATH; open a new terminal and run rde init again");
 }
 function listsMissingOpencode(all, options) {
@@ -4693,21 +4907,21 @@ function listsMissingOpencode(all, options) {
 function skipLine(all, source) {
 	switch (source) {
 		case "override":
-		case "chosen": return `Skipping the rde skill; run \`rde init --only ${STEP_ID$7}\` to install it later`;
+		case "chosen": return `Skipping the skills; run \`rde init --only ${STEP_ID$7}\` to install it later`;
 		case "detected": return `No coding agent found (${displayNames(all)}); run \`rde init --only ${STEP_ID$7} --agents <name>\` once one is installed`;
 	}
 }
 function agentsSkillsStep(options, deps = hostDeps$10) {
 	return {
 		id: STEP_ID$7,
-		title: "Install the rde skill for your coding agents",
+		title: "Install the rde and data-app skills for your coding agents",
 		async detect(ctx) {
 			const resolved = deps(ctx);
 			const all = await detectAgents(resolved.probe);
 			if (listsMissingOpencode(all, options)) return "todo";
 			const detected = detectedOnly(all);
 			if (detected.length === 0) return ctx.state.steps[STEP_ID$7]?.status === "skipped" ? "not-applicable" : "todo";
-			return (await rdeSkillEntries(resolved.runner)).some((entry) => coversAny(entry, detected)) ? "done" : "todo";
+			return missingSkills(await skillsCli(resolved.runner).list(), detected).length === 0 ? "done" : "todo";
 		},
 		async run(ctx) {
 			const resolved = deps(ctx);
@@ -4718,16 +4932,28 @@ function agentsSkillsStep(options, deps = hostDeps$10) {
 				return "skipped";
 			}
 			if (selection.agents.some(isMissingOpencode)) await installOpencode(ctx, resolved);
-			const from = resolved.skillSource === "https://github.com/metabase/agent-skills/tree/rde-skill" ? "" : ` from ${resolved.skillSource}`;
-			ctx.ui.info(`Installing the rde skill for ${displayNames(selection.agents)} (${SOURCE_NOTES[selection.source]})${from}`);
-			await skillsCli(resolved.runner).add({
+			const skills = skillsCli(resolved.runner);
+			const agents = selection.agents.map((agent) => agent.skillsCliName);
+			const forWhom = `for ${displayNames(selection.agents)} (${SOURCE_NOTES[selection.source]})`;
+			ctx.ui.info(`Installing the data-app skills ${forWhom}`);
+			await skills.add({
+				source: DATA_APP_SKILLS_SOURCE,
+				skills: DATA_APP_SKILL_NAMES,
+				agents,
+				output: ctx.ui.childOutput
+			});
+			const from = resolved.skillSource === "https://github.com/metabase/agent-skills/tree/rde-generic-skills" ? "" : ` from ${resolved.skillSource}`;
+			ctx.ui.info(`Installing the rde skills ${forWhom}${from}`);
+			await skills.add({
 				source: resolved.skillSource,
-				skill: "rde",
-				agents: selection.agents.map((agent) => agent.skillsCliName)
+				skills: RDE_SOURCE_SKILL_NAMES,
+				agents,
+				output: ctx.ui.childOutput
 			});
-			const entries = await rdeSkillEntries(resolved.runner);
-			if (entries.length === 0) throw new ConfigError(`the skills installer finished but \`skills list\` does not show the rde skill`);
-			ctx.ui.note(installedLines(entries), "rde skill installed");
+			const installed = await skills.list();
+			const missing = unlistedSkills(installed);
+			if (missing.length > 0) throw new ConfigError(`the skills installer finished but \`skills list\` does not show ${missing.join(", ")}`);
+			ctx.ui.note(installedLines(requiredEntries(installed)), "Skills installed");
 			ctx.ui.info(MECHANICS_NOTE);
 			return "completed";
 		}
@@ -5545,7 +5771,7 @@ const SAMPLE_LABEL = "sample database";
 async function sampleDatabaseRow(record, deps, dockerOk, access) {
