postgresai 0.15.0-dev.1 → 0.15.0-dev.10

package/dist/bin/postgres-ai.js

@@ -6,27 +6,46 @@ var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
 var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
   for (let key of __getOwnPropNames(mod))
     if (!__hasOwnProp.call(to, key))
       __defProp(to, key, {
-        get: () => mod[key],
+        get: __accessProp.bind(mod, key),
         enumerable: true
       });
+  if (canCache)
+    cache.set(mod, to);
   return to;
 };
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, {
       get: all[name],
       enumerable: true,
       configurable: true,
-      set: (newValue) => all[name] = () => newValue
+      set: __exportSetter.bind(all, name)
     });
 };
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // node_modules/commander/lib/error.js
@@ -79,7 +98,7 @@ var require_argument = __commonJS((exports) => {
           this._name = name;
           break;
       }
-      if (this._name.length > 3 && this._name.slice(-3) === "...") {
+      if (this._name.endsWith("...")) {
         this.variadic = true;
         this._name = this._name.slice(0, -3);
       }
@@ -87,11 +106,12 @@ var require_argument = __commonJS((exports) => {
     name() {
       return this._name;
     }
-    _concatValue(value, previous) {
+    _collectValue(value, previous) {
       if (previous === this.defaultValue || !Array.isArray(previous)) {
         return [value];
       }
-      return previous.concat(value);
+      previous.push(value);
+      return previous;
     }
     default(value, description) {
       this.defaultValue = value;
@@ -109,7 +129,7 @@ var require_argument = __commonJS((exports) => {
           throw new InvalidArgumentError(`Allowed choices are ${this.argChoices.join(", ")}.`);
         }
         if (this.variadic) {
-          return this._concatValue(arg, previous);
+          return this._collectValue(arg, previous);
         }
         return arg;
       };
@@ -139,10 +159,14 @@ var require_help = __commonJS((exports) => {
   class Help {
     constructor() {
       this.helpWidth = undefined;
+      this.minWidthToWrap = 40;
       this.sortSubcommands = false;
       this.sortOptions = false;
       this.showGlobalOptions = false;
     }
+    prepareContext(contextOptions) {
+      this.helpWidth = this.helpWidth ?? contextOptions.helpWidth ?? 80;
+    }
     visibleCommands(cmd) {
       const visibleCommands = cmd.commands.filter((cmd2) => !cmd2._hidden);
       const helpCommand = cmd._getHelpCommand();
@@ -217,22 +241,22 @@ var require_help = __commonJS((exports) => {
     }
     longestSubcommandTermLength(cmd, helper) {
       return helper.visibleCommands(cmd).reduce((max, command) => {
-        return Math.max(max, helper.subcommandTerm(command).length);
+        return Math.max(max, this.displayWidth(helper.styleSubcommandTerm(helper.subcommandTerm(command))));
       }, 0);
     }
     longestOptionTermLength(cmd, helper) {
       return helper.visibleOptions(cmd).reduce((max, option) => {
-        return Math.max(max, helper.optionTerm(option).length);
+        return Math.max(max, this.displayWidth(helper.styleOptionTerm(helper.optionTerm(option))));
       }, 0);
     }
     longestGlobalOptionTermLength(cmd, helper) {
       return helper.visibleGlobalOptions(cmd).reduce((max, option) => {
-        return Math.max(max, helper.optionTerm(option).length);
+        return Math.max(max, this.displayWidth(helper.styleOptionTerm(helper.optionTerm(option))));
       }, 0);
     }
     longestArgumentTermLength(cmd, helper) {
       return helper.visibleArguments(cmd).reduce((max, argument) => {
-        return Math.max(max, helper.argumentTerm(argument).length);
+        return Math.max(max, this.displayWidth(helper.styleArgumentTerm(helper.argumentTerm(argument))));
       }, 0);
     }
     commandUsage(cmd) {
@@ -270,7 +294,11 @@ var require_help = __commonJS((exports) => {
         extraInfo.push(`env: ${option.envVar}`);
       }
       if (extraInfo.length > 0) {
-        return `${option.description} (${extraInfo.join(", ")})`;
+        const extraDescription = `(${extraInfo.join(", ")})`;
+        if (option.description) {
+          return `${option.description} ${extraDescription}`;
+        }
+        return extraDescription;
       }
       return option.description;
     }
@@ -283,102 +311,202 @@ var require_help = __commonJS((exports) => {
         extraInfo.push(`default: ${argument.defaultValueDescription || JSON.stringify(argument.defaultValue)}`);
       }
       if (extraInfo.length > 0) {
-        const extraDescripton = `(${extraInfo.join(", ")})`;
+        const extraDescription = `(${extraInfo.join(", ")})`;
         if (argument.description) {
-          return `${argument.description} ${extraDescripton}`;
+          return `${argument.description} ${extraDescription}`;
         }
-        return extraDescripton;
+        return extraDescription;
       }
       return argument.description;
     }
+    formatItemList(heading, items, helper) {
+      if (items.length === 0)
+        return [];
+      return [helper.styleTitle(heading), ...items, ""];
+    }
+    groupItems(unsortedItems, visibleItems, getGroup) {
+      const result = new Map;
+      unsortedItems.forEach((item) => {
+        const group = getGroup(item);
+        if (!result.has(group))
+          result.set(group, []);
+      });
+      visibleItems.forEach((item) => {
+        const group = getGroup(item);
+        if (!result.has(group)) {
+          result.set(group, []);
+        }
+        result.get(group).push(item);
+      });
+      return result;
+    }
     formatHelp(cmd, helper) {
       const termWidth = helper.padWidth(cmd, helper);
-      const helpWidth = helper.helpWidth || 80;
-      const itemIndentWidth = 2;
-      const itemSeparatorWidth = 2;
-      function formatItem(term, description) {
-        if (description) {
-          const fullText = `${term.padEnd(termWidth + itemSeparatorWidth)}${description}`;
-          return helper.wrap(fullText, helpWidth - itemIndentWidth, termWidth + itemSeparatorWidth);
-        }
-        return term;
+      const helpWidth = helper.helpWidth ?? 80;
+      function callFormatItem(term, description) {
+        return helper.formatItem(term, termWidth, description, helper);
       }
-      function formatList(textArray) {
-        return textArray.join(`
-`).replace(/^/gm, " ".repeat(itemIndentWidth));
-      }
-      let output = [`Usage: ${helper.commandUsage(cmd)}`, ""];
+      let output = [
+        `${helper.styleTitle("Usage:")} ${helper.styleUsage(helper.commandUsage(cmd))}`,
+        ""
+      ];
       const commandDescription = helper.commandDescription(cmd);
       if (commandDescription.length > 0) {
         output = output.concat([
-          helper.wrap(commandDescription, helpWidth, 0),
+          helper.boxWrap(helper.styleCommandDescription(commandDescription), helpWidth),
           ""
         ]);
       }
       const argumentList = helper.visibleArguments(cmd).map((argument) => {
-        return formatItem(helper.argumentTerm(argument), helper.argumentDescription(argument));
+        return callFormatItem(helper.styleArgumentTerm(helper.argumentTerm(argument)), helper.styleArgumentDescription(helper.argumentDescription(argument)));
       });
-      if (argumentList.length > 0) {
-        output = output.concat(["Arguments:", formatList(argumentList), ""]);
-      }
-      const optionList = helper.visibleOptions(cmd).map((option) => {
-        return formatItem(helper.optionTerm(option), helper.optionDescription(option));
+      output = output.concat(this.formatItemList("Arguments:", argumentList, helper));
+      const optionGroups = this.groupItems(cmd.options, helper.visibleOptions(cmd), (option) => option.helpGroupHeading ?? "Options:");
+      optionGroups.forEach((options, group) => {
+        const optionList = options.map((option) => {
+          return callFormatItem(helper.styleOptionTerm(helper.optionTerm(option)), helper.styleOptionDescription(helper.optionDescription(option)));
+        });
+        output = output.concat(this.formatItemList(group, optionList, helper));
       });
-      if (optionList.length > 0) {
-        output = output.concat(["Options:", formatList(optionList), ""]);
-      }
-      if (this.showGlobalOptions) {
+      if (helper.showGlobalOptions) {
         const globalOptionList = helper.visibleGlobalOptions(cmd).map((option) => {
-          return formatItem(helper.optionTerm(option), helper.optionDescription(option));
+          return callFormatItem(helper.styleOptionTerm(helper.optionTerm(option)), helper.styleOptionDescription(helper.optionDescription(option)));
         });
-        if (globalOptionList.length > 0) {
-          output = output.concat([
-            "Global Options:",
-            formatList(globalOptionList),
-            ""
-          ]);
-        }
+        output = output.concat(this.formatItemList("Global Options:", globalOptionList, helper));
       }
-      const commandList = helper.visibleCommands(cmd).map((cmd2) => {
-        return formatItem(helper.subcommandTerm(cmd2), helper.subcommandDescription(cmd2));
+      const commandGroups = this.groupItems(cmd.commands, helper.visibleCommands(cmd), (sub) => sub.helpGroup() || "Commands:");
+      commandGroups.forEach((commands, group) => {
+        const commandList = commands.map((sub) => {
+          return callFormatItem(helper.styleSubcommandTerm(helper.subcommandTerm(sub)), helper.styleSubcommandDescription(helper.subcommandDescription(sub)));
+        });
+        output = output.concat(this.formatItemList(group, commandList, helper));
       });
-      if (commandList.length > 0) {
-        output = output.concat(["Commands:", formatList(commandList), ""]);
-      }
       return output.join(`
 `);
     }
+    displayWidth(str) {
+      return stripColor(str).length;
+    }
+    styleTitle(str) {
+      return str;
+    }
+    styleUsage(str) {
+      return str.split(" ").map((word) => {
+        if (word === "[options]")
+          return this.styleOptionText(word);
+        if (word === "[command]")
+          return this.styleSubcommandText(word);
+        if (word[0] === "[" || word[0] === "<")
+          return this.styleArgumentText(word);
+        return this.styleCommandText(word);
+      }).join(" ");
+    }
+    styleCommandDescription(str) {
+      return this.styleDescriptionText(str);
+    }
+    styleOptionDescription(str) {
+      return this.styleDescriptionText(str);
+    }
+    styleSubcommandDescription(str) {
+      return this.styleDescriptionText(str);
+    }
+    styleArgumentDescription(str) {
+      return this.styleDescriptionText(str);
+    }
+    styleDescriptionText(str) {
+      return str;
+    }
+    styleOptionTerm(str) {
+      return this.styleOptionText(str);
+    }
+    styleSubcommandTerm(str) {
+      return str.split(" ").map((word) => {
+        if (word === "[options]")
+          return this.styleOptionText(word);
+        if (word[0] === "[" || word[0] === "<")
+          return this.styleArgumentText(word);
+        return this.styleSubcommandText(word);
+      }).join(" ");
+    }
+    styleArgumentTerm(str) {
+      return this.styleArgumentText(str);
+    }
+    styleOptionText(str) {
+      return str;
+    }
+    styleArgumentText(str) {
+      return str;
+    }
+    styleSubcommandText(str) {
+      return str;
+    }
+    styleCommandText(str) {
+      return str;
+    }
     padWidth(cmd, helper) {
       return Math.max(helper.longestOptionTermLength(cmd, helper), helper.longestGlobalOptionTermLength(cmd, helper), helper.longestSubcommandTermLength(cmd, helper), helper.longestArgumentTermLength(cmd, helper));
     }
-    wrap(str, width, indent, minColumnWidth = 40) {
-      const indents = " \\f\\t\\v   -   　\uFEFF";
-      const manualIndent = new RegExp(`[\\n][${indents}]+`);
-      if (str.match(manualIndent))
-        return str;
-      const columnWidth = width - indent;
-      if (columnWidth < minColumnWidth)
+    preformatted(str) {
+      return /\n[^\S\r\n]/.test(str);
+    }
+    formatItem(term, termWidth, description, helper) {
+      const itemIndent = 2;
+      const itemIndentStr = " ".repeat(itemIndent);
+      if (!description)
+        return itemIndentStr + term;
+      const paddedTerm = term.padEnd(termWidth + term.length - helper.displayWidth(term));
+      const spacerWidth = 2;
+      const helpWidth = this.helpWidth ?? 80;
+      const remainingWidth = helpWidth - termWidth - spacerWidth - itemIndent;
+      let formattedDescription;
+      if (remainingWidth < this.minWidthToWrap || helper.preformatted(description)) {
+        formattedDescription = description;
+      } else {
+        const wrappedDescription = helper.boxWrap(description, remainingWidth);
+        formattedDescription = wrappedDescription.replace(/\n/g, `
+` + " ".repeat(termWidth + spacerWidth));
+      }
+      return itemIndentStr + paddedTerm + " ".repeat(spacerWidth) + formattedDescription.replace(/\n/g, `
+${itemIndentStr}`);
+    }
+    boxWrap(str, width) {
+      if (width < this.minWidthToWrap)
         return str;
-      const leadingStr = str.slice(0, indent);
-      const columnText = str.slice(indent).replace(`\r
-`, `
-`);
-      const indentString = " ".repeat(indent);
-      const zeroWidthSpace = "​";
-      const breaks = `\\s${zeroWidthSpace}`;
-      const regex = new RegExp(`
-|.{1,${columnWidth - 1}}([${breaks}]|$)|[^${breaks}]+?([${breaks}]|$)`, "g");
-      const lines = columnText.match(regex) || [];
-      return leadingStr + lines.map((line, i) => {
-        if (line === `
-`)
-          return "";
-        return (i > 0 ? indentString : "") + line.trimEnd();
-      }).join(`
+      const rawLines = str.split(/\r\n|\n/);
+      const chunkPattern = /[\s]*[^\s]+/g;
+      const wrappedLines = [];
+      rawLines.forEach((line) => {
+        const chunks = line.match(chunkPattern);
+        if (chunks === null) {
+          wrappedLines.push("");
+          return;
+        }
+        let sumChunks = [chunks.shift()];
+        let sumWidth = this.displayWidth(sumChunks[0]);
+        chunks.forEach((chunk) => {
+          const visibleWidth = this.displayWidth(chunk);
+          if (sumWidth + visibleWidth <= width) {
+            sumChunks.push(chunk);
+            sumWidth += visibleWidth;
+            return;
+          }
+          wrappedLines.push(sumChunks.join(""));
+          const nextChunk = chunk.trimStart();
+          sumChunks = [nextChunk];
+          sumWidth = this.displayWidth(nextChunk);
+        });
+        wrappedLines.push(sumChunks.join(""));
+      });
+      return wrappedLines.join(`
 `);
     }
   }
+  function stripColor(str) {
+    const sgrPattern = /\x1b\[\d*(;\d*)*m/g;
+    return str.replace(sgrPattern, "");
+  }
   exports.Help = Help;
+  exports.stripColor = stripColor;
 });
 
 // node_modules/commander/lib/option.js
@@ -409,6 +537,7 @@ var require_option = __commonJS((exports) => {
       this.argChoices = undefined;
       this.conflictsWith = [];
       this.implied = undefined;
+      this.helpGroupHeading = undefined;
     }
     default(value, description) {
       this.defaultValue = value;
@@ -447,11 +576,12 @@ var require_option = __commonJS((exports) => {
       this.hidden = !!hide;
       return this;
     }
-    _concatValue(value, previous) {
+    _collectValue(value, previous) {
       if (previous === this.defaultValue || !Array.isArray(previous)) {
         return [value];
       }
-      return previous.concat(value);
+      previous.push(value);
+      return previous;
     }
     choices(values) {
       this.argChoices = values.slice();
@@ -460,7 +590,7 @@ var require_option = __commonJS((exports) => {
           throw new InvalidArgumentError(`Allowed choices are ${this.argChoices.join(", ")}.`);
         }
         if (this.variadic) {
-          return this._concatValue(arg, previous);
+          return this._collectValue(arg, previous);
         }
         return arg;
       };
@@ -473,7 +603,14 @@ var require_option = __commonJS((exports) => {
       return this.short.replace(/^-/, "");
     }
     attributeName() {
-      return camelcase(this.name().replace(/^no-/, ""));
+      if (this.negate) {
+        return camelcase(this.name().replace(/^no-/, ""));
+      }
+      return camelcase(this.name());
+    }
+    helpGroup(heading) {
+      this.helpGroupHeading = heading;
+      return this;
     }
     is(arg) {
       return this.short === arg || this.long === arg;
@@ -518,14 +655,38 @@ var require_option = __commonJS((exports) => {
   function splitOptionFlags(flags) {
     let shortFlag;
     let longFlag;
-    const flagParts = flags.split(/[ |,]+/);
-    if (flagParts.length > 1 && !/^[[<]/.test(flagParts[1]))
+    const shortFlagExp = /^-[^-]$/;
+    const longFlagExp = /^--[^-]/;
+    const flagParts = flags.split(/[ |,]+/).concat("guard");
+    if (shortFlagExp.test(flagParts[0]))
+      shortFlag = flagParts.shift();
+    if (longFlagExp.test(flagParts[0]))
+      longFlag = flagParts.shift();
+    if (!shortFlag && shortFlagExp.test(flagParts[0]))
       shortFlag = flagParts.shift();
-    longFlag = flagParts.shift();
-    if (!shortFlag && /^-[^-]$/.test(longFlag)) {
+    if (!shortFlag && longFlagExp.test(flagParts[0])) {
       shortFlag = longFlag;
-      longFlag = undefined;
-    }
+      longFlag = flagParts.shift();
+    }
+    if (flagParts[0].startsWith("-")) {
+      const unsupportedFlag = flagParts[0];
+      const baseError = `option creation failed due to '${unsupportedFlag}' in option flags '${flags}'`;
+      if (/^-[^-][^-]/.test(unsupportedFlag))
+        throw new Error(`${baseError}
+- a short flag is a single dash and a single character
+  - either use a single dash and a single character (for a short flag)
+  - or use a double dash for a long option (and can have two, like '--ws, --workspace')`);
+      if (shortFlagExp.test(unsupportedFlag))
+        throw new Error(`${baseError}
+- too many short flags`);
+      if (longFlagExp.test(unsupportedFlag))
+        throw new Error(`${baseError}
+- too many long flags`);
+      throw new Error(`${baseError}
+- unrecognised flag format`);
+    }
+    if (shortFlag === undefined && longFlag === undefined)
+      throw new Error(`option creation failed due to no flags found in '${flags}'.`);
     return { shortFlag, longFlag };
   }
   exports.Option = Option;
@@ -614,7 +775,7 @@ var require_command = __commonJS((exports) => {
   var process2 = __require("node:process");
   var { Argument, humanReadableArgName } = require_argument();
   var { CommanderError } = require_error();
-  var { Help } = require_help();
+  var { Help, stripColor } = require_help();
   var { Option, DualOptions } = require_option();
   var { suggestSimilar } = require_suggestSimilar();
 
