postgresai 0.16.0-dev.10 → 0.16.0-dev.11

package/dist/bin/postgres-ai.js

@@ -6,43 +6,25 @@ var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-function __accessProp(key) {
-  return this[key];
-}
-var __toESMCache_node;
-var __toESMCache_esm;
 var __toESM = (mod, isNodeMode, target) => {
-  var canCache = mod != null && typeof mod === "object";
-  if (canCache) {
-    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
-    var cached = cache.get(mod);
-    if (cached)
-      return cached;
-  }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
   for (let key of __getOwnPropNames(mod))
     if (!__hasOwnProp.call(to, key))
       __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
+        get: () => mod[key],
         enumerable: true
       });
-  if (canCache)
-    cache.set(mod, to);
   return to;
 };
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, {
       get: all[name],
       enumerable: true,
       configurable: true,
-      set: __exportSetter.bind(all, name)
+      set: (newValue) => all[name] = () => newValue
     });
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
@@ -1020,7 +1002,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         this._exitCallback = (err) => {
           if (err.code !== "commander.executeSubCommandAsync") {
             throw err;
-          }
+          } else {}
         };
       }
       return this;
@@ -9980,8 +9962,8 @@ var require_utils3 = __commonJS((exports, module) => {
     }
     return ind;
   }
-  function removeDotSegments(path5) {
-    let input = path5;
+  function removeDotSegments(path4) {
+    let input = path4;
     const output = [];
     let nextSlash = -1;
     let len = 0;
@@ -10171,8 +10153,8 @@ var require_schemes = __commonJS((exports, module) => {
       wsComponent.secure = undefined;
     }
     if (wsComponent.resourceName) {
-      const [path5, query] = wsComponent.resourceName.split("?");
-      wsComponent.path = path5 && path5 !== "/" ? path5 : undefined;
+      const [path4, query] = wsComponent.resourceName.split("?");
+      wsComponent.path = path4 && path4 !== "/" ? path4 : undefined;
       wsComponent.query = query;
       wsComponent.resourceName = undefined;
     }
@@ -13106,7 +13088,7 @@ var require_formats = __commonJS((exports) => {
   }
   var TIME = /^(\d\d):(\d\d):(\d\d(?:\.\d+)?)(z|([+-])(\d\d)(?::?(\d\d))?)?$/i;
   function getTime(strictTimeZone) {
-    return function time3(str2) {
+    return function time(str2) {
       const matches = TIME.exec(str2);
       if (!matches)
         return false;
@@ -13307,12 +13289,12 @@ var require_dist2 = __commonJS((exports, module) => {
       throw new Error(`Unknown format "${name}"`);
     return f;
   };
-  function addFormats(ajv, list, fs5, exportName) {
+  function addFormats(ajv, list, fs4, exportName) {
     var _a2;
     var _b;
     (_a2 = (_b = ajv.opts.code).formats) !== null && _a2 !== undefined || (_b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`);
     for (const f of list)
-      ajv.addFormat(f, fs5[f]);
+      ajv.addFormat(f, fs4[f]);
   }
   module.exports = exports = formatsPlugin;
   Object.defineProperty(exports, "__esModule", { value: true });
@@ -13323,11 +13305,19 @@ var require_dist2 = __commonJS((exports, module) => {
 var exports_util2 = {};
 __export(exports_util2, {
   resolveBaseUrls: () => resolveBaseUrls2,
+  requestTimeoutSignal: () => requestTimeoutSignal2,
+  redactTextSecrets: () => redactTextSecrets2,
   redactSecretsForLog: () => redactSecretsForLog2,
+  redactSecrets: () => redactSecrets2,
   normalizeBaseUrl: () => normalizeBaseUrl2,
   maskSecret: () => maskSecret2,
+  isRetryableHttpStatus: () => isRetryableHttpStatus2,
+  isFetchTimeout: () => isFetchTimeout2,