 	const id = "sample-database";
 	if (!dockerOk) return skipped(id, SAMPLE_LABEL, "Docker is not available");
-	const status = await sampleDatabaseContainer(record, deps.runtime.docker).status();
+	const status = await sampleDatabaseContainer(record, deps.runtime.docker, deps.runtime.rdeHome).status();
 	if (!status.installed) return failed(id, SAMPLE_LABEL, {
 		detail: `${record.containerName} does not exist`,
 		hint: "`rde init` recreates it",
@@ -5608,6 +5834,7 @@ async function gitSyncRow(state, deps) {
 const SKILL_STEP = "agents-skills";
 const GLOBAL_SCOPE = "global";
 const SKILL_FILE = "SKILL.md";
+const SOURCE_SKILLS_DIR = "skills";
 const CLAUDE_CODE = "Claude Code";
 const CLAUDE_CODE_SKILL_RULE = "a personal skill wins over a project one: https://code.claude.com/docs/en/skills";
 function skillRowId(agent) {
@@ -5625,7 +5852,7 @@ async function judgeCopy(entry, origin, deps) {
 	switch (origin.kind) {
 		case "local": {
 			const installed = await deps.skills.files.readText(join(entry.path, SKILL_FILE));
-			const wanted = await deps.skills.files.readText(join(origin.path, SKILL_FILE));
+			const wanted = await deps.skills.files.readText(join(origin.path, SOURCE_SKILLS_DIR, entry.name, SKILL_FILE));
 			const current = installed !== null && installed === wanted;
 			return {
 				entry,
@@ -5919,6 +6146,62 @@ function storedLogin(variant, user) {
 		case "prompted": return null;
 	}
 }
+async function resumeGeneratedAdmin(ctx, client) {
+	const login = ctx.secrets.admin;
+	if (login === null) return false;
+	try {
+		const session = await client.session.create({
+			username: login.email,
+			password: login.password
+		});
+		ctx.session.metabaseSession.set(session.id);
+	} catch (error) {
+		if (isRejectedCredential(error)) return false;
+		throw error;
+	}
+	await ctx.saveState({
+		...ctx.state,
+		admin: {
+			kind: "generated",
+			email: login.email
+		}
+	});
+	ctx.ui.success(`Admin user ${login.email} recorded (created by an earlier rde init that was interrupted)`);
+	return true;
+}
+async function recordExistingAdmin(ctx, variant, client, url) {
+	if (variant !== "prompted") {
+		if (await resumeGeneratedAdmin(ctx, client)) return "completed";
+		throw new ConfigError(`Metabase at ${url} already has an admin that rde did not create; pass its login with --admin-email and --admin-password, or run \`rde uninstall\` then \`rde init\` for a fresh instance`);
+	}
+	const email = await ctx.prompts.text({
+		key: ADMIN_USER_KEYS.email,
+		message: "Admin email",
+		validate: validateEmail
+	});
+	const password = await ctx.prompts.password({
+		key: ADMIN_USER_KEYS.password,
+		message: "Admin password"
+	});
+	const session = await client.session.create({
+		username: email,
+		password
+	});
+	ctx.session.metabaseSession.set(session.id);
+	await ctx.saveSecrets({
+		...ctx.secrets,
+		admin: null
+	});
+	await ctx.saveState({
+		...ctx.state,
+		admin: {
+			kind: "prompted",
+			email
+		}
+	});
+	ctx.ui.success(`Admin user ${email} recorded`);
+	return "completed";
+}
 function adminUserStep(options, deps = hostDeps$8) {
 	return {
 		id: STEP_ID$6,
@@ -5927,7 +6210,7 @@ function adminUserStep(options, deps = hostDeps$8) {
 			const configured = configuredRuntime(ctx.state);
 			if (configured === null) return "todo";
 			try {
-				return (await deps(ctx).client(configured.url, NO_AUTH).session.properties())["has-user-setup"] ? "done" : "todo";
+				return (await deps(ctx).client(configured.url, NO_AUTH).session.properties())["has-user-setup"] && ctx.state.admin !== null ? "done" : "todo";
