postgresai 0.14.0-dev.70 → 0.14.0-dev.72

package/dist/bin/postgres-ai.js

@@ -13064,7 +13064,7 @@ var {
 // package.json
 var package_default = {
   name: "postgresai",
-  version: "0.14.0-dev.70",
+  version: "0.14.0-dev.72",
   description: "postgres_ai CLI",
   license: "Apache-2.0",
   private: false,
@@ -15887,7 +15887,7 @@ var Result = import_lib.default.Result;
 var TypeOverrides = import_lib.default.TypeOverrides;
 var defaults = import_lib.default.defaults;
 // package.json
-var version = "0.14.0-dev.70";
+var version = "0.14.0-dev.72";
 var package_default2 = {
   name: "postgresai",
   version,
@@ -16079,13 +16079,24 @@ function resolveBaseUrls(opts, cfg, defaults2 = {}) {
 
 // lib/issues.ts
 async function fetchIssues(params) {
-  const { apiKey, apiBaseUrl, debug } = params;
+  const { apiKey, apiBaseUrl, orgId, status, limit = 20, offset = 0, debug } = params;
   if (!apiKey) {
     throw new Error("API key is required");
   }
   const base = normalizeBaseUrl(apiBaseUrl);
   const url = new URL(`${base}/issues`);
   url.searchParams.set("select", "id,title,status,created_at");
+  url.searchParams.set("order", "id.desc");
+  url.searchParams.set("limit", String(limit));
+  url.searchParams.set("offset", String(offset));
+  if (typeof orgId === "number") {
+    url.searchParams.set("org_id", `eq.${orgId}`);
+  }
+  if (status === "open") {
+    url.searchParams.set("status", "eq.0");
+  } else if (status === "closed") {
+    url.searchParams.set("status", "eq.1");
+  }
   const headers = {
     "access-token": apiKey,
     Prefer: "return=representation",
@@ -16170,7 +16181,7 @@ async function fetchIssue(params) {
   }
   const base = normalizeBaseUrl(apiBaseUrl);
   const url = new URL(`${base}/issues`);
-  url.searchParams.set("select", "id,title,description,status,created_at,author_display_name");
+  url.searchParams.set("select", "id,title,description,status,created_at,author_display_name,action_items");
   url.searchParams.set("id", `eq.${issueId}`);
   url.searchParams.set("limit", "1");
   const headers = {
@@ -16198,11 +16209,20 @@ async function fetchIssue(params) {
   if (response.ok) {
     try {
       const parsed = JSON.parse(data);
-      if (Array.isArray(parsed)) {
-        return parsed[0] ?? null;
-      } else {
-        return parsed;
+      const rawIssue = Array.isArray(parsed) ? parsed[0] : parsed;
+      if (!rawIssue) {
+        return null;
       }
+      const actionItemsSummary = Array.isArray(rawIssue.action_items) ? rawIssue.action_items.map((item) => ({ id: item.id, title: item.title })) : [];
+      return {
+        id: rawIssue.id,
+        title: rawIssue.title,
+        description: rawIssue.description,
+        status: rawIssue.status,
+        created_at: rawIssue.created_at,
+        author_display_name: rawIssue.author_display_name,
+        action_items: actionItemsSummary
+      };
     } catch {
       throw new Error(`Failed to parse issue response: ${data}`);
     }
@@ -16441,6 +16461,243 @@ async function updateIssueComment(params) {
     throw new Error(formatHttpError("Failed to update issue comment", response.status, data));
   }
 }
+async function fetchActionItem(params) {
+  const { apiKey, apiBaseUrl, actionItemIds, debug } = params;
+  if (!apiKey) {
+    throw new Error("API key is required");
+  }
+  const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  const rawIds = Array.isArray(actionItemIds) ? actionItemIds : [actionItemIds];
+  const validIds = rawIds.filter((id) => id != null && typeof id === "string").map((id) => id.trim()).filter((id) => id.length > 0 && uuidPattern.test(id));
+  if (validIds.length === 0) {
+    throw new Error("actionItemId is required and must be a valid UUID");
+  }
+  const base = normalizeBaseUrl(apiBaseUrl);
+  const url = new URL(`${base}/issue_action_items`);
+  if (validIds.length === 1) {
+    url.searchParams.set("id", `eq.${validIds[0]}`);
+  } else {
+    url.searchParams.set("id", `in.(${validIds.join(",")})`);
+  }
+  const headers = {
+    "access-token": apiKey,
+    Prefer: "return=representation",
+    "Content-Type": "application/json",
+    Connection: "close"
+  };
+  if (debug) {
+    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
+    console.log(`Debug: Resolved API base URL: ${base}`);
+    console.log(`Debug: GET URL: ${url.toString()}`);
+    console.log(`Debug: Auth scheme: access-token`);
+    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+  }
+  const response = await fetch(url.toString(), {
+    method: "GET",
+    headers
+  });
+  if (debug) {
+    console.log(`Debug: Response status: ${response.status}`);
+    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+  }
+  const data = await response.text();
+  if (response.ok) {
+    try {
+      const parsed = JSON.parse(data);
+      if (Array.isArray(parsed)) {
+        return parsed;
+      }
+      return parsed ? [parsed] : [];
+    } catch {
+      throw new Error(`Failed to parse action item response: ${data}`);
+    }
+  } else {
+    throw new Error(formatHttpError("Failed to fetch action item", response.status, data));
+  }
+}
+async function fetchActionItems(params) {
+  const { apiKey, apiBaseUrl, issueId, debug } = params;
+  if (!apiKey) {
+    throw new Error("API key is required");
+  }
+  if (!issueId) {
+    throw new Error("issueId is required");
+  }
+  const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  if (!uuidPattern.test(issueId.trim())) {
+    throw new Error("issueId must be a valid UUID");
+  }
+  const base = normalizeBaseUrl(apiBaseUrl);
+  const url = new URL(`${base}/issue_action_items`);
+  url.searchParams.set("issue_id", `eq.${issueId.trim()}`);
+  const headers = {
+    "access-token": apiKey,
+    Prefer: "return=representation",
+    "Content-Type": "application/json",
+    Connection: "close"
+  };
+  if (debug) {
+    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
+    console.log(`Debug: Resolved API base URL: ${base}`);
+    console.log(`Debug: GET URL: ${url.toString()}`);
+    console.log(`Debug: Auth scheme: access-token`);
+    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+  }
+  const response = await fetch(url.toString(), {
+    method: "GET",
+    headers
+  });
+  if (debug) {
+    console.log(`Debug: Response status: ${response.status}`);
+    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+  }
+  const data = await response.text();
+  if (response.ok) {
+    try {
+      return JSON.parse(data);
+    } catch {
+      throw new Error(`Failed to parse action items response: ${data}`);
+    }
+  } else {
+    throw new Error(formatHttpError("Failed to fetch action items", response.status, data));
+  }
+}
+async function createActionItem(params) {
+  const { apiKey, apiBaseUrl, issueId, title, description, sqlAction, configs, debug } = params;
+  if (!apiKey) {
+    throw new Error("API key is required");
+  }
+  if (!issueId) {
+    throw new Error("issueId is required");
+  }
+  const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  if (!uuidPattern.test(issueId.trim())) {
+    throw new Error("issueId must be a valid UUID");
+  }
+  if (!title) {
+    throw new Error("title is required");
+  }
+  const base = normalizeBaseUrl(apiBaseUrl);
+  const url = new URL(`${base}/rpc/issue_action_item_create`);
+  const bodyObj = {
+    issue_id: issueId,
+    title
+  };
+  if (description !== undefined) {
+    bodyObj.description = description;
+  }
+  if (sqlAction !== undefined) {
+    bodyObj.sql_action = sqlAction;
+  }
+  if (configs !== undefined) {
+    bodyObj.configs = configs;
+  }
+  const body = JSON.stringify(bodyObj);
+  const headers = {
+    "access-token": apiKey,
+    Prefer: "return=representation",
+    "Content-Type": "application/json",
+    Connection: "close"
+  };
+  if (debug) {
+    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
+    console.log(`Debug: Resolved API base URL: ${base}`);
+    console.log(`Debug: POST URL: ${url.toString()}`);
+    console.log(`Debug: Auth scheme: access-token`);
+    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.log(`Debug: Request body: ${body}`);
+  }
+  const response = await fetch(url.toString(), {
+    method: "POST",
+    headers,
+    body
+  });
+  if (debug) {
+    console.log(`Debug: Response status: ${response.status}`);
+    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+  }
+  const data = await response.text();
+  if (response.ok) {
+    try {
+      return JSON.parse(data);
+    } catch {
+      throw new Error(`Failed to parse create action item response: ${data}`);
+    }
+  } else {
+    throw new Error(formatHttpError("Failed to create action item", response.status, data));
+  }
+}
+async function updateActionItem(params) {