   formatHttpError: () => formatHttpError2,
-  describeFetchError: () => describeFetchError2
+  describeFetchError: () => describeFetchError2,
+  HttpStatusError: () => HttpStatusError2,
+  HttpRequestTimeoutError: () => HttpRequestTimeoutError2,
+  DEFAULT_HTTP_REQUEST_TIMEOUT_MS: () => DEFAULT_HTTP_REQUEST_TIMEOUT_MS2
 });
 function isHtmlContent2(text) {
   const trimmed = text.trim();
@@ -13339,31 +13329,48 @@ function formatHttpError2(operation, status, responseBody, statusText) {
 ${AUTH_REMEDIATION_HINT2}` : "";
   let bodyMessage;
   let bodyDetails;
+  let bodyCode;
+  let bodyHint;
   if (responseBody && !isHtmlContent2(responseBody)) {
     try {
       const errObj = JSON.parse(responseBody);
       const message = errObj.message ?? errObj.error;
       if (typeof message === "string" && message.trim().length > 0) {
-        bodyMessage = message.trim();
+        bodyMessage = redactTextSecrets2(message.trim());
       }
       const details = errObj.details ?? errObj.detail;
       if (typeof details === "string" && details.trim().length > 0) {
-        bodyDetails = details.trim();
+        bodyDetails = redactTextSecrets2(details.trim());
+      }
+      if (typeof errObj.code === "string" && errObj.code.trim().length > 0) {
+        bodyCode = errObj.code.trim();
+      }
+      if (typeof errObj.hint === "string" && errObj.hint.trim().length > 0) {
+        bodyHint = redactTextSecrets2(errObj.hint.trim());
+      }
+      if (bodyMessage === undefined && bodyDetails === undefined && bodyCode === undefined && bodyHint === undefined) {
+        bodyDetails = redactSecretsForLog2(JSON.stringify(errObj));
       }
     } catch {
       const trimmed = responseBody.trim();
       if (trimmed.length > 0 && trimmed.length < 500) {
-        bodyDetails = trimmed;
+        bodyDetails = redactTextSecrets2(trimmed);
       }
     }
   }
   const trimmedReason = statusText?.trim();
   const reasonPhrase = trimmedReason && trimmedReason !== STANDARD_REASON_PHRASES2[status] && trimmedReason !== generic ? trimmedReason : undefined;
-  const headline = bodyMessage ?? reasonPhrase ?? generic;
-  let errMsg = `${operation}: HTTP ${status} - ${headline}`;
+  const safeReasonPhrase = reasonPhrase ? redactTextSecrets2(reasonPhrase) : undefined;
+  const headline = bodyMessage ?? safeReasonPhrase ?? generic;
+  const codeSuffix = bodyCode && !headline.includes(bodyCode) ? ` (${bodyCode})` : "";
+  let errMsg = `${operation}: HTTP ${status} - ${headline}${codeSuffix}`;
   if (bodyDetails && bodyDetails !== headline) {
     errMsg += `
 ${bodyDetails}`;
+  }
+  if (bodyHint) {
+    errMsg += `
+Hint: ${bodyHint}`;
   }
   return errMsg + remediation;
 }
@@ -13372,6 +13379,18 @@ function describeFetchError2(operation, url, err) {
   const detail = cause?.code || cause?.message || (err instanceof Error && err.message ? err.message : String(err));
   return `${operation}: could not reach ${url} (${detail})`;
 }
+function isRetryableHttpStatus2(status) {
+  return status >= 500 || status === 429;
+}
+function requestTimeoutSignal2(timeoutMs) {
+  const requested = typeof timeoutMs === "number" && Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : DEFAULT_HTTP_REQUEST_TIMEOUT_MS2;
+  const bounded = Math.max(1, Math.min(DEFAULT_HTTP_REQUEST_TIMEOUT_MS2, Math.floor(requested)));
+  return { signal: AbortSignal.timeout(bounded), timeoutMs: bounded };
+}
+function isFetchTimeout2(err) {
+  const name = err?.name;
+  return name === "AbortError" || name === "TimeoutError";
+}
 function maskSecret2(secret) {
   if (!secret)
     return "";
@@ -13381,27 +13400,34 @@ function maskSecret2(secret) {
     return `${secret.slice(0, 4)}${"*".repeat(secret.length - 8)}${secret.slice(-4)}`;