@@ -625,7 +786,7 @@ var require_command = __commonJS((exports) => {
       this.options = [];
       this.parent = null;
       this._allowUnknownOption = false;
-      this._allowExcessArguments = true;
+      this._allowExcessArguments = false;
       this.registeredArguments = [];
       this._args = this.registeredArguments;
       this.args = [];
@@ -652,18 +813,25 @@ var require_command = __commonJS((exports) => {
       this._lifeCycleHooks = {};
       this._showHelpAfterError = false;
       this._showSuggestionAfterError = true;
+      this._savedState = null;
       this._outputConfiguration = {
         writeOut: (str) => process2.stdout.write(str),
         writeErr: (str) => process2.stderr.write(str),
+        outputError: (str, write) => write(str),
         getOutHelpWidth: () => process2.stdout.isTTY ? process2.stdout.columns : undefined,
         getErrHelpWidth: () => process2.stderr.isTTY ? process2.stderr.columns : undefined,
-        outputError: (str, write) => write(str)
+        getOutHasColors: () => useColor() ?? (process2.stdout.isTTY && process2.stdout.hasColors?.()),
+        getErrHasColors: () => useColor() ?? (process2.stderr.isTTY && process2.stderr.hasColors?.()),
+        stripColor: (str) => stripColor(str)
       };
       this._hidden = false;
       this._helpOption = undefined;
       this._addImplicitHelpCommand = undefined;
       this._helpCommand = undefined;
       this._helpConfiguration = {};
+      this._helpGroupHeading = undefined;
+      this._defaultCommandGroup = undefined;
+      this._defaultOptionGroup = undefined;
     }
     copyInheritedSettings(sourceCommand) {
       this._outputConfiguration = sourceCommand._outputConfiguration;
@@ -728,7 +896,10 @@ var require_command = __commonJS((exports) => {
     configureOutput(configuration) {
       if (configuration === undefined)
         return this._outputConfiguration;
-      Object.assign(this._outputConfiguration, configuration);
+      this._outputConfiguration = {
+        ...this._outputConfiguration,
+        ...configuration
+      };
       return this;
     }
     showHelpAfterError(displayHelp = true) {
@@ -759,12 +930,12 @@ var require_command = __commonJS((exports) => {
     createArgument(name, description) {
       return new Argument(name, description);
     }
-    argument(name, description, fn, defaultValue) {
+    argument(name, description, parseArg, defaultValue) {
       const argument = this.createArgument(name, description);
-      if (typeof fn === "function") {
-        argument.default(defaultValue).argParser(fn);
+      if (typeof parseArg === "function") {
+        argument.default(defaultValue).argParser(parseArg);
       } else {
-        argument.default(fn);
+        argument.default(parseArg);
       }
       this.addArgument(argument);
       return this;
@@ -777,7 +948,7 @@ var require_command = __commonJS((exports) => {
     }
     addArgument(argument) {
       const previousArgument = this.registeredArguments.slice(-1)[0];
-      if (previousArgument && previousArgument.variadic) {
+      if (previousArgument?.variadic) {
         throw new Error(`only the last argument can be variadic '${previousArgument.name()}'`);
       }
       if (argument.required && argument.defaultValue !== undefined && argument.parseArg === undefined) {
@@ -789,10 +960,13 @@ var require_command = __commonJS((exports) => {
     helpCommand(enableOrNameAndArgs, description) {
       if (typeof enableOrNameAndArgs === "boolean") {
         this._addImplicitHelpCommand = enableOrNameAndArgs;
+        if (enableOrNameAndArgs && this._defaultCommandGroup) {
+          this._initCommandGroup(this._getHelpCommand());
+        }
         return this;
       }
-      enableOrNameAndArgs = enableOrNameAndArgs ?? "help [command]";
-      const [, helpName, helpArgs] = enableOrNameAndArgs.match(/([^ ]+) *(.*)/);
+      const nameAndArgs = enableOrNameAndArgs ?? "help [command]";
+      const [, helpName, helpArgs] = nameAndArgs.match(/([^ ]+) *(.*)/);
       const helpDescription = description ?? "display help for command";
       const helpCommand = this.createCommand(helpName);
       helpCommand.helpOption(false);
@@ -802,6 +976,8 @@ var require_command = __commonJS((exports) => {
         helpCommand.description(helpDescription);
       this._addImplicitHelpCommand = true;
       this._helpCommand = helpCommand;
+      if (enableOrNameAndArgs || description)
+        this._initCommandGroup(helpCommand);
       return this;
     }
     addHelpCommand(helpCommand, deprecatedDescription) {
@@ -811,6 +987,7 @@ var require_command = __commonJS((exports) => {
       }
       this._addImplicitHelpCommand = true;
       this._helpCommand = helpCommand;
+      this._initCommandGroup(helpCommand);
       return this;
     }
     _getHelpCommand() {
@@ -890,6 +1067,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         throw new Error(`Cannot add option '${option.flags}'${this._name && ` to command '${this._name}'`} due to conflicting flag '${matchingFlag}'
 -  already used by option '${matchingOption.flags}'`);
       }
+      this._initOptionGroup(option);
       this.options.push(option);
     }
     _registerCommand(command) {
@@ -902,6 +1080,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         const newCmd = knownBy(command).join("|");
         throw new Error(`cannot add command '${newCmd}' as already have command '${existingCmd}'`);
       }
+      this._initCommandGroup(command);
       this.commands.push(command);
     }
     addOption(option) {
@@ -924,7 +1103,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (val !== null && option.parseArg) {
           val = this._callParseArg(option, val, oldValue, invalidValueMessage);
         } else if (val !== null && option.variadic) {
-          val = option._concatValue(val, oldValue);
+          val = option._collectValue(val, oldValue);
         }
         if (val == null) {
           if (option.negate) {
@@ -1089,15 +1268,53 @@ Expecting one of '${allowedValues.join("', '")}'`);
       return userArgs;
     }
     parse(argv, parseOptions) {
+      this._prepareForParse();
       const userArgs = this._prepareUserArgs(argv, parseOptions);
       this._parseCommand([], userArgs);
       return this;
     }
     async parseAsync(argv, parseOptions) {
+      this._prepareForParse();
       const userArgs = this._prepareUserArgs(argv, parseOptions);
       await this._parseCommand([], userArgs);
       return this;
     }
+    _prepareForParse() {
+      if (this._savedState === null) {
+        this.saveStateBeforeParse();
+      } else {
+        this.restoreStateBeforeParse();
+      }
+    }
+    saveStateBeforeParse() {
+      this._savedState = {
+        _name: this._name,
+        _optionValues: { ...this._optionValues },
+        _optionValueSources: { ...this._optionValueSources }
+      };
+    }
+    restoreStateBeforeParse() {
+      if (this._storeOptionsAsProperties)
+        throw new Error(`Can not call parse again when storeOptionsAsProperties is true.
+- either make a new Command for each call to parse, or stop storing options as properties`);
+      this._name = this._savedState._name;
+      this._scriptPath = null;
+      this.rawArgs = [];
+      this._optionValues = { ...this._savedState._optionValues };
+      this._optionValueSources = { ...this._savedState._optionValueSources };
+      this.args = [];
+      this.processedArgs = [];
+    }
+    _checkForMissingExecutable(executableFile, executableDir, subcommandName) {
+      if (fs.existsSync(executableFile))
+        return;
+      const executableDirMessage = executableDir ? `searched for local subcommand relative to directory '${executableDir}'` : "no directory for search for local subcommand, use .executableDir() to supply a custom directory";
+      const executableMissing = `'${executableFile}' does not exist
+ - if '${subcommandName}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead
+ - if the default executable name is not suitable, use the executableFile option to supply a custom name or path
+ - ${executableDirMessage}`;
+      throw new Error(executableMissing);
+    }
     _executeSubCommand(subcommand, args) {
       args = args.slice();
       let launchWithNode = false;
@@ -1121,7 +1338,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let resolvedScriptPath;
         try {
           resolvedScriptPath = fs.realpathSync(this._scriptPath);
-        } catch (err) {
+        } catch {
           resolvedScriptPath = this._scriptPath;
         }
         executableDir = path.resolve(path.dirname(resolvedScriptPath), executableDir);
@@ -1147,6 +1364,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           proc = childProcess.spawn(executableFile, args, { stdio: "inherit" });
         }
       } else {
+        this._checkForMissingExecutable(executableFile, executableDir, subcommand._name);
         args.unshift(executableFile);
         args = incrementNodeInspectorPort(process2.execArgv).concat(args);
         proc = childProcess.spawn(process2.execPath, args, { stdio: "inherit" });
@@ -1172,12 +1390,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
       });
       proc.on("error", (err) => {
         if (err.code === "ENOENT") {
-          const executableDirMessage = executableDir ? `searched for local subcommand relative to directory '${executableDir}'` : "no directory for search for local subcommand, use .executableDir() to supply a custom directory";
-          const executableMissing = `'${executableFile}' does not exist
- - if '${subcommand._name}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead
- - if the default executable name is not suitable, use the executableFile option to supply a custom name or path
- - ${executableDirMessage}`;
-          throw new Error(executableMissing);
+          this._checkForMissingExecutable(executableFile, executableDir, subcommand._name);
         } else if (err.code === "EACCES") {
           throw new Error(`'${executableFile}' not executable`);
         }
@@ -1195,6 +1408,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
       const subCommand = this._findCommand(commandName);
       if (!subCommand)
         this.help({ error: true });
+      subCommand._prepareForParse();
       let promiseChain;
       promiseChain = this._chainOrCallSubCommandHook(promiseChain, subCommand, "preSubcommand");
       promiseChain = this._chainOrCall(promiseChain, () => {
@@ -1264,7 +1478,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
       this.processedArgs = processedArgs;
     }
     _chainOrCall(promise, fn) {
-      if (promise && promise.then && typeof promise.then === "function") {
+      if (promise?.then && typeof promise.then === "function") {
         return promise.then(() => fn());
       }
       return fn();
@@ -1341,7 +1555,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         promiseChain = this._chainOrCallHooks(promiseChain, "postAction");
         return promiseChain;
       }
-      if (this.parent && this.parent.listenerCount(commandEvent)) {
+      if (this.parent?.listenerCount(commandEvent)) {
         checkForUnknownOptions();
         this._processArguments();
         this.parent.emit(commandEvent, operands, unknown);
@@ -1403,24 +1617,31 @@ Expecting one of '${allowedValues.join("', '")}'`);
         cmd._checkForConflictingLocalOptions();
       });
     }
-    parseOptions(argv) {
+    parseOptions(args) {
       const operands = [];
       const unknown = [];
       let dest = operands;
-      const args = argv.slice();
       function maybeOption(arg) {
         return arg.length > 1 && arg[0] === "-";
       }
+      const negativeNumberArg = (arg) => {
+        if (!/^-(\d+|\d*\.\d+)(e[+-]?\d+)?$/.test(arg))
+          return false;
+        return !this._getCommandAndAncestors().some((cmd) => cmd.options.map((opt) => opt.short).some((short) => /^-\d$/.test(short)));
+      };
       let activeVariadicOption = null;
-      while (args.length) {
-        const arg = args.shift();
+      let activeGroup = null;
+      let i = 0;
+      while (i < args.length || activeGroup) {
+        const arg = activeGroup ?? args[i++];
+        activeGroup = null;
         if (arg === "--") {
           if (dest === unknown)
             dest.push(arg);
-          dest.push(...args);
+          dest.push(...args.slice(i));
           break;
         }
-        if (activeVariadicOption && !maybeOption(arg)) {
+        if (activeVariadicOption && (!maybeOption(arg) || negativeNumberArg(arg))) {
           this.emit(`option:${activeVariadicOption.name()}`, arg);
           continue;
         }
@@ -1429,14 +1650,14 @@ Expecting one of '${allowedValues.join("', '")}'`);
           const option = this._findOption(arg);
           if (option) {
             if (option.required) {
-              const value = args.shift();
+              const value = args[i++];
               if (value === undefined)
                 this.optionMissingArgument(option);
               this.emit(`option:${option.name()}`, value);
             } else if (option.optional) {
               let value = null;
-              if (args.length > 0 && !maybeOption(args[0])) {
-                value = args.shift();
+              if (i < args.length && (!maybeOption(args[i]) || negativeNumberArg(args[i]))) {
+                value = args[i++];
               }
               this.emit(`option:${option.name()}`, value);
             } else {
@@ -1453,7 +1674,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
               this.emit(`option:${option.name()}`, arg.slice(2));
             } else {
               this.emit(`option:${option.name()}`);
-              args.unshift(`-${arg.slice(2)}`);
+              activeGroup = `-${arg.slice(2)}`;
             }
             continue;
           }
@@ -1466,31 +1687,24 @@ Expecting one of '${allowedValues.join("', '")}'`);
             continue;
           }
         }
-        if (maybeOption(arg)) {
+        if (dest === operands && maybeOption(arg) && !(this.commands.length === 0 && negativeNumberArg(arg))) {
           dest = unknown;
         }
         if ((this._enablePositionalOptions || this._passThroughOptions) && operands.length === 0 && unknown.length === 0) {
           if (this._findCommand(arg)) {
             operands.push(arg);
-            if (args.length > 0)
-              unknown.push(...args);
+            unknown.push(...args.slice(i));
             break;
           } else if (this._getHelpCommand() && arg === this._getHelpCommand().name()) {
-            operands.push(arg);
-            if (args.length > 0)
-              operands.push(...args);
+            operands.push(arg, ...args.slice(i));
             break;
           } else if (this._defaultCommandName) {
-            unknown.push(arg);
-            if (args.length > 0)
-              unknown.push(...args);
+            unknown.push(arg, ...args.slice(i));
             break;
           }
         }
         if (this._passThroughOptions) {
-          dest.push(arg);
-          if (args.length > 0)
-            dest.push(...args);
+          dest.push(arg, ...args.slice(i));
           break;
         }
         dest.push(arg);
@@ -1701,6 +1915,32 @@ Expecting one of '${allowedValues.join("', '")}'`);
       this._name = str;
       return this;
     }
+    helpGroup(heading) {
+      if (heading === undefined)
+        return this._helpGroupHeading ?? "";
+      this._helpGroupHeading = heading;
+      return this;
+    }
+    commandsGroup(heading) {
+      if (heading === undefined)
+        return this._defaultCommandGroup ?? "";
+      this._defaultCommandGroup = heading;
+      return this;
+    }
+    optionsGroup(heading) {
+      if (heading === undefined)
+        return this._defaultOptionGroup ?? "";
+      this._defaultOptionGroup = heading;
+      return this;
+    }
+    _initOptionGroup(option) {
+      if (this._defaultOptionGroup && !option.helpGroupHeading)
+        option.helpGroup(this._defaultOptionGroup);
+    }
+    _initCommandGroup(cmd) {
+      if (this._defaultCommandGroup && !cmd.helpGroup())
+        cmd.helpGroup(this._defaultCommandGroup);
+    }
     nameFromFilename(filename) {
       this._name = path.basename(filename, path.extname(filename));
       return this;
@@ -1713,23 +1953,38 @@ Expecting one of '${allowedValues.join("', '")}'`);
     }
     helpInformation(contextOptions) {
       const helper = this.createHelp();
-      if (helper.helpWidth === undefined) {
-        helper.helpWidth = contextOptions && contextOptions.error ? this._outputConfiguration.getErrHelpWidth() : this._outputConfiguration.getOutHelpWidth();
-      }
-      return helper.formatHelp(this, helper);
+      const context = this._getOutputContext(contextOptions);
+      helper.prepareContext({
+        error: context.error,
+        helpWidth: context.helpWidth,
+        outputHasColors: context.hasColors
+      });
+      const text = helper.formatHelp(this, helper);
+      if (context.hasColors)
+        return text;
+      return this._outputConfiguration.stripColor(text);
     }
-    _getHelpContext(contextOptions) {
+    _getOutputContext(contextOptions) {
       contextOptions = contextOptions || {};
-      const context = { error: !!contextOptions.error };
-      let write;
-      if (context.error) {
-        write = (arg) => this._outputConfiguration.writeErr(arg);
+      const error = !!contextOptions.error;
+      let baseWrite;
+      let hasColors;
+      let helpWidth;
+      if (error) {
+        baseWrite = (str) => this._outputConfiguration.writeErr(str);
+        hasColors = this._outputConfiguration.getErrHasColors();
+        helpWidth = this._outputConfiguration.getErrHelpWidth();
       } else {
-        write = (arg) => this._outputConfiguration.writeOut(arg);
-      }
-      context.write = contextOptions.write || write;
-      context.command = this;
-      return context;
+        baseWrite = (str) => this._outputConfiguration.writeOut(str);
+        hasColors = this._outputConfiguration.getOutHasColors();
+        helpWidth = this._outputConfiguration.getOutHelpWidth();
+      }
+      const write = (str) => {
+        if (!hasColors)
+          str = this._outputConfiguration.stripColor(str);
+        return baseWrite(str);
+      };
+      return { error, write, hasColors, helpWidth };
     }
     outputHelp(contextOptions) {
       let deprecatedCallback;
@@ -1737,35 +1992,44 @@ Expecting one of '${allowedValues.join("', '")}'`);
         deprecatedCallback = contextOptions;
         contextOptions = undefined;
       }
-      const context = this._getHelpContext(contextOptions);
-      this._getCommandAndAncestors().reverse().forEach((command) => command.emit("beforeAllHelp", context));
-      this.emit("beforeHelp", context);
-      let helpInformation = this.helpInformation(context);
+      const outputContext = this._getOutputContext(contextOptions);
+      const eventContext = {
+        error: outputContext.error,
+        write: outputContext.write,
+        command: this
+      };
+      this._getCommandAndAncestors().reverse().forEach((command) => command.emit("beforeAllHelp", eventContext));
+      this.emit("beforeHelp", eventContext);
+      let helpInformation = this.helpInformation({ error: outputContext.error });
       if (deprecatedCallback) {
         helpInformation = deprecatedCallback(helpInformation);
         if (typeof helpInformation !== "string" && !Buffer.isBuffer(helpInformation)) {
           throw new Error("outputHelp callback must return a string or a Buffer");
         }
       }
-      context.write(helpInformation);
+      outputContext.write(helpInformation);
       if (this._getHelpOption()?.long) {
         this.emit(this._getHelpOption().long);
       }
-      this.emit("afterHelp", context);
-      this._getCommandAndAncestors().forEach((command) => command.emit("afterAllHelp", context));
+      this.emit("afterHelp", eventContext);
+      this._getCommandAndAncestors().forEach((command) => command.emit("afterAllHelp", eventContext));
     }
     helpOption(flags, description) {
       if (typeof flags === "boolean") {
         if (flags) {
-          this._helpOption = this._helpOption ?? undefined;
+          if (this._helpOption === null)
+            this._helpOption = undefined;
+          if (this._defaultOptionGroup) {
+            this._initOptionGroup(this._getHelpOption());
+          }
         } else {
           this._helpOption = null;
         }
         return this;
       }
-      flags = flags ?? "-h, --help";
-      description = description ?? "display help for command";
-      this._helpOption = this.createOption(flags, description);
+      this._helpOption = this.createOption(flags ?? "-h, --help", description ?? "display help for command");
+      if (flags || description)
+        this._initOptionGroup(this._helpOption);
       return this;
     }
     _getHelpOption() {
@@ -1776,11 +2040,12 @@ Expecting one of '${allowedValues.join("', '")}'`);
     }
     addHelpOption(option) {
       this._helpOption = option;
+      this._initOptionGroup(option);
       return this;
     }
     help(contextOptions) {
       this.outputHelp(contextOptions);
-      let exitCode = process2.exitCode || 0;
+      let exitCode = Number(process2.exitCode ?? 0);
       if (exitCode === 0 && contextOptions && typeof contextOptions !== "function" && contextOptions.error) {
         exitCode = 1;
       }
@@ -1845,7 +2110,15 @@ Expecting one of '${allowedValues.join("', '")}'`);
       return arg;
     });
   }
+  function useColor() {
+    if (process2.env.NO_COLOR || process2.env.FORCE_COLOR === "0" || process2.env.FORCE_COLOR === "false")
+      return false;
+    if (process2.env.FORCE_COLOR || process2.env.CLICOLOR_FORCE !== undefined)
+      return true;
+    return;
+  }
   exports.Command = Command;
+  exports.useColor = useColor;
 });
 
 // node_modules/commander/index.js
@@ -13046,6 +13319,92 @@ var require_dist2 = __commonJS((exports, module) => {
   exports.default = formatsPlugin;
 });
 
+// lib/util.ts
+var exports_util2 = {};
+__export(exports_util2, {
+  resolveBaseUrls: () => resolveBaseUrls2,
+  normalizeBaseUrl: () => normalizeBaseUrl2,
+  maskSecret: () => maskSecret2,
+  formatHttpError: () => formatHttpError2
+});
+function isHtmlContent2(text) {
+  const trimmed = text.trim();
+  return trimmed.startsWith("<!DOCTYPE") || trimmed.startsWith("<html") || trimmed.startsWith("<HTML");
+}
+function formatHttpError2(operation, status, responseBody) {
+  const statusMessage = HTTP_STATUS_MESSAGES2[status] || "Request failed";
+  let errMsg = `${operation}: HTTP ${status} - ${statusMessage}`;
+  if (responseBody) {
+    if (isHtmlContent2(responseBody)) {
+      return errMsg;
+    }
+    try {
+      const errObj = JSON.parse(responseBody);
+      const message = errObj.message || errObj.error || errObj.detail;
+      if (message && typeof message === "string") {
+        errMsg += `
+${message}`;
+      } else {
+        errMsg += `
+${JSON.stringify(errObj, null, 2)}`;
+      }
+    } catch {
+      const trimmed = responseBody.trim();
+      if (trimmed.length > 0 && trimmed.length < 500) {
+        errMsg += `
+${trimmed}`;
+      }
+    }
+  }
+  return errMsg;
+}
+function maskSecret2(secret) {
+  if (!secret)
+    return "";
+  if (secret.length <= 8)
+    return "****";
+  if (secret.length <= 16)
+    return `${secret.slice(0, 4)}${"*".repeat(secret.length - 8)}${secret.slice(-4)}`;
+  return `${secret.slice(0, Math.min(12, secret.length - 8))}${"*".repeat(Math.max(4, secret.length - 16))}${secret.slice(-4)}`;
+}
+function normalizeBaseUrl2(value) {
+  const trimmed = (value || "").replace(/\/$/, "");
+  try {
+    new URL(trimmed);
+  } catch {
+    throw new Error(`Invalid base URL: ${value}`);
+  }
+  return trimmed;
+}
+function resolveBaseUrls2(opts, cfg, defaults2 = {}) {
+  const defApi = defaults2.apiBaseUrl || "https://postgres.ai/api/general/";
+  const defUi = defaults2.uiBaseUrl || "https://console.postgres.ai";
+  const defStorage = defaults2.storageBaseUrl || "https://postgres.ai/storage";
+  const apiCandidate = opts?.apiBaseUrl || process.env.PGAI_API_BASE_URL || cfg?.baseUrl || defApi;
+  const uiCandidate = opts?.uiBaseUrl || process.env.PGAI_UI_BASE_URL || defUi;
+  const storageCandidate = opts?.storageBaseUrl || process.env.PGAI_STORAGE_BASE_URL || cfg?.storageBaseUrl || defStorage;
+  return {
+    apiBaseUrl: normalizeBaseUrl2(apiCandidate),
+    uiBaseUrl: normalizeBaseUrl2(uiCandidate),
+    storageBaseUrl: normalizeBaseUrl2(storageCandidate)
+  };
+}
+var HTTP_STATUS_MESSAGES2;
+var init_util = __esm(() => {
+  HTTP_STATUS_MESSAGES2 = {
+    400: "Bad Request",
+    401: "Unauthorized - check your API key",
+    403: "Forbidden - access denied",
+    404: "Not Found",
+    408: "Request Timeout",
+    429: "Too Many Requests - rate limited",
+    500: "Internal Server Error",
+    502: "Bad Gateway - server temporarily unavailable",
+    503: "Service Unavailable - server temporarily unavailable",
+    504: "Gateway Timeout - server temporarily unavailable"
+  };
+});
+
 // node_modules/commander/esm.mjs
 var import__ = __toESM(require_commander(), 1);
 var {
@@ -13064,7 +13423,7 @@ var {
 // package.json
 var package_default = {
   name: "postgresai",
-  version: "0.15.0-dev.1",
+  version: "0.15.0-dev.10",
   description: "postgres_ai CLI",
   license: "Apache-2.0",
   private: false,
@@ -13092,7 +13451,7 @@ var package_default = {
     "embed-metrics": "bun run scripts/embed-metrics.ts",
     "embed-checkup-dictionary": "bun run scripts/embed-checkup-dictionary.ts",
     "embed-all": "bun run embed-metrics && bun run embed-checkup-dictionary",
-    build: `bun run embed-all && bun build ./bin/postgres-ai.ts --outdir ./dist/bin --target node && node -e "const fs=require('fs');const f='./dist/bin/postgres-ai.js';fs.writeFileSync(f,fs.readFileSync(f,'utf8').replace('#!/usr/bin/env bun','#!/usr/bin/env node'))" && cp -r ./sql ./dist/sql`,
+    build: `bun run embed-all && bun build ./bin/postgres-ai.ts --outdir ./dist/bin --target node && node -e "const fs=require('fs');const f='./dist/bin/postgres-ai.js';fs.writeFileSync(f,fs.readFileSync(f,'utf8').replace('#!/usr/bin/env bun','#!/usr/bin/env node'))" && cp -r ./sql ./dist/sql && cp ../instances.demo.yml ./instances.demo.yml`,
     prepublishOnly: "npm run build",
     start: "bun ./bin/postgres-ai.ts --help",
     "start:node": "node ./dist/bin/postgres-ai.js --help",
@@ -13105,7 +13464,7 @@ var package_default = {
   },
   dependencies: {
     "@modelcontextprotocol/sdk": "^1.20.2",
-    commander: "^12.1.0",
+    commander: "^14.0.3",
     "js-yaml": "^4.1.0",
     pg: "^8.16.3"
   },
@@ -13115,7 +13474,7 @@ var package_default = {
     "@types/pg": "^8.15.6",
     ajv: "^8.17.1",
     "ajv-formats": "^3.0.1",
-    typescript: "^5.9.3"
+    typescript: "^6.0.2"
   },
   publishConfig: {
     access: "public"
@@ -13140,6 +13499,7 @@ function readConfig() {
   const config = {
     apiKey: null,
     baseUrl: null,
+    storageBaseUrl: null,
     orgId: null,
     defaultProject: null,
     projectName: null
@@ -13151,6 +13511,7 @@ function readConfig() {
       const parsed = JSON.parse(content);
       config.apiKey = parsed.apiKey ?? null;
       config.baseUrl = parsed.baseUrl ?? null;
+      config.storageBaseUrl = parsed.storageBaseUrl ?? null;
       config.orgId = parsed.orgId ?? null;
       config.defaultProject = parsed.defaultProject ?? null;
       config.projectName = parsed.projectName ?? null;
@@ -15873,9 +16234,10 @@ var safeLoadAll = renamed("safeLoadAll", "loadAll");
 var safeDump = renamed("safeDump", "dump");
 
 // bin/postgres-ai.ts
-import * as fs5 from "fs";
-import * as path5 from "path";
+import * as fs6 from "fs";
+import * as path6 from "path";
 import * as os3 from "os";
+import { fileURLToPath as fileURLToPath2 } from "url";
 import * as crypto2 from "crypto";
 