+  const { apiKey, apiBaseUrl, actionItemId, title, description, isDone, status, statusReason, sqlAction, configs, debug } = params;
+  if (!apiKey) {
+    throw new Error("API key is required");
+  }
+  if (!actionItemId) {
+    throw new Error("actionItemId is required");
+  }
+  const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  if (!uuidPattern.test(actionItemId.trim())) {
+    throw new Error("actionItemId must be a valid UUID");
+  }
+  const hasUpdateField = title !== undefined || description !== undefined || isDone !== undefined || status !== undefined || statusReason !== undefined || sqlAction !== undefined || configs !== undefined;
+  if (!hasUpdateField) {
+    throw new Error("At least one field to update is required");
+  }
+  const base = normalizeBaseUrl(apiBaseUrl);
+  const url = new URL(`${base}/rpc/issue_action_item_update`);
+  const bodyObj = {
+    action_item_id: actionItemId
+  };
+  if (title !== undefined) {
+    bodyObj.title = title;
+  }
+  if (description !== undefined) {
+    bodyObj.description = description;
+  }
+  if (isDone !== undefined) {
+    bodyObj.is_done = isDone;
+  }
+  if (status !== undefined) {
+    bodyObj.status = status;
+  }
+  if (statusReason !== undefined) {
+    bodyObj.status_reason = statusReason;
+  }
+  if (sqlAction !== undefined) {
+    bodyObj.sql_action = sqlAction;
+  }
+  if (configs !== undefined) {
+    bodyObj.configs = configs;
+  }
+  const body = JSON.stringify(bodyObj);
+  const headers = {
+    "access-token": apiKey,
+    Prefer: "return=representation",
+    "Content-Type": "application/json",
+    Connection: "close"
+  };
+  if (debug) {
+    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
+    console.log(`Debug: Resolved API base URL: ${base}`);
+    console.log(`Debug: POST URL: ${url.toString()}`);
+    console.log(`Debug: Auth scheme: access-token`);
+    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.log(`Debug: Request body: ${body}`);
+  }
+  const response = await fetch(url.toString(), {
+    method: "POST",
+    headers,
+    body
+  });
+  if (debug) {
+    console.log(`Debug: Response status: ${response.status}`);
+    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+  }
+  if (!response.ok) {
+    const data = await response.text();
+    throw new Error(formatHttpError("Failed to update action item", response.status, data));
+  }
+}
 
 // node_modules/zod/v4/core/core.js
 var NEVER = Object.freeze({
@@ -23350,7 +23607,16 @@ async function handleToolCall(req, rootOpts, extra) {
   }
   try {
     if (toolName === "list_issues") {
-      const issues = await fetchIssues({ apiKey, apiBaseUrl, debug });
+      const orgId = args.org_id !== undefined ? Number(args.org_id) : cfg.orgId ?? undefined;
+      const statusArg = args.status ? String(args.status) : undefined;
+      let status;
+      if (statusArg === "open")
+        status = "open";
+      else if (statusArg === "closed")
+        status = "closed";
+      const limit = args.limit !== undefined ? Number(args.limit) : undefined;
+      const offset = args.offset !== undefined ? Number(args.offset) : undefined;
+      const issues = await fetchIssues({ apiKey, apiBaseUrl, orgId, status, limit, offset, debug });
       return { content: [{ type: "text", text: JSON.stringify(issues, null, 2) }] };
     }
     if (toolName === "view_issue") {
@@ -23430,6 +23696,70 @@ async function handleToolCall(req, rootOpts, extra) {
       const result = await updateIssueComment({ apiKey, apiBaseUrl, commentId, content, debug });
       return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
     }
+    if (toolName === "view_action_item") {
+      let actionItemIds;
+      if (Array.isArray(args.action_item_ids)) {
+        actionItemIds = args.action_item_ids.map((id) => String(id).trim()).filter((id) => id);
+      } else if (args.action_item_id) {
+        actionItemIds = [String(args.action_item_id).trim()];
+      } else {
+        actionItemIds = [];
+      }
+      if (actionItemIds.length === 0) {
+        return { content: [{ type: "text", text: "action_item_id or action_item_ids is required" }], isError: true };
+      }
+      const actionItems = await fetchActionItem({ apiKey, apiBaseUrl, actionItemIds, debug });
+      if (actionItems.length === 0) {
+        return { content: [{ type: "text", text: "Action item(s) not found" }], isError: true };
+      }
+      return { content: [{ type: "text", text: JSON.stringify(actionItems, null, 2) }] };
+    }
+    if (toolName === "list_action_items") {
+      const issueId = String(args.issue_id || "").trim();
+      if (!issueId) {
+        return { content: [{ type: "text", text: "issue_id is required" }], isError: true };
+      }
+      const actionItems = await fetchActionItems({ apiKey, apiBaseUrl, issueId, debug });
+      return { content: [{ type: "text", text: JSON.stringify(actionItems, null, 2) }] };
+    }
+    if (toolName === "create_action_item") {
+      const issueId = String(args.issue_id || "").trim();
+      const rawTitle = String(args.title || "").trim();
+      if (!issueId) {
+        return { content: [{ type: "text", text: "issue_id is required" }], isError: true };
+      }
+      if (!rawTitle) {
+        return { content: [{ type: "text", text: "title is required" }], isError: true };
+      }
+      const title = interpretEscapes(rawTitle);
+      const rawDescription = args.description ? String(args.description) : undefined;
+      const description = rawDescription ? interpretEscapes(rawDescription) : undefined;
+      const sqlAction = args.sql_action !== undefined ? String(args.sql_action) : undefined;
+      const configs = Array.isArray(args.configs) ? args.configs : undefined;
+      const result = await createActionItem({ apiKey, apiBaseUrl, issueId, title, description, sqlAction, configs, debug });
+      return { content: [{ type: "text", text: JSON.stringify({ id: result }, null, 2) }] };
+    }
+    if (toolName === "update_action_item") {
+      const actionItemId = String(args.action_item_id || "").trim();
+      if (!actionItemId) {
+        return { content: [{ type: "text", text: "action_item_id is required" }], isError: true };
+      }
+      const rawTitle = args.title !== undefined ? String(args.title) : undefined;
+      const title = rawTitle !== undefined ? interpretEscapes(rawTitle) : undefined;
+      const rawDescription = args.description !== undefined ? String(args.description) : undefined;
+      const description = rawDescription !== undefined ? interpretEscapes(rawDescription) : undefined;
+      const isDone = args.is_done !== undefined ? Boolean(args.is_done) : undefined;
+      const status = args.status !== undefined ? String(args.status) : undefined;
+      const statusReason = args.status_reason !== undefined ? String(args.status_reason) : undefined;
+      if (title === undefined && description === undefined && isDone === undefined && status === undefined && statusReason === undefined) {
+        return { content: [{ type: "text", text: "At least one field to update is required (title, description, is_done, status, or status_reason)" }], isError: true };
+      }
+      if (status !== undefined && !["waiting_for_approval", "approved", "rejected"].includes(status)) {
+        return { content: [{ type: "text", text: "status must be 'waiting_for_approval', 'approved', or 'rejected'" }], isError: true };
+      }
+      await updateActionItem({ apiKey, apiBaseUrl, actionItemId, title, description, isDone, status, statusReason, debug });
+      return { content: [{ type: "text", text: JSON.stringify({ success: true }, null, 2) }] };
+    }
     throw new Error(`Unknown tool: ${toolName}`);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -23437,7 +23767,11 @@ async function handleToolCall(req, rootOpts, extra) {
   }
 }
 async function startMcpServer(rootOpts, extra) {
-  const server = new Server({ name: "postgresai-mcp", version: package_default2.version }, { capabilities: { tools: {} } });
+  const server = new Server({
+    name: "postgresai-mcp",
+    version: package_default2.version,
+    title: "PostgresAI MCP Server"
+  }, { capabilities: { tools: {} } });
   server.setRequestHandler(ListToolsRequestSchema, async () => {
     return {
       tools: [
@@ -23447,6 +23781,10 @@ async function startMcpServer(rootOpts, extra) {
           inputSchema: {
             type: "object",
             properties: {
+              org_id: { type: "number", description: "Organization ID (optional, falls back to config)" },
+              status: { type: "string", description: "Filter by status: 'open', 'closed', or omit for all" },
+              limit: { type: "number", description: "Max number of issues to return (default: 20)" },