   return `${secret.slice(0, Math.min(12, secret.length - 8))}${"*".repeat(Math.max(4, secret.length - 16))}${secret.slice(-4)}`;
 }
+function isSensitiveLogKey2(key) {
+  const normalized = key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[-\s]+/g, "_").toLowerCase();
+  return /^(?:password|passwd|db_(?:pass|password)|conn_?str|secret|token|api_key|private_key|access_key|access_token|refresh_token|auth|auth_key|auth_token|authorization|credentials?|dsn)$/.test(normalized);
+}
+function redactSecrets2(value) {
+  if (Array.isArray(value)) {
+    return value.map(redactSecrets2);
+  }
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [key, child] of Object.entries(value)) {
+      out[key] = isSensitiveLogKey2(key) && child != null ? "[REDACTED]" : redactSecrets2(child);
+    }
+    return out;
+  }
+  return value;
+}
 function redactSecretsForLog2(text) {
   let parsed;
   try {
     parsed = JSON.parse(text);
   } catch {
-    return text;
+    return redactTextSecrets2(text);
   }
-  const walk = (node) => {
-    if (Array.isArray(node)) {
-      return node.map(walk);
-    }
-    if (node && typeof node === "object") {
-      const out = {};
-      for (const [key, value] of Object.entries(node)) {
-        out[key] = SENSITIVE_LOG_KEY2.test(key) && value != null ? "[REDACTED]" : walk(value);
-      }
-      return out;
-    }
-    return node;
-  };
-  return JSON.stringify(walk(parsed));
+  return JSON.stringify(redactSecrets2(parsed));
+}
+function redactTextSecrets2(text) {
+  return text.replace(TEXT_URL_USERINFO2, "$1:[REDACTED]@").replace(TEXT_SENSITIVE_PAIR2, "$1[REDACTED]");
 }
 function normalizeBaseUrl2(value) {
   const trimmed = (value || "").replace(/\/$/, "");
@@ -13425,7 +13451,7 @@ function resolveBaseUrls2(opts, cfg, defaults2 = {}) {
     storageBaseUrl: normalizeBaseUrl2(storageCandidate)
   };
 }
-var HTTP_STATUS_MESSAGES2, AUTH_REMEDIATION_HINT2 = "Run 'postgresai auth' to (re)authenticate, or set/update PGAI_API_KEY.", STANDARD_REASON_PHRASES2, SENSITIVE_LOG_KEY2;
+var HTTP_STATUS_MESSAGES2, AUTH_REMEDIATION_HINT2 = "Run 'postgresai auth' to (re)authenticate, or set/update PGAI_API_KEY.", STANDARD_REASON_PHRASES2, HttpStatusError2, DEFAULT_HTTP_REQUEST_TIMEOUT_MS2 = 25000, HttpRequestTimeoutError2, TEXT_URL_USERINFO2, TEXT_SENSITIVE_PAIR2;
 var init_util = __esm(() => {
   HTTP_STATUS_MESSAGES2 = {
     400: "Bad Request",
@@ -13453,7 +13479,22 @@ var init_util = __esm(() => {
     503: "Service Unavailable",
     504: "Gateway Timeout"
   };
-  SENSITIVE_LOG_KEY2 = /password|connstr/i;
+  HttpStatusError2 = class HttpStatusError2 extends Error {
+    status;
+    constructor(message, status) {
+      super(message);
+      this.name = "HttpStatusError";
+      this.status = status;
+    }
+  };
+  HttpRequestTimeoutError2 = class HttpRequestTimeoutError2 extends Error {
+    constructor(operation, timeoutMs) {
+      super(`${operation}: request timed out after ${timeoutMs}ms`);
+      this.name = "HttpRequestTimeoutError";
+    }
+  };
+  TEXT_URL_USERINFO2 = /(\b[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+):[^\s/@]+@/gi;
+  TEXT_SENSITIVE_PAIR2 = /((?:password|passwd|db[-_]?pass|connstr|secret|token|api[-_]?key|private[-_]?key|access[-_]?key|cred(?:ential)?s?|dsn)["']?\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;&]+)/gi;
 });
 
 // node_modules/commander/esm.mjs
@@ -13474,7 +13515,7 @@ var {
 // package.json
 var package_default = {
   name: "postgresai",
-  version: "0.16.0-dev.10",
+  version: "0.16.0-dev.11",
   description: "postgres_ai CLI",
   license: "Apache-2.0",
   private: false,
@@ -16285,11 +16326,11 @@ var safeLoadAll = renamed("safeLoadAll", "loadAll");