 // node_modules/pg/esm/index.mjs
@@ -15892,7 +16254,7 @@ var Result = import_lib.default.Result;
 var TypeOverrides = import_lib.default.TypeOverrides;
 var defaults = import_lib.default.defaults;
 // package.json
-var version = "0.15.0-dev.1";
+var version = "0.15.0-dev.10";
 var package_default2 = {
   name: "postgresai",
   version,
@@ -15923,7 +16285,7 @@ var package_default2 = {
     "embed-metrics": "bun run scripts/embed-metrics.ts",
     "embed-checkup-dictionary": "bun run scripts/embed-checkup-dictionary.ts",
     "embed-all": "bun run embed-metrics && bun run embed-checkup-dictionary",
-    build: `bun run embed-all && bun build ./bin/postgres-ai.ts --outdir ./dist/bin --target node && node -e "const fs=require('fs');const f='./dist/bin/postgres-ai.js';fs.writeFileSync(f,fs.readFileSync(f,'utf8').replace('#!/usr/bin/env bun','#!/usr/bin/env node'))" && cp -r ./sql ./dist/sql`,
+    build: `bun run embed-all && bun build ./bin/postgres-ai.ts --outdir ./dist/bin --target node && node -e "const fs=require('fs');const f='./dist/bin/postgres-ai.js';fs.writeFileSync(f,fs.readFileSync(f,'utf8').replace('#!/usr/bin/env bun','#!/usr/bin/env node'))" && cp -r ./sql ./dist/sql && cp ../instances.demo.yml ./instances.demo.yml`,
     prepublishOnly: "npm run build",
     start: "bun ./bin/postgres-ai.ts --help",
     "start:node": "node ./dist/bin/postgres-ai.js --help",
@@ -15936,7 +16298,7 @@ var package_default2 = {
   },
   dependencies: {
     "@modelcontextprotocol/sdk": "^1.20.2",
-    commander: "^12.1.0",
+    commander: "^14.0.3",
     "js-yaml": "^4.1.0",
     pg: "^8.16.3"
   },
@@ -15946,7 +16308,7 @@ var package_default2 = {
     "@types/pg": "^8.15.6",
     ajv: "^8.17.1",
     "ajv-formats": "^3.0.1",
-    typescript: "^5.9.3"
+    typescript: "^6.0.2"
   },
   publishConfig: {
     access: "public"
@@ -15971,6 +16333,7 @@ function readConfig2() {
   const config = {
     apiKey: null,
     baseUrl: null,
+    storageBaseUrl: null,
     orgId: null,
     defaultProject: null,
     projectName: null
@@ -15982,6 +16345,7 @@ function readConfig2() {
       const parsed = JSON.parse(content);
       config.apiKey = parsed.apiKey ?? null;
       config.baseUrl = parsed.baseUrl ?? null;
+      config.storageBaseUrl = parsed.storageBaseUrl ?? null;
       config.orgId = parsed.orgId ?? null;
       config.defaultProject = parsed.defaultProject ?? null;
       config.projectName = parsed.projectName ?? null;
@@ -16079,11 +16443,14 @@ function normalizeBaseUrl(value) {
 function resolveBaseUrls(opts, cfg, defaults2 = {}) {
   const defApi = defaults2.apiBaseUrl || "https://postgres.ai/api/general/";
   const defUi = defaults2.uiBaseUrl || "https://console.postgres.ai";
+  const defStorage = defaults2.storageBaseUrl || "https://postgres.ai/storage";
   const apiCandidate = opts?.apiBaseUrl || process.env.PGAI_API_BASE_URL || cfg?.baseUrl || defApi;
   const uiCandidate = opts?.uiBaseUrl || process.env.PGAI_UI_BASE_URL || defUi;
+  const storageCandidate = opts?.storageBaseUrl || process.env.PGAI_STORAGE_BASE_URL || cfg?.storageBaseUrl || defStorage;
   return {
     apiBaseUrl: normalizeBaseUrl(apiCandidate),
-    uiBaseUrl: normalizeBaseUrl(uiCandidate)
+    uiBaseUrl: normalizeBaseUrl(uiCandidate),
+    storageBaseUrl: normalizeBaseUrl(storageCandidate)
   };
 }
 
@@ -16115,18 +16482,18 @@ async function fetchIssues(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: GET URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: GET URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
   }
   const response = await fetch(url.toString(), {
     method: "GET",
     headers
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   const data = await response.text();
   if (response.ok) {
@@ -16157,18 +16524,18 @@ async function fetchIssueComments(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: GET URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: GET URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
   }
   const response = await fetch(url.toString(), {
     method: "GET",
     headers
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   const data = await response.text();
   if (response.ok) {
@@ -16202,18 +16569,18 @@ async function fetchIssue(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: GET URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: GET URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
   }
   const response = await fetch(url.toString(), {
     method: "GET",
     headers
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   const data = await response.text();
   if (response.ok) {
@@ -16275,11 +16642,11 @@ async function createIssue(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: POST URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
-    console.log(`Debug: Request body: ${body}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: POST URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Request body: ${body}`);
   }
   const response = await fetch(url.toString(), {
     method: "POST",
@@ -16287,8 +16654,8 @@ async function createIssue(params) {
     body
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   const data = await response.text();
   if (response.ok) {
@@ -16330,11 +16697,11 @@ async function createIssueComment(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: POST URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
-    console.log(`Debug: Request body: ${body}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: POST URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Request body: ${body}`);
   }
   const response = await fetch(url.toString(), {
     method: "POST",
@@ -16342,8 +16709,8 @@ async function createIssueComment(params) {
     body
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   const data = await response.text();
   if (response.ok) {
@@ -16393,11 +16760,11 @@ async function updateIssue(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: POST URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
-    console.log(`Debug: Request body: ${body}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: POST URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Request body: ${body}`);
   }
   const response = await fetch(url.toString(), {
     method: "POST",
@@ -16405,8 +16772,8 @@ async function updateIssue(params) {
     body
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   const data = await response.text();
   if (response.ok) {
@@ -16445,11 +16812,11 @@ async function updateIssueComment(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: POST URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
-    console.log(`Debug: Request body: ${body}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: POST URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Request body: ${body}`);
   }
   const response = await fetch(url.toString(), {
     method: "POST",
@@ -16457,8 +16824,8 @@ async function updateIssueComment(params) {
     body
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   const data = await response.text();
   if (response.ok) {
@@ -16497,18 +16864,18 @@ async function fetchActionItem(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: GET URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: GET URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
   }
   const response = await fetch(url.toString(), {
     method: "GET",
     headers
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   const data = await response.text();
   if (response.ok) {
@@ -16548,18 +16915,18 @@ async function fetchActionItems(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: GET URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: GET URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
   }
   const response = await fetch(url.toString(), {
     method: "GET",
     headers
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   const data = await response.text();
   if (response.ok) {
@@ -16611,11 +16978,11 @@ async function createActionItem(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: POST URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
-    console.log(`Debug: Request body: ${body}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: POST URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Request body: ${body}`);
   }
   const response = await fetch(url.toString(), {
     method: "POST",
@@ -16623,8 +16990,8 @@ async function createActionItem(params) {
     body
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   const data = await response.text();
   if (response.ok) {
@@ -16688,11 +17055,11 @@ async function updateActionItem(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: POST URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
-    console.log(`Debug: Request body: ${body}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: POST URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Request body: ${body}`);
   }
   const response = await fetch(url.toString(), {
     method: "POST",
@@ -16700,8 +17067,8 @@ async function updateActionItem(params) {
     body
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   if (!response.ok) {
     const data = await response.text();
@@ -16709,6 +17076,192 @@ async function updateActionItem(params) {
   }
 }
 
+// lib/reports.ts
+function parseFlexibleDate(input) {
+  const s = input.trim();
+  const dotMatch = s.match(/^(\d{1,2})\.(\d{1,2})\.(\d{4})(?:\s+(\d{1,2}):(\d{2})(?::(\d{2}))?)?$/);
+  if (dotMatch) {
+    const [, dd, mm, yyyy, hh, min, ss] = dotMatch;
+    const iso = `${yyyy}-${mm.padStart(2, "0")}-${dd.padStart(2, "0")}T${(hh ?? "00").padStart(2, "0")}:${(min ?? "00").padStart(2, "0")}:${(ss ?? "00").padStart(2, "0")}Z`;
+    const d = new Date(iso);
+    if (isNaN(d.getTime()))
+      throw new Error(`Invalid date: ${input}`);
+    return d.toISOString();
+  }
+  const isoMatch = s.match(/^(\d{4})-(\d{2})-(\d{2})(?:[T ](\d{2}):(\d{2})(?::(\d{2}))?)?$/);
+  if (isoMatch) {
+    const [, yyyy, mm, dd, hh, min, ss] = isoMatch;
+    const iso = `${yyyy}-${mm}-${dd}T${hh ?? "00"}:${min ?? "00"}:${ss ?? "00"}Z`;
+    const d = new Date(iso);
+    if (isNaN(d.getTime()))
+      throw new Error(`Invalid date: ${input}`);
+    return d.toISOString();
+  }
+  throw new Error(`Unrecognized date format: ${input}. Use YYYY-MM-DD or DD.MM.YYYY`);
+}
+async function fetchReports(params) {
+  const { apiKey, apiBaseUrl, projectId, status, limit = 20, beforeDate, beforeId, debug } = params;
+  if (!apiKey) {
+    throw new Error("API key is required");
+  }
+  const base = normalizeBaseUrl(apiBaseUrl);
+  const url = new URL(`${base}/checkup_reports`);
+  url.searchParams.set("order", "id.desc");
+  url.searchParams.set("limit", String(limit));
+  if (typeof projectId === "number") {
+    url.searchParams.set("project_id", `eq.${projectId}`);
+  }
+  if (status) {
+    url.searchParams.set("status", `eq.${status}`);
+  }
+  if (beforeDate) {
+    url.searchParams.set("created_at", `lt.${beforeDate}`);
+  }
+  if (typeof beforeId === "number") {
+    url.searchParams.set("id", `lt.${beforeId}`);
+  }
+  const headers = {
+    "access-token": apiKey,
+    Prefer: "return=representation",
+    "Content-Type": "application/json",
+    Connection: "close"
+  };
+  if (debug) {
+    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: GET URL: ${url.toString()}`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+  }
+  const response = await fetch(url.toString(), { method: "GET", headers });
+  if (debug) {
+    console.error(`Debug: Response status: ${response.status}`);
+  }
+  const data = await response.text();
+  if (response.ok) {
+    try {
+      return JSON.parse(data);
+    } catch {
+      throw new Error(`Failed to parse reports response: ${data}`);
+    }
+  } else {
+    throw new Error(formatHttpError("Failed to fetch reports", response.status, data));
+  }
+}
+var MAX_ALL_REPORTS = 1e4;
+async function fetchAllReports(params) {
+  const pageSize = params.limit ?? 100;
+  const all = [];
+  let beforeId;
+  while (true) {
+    const page = await fetchReports({ ...params, limit: pageSize, beforeId });
+    if (page.length === 0)
+      break;
+    all.push(...page);
+    if (all.length >= MAX_ALL_REPORTS) {
+      console.warn(`Warning: reached maximum of ${MAX_ALL_REPORTS} reports, stopping pagination`);
+      break;
+    }
+    beforeId = page[page.length - 1].id;
+    if (page.length < pageSize)
+      break;
+  }
+  return all;
+}
+async function fetchReportFiles(params) {
+  const { apiKey, apiBaseUrl, reportId, type: type2, checkId, debug } = params;
+  if (!apiKey) {
+    throw new Error("API key is required");
+  }
+  if (reportId === undefined && !checkId) {
+    throw new Error("Either reportId or checkId is required");
+  }
+  const base = normalizeBaseUrl(apiBaseUrl);
+  const url = new URL(`${base}/checkup_report_files`);
+  if (typeof reportId === "number") {
+    url.searchParams.set("checkup_report_id", `eq.${reportId}`);
+  }
+  url.searchParams.set("order", "id.asc");
+  if (type2) {
+    url.searchParams.set("type", `eq.${type2}`);
+  }
+  if (checkId) {
+    url.searchParams.set("check_id", `eq.${checkId}`);
+  }
+  const headers = {
+    "access-token": apiKey,
+    Prefer: "return=representation",
+    "Content-Type": "application/json",
+    Connection: "close"
+  };
+  if (debug) {
+    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: GET URL: ${url.toString()}`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+  }
+  const response = await fetch(url.toString(), { method: "GET", headers });
+  if (debug) {
+    console.error(`Debug: Response status: ${response.status}`);
+  }
+  const data = await response.text();
+  if (response.ok) {
+    try {
+      return JSON.parse(data);
+    } catch {
+      throw new Error(`Failed to parse report files response: ${data}`);
+    }
+  } else {
+    throw new Error(formatHttpError("Failed to fetch report files", response.status, data));
+  }
+}
+async function fetchReportFileData(params) {
+  const { apiKey, apiBaseUrl, reportId, type: type2, checkId, debug } = params;
+  if (!apiKey) {
+    throw new Error("API key is required");
+  }
+  if (reportId === undefined && !checkId) {
+    throw new Error("Either reportId or checkId is required");
+  }
+  const base = normalizeBaseUrl(apiBaseUrl);
+  const url = new URL(`${base}/checkup_report_file_data`);
+  if (typeof reportId === "number") {
+    url.searchParams.set("checkup_report_id", `eq.${reportId}`);
+  }
+  url.searchParams.set("order", "id.asc");
+  if (type2) {
+    url.searchParams.set("type", `eq.${type2}`);
+  }
+  if (checkId) {
+    url.searchParams.set("check_id", `eq.${checkId}`);
+  }
+  const headers = {
+    "access-token": apiKey,
+    Prefer: "return=representation",
+    "Content-Type": "application/json",
+    Connection: "close"
+  };
+  if (debug) {
+    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: GET URL: ${url.toString()}`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+  }
+  const response = await fetch(url.toString(), { method: "GET", headers });
+  if (debug) {
+    console.error(`Debug: Response status: ${response.status}`);
+  }
+  const data = await response.text();
+  if (response.ok) {
+    try {
+      return JSON.parse(data);
+    } catch {
+      throw new Error(`Failed to parse report file data response: ${data}`);
+    }
+  } else {
+    throw new Error(formatHttpError("Failed to fetch report file data", response.status, data));
+  }
+}
+
 // node_modules/zod/v4/core/core.js
 var NEVER = Object.freeze({
   status: "aborted"
@@ -23770,9 +24323,49 @@ async function handleToolCall(req, rootOpts, extra) {
       await updateActionItem({ apiKey, apiBaseUrl, actionItemId, title, description, isDone, status, statusReason, debug });
       return { content: [{ type: "text", text: JSON.stringify({ success: true }, null, 2) }] };
     }
-    throw new Error(`Unknown tool: ${toolName}`);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
+    if (toolName === "list_reports") {
+      const projectId = args.project_id !== undefined ? Number(args.project_id) : undefined;
+      const status = args.status ? String(args.status) : undefined;
+      const limit = args.limit !== undefined ? Number(args.limit) : undefined;
+      const beforeDate = args.before_date ? parseFlexibleDate(String(args.before_date)) : undefined;
+      const all = args.all === true;
+      let reports;
+      if (all) {
+        reports = await fetchAllReports({ apiKey, apiBaseUrl, projectId, status, limit, debug });
+      } else {
+        reports = await fetchReports({ apiKey, apiBaseUrl, projectId, status, limit, beforeDate, debug });
+      }
+      return { content: [{ type: "text", text: JSON.stringify(reports, null, 2) }] };
+    }
+    if (toolName === "list_report_files") {
+      const reportId = args.report_id !== undefined ? Number(args.report_id) : undefined;
+      if (reportId !== undefined && isNaN(reportId)) {
+        return { content: [{ type: "text", text: "report_id must be a number" }], isError: true };
+      }
+      const type2 = args.type ? String(args.type) : undefined;
+      const checkId = args.check_id ? String(args.check_id) : undefined;
+      if (reportId === undefined && !checkId) {
+        return { content: [{ type: "text", text: "Either report_id or check_id is required" }], isError: true };
+      }
+      const files = await fetchReportFiles({ apiKey, apiBaseUrl, reportId, type: type2, checkId, debug });
+      return { content: [{ type: "text", text: JSON.stringify(files, null, 2) }] };
+    }
+    if (toolName === "get_report_data") {
+      const reportId = args.report_id !== undefined ? Number(args.report_id) : undefined;
+      if (reportId !== undefined && isNaN(reportId)) {
+        return { content: [{ type: "text", text: "report_id must be a number" }], isError: true };
+      }
+      const type2 = args.type ? String(args.type) : undefined;
+      const checkId = args.check_id ? String(args.check_id) : undefined;
+      if (reportId === undefined && !checkId) {
+        return { content: [{ type: "text", text: "Either report_id or check_id is required" }], isError: true };
+      }
+      const files = await fetchReportFileData({ apiKey, apiBaseUrl, reportId, type: type2, checkId, debug });
+      return { content: [{ type: "text", text: JSON.stringify(files, null, 2) }] };
+    }
+    throw new Error(`Unknown tool: ${toolName}`);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
     return { content: [{ type: "text", text: message }], isError: true };
   }
 }
@@ -23955,6 +24548,50 @@ async function startMcpServer(rootOpts, extra) {
             required: ["action_item_id"],
             additionalProperties: false
           }
+        },
+        {
+          name: "list_reports",
+          description: "List checkup reports. Returns report metadata: id, project, status, timestamps. Use get_report_data to fetch actual report content. Supports date-based filtering with before_date.",
+          inputSchema: {
+            type: "object",
+            properties: {
+              project_id: { type: "number", description: "Filter by project ID" },
+              status: { type: "string", description: "Filter by status (e.g., 'completed')" },
+              limit: { type: "number", description: "Max number of reports to return (default: 20)" },
+              before_date: { type: "string", description: "Show reports created before this date (YYYY-MM-DD, DD.MM.YYYY, YYYY-MM-DD HH:mm, etc.)" },
+              all: { type: "boolean", description: "Fetch all reports (paginated automatically)" },
+              debug: { type: "boolean", description: "Enable verbose debug logs" }
+            },
+            additionalProperties: false
+          }
+        },
+        {
+          name: "list_report_files",
+          description: "List files in a checkup report (metadata only, no content). Each report contains json (raw data) and md (markdown analysis) files per check. Either report_id or check_id must be provided.",
+          inputSchema: {
+            type: "object",
+            properties: {
+              report_id: { type: "number", description: "Checkup report ID (optional if check_id is provided)" },
+              type: { type: "string", description: "Filter by file type: 'json' or 'md'" },
+              check_id: { type: "string", description: "Filter by check ID (e.g., 'H002', 'F004')" },
+              debug: { type: "boolean", description: "Enable verbose debug logs" }
+            },
+            additionalProperties: false
+          }
+        },
+        {
+          name: "get_report_data",
+          description: "Get checkup report file content. Returns files with a 'data' field containing the actual content: markdown analysis or JSON raw data. Use type='md' for human-readable analysis with recommendations, type='json' for raw check data. Either report_id or check_id must be provided.",
+          inputSchema: {
+            type: "object",
+            properties: {
+              report_id: { type: "number", description: "Checkup report ID (optional if check_id is provided)" },
+              type: { type: "string", description: "Filter by file type: 'json' for raw data, 'md' for markdown analysis" },
+              check_id: { type: "string", description: "Filter by check ID (e.g., 'H002', 'F004')" },
+              debug: { type: "boolean", description: "Enable verbose debug logs" }
+            },
+            additionalProperties: false
+          }
         }
       ]
     };
@@ -23994,18 +24631,18 @@ async function fetchIssues2(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: GET URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: GET URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
   }
   const response = await fetch(url.toString(), {
     method: "GET",
     headers
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   const data = await response.text();
   if (response.ok) {
@@ -24036,18 +24673,18 @@ async function fetchIssueComments2(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: GET URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: GET URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
   }
   const response = await fetch(url.toString(), {
     method: "GET",
     headers
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   const data = await response.text();
   if (response.ok) {
@@ -24081,18 +24718,18 @@ async function fetchIssue2(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: GET URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: GET URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
   }
   const response = await fetch(url.toString(), {
     method: "GET",
     headers
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   const data = await response.text();
   if (response.ok) {
@@ -24154,11 +24791,11 @@ async function createIssue2(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: POST URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
-    console.log(`Debug: Request body: ${body}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: POST URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Request body: ${body}`);
   }
   const response = await fetch(url.toString(), {
     method: "POST",
@@ -24166,8 +24803,8 @@ async function createIssue2(params) {
     body
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   const data = await response.text();
   if (response.ok) {
@@ -24209,11 +24846,11 @@ async function createIssueComment2(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: POST URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
-    console.log(`Debug: Request body: ${body}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: POST URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Request body: ${body}`);
   }
   const response = await fetch(url.toString(), {
     method: "POST",
@@ -24221,8 +24858,8 @@ async function createIssueComment2(params) {
     body
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   const data = await response.text();
   if (response.ok) {
@@ -24272,11 +24909,11 @@ async function updateIssue2(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: POST URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
-    console.log(`Debug: Request body: ${body}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: POST URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Request body: ${body}`);
   }
   const response = await fetch(url.toString(), {
     method: "POST",
@@ -24284,8 +24921,8 @@ async function updateIssue2(params) {
     body
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   const data = await response.text();
   if (response.ok) {
@@ -24324,11 +24961,11 @@ async function updateIssueComment2(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: POST URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
-    console.log(`Debug: Request body: ${body}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: POST URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Request body: ${body}`);
   }
   const response = await fetch(url.toString(), {
     method: "POST",
@@ -24336,8 +24973,8 @@ async function updateIssueComment2(params) {
     body
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   const data = await response.text();
   if (response.ok) {
@@ -24376,18 +25013,18 @@ async function fetchActionItem2(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: GET URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: GET URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
   }
   const response = await fetch(url.toString(), {
     method: "GET",
     headers
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   const data = await response.text();
   if (response.ok) {
@@ -24427,18 +25064,18 @@ async function fetchActionItems2(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: GET URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: GET URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
   }
   const response = await fetch(url.toString(), {
     method: "GET",
     headers
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   const data = await response.text();
   if (response.ok) {
@@ -24490,11 +25127,11 @@ async function createActionItem2(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: POST URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
-    console.log(`Debug: Request body: ${body}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: POST URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Request body: ${body}`);
   }
   const response = await fetch(url.toString(), {
     method: "POST",
@@ -24502,8 +25139,8 @@ async function createActionItem2(params) {
     body
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   const data = await response.text();
   if (response.ok) {
@@ -24567,11 +25204,11 @@ async function updateActionItem2(params) {
   };
   if (debug) {
     const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.log(`Debug: Resolved API base URL: ${base}`);
-    console.log(`Debug: POST URL: ${url.toString()}`);
-    console.log(`Debug: Auth scheme: access-token`);
-    console.log(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
-    console.log(`Debug: Request body: ${body}`);
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: POST URL: ${url.toString()}`);
+    console.error(`Debug: Auth scheme: access-token`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+    console.error(`Debug: Request body: ${body}`);
   }
   const response = await fetch(url.toString(), {
     method: "POST",
@@ -24579,8 +25216,8 @@ async function updateActionItem2(params) {
     body
   });
   if (debug) {
-    console.log(`Debug: Response status: ${response.status}`);
-    console.log(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
   }
   if (!response.ok) {
     const data = await response.text();
@@ -24588,41 +25225,437 @@ async function updateActionItem2(params) {
   }
 }
 