+              offset: { type: "number", description: "Number of issues to skip (default: 0)" },
               debug: { type: "boolean", description: "Enable verbose debug logs" }
             },
             additionalProperties: false
@@ -23535,47 +23873,130 @@ async function startMcpServer(rootOpts, extra) {
             required: ["comment_id", "content"],
             additionalProperties: false
           }
-        }
-      ]
-    };
-  });
-  server.setRequestHandler(CallToolRequestSchema, async (req) => {
-    return handleToolCall(req, rootOpts, extra);
-  });
-  const transport = new StdioServerTransport;
-  await server.connect(transport);
-}
-
-// lib/issues.ts
-async function fetchIssues2(params) {
-  const { apiKey, apiBaseUrl, debug } = params;
-  if (!apiKey) {
-    throw new Error("API key is required");
-  }
-  const base = normalizeBaseUrl(apiBaseUrl);
-  const url = new URL(`${base}/issues`);
-  url.searchParams.set("select", "id,title,status,created_at");
-  const headers = {
-    "access-token": apiKey,
-    Prefer: "return=representation",
-    "Content-Type": "application/json",
-    Connection: "close"
-  };
-  if (debug) {
-    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: GET URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
-  }
-  const response = await fetch(url.toString(), {
-    method: "GET",
-    headers
-  });
-  if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
-  }
+        },
+        {
+          name: "view_action_item",
+          description: "View action item(s) with all details. Supports single ID or multiple IDs.",
+          inputSchema: {
+            type: "object",
+            properties: {
+              action_item_id: { type: "string", description: "Single action item ID (UUID)" },
+              action_item_ids: { type: "array", items: { type: "string" }, description: "Multiple action item IDs (UUIDs)" },
+              debug: { type: "boolean", description: "Enable verbose debug logs" }
+            },
+            additionalProperties: false
+          }
+        },
+        {
+          name: "list_action_items",
+          description: "List action items for an issue",
+          inputSchema: {
+            type: "object",
+            properties: {
+              issue_id: { type: "string", description: "Issue ID (UUID)" },
+              debug: { type: "boolean", description: "Enable verbose debug logs" }
+            },
+            required: ["issue_id"],
+            additionalProperties: false
+          }
+        },
+        {
+          name: "create_action_item",
+          description: "Create a new action item for an issue",
+          inputSchema: {
+            type: "object",
+            properties: {
+              issue_id: { type: "string", description: "Issue ID (UUID)" },
+              title: { type: "string", description: "Action item title" },
+              description: { type: "string", description: "Detailed description" },
+              sql_action: { type: "string", description: "SQL command to execute, e.g. 'DROP INDEX CONCURRENTLY idx_unused;'" },
+              configs: {
+                type: "array",
+                items: {
+                  type: "object",
+                  properties: {
+                    parameter: { type: "string" },
+                    value: { type: "string" }
+                  },
+                  required: ["parameter", "value"]
+                },
+                description: "Configuration parameter changes"
+              },
+              debug: { type: "boolean", description: "Enable verbose debug logs" }
+            },
+            required: ["issue_id", "title"],
+            additionalProperties: false
+          }
+        },
+        {
+          name: "update_action_item",
+          description: "Update an action item: mark as done/not done, approve/reject, or edit title/description",
+          inputSchema: {
+            type: "object",
+            properties: {
+              action_item_id: { type: "string", description: "Action item ID (UUID)" },
+              title: { type: "string", description: "New title" },
+              description: { type: "string", description: "New description" },
+              is_done: { type: "boolean", description: "Mark as done (true) or not done (false)" },
+              status: { type: "string", description: "Approval status: 'waiting_for_approval', 'approved', or 'rejected'" },
+              status_reason: { type: "string", description: "Reason for approval/rejection" },
+              debug: { type: "boolean", description: "Enable verbose debug logs" }
+            },
+            required: ["action_item_id"],
+            additionalProperties: false
+          }
+        }
+      ]
+    };
+  });
+  server.setRequestHandler(CallToolRequestSchema, async (req) => {
+    return handleToolCall(req, rootOpts, extra);
+  });
+  const transport = new StdioServerTransport;
+  await server.connect(transport);
+}
+
+// lib/issues.ts
+async function fetchIssues2(params) {
+  const { apiKey, apiBaseUrl, orgId, status, limit = 20, offset = 0, debug } = params;
+  if (!apiKey) {
+    throw new Error("API key is required");
+  }
+  const base = normalizeBaseUrl(apiBaseUrl);
+  const url = new URL(`${base}/issues`);
+  url.searchParams.set("select", "id,title,status,created_at");
+  url.searchParams.set("order", "id.desc");
+  url.searchParams.set("limit", String(limit));
+  url.searchParams.set("offset", String(offset));
+  if (typeof orgId === "number") {
+    url.searchParams.set("org_id", `eq.${orgId}`);
+  }
+  if (status === "open") {
+    url.searchParams.set("status", "eq.0");
+  } else if (status === "closed") {
+    url.searchParams.set("status", "eq.1");
+  }
+  const headers = {
+    "access-token": apiKey,
+    Prefer: "return=representation",
+    "Content-Type": "application/json",
+    Connection: "close"
+  };
+  if (debug) {
+    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
+    console.log(`Debug: Resolved API base URL: ${base}`);
+    console.log(`Debug: GET URL: ${url.toString()}`);
+    console.log(`Debug: Auth scheme: access-token`);
+    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+  }
+  const response = await fetch(url.toString(), {
+    method: "GET",
+    headers
+  });
+  if (debug) {
+    console.log(`Debug: Response status: ${response.status}`);
+    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+  }
   const data = await response.text();
   if (response.ok) {
     try {
@@ -23639,7 +24060,7 @@ async function fetchIssue2(params) {
   }
   const base = normalizeBaseUrl(apiBaseUrl);
   const url = new URL(`${base}/issues`);
-  url.searchParams.set("select", "id,title,description,status,created_at,author_display_name");
+  url.searchParams.set("select", "id,title,description,status,created_at,author_display_name,action_items");
   url.searchParams.set("id", `eq.${issueId}`);
   url.searchParams.set("limit", "1");
   const headers = {
@@ -23667,11 +24088,20 @@ async function fetchIssue2(params) {
   if (response.ok) {
     try {
       const parsed = JSON.parse(data);
-      if (Array.isArray(parsed)) {
-        return parsed[0] ?? null;
-      } else {
-        return parsed;
+      const rawIssue = Array.isArray(parsed) ? parsed[0] : parsed;
+      if (!rawIssue) {
+        return null;
       }
+      const actionItemsSummary = Array.isArray(rawIssue.action_items) ? rawIssue.action_items.map((item) => ({ id: item.id, title: item.title })) : [];
+      return {
+        id: rawIssue.id,
+        title: rawIssue.title,
+        description: rawIssue.description,
+        status: rawIssue.status,
+        created_at: rawIssue.created_at,
+        author_display_name: rawIssue.author_display_name,
+        action_items: actionItemsSummary
+      };
     } catch {
       throw new Error(`Failed to parse issue response: ${data}`);
     }
@@ -23910,6 +24340,243 @@ async function updateIssueComment2(params) {
     throw new Error(formatHttpError("Failed to update issue comment", response.status, data));
   }
 }
+async function fetchActionItem2(params) {
+  const { apiKey, apiBaseUrl, actionItemIds, debug } = params;
+  if (!apiKey) {
+    throw new Error("API key is required");
+  }
+  const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  const rawIds = Array.isArray(actionItemIds) ? actionItemIds : [actionItemIds];
+  const validIds = rawIds.filter((id) => id != null && typeof id === "string").map((id) => id.trim()).filter((id) => id.length > 0 && uuidPattern.test(id));
+  if (validIds.length === 0) {
+    throw new Error("actionItemId is required and must be a valid UUID");
+  }
+  const base = normalizeBaseUrl(apiBaseUrl);