 var safeDump = renamed("safeDump", "dump");
 
 // bin/postgres-ai.ts
-import * as fs11 from "fs";
-import * as path9 from "path";
+import * as fs9 from "fs";
+import * as path7 from "path";
 import * as os3 from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import * as crypto4 from "crypto";
+import * as crypto2 from "crypto";
 
 // node_modules/pg/esm/index.mjs
 var import_lib = __toESM(require_lib2(), 1);
@@ -16305,7 +16346,7 @@ var Result = import_lib.default.Result;
 var TypeOverrides = import_lib.default.TypeOverrides;
 var defaults = import_lib.default.defaults;
 // package.json
-var version = "0.16.0-dev.10";
+var version = "0.16.0-dev.11";
 var package_default2 = {
   name: "postgresai",
   version,
@@ -16467,31 +16508,48 @@ function formatHttpError(operation, status, responseBody, statusText) {
 ${AUTH_REMEDIATION_HINT}` : "";
   let bodyMessage;
   let bodyDetails;
+  let bodyCode;
+  let bodyHint;
   if (responseBody && !isHtmlContent(responseBody)) {
     try {
       const errObj = JSON.parse(responseBody);
       const message = errObj.message ?? errObj.error;
       if (typeof message === "string" && message.trim().length > 0) {
-        bodyMessage = message.trim();
+        bodyMessage = redactTextSecrets(message.trim());
       }
       const details = errObj.details ?? errObj.detail;
       if (typeof details === "string" && details.trim().length > 0) {
-        bodyDetails = details.trim();
+        bodyDetails = redactTextSecrets(details.trim());
+      }
+      if (typeof errObj.code === "string" && errObj.code.trim().length > 0) {
+        bodyCode = errObj.code.trim();
+      }
+      if (typeof errObj.hint === "string" && errObj.hint.trim().length > 0) {
+        bodyHint = redactTextSecrets(errObj.hint.trim());
+      }
+      if (bodyMessage === undefined && bodyDetails === undefined && bodyCode === undefined && bodyHint === undefined) {
+        bodyDetails = redactSecretsForLog(JSON.stringify(errObj));
       }
     } catch {
       const trimmed = responseBody.trim();
       if (trimmed.length > 0 && trimmed.length < 500) {
-        bodyDetails = trimmed;
+        bodyDetails = redactTextSecrets(trimmed);
       }
     }
   }
   const trimmedReason = statusText?.trim();
   const reasonPhrase = trimmedReason && trimmedReason !== STANDARD_REASON_PHRASES[status] && trimmedReason !== generic ? trimmedReason : undefined;
-  const headline = bodyMessage ?? reasonPhrase ?? generic;
-  let errMsg = `${operation}: HTTP ${status} - ${headline}`;
+  const safeReasonPhrase = reasonPhrase ? redactTextSecrets(reasonPhrase) : undefined;
+  const headline = bodyMessage ?? safeReasonPhrase ?? generic;
+  const codeSuffix = bodyCode && !headline.includes(bodyCode) ? ` (${bodyCode})` : "";
+  let errMsg = `${operation}: HTTP ${status} - ${headline}${codeSuffix}`;
   if (bodyDetails && bodyDetails !== headline) {
     errMsg += `
 ${bodyDetails}`;
+  }
+  if (bodyHint) {
+    errMsg += `
+Hint: ${bodyHint}`;
   }
   return errMsg + remediation;
 }
@@ -16500,6 +16558,35 @@ function describeFetchError(operation, url, err) {
   const detail = cause?.code || cause?.message || (err instanceof Error && err.message ? err.message : String(err));
   return `${operation}: could not reach ${url} (${detail})`;
 }
+
+class HttpStatusError extends Error {
+  status;
+  constructor(message, status) {
+    super(message);
+    this.name = "HttpStatusError";
+    this.status = status;
+  }
+}
+function isRetryableHttpStatus(status) {
+  return status >= 500 || status === 429;
+}
+var DEFAULT_HTTP_REQUEST_TIMEOUT_MS = 25000;
+
+class HttpRequestTimeoutError extends Error {
+  constructor(operation, timeoutMs) {
+    super(`${operation}: request timed out after ${timeoutMs}ms`);