 			} catch (error) {
 				if (isNotReady(error)) return "todo";
 				throw error;
@@ -5939,6 +6222,7 @@ function adminUserStep(options, deps = hostDeps$8) {
 			const client = resolved.client(configured.url, NO_AUTH);
 			const properties = await client.session.properties();
 			if (properties["has-user-setup"]) {
+				if (ctx.state.admin === null) return recordExistingAdmin(ctx, options.variant, client, configured.url);
 				ctx.ui.info("Metabase already has an admin user");
 				return "completed";
 			}
@@ -6147,6 +6431,16 @@ const FALLBACK_REMOTE_NAME = "rde-remote";
 const README_NAME = "README.md";
 const README_CONTENT = "# Metabase content\n\nMetabase content synced by rde.\n";
 const INITIAL_COMMIT_MESSAGE = "Initial commit";
+const GITIGNORE_NAME = ".gitignore";
+const IGNORED_PATHS = [
+	".env",
+	".env.local",
+	".env.*.local",
+	"node_modules/",
+	".vite/",
+	".scratch/",
+	".DS_Store"
+];
 const HTTPS_PREFIX = "https://";
 const HOME_PREFIX = "~/";
 const BAD_REQUEST_STATUS = 400;
@@ -6356,10 +6650,20 @@ function hostedScreen(run) {
 		}
 	};
 }
+async function ignoreDataAppFiles(workdir) {
+	const path = join(workdir, GITIGNORE_NAME);
+	const existing = await readTextFile(path);
+	const present = new Set(existing === null ? [] : existing.split("\n").map((line) => line.trim()));
+	const missing = IGNORED_PATHS.filter((entry) => !present.has(entry));
+	if (missing.length === 0) return;
+	const separator = existing === null || existing.endsWith("\n") ? "" : "\n";
+	await promises.appendFile(path, `${separator}${missing.join("\n")}\n`);
+}
 async function prepareWorkdir(run, workdir) {
 	if (!await run.git.isRepo(workdir)) await run.git.init(workdir, { branch: DEFAULT_BRANCH });
 	if (!await run.git.hasCommits(workdir)) {
 		await promises.writeFile(join(workdir, README_NAME), README_CONTENT);
+		await ignoreDataAppFiles(workdir);
 		await run.git.commitAll(workdir, INITIAL_COMMIT_MESSAGE);
 	}
 	return {
@@ -6758,7 +7062,7 @@ async function chooseRuntime(ctx, options, deps) {
 			return {
 				kind,
 				image,
-				containerName: containerName(ctx.state.name),
+				containerName: containerName(ctx.state.name, deps.runtime.rdeHome),
 				port,
 				hostAlias: DOCKER_HOST_ALIAS
 			};
@@ -6852,7 +7156,7 @@ async function recordedDatabase(record, client) {
 async function persistedRecord(ctx, deps) {
 	const existing = ctx.state.sampleDatabase;
 	if (existing !== null) {
-		if ((await sampleDatabaseContainer(existing, deps.runtime.docker).status()).installed || await deps.ports.isFree(existing.port)) return {
+		if ((await sampleDatabaseContainer(existing, deps.runtime.docker, deps.runtime.rdeHome).status()).installed || await deps.ports.isFree(existing.port)) return {
 			record: existing,
 			staleDatabaseId: null
 		};
@@ -6862,7 +7166,7 @@ async function persistedRecord(ctx, deps) {
 	const port = await deps.ports.findFree(SAMPLE_DATABASE_PORT);
 	if (port !== 15432) ctx.ui.warn(`Port ${SAMPLE_DATABASE_PORT} is in use; using ${port} for the sample database`);
 	const record = {
-		containerName: sampleContainerName(ctx.state.name),
+		containerName: sampleContainerName(ctx.state.name, deps.runtime.rdeHome),
 		image: SAMPLE_DATABASE_IMAGE,
 		port,
 		databaseId: null
@@ -6876,16 +7180,30 @@ async function persistedRecord(ctx, deps) {
 		staleDatabaseId: existing?.databaseId ?? null
 	};
 }
-async function installAndStart(ctx, sidecar, record, deps) {
-	const installing = ctx.ui.spinner(`Installing the sample database from ${record.image}`);