+  const url = new URL(`${base}/issue_action_items`);
+  if (validIds.length === 1) {
+    url.searchParams.set("id", `eq.${validIds[0]}`);
+  } else {
+    url.searchParams.set("id", `in.(${validIds.join(",")})`);
+  }
+  const headers = {
+    "access-token": apiKey,
+    Prefer: "return=representation",
+    "Content-Type": "application/json",
+    Connection: "close"
+  };
+  if (debug) {
+    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
+    console.log(`Debug: Resolved API base URL: ${base}`);
+    console.log(`Debug: GET URL: ${url.toString()}`);
+    console.log(`Debug: Auth scheme: access-token`);
+    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+  }
+  const response = await fetch(url.toString(), {
+    method: "GET",
+    headers
+  });
+  if (debug) {
+    console.log(`Debug: Response status: ${response.status}`);
+    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+  }
+  const data = await response.text();
+  if (response.ok) {
+    try {
+      const parsed = JSON.parse(data);
+      if (Array.isArray(parsed)) {
+        return parsed;
+      }
+      return parsed ? [parsed] : [];
+    } catch {
+      throw new Error(`Failed to parse action item response: ${data}`);
+    }
+  } else {
+    throw new Error(formatHttpError("Failed to fetch action item", response.status, data));
+  }
+}
+async function fetchActionItems2(params) {
+  const { apiKey, apiBaseUrl, issueId, debug } = params;
+  if (!apiKey) {
+    throw new Error("API key is required");
+  }
+  if (!issueId) {
+    throw new Error("issueId is required");
+  }
+  const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  if (!uuidPattern.test(issueId.trim())) {
+    throw new Error("issueId must be a valid UUID");
+  }
+  const base = normalizeBaseUrl(apiBaseUrl);
+  const url = new URL(`${base}/issue_action_items`);
+  url.searchParams.set("issue_id", `eq.${issueId.trim()}`);
+  const headers = {
+    "access-token": apiKey,
+    Prefer: "return=representation",
+    "Content-Type": "application/json",
+    Connection: "close"
+  };
+  if (debug) {
+    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
+    console.log(`Debug: Resolved API base URL: ${base}`);
+    console.log(`Debug: GET URL: ${url.toString()}`);
+    console.log(`Debug: Auth scheme: access-token`);
+    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+  }
+  const response = await fetch(url.toString(), {
+    method: "GET",
+    headers
+  });
+  if (debug) {
+    console.log(`Debug: Response status: ${response.status}`);
+    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+  }
+  const data = await response.text();
+  if (response.ok) {
+    try {
+      return JSON.parse(data);
+    } catch {
+      throw new Error(`Failed to parse action items response: ${data}`);
+    }
+  } else {
+    throw new Error(formatHttpError("Failed to fetch action items", response.status, data));
+  }
+}
+async function createActionItem2(params) {
+  const { apiKey, apiBaseUrl, issueId, title, description, sqlAction, configs, debug } = params;
+  if (!apiKey) {
+    throw new Error("API key is required");
+  }
+  if (!issueId) {
+    throw new Error("issueId is required");
+  }
+  const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  if (!uuidPattern.test(issueId.trim())) {
+    throw new Error("issueId must be a valid UUID");
+  }
+  if (!title) {
+    throw new Error("title is required");
+  }
+  const base = normalizeBaseUrl(apiBaseUrl);
+  const url = new URL(`${base}/rpc/issue_action_item_create`);
+  const bodyObj = {
+    issue_id: issueId,
+    title
+  };
+  if (description !== undefined) {
+    bodyObj.description = description;
+  }
+  if (sqlAction !== undefined) {
+    bodyObj.sql_action = sqlAction;
+  }
+  if (configs !== undefined) {
+    bodyObj.configs = configs;
+  }
+  const body = JSON.stringify(bodyObj);
+  const headers = {
+    "access-token": apiKey,
+    Prefer: "return=representation",
+    "Content-Type": "application/json",
+    Connection: "close"
+  };
+  if (debug) {
+    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
+    console.log(`Debug: Resolved API base URL: ${base}`);
+    console.log(`Debug: POST URL: ${url.toString()}`);
+    console.log(`Debug: Auth scheme: access-token`);
+    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.log(`Debug: Request body: ${body}`);
+  }
+  const response = await fetch(url.toString(), {
+    method: "POST",
+    headers,
+    body
+  });
+  if (debug) {
+    console.log(`Debug: Response status: ${response.status}`);
+    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+  }
+  const data = await response.text();
+  if (response.ok) {
+    try {
+      return JSON.parse(data);
+    } catch {
+      throw new Error(`Failed to parse create action item response: ${data}`);
+    }
+  } else {
+    throw new Error(formatHttpError("Failed to create action item", response.status, data));
+  }
+}
+async function updateActionItem2(params) {
+  const { apiKey, apiBaseUrl, actionItemId, title, description, isDone, status, statusReason, sqlAction, configs, debug } = params;
+  if (!apiKey) {
+    throw new Error("API key is required");
+  }
+  if (!actionItemId) {
+    throw new Error("actionItemId is required");
+  }
+  const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  if (!uuidPattern.test(actionItemId.trim())) {
+    throw new Error("actionItemId must be a valid UUID");
+  }
+  const hasUpdateField = title !== undefined || description !== undefined || isDone !== undefined || status !== undefined || statusReason !== undefined || sqlAction !== undefined || configs !== undefined;
+  if (!hasUpdateField) {
+    throw new Error("At least one field to update is required");
+  }
+  const base = normalizeBaseUrl(apiBaseUrl);
+  const url = new URL(`${base}/rpc/issue_action_item_update`);
+  const bodyObj = {
+    action_item_id: actionItemId
+  };
+  if (title !== undefined) {
+    bodyObj.title = title;
+  }
+  if (description !== undefined) {
+    bodyObj.description = description;
+  }
+  if (isDone !== undefined) {
+    bodyObj.is_done = isDone;
+  }
+  if (status !== undefined) {
+    bodyObj.status = status;
+  }
+  if (statusReason !== undefined) {
+    bodyObj.status_reason = statusReason;
+  }
+  if (sqlAction !== undefined) {
+    bodyObj.sql_action = sqlAction;
+  }
+  if (configs !== undefined) {
+    bodyObj.configs = configs;
+  }
+  const body = JSON.stringify(bodyObj);
+  const headers = {
+    "access-token": apiKey,
+    Prefer: "return=representation",
+    "Content-Type": "application/json",
+    Connection: "close"
+  };
+  if (debug) {
+    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
+    console.log(`Debug: Resolved API base URL: ${base}`);
+    console.log(`Debug: POST URL: ${url.toString()}`);
+    console.log(`Debug: Auth scheme: access-token`);
+    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.log(`Debug: Request body: ${body}`);
+  }
+  const response = await fetch(url.toString(), {
+    method: "POST",
+    headers,
+    body
+  });
+  if (debug) {
+    console.log(`Debug: Response status: ${response.status}`);
+    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+  }
+  if (!response.ok) {
+    const data = await response.text();
+    throw new Error(formatHttpError("Failed to update action item", response.status, data));
+  }
+}
 
 // lib/util.ts
 function maskSecret2(secret) {
@@ -23947,6 +24614,15 @@ import { URL as URL2, fileURLToPath } from "url";
 import * as fs3 from "fs";
 import * as path3 from "path";
 var DEFAULT_MONITORING_USER = "postgres_ai_mon";
+var KNOWN_PROVIDERS = ["self-managed", "supabase"];
+var SKIP_ROLE_CREATION_PROVIDERS = ["supabase"];
+var SKIP_ALTER_USER_PROVIDERS = ["supabase"];
+var SKIP_SEARCH_PATH_CHECK_PROVIDERS = ["supabase"];
+function validateProvider(provider) {
+  if (!provider || KNOWN_PROVIDERS.includes(provider))
+    return null;
+  return `Unknown provider "${provider}". Known providers: ${KNOWN_PROVIDERS.join(", ")}. Treating as self-managed.`;
+}
 function sslModeToConfig(mode) {
   if (mode.toLowerCase() === "disable")
     return false;
@@ -24261,6 +24937,7 @@ async function resolveMonitoringPassword(opts) {
 async function buildInitPlan(params) {
   const monitoringUser = params.monitoringUser || DEFAULT_MONITORING_USER;
   const database = params.database;
+  const provider = params.provider ?? "self-managed";
   const qRole = quoteIdent(monitoringUser);
   const qDb = quoteIdent(database);
   const qPw = quoteLiteral(params.monitoringPassword);
@@ -24270,7 +24947,8 @@ async function buildInitPlan(params) {
     ROLE_IDENT: qRole,
     DB_IDENT: qDb
   };
-  const roleStmt = `do $$ begin
+  if (!SKIP_ROLE_CREATION_PROVIDERS.includes(provider)) {