+    this.name = "HttpRequestTimeoutError";
+  }
+}
+function requestTimeoutSignal(timeoutMs) {
+  const requested = typeof timeoutMs === "number" && Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : DEFAULT_HTTP_REQUEST_TIMEOUT_MS;
+  const bounded = Math.max(1, Math.min(DEFAULT_HTTP_REQUEST_TIMEOUT_MS, Math.floor(requested)));
+  return { signal: AbortSignal.timeout(bounded), timeoutMs: bounded };
+}
+function isFetchTimeout(err) {
+  const name = err?.name;
+  return name === "AbortError" || name === "TimeoutError";
+}
 function maskSecret(secret) {
   if (!secret)
     return "";
@@ -16509,28 +16596,36 @@ function maskSecret(secret) {
     return `${secret.slice(0, 4)}${"*".repeat(secret.length - 8)}${secret.slice(-4)}`;
   return `${secret.slice(0, Math.min(12, secret.length - 8))}${"*".repeat(Math.max(4, secret.length - 16))}${secret.slice(-4)}`;
 }
-var SENSITIVE_LOG_KEY = /password|connstr/i;
+function isSensitiveLogKey(key) {
+  const normalized = key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[-\s]+/g, "_").toLowerCase();
+  return /^(?:password|passwd|db_(?:pass|password)|conn_?str|secret|token|api_key|private_key|access_key|access_token|refresh_token|auth|auth_key|auth_token|authorization|credentials?|dsn)$/.test(normalized);
+}
+function redactSecrets(value) {
+  if (Array.isArray(value)) {
+    return value.map(redactSecrets);
+  }
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [key, child] of Object.entries(value)) {
+      out[key] = isSensitiveLogKey(key) && child != null ? "[REDACTED]" : redactSecrets(child);
+    }
+    return out;
+  }
+  return value;
+}
 function redactSecretsForLog(text) {
   let parsed;
   try {
     parsed = JSON.parse(text);
   } catch {
-    return text;
+    return redactTextSecrets(text);
   }
-  const walk = (node) => {
-    if (Array.isArray(node)) {
-      return node.map(walk);
-    }
-    if (node && typeof node === "object") {
-      const out = {};
-      for (const [key, value] of Object.entries(node)) {
-        out[key] = SENSITIVE_LOG_KEY.test(key) && value != null ? "[REDACTED]" : walk(value);
-      }
-      return out;
-    }
-    return node;
-  };
-  return JSON.stringify(walk(parsed));
+  return JSON.stringify(redactSecrets(parsed));
+}
+var TEXT_URL_USERINFO = /(\b[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+):[^\s/@]+@/gi;
+var TEXT_SENSITIVE_PAIR = /((?:password|passwd|db[-_]?pass|connstr|secret|token|api[-_]?key|private[-_]?key|access[-_]?key|cred(?:ential)?s?|dsn)["']?\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;&]+)/gi;
+function redactTextSecrets(text) {
+  return text.replace(TEXT_URL_USERINFO, "$1:[REDACTED]@").replace(TEXT_SENSITIVE_PAIR, "$1[REDACTED]");
 }
 function normalizeBaseUrl(value) {
   const trimmed = (value || "").replace(/\/$/, "");
@@ -17363,611 +17458,9 @@ async function fetchReportFileData(params) {
   }
 }
 
-// lib/joe.ts
+// lib/storage.ts
 import * as fs3 from "fs";
 import * as path3 from "path";
-import * as crypto from "node:crypto";
-var JOE_COMMANDS = [
-  "plan",
-  "explain",
-  "exec",
-  "hypo",
-  "activity",
-  "terminate",
-  "reset",
-  "describe"
-];
-var TERMINAL_STATES = new Set([
-  "done",
-  "error",
-  "timed_out"
-]);
-var AI_ENABLED_COMMANDS = new Set([
-  "plan",
-  "explain",
-  "exec",
-  "hypo",
-  "activity",
-  "describe"
-]);
-var EXECUTING_COMMANDS = new Set([
-  "exec",
-  "explain"
-]);
-var DEFAULT_BUDGET_MS = 25000;
-var DEFAULT_POLL_INTERVAL_MS = 800;
-async function callRpc(params) {
-  const { apiKey, apiBaseUrl, fn, body, operation, debug } = params;
-  if (!apiKey) {
-    throw new Error("API key is required");
-  }
-  const base = normalizeBaseUrl(apiBaseUrl);
-  const url = new URL(`${base}/rpc/${fn}`);