+async function recordSampleDatabaseMove(ctx, from, to) {
+	ctx.ui.warn(`Port ${from.port} is taken; the sample database moved to ${to.port}`);
+	const record = {
+		...to,
+		databaseId: null
+	};
+	await ctx.saveState({
+		...ctx.state,
+		sampleDatabase: record,
+		databases: ctx.state.databases.filter((entry) => entry.id !== from.databaseId)
+	});
+	return record;
+}
+async function installAndStart(ctx, sidecar, installed, deps) {
+	const installing = ctx.ui.spinner(`Installing the sample database from ${installed.image}`);
 	try {
 		await sidecar.install({ onProgress: (line) => installing.update(line) });
 	} catch (error) {
 		installing.fail("Sample database install failed");
 		throw error;
 	}
-	installing.stop(`Sample database container ${record.containerName} on port ${record.port}`);
-	await sidecar.start();
+	installing.stop(`Sample database container ${installed.containerName} on port ${installed.port}`);
+	const started = await startOnFreePort(installed, deps.runtime.docker, deps.ports, deps.runtime.rdeHome);
+	const record = started.state.port === installed.port ? installed : await recordSampleDatabaseMove(ctx, installed, started.state);
 	const waiting = ctx.ui.spinner("Waiting for Postgres to accept connections…");
 	try {
 		await sidecar.waitReady({
@@ -6897,6 +7215,7 @@ async function installAndStart(ctx, sidecar, record, deps) {
 		throw error;
 	}
 	waiting.stop(`Postgres is ready on ${LOOPBACK_HOST}:${record.port}`);
+	return record;
 }
 function connectionDetails(record, configured, deps) {
 	const alias = runtimeFromState(configured.runtime, deps.runtime).hostAlias();
@@ -6961,7 +7280,7 @@ function sampleDatabaseStep(deps = hostDeps$3) {
 			const record = ctx.state.sampleDatabase;
 			const configured = configuredRuntime(ctx.state);
 			if (record === null || configured === null || ctx.secrets.apiKey === null) return "todo";
-			if (!(await sampleDatabaseContainer(record, resolved.runtime.docker).status()).installed) return "todo";
+			if (!(await sampleDatabaseContainer(record, resolved.runtime.docker, resolved.runtime.rdeHome).status()).installed) return "todo";
 			const client = resolved.client(configured.url, {
 				kind: "api-key",
 				key: ctx.secrets.apiKey
@@ -6979,24 +7298,24 @@ function sampleDatabaseStep(deps = hostDeps$3) {
 			const apiKey = requireApiKey(ctx);
 			const docker = await resolved.runtime.docker.available();
 			if (!docker.available) throw new ConfigError(`the sample database runs in Docker, which is not available: ${docker.reason}`);
-			const choice = await persistedRecord(ctx, resolved);
-			await installAndStart(ctx, sampleDatabaseContainer(choice.record, resolved.runtime.docker), choice.record, resolved);
+			const persisted = await persistedRecord(ctx, resolved);
+			const record = await installAndStart(ctx, sampleDatabaseContainer(persisted.record, resolved.runtime.docker, resolved.runtime.rdeHome), persisted.record, resolved);
+			const choice = {
+				...persisted,
+				record
+			};
 			const client = resolved.client(configured.url, {
 				kind: "api-key",
 				key: apiKey
 			});
 			await connectDatabase(ctx, choice, configured, client, resolved);
 			await client.setting.enableTransforms();
-			ctx.ui.note(usageLines(choice.record), "Sample database");
+			ctx.ui.note(usageLines(record), "Sample database");
 			return "completed";
 		}
 	};
 }
 const DEFAULT_HEALTH_TIMING = { timeoutMs: 3e5 };
-async function startAndWaitForHealth(runtime, client, options) {
-	await runtime.start();
-	await waitForHealth(client, options);