+    const roleStmt = `do $$ begin
   if not exists (select 1 from pg_catalog.pg_roles where rolname = ${qRoleNameLit}) then
     begin
       create user ${qRole} with password ${qPw};
@@ -24280,11 +24958,23 @@ async function buildInitPlan(params) {
   end if;
   alter user ${qRole} with password ${qPw};
 end $$;`;
-  const roleSql = applyTemplate(loadSqlTemplate("01.role.sql"), { ...vars, ROLE_STMT: roleStmt });
-  steps.push({ name: "01.role", sql: roleSql });
+    const roleSql = applyTemplate(loadSqlTemplate("01.role.sql"), { ...vars, ROLE_STMT: roleStmt });
+    steps.push({ name: "01.role", sql: roleSql });
+  }
+  let permissionsSql = applyTemplate(loadSqlTemplate("02.permissions.sql"), vars);
+  if (SKIP_ALTER_USER_PROVIDERS.includes(provider)) {
+    permissionsSql = permissionsSql.split(`
+`).filter((line) => {
+      const trimmed = line.trim();
+      if (trimmed.startsWith("--") || trimmed === "")
+        return true;
+      return !/^\s*alter\s+user\s+/i.test(line);
+    }).join(`
+`);
+  }
   steps.push({
     name: "02.permissions",
-    sql: applyTemplate(loadSqlTemplate("02.permissions.sql"), vars)
+    sql: permissionsSql
   });
   steps.push({
     name: "05.helpers",
@@ -24372,6 +25062,7 @@ async function verifyInitSetup(params) {
     const missingOptional = [];
     const role = params.monitoringUser;
     const db = params.database;
+    const provider = params.provider ?? "self-managed";
     const roleRes = await params.client.query("select 1 from pg_catalog.pg_roles where rolname = $1", [role]);
     const roleExists = (roleRes.rowCount ?? 0) > 0;
     if (!roleExists) {
@@ -24407,15 +25098,17 @@ async function verifyInitSetup(params) {
     if (!schemaUsageRes.rows?.[0]?.ok) {
       missingRequired.push("USAGE on schema public");
     }
-    const rolcfgRes = await params.client.query("select rolconfig from pg_catalog.pg_roles where rolname = $1", [role]);
-    const rolconfig = rolcfgRes.rows?.[0]?.rolconfig;
-    const spLine = Array.isArray(rolconfig) ? rolconfig.find((v) => String(v).startsWith("search_path=")) : undefined;
-    if (typeof spLine !== "string" || !spLine) {
-      missingRequired.push("role search_path is set");
-    } else {
-      const sp = spLine.toLowerCase();
-      if (!sp.includes("postgres_ai") || !sp.includes("public") || !sp.includes("pg_catalog")) {
-        missingRequired.push("role search_path includes postgres_ai, public and pg_catalog");
+    if (!SKIP_SEARCH_PATH_CHECK_PROVIDERS.includes(provider)) {
+      const rolcfgRes = await params.client.query("select rolconfig from pg_catalog.pg_roles where rolname = $1", [role]);
+      const rolconfig = rolcfgRes.rows?.[0]?.rolconfig;
+      const spLine = Array.isArray(rolconfig) ? rolconfig.find((v) => String(v).startsWith("search_path=")) : undefined;
+      if (typeof spLine !== "string" || !spLine) {
+        missingRequired.push("role search_path is set");
+      } else {
+        const sp = spLine.toLowerCase();
+        if (!sp.includes("postgres_ai") || !sp.includes("public") || !sp.includes("pg_catalog")) {
+          missingRequired.push("role search_path includes postgres_ai, public and pg_catalog");
+        }
       }
     }
     const explainFnRes = await params.client.query("select has_function_privilege($1, 'postgres_ai.explain_generic(text, text, text)', 'EXECUTE') as ok", [role]);
@@ -24619,6 +25312,38 @@ class SupabaseClient {
     return err;
   }
 }
+async function fetchPoolerDatabaseUrl(config2) {
+  const url = `${SUPABASE_API_BASE}/v1/projects/${encodeURIComponent(config2.projectRef)}/config/database/pooler`;
+  try {
+    const response = await fetch(url, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${config2.accessToken}`
+      }
+    });
+    if (!response.ok) {
+      return null;
+    }
+    const data = await response.json();
+    if (Array.isArray(data) && data.length > 0) {
+      const pooler = data[0];
+      if (pooler.db_host && pooler.db_port && pooler.db_name && pooler.db_user) {
+        return `postgresql://${pooler.db_user}@${pooler.db_host}:${pooler.db_port}/${pooler.db_name}`;
+      }
+      if (typeof pooler.connection_string === "string") {
+        try {
+          const connUrl = new URL(pooler.connection_string);
+          return `postgresql://${connUrl.username}@${connUrl.hostname}:${connUrl.port}${connUrl.pathname}`;
+        } catch {
+          return null;
+        }
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
 function resolveSupabaseConfig(opts) {
   const accessToken = opts.accessToken?.trim() || process.env.SUPABASE_ACCESS_TOKEN?.trim() || "";
   const projectRef = opts.projectRef?.trim() || process.env.SUPABASE_PROJECT_REF?.trim() || "";
@@ -27134,7 +27859,7 @@ program2.command("set-default-project <project>").description("store default pro
   writeConfig({ defaultProject: value });
   console.log(`Default project saved: ${value}`);
 });
-program2.command("prepare-db [conn]").description("prepare database for monitoring: create monitoring user, required view(s), and grant permissions (idempotent)").option("--db-url <url>", "PostgreSQL connection URL (admin) to run the setup against (deprecated; pass it as positional arg)").option("-h, --host <host>", "PostgreSQL host (psql-like)").option("-p, --port <port>", "PostgreSQL port (psql-like)").option("-U, --username <username>", "PostgreSQL user (psql-like)").option("-d, --dbname <dbname>", "PostgreSQL database name (psql-like)").option("--admin-password <password>", "Admin connection password (otherwise uses PGPASSWORD if set)").option("--monitoring-user <name>", "Monitoring role name to create/update", DEFAULT_MONITORING_USER).option("--password <password>", "Monitoring role password (overrides PGAI_MON_PASSWORD)").option("--skip-optional-permissions", "Skip optional permissions (RDS/self-managed extras)", false).option("--verify", "Verify that monitoring role/permissions are in place (no changes)", false).option("--reset-password", "Reset monitoring role password only (no other changes)", false).option("--print-sql", "Print SQL plan and exit (no changes applied)", false).option("--print-password", "Print generated monitoring password (DANGEROUS in CI logs)", false).option("--supabase", "Use Supabase Management API instead of direct PostgreSQL connection", false).option("--supabase-access-token <token>", "Supabase Management API access token (or SUPABASE_ACCESS_TOKEN env)").option("--supabase-project-ref <ref>", "Supabase project reference (or SUPABASE_PROJECT_REF env)").option("--json", "Output result as JSON (machine-readable)", false).addHelpText("after", [
+program2.command("prepare-db [conn]").description("prepare database for monitoring: create monitoring user, required view(s), and grant permissions (idempotent)").option("--db-url <url>", "PostgreSQL connection URL (admin) to run the setup against (deprecated; pass it as positional arg)").option("-h, --host <host>", "PostgreSQL host (psql-like)").option("-p, --port <port>", "PostgreSQL port (psql-like)").option("-U, --username <username>", "PostgreSQL user (psql-like)").option("-d, --dbname <dbname>", "PostgreSQL database name (psql-like)").option("--admin-password <password>", "Admin connection password (otherwise uses PGPASSWORD if set)").option("--monitoring-user <name>", "Monitoring role name to create/update", DEFAULT_MONITORING_USER).option("--password <password>", "Monitoring role password (overrides PGAI_MON_PASSWORD)").option("--skip-optional-permissions", "Skip optional permissions (RDS/self-managed extras)", false).option("--provider <provider>", "Database provider (e.g., supabase). Affects which steps are executed.").option("--verify", "Verify that monitoring role/permissions are in place (no changes)", false).option("--reset-password", "Reset monitoring role password only (no other changes)", false).option("--print-sql", "Print SQL plan and exit (no changes applied)", false).option("--print-password", "Print generated monitoring password (DANGEROUS in CI logs)", false).option("--supabase", "Use Supabase Management API instead of direct PostgreSQL connection", false).option("--supabase-access-token <token>", "Supabase Management API access token (or SUPABASE_ACCESS_TOKEN env)").option("--supabase-project-ref <ref>", "Supabase project reference (or SUPABASE_PROJECT_REF env)").option("--json", "Output result as JSON (machine-readable)", false).addHelpText("after", [
   "",
   "Examples:",
   "  postgresai prepare-db postgresql://admin@host:5432/dbname",
@@ -27177,7 +27902,11 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
   "  SUPABASE_ACCESS_TOKEN=... postgresai prepare-db --supabase --supabase-project-ref <ref>",
   "",
   "  Generate a token at: https://supabase.com/dashboard/account/tokens",