-// lib/util.ts
-function maskSecret2(secret) {
-  if (!secret)
+// lib/reports.ts
+function parseFlexibleDate2(input) {
+  const s = input.trim();
+  const dotMatch = s.match(/^(\d{1,2})\.(\d{1,2})\.(\d{4})(?:\s+(\d{1,2}):(\d{2})(?::(\d{2}))?)?$/);
+  if (dotMatch) {
+    const [, dd, mm, yyyy, hh, min, ss] = dotMatch;
+    const iso = `${yyyy}-${mm.padStart(2, "0")}-${dd.padStart(2, "0")}T${(hh ?? "00").padStart(2, "0")}:${(min ?? "00").padStart(2, "0")}:${(ss ?? "00").padStart(2, "0")}Z`;
+    const d = new Date(iso);
+    if (isNaN(d.getTime()))
+      throw new Error(`Invalid date: ${input}`);
+    return d.toISOString();
+  }
+  const isoMatch = s.match(/^(\d{4})-(\d{2})-(\d{2})(?:[T ](\d{2}):(\d{2})(?::(\d{2}))?)?$/);
+  if (isoMatch) {
+    const [, yyyy, mm, dd, hh, min, ss] = isoMatch;
+    const iso = `${yyyy}-${mm}-${dd}T${hh ?? "00"}:${min ?? "00"}:${ss ?? "00"}Z`;
+    const d = new Date(iso);
+    if (isNaN(d.getTime()))
+      throw new Error(`Invalid date: ${input}`);
+    return d.toISOString();
+  }
+  throw new Error(`Unrecognized date format: ${input}. Use YYYY-MM-DD or DD.MM.YYYY`);
+}
+async function fetchReports2(params) {
+  const { apiKey, apiBaseUrl, projectId, status, limit = 20, beforeDate, beforeId, debug } = params;
+  if (!apiKey) {
+    throw new Error("API key is required");
+  }
+  const base = normalizeBaseUrl(apiBaseUrl);
+  const url = new URL(`${base}/checkup_reports`);
+  url.searchParams.set("order", "id.desc");
+  url.searchParams.set("limit", String(limit));
+  if (typeof projectId === "number") {
+    url.searchParams.set("project_id", `eq.${projectId}`);
+  }
+  if (status) {
+    url.searchParams.set("status", `eq.${status}`);
+  }
+  if (beforeDate) {
+    url.searchParams.set("created_at", `lt.${beforeDate}`);
+  }
+  if (typeof beforeId === "number") {
+    url.searchParams.set("id", `lt.${beforeId}`);
+  }
+  const headers = {
+    "access-token": apiKey,
+    Prefer: "return=representation",
+    "Content-Type": "application/json",
+    Connection: "close"
+  };
+  if (debug) {
+    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: GET URL: ${url.toString()}`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+  }
+  const response = await fetch(url.toString(), { method: "GET", headers });
+  if (debug) {
+    console.error(`Debug: Response status: ${response.status}`);
+  }
+  const data = await response.text();
+  if (response.ok) {
+    try {
+      return JSON.parse(data);
+    } catch {
+      throw new Error(`Failed to parse reports response: ${data}`);
+    }
+  } else {
+    throw new Error(formatHttpError("Failed to fetch reports", response.status, data));
+  }
+}
+var MAX_ALL_REPORTS2 = 1e4;
+async function fetchAllReports2(params) {
+  const pageSize = params.limit ?? 100;
+  const all = [];
+  let beforeId;
+  while (true) {
+    const page = await fetchReports2({ ...params, limit: pageSize, beforeId });
+    if (page.length === 0)
+      break;
+    all.push(...page);
+    if (all.length >= MAX_ALL_REPORTS2) {
+      console.warn(`Warning: reached maximum of ${MAX_ALL_REPORTS2} reports, stopping pagination`);
+      break;
+    }
+    beforeId = page[page.length - 1].id;
+    if (page.length < pageSize)
+      break;
+  }
+  return all;
+}
+async function fetchReportFiles2(params) {
+  const { apiKey, apiBaseUrl, reportId, type: type2, checkId, debug } = params;
+  if (!apiKey) {
+    throw new Error("API key is required");
+  }
+  if (reportId === undefined && !checkId) {
+    throw new Error("Either reportId or checkId is required");
+  }
+  const base = normalizeBaseUrl(apiBaseUrl);
+  const url = new URL(`${base}/checkup_report_files`);
+  if (typeof reportId === "number") {
+    url.searchParams.set("checkup_report_id", `eq.${reportId}`);
+  }
+  url.searchParams.set("order", "id.asc");
+  if (type2) {
+    url.searchParams.set("type", `eq.${type2}`);
+  }
+  if (checkId) {
+    url.searchParams.set("check_id", `eq.${checkId}`);
+  }
+  const headers = {
+    "access-token": apiKey,
+    Prefer: "return=representation",
+    "Content-Type": "application/json",
+    Connection: "close"
+  };
+  if (debug) {
+    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: GET URL: ${url.toString()}`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+  }
+  const response = await fetch(url.toString(), { method: "GET", headers });
+  if (debug) {
+    console.error(`Debug: Response status: ${response.status}`);
+  }
+  const data = await response.text();
+  if (response.ok) {
+    try {
+      return JSON.parse(data);
+    } catch {
+      throw new Error(`Failed to parse report files response: ${data}`);
+    }
+  } else {
+    throw new Error(formatHttpError("Failed to fetch report files", response.status, data));
+  }
+}
+async function fetchReportFileData2(params) {
+  const { apiKey, apiBaseUrl, reportId, type: type2, checkId, debug } = params;
+  if (!apiKey) {
+    throw new Error("API key is required");
+  }
+  if (reportId === undefined && !checkId) {
+    throw new Error("Either reportId or checkId is required");
+  }
+  const base = normalizeBaseUrl(apiBaseUrl);
+  const url = new URL(`${base}/checkup_report_file_data`);
+  if (typeof reportId === "number") {
+    url.searchParams.set("checkup_report_id", `eq.${reportId}`);
+  }
+  url.searchParams.set("order", "id.asc");
+  if (type2) {
+    url.searchParams.set("type", `eq.${type2}`);
+  }
+  if (checkId) {
+    url.searchParams.set("check_id", `eq.${checkId}`);
+  }
+  const headers = {
+    "access-token": apiKey,
+    Prefer: "return=representation",
+    "Content-Type": "application/json",
+    Connection: "close"
+  };
+  if (debug) {
+    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
+    console.error(`Debug: Resolved API base URL: ${base}`);
+    console.error(`Debug: GET URL: ${url.toString()}`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+  }
+  const response = await fetch(url.toString(), { method: "GET", headers });
+  if (debug) {
+    console.error(`Debug: Response status: ${response.status}`);
+  }
+  const data = await response.text();
+  if (response.ok) {
+    try {
+      return JSON.parse(data);
+    } catch {
+      throw new Error(`Failed to parse report file data response: ${data}`);
+    }
+  } else {
+    throw new Error(formatHttpError("Failed to fetch report file data", response.status, data));
+  }
+}
+function renderMarkdownForTerminal(md) {
+  if (!md)
     return "";
-  if (secret.length <= 8)
-    return "****";
-  if (secret.length <= 16)
-    return `${secret.slice(0, 4)}${"*".repeat(secret.length - 8)}${secret.slice(-4)}`;
-  return `${secret.slice(0, Math.min(12, secret.length - 8))}${"*".repeat(Math.max(4, secret.length - 16))}${secret.slice(-4)}`;
+  const RESET = "\x1B[0m";
+  const BOLD = "\x1B[1m";
+  const BOLD_UNDERLINE = "\x1B[1;4m";
+  const DIM = "\x1B[2m";
+  const ITALIC = "\x1B[3m";
+  const CYAN = "\x1B[36m";
+  const lines = md.split(`
+`);
+  const output = [];
+  let inCodeBlock = false;
+  for (const line of lines) {
+    if (line.trimStart().startsWith("```")) {
+      inCodeBlock = !inCodeBlock;
+      if (inCodeBlock) {
+        output.push(`${DIM}${"─".repeat(40)}${RESET}`);
+      } else {
+        output.push(`${DIM}${"─".repeat(40)}${RESET}`);
+      }
+      continue;
+    }
+    if (inCodeBlock) {
+      output.push(`${DIM}  ${line}${RESET}`);
+      continue;
+    }
+    if (/^-{3,}$/.test(line.trim()) || /^\*{3,}$/.test(line.trim()) || /^_{3,}$/.test(line.trim())) {
+      output.push(`${DIM}${"─".repeat(60)}${RESET}`);
+      continue;
+    }
+    const headingMatch = line.match(/^(#{1,6})\s+(.*)/);
+    if (headingMatch) {
+      const level = headingMatch[1].length;
+      const text = headingMatch[2];
+      if (level === 1) {
+        output.push(`${BOLD_UNDERLINE}${text}${RESET}`);
+      } else {
+        output.push(`${BOLD}${text}${RESET}`);
+      }
+      continue;
+    }
+    let formatted = line;
+    formatted = formatted.replace(/\*\*(.+?)\*\*/g, `${BOLD}$1${RESET}`);
+    formatted = formatted.replace(/__(.+?)__/g, `${BOLD}$1${RESET}`);
+    formatted = formatted.replace(/(?<!\*)\*(?!\*)(.+?)(?<!\*)\*(?!\*)/g, `${ITALIC}$1${RESET}`);
+    formatted = formatted.replace(/(?<=^|[\s(])_([^\s_](?:.*?[^\s_])?)_(?=$|[\s),.:;!?])/g, `${ITALIC}$1${RESET}`);
+    formatted = formatted.replace(/`([^`]+)`/g, `${CYAN}$1${RESET}`);
+    output.push(formatted);
+  }
+  return output.join(`
+`);
 }
-function normalizeBaseUrl2(value) {
-  const trimmed = (value || "").replace(/\/$/, "");
-  try {
-    new URL(trimmed);
-  } catch {
-    throw new Error(`Invalid base URL: ${value}`);
+
+// bin/postgres-ai.ts
+init_util();
+
+// lib/storage.ts
+import * as fs3 from "fs";
+import * as path3 from "path";
+var MAX_UPLOAD_SIZE = 500 * 1024 * 1024;
+var MAX_DOWNLOAD_SIZE = 500 * 1024 * 1024;
+var MIME_TYPES = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".svg": "image/svg+xml",
+  ".bmp": "image/bmp",
+  ".ico": "image/x-icon",
+  ".pdf": "application/pdf",
+  ".json": "application/json",
+  ".xml": "application/xml",
+  ".zip": "application/zip",
+  ".gz": "application/gzip",
+  ".tar": "application/x-tar",
+  ".csv": "text/csv",
+  ".txt": "text/plain",
+  ".log": "text/plain",
+  ".sql": "application/sql",
+  ".html": "text/html",
+  ".css": "text/css",
+  ".js": "application/javascript",
+  ".ts": "application/typescript",
+  ".md": "text/markdown",
+  ".yaml": "application/x-yaml",
+  ".yml": "application/x-yaml"
+};
+async function uploadFile(params) {
+  const { apiKey, storageBaseUrl, filePath, debug } = params;
+  if (!apiKey) {
+    throw new Error("API key is required");
+  }
+  if (!storageBaseUrl) {
+    throw new Error("storageBaseUrl is required");
+  }
+  if (!filePath) {
+    throw new Error("filePath is required");
+  }
+  const resolvedPath = path3.resolve(filePath);
+  if (!fs3.existsSync(resolvedPath)) {
+    throw new Error(`File not found: ${resolvedPath}`);
+  }
+  const stat = fs3.statSync(resolvedPath);
+  if (!stat.isFile()) {
+    throw new Error(`Not a file: ${resolvedPath}`);
+  }
+  if (stat.size > MAX_UPLOAD_SIZE) {
+    throw new Error(`File too large: ${stat.size} bytes (max ${MAX_UPLOAD_SIZE})`);
+  }
+  const base = normalizeBaseUrl(storageBaseUrl);
+  if (new URL(base).protocol === "http:") {
+    console.error("Warning: storage URL uses HTTP — API key will be sent unencrypted");
+  }
+  const url = `${base}/upload`;
+  const fileBuffer = fs3.readFileSync(resolvedPath);
+  const fileName = path3.basename(resolvedPath);
+  const ext = path3.extname(fileName).toLowerCase();
+  const mimeType = MIME_TYPES[ext] || "application/octet-stream";
+  const formData = new FormData;
+  formData.append("file", new Blob([fileBuffer], { type: mimeType }), fileName);
+  const headers = {
+    "access-token": apiKey
+  };
+  if (debug) {
+    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
+    console.error(`Debug: Storage base URL: ${base}`);
+    console.error(`Debug: POST URL: ${url}`);
+    console.error(`Debug: File: ${resolvedPath} (${stat.size} bytes, ${mimeType})`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+  }
+  const response = await fetch(url, {
+    method: "POST",
+    headers,
+    body: formData
+  });
+  if (debug) {
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+  }
+  const data = await response.text();
+  if (response.ok) {
+    try {
+      return JSON.parse(data);
+    } catch {
+      throw new Error(`Failed to parse upload response: ${data}`);
+    }
+  } else {
+    throw new Error(formatHttpError("Failed to upload file", response.status, data));
   }
-  return trimmed;
 }
-function resolveBaseUrls2(opts, cfg, defaults2 = {}) {
-  const defApi = defaults2.apiBaseUrl || "https://postgres.ai/api/general/";
-  const defUi = defaults2.uiBaseUrl || "https://console.postgres.ai";
-  const apiCandidate = opts?.apiBaseUrl || process.env.PGAI_API_BASE_URL || cfg?.baseUrl || defApi;
-  const uiCandidate = opts?.uiBaseUrl || process.env.PGAI_UI_BASE_URL || defUi;
+async function downloadFile(params) {
+  const { apiKey, storageBaseUrl, fileUrl, outputPath, debug } = params;
+  if (!apiKey) {
+    throw new Error("API key is required");
+  }
+  if (!storageBaseUrl) {
+    throw new Error("storageBaseUrl is required");
+  }
+  if (!fileUrl) {
+    throw new Error("fileUrl is required");
+  }
+  const base = normalizeBaseUrl(storageBaseUrl);
+  if (new URL(base).protocol === "http:") {
+    console.error("Warning: storage URL uses HTTP — API key will be sent unencrypted");
+  }
+  let fullUrl;
+  if (fileUrl.startsWith("http://") || fileUrl.startsWith("https://")) {
+    if (!fileUrl.startsWith(base + "/")) {
+      throw new Error(`URL must be under storage base URL: ${base}`);
+    }
+    fullUrl = fileUrl;
+  } else {
+    const relativePath = fileUrl.startsWith("/") ? fileUrl : `/${fileUrl}`;
+    fullUrl = `${base}${relativePath}`;
+  }
+  const urlFilename = path3.basename(new URL(fullUrl).pathname);
+  if (!urlFilename) {
+    throw new Error("Cannot derive filename from URL; please specify --output");
+  }
+  const saveTo = outputPath ? path3.resolve(outputPath) : path3.resolve(urlFilename);
+  if (!outputPath) {
+    const normalizedSave = path3.normalize(saveTo);
+    if (!normalizedSave.startsWith(path3.normalize(process.cwd()))) {
+      throw new Error("Derived output path escapes current directory; please specify --output");
+    }
+  }
+  const headers = {
+    "access-token": apiKey
+  };
+  if (debug) {
+    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
+    console.error(`Debug: Storage base URL: ${base}`);
+    console.error(`Debug: GET URL: ${fullUrl}`);
+    console.error(`Debug: Output: ${saveTo}`);
+    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+  }
+  const response = await fetch(fullUrl, {
+    method: "GET",
+    headers
+  });
+  if (debug) {
+    console.error(`Debug: Response status: ${response.status}`);
+    console.error(`Debug: Response headers: ${JSON.stringify(Object.fromEntries(response.headers.entries()))}`);
+  }
+  if (!response.ok) {
+    const data = await response.text();
+    throw new Error(formatHttpError("Failed to download file", response.status, data));
+  }
+  const contentLength = response.headers.get("content-length");
+  if (contentLength && parseInt(contentLength, 10) > MAX_DOWNLOAD_SIZE) {
+    throw new Error(`File too large: ${contentLength} bytes (max ${MAX_DOWNLOAD_SIZE})`);
+  }
+  const arrayBuffer = await response.arrayBuffer();
+  const buffer = Buffer.from(arrayBuffer);
+  const parentDir = path3.dirname(saveTo);
+  if (!fs3.existsSync(parentDir)) {
+    fs3.mkdirSync(parentDir, { recursive: true });
+  }
+  fs3.writeFileSync(saveTo, buffer);
   return {
-    apiBaseUrl: normalizeBaseUrl2(apiCandidate),
-    uiBaseUrl: normalizeBaseUrl2(uiCandidate)
+    savedTo: saveTo,
+    size: buffer.length,
+    mimeType: response.headers.get("content-type")
   };
 }
+var IMAGE_EXTENSIONS = new Set([".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg", ".bmp", ".ico"]);
+function buildMarkdownLink(fileUrl, storageBaseUrl, filename) {
+  const base = normalizeBaseUrl(storageBaseUrl);
+  const normalizedFileUrl = fileUrl.startsWith("/") ? fileUrl : `/${fileUrl}`;
+  const fullUrl = fileUrl.startsWith("http://") || fileUrl.startsWith("https://") ? fileUrl : `${base}${normalizedFileUrl}`;
+  const name = filename || path3.basename(new URL(fullUrl).pathname);
+  const safeName = name.replace(/[\[\]()]/g, "\\$&");
+  const ext = path3.extname(name).toLowerCase();
+  if (IMAGE_EXTENSIONS.has(ext)) {
+    return `![${safeName}](${fullUrl})`;
+  }
+  return `[${safeName}](${fullUrl})`;
+}
 
 // lib/init.ts
 import { randomBytes } from "crypto";
 import { URL as URL2, fileURLToPath } from "url";
-import * as fs3 from "fs";
-import * as path3 from "path";
+import * as fs4 from "fs";
+import * as path4 from "path";
 var DEFAULT_MONITORING_USER = "postgres_ai_mon";
 var KNOWN_PROVIDERS = ["self-managed", "supabase"];
 var SKIP_ROLE_CREATION_PROVIDERS = ["supabase"];
@@ -24678,8 +25711,9 @@ function isSslNegotiationError(err) {
 }
 async function connectWithSslFallback(ClientClass, adminConn, verbose) {
   const tryConnect = async (config2) => {
-    const client = new ClientClass(config2);
+    const client = new ClientClass({ ...config2, connectionTimeoutMillis: 1e4 });
     await client.connect();
+    await client.query("SET statement_timeout = '30s'");
     return client;
   };
   if (!adminConn.sslFallbackEnabled) {
@@ -24694,7 +25728,7 @@ async function connectWithSslFallback(ClientClass, adminConn, verbose) {
       throw sslErr;
     }
     if (verbose) {
-      console.log("SSL connection failed, retrying without SSL...");
+      console.error("SSL connection failed, retrying without SSL...");
     }
     const noSslConfig = { ...adminConn.clientConfig, ssl: false };
     try {
@@ -24713,21 +25747,21 @@ async function connectWithSslFallback(ClientClass, adminConn, verbose) {
 }
 function sqlDir() {
   const currentFile = fileURLToPath(import.meta.url);
-  const currentDir = path3.dirname(currentFile);
+  const currentDir = path4.dirname(currentFile);
   const candidates = [
-    path3.resolve(currentDir, "..", "sql"),
-    path3.resolve(currentDir, "..", "..", "sql")
+    path4.resolve(currentDir, "..", "sql"),
+    path4.resolve(currentDir, "..", "..", "sql")
   ];
   for (const candidate of candidates) {
-    if (fs3.existsSync(candidate)) {
+    if (fs4.existsSync(candidate)) {
       return candidate;
     }
   }
   throw new Error(`SQL directory not found. Searched: ${candidates.join(", ")}`);
 }
 function loadSqlTemplate(filename) {
-  const p = path3.join(sqlDir(), filename);
-  return fs3.readFileSync(p, "utf8");
+  const p = path4.join(sqlDir(), filename);
+  return fs4.readFileSync(p, "utf8");
 }
 function applyTemplate(sql, vars) {
   return sql.replace(/\{\{([A-Z0-9_]+)\}\}/g, (_, key) => {
@@ -25148,7 +26182,12 @@ async function verifyInitSetup(params) {
     if (!schemaExistsRes.rows?.[0]?.ok) {
       missingRequired.push("USAGE on schema postgres_ai");
     }
-    const viewExistsRes = await params.client.query("select to_regclass('postgres_ai.pg_statistic') is not null as ok");
+    const viewExistsRes = await params.client.query(`
+      select case
+        when not has_schema_privilege(current_user, 'postgres_ai', 'USAGE') then null
+        else to_regclass('postgres_ai.pg_statistic') is not null
+      end as ok
+    `);
     if (!viewExistsRes.rows?.[0]?.ok) {
       missingRequired.push("view postgres_ai.pg_statistic exists");
     } else {
@@ -25232,6 +26271,119 @@ async function verifyInitSetup(params) {
     } catch {}
   }
 }
+async function checkCurrentUserPermissions(client) {
+  const sql = `
+    with permission_checks as (
+      select
+        format('connect on database %I', current_database()) as permission_name,
+        'required' as status,
+        has_database_privilege(current_user, current_database(), 'connect') as granted
+
+      union all
+
+      select
+        'pg_monitor role membership' as permission_name,
+        'required' as status,
+        -- CASE guarantees evaluation order: pg_has_role() is only called if the
+        -- pg_monitor role exists, avoiding ERROR on PostgreSQL < 10 or when dropped.
+        case
+          when not exists (select from pg_roles where rolname = 'pg_monitor')
+          then false
+          else pg_has_role(current_user, 'pg_monitor', 'member')
+        end as granted
+
+      union all
+
+      select
+        'select on pg_catalog.pg_index' as permission_name,
+        'required' as status,
+        has_table_privilege(current_user, 'pg_catalog.pg_index', 'select') as granted
+
+      union all
+
+      select
+        'postgres_ai.pg_statistic view exists' as permission_name,
+        'optional' as status,
+        case
+          when not has_schema_privilege(current_user, 'postgres_ai', 'USAGE') then null
+          else to_regclass('postgres_ai.pg_statistic') is not null
+        end as granted
+
+      union all
+
+      select
+        'select on postgres_ai.pg_statistic' as permission_name,
+        'optional' as status,
+        case
+          when not has_schema_privilege(current_user, 'postgres_ai', 'USAGE') then null
+          when to_regclass('postgres_ai.pg_statistic') is null then null
+          else has_table_privilege(current_user, 'postgres_ai.pg_statistic', 'select')
+        end as granted
+    )
+    select
+      permission_name,
+      status,
+      granted,
+      case
+        when status = 'required' and not coalesce(granted, false) then
+          case
+            when permission_name like 'connect%' then
+              format('grant connect on database %I to %I;', current_database(), current_user)
+            when permission_name = 'pg_monitor role membership' then
+              format('grant pg_monitor to %I;', current_user)
+            when permission_name like 'select on pg_catalog.pg_index' then
+              format('grant select on pg_catalog.pg_index to %I;', current_user)
+          end
+        when permission_name = 'postgres_ai.pg_statistic view exists' and granted = false then
+          '-- create postgres_ai.pg_statistic view (see setup script)'
+        when permission_name = 'select on postgres_ai.pg_statistic' and granted = false then
+          format('grant select on postgres_ai.pg_statistic to %I;', current_user)
+        else null
+      end as fix_command
+    from permission_checks
+    order by
+      case status when 'required' then 1 else 2 end,
+      permission_name;
+  `;
+  const res = await client.query(sql);
+  const rows = res.rows;
+  const missingRequired = rows.filter((r) => r.status === "required" && r.granted !== true);
+  const missingOptional = rows.filter((r) => r.status === "optional" && r.granted === false);
+  return {
+    ok: missingRequired.length === 0,
+    rows,
+    missingRequired,
+    missingOptional
+  };
+}
+function formatPermissionCheckMessages(result) {
+  const warnings = [];
+  const errors3 = [];
+  for (const row of result.missingOptional) {
+    const fix = row.fix_command ? ` Fix: ${row.fix_command}` : "";
+    warnings.push(`Warning: optional permission missing — ${row.permission_name}.${fix}`);
+  }
+  if (!result.ok) {
+    errors3.push(`Error: the database user is missing required permissions.
+`);
+    errors3.push("Missing permissions:");
+    for (const row of result.missingRequired) {
+      errors3.push(`  - ${row.permission_name}`);
+    }
+    const fixes = result.missingRequired.map((r) => r.fix_command).filter(Boolean);
+    if (fixes.length > 0) {
+      errors3.push(`
+To fix, run the following as a superuser:
+`);
+      for (const fix of fixes) {
+        errors3.push(`  ${fix}`);
+      }
+    }
+    errors3.push(`
+Alternatively, run 'postgresai prepare-db' to set up permissions automatically.`);
+  }
+  return { failed: !result.ok, warnings, errors: errors3 };
+}
 