-}
 //#endregion
 //#region src/steps/start-metabase.ts
 const LOG_TAIL_ON_TIMEOUT = 30;
@@ -7004,6 +7323,7 @@ const PERCENT = 100;
 function hostDeps$2(ctx) {
 	return {
 		runtime: hostRuntimeDeps(ctx.state.name, ctx.signal),
+		ports: hostPortProbe,
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
 		timing: DEFAULT_HEALTH_TIMING
 	};
@@ -7020,7 +7340,9 @@ function progressLabel(progress) {
 async function startSampleDatabase(ctx, deps) {
 	const record = ctx.state.sampleDatabase;
 	if (record === null) return;
-	switch (await sampleDatabaseContainer(record, deps.runtime.docker).start()) {
+	const started = await startOnFreePort(record, deps.runtime.docker, deps.ports, deps.runtime.rdeHome);
+	if (started.state.port !== record.port) await recordSampleDatabaseMove(ctx, record, started.state);
+	switch (started.outcome) {
 		case "missing":
 			ctx.ui.warn(`Sample database container ${record.containerName} is missing; \`rde init\` recreates it`);
 			return;
@@ -7051,11 +7373,16 @@ function startMetabaseStep(deps = hostDeps$2) {
 			const runtime = runtimeFromState(configured.runtime, resolved.runtime);
 			const client = resolved.client(configured.url, NO_AUTH);
 			await startSampleDatabase(ctx, resolved);
+			await runtime.start({ onNotice: (line) => ctx.ui.info(line) });
 			const spinner = ctx.ui.spinner("Starting Metabase…");
+			let shown = 0;
 			try {
-				await startAndWaitForHealth(runtime, client, {
+				await waitForHealth(client, {
 					...resolved.timing,
-					onProgress: (progress) => spinner.update(progressLabel(progress))
+					onProgress: (progress) => {
+						shown = Math.max(shown, progress);
+						spinner.update(progressLabel(shown));
+					}
 				});
 			} catch (error) {
 				if (error instanceof MetabaseUnreachableError) {
@@ -7154,7 +7481,7 @@ async function summaryLines(state, apiKey, deps) {
 	const installed = await skillsCli(deps.runner).list();
 	lines.push(skillLine(installed.filter((entry) => entry.name === "rde")));
 	lines.push(...launchLines(await detectAgents(deps.probe), state.gitRemote?.workdir ?? null));
-	lines.push("Lifecycle: rde status, rde stop, rde start");
+	lines.push("Lifecycle: rde status (--json for scripts), rde stop, rde start");
 	return lines;
 }
 function summaryStep(deps = hostDeps$1) {
@@ -7354,7 +7681,7 @@ const doctor = defineRdeCommand({
 		if (args.fix && report.failed > 0) {
 			if (state === null) throw new ConfigError("no instance to fix yet; run `rde init`");
 			print(report, args.json);
-			const prompts = answeringPrompts(clackPrompts(), /* @__PURE__ */ new Map(), { takeRecommended: args.yes || !stdinIsTty() });
+			const prompts = answeringPrompts(clackPrompts({ confirmsWithYes: true }), /* @__PURE__ */ new Map(), { takeRecommended: args.yes || !stdinIsTty() });
 			const ctx = await createWizardContext(name, {
 				signal: interruptSignal,
 				prompts
@@ -7998,7 +8325,7 @@ function promptsFor(answers, yes) {
 		...yes && { confirmAll: true },
 		...(yes || !terminal) && { takeRecommended: true }
 	};
-	return answeringPrompts(clackPrompts(), keyedAnswers(answers), answering);
+	return answeringPrompts(clackPrompts({ confirmsWithYes: true }), keyedAnswers(answers), answering);
 }
 const init = defineRdeCommand({
 	meta: {
@@ -8016,7 +8343,7 @@ const init = defineRdeCommand({
 		},
 		runtime: {
 			type: "string",
-			description: `How a new instance runs Metabase (${RUNTIME_LIST}); Docker when it is available`
+			description: `How a new instance runs Metabase (${RUNTIME_LIST}); Docker when it is available; the sample database always runs in Docker`