-  "  Find your project ref in: https://supabase.com/dashboard/project/<ref>"
+  "  Find your project ref in: https://supabase.com/dashboard/project/<ref>",
+  "",
+  "Provider-specific behavior (for direct connections):",
+  "  --provider supabase    Skip role creation (create user in Supabase dashboard)",
+  "                         Skip ALTER USER (restricted by Supabase)"
 ].join(`
 `)).action(async (conn, opts, cmd) => {
   const jsonOutput = opts.json;
@@ -27216,6 +27945,10 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
   }
   const shouldPrintSql = !!opts.printSql;
   const redactPasswords = (sql) => redactPasswordsInSql(sql);
+  const providerWarning = validateProvider(opts.provider);
+  if (providerWarning) {
+    console.warn(`\u26A0 ${providerWarning}`);
+  }
   if (!conn && !opts.dbUrl && !opts.host && !opts.port && !opts.username && !opts.adminPassword) {
     if (shouldPrintSql) {
       const database = (opts.dbname ?? process.env.PGDATABASE ?? "postgres").trim();
@@ -27225,12 +27958,14 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
         database,
         monitoringUser: opts.monitoringUser,
         monitoringPassword: monPassword,
-        includeOptionalPermissions: includeOptionalPermissions2
+        includeOptionalPermissions: includeOptionalPermissions2,
+        provider: opts.provider
       });
       console.log(`
 --- SQL plan (offline; not connected) ---`);
       console.log(`-- database: ${database}`);
       console.log(`-- monitoring user: ${opts.monitoringUser}`);
+      console.log(`-- provider: ${opts.provider ?? "self-managed"}`);
       console.log(`-- optional permissions: ${includeOptionalPermissions2 ? "enabled" : "skipped"}`);
       for (const step of plan.steps) {
         console.log(`
@@ -27267,6 +28002,10 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
       console.log(`Optional permissions: ${includeOptionalPermissions2 ? "enabled" : "skipped"}`);
     }
     const supabaseClient = new SupabaseClient(supabaseConfig);
+    let databaseUrl = null;
+    if (jsonOutput) {
+      databaseUrl = await fetchPoolerDatabaseUrl(supabaseConfig);
+    }
     try {
       const database = await supabaseClient.getCurrentDatabase();
       if (!database) {
@@ -27284,7 +28023,7 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
         });
         if (v.ok) {
           if (jsonOutput) {
-            outputJson({
+            const result = {
               success: true,
               mode: "supabase",
               action: "verify",
@@ -27292,7 +28031,11 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
               monitoringUser: opts.monitoringUser,
               verified: true,
               missingOptional: v.missingOptional
-            });
+            };
+            if (databaseUrl) {
+              result.databaseUrl = databaseUrl;
+            }
+            outputJson(result);
           } else {
             console.log("\u2713 prepare-db verify: OK");
             if (v.missingOptional.length > 0) {
@@ -27304,7 +28047,7 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
           return;
         }
         if (jsonOutput) {
-          outputJson({
+          const result = {
             success: false,
             mode: "supabase",
             action: "verify",
@@ -27313,7 +28056,11 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
             verified: false,
             missingRequired: v.missingRequired,
             missingOptional: v.missingOptional
-          });
+          };
+          if (databaseUrl) {
+            result.databaseUrl = databaseUrl;
+          }
+          outputJson(result);
         } else {
           console.error("\u2717 prepare-db verify failed: missing required items");
           for (const m of v.missingRequired)
@@ -27408,6 +28155,9 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
         if (passwordGenerated) {
           result.generatedPassword = monPassword;
         }
+        if (databaseUrl) {
+          result.databaseUrl = databaseUrl;
+        }
         outputJson(result);
       } else {
         console.log(opts.resetPassword ? "\u2713 prepare-db password reset completed" : "\u2713 prepare-db completed");
@@ -27550,7 +28300,8 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
         client,
         database,
         monitoringUser: opts.monitoringUser,
-        includeOptionalPermissions
+        includeOptionalPermissions,
+        provider: opts.provider
       });
       if (v.ok) {
         if (jsonOutput) {
@@ -27560,11 +28311,12 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
             action: "verify",
             database,
             monitoringUser: opts.monitoringUser,
+            provider: opts.provider,
             verified: true,
             missingOptional: v.missingOptional
           });
         } else {
-          console.log("\u2713 prepare-db verify: OK");
+          console.log(`\u2713 prepare-db verify: OK${opts.provider ? ` (provider: ${opts.provider})` : ""}`);
           if (v.missingOptional.length > 0) {
             console.log("\u26A0 Optional items missing:");
             for (const m of v.missingOptional)
@@ -27642,9 +28394,15 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
       database,
       monitoringUser: opts.monitoringUser,
       monitoringPassword: monPassword,
-      includeOptionalPermissions
+      includeOptionalPermissions,
+      provider: opts.provider
     });
     const effectivePlan = opts.resetPassword ? { ...plan, steps: plan.steps.filter((s) => s.name === "01.role") } : plan;
+    if (opts.resetPassword && effectivePlan.steps.length === 0) {
+      console.error(`\u2717 --reset-password not supported for provider "${opts.provider}" (role creation is skipped)`);
+      process.exitCode = 1;
+      return;
+    }
     if (shouldPrintSql) {
       console.log(`
 --- SQL plan ---`);
@@ -29131,18 +29889,36 @@ function interpretEscapes2(str2) {
 `).replace(/\\t/g, "\t").replace(/\\r/g, "\r").replace(/\\"/g, '"').replace(/\\'/g, "'").replace(/\x00/g, "\\");
 }
 var issues = program2.command("issues").description("issues management");
-issues.command("list").description("list issues").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (opts) => {
+issues.command("list").description("list issues").option("--status <status>", "filter by status: open, closed, or all (default: all)").option("--limit <n>", "max number of issues to return (default: 20)", parseInt).option("--offset <n>", "number of issues to skip (default: 0)", parseInt).option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (opts) => {
+  const spinner = createTtySpinner(process.stdout.isTTY ?? false, "Fetching issues...");
   try {
     const rootOpts = program2.opts();
     const cfg = readConfig();
     const { apiKey } = getConfig(rootOpts);
     if (!apiKey) {
+      spinner.stop();
       console.error("API key is required. Run 'pgai auth' first or set --api-key.");
       process.exitCode = 1;
       return;
     }
+    const orgId = cfg.orgId ?? undefined;
     const { apiBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
-    const result = await fetchIssues2({ apiKey, apiBaseUrl, debug: !!opts.debug });
+    let statusFilter;
+    if (opts.status === "open") {
+      statusFilter = "open";
+    } else if (opts.status === "closed") {
+      statusFilter = "closed";
+    }
+    const result = await fetchIssues2({
+      apiKey,
+      apiBaseUrl,
+      orgId,
+      status: statusFilter,
+      limit: opts.limit,
+      offset: opts.offset,
+      debug: !!opts.debug
+    });
+    spinner.stop();
     const trimmed = Array.isArray(result) ? result.map((r) => ({
       id: r.id,
       title: r.title,
@@ -29151,17 +29927,20 @@ issues.command("list").description("list issues").option("--debug", "enable debu
     })) : result;
     printResult(trimmed, opts.json);
   } catch (err) {
+    spinner.stop();
     const message = err instanceof Error ? err.message : String(err);
     console.error(message);
     process.exitCode = 1;
   }
 });
 issues.command("view <issueId>").description("view issue details and comments").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (issueId, opts) => {
+  const spinner = createTtySpinner(process.stdout.isTTY ?? false, "Fetching issue...");
   try {
     const rootOpts = program2.opts();
     const cfg = readConfig();
     const { apiKey } = getConfig(rootOpts);
     if (!apiKey) {
+      spinner.stop();
       console.error("API key is required. Run 'pgai auth' first or set --api-key.");
       process.exitCode = 1;
       return;
@@ -29169,32 +29948,38 @@ issues.command("view <issueId>").description("view issue details and comments").