-  const payload = JSON.stringify(body);
-  const headers = {
-    "access-token": apiKey,
-    "Content-Type": "application/json",
-    Connection: "close"
-  };
-  if (debug) {
-    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.error(`Debug: POST URL: ${url.toString()}`);
-    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
-    console.error(`Debug: Request body: ${redactSecretsForLog(payload)}`);
-  }
-  let response;
-  try {
-    response = await fetch(url.toString(), {
-      method: "POST",
-      headers,
-      body: payload
-    });
-  } catch (err) {
-    throw new Error(describeFetchError(operation, base, err));
-  }
-  const text = await response.text();
-  if (debug) {
-    console.error(`Debug: Response status: ${response.status}`);
-    console.error(`Debug: Response body: ${redactSecretsForLog(text)}`);
-  }
-  if (!response.ok) {
-    throw new Error(formatHttpError(operation, response.status, text, response.statusText));
-  }
-  try {
-    return JSON.parse(text);
-  } catch {
-    throw new Error(`${operation}: failed to parse response: ${text}`);
-  }
-}
-async function submitCommand(params) {
-  const { apiKey, apiBaseUrl, command, projectId, sql, args, sessionId, idempotencyKey, debug } = params;
-  if (!JOE_COMMANDS.includes(command)) {
-    throw new Error(`Unknown Joe command: ${command}`);
-  }
-  const body = {
-    project_id: projectId,
-    command,
-    sql: sql ?? null,
-    args: args ?? null,
-    session_id: sessionId ?? null
-  };
-  if (idempotencyKey) {
-    body.idempotency_key = idempotencyKey;
-  }
-  return callRpc({
-    apiKey,
-    apiBaseUrl,
-    fn: "joe_command_submit",
-    body,
-    operation: `Failed to submit ${command} command`,
-    debug
-  });
-}
-async function getCommandStatus(params) {
-  const { apiKey, apiBaseUrl, commandId, debug } = params;
-  if (!commandId) {
-    throw new Error("commandId is required");
-  }
-  return callRpc({
-    apiKey,
-    apiBaseUrl,
-    fn: "joe_command_status",
-    body: { command_id: commandId },
-    operation: "Failed to fetch command status",
-    debug
-  });
-}
-async function getCommandResult(params) {
-  const { apiKey, apiBaseUrl, commandId, debug } = params;
-  if (!commandId) {
-    throw new Error("commandId is required");
-  }
-  return callRpc({
-    apiKey,
-    apiBaseUrl,
-    fn: "joe_command_result",
-    body: { command_id: commandId },
-    operation: "Failed to fetch command result",
-    debug
-  });
-}
-function normalizeProjectRow(row) {
-  const projectId = row.project_id ?? row.id ?? 0;
-  return {
-    project_id: Number(projectId),
-    alias: row.alias ?? null,
-    name: row.name ?? null,
-    label: row.label ?? null,
-    joe_ready: Boolean(row.joe_ready ?? row.joe_api_v2_enabled ?? false),
-    tunnel: Boolean(row.tunnel ?? row.tunnel_ready ?? false),
-    instance_id: row.instance_id == null ? null : Number(row.instance_id),
-    dblab_instance_id: row.dblab_instance_id == null ? null : Number(row.dblab_instance_id)
-  };
-}
-async function listProjects(params) {
-  const { apiKey, apiBaseUrl, orgId, debug } = params;
-  const body = {};
-  if (typeof orgId === "number") {
-    body.org_id = orgId;
-  }
-  const rows = await callRpc({
-    apiKey,
-    apiBaseUrl,
-    fn: "projects_list",
-    body,
-    operation: "Failed to list projects",
-    debug
-  });
-  if (!Array.isArray(rows)) {
-    return [];
-  }
-  return rows.map(normalizeProjectRow);
-}
-function isNumericProjectRef(ref) {
-  return /^[0-9]+$/.test(ref.trim());
-}
-async function resolveProjectId(params) {
-  const ref = String(params.project ?? "").trim();
-  if (!ref) {
-    throw new Error("project is required (--project <id|alias>)");
-  }