 // lib/supabase.ts
 var SUPABASE_API_BASE = "https://api.supabase.com";
@@ -25394,6 +26546,9 @@ class SupabaseClient {
   }
 }
 async function fetchPoolerDatabaseUrl(config2, username) {
+  if (!isValidProjectRef(config2.projectRef)) {
+    throw new Error(`Invalid Supabase project reference format: "${config2.projectRef}". Expected 10-30 alphanumeric characters.`);
+  }
   const url = `${SUPABASE_API_BASE}/v1/projects/${encodeURIComponent(config2.projectRef)}/config/database/pooler`;
   const suffix = `.${config2.projectRef}`;
   const effectiveUsername = username.endsWith(suffix) ? username : `${username}${suffix}`;
@@ -25566,7 +26721,10 @@ async function verifyInitSetupViaSupabase(params) {
       missingRequired.push("USAGE on schema postgres_ai");
     }
   }
-  const viewExistsRes = await params.client.query("SELECT to_regclass('postgres_ai.pg_statistic') IS NOT NULL as ok", true);
+  const viewExistsRes = await params.client.query(`SELECT CASE
+      WHEN NOT has_schema_privilege(current_user, 'postgres_ai', 'USAGE') THEN NULL
+      ELSE to_regclass('postgres_ai.pg_statistic') IS NOT NULL
+    END as ok`, true);
   if (!viewExistsRes.rows?.[0]?.ok) {
     missingRequired.push("view postgres_ai.pg_statistic exists");
   } else {
@@ -25706,12 +26864,12 @@ function createCallbackServer(port = 0, expectedState = null, timeoutMs = 300000
   let resolveReady;
   let rejectReady;
   let serverInstance = null;
-  const promise2 = new Promise((resolve4, reject) => {
-    resolveCallback = resolve4;
+  const promise2 = new Promise((resolve5, reject) => {
+    resolveCallback = resolve5;
     rejectCallback = reject;
   });
-  const ready = new Promise((resolve4, reject) => {
-    resolveReady = resolve4;
+  const ready = new Promise((resolve5, reject) => {
+    resolveReady = resolve5;
     rejectReady = reject;
   });
   let timeoutId = null;
@@ -25897,12 +27055,13 @@ function createCallbackServer(port = 0, expectedState = null, timeoutMs = 300000
 }
 
 // bin/postgres-ai.ts
+init_util();
 import { createInterface } from "readline";
 import * as childProcess from "child_process";
 
 // lib/checkup.ts
-import * as fs4 from "fs";
-import * as path4 from "path";
+import * as fs5 from "fs";
+import * as path5 from "path";
 
 // lib/metrics-embedded.ts
 var METRICS = {
@@ -26710,6 +27869,65 @@ limit 1000
     },
     gauges: ["real_size_mib", "table_size_mib", "extra_size", "extra_pct", "fillfactor", "bloat_size", "bloat_pct", "is_na", "reltuples"],
     statement_timeout_seconds: 15
+  },
+  pg_stat_io: {
+    description: "Collects I/O statistics from the PostgreSQL `pg_stat_io` view (available in PostgreSQL 16+). Provides insights into read and write operations by backend type, including the number of operations, MiB transferred (divided by 1048576), and time spent on I/O. This metric is essential for monitoring I/O performance and identifying potential bottlenecks in disk operations. The data is aggregated by backend type with a total row included via ROLLUP.",
+    sqls: {
+      11: "; -- pg_stat_io only available in PostgreSQL 16+",
+      16: `select /* pgwatch_generated */
+    (extract(epoch from now()) * 1e9)::int8 as epoch_ns,
+    current_database() as tag_datname,
+    coalesce(backend_type, 'total') as tag_backend_type,
+    sum(coalesce(reads, 0))::int8 as reads,
+    (sum(coalesce(reads, 0) * op_bytes) / 1048576.0)::int8 as read_bytes_mb,
+    sum(coalesce(read_time, 0))::int8 as read_time_ms,
+    sum(coalesce(writes, 0))::int8 as writes,
+    (sum(coalesce(writes, 0) * op_bytes) / 1048576.0)::int8 as write_bytes_mb,
+    sum(coalesce(write_time, 0))::int8 as write_time_ms,
+    sum(coalesce(writebacks, 0))::int8 as writebacks,
+    (sum(coalesce(writebacks, 0) * op_bytes) / 1048576.0)::int8 as writeback_bytes_mb,
+    sum(coalesce(writeback_time, 0))::int8 as writeback_time_ms,
+    sum(coalesce(fsyncs, 0))::int8 as fsyncs,
+    sum(coalesce(fsync_time, 0))::int8 as fsync_time_ms,
+    sum(coalesce(extends, 0))::int8 as extends,
+    (sum(coalesce(extends, 0) * op_bytes) / 1048576.0)::int8 as extend_bytes_mb,
+    sum(coalesce(hits, 0))::int8 as hits,
+    sum(coalesce(evictions, 0))::int8 as evictions,
+    sum(coalesce(reuses, 0))::int8 as reuses,
+    max(extract(epoch from now() - stats_reset)::int) as stats_reset_s
+from
+    pg_stat_io
+group by
+    rollup (backend_type)`,
+      18: `select /* pgwatch_generated */
+    (extract(epoch from now()) * 1e9)::int8 as epoch_ns,
+    current_database() as tag_datname,
+    coalesce(backend_type, 'total') as tag_backend_type,
+    sum(coalesce(reads, 0))::int8 as reads,
+    (sum(coalesce(read_bytes, 0)) / 1048576.0)::int8 as read_bytes_mb,
+    sum(coalesce(read_time, 0))::int8 as read_time_ms,
+    sum(coalesce(writes, 0))::int8 as writes,
+    (sum(coalesce(write_bytes, 0)) / 1048576.0)::int8 as write_bytes_mb,
+    sum(coalesce(write_time, 0))::int8 as write_time_ms,
+    sum(coalesce(writebacks, 0))::int8 as writebacks,
+    -- PostgreSQL 18 has no writeback_bytes column; rows with NULL op_bytes contribute zero by design.
+    (sum(coalesce(writebacks, 0) * coalesce(op_bytes, 0)) / 1048576.0)::int8 as writeback_bytes_mb,
+    sum(coalesce(writeback_time, 0))::int8 as writeback_time_ms,
+    sum(coalesce(fsyncs, 0))::int8 as fsyncs,
+    sum(coalesce(fsync_time, 0))::int8 as fsync_time_ms,
+    sum(coalesce(extends, 0))::int8 as extends,
+    (sum(coalesce(extend_bytes, 0)) / 1048576.0)::int8 as extend_bytes_mb,
+    sum(coalesce(hits, 0))::int8 as hits,
+    sum(coalesce(evictions, 0))::int8 as evictions,
+    sum(coalesce(reuses, 0))::int8 as reuses,
+    max(extract(epoch from now() - stats_reset)::int) as stats_reset_s
+from
+    pg_stat_io
+group by
+    rollup (backend_type)`
+    },
+    gauges: ["*"],
+    statement_timeout_seconds: 15
   }
 };
 
@@ -26735,7 +27953,8 @@ var METRIC_NAMES = {
   settings: "settings",
   dbStats: "db_stats",
   dbSize: "db_size",
-  statsReset: "stats_reset"
+  statsReset: "stats_reset",
+  I001: "pg_stat_io"
 };
 function transformMetricRow(row) {
   const result = {};
@@ -27335,7 +28554,7 @@ function parseVersionNum(versionNum) {
     };
   } catch (err) {
     const errorMsg = err instanceof Error ? err.message : String(err);
-    console.log(`[parseVersionNum] Warning: Failed to parse "${versionNum}": ${errorMsg}`);
+    console.error(`[parseVersionNum] Warning: Failed to parse "${versionNum}": ${errorMsg}`);
     return { major: "", minor: "" };
   }
 }
@@ -27652,7 +28871,7 @@ async function getStatsReset(client, pgMajorVersion = 16) {
   } catch (err) {
     const errorMsg = err instanceof Error ? err.message : String(err);
     postmasterStartupError = `Failed to query postmaster start time: ${errorMsg}`;
-    console.log(`[getStatsReset] Warning: ${postmasterStartupError}`);
+    console.error(`[getStatsReset] Warning: ${postmasterStartupError}`);
   }
   const statsResult = {
     stats_reset_epoch: statsResetEpoch,
@@ -27705,7 +28924,7 @@ async function getRedundantIndexes(client, pgMajorVersion = 16) {
       const errorMsg = err instanceof Error ? err.message : String(err);
       const indexName = String(transformed.index_name || "unknown");
       parseError = `Failed to parse redundant_to_json: ${errorMsg}`;
-      console.log(`[H004] Warning: ${parseError} for index "${indexName}"`);
+      console.error(`[H004] Warning: ${parseError} for index "${indexName}"`);
     }
     const result2 = {
       schema_name: String(transformed.schema_name || ""),
@@ -27747,7 +28966,7 @@ function createBaseReport(checkId, checkTitle, nodeName) {
 }
 function readTextFileSafe(p) {
   try {
-    const value = fs4.readFileSync(p, "utf8").trim();
+    const value = fs5.readFileSync(p, "utf8").trim();
     return value || null;
   } catch {
     return null;
@@ -27760,8 +28979,8 @@ function resolveBuildTs() {
   if (fromFile)
     return fromFile;
   try {
-    const pkgRoot = path4.resolve(__dirname, "..");
-    const fromPkgFile = readTextFileSafe(path4.join(pkgRoot, "BUILD_TS"));
+    const pkgRoot = path5.resolve(__dirname, "..");
+    const fromPkgFile = readTextFileSafe(path5.join(pkgRoot, "BUILD_TS"));
     if (fromPkgFile)
       return fromPkgFile;
   } catch (err) {
@@ -27769,13 +28988,13 @@ function resolveBuildTs() {
     console.warn(`[resolveBuildTs] Warning: path resolution failed: ${errorMsg}`);
   }
   try {
-    const pkgJsonPath = path4.resolve(__dirname, "..", "package.json");
-    const st = fs4.statSync(pkgJsonPath);
+    const pkgJsonPath = path5.resolve(__dirname, "..", "package.json");
+    const st = fs5.statSync(pkgJsonPath);
     return st.mtime.toISOString();
   } catch (err) {
     if (process.env.DEBUG) {
       const errorMsg = err instanceof Error ? err.message : String(err);
-      console.log(`[resolveBuildTs] Could not stat package.json, using current time: ${errorMsg}`);
+      console.error(`[resolveBuildTs] Could not stat package.json, using current time: ${errorMsg}`);
     }
     return new Date().toISOString();
   }
@@ -27885,7 +29104,7 @@ async function generateD004(client, nodeName) {
     }
   } catch (err) {
     const errorMsg = err instanceof Error ? err.message : String(err);
-    console.log(`[D004] Error querying pg_stat_statements: ${errorMsg}`);
+    console.error(`[D004] Error querying pg_stat_statements: ${errorMsg}`);
     pgssError = errorMsg;
   }
   let kcacheAvailable = false;
@@ -27931,7 +29150,7 @@ async function generateD004(client, nodeName) {
     }
   } catch (err) {
     const errorMsg = err instanceof Error ? err.message : String(err);
-    console.log(`[D004] Error querying pg_stat_kcache: ${errorMsg}`);
+    console.error(`[D004] Error querying pg_stat_kcache: ${errorMsg}`);
     kcacheError = errorMsg;
   }
   report.results[nodeName] = {
@@ -28042,7 +29261,10 @@ async function generateF004(client, nodeName) {
     });
   } catch (err) {
     const errorMsg = err instanceof Error ? err.message : String(err);
-    console.log(`[F004] Error estimating table bloat: ${errorMsg}`);
+    console.error(`[F004] Error estimating table bloat: ${errorMsg}`);
+    if (errorMsg.includes("postgres_ai.")) {
+      console.error(`  Hint: Run "postgresai prepare-db <connection>" to create required objects.`);
+    }
   }
   const { datname: dbName, size_bytes: dbSizeBytes } = await getCurrentDatabaseInfo(client, pgMajorVersion);
   const totalCount = bloatedTables.length;
@@ -28116,7 +29338,10 @@ async function generateF005(client, nodeName) {
     });
   } catch (err) {
     const errorMsg = err instanceof Error ? err.message : String(err);
-    console.log(`[F005] Error estimating index bloat: ${errorMsg}`);
+    console.error(`[F005] Error estimating index bloat: ${errorMsg}`);
+    if (errorMsg.includes("postgres_ai.")) {
+      console.error(`  Hint: Run "postgresai prepare-db <connection>" to create required objects.`);
+    }
   }
   const { datname: dbName, size_bytes: dbSizeBytes } = await getCurrentDatabaseInfo(client, pgMajorVersion);
   const totalCount = bloatedIndexes.length;
@@ -28203,7 +29428,7 @@ async function generateG001(client, nodeName) {
     }
   } catch (err) {
     const errorMsg = err instanceof Error ? err.message : String(err);
-    console.log(`[G001] Error calculating memory usage: ${errorMsg}`);
+    console.error(`[G001] Error calculating memory usage: ${errorMsg}`);
     memoryError = errorMsg;
   }
   report.results[nodeName] = {
@@ -28263,14 +29488,148 @@ async function generateG003(client, nodeName) {
     }
   } catch (err) {
     const errorMsg = err instanceof Error ? err.message : String(err);
-    console.log(`[G003] Error querying deadlock stats: ${errorMsg}`);
-    deadlockError = errorMsg;
+    console.error(`[G003] Error querying deadlock stats: ${errorMsg}`);
+    deadlockError = errorMsg;
+  }
+  report.results[nodeName] = {
+    data: {
+      settings: lockSettings,
+      deadlock_stats: deadlockStats,
+      ...deadlockError && { deadlock_stats_error: deadlockError }
+    },
+    postgres_version: postgresVersion
+  };
+  return report;
+}
+async function getIOStatistics(client, pgMajorVersion = 0, metricSqlOverride) {
+  if (pgMajorVersion < 16) {
+    return [];
+  }
+  try {
+    const sql = metricSqlOverride ?? getMetricSql(METRIC_NAMES.I001, pgMajorVersion);
+    if (!sql || sql.trim().startsWith(";")) {
+      return [];
+    }
+    const result = await client.query(sql);
+    return result.rows.map((row) => {
+      const transformed = transformMetricRow(row);
+      return {
+        backend_type: String(transformed.backend_type || "unknown"),
+        reads: parseInt(String(transformed.reads || 0), 10),
+        read_bytes_mb: parseInt(String(transformed.read_bytes_mb || 0), 10),
+        read_time_ms: parseInt(String(transformed.read_time_ms || 0), 10),
+        writes: parseInt(String(transformed.writes || 0), 10),
+        write_bytes_mb: parseInt(String(transformed.write_bytes_mb || 0), 10),
+        write_time_ms: parseInt(String(transformed.write_time_ms || 0), 10),
+        writebacks: parseInt(String(transformed.writebacks || 0), 10),
+        writeback_bytes_mb: parseInt(String(transformed.writeback_bytes_mb || 0), 10),
+        writeback_time_ms: parseInt(String(transformed.writeback_time_ms || 0), 10),
+        fsyncs: parseInt(String(transformed.fsyncs || 0), 10),
+        fsync_time_ms: parseInt(String(transformed.fsync_time_ms || 0), 10),
+        extends: parseInt(String(transformed.extends || 0), 10),
+        extend_bytes_mb: parseInt(String(transformed.extend_bytes_mb || 0), 10),
+        hits: parseInt(String(transformed.hits || 0), 10),
+        evictions: parseInt(String(transformed.evictions || 0), 10),
+        reuses: parseInt(String(transformed.reuses || 0), 10)
+      };
+    });
+  } catch (err) {
+    const errorMsg = err instanceof Error ? err.message : String(err);
+    console.log(`[I001] Error fetching I/O statistics: ${errorMsg}`);
+    return [];
+  }
+}
+async function generateI001(client, nodeName) {
+  const report = createBaseReport("I001", "I/O statistics (pg_stat_io)", nodeName);
+  const postgresVersion = await getPostgresVersion(client);
+  const parsedPgMajorVersion = parseInt(postgresVersion.server_major_ver, 10);
+  const pgMajorVersion = Number.isFinite(parsedPgMajorVersion) ? parsedPgMajorVersion : 0;
+  if (pgMajorVersion < 16) {
+    report.results[nodeName] = {
+      data: {
+        available: false,
+        min_version_required: "16",
+        by_backend_type: [],
+        analysis: {
+          total_read_mb: 0,
+          total_write_mb: 0,
+          total_io_time_ms: 0,
+          read_hit_ratio_pct: 0,
+          avg_read_time_ms: null,
+          avg_write_time_ms: null
+        },
+        stats_reset_s: null
+      },
+      postgres_version: postgresVersion
+    };
+    return report;
+  }
+  const ioStats = await getIOStatistics(client, pgMajorVersion);
+  ioStats.sort((a, b) => {
+    if (a.backend_type === "total")
+      return -1;
+    if (b.backend_type === "total")
+      return 1;
+    return a.backend_type.localeCompare(b.backend_type);
+  });
+  let totalStats = ioStats.find((s) => s.backend_type === "total");
+  if (!totalStats && ioStats.length > 0) {
+    totalStats = {
+      backend_type: "total",
+      reads: ioStats.reduce((sum, s) => sum + s.reads, 0),
+      read_bytes_mb: ioStats.reduce((sum, s) => sum + s.read_bytes_mb, 0),
+      read_time_ms: ioStats.reduce((sum, s) => sum + s.read_time_ms, 0),
+      writes: ioStats.reduce((sum, s) => sum + s.writes, 0),
+      write_bytes_mb: ioStats.reduce((sum, s) => sum + s.write_bytes_mb, 0),
+      write_time_ms: ioStats.reduce((sum, s) => sum + s.write_time_ms, 0),
+      writebacks: ioStats.reduce((sum, s) => sum + s.writebacks, 0),
+      writeback_bytes_mb: ioStats.reduce((sum, s) => sum + s.writeback_bytes_mb, 0),
+      writeback_time_ms: ioStats.reduce((sum, s) => sum + s.writeback_time_ms, 0),
+      fsyncs: ioStats.reduce((sum, s) => sum + s.fsyncs, 0),
+      fsync_time_ms: ioStats.reduce((sum, s) => sum + s.fsync_time_ms, 0),
+      extends: ioStats.reduce((sum, s) => sum + (s.extends || 0), 0),
+      extend_bytes_mb: ioStats.reduce((sum, s) => sum + (s.extend_bytes_mb || 0), 0),
+      hits: ioStats.reduce((sum, s) => sum + s.hits, 0),
+      evictions: ioStats.reduce((sum, s) => sum + s.evictions, 0),
+      reuses: ioStats.reduce((sum, s) => sum + s.reuses, 0)
+    };
   }
+  const totalReadMb = totalStats?.read_bytes_mb || 0;
+  const totalWriteMb = totalStats?.write_bytes_mb || 0;
+  const totalReadTime = totalStats?.read_time_ms || 0;
+  const totalWriteTime = totalStats?.write_time_ms || 0;
+  const totalIoTimeMs = totalReadTime + totalWriteTime;
+  const totalReads = totalStats?.reads || 0;
+  const totalWrites = totalStats?.writes || 0;
+  const totalHits = totalStats?.hits || 0;
+  const totalRequests = totalHits + totalReads;
+  const readHitRatioPct = totalRequests > 0 ? Math.round(totalHits / totalRequests * 1e4) / 100 : 0;
+  const avgReadTimeMs = totalReads > 0 ? Math.round(totalReadTime / totalReads * 1000) / 1000 : null;
+  const avgWriteTimeMs = totalWrites > 0 ? Math.round(totalWriteTime / totalWrites * 1000) / 1000 : null;
+  let statsResetS = null;
+  try {
+    const resetResult = await client.query(`
+      select max(extract(epoch from now() - stats_reset)::int) as stats_reset_s
+      from pg_stat_io
+    `);
+    if (resetResult.rows.length > 0 && resetResult.rows[0].stats_reset_s !== null) {
+      const parsedStatsResetS = parseInt(resetResult.rows[0].stats_reset_s, 10);
+      statsResetS = Number.isFinite(parsedStatsResetS) ? parsedStatsResetS : null;
+    }
+  } catch (err) {}
   report.results[nodeName] = {
     data: {
-      settings: lockSettings,
-      deadlock_stats: deadlockStats,
-      ...deadlockError && { deadlock_stats_error: deadlockError }
+      available: ioStats.length > 0,
+      by_backend_type: ioStats,
+      analysis: {
+        total_read_mb: totalReadMb,
+        total_write_mb: totalWriteMb,
+        total_io_time_ms: totalIoTimeMs,
+        read_hit_ratio_pct: readHitRatioPct,
+        avg_read_time_ms: avgReadTimeMs,
+        avg_write_time_ms: avgWriteTimeMs
+      },
+      stats_reset_s: statsResetS
     },
     postgres_version: postgresVersion
   };
@@ -28291,7 +29650,8 @@ var REPORT_GENERATORS = {
   G003: generateG003,
   H001: generateH001,
   H002: generateH002,
-  H004: generateH004
+  H004: generateH004,
+  I001: generateI001
 };
 var CHECK_INFO = (() => {
   const fullMap = buildCheckInfoMap();
@@ -28327,6 +29687,7 @@ function getCheckupEntry(code) {
 }
 