 		},
 		image: {
 			type: "string",
@@ -8065,7 +8392,7 @@ const init = defineRdeCommand({
 		},
 		"skip-databases": {
 			type: "boolean",
-			description: "Connect no database",
+			description: "Connect none of your own databases (the sample database is still connected)",
 			default: false
 		},
 		"git-dir": {
@@ -8104,7 +8431,7 @@ const init = defineRdeCommand({
 		},
 		yes: {
 			type: "boolean",
-			description: "Answer yes to every confirmation (skipping databases)",
+			description: "Answer yes to every confirmation; skips the question about your own databases (the sample database is still connected)",
 			default: false
 		}
 	},
@@ -8144,7 +8471,7 @@ const init = defineRdeCommand({
 		const answers = await combinedAnswers(runOptions);
 		const answering = promptsFor(answers, runOptions.yes);
 		const recording = printTo === void 0 ? null : recordingPrompts(answering);
-		const ctx = await createWizardContext(DEFAULT_INSTANCE_NAME, {
+		const ctx = await createWizardContext(await instanceNameOrDefault(), {
 			signal: interruptSignal,
 			prompts: recording?.prompts ?? answering
 		});
@@ -8167,7 +8494,7 @@ async function loadInstance(name, signal) {
 		state,
 		url: configured.url,
 		runtime: runtimeFromState(configured.runtime, deps),
-		sampleDatabase: state.sampleDatabase === null ? null : sampleDatabaseContainer(state.sampleDatabase, deps.docker)
+		sampleDatabase: state.sampleDatabase === null ? null : sampleDatabaseContainer(state.sampleDatabase, deps.docker, deps.rdeHome)
 	};
 }
 function openInstance(url) {
@@ -8252,6 +8579,16 @@ async function stepReports(ctx, deps) {
 	}
 	return reports;
 }
+function setupOf(ctx, steps) {
+	const pending = steps.find((step) => step.status === "todo" && ctx.state.steps[step.id] === void 0);
+	if (pending === void 0) return { complete: true };
+	return {
+		complete: false,
+		step: pending.id,
+		title: pending.title,
+		resume: `rde init --from ${pending.id}`
+	};
+}
 function isNotServing(error) {
 	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
 }
@@ -8267,7 +8604,7 @@ async function databasesOf(ctx, deps, health) {
 async function sampleDatabaseOf(ctx, deps, databases) {
 	const record = ctx.state.sampleDatabase;
 	if (record === null) return null;
-	const status = await sampleDatabaseContainer(record, deps.runtime.docker).status();
+	const status = await sampleDatabaseContainer(record, deps.runtime.docker, deps.runtime.rdeHome).status();
 	const listed = databases?.find((database) => database.id === record.databaseId) ?? null;
 	return {
 		container: status.running ? "running" : status.installed ? "stopped" : "missing",
@@ -8304,6 +8641,7 @@ async function collectStatus(ctx, deps) {
 	const health = configured === null ? null : await healthOf(configured.url, deps);
 	const databases = health === null ? null : await databasesOf(ctx, deps, health);
 	const admin = ctx.state.admin;
+	const steps = await stepReports(ctx, deps);
 	return {
 		instance: ctx.state.name,
 		url: configured?.url ?? null,
@@ -8317,10 +8655,12 @@ async function collectStatus(ctx, deps) {
 		},
 		version: ctx.state.version,
 		health,
-		steps: await stepReports(ctx, deps),
+		steps,
+		setup: setupOf(ctx, steps),
 		databases,
 		sampleDatabase: await sampleDatabaseOf(ctx, deps, databases),
-		gitSync: await gitSyncOf(ctx, deps)
+		gitSync: await gitSyncOf(ctx, deps),
+		contentRepository: ctx.state.gitRemote === null ? null : ctx.state.gitRemote.workdir
 	};
 }
 function runtimeLine(report) {