-  if (isNumericProjectRef(ref)) {
-    return Number(ref);
-  }
-  const projects = await listProjects({
-    apiKey: params.apiKey,
-    apiBaseUrl: params.apiBaseUrl,
-    orgId: params.orgId,
-    debug: params.debug
-  });
-  const needle = ref.toLowerCase();
-  const match = projects.find((p) => p.alias !== null && p.alias.toLowerCase() === needle || p.name !== null && p.name.toLowerCase() === needle || p.label !== null && p.label.toLowerCase() === needle);
-  if (!match) {
-    throw new Error(`Project not found for alias/name '${ref}'. Run 'pgai projects' to see available projects.`);
-  }
-  return match.project_id;
-}
-function sessionStorePath(dir) {
-  return path3.join(dir ?? getConfigDir2(), "joe-sessions.json");
-}
-function readSessionStore(dir) {
-  const file = sessionStorePath(dir);
-  if (!fs3.existsSync(file)) {
-    return {};
-  }
-  try {
-    const parsed = JSON.parse(fs3.readFileSync(file, "utf8"));
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-      return parsed;
-    }
-  } catch {}
-  return {};
-}
-function readStoredSessionId(projectId, dir) {
-  const store = readSessionStore(dir);
-  const value = store[String(projectId)];
-  return typeof value === "string" && value.length > 0 ? value : null;
-}
-function writeStoredSessionId(projectId, sessionId, dir) {
-  const baseDir = dir ?? getConfigDir2();
-  if (!fs3.existsSync(baseDir)) {
-    fs3.mkdirSync(baseDir, { recursive: true, mode: 448 });
-  }
-  const store = readSessionStore(dir);
-  store[String(projectId)] = sessionId;
-  fs3.writeFileSync(sessionStorePath(dir), JSON.stringify(store, null, 2) + `
-`, { mode: 384 });
-}
-function clearStoredSessionId(projectId, dir) {
-  const file = sessionStorePath(dir);
-  if (!fs3.existsSync(file)) {
-    return;
-  }
-  const store = readSessionStore(dir);
-  if (String(projectId) in store) {
-    delete store[String(projectId)];
-    fs3.writeFileSync(file, JSON.stringify(store, null, 2) + `
-`, { mode: 384 });
-  }
-}
-function computeIdempotencyKey(command, projectId, sql, args) {
-  if (EXECUTING_COMMANDS.has(command)) {
-    const canonical = `${projectId}
-${command}
-${sql ?? ""}
-${JSON.stringify(args ?? null)}`;
-    return `joe-${crypto.createHash("sha256").update(canonical).digest("hex")}`;
-  }
-  return `joe-${crypto.randomUUID()}`;
-}
-var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
-async function runCommand(params) {
-  const {
-    apiKey,
-    apiBaseUrl,
-    command,
-    projectId,
-    sql,
-    args,
-    sessionId,
-    debug
-  } = params;
-  const budgetMs = typeof params.budgetMs === "number" && Number.isFinite(params.budgetMs) ? params.budgetMs : DEFAULT_BUDGET_MS;
-  const pollIntervalMs = params.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-  const now = params.now ?? Date.now;
-  const sleep = params.sleep ?? defaultSleep;
-  const idempotencyKey = params.idempotencyKey ?? computeIdempotencyKey(command, projectId, sql, args);
-  const submitted = await submitCommand({
-    apiKey,
-    apiBaseUrl,
-    command,
-    projectId,
-    sql,
-    args,
-    sessionId,
-    idempotencyKey,
-    debug
-  });
-  const commandId = submitted.command_id;
-  const newSessionId = submitted.session_id ?? sessionId ?? null;
-  const deadline = now() + budgetMs;
-  let status = submitted.status;
-  while (true) {
-    const statusResp = await getCommandStatus({ apiKey, apiBaseUrl, commandId, debug });
-    status = statusResp.status;
-    if (TERMINAL_STATES.has(status)) {
-      break;
-    }
-    if (now() >= deadline) {
-      return { commandId, sessionId: newSessionId, status, result: null, budgetExpired: true };
-    }
-    await sleep(pollIntervalMs);
-  }
-  const result = await getCommandResult({ apiKey, apiBaseUrl, commandId, debug });
-  return { commandId, sessionId: newSessionId, status, result, budgetExpired: false };
-}
-async function executeJoeCommand(params) {
-  const projectId = await resolveProjectId({
-    apiKey: params.apiKey,
-    apiBaseUrl: params.apiBaseUrl,
-    project: params.project,
-    orgId: params.orgId,
-    debug: params.debug
-  });
-  let sessionId;
-  if (params.newSession) {
-    clearStoredSessionId(projectId, params.sessionDir);
-    sessionId = null;
-  } else if (params.session) {
-    sessionId = String(params.session);
-  } else {
-    sessionId = readStoredSessionId(projectId, params.sessionDir);
-  }
-  const outcome = await runCommand({
-    apiKey: params.apiKey,
-    apiBaseUrl: params.apiBaseUrl,
-    command: params.command,
-    projectId,
-    sql: params.sql,
-    args: params.args,
-    sessionId,
-    budgetMs: params.budgetMs,
-    pollIntervalMs: params.pollIntervalMs,
-    debug: params.debug,
-    now: params.now,
-    sleep: params.sleep
-  });
-  if (outcome.sessionId) {
-    writeStoredSessionId(projectId, outcome.sessionId, params.sessionDir);
-  }
-  return { ...outcome, command: params.command, projectId };
-}
-
-// lib/dblab.ts
-function isNumericProjectRef2(ref) {
-  return /^[0-9]+$/.test(ref.trim());
-}
-async function resolveDblabInstanceId(params) {
-  const { apiKey, apiBaseUrl, orgId, debug } = params;
-  if (!apiKey) {
-    throw new Error("API key is required");
-  }
-  const ref = String(params.project ?? "").trim();
-  if (!ref) {
-    throw new Error("project is required (--project <id|alias>)");
-  }
-  let projects;
-  try {
-    projects = await listProjects({ apiKey, apiBaseUrl, orgId, debug });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    throw new Error(`Failed to resolve project's DBLab instance: ${message}`);
-  }
-  const numeric = isNumericProjectRef2(ref);
-  const needle = ref.toLowerCase();
-  const match = projects.find((p) => {
-    if (numeric) {
-      return String(p.project_id) === ref;
-    }
-    return p.alias !== null && p.alias.toLowerCase() === needle || p.name !== null && p.name.toLowerCase() === needle || p.label !== null && p.label.toLowerCase() === needle;
-  });
-  if (!match) {
-    throw new Error(`No DBLab instance found for project '${ref}'. Run 'pgai projects' to see available projects.`);
-  }
-  if (match.dblab_instance_id == null) {
-    throw new Error(`Project '${ref}' has no active DBLab instance. Register a DBLab instance for it in the Console first.`);
-  }
-  return String(match.dblab_instance_id);
-}
-async function callDblabApi(params) {
-  const { apiKey, apiBaseUrl, instanceId, action, method, data, operation, debug } = params;
-  if (!apiKey) {
-    throw new Error("API key is required");
-  }
-  if (!instanceId) {
-    throw new Error("instanceId is required");
-  }
-  const base = normalizeBaseUrl(apiBaseUrl);
-  const url = new URL(`${base}/rpc/dblab_api_call`);
-  const bodyObj = {
-    instance_id: instanceId,
-    action,
-    method
-  };
-  if (data !== undefined) {
-    bodyObj.data = data;
-  }
-  const body = JSON.stringify(bodyObj);
-  const headers = {
-    "access-token": apiKey,
-    "Content-Type": "application/json",
-    Connection: "close"
-  };
-  if (debug) {
-    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.error(`Debug: POST URL: ${url.toString()}`);
-    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
-    console.error(`Debug: Request body: ${redactSecretsForLog(body)}`);
-  }
-  let response;
-  try {
-    response = await fetch(url.toString(), { method: "POST", headers, body });
-  } catch (err) {
-    throw new Error(describeFetchError(operation, base, err));
-  }
-  const text = await response.