 // lib/checkup-api.ts
+import * as http2 from "http";
 import * as https from "https";
 import { URL as URL3 } from "url";
 var DEFAULT_RETRY_CONFIG = {
@@ -28369,7 +29730,7 @@ async function withRetry(fn, config2 = {}, onRetry) {
       if (onRetry) {
         onRetry(attempt, err, delayMs);
       }
-      await new Promise((resolve5) => setTimeout(resolve5, delayMs));
+      await new Promise((resolve6) => setTimeout(resolve6, delayMs));
       delayMs = Math.min(delayMs * backoffMultiplier, maxDelayMs);
     }
   }
@@ -28439,7 +29800,7 @@ async function postRpc(params) {
   const controller = new AbortController;
   let timeoutId = null;
   let settled = false;
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const settledReject = (err) => {
       if (settled)
         return;
@@ -28454,9 +29815,17 @@ async function postRpc(params) {
       settled = true;
       if (timeoutId)
         clearTimeout(timeoutId);
-      resolve5(value);
+      resolve6(value);
     };
-    const req = https.request(url, {
+    if (url.protocol === "http:") {
+      const hostname = url.hostname.replace(/^\[|\]$/g, "");
+      const isLoopback = ["localhost", "127.0.0.1", "::1"].includes(hostname);
+      if (!isLoopback && process.env.CHECKUP_ALLOW_HTTP !== "1") {
+        throw new Error(`Refusing to send API key over plaintext HTTP to '${url.host}'. ` + `Use https://, a loopback hostname, or set CHECKUP_ALLOW_HTTP=1.`);
+      }
+    }
+    const transport = url.protocol === "http:" ? http2 : https;
+    const req = transport.request(url, {
       method: "POST",
       headers,
       signal: controller.signal
@@ -28826,28 +30195,23 @@ function closeReadline() {
     rl = null;
   }
 }
-async function execPromise(command) {
-  return new Promise((resolve6, reject) => {
-    childProcess.exec(command, (error2, stdout, stderr) => {
-      if (error2) {
-        const err = error2;
-        err.code = typeof error2.code === "number" ? error2.code : 1;
-        reject(err);
-      } else {
-        resolve6({ stdout, stderr });
-      }
-    });
-  });
+function stripMatchingQuotes(value) {
+  const trimmed = value.trim();
+  const quote = trimmed[0];
+  if (trimmed.length >= 2 && (quote === '"' || quote === "'") && trimmed.endsWith(quote)) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
 }
 async function execFilePromise(file, args) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     childProcess.execFile(file, args, (error2, stdout, stderr) => {
       if (error2) {
         const err = error2;
         err.code = typeof error2.code === "number" ? error2.code : 1;
         reject(err);
       } else {
-        resolve6({ stdout, stderr });
+        resolve7({ stdout, stderr });
       }
     });
   });
@@ -28888,9 +30252,9 @@ function spawn2(cmd, args, options) {
   };
 }
 async function question(prompt) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     getReadline().question(prompt, (answer) => {
-      resolve6(answer);
+      resolve7(answer);
     });
   });
 }
@@ -28901,7 +30265,7 @@ function expandHomePath(p) {
   if (s === "~")
     return os3.homedir();
   if (s.startsWith("~/") || s.startsWith("~\\")) {
-    return path5.join(os3.homedir(), s.slice(2));
+    return path6.join(os3.homedir(), s.slice(2));
   }
   return s;
 }
@@ -28950,10 +30314,10 @@ function prepareOutputDirectory(outputOpt) {
   if (!outputOpt)
     return;
   const outputDir = expandHomePath(outputOpt);
-  const outputPath = path5.isAbsolute(outputDir) ? outputDir : path5.resolve(process.cwd(), outputDir);
-  if (!fs5.existsSync(outputPath)) {
+  const outputPath = path6.isAbsolute(outputDir) ? outputDir : path6.resolve(process.cwd(), outputDir);
+  if (!fs6.existsSync(outputPath)) {
     try {
-      fs5.mkdirSync(outputPath, { recursive: true });
+      fs6.mkdirSync(outputPath, { recursive: true });
     } catch (e) {
       const errAny = e;
       const code = typeof errAny?.code === "string" ? errAny.code : "";
@@ -29032,9 +30396,10 @@ async function uploadCheckupReports(uploadCfg, reports, spinner, logUpload) {
 }
 function writeReportFiles(reports, outputPath) {
   for (const [checkId, report] of Object.entries(reports)) {
-    const filePath = path5.join(outputPath, `${checkId}.json`);
-    fs5.writeFileSync(filePath, JSON.stringify(report, null, 2), "utf8");
-    console.log(`\u2713 ${checkId}: ${filePath}`);
+    const filePath = path6.join(outputPath, `${checkId}.json`);
+    fs6.writeFileSync(filePath, JSON.stringify(report, null, 2), "utf8");
+    const title = report.checkTitle || checkId;
+    console.log(`\u2713 ${checkId} ${title}: ${filePath}`);
   }
 }
 function printUploadSummary(summary, projectWasGenerated, useStderr, reports) {
@@ -29077,7 +30442,7 @@ function getDefaultMonitoringProjectDir() {
   const override = process.env.PGAI_PROJECT_DIR;
   if (override && override.trim())
     return override.trim();
-  return path5.join(getConfigDir(), "monitoring");
+  return path6.join(getConfigDir(), "monitoring");
 }
 async function downloadText(url) {
   const controller = new AbortController;
@@ -29094,12 +30459,12 @@ async function downloadText(url) {
 }
 async function ensureDefaultMonitoringProject() {
   const projectDir = getDefaultMonitoringProjectDir();
-  const composeFile = path5.resolve(projectDir, "docker-compose.yml");
-  const instancesFile = path5.resolve(projectDir, "instances.yml");
-  if (!fs5.existsSync(projectDir)) {
-    fs5.mkdirSync(projectDir, { recursive: true, mode: 448 });
+  const composeFile = path6.resolve(projectDir, "docker-compose.yml");
+  const instancesFile = path6.resolve(projectDir, "instances.yml");
+  if (!fs6.existsSync(projectDir)) {
+    fs6.mkdirSync(projectDir, { recursive: true, mode: 448 });
   }
-  if (!fs5.existsSync(composeFile)) {
+  if (!fs6.existsSync(composeFile)) {
     const refs = [
       process.env.PGAI_PROJECT_REF,
       package_default.version,
@@ -29111,36 +30476,39 @@ async function ensureDefaultMonitoringProject() {
       const url = `https://gitlab.com/postgres-ai/postgres_ai/-/raw/${encodeURIComponent(ref)}/docker-compose.yml`;
       try {
         const text = await downloadText(url);
-        fs5.writeFileSync(composeFile, text, { encoding: "utf8", mode: 384 });
+        fs6.writeFileSync(composeFile, text, { encoding: "utf8", mode: 384 });
         break;
       } catch (err) {
         lastErr = err;
       }
     }
-    if (!fs5.existsSync(composeFile)) {
+    if (!fs6.existsSync(composeFile)) {
       const msg = lastErr instanceof Error ? lastErr.message : String(lastErr);
       throw new Error(`Failed to bootstrap docker-compose.yml: ${msg}`);
     }
   }
-  if (!fs5.existsSync(instancesFile)) {
+  if (fs6.existsSync(instancesFile) && fs6.lstatSync(instancesFile).isDirectory()) {
+    fs6.rmSync(instancesFile, { recursive: true, force: true });
+  }
+  if (!fs6.existsSync(instancesFile)) {
     const header = `# PostgreSQL instances to monitor
 ` + `# Add your instances using: pgai mon targets add <connection-string> <name>
 
 `;
-    fs5.writeFileSync(instancesFile, header, { encoding: "utf8", mode: 384 });
+    fs6.writeFileSync(instancesFile, header, { encoding: "utf8", mode: 384 });
   }
-  const pgwatchConfig = path5.resolve(projectDir, ".pgwatch-config");
-  if (!fs5.existsSync(pgwatchConfig)) {
-    fs5.writeFileSync(pgwatchConfig, "", { encoding: "utf8", mode: 384 });
+  const pgwatchConfig = path6.resolve(projectDir, ".pgwatch-config");
+  if (!fs6.existsSync(pgwatchConfig)) {
+    fs6.writeFileSync(pgwatchConfig, "", { encoding: "utf8", mode: 384 });
   }
-  const envFile = path5.resolve(projectDir, ".env");
-  if (!fs5.existsSync(envFile)) {
+  const envFile = path6.resolve(projectDir, ".env");
+  if (!fs6.existsSync(envFile)) {
     const envText = `PGAI_TAG=${package_default.version}
 # PGAI_REGISTRY=registry.gitlab.com/postgres-ai/postgres_ai
 `;
-    fs5.writeFileSync(envFile, envText, { encoding: "utf8", mode: 384 });
+    fs6.writeFileSync(envFile, envText, { encoding: "utf8", mode: 384 });
   }
-  return { fs: fs5, path: path5, projectDir, composeFile, instancesFile };
+  return { fs: fs6, path: path6, projectDir, composeFile, instancesFile };
 }
 function getConfig(opts) {
   let apiKey = opts.apiKey || process.env.PGAI_API_KEY || "";
@@ -29171,7 +30539,7 @@ function printResult(result, json2) {
   }
 }
 var program2 = new Command;
-program2.name("postgres-ai").description("PostgresAI CLI").version(package_default.version).option("--api-key <key>", "API key (overrides PGAI_API_KEY)").option("--api-base-url <url>", "API base URL for backend RPC (overrides PGAI_API_BASE_URL)").option("--ui-base-url <url>", "UI base URL for browser routes (overrides PGAI_UI_BASE_URL)");
+program2.name("postgres-ai").description("PostgresAI CLI").version(package_default.version).option("--api-key <key>", "API key (overrides PGAI_API_KEY)").option("--api-base-url <url>", "API base URL for backend RPC (overrides PGAI_API_BASE_URL)").option("--ui-base-url <url>", "UI base URL for browser routes (overrides PGAI_UI_BASE_URL)").option("--storage-base-url <url>", "Storage base URL for file uploads (overrides PGAI_STORAGE_BASE_URL)");
 program2.command("set-default-project <project>").description("store default project for checkup uploads").action(async (project) => {
   const value = (project || "").trim();
   if (!value) {
@@ -29182,6 +30550,23 @@ program2.command("set-default-project <project>").description("store default pro
   writeConfig({ defaultProject: value });
   console.log(`Default project saved: ${value}`);
 });
+program2.command("set-storage-url <url>").description("store storage base URL for file uploads").action(async (url) => {
+  const value = (url || "").trim();
+  if (!value) {
+    console.error("Error: url is required");
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    const { normalizeBaseUrl: normalizeBaseUrl3 } = await Promise.resolve().then(() => (init_util(), exports_util2));
+    const normalized = normalizeBaseUrl3(value);
+    writeConfig({ storageBaseUrl: normalized });
+    console.log(`Storage URL saved: ${normalized}`);
+  } catch {
+    console.error(`Error: invalid URL: ${value}`);
+    process.exitCode = 1;
+  }
+});
 program2.command("prepare-db [conn]").description("prepare database for monitoring: create monitoring user, required view(s), and grant permissions (idempotent)").option("--db-url <url>", "PostgreSQL connection URL (admin) to run the setup against (deprecated; pass it as positional arg)").option("-h, --host <host>", "PostgreSQL host (psql-like)").option("-p, --port <port>", "PostgreSQL port (psql-like)").option("-U, --username <username>", "PostgreSQL user (psql-like)").option("-d, --dbname <dbname>", "PostgreSQL database name (psql-like)").option("--admin-password <password>", "Admin connection password (otherwise uses PGPASSWORD if set)").option("--monitoring-user <name>", "Monitoring role name to create/update", DEFAULT_MONITORING_USER).option("--password <password>", "Monitoring role password (overrides PGAI_MON_PASSWORD)").option("--skip-optional-permissions", "Skip optional permissions (RDS/self-managed extras)", false).option("--provider <provider>", "Database provider (e.g., supabase). Affects which steps are executed.").option("--verify", "Verify that monitoring role/permissions are in place (no changes)", false).option("--reset-password", "Reset monitoring role password only (no other changes)", false).option("--print-sql", "Print SQL plan and exit (no changes applied)", false).option("--print-password", "Print generated monitoring password (DANGEROUS in CI logs)", false).option("--supabase", "Use Supabase Management API instead of direct PostgreSQL connection", false).option("--supabase-access-token <token>", "Supabase Management API access token (or SUPABASE_ACCESS_TOKEN env)").option("--supabase-project-ref <ref>", "Supabase project reference (or SUPABASE_PROJECT_REF env)").option("--json", "Output result as JSON (machine-readable)", false).addHelpText("after", [
   "",
   "Examples:",
@@ -29362,9 +30747,9 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
           } else {
             console.log("\u2713 prepare-db verify: OK");
             if (v.missingOptional.length > 0) {
-              console.log("\u26A0 Optional items missing:");
+              console.error("\u26A0 Optional items missing:");
               for (const m of v.missingOptional)
-                console.log(`- ${m}`);
+                console.error(`- ${m}`);
             }
           }
           return;
@@ -29485,9 +30870,9 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
       } else {
         console.log(opts.resetPassword ? "\u2713 prepare-db password reset completed" : "\u2713 prepare-db completed");
         if (skippedOptional.length > 0) {
-          console.log("\u26A0 Some optional steps were skipped (not supported or insufficient privileges):");
+          console.error("\u26A0 Some optional steps were skipped (not supported or insufficient privileges):");
           for (const s of skippedOptional)
-            console.log(`- ${s}`);
+            console.error(`- ${s}`);
         }
         if (process.stdout.isTTY) {
           console.log(`Applied ${applied.length} steps`);
@@ -29645,9 +31030,9 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
         } else {
           console.log(`\u2713 prepare-db verify: OK${opts.provider ? ` (provider: ${opts.provider})` : ""}`);
           if (v.missingOptional.length > 0) {
-            console.log("\u26A0 Optional items missing:");
+            console.error("\u26A0 Optional items missing:");
             for (const m of v.missingOptional)
-              console.log(`- ${m}`);
+              console.error(`- ${m}`);
           }
         }
         return;
@@ -29763,9 +31148,9 @@ program2.command("prepare-db [conn]").description("prepare database for monitori
     } else {
       console.log(opts.resetPassword ? "\u2713 prepare-db password reset completed" : "\u2713 prepare-db completed");
       if (skippedOptional.length > 0) {
-        console.log("\u26A0 Some optional steps were skipped (not supported or insufficient privileges):");
+        console.error("\u26A0 Some optional steps were skipped (not supported or insufficient privileges):");
         for (const s of skippedOptional)
-          console.log(`- ${s}`);
+          console.error(`- ${s}`);
       }
       if (process.stdout.isTTY) {
         console.log(`Applied ${applied.length} steps`);
@@ -29965,9 +31350,9 @@ program2.command("unprepare-db [conn]").description("remove monitoring setup: dr
     console.log(`Drop role: ${dropRole}`);
   }
   if (!opts.force && !jsonOutput && !shouldPrintSql) {
-    const answer = await new Promise((resolve6) => {
+    const answer = await new Promise((resolve7) => {
       const readline = getReadline();
-      readline.question(`This will remove the monitoring setup for user "${opts.monitoringUser}"${dropRole ? " and drop the role" : ""}. Continue? [y/N] `, (ans) => resolve6(ans.trim().toLowerCase()));
+      readline.question(`This will remove the monitoring setup for user "${opts.monitoringUser}"${dropRole ? " and drop the role" : ""}. Continue? [y/N] `, (ans) => resolve7(ans.trim().toLowerCase()));
     });
     if (answer !== "y" && answer !== "yes") {
       console.log("Aborted.");
@@ -30021,11 +31406,11 @@ program2.command("unprepare-db [conn]").description("remove monitoring setup: dr
         console.log("\u2713 unprepare-db completed");
         console.log(`Applied ${applied.length} steps`);
       } else {
-        console.log("\u26A0 unprepare-db completed with errors");
+        console.error("\u26A0 unprepare-db completed with errors");
         console.log(`Applied ${applied.length} steps`);
-        console.log("Errors:");
+        console.error("Errors:");
         for (const err of errors3) {
-          console.log(`  - ${err}`);
+          console.error(`  - ${err}`);
         }
         process.exitCode = 1;
       }
@@ -30174,6 +31559,20 @@ Usage: postgresai checkup ${checkId} postgresql://user@host:5432/dbname
     spinner.update("Connecting to Postgres");
     const connResult = await connectWithSslFallback(Client, adminConn);
     client = connResult.client;
+    spinner.update("Checking database permissions");
+    const permCheck = await checkCurrentUserPermissions(client);
+    const permMessages = formatPermissionCheckMessages(permCheck);
+    for (const w of permMessages.warnings) {
+      console.error(w);
+    }
+    if (permMessages.failed) {
+      spinner.stop();
+      for (const e of permMessages.errors) {
+        console.error(e);
+      }
+      process.exitCode = 1;
+      return;
+    }
     let reports;
     if (checkId === "ALL") {
       reports = await generateAllReports(client, opts.nodeName, (p) => {
@@ -30271,7 +31670,7 @@ Usage: postgresai checkup ${checkId} postgresql://user@host:5432/dbname
         }
       }
     }
-    if (shouldPrintJson) {
+    if (shouldPrintJson && !outputPath) {
       console.log(JSON.stringify(reports, null, 2));
     }
     const hadOutput = shouldPrintJson || shouldConvertMarkdown || outputPath || uploadSummary;
@@ -30324,12 +31723,12 @@ function resolvePaths() {
   const startDir = process.cwd();
   let currentDir = startDir;
   while (true) {
-    const composeFile = path5.resolve(currentDir, "docker-compose.yml");
-    if (fs5.existsSync(composeFile)) {
-      const instancesFile = path5.resolve(currentDir, "instances.yml");
-      return { fs: fs5, path: path5, projectDir: currentDir, composeFile, instancesFile };
+    const composeFile = path6.resolve(currentDir, "docker-compose.yml");
+    if (fs6.existsSync(composeFile)) {
+      const instancesFile = path6.resolve(currentDir, "instances.yml");
+      return { fs: fs6, path: path6, projectDir: currentDir, composeFile, instancesFile };
     }
-    const parentDir = path5.dirname(currentDir);
+    const parentDir = path6.dirname(currentDir);
     if (parentDir === currentDir)
       break;
     currentDir = parentDir;
@@ -30353,10 +31752,10 @@ function isDockerRunning() {
 }
 function getComposeCmd() {
   const tryCmd = (cmd, args) => spawnSync2(cmd, args, { stdio: "ignore", timeout: 5000 }).status === 0;
-  if (tryCmd("docker-compose", ["version"]))
-    return ["docker-compose"];
   if (tryCmd("docker", ["compose", "version"]))
     return ["docker", "compose"];
+  if (tryCmd("docker-compose", ["version"]))
+    return ["docker-compose"];
   return null;
 }
 function checkRunningContainers() {
@@ -30377,10 +31776,10 @@ function registerMonitoringInstance(apiKey, projectName, opts) {
   const url = `${apiBaseUrl}/rpc/monitoring_instance_register`;
   const debug = opts?.debug;
   if (debug) {
-    console.log(`
+    console.error(`
 Debug: Registering monitoring instance...`);
-    console.log(`Debug: POST ${url}`);
-    console.log(`Debug: project_name=${projectName}`);
+    console.error(`Debug: POST ${url}`);
+    console.error(`Debug: project_name=${projectName}`);
   }
   fetch(url, {
     method: "POST",
@@ -30395,26 +31794,26 @@ Debug: Registering monitoring instance...`);
     const body = await res.text().catch(() => "");
     if (!res.ok) {
       if (debug) {
-        console.log(`Debug: Monitoring registration failed: HTTP ${res.status}`);
-        console.log(`Debug: Response: ${body}`);
+        console.error(`Debug: Monitoring registration failed: HTTP ${res.status}`);
+        console.error(`Debug: Response: ${body}`);
       }
       return;
     }
     if (debug) {
-      console.log(`Debug: Monitoring registration response: ${body}`);
+      console.error(`Debug: Monitoring registration response: ${body}`);
     }
   }).catch((err) => {
     if (debug) {
-      console.log(`Debug: Monitoring registration error: ${err.message}`);
+      console.error(`Debug: Monitoring registration error: ${err.message}`);
     }
   });
 }
 function updatePgwatchConfig(configPath, updates) {
   let lines = [];
-  if (fs5.existsSync(configPath)) {
-    const stats = fs5.statSync(configPath);
+  if (fs6.existsSync(configPath)) {
+    const stats = fs6.statSync(configPath);
     if (!stats.isDirectory()) {
-      const content = fs5.readFileSync(configPath, "utf8");
+      const content = fs6.readFileSync(configPath, "utf8");
       lines = content.split(/\r?\n/).filter((l) => l.trim() !== "");
     }
   }
@@ -30426,7 +31825,7 @@ function updatePgwatchConfig(configPath, updates) {
       lines.push(`${key}=${value}`);
     }
   }
-  fs5.writeFileSync(configPath, lines.join(`
+  fs6.writeFileSync(configPath, lines.join(`
 `) + `
 `, { encoding: "utf8", mode: 384 });
 }
@@ -30456,12 +31855,12 @@ async function runCompose(args, grafanaPassword) {
   if (grafanaPassword) {
     env.GF_SECURITY_ADMIN_PASSWORD = grafanaPassword;
   } else {
-    const cfgPath = path5.resolve(projectDir, ".pgwatch-config");
-    if (fs5.existsSync(cfgPath)) {
+    const cfgPath = path6.resolve(projectDir, ".pgwatch-config");
+    if (fs6.existsSync(cfgPath)) {
       try {
-        const stats = fs5.statSync(cfgPath);
+        const stats = fs6.statSync(cfgPath);
         if (!stats.isDirectory()) {
-          const content = fs5.readFileSync(cfgPath, "utf8");
+          const content = fs6.readFileSync(cfgPath, "utf8");
           const match = content.match(/^grafana_password=([^\r\n]+)/m);
           if (match) {
             env.GF_SECURITY_ADMIN_PASSWORD = match[1].trim();
@@ -30474,17 +31873,37 @@ async function runCompose(args, grafanaPassword) {
       }
     }
   }
+  const envFilePath = path6.resolve(projectDir, ".env");
+  if (fs6.existsSync(envFilePath)) {
+    try {
+      const envContent = fs6.readFileSync(envFilePath, "utf8");
+      if (!env.VM_AUTH_USERNAME) {
+        const m = envContent.match(/^VM_AUTH_USERNAME=([^\r\n]+)/m);
+        if (m)
+          env.VM_AUTH_USERNAME = stripMatchingQuotes(m[1]);
+      }
+      if (!env.VM_AUTH_PASSWORD) {
+        const m = envContent.match(/^VM_AUTH_PASSWORD=([^\r\n]+)/m);
+        if (m)
+          env.VM_AUTH_PASSWORD = stripMatchingQuotes(m[1]);
+      }
+    } catch (err) {
+      if (process.env.DEBUG) {
+        console.warn(`Warning: Could not read VM auth from .env: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+  }
   const finalArgs = [...args];
   if (process.platform === "darwin" && args.includes("up")) {
     finalArgs.push("--scale", "self-node-exporter=0");
   }
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const child = spawn2(cmd[0], [...cmd.slice(1), "-f", composeFile, ...finalArgs], {
       stdio: "inherit",
       env,
       cwd: projectDir
     });
-    child.on("close", (code) => resolve6(code || 0));
+    child.on("close", (code) => resolve7(code || 0));
   });
 }
 program2.command("help", { isDefault: true }).description("show help").action(() => {
@@ -30501,26 +31920,38 @@ mon.command("local-install").description("install local monitoring stack (genera
 `);
   console.log(`This will install, configure, and start the monitoring system
 `);
-  const { projectDir } = await resolveOrInitPaths();
+  const { projectDir, instancesFile: instancesPath } = await resolveOrInitPaths();
   console.log(`Project directory: ${projectDir}
 `);
   if (opts.project) {
-    const cfgPath2 = path5.resolve(projectDir, ".pgwatch-config");
+    const cfgPath2 = path6.resolve(projectDir, ".pgwatch-config");
     updatePgwatchConfig(cfgPath2, { project_name: opts.project });
     console.log(`Using project name: ${opts.project}
 `);
   }
-  const envFile = path5.resolve(projectDir, ".env");
+  const envFile = path6.resolve(projectDir, ".env");
   let existingRegistry = null;
   let existingPassword = null;
-  if (fs5.existsSync(envFile)) {
-    const existingEnv = fs5.readFileSync(envFile, "utf8");
+  let existingReplicatorPassword = null;
+  let existingVmAuthUsername = null;
+  let existingVmAuthPassword = null;
+  if (fs6.existsSync(envFile)) {
+    const existingEnv = fs6.readFileSync(envFile, "utf8");
     const registryMatch = existingEnv.match(/^PGAI_REGISTRY=(.+)$/m);
     if (registryMatch)
       existingRegistry = registryMatch[1].trim();
     const pwdMatch = existingEnv.match(/^GF_SECURITY_ADMIN_PASSWORD=(.+)$/m);
     if (pwdMatch)
       existingPassword = pwdMatch[1].trim();
+    const replicatorPwdMatch = existingEnv.match(/^REPLICATOR_PASSWORD=(.+)$/m);
+    if (replicatorPwdMatch)
+      existingReplicatorPassword = replicatorPwdMatch[1].trim();
+    const vmAuthUserMatch = existingEnv.match(/^VM_AUTH_USERNAME=(.+)$/m);
+    if (vmAuthUserMatch)
+      existingVmAuthUsername = stripMatchingQuotes(vmAuthUserMatch[1]);
+    const vmAuthPasswordMatch = existingEnv.match(/^VM_AUTH_PASSWORD=(.+)$/m);
+    if (vmAuthPasswordMatch)
+      existingVmAuthPassword = stripMatchingQuotes(vmAuthPasswordMatch[1]);
   }
   const imageTag = opts.tag || package_default.version;
   const envLines = [`PGAI_TAG=${imageTag}`];
@@ -30530,7 +31961,10 @@ mon.command("local-install").description("install local monitoring stack (genera
   if (existingPassword) {
     envLines.push(`GF_SECURITY_ADMIN_PASSWORD=${existingPassword}`);
   }
-  fs5.writeFileSync(envFile, envLines.join(`
+  envLines.push(`REPLICATOR_PASSWORD=${existingReplicatorPassword || crypto2.randomBytes(32).toString("hex")}`);
+  envLines.push(`VM_AUTH_USERNAME=${existingVmAuthUsername || "vmauth"}`);
+  envLines.push(`VM_AUTH_PASSWORD=${existingVmAuthPassword || crypto2.randomBytes(18).toString("base64")}`);
+  fs6.writeFileSync(envFile, envLines.join(`
 `) + `
 `, { encoding: "utf8", mode: 384 });
   if (opts.tag) {
@@ -30538,8 +31972,8 @@ mon.command("local-install").description("install local monitoring stack (genera
 `);
   }
   if (opts.demo && opts.dbUrl) {
-    console.log("\u26A0 Both --demo and --db-url provided. Demo mode includes its own database.");
-    console.log(`\u26A0 The --db-url will be ignored in demo mode.
+    console.error("\u26A0 Both --demo and --db-url provided. Demo mode includes its own database.");
+    console.error(`\u26A0 The --db-url will be ignored in demo mode.
 `);
     opts.dbUrl = undefined;
   }
@@ -30554,7 +31988,7 @@ Use demo mode without API key: postgres-ai mon local-install --demo`);
   }
   const { running, containers } = checkRunningContainers();
   if (running) {
-    console.log(`\u26A0 Monitoring services are already running: ${containers.join(", ")}`);
+    console.error(`\u26A0 Monitoring services are already running: ${containers.join(", ")}`);
     console.log(`Use 'postgres-ai mon restart' to restart them
 `);
     return;
@@ -30566,12 +32000,12 @@ Use demo mode without API key: postgres-ai mon local-install --demo`);
     if (apiKey) {
       console.log("Using API key provided via --api-key parameter");
       writeConfig({ apiKey });
-      updatePgwatchConfig(path5.resolve(projectDir, ".pgwatch-config"), { api_key: apiKey });
+      updatePgwatchConfig(path6.resolve(projectDir, ".pgwatch-config"), { api_key: apiKey });
       console.log(`\u2713 API key saved
 `);
     } else if (opts.yes) {
       console.log("Auto-yes mode: no API key provided, skipping API key setup");
-      console.log("\u26A0 Reports will be generated locally only");
+      console.error("\u26A0 Reports will be generated locally only");
       console.log(`You can add an API key later with: postgres-ai add-key <api_key>
 `);
     } else {
@@ -30583,23 +32017,23 @@ Use demo mode without API key: postgres-ai mon local-install --demo`);
           const trimmedKey = inputApiKey.trim();
           if (trimmedKey) {
             writeConfig({ apiKey: trimmedKey });
-            updatePgwatchConfig(path5.resolve(projectDir, ".pgwatch-config"), { api_key: trimmedKey });
+            updatePgwatchConfig(path6.resolve(projectDir, ".pgwatch-config"), { api_key: trimmedKey });
             apiKey = trimmedKey;
             console.log(`\u2713 API key saved
 `);
             break;
           }
-          console.log("\u26A0 API key cannot be empty");
+          console.error("\u26A0 API key cannot be empty");
           const retry = await question("Try again or skip API key setup, retry? (Y/n): ");
           if (retry.toLowerCase() === "n") {
-            console.log("\u26A0 Skipping API key setup - reports will be generated locally only");
+            console.error("\u26A0 Skipping API key setup - reports will be generated locally only");
             console.log(`You can add an API key later with: postgres-ai add-key <api_key>
 `);
             break;
           }
         }
       } else {
-        console.log("\u26A0 Skipping API key setup - reports will be generated locally only");
+        console.error("\u26A0 Skipping API key setup - reports will be generated locally only");
         console.log(`You can add an API key later with: postgres-ai add-key <api_key>
 `);
       }
@@ -30612,13 +32046,13 @@ Use demo mode without API key: postgres-ai mon local-install --demo`);
   if (!opts.demo) {
     console.log(`Step 2: Add PostgreSQL Instance to Monitor
 `);
-    const { instancesFile: instancesPath, projectDir: projectDir2 } = await resolveOrInitPaths();
+    const { instancesFile: instancesPath2, projectDir: projectDir2 } = await resolveOrInitPaths();
     const emptyInstancesContent = `# PostgreSQL instances to monitor
 # Add your instances using: postgres-ai mon targets add
 