@@ -8332,6 +8672,10 @@ function runtimeLine(report) {
 function versionLine(report) {
 	return report.version === null ? "Version: not recorded yet; `rde start` records it" : `Version: ${report.version}`;
 }
+function setupLine(setup) {
+	if (setup.complete) return "Setup: complete";
+	return `Setup: incomplete; "${setup.title}" is not done; run \`${setup.resume}\``;
+}
 function isGitSyncFailure(value) {
 	return "error" in value;
 }
@@ -8368,11 +8712,13 @@ function statusLines(report) {
 		runtimeLine(report),
 		versionLine(report),
 		`Health: ${report.health ?? "unknown"}`,
+		setupLine(report.setup),
 		"Steps:",
 		...checklistLines(report.steps).map((line) => `  ${line}`),
 		...databaseLines(report),
 		sampleDatabaseLine(report),
-		gitSyncLine(report)
+		gitSyncLine(report),
+		...report.contentRepository === null ? [] : [`Content repository: ${report.contentRepository}`]
 	];
 }
 //#endregion
@@ -8421,12 +8767,13 @@ const stop = defineRdeCommand({
 //#endregion
 //#region src/steps/uninstall.ts
 const API_KEY_METHOD = "apiKey";
-function hostUninstallDeps(signal) {
+function hostUninstallDeps(signal, childOutput) {
 	const runner = processRunner(signal);
 	return {
 		docker: dockerTool(runner),
 		daemon: daemonTool(runner),
-		runner
+		runner,
+		childOutput
 	};
 }
 const NOT_TOUCHED = "The mb CLI, Docker, and Java themselves";
@@ -8472,7 +8819,7 @@ async function pathExists(path) {
 		throw error;
 	}
 }
-async function findContainer(name, docker, stateImage) {
+async function findContainer(name, docker, stateImage, home) {
 	try {
 		const inspection = await docker.containerInspect(name);
 		if (!inspection.exists) return {
@@ -8480,6 +8827,14 @@ async function findContainer(name, docker, stateImage) {
 			image: stateImage,
 			problem: null
 		};
+		if (inspection.home !== null && inspection.home !== home) return {
+			removal: null,
+			image: null,
+			problem: {
+				subject: `Container ${name}`,
+				reason: `belongs to the rde home ${inspection.home} and is left alone`
+			}
+		};
 		return {
 			removal: {
 				label: inspection.running ? `Container ${name} (running; it is stopped first)` : `Container ${name} (stopped)`,
@@ -8593,16 +8948,20 @@ async function findMbProfiles(candidates, url, runner) {
 	}
 	return removals;
 }
-function skillLabel(entries) {
-	return `rde skill for ${[...new Set(entries.flatMap((entry) => entry.agents))].join(", ")}`;
+function skillLabel(names, entries) {
+	const agents = [...new Set(entries.flatMap((entry) => entry.agents))];
+	const noun = names.length === 1 ? "skill" : "skills";
+	return `${names.join(" and ")} ${noun} for ${agents.join(", ")}`;
 }
-async function findSkill(runner) {
+async function findSkill(runner, childOutput) {
 	const skills = skillsCli(runner);
-	const entries = (await skills.list()).filter((entry) => entry.name === "rde");
+	const owned = RDE_SOURCE_SKILL_NAMES;
+	const entries = (await skills.list()).filter((entry) => owned.includes(entry.name));
 	if (entries.length === 0) return null;
+	const names = [...new Set(entries.map((entry) => entry.name))];
 	return {
-		label: skillLabel(entries),
-		remove: () => skills.remove("rde")
+		label: skillLabel(names, entries),
+		remove: () => skills.remove(names, childOutput)
 	};
 }
 function instanceDirLabel(path, state) {
@@ -8645,12 +9004,13 @@ async function planUninstall(options, deps) {
 	const kept = [];
 	const { state, problem } = await readStateLeniently(options.instance);
 	if (problem !== null) problems.push(problem);
+	const home = rdeHome();