     const { apiBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
     const issue2 = await fetchIssue2({ apiKey, apiBaseUrl, issueId, debug: !!opts.debug });
     if (!issue2) {
+      spinner.stop();
       console.error("Issue not found");
       process.exitCode = 1;
       return;
     }
+    spinner.update("Fetching comments...");
     const comments = await fetchIssueComments2({ apiKey, apiBaseUrl, issueId, debug: !!opts.debug });
+    spinner.stop();
     const combined = { issue: issue2, comments };
     printResult(combined, opts.json);
   } catch (err) {
+    spinner.stop();
     const message = err instanceof Error ? err.message : String(err);
     console.error(message);
     process.exitCode = 1;
   }
 });
 issues.command("post-comment <issueId> <content>").description("post a new comment to an issue").option("--parent <uuid>", "parent comment id").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (issueId, content, opts) => {
+  if (opts.debug) {
+    console.log(`Debug: Original content: ${JSON.stringify(content)}`);
+  }
+  content = interpretEscapes2(content);
+  if (opts.debug) {
+    console.log(`Debug: Interpreted content: ${JSON.stringify(content)}`);
+  }
+  const spinner = createTtySpinner(process.stdout.isTTY ?? false, "Posting comment...");
   try {
-    if (opts.debug) {
-      console.log(`Debug: Original content: ${JSON.stringify(content)}`);
-    }
-    content = interpretEscapes2(content);
-    if (opts.debug) {
-      console.log(`Debug: Interpreted content: ${JSON.stringify(content)}`);
-    }
     const rootOpts = program2.opts();
     const cfg = readConfig();
     const { apiKey } = getConfig(rootOpts);
     if (!apiKey) {
+      spinner.stop();
       console.error("API key is required. Run 'pgai auth' first or set --api-key.");
       process.exitCode = 1;
       return;
@@ -29208,41 +29993,44 @@ issues.command("post-comment <issueId> <content>").description("post a new comme
       parentCommentId: opts.parent,
       debug: !!opts.debug
     });
+    spinner.stop();
     printResult(result, opts.json);
   } catch (err) {
+    spinner.stop();
     const message = err instanceof Error ? err.message : String(err);
     console.error(message);
     process.exitCode = 1;
   }
 });
-issues.command("create <title>").description("create a new issue").option("--org-id <id>", "organization id (defaults to config orgId)", (v) => parseInt(v, 10)).option("--project-id <id>", "project id", (v) => parseInt(v, 10)).option("--description <text>", "issue description (supports \\\\n)").option("--label <label>", "issue label (repeatable)", (value, previous) => {
+issues.command("create <title>").description("create a new issue").option("--org-id <id>", "organization id (defaults to config orgId)", (v) => parseInt(v, 10)).option("--project-id <id>", "project id", (v) => parseInt(v, 10)).option("--description <text>", "issue description (use \\n for newlines)").option("--label <label>", "issue label (repeatable)", (value, previous) => {
   previous.push(value);
   return previous;
 }, []).option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (rawTitle, opts) => {
+  const rootOpts = program2.opts();
+  const cfg = readConfig();
+  const { apiKey } = getConfig(rootOpts);
+  if (!apiKey) {
+    console.error("API key is required. Run 'pgai auth' first or set --api-key.");
+    process.exitCode = 1;
+    return;
+  }
+  const title = interpretEscapes2(String(rawTitle || "").trim());
+  if (!title) {
+    console.error("title is required");
+    process.exitCode = 1;
+    return;
+  }
+  const orgId = typeof opts.orgId === "number" && !Number.isNaN(opts.orgId) ? opts.orgId : cfg.orgId;
+  if (typeof orgId !== "number") {
+    console.error("org_id is required. Either pass --org-id or run 'pgai auth' to store it in config.");
+    process.exitCode = 1;
+    return;
+  }
+  const description = opts.description !== undefined ? interpretEscapes2(String(opts.description)) : undefined;
+  const labels = Array.isArray(opts.label) && opts.label.length > 0 ? opts.label.map(String) : undefined;
+  const projectId = typeof opts.projectId === "number" && !Number.isNaN(opts.projectId) ? opts.projectId : undefined;
+  const spinner = createTtySpinner(process.stdout.isTTY ?? false, "Creating issue...");
   try {
-    const rootOpts = program2.opts();
-    const cfg = readConfig();
-    const { apiKey } = getConfig(rootOpts);
-    if (!apiKey) {
-      console.error("API key is required. Run 'pgai auth' first or set --api-key.");
-      process.exitCode = 1;
-      return;
-    }
-    const title = interpretEscapes2(String(rawTitle || "").trim());
-    if (!title) {
-      console.error("title is required");
-      process.exitCode = 1;
-      return;
-    }
-    const orgId = typeof opts.orgId === "number" && !Number.isNaN(opts.orgId) ? opts.orgId : cfg.orgId;
-    if (typeof orgId !== "number") {
-      console.error("org_id is required. Either pass --org-id or run 'pgai auth' to store it in config.");
-      process.exitCode = 1;
-      return;
-    }
-    const description = opts.description !== undefined ? interpretEscapes2(String(opts.description)) : undefined;
-    const labels = Array.isArray(opts.label) && opts.label.length > 0 ? opts.label.map(String) : undefined;
-    const projectId = typeof opts.projectId === "number" && !Number.isNaN(opts.projectId) ? opts.projectId : undefined;
     const { apiBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
     const result = await createIssue2({
       apiKey,
@@ -29254,57 +30042,60 @@ issues.command("create <title>").description("create a new issue").option("--org
       labels,
       debug: !!opts.debug
     });
+    spinner.stop();
     printResult(result, opts.json);
   } catch (err) {
+    spinner.stop();
     const message = err instanceof Error ? err.message : String(err);
     console.error(message);
     process.exitCode = 1;
   }
 });
-issues.command("update <issueId>").description("update an existing issue (title/description/status/labels)").option("--title <text>", "new title (supports \\\\n)").option("--description <text>", "new description (supports \\\\n)").option("--status <value>", "status: open|closed|0|1").option("--label <label>", "set labels (repeatable). If provided, replaces existing labels.", (value, previous) => {
+issues.command("update <issueId>").description("update an existing issue (title/description/status/labels)").option("--title <text>", "new title (use \\n for newlines)").option("--description <text>", "new description (use \\n for newlines)").option("--status <value>", "status: open|closed|0|1").option("--label <label>", "set labels (repeatable). If provided, replaces existing labels.", (value, previous) => {
   previous.push(value);
   return previous;
 }, []).option("--clear-labels", "set labels to an empty list").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (issueId, opts) => {
-  try {
-    const rootOpts = program2.opts();
-    const cfg = readConfig();
-    const { apiKey } = getConfig(rootOpts);
-    if (!apiKey) {
-      console.error("API key is required. Run 'pgai auth' first or set --api-key.");
-      process.exitCode = 1;
-      return;
-    }
-    const { apiBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
-    const title = opts.title !== undefined ? interpretEscapes2(String(opts.title)) : undefined;
-    const description = opts.description !== undefined ? interpretEscapes2(String(opts.description)) : undefined;
-    let status = undefined;
-    if (opts.status !== undefined) {
-      const raw = String(opts.status).trim().toLowerCase();
-      if (raw === "open")
-        status = 0;
-      else if (raw === "closed")
-        status = 1;
-      else {
-        const n = Number(raw);
-        if (!Number.isFinite(n)) {
-          console.error("status must be open|closed|0|1");
-          process.exitCode = 1;
-          return;
-        }
-        status = n;
-      }
-      if (status !== 0 && status !== 1) {
-        console.error("status must be 0 (open) or 1 (closed)");
+  const rootOpts = program2.opts();
+  const cfg = readConfig();
+  const { apiKey } = getConfig(rootOpts);
+  if (!apiKey) {
+    console.error("API key is required. Run 'pgai auth' first or set --api-key.");
+    process.exitCode = 1;
+    return;
+  }
+  const { apiBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
+  const title = opts.title !== undefined ? interpretEscapes2(String(opts.title)) : undefined;
+  const description = opts.description !== undefined ? interpretEscapes2(String(opts.description)) : undefined;
+  let status = undefined;
+  if (opts.status !== undefined) {
+    const raw = String(opts.status).trim().toLowerCase();
+    if (raw === "open")
+      status = 0;
+    else if (raw === "closed")
+      status = 1;
+    else {
+      const n = Number(raw);
+      if (!Number.isFinite(n)) {
+        console.error("status must be open|closed|0|1");
         process.exitCode = 1;
         return;
       }
+      status = n;
     }
-    let labels = undefined;
-    if (opts.clearLabels) {
-      labels = [];
-    } else if (Array.isArray(opts.label) && opts.label.length > 0) {
-      labels = opts.label.map(String);
+    if (status !== 0 && status !== 1) {
+      console.error("status must be 0 (open) or 1 (closed)");
+      process.exitCode = 1;
+      return;
     }
+  }