 `;
-    fs5.writeFileSync(instancesPath, emptyInstancesContent, "utf8");
-    console.log(`Instances file: ${instancesPath}`);
+    fs6.writeFileSync(instancesPath2, emptyInstancesContent, "utf8");
+    console.log(`Instances file: ${instancesPath2}`);
     console.log(`Project directory: ${projectDir2}
 `);
     if (opts.dbUrl) {
@@ -30649,26 +32083,31 @@ Use demo mode without API key: postgres-ai mon local-install --demo`);
     node_name: ${instanceName}
     sink_type: ~sink_type~
 `;
-      fs5.appendFileSync(instancesPath, body, "utf8");
+      fs6.appendFileSync(instancesPath2, body, "utf8");
       console.log(`\u2713 Monitoring target '${instanceName}' added
 `);
       console.log("Testing connection to the added instance...");
-      try {
-        const client = new Client({ connectionString: connStr });
-        await client.connect();
-        const result = await client.query("select version();");
-        console.log("\u2713 Connection successful");
-        console.log(`${result.rows[0].version}
+      {
+        let testClient = null;
+        try {
+          testClient = new Client({ connectionString: connStr, connectionTimeoutMillis: 1e4 });
+          await testClient.connect();
+          const result = await testClient.query("select version();");
+          console.log("\u2713 Connection successful");
+          console.log(`${result.rows[0].version}
 `);
-        await client.end();
-      } catch (error2) {
-        const message = error2 instanceof Error ? error2.message : String(error2);
-        console.error(`\u2717 Connection failed: ${message}
+        } catch (error2) {
+          const message = error2 instanceof Error ? error2.message : String(error2);
+          console.error(`\u2717 Connection failed: ${message}
 `);
+        } finally {
+          if (testClient)
+            await testClient.end();
+        }
       }
     } else if (opts.yes) {
       console.log("Auto-yes mode: no database URL provided, skipping database setup");
-      console.log("\u26A0 No PostgreSQL instance added");
+      console.error("\u26A0 No PostgreSQL instance added");
       console.log(`You can add one later with: postgres-ai mon targets add
 `);
     } else {
@@ -30686,7 +32125,7 @@ You can provide either:`);
           const m = connStr.match(/^postgresql:\/\/([^:]+):([^@]+)@([^:\/]+)(?::(\d+))?\/(.+)$/);
           if (!m) {
             console.error("\u2717 Invalid connection string format");
-            console.log(`\u26A0 Continuing without adding instance
+            console.error(`\u26A0 Continuing without adding instance
 `);
           } else {
             const host = m[3];
@@ -30704,36 +32143,59 @@ You can provide either:`);
     node_name: ${instanceName}
     sink_type: ~sink_type~
 `;
-            fs5.appendFileSync(instancesPath, body, "utf8");
+            fs6.appendFileSync(instancesPath2, body, "utf8");
             console.log(`\u2713 Monitoring target '${instanceName}' added
 `);
             console.log("Testing connection to the added instance...");
-            try {
-              const client = new Client({ connectionString: connStr });
-              await client.connect();
-              const result = await client.query("select version();");
-              console.log("\u2713 Connection successful");
-              console.log(`${result.rows[0].version}
+            {
+              let testClient = null;
+              try {
+                testClient = new Client({ connectionString: connStr, connectionTimeoutMillis: 1e4 });
+                await testClient.connect();
+                const result = await testClient.query("select version();");
+                console.log("\u2713 Connection successful");
+                console.log(`${result.rows[0].version}
 `);
-              await client.end();
-            } catch (error2) {
-              const message = error2 instanceof Error ? error2.message : String(error2);
-              console.error(`\u2717 Connection failed: ${message}
+              } catch (error2) {
+                const message = error2 instanceof Error ? error2.message : String(error2);
+                console.error(`\u2717 Connection failed: ${message}
 `);
+              } finally {
+                if (testClient)
+                  await testClient.end();
+              }
             }
           }
         } else {
-          console.log(`\u26A0 No PostgreSQL instance added - you can add one later with: postgres-ai mon targets add
+          console.error(`\u26A0 No PostgreSQL instance added - you can add one later with: postgres-ai mon targets add
 `);
         }
       } else {
-        console.log(`\u26A0 No PostgreSQL instance added - you can add one later with: postgres-ai mon targets add
+        console.error(`\u26A0 No PostgreSQL instance added - you can add one later with: postgres-ai mon targets add
 `);
       }
     }
   } else {
-    console.log(`Step 2: Demo mode enabled - using included demo PostgreSQL database
+    console.log("Step 2: Demo mode enabled - using included demo PostgreSQL database");
+    const currentDir = path6.dirname(fileURLToPath2(import.meta.url));
+    const demoCandidates = [
+      path6.resolve(currentDir, "..", "..", "instances.demo.yml"),
+      path6.resolve(currentDir, "..", "..", "..", "instances.demo.yml")
+    ];
+    const demoSrc = demoCandidates.find((p) => fs6.existsSync(p));
+    if (demoSrc) {
+      if (fs6.existsSync(instancesPath) && fs6.lstatSync(instancesPath).isDirectory()) {
+        fs6.rmSync(instancesPath, { recursive: true, force: true });
+      }
+      fs6.copyFileSync(demoSrc, instancesPath);
+      console.log(`\u2713 Demo monitoring target configured
 `);
+    } else {
+      console.error(`Error: instances.demo.yml not found \u2014 cannot configure demo target.
+Searched: ${demoCandidates.join(", ")}
+`);
+      process.exit(1);
+    }
   }
   console.log(opts.demo ? "Step 3: Updating configuration..." : "Step 3: Updating configuration...");
   const code1 = await runCompose(["run", "--rm", "sources-generator"]);
@@ -30744,13 +32206,15 @@ You can provide either:`);
   console.log(`\u2713 Configuration updated
 `);
   console.log(opts.demo ? "Step 4: Configuring Grafana security..." : "Step 4: Configuring Grafana security...");
-  const cfgPath = path5.resolve(projectDir, ".pgwatch-config");
+  const cfgPath = path6.resolve(projectDir, ".pgwatch-config");
   let grafanaPassword = "";
+  let vmAuthUsername = "";
+  let vmAuthPassword = "";
   try {
-    if (fs5.existsSync(cfgPath)) {
-      const stats = fs5.statSync(cfgPath);
+    if (fs6.existsSync(cfgPath)) {
+      const stats = fs6.statSync(cfgPath);
       if (!stats.isDirectory()) {
-        const content = fs5.readFileSync(cfgPath, "utf8");
+        const content = fs6.readFileSync(cfgPath, "utf8");
         const match = content.match(/^grafana_password=([^\r\n]+)/m);
         if (match) {
           grafanaPassword = match[1].trim();
@@ -30759,30 +32223,67 @@ You can provide either:`);
     }
     if (!grafanaPassword) {
       console.log("Generating secure Grafana password...");
-      const { stdout: password } = await execPromise(`openssl rand -base64 12 | tr -d '
-'`);
-      grafanaPassword = password.trim();
+      const { stdout: password } = await execFilePromise("openssl", ["rand", "-base64", "12"]);
+      grafanaPassword = password.trim().replace(/\n/g, "");
       let configContent = "";
-      if (fs5.existsSync(cfgPath)) {
-        const stats = fs5.statSync(cfgPath);
+      if (fs6.existsSync(cfgPath)) {
+        const stats = fs6.statSync(cfgPath);
         if (!stats.isDirectory()) {
-          configContent = fs5.readFileSync(cfgPath, "utf8");
+          configContent = fs6.readFileSync(cfgPath, "utf8");
         }
       }
       const lines = configContent.split(/\r?\n/).filter((l) => !/^grafana_password=/.test(l));
       lines.push(`grafana_password=${grafanaPassword}`);
-      fs5.writeFileSync(cfgPath, lines.filter(Boolean).join(`
+      fs6.writeFileSync(cfgPath, lines.filter(Boolean).join(`
 `) + `
 `, "utf8");
     }
     console.log(`\u2713 Grafana password configured
 `);
   } catch (error2) {
-    console.log("\u26A0 Could not generate Grafana password automatically");
+    console.error("\u26A0 Could not generate Grafana password automatically");
     console.log(`Using default password: demo
 `);
     grafanaPassword = "demo";
   }
+  try {
+    const envFile2 = path6.resolve(projectDir, ".env");
+    if (fs6.existsSync(envFile2)) {
+      const envContent = fs6.readFileSync(envFile2, "utf8");
+      const userMatch = envContent.match(/^VM_AUTH_USERNAME=([^\r\n]+)/m);
+      const passMatch = envContent.match(/^VM_AUTH_PASSWORD=([^\r\n]+)/m);
+      if (userMatch)
+        vmAuthUsername = stripMatchingQuotes(userMatch[1]);
+      if (passMatch)
+        vmAuthPassword = stripMatchingQuotes(passMatch[1]);
+    }
+    if (!vmAuthUsername || !vmAuthPassword) {
+      console.log("Generating VictoriaMetrics auth credentials...");
+      vmAuthUsername = vmAuthUsername || "vmauth";
+      if (!vmAuthPassword) {
+        const { stdout: vmPass } = await execFilePromise("openssl", ["rand", "-base64", "12"]);
+        vmAuthPassword = vmPass.trim().replace(/\n/g, "");
+      }
+      let envContent = "";
+      if (fs6.existsSync(envFile2)) {
+        envContent = fs6.readFileSync(envFile2, "utf8");
+      }
+      const envLines2 = envContent.split(/\r?\n/).filter((l) => !/^VM_AUTH_USERNAME=/.test(l) && !/^VM_AUTH_PASSWORD=/.test(l)).filter((l, i2, arr) => !(i2 === arr.length - 1 && l === ""));
+      envLines2.push(`VM_AUTH_USERNAME=${vmAuthUsername}`);
+      envLines2.push(`VM_AUTH_PASSWORD=${vmAuthPassword}`);
+      fs6.writeFileSync(envFile2, envLines2.join(`
+`) + `
+`, { encoding: "utf8", mode: 384 });
+    }
+    console.log(`\u2713 VictoriaMetrics auth configured
+`);
+  } catch (error2) {
+    console.error("\u26A0 Could not generate VictoriaMetrics auth credentials automatically");
+    if (process.env.DEBUG) {
+      console.warn(`  ${error2 instanceof Error ? error2.message : String(error2)}`);
+    }
+  }
+  await runCompose(["rm", "-f", "-s", "config-init"]);
   console.log("Step 5: Starting monitoring services...");
   const code2 = await runCompose(["up", "-d", "--force-recreate"], grafanaPassword);
   if (code2 !== 0) {
@@ -30830,6 +32331,9 @@ You can provide either:`);
   console.log("\uD83D\uDE80 MAIN ACCESS POINT - Start here:");
   console.log("   Grafana Dashboard: http://localhost:3000");
   console.log(`   Login: monitor / ${grafanaPassword}`);
+  if (vmAuthUsername && vmAuthPassword) {
+    console.log(`   VictoriaMetrics Auth: ${vmAuthUsername} / ${vmAuthPassword}`);
+  }
   console.log(`\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
 `);
 });
@@ -30873,7 +32377,7 @@ mon.command("stop").description("stop monitoring services").action(async () => {
   let code = await runCompose(["down", "--remove-orphans"]);
   if (code !== 0) {
     await removeOrphanedContainers();
-    await new Promise((resolve6) => setTimeout(resolve6, NETWORK_CLEANUP_DELAY_MS));
+    await new Promise((resolve7) => setTimeout(resolve7, NETWORK_CLEANUP_DELAY_MS));
     code = await runCompose(["down", "--remove-orphans"]);
   }
   if (code !== 0) {
@@ -30928,7 +32432,7 @@ mon.command("health").description("health check for monitoring services").option
     if (attempt > 1) {
       console.log(`Retrying (attempt ${attempt}/${maxAttempts})...
 `);
-      await new Promise((resolve6) => setTimeout(resolve6, 5000));
+      await new Promise((resolve7) => setTimeout(resolve7, 5000));
     }
     allHealthy = true;
     for (const service of services) {
@@ -30976,11 +32480,11 @@ mon.command("config").description("show monitoring services configuration").acti
   console.log(`Project Directory: ${projectDir}`);
   console.log(`Docker Compose File: ${composeFile}`);
   console.log(`Instances File: ${instancesFile}`);
-  if (fs5.existsSync(instancesFile)) {
+  if (fs6.existsSync(instancesFile) && !fs6.lstatSync(instancesFile).isDirectory()) {
     console.log(`
 Instances configuration:
 `);
-    const text = fs5.readFileSync(instancesFile, "utf8");
+    const text = fs6.readFileSync(instancesFile, "utf8");
     process.stdout.write(text);
     if (!/\n$/.test(text))
       console.log();
@@ -30995,19 +32499,19 @@ mon.command("update").description("update monitoring stack").action(async () =>
   console.log(`Updating PostgresAI monitoring stack...
 `);
   try {
-    const gitDir = path5.resolve(process.cwd(), ".git");
-    if (!fs5.existsSync(gitDir)) {
+    const gitDir = path6.resolve(process.cwd(), ".git");
+    if (!fs6.existsSync(gitDir)) {
       console.error("Not a git repository. Cannot update.");
       process.exitCode = 1;
       return;
     }
     console.log("Fetching latest changes...");
-    await execPromise("git fetch origin");
-    const { stdout: branch } = await execPromise("git rev-parse --abbrev-ref HEAD");
+    await execFilePromise("git", ["fetch", "origin"]);
+    const { stdout: branch } = await execFilePromise("git", ["rev-parse", "--abbrev-ref", "HEAD"]);
     const currentBranch = branch.trim();
     console.log(`Current branch: ${currentBranch}`);
     console.log("Pulling latest changes...");
-    const { stdout: pullOut } = await execPromise("git pull origin " + currentBranch);
+    const { stdout: pullOut } = await execFilePromise("git", ["pull", "origin", currentBranch]);
     console.log(pullOut);
     console.log(`
 Updating Docker images...`);
@@ -31092,7 +32596,7 @@ mon.command("clean").description("cleanup monitoring services artifacts (stops s
     if (downCode === 0) {
       console.log("\u2713 Monitoring services stopped and removed");
     } else {
-      console.log("\u26A0 Could not stop services (may not be running)");
+      console.error("\u26A0 Could not stop services (may not be running)");
     }
     await removeOrphanedContainers();
     console.log("\u2713 Removed orphaned containers");
@@ -31151,13 +32655,13 @@ mon.command("check").description("monitoring services system readiness check").a
 var targets = mon.command("targets").description("manage databases to monitor");
 targets.command("list").description("list monitoring target databases").action(async () => {
   const { instancesFile: instancesPath, projectDir } = await resolveOrInitPaths();
-  if (!fs5.existsSync(instancesPath)) {
+  if (!fs6.existsSync(instancesPath) || fs6.lstatSync(instancesPath).isDirectory()) {
     console.error(`instances.yml not found in ${projectDir}`);
     process.exitCode = 1;
     return;
   }
   try {
-    const content = fs5.readFileSync(instancesPath, "utf8");
+    const content = fs6.readFileSync(instancesPath, "utf8");
     const instances = load(content);
     if (!instances || !Array.isArray(instances) || instances.length === 0) {
       console.log("No monitoring targets configured");
@@ -31206,8 +32710,8 @@ targets.command("add [connStr] [name]").description("add monitoring target datab
   const db = m[5];
   const instanceName = name && name.trim() ? name.trim() : `${host}-${db}`.replace(/[^a-zA-Z0-9-]/g, "-");
   try {
-    if (fs5.existsSync(file)) {
-      const content2 = fs5.readFileSync(file, "utf8");
+    if (fs6.existsSync(file) && !fs6.lstatSync(file).isDirectory()) {
+      const content2 = fs6.readFileSync(file, "utf8");
       const instances = load(content2) || [];
       if (Array.isArray(instances)) {
         const exists = instances.some((inst) => inst.name === instanceName);
@@ -31219,13 +32723,18 @@ targets.command("add [connStr] [name]").description("add monitoring target datab
       }
     }
   } catch (err) {
-    const content2 = fs5.existsSync(file) ? fs5.readFileSync(file, "utf8") : "";
-    if (new RegExp(`^- name: ${instanceName}$`, "m").test(content2)) {
+    const isFile = fs6.existsSync(file) && !fs6.lstatSync(file).isDirectory();
+    const content2 = isFile ? fs6.readFileSync(file, "utf8") : "";
+    const escapedName = instanceName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    if (new RegExp(`^- name: ${escapedName}$`, "m").test(content2)) {
       console.error(`Monitoring target '${instanceName}' already exists`);
       process.exitCode = 1;
       return;
     }
   }
+  if (fs6.existsSync(file) && fs6.lstatSync(file).isDirectory()) {
+    fs6.rmSync(file, { recursive: true, force: true });
+  }
   const body = `- name: ${instanceName}
   conn_str: ${connStr}
   preset_metrics: full
@@ -31238,20 +32747,20 @@ targets.command("add [connStr] [name]").description("add monitoring target datab
     node_name: ${instanceName}
     sink_type: ~sink_type~
 `;
-  const content = fs5.existsSync(file) ? fs5.readFileSync(file, "utf8") : "";
-  fs5.appendFileSync(file, (content && !/\n$/.test(content) ? `
+  const content = fs6.existsSync(file) ? fs6.readFileSync(file, "utf8") : "";
+  fs6.appendFileSync(file, (content && !/\n$/.test(content) ? `
 ` : "") + body, "utf8");
   console.log(`Monitoring target '${instanceName}' added`);
 });
 targets.command("remove <name>").description("remove monitoring target database").action(async (name) => {
   const { instancesFile: file } = await resolveOrInitPaths();
-  if (!fs5.existsSync(file)) {
+  if (!fs6.existsSync(file) || fs6.lstatSync(file).isDirectory()) {
     console.error("instances.yml not found");
     process.exitCode = 1;
     return;
   }
   try {
-    const content = fs5.readFileSync(file, "utf8");
+    const content = fs6.readFileSync(file, "utf8");
     const instances = load(content);
     if (!instances || !Array.isArray(instances)) {
       console.error("Invalid instances.yml format");
@@ -31264,7 +32773,7 @@ targets.command("remove <name>").description("remove monitoring target database"
       process.exitCode = 1;
       return;
     }
-    fs5.writeFileSync(file, dump(filtered), "utf8");
+    fs6.writeFileSync(file, dump(filtered), "utf8");
     console.log(`Monitoring target '${name}' removed`);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -31274,13 +32783,13 @@ targets.command("remove <name>").description("remove monitoring target database"
 });
 targets.command("test <name>").description("test monitoring target database connectivity").action(async (name) => {
   const { instancesFile: instancesPath } = await resolveOrInitPaths();
-  if (!fs5.existsSync(instancesPath)) {
+  if (!fs6.existsSync(instancesPath) || fs6.lstatSync(instancesPath).isDirectory()) {
     console.error("instances.yml not found");
     process.exitCode = 1;
     return;
   }
   try {
-    const content = fs5.readFileSync(instancesPath, "utf8");
+    const content = fs6.readFileSync(instancesPath, "utf8");
     const instances = load(content);
     if (!instances || !Array.isArray(instances)) {
       console.error("Invalid instances.yml format");
@@ -31299,7 +32808,7 @@ targets.command("test <name>").description("test monitoring target database conn
       return;
     }
     console.log(`Testing connection to monitoring target '${name}'...`);
-    const client = new Client({ connectionString: instance.conn_str });
+    const client = new Client({ connectionString: instance.conn_str, connectionTimeoutMillis: 1e4 });
     try {
       await client.connect();
       const result = await client.query("select version();");
@@ -31341,8 +32850,8 @@ auth.command("login", { isDefault: true }).description("authenticate via browser
   const cfg = readConfig();
   const { apiBaseUrl, uiBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
   if (opts.debug) {
-    console.log(`Debug: Resolved API base URL: ${apiBaseUrl}`);
-    console.log(`Debug: Resolved UI base URL: ${uiBaseUrl}`);
+    console.error(`Debug: Resolved API base URL: ${apiBaseUrl}`);
+    console.error(`Debug: Resolved UI base URL: ${uiBaseUrl}`);
   }
   try {
     console.log("Starting local callback server...");
@@ -31361,8 +32870,8 @@ auth.command("login", { isDefault: true }).description("authenticate via browser
     });
     const initUrl = new URL(`${apiBaseUrl}/rpc/oauth_init`);
     if (opts.debug) {
-      console.log(`Debug: Trying to POST to: ${initUrl.toString()}`);
-      console.log(`Debug: Request data: ${initData}`);
+      console.error(`Debug: Trying to POST to: ${initUrl.toString()}`);
+      console.error(`Debug: Request data: ${initData}`);
     }
     let initResponse;
     try {
@@ -31400,7 +32909,7 @@ Please verify the --api-base-url parameter.`);
     }
     const authUrl = `${uiBaseUrl}/cli/auth?state=${encodeURIComponent(params.state)}&code_challenge=${encodeURIComponent(params.codeChallenge)}&code_challenge_method=S256&redirect_uri=${encodeURIComponent(redirectUri)}&api_url=${encodeURIComponent(apiBaseUrl)}`;