 	const runtime = state?.runtime?.kind === "docker" ? state.runtime : null;
-	const container = await findContainer(runtime?.containerName ?? containerName(options.instance), deps.docker, runtime?.image ?? null);
+	const container = await findContainer(runtime?.containerName ?? containerName(options.instance, home), deps.docker, runtime?.image ?? null, home);
 	if (container.removal !== null) removals.push(container.removal);
 	if (container.problem !== null) problems.push(container.problem);
 	const sample = state?.sampleDatabase ?? null;
-	const sidecar = await findContainer(sample?.containerName ?? sampleContainerName(options.instance), deps.docker, sample?.image ?? null);
+	const sidecar = await findContainer(sample?.containerName ?? sampleContainerName(options.instance, home), deps.docker, sample?.image ?? null, home);
 	if (sidecar.removal !== null) removals.push(sidecar.removal);
 	if (sidecar.problem !== null) problems.push(sidecar.problem);
 	const jarSource = state?.runtime?.kind === "jar" ? state.runtime.source : null;
@@ -8670,7 +9030,7 @@ async function planUninstall(options, deps) {
 	const profiles = state === null ? await findMbProfiles([DEFAULT_MB_PROFILE, namedMbProfile(options.instance)], null, deps.runner) : await findMbProfiles([state.mbProfile], state.url, deps.runner);
 	removals.push(...profiles);
 	if (options.removeSkill) {
-		const skill = await findSkill(deps.runner);
+		const skill = await findSkill(deps.runner, deps.childOutput);
 		if (skill !== null) removals.push(skill);
 	}
 	const dir = instanceDir(options.instance);
@@ -8799,15 +9159,17 @@ const uninstallCommand = defineRdeCommand({
 		}
 	},
 	async run(args) {
+		const instance = args.instance ?? await instanceNameOrDefault();
+		const ui = terminalUi();
 		const report = await uninstall({
-			instance: args.instance ?? await instanceNameOrDefault(),
+			instance,
 			keepData: args["keep-data"],
 			removeSkill: args["remove-skill"],
 			removeImage: args["remove-image"],
 			yes: args.yes
-		}, hostUninstallDeps(interruptSignal), {
-			prompts: clackPrompts(),
-			ui: clackUi()
+		}, hostUninstallDeps(interruptSignal, ui.childOutput), {
+			prompts: clackPrompts({ confirmsWithYes: true }),
+			ui
 		});
 		if (report === null) return;
 		const remaining = leftBehind(report);
@@ -8821,6 +9183,7 @@ const RELEASE_TAG = /^v?[01]\.(\d+\.\d+(?:\.\d+)?)/;
 function hostDeps(ctx) {
 	return {
 		runtime: hostRuntimeDeps(ctx.state.name, ctx.signal),
+		ports: hostPortProbe,
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
 		timing: DEFAULT_HEALTH_TIMING,
 		releases: releaseLookup(ctx.signal),
@@ -9082,7 +9445,7 @@ const upgradeCommand = defineRdeCommand({
 const main = defineCommand({
 	meta: {
 		name: "rde",
-		version: "0.1.5",
+		version: "0.1.7",
 		description: "Prepares a local machine for data-engineering work with Metabase and coding agents"
 	},
 	subCommands: {
@@ -9100,15 +9463,24 @@ const main = defineCommand({
 	}
 });
 //#endregion
+//#region src/output/usage.ts
+async function printUsage(cmd, parent) {
+	const usage = await renderUsage(cmd, parent);
+	process.stdout.write((drawsOnTerminal() ? usage : withoutEscapes(usage)) + "\n\n");
+}
+//#endregion
 //#region src/cli.ts
 async function run() {
 	installInterruptHandler((code) => process.exit(code));
 	const rawArgs = process.argv.slice(2);
 	if (rawArgs.length === 0) {
-		await showUsage(main);
+		await printUsage(main);
 		return;
 	}
-	await runMain(main, { rawArgs });
+	await runMain(main, {
+		rawArgs,
+		showUsage: printUsage
+	});
 }
 await run();
 //#endregion