+  let labels = undefined;
+  if (opts.clearLabels) {
+    labels = [];
+  } else if (Array.isArray(opts.label) && opts.label.length > 0) {
+    labels = opts.label.map(String);
+  }
+  const spinner = createTtySpinner(process.stdout.isTTY ?? false, "Updating issue...");
+  try {
     const result = await updateIssue2({
       apiKey,
       apiBaseUrl,
@@ -29315,40 +30106,217 @@ issues.command("update <issueId>").description("update an existing issue (title/
       labels,
       debug: !!opts.debug
     });
+    spinner.stop();
     printResult(result, opts.json);
   } catch (err) {
+    spinner.stop();
     const message = err instanceof Error ? err.message : String(err);
     console.error(message);
     process.exitCode = 1;
   }
 });
 issues.command("update-comment <commentId> <content>").description("update an existing issue comment").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (commentId, content, opts) => {
+  if (opts.debug) {
+    console.log(`Debug: Original content: ${JSON.stringify(content)}`);
+  }
+  content = interpretEscapes2(content);
+  if (opts.debug) {
+    console.log(`Debug: Interpreted content: ${JSON.stringify(content)}`);
+  }
+  const rootOpts = program2.opts();
+  const cfg = readConfig();
+  const { apiKey } = getConfig(rootOpts);
+  if (!apiKey) {
+    console.error("API key is required. Run 'pgai auth' first or set --api-key.");
+    process.exitCode = 1;
+    return;
+  }
+  const spinner = createTtySpinner(process.stdout.isTTY ?? false, "Updating comment...");
   try {
-    if (opts.debug) {
-      console.log(`Debug: Original content: ${JSON.stringify(content)}`);
-    }
-    content = interpretEscapes2(content);
-    if (opts.debug) {
-      console.log(`Debug: Interpreted content: ${JSON.stringify(content)}`);
+    const { apiBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
+    const result = await updateIssueComment2({
+      apiKey,
+      apiBaseUrl,
+      commentId,
+      content,
+      debug: !!opts.debug
+    });
+    spinner.stop();
+    printResult(result, opts.json);
+  } catch (err) {
+    spinner.stop();
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(message);
+    process.exitCode = 1;
+  }
+});
+issues.command("action-items <issueId>").description("list action items for an issue").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (issueId, opts) => {
+  const spinner = createTtySpinner(process.stdout.isTTY ?? false, "Fetching action items...");
+  try {
+    const rootOpts = program2.opts();
+    const cfg = readConfig();
+    const { apiKey } = getConfig(rootOpts);
+    if (!apiKey) {
+      spinner.stop();
+      console.error("API key is required. Run 'pgai auth' first or set --api-key.");
+      process.exitCode = 1;
+      return;
     }
+    const { apiBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
+    const result = await fetchActionItems2({ apiKey, apiBaseUrl, issueId, debug: !!opts.debug });
+    spinner.stop();
+    printResult(result, opts.json);
+  } catch (err) {
+    spinner.stop();
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(message);
+    process.exitCode = 1;
+  }
+});
+issues.command("view-action-item <actionItemIds...>").description("view action item(s) with all details (supports multiple IDs)").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (actionItemIds, opts) => {
+  const spinner = createTtySpinner(process.stdout.isTTY ?? false, "Fetching action item(s)...");
+  try {
     const rootOpts = program2.opts();
     const cfg = readConfig();
     const { apiKey } = getConfig(rootOpts);
     if (!apiKey) {
+      spinner.stop();
       console.error("API key is required. Run 'pgai auth' first or set --api-key.");
       process.exitCode = 1;
       return;
     }
     const { apiBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
-    const result = await updateIssueComment2({
+    const result = await fetchActionItem2({ apiKey, apiBaseUrl, actionItemIds, debug: !!opts.debug });
+    if (result.length === 0) {
+      spinner.stop();
+      console.error("Action item(s) not found");
+      process.exitCode = 1;
+      return;
+    }
+    spinner.stop();
+    printResult(result, opts.json);
+  } catch (err) {
+    spinner.stop();
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(message);
+    process.exitCode = 1;
+  }
+});
+issues.command("create-action-item <issueId> <title>").description("create a new action item for an issue").option("--description <text>", "detailed description (use \\n for newlines)").option("--sql-action <sql>", "SQL command to execute").option("--config <json>", 'config change as JSON: {"parameter":"...","value":"..."} (repeatable)', (value, previous) => {
+  try {
+    previous.push(JSON.parse(value));
+  } catch {
+    console.error(`Invalid JSON for --config: ${value}`);
+    process.exit(1);
+  }
+  return previous;
+}, []).option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (issueId, rawTitle, opts) => {
+  const rootOpts = program2.opts();
+  const cfg = readConfig();
+  const { apiKey } = getConfig(rootOpts);
+  if (!apiKey) {
+    console.error("API key is required. Run 'pgai auth' first or set --api-key.");
+    process.exitCode = 1;
+    return;
+  }
+  const title = interpretEscapes2(String(rawTitle || "").trim());
+  if (!title) {
+    console.error("title is required");
+    process.exitCode = 1;
+    return;
+  }
+  const description = opts.description !== undefined ? interpretEscapes2(String(opts.description)) : undefined;
+  const sqlAction = opts.sqlAction;
+  const configs = Array.isArray(opts.config) && opts.config.length > 0 ? opts.config : undefined;
+  const spinner = createTtySpinner(process.stdout.isTTY ?? false, "Creating action item...");
+  try {
+    const { apiBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
+    const result = await createActionItem2({
       apiKey,
       apiBaseUrl,
-      commentId,
-      content,
+      issueId,
+      title,
+      description,
+      sqlAction,
+      configs,
       debug: !!opts.debug
     });
-    printResult(result, opts.json);
+    spinner.stop();
+    printResult({ id: result }, opts.json);
+  } catch (err) {
+    spinner.stop();
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(message);
+    process.exitCode = 1;
+  }
+});
+issues.command("update-action-item <actionItemId>").description("update an action item (title, description, status, sql_action, configs)").option("--title <text>", "new title (use \\n for newlines)").option("--description <text>", "new description (use \\n for newlines)").option("--done", "mark as done").option("--not-done", "mark as not done").option("--status <value>", "status: waiting_for_approval|approved|rejected").option("--status-reason <text>", "reason for status change").option("--sql-action <sql>", "SQL command (use empty string to clear)").option("--config <json>", "config change as JSON (repeatable, replaces all configs)", (value, previous) => {
+  try {
+    previous.push(JSON.parse(value));
+  } catch {
+    console.error(`Invalid JSON for --config: ${value}`);
+    process.exit(1);
+  }
+  return previous;
+}, []).option("--clear-configs", "clear all config changes").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (actionItemId, opts) => {
+  const rootOpts = program2.opts();
+  const cfg = readConfig();
+  const { apiKey } = getConfig(rootOpts);
+  if (!apiKey) {
+    console.error("API key is required. Run 'pgai auth' first or set --api-key.");
+    process.exitCode = 1;
+    return;
+  }
+  const title = opts.title !== undefined ? interpretEscapes2(String(opts.title)) : undefined;
+  const description = opts.description !== undefined ? interpretEscapes2(String(opts.description)) : undefined;
+  let isDone = undefined;
+  if (opts.done)
+    isDone = true;
+  else if (opts.notDone)
+    isDone = false;
+  let status = undefined;
+  if (opts.status !== undefined) {
+    const validStatuses = ["waiting_for_approval", "approved", "rejected"];
+    if (!validStatuses.includes(opts.status)) {
+      console.error(`status must be one of: ${validStatuses.join(", ")}`);
+      process.exitCode = 1;
+      return;
+    }
+    status = opts.status;
+  }
+  const statusReason = opts.statusReason;
+  const sqlAction = opts.sqlAction;
+  let configs = undefined;
+  if (opts.clearConfigs) {
+    configs = [];
+  } else if (Array.isArray(opts.config) && opts.config.length > 0) {
+    configs = opts.config;
+  }
+  if (title === undefined && description === undefined && isDone === undefined && status === undefined && statusReason === undefined && sqlAction === undefined && configs === undefined) {
+    console.error("At least one update option is required");
+    process.exitCode = 1;
+    return;
+  }
+  const spinner = createTtySpinner(process.stdout.isTTY ?? false, "Updating action item...");
+  try {
+    const { apiBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
+    await updateActionItem2({
+      apiKey,
+      apiBaseUrl,
+      actionItemId,
+      title,
+      description,
+      isDone,
+      status,
+      statusReason,
+      sqlAction,
+      configs,
+      debug: !!opts.debug
+    });
+    spinner.stop();
+    printResult({ success: true }, opts.json);
   } catch (err) {
+    spinner.stop();
     const message = err instanceof Error ? err.message : String(err);
     console.error(message);
     process.exitCode = 1;