     if (opts.debug) {
-      console.log(`Debug: Auth URL: ${authUrl}`);
+      console.error(`Debug: Auth URL: ${authUrl}`);
     }
     console.log(`
 Opening browser for authentication...`);
@@ -31533,15 +33042,15 @@ To authenticate, run: pgai auth`);
 });
 auth.command("remove-key").description("remove API key").action(async () => {
   const newConfigPath = getConfigPath();
-  const hasNewConfig = fs5.existsSync(newConfigPath);
+  const hasNewConfig = fs6.existsSync(newConfigPath);
   let legacyPath;
   try {
     const { projectDir } = await resolveOrInitPaths();
-    legacyPath = path5.resolve(projectDir, ".pgwatch-config");
+    legacyPath = path6.resolve(projectDir, ".pgwatch-config");
   } catch {
-    legacyPath = path5.resolve(process.cwd(), ".pgwatch-config");
+    legacyPath = path6.resolve(process.cwd(), ".pgwatch-config");
   }
-  const hasLegacyConfig = fs5.existsSync(legacyPath) && fs5.statSync(legacyPath).isFile();
+  const hasLegacyConfig = fs6.existsSync(legacyPath) && fs6.statSync(legacyPath).isFile();
   if (!hasNewConfig && !hasLegacyConfig) {
     console.log("No API key configured");
     return;
@@ -31551,11 +33060,11 @@ auth.command("remove-key").description("remove API key").action(async () => {
   }
   if (hasLegacyConfig) {
     try {
-      const content = fs5.readFileSync(legacyPath, "utf8");
+      const content = fs6.readFileSync(legacyPath, "utf8");
       const filtered = content.split(/\r?\n/).filter((l) => !/^api_key=/.test(l)).join(`
 `).replace(/\n+$/g, `
 `);
-      fs5.writeFileSync(legacyPath, filtered, "utf8");
+      fs6.writeFileSync(legacyPath, filtered, "utf8");
     } catch (err) {
       console.warn(`Warning: Could not update legacy config: ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -31566,28 +33075,27 @@ To authenticate again, run: pgai auth`);
 });
 mon.command("generate-grafana-password").description("generate Grafana password for monitoring services").action(async () => {
   const { projectDir } = await resolveOrInitPaths();
-  const cfgPath = path5.resolve(projectDir, ".pgwatch-config");
+  const cfgPath = path6.resolve(projectDir, ".pgwatch-config");
   try {
-    const { stdout: password } = await execPromise(`openssl rand -base64 12 | tr -d '
-'`);
-    const newPassword = password.trim();
+    const { stdout: password } = await execFilePromise("openssl", ["rand", "-base64", "12"]);
+    const newPassword = password.trim().replace(/\n/g, "");
     if (!newPassword) {
       console.error("Failed to generate password");
       process.exitCode = 1;
       return;
     }
     let configContent = "";
-    if (fs5.existsSync(cfgPath)) {
-      const stats = fs5.statSync(cfgPath);
+    if (fs6.existsSync(cfgPath)) {
+      const stats = fs6.statSync(cfgPath);
       if (stats.isDirectory()) {
         console.error(".pgwatch-config is a directory, expected a file. Skipping read.");
       } else {
-        configContent = fs5.readFileSync(cfgPath, "utf8");
+        configContent = fs6.readFileSync(cfgPath, "utf8");
       }
     }
     const lines = configContent.split(/\r?\n/).filter((l) => !/^grafana_password=/.test(l));
     lines.push(`grafana_password=${newPassword}`);
-    fs5.writeFileSync(cfgPath, lines.filter(Boolean).join(`
+    fs6.writeFileSync(cfgPath, lines.filter(Boolean).join(`
 `) + `
 `, "utf8");
     console.log("\u2713 New Grafana password generated and saved");
@@ -31609,19 +33117,19 @@ Note: This command requires 'openssl' to be installed`);
 });
 mon.command("show-grafana-credentials").description("show Grafana credentials for monitoring services").action(async () => {
   const { projectDir } = await resolveOrInitPaths();
-  const cfgPath = path5.resolve(projectDir, ".pgwatch-config");
-  if (!fs5.existsSync(cfgPath)) {
+  const cfgPath = path6.resolve(projectDir, ".pgwatch-config");
+  if (!fs6.existsSync(cfgPath)) {
     console.error("Configuration file not found. Run 'postgres-ai mon local-install' first.");
     process.exitCode = 1;
     return;
   }
-  const stats = fs5.statSync(cfgPath);
+  const stats = fs6.statSync(cfgPath);
   if (stats.isDirectory()) {
     console.error(".pgwatch-config is a directory, expected a file. Cannot read credentials.");
     process.exitCode = 1;
     return;
   }
-  const content = fs5.readFileSync(cfgPath, "utf8");
+  const content = fs6.readFileSync(cfgPath, "utf8");
   const lines = content.split(/\r?\n/);
   let password = "";
   for (const line of lines) {
@@ -31641,6 +33149,18 @@ Grafana credentials:`);
   console.log("  URL:      http://localhost:3000");
   console.log("  Username: monitor");
   console.log(`  Password: ${password}`);
+  const envFile = path6.resolve(projectDir, ".env");
+  if (fs6.existsSync(envFile)) {
+    const envContent = fs6.readFileSync(envFile, "utf8");
+    const vmUser = envContent.match(/^VM_AUTH_USERNAME=([^\r\n]+)/m);
+    const vmPass = envContent.match(/^VM_AUTH_PASSWORD=([^\r\n]+)/m);
+    if (vmUser && vmPass) {
+      console.log(`
+VictoriaMetrics credentials:`);
+      console.log(`  Username: ${stripMatchingQuotes(vmUser[1])}`);
+      console.log(`  Password: ${stripMatchingQuotes(vmPass[1])}`);
+    }
+  }
   console.log("");
 });
 function interpretEscapes2(str2) {
@@ -31726,11 +33246,11 @@ issues.command("view <issueId>").description("view issue details and comments").
 });
 issues.command("post-comment <issueId> <content>").description("post a new comment to an issue").option("--parent <uuid>", "parent comment id").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (issueId, content, opts) => {
   if (opts.debug) {
-    console.log(`Debug: Original content: ${JSON.stringify(content)}`);
+    console.error(`Debug: Original content: ${JSON.stringify(content)}`);
   }
   content = interpretEscapes2(content);
   if (opts.debug) {
-    console.log(`Debug: Interpreted content: ${JSON.stringify(content)}`);
+    console.error(`Debug: Interpreted content: ${JSON.stringify(content)}`);
   }
   const spinner = createTtySpinner(process.stdout.isTTY ?? false, "Posting comment...");
   try {
@@ -31876,11 +33396,11 @@ issues.command("update <issueId>").description("update an existing issue (title/
 });
 issues.command("update-comment <commentId> <content>").description("update an existing issue comment").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (commentId, content, opts) => {
   if (opts.debug) {
-    console.log(`Debug: Original content: ${JSON.stringify(content)}`);
+    console.error(`Debug: Original content: ${JSON.stringify(content)}`);
   }
   content = interpretEscapes2(content);
   if (opts.debug) {
-    console.log(`Debug: Interpreted content: ${JSON.stringify(content)}`);
+    console.error(`Debug: Interpreted content: ${JSON.stringify(content)}`);
   }
   const rootOpts = program2.opts();
   const cfg = readConfig();
@@ -31909,6 +33429,74 @@ issues.command("update-comment <commentId> <content>").description("update an ex
     process.exitCode = 1;
   }
 });
+var issueFiles = issues.command("files").description("upload and download files for issues");
+issueFiles.command("upload <path>").description("upload a file to storage and get a markdown link").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (filePath, opts) => {
+  const spinner = createTtySpinner(process.stdout.isTTY ?? false, "Uploading file...");
+  try {
+    const rootOpts = program2.opts();
+    const cfg = readConfig();
+    const { apiKey } = getConfig(rootOpts);
+    if (!apiKey) {
+      spinner.stop();
+      console.error("API key is required. Run 'pgai auth' first or set --api-key.");
+      process.exitCode = 1;
+      return;
+    }
+    const { storageBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
+    const result = await uploadFile({
+      apiKey,
+      storageBaseUrl,
+      filePath,
+      debug: !!opts.debug
+    });
+    spinner.stop();
+    if (opts.json) {
+      printResult(result, true);
+    } else {
+      const md = buildMarkdownLink(result.url, storageBaseUrl, result.metadata.originalName);
+      const displayUrl = result.url.startsWith("/") ? `${storageBaseUrl}${result.url}` : `${storageBaseUrl}/${result.url}`;
+      console.log(`URL: ${displayUrl}`);
+      console.log(`File: ${result.metadata.originalName}`);
+      console.log(`Size: ${result.metadata.size} bytes`);
+      console.log(`Type: ${result.metadata.mimeType}`);
+      console.log(`Markdown: ${md}`);
+    }
+  } catch (err) {
+    spinner.stop();
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(message);
+    process.exitCode = 1;
+  }
+});
+issueFiles.command("download <url>").description("download a file from storage").option("-o, --output <path>", "output file path (default: derive from URL)").option("--debug", "enable debug output").action(async (fileUrl, opts) => {
+  const spinner = createTtySpinner(process.stdout.isTTY ?? false, "Downloading file...");
+  try {
+    const rootOpts = program2.opts();
+    const cfg = readConfig();
+    const { apiKey } = getConfig(rootOpts);
+    if (!apiKey) {
+      spinner.stop();
+      console.error("API key is required. Run 'pgai auth' first or set --api-key.");
+      process.exitCode = 1;
+      return;
+    }
+    const { storageBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
+    const result = await downloadFile({
+      apiKey,
+      storageBaseUrl,
+      fileUrl,
+      outputPath: opts.output,
+      debug: !!opts.debug
+    });
+    spinner.stop();
+    console.log(`Saved: ${result.savedTo}`);
+  } catch (err) {
+    spinner.stop();
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(message);
+    process.exitCode = 1;
+  }
+});
 issues.command("action-items <issueId>").description("list action items for an issue").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (issueId, opts) => {
   const spinner = createTtySpinner(process.stdout.isTTY ?? false, "Fetching action items...");
   try {
@@ -32081,6 +33669,196 @@ issues.command("update-action-item <actionItemId>").description("update an actio
     process.exitCode = 1;
   }
 });
+var reports = program2.command("reports").description("checkup reports management");
+reports.command("list").description("list checkup reports").option("--project-id <id>", "filter by project id", (v) => parseInt(v, 10)).addOption(new Option("--status <status>", "filter by status (e.g., completed)").hideHelp()).option("--limit <n>", "max number of reports to return (default: 20, max: 100)", (v) => {
+  const n = parseInt(v, 10);
+  return Number.isNaN(n) ? 20 : Math.max(1, Math.min(n, 100));
+}).option("--before <date>", "show reports created before this date (YYYY-MM-DD, DD.MM.YYYY, etc.)").option("--all", "fetch all reports (paginated automatically)").addOption(new Option("--debug", "enable debug output").hideHelp()).option("--json", "output raw JSON").action(async (opts) => {
+  const spinner = createTtySpinner(process.stdout.isTTY ?? false, "Fetching reports...");
+  try {
+    const rootOpts = program2.opts();
+    const cfg = readConfig();
+    const { apiKey } = getConfig(rootOpts);
+    if (!apiKey) {
+      spinner.stop();
+      console.error("API key is required. Run 'pgai auth' first or set --api-key.");
+      process.exitCode = 1;
+      return;
+    }
+    if (opts.all && opts.before) {
+      spinner.stop();
+      console.error("--all and --before cannot be used together");
+      process.exitCode = 1;
+      return;
+    }
+    const { apiBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
+    let result;
+    if (opts.all) {
+      result = await fetchAllReports2({
+        apiKey,
+        apiBaseUrl,
+        projectId: opts.projectId,
+        status: opts.status,
+        limit: opts.limit,
+        debug: !!opts.debug
+      });
+    } else {
+      result = await fetchReports2({
+        apiKey,
+        apiBaseUrl,
+        projectId: opts.projectId,
+        status: opts.status,
+        limit: opts.limit,
+        beforeDate: opts.before ? parseFlexibleDate2(opts.before) : undefined,
+        debug: !!opts.debug
+      });
+    }
+    spinner.stop();
+    printResult(result, opts.json);
+  } catch (err) {
+    spinner.stop();
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(message);
+    process.exitCode = 1;
+  }
+});
+reports.command("files [reportId]").description("list files of a checkup report (metadata only, no content)").option("--type <type>", "filter by file type: json, md").option("--check-id <id>", "filter by check ID (e.g., H002)").addOption(new Option("--debug", "enable debug output").hideHelp()).option("--json", "output raw JSON").action(async (reportId, opts) => {
+  const spinner = createTtySpinner(process.stdout.isTTY ?? false, "Fetching report files...");
+  try {
+    const rootOpts = program2.opts();
+    const cfg = readConfig();
+    const { apiKey } = getConfig(rootOpts);
+    if (!apiKey) {
+      spinner.stop();
+      console.error("API key is required. Run 'pgai auth' first or set --api-key.");
+      process.exitCode = 1;
+      return;
+    }
+    let numericId;
+    if (reportId !== undefined) {
+      numericId = parseInt(reportId, 10);
+      if (isNaN(numericId)) {
+        spinner.stop();
+        console.error("reportId must be a number");
+        process.exitCode = 1;
+        return;
+      }
+    }
+    if (numericId === undefined && !opts.checkId) {
+      spinner.stop();
+      console.error("Either reportId or --check-id is required");
+      process.exitCode = 1;
+      return;
+    }
+    const { apiBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
+    const result = await fetchReportFiles2({
+      apiKey,
+      apiBaseUrl,
+      reportId: numericId,
+      type: opts.type,
+      checkId: opts.checkId,
+      debug: !!opts.debug
+    });
+    spinner.stop();
+    printResult(result, opts.json);
+  } catch (err) {
+    spinner.stop();
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(message);
+    process.exitCode = 1;
+  }
+});
+reports.command("data [reportId]").description("get checkup report file data (includes content)").option("--type <type>", "filter by file type: json, md").option("--check-id <id>", "filter by check ID (e.g., H002)").option("--formatted", "render markdown with ANSI styling (experimental)").option("-o, --output <dir>", "save files to directory (uses original filenames)").addOption(new Option("--debug", "enable debug output").hideHelp()).option("--json", "output raw JSON").action(async (reportId, opts) => {
+  const spinner = createTtySpinner(process.stdout.isTTY ?? false, "Fetching report data...");
+  try {
+    const rootOpts = program2.opts();
+    const cfg = readConfig();
+    const { apiKey } = getConfig(rootOpts);
+    if (!apiKey) {
+      spinner.stop();
+      console.error("API key is required. Run 'pgai auth' first or set --api-key.");
+      process.exitCode = 1;
+      return;
+    }
+    let numericId;
+    if (reportId !== undefined) {
+      numericId = parseInt(reportId, 10);
+      if (isNaN(numericId)) {
+        spinner.stop();
+        console.error("reportId must be a number");
+        process.exitCode = 1;
+        return;
+      }
+    }
+    if (numericId === undefined && !opts.checkId) {
+      spinner.stop();
+      console.error("Either reportId or --check-id is required");
+      process.exitCode = 1;
+      return;
+    }
+    const { apiBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
+    const effectiveType = opts.type ?? (!opts.json && !opts.output ? "md" : undefined);
+    const result = await fetchReportFileData2({
+      apiKey,
+      apiBaseUrl,
+      reportId: numericId,
+      type: effectiveType,
+      checkId: opts.checkId,
+      debug: !!opts.debug
+    });
+    spinner.stop();
+    if (opts.output) {
+      const dir = path6.resolve(opts.output);
+      fs6.mkdirSync(dir, { recursive: true });
+      for (const f of result) {
+        const safeName = path6.basename(f.filename);
+        const filePath = path6.join(dir, safeName);
+        const content = f.type === "json" ? JSON.stringify(tryParseJson(f.data), null, 2) : f.data;
+        fs6.writeFileSync(filePath, content, "utf-8");
+        console.log(filePath);
+      }
+    } else if (opts.json) {
+      const processed = result.map((f) => ({
+        ...f,
+        data: f.type === "json" ? tryParseJson(f.data) : f.data
+      }));
+      printResult(processed, true);
+    } else if (opts.formatted && process.stdout.isTTY) {
+      for (const f of result) {
+        if (result.length > 1) {
+          console.log(`\x1B[1m--- ${f.filename} (${f.check_id}, ${f.type}) ---\x1B[0m`);
+        }
+        if (f.type === "md") {
+          console.log(renderMarkdownForTerminal(f.data));
+        } else if (f.type === "json") {
+          const parsed = tryParseJson(f.data);
+          console.log(typeof parsed === "string" ? parsed : JSON.stringify(parsed, null, 2));
+        } else {
+          console.log(f.data);
+        }
+      }
+    } else {
+      for (const f of result) {
+        if (result.length > 1) {
+          console.log(`--- ${f.filename} (${f.check_id}, ${f.type}) ---`);
+        }
+        console.log(f.data);
+      }
+    }
+  } catch (err) {
+    spinner.stop();
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(message);
+    process.exitCode = 1;
+  }
+});
+function tryParseJson(s) {
+  try {
+    return JSON.parse(s);
+  } catch {
+    return s;
+  }
+}
 var mcp = program2.command("mcp").description("MCP server integration");
 mcp.command("start").description("start MCP stdio server").option("--debug", "enable debug output").action(async (opts) => {
   const rootOpts = program2.opts();
@@ -32119,7 +33897,7 @@ mcp.command("install [client]").description("install MCP server configuration fo
   try {
     let pgaiPath;
     try {
-      const execPath = await execPromise("which pgai");
+      const execPath = await execFilePromise("which", ["pgai"]);
       pgaiPath = execPath.stdout.trim();
     } catch {
       pgaiPath = "pgai";
@@ -32127,7 +33905,7 @@ mcp.command("install [client]").description("install MCP server configuration fo
     if (client === "claude-code") {
       console.log("Installing PostgresAI MCP server for Claude Code...");
       try {
-        const { stdout, stderr } = await execPromise(`claude mcp add -s user postgresai ${pgaiPath} mcp start`);
+        const { stdout, stderr } = await execFilePromise("claude", ["mcp", "add", "-s", "user", "postgresai", pgaiPath, "mcp", "start"]);
         if (stdout)
           console.log(stdout);
         if (stderr)
@@ -32154,29 +33932,29 @@ mcp.command("install [client]").description("install MCP server configuration fo
     let configDir;
     switch (client) {
       case "cursor":
-        configPath = path5.join(homeDir, ".cursor", "mcp.json");
-        configDir = path5.dirname(configPath);
+        configPath = path6.join(homeDir, ".cursor", "mcp.json");
+        configDir = path6.dirname(configPath);
         break;
       case "windsurf":
-        configPath = path5.join(homeDir, ".windsurf", "mcp.json");
-        configDir = path5.dirname(configPath);
+        configPath = path6.join(homeDir, ".windsurf", "mcp.json");
+        configDir = path6.dirname(configPath);
         break;
       case "codex":
-        configPath = path5.join(homeDir, ".codex", "mcp.json");
-        configDir = path5.dirname(configPath);
+        configPath = path6.join(homeDir, ".codex", "mcp.json");
+        configDir = path6.dirname(configPath);
         break;
       default:
         console.error(`Configuration not implemented for: ${client}`);
         process.exitCode = 1;
         return;
     }
-    if (!fs5.existsSync(configDir)) {
-      fs5.mkdirSync(configDir, { recursive: true });
+    if (!fs6.existsSync(configDir)) {
+      fs6.mkdirSync(configDir, { recursive: true });
     }
     let config2 = { mcpServers: {} };
-    if (fs5.existsSync(configPath)) {
+    if (fs6.existsSync(configPath)) {
       try {
-        const content = fs5.readFileSync(configPath, "utf8");
+        const content = fs6.readFileSync(configPath, "utf8");
         config2 = JSON.parse(content);
         if (!config2.mcpServers) {
           config2.mcpServers = {};
@@ -32189,7 +33967,7 @@ mcp.command("install [client]").description("install MCP server configuration fo
       command: pgaiPath,
       args: ["mcp", "start"]
     };
-    fs5.writeFileSync(configPath, JSON.stringify(config2, null, 2), "utf8");
+    fs6.writeFileSync(configPath, JSON.stringify(config2, null, 2), "utf8");
     console.log(`\u2713 PostgresAI MCP server configured for ${client}`);
     console.log(`  Config file: ${configPath}`);
     console.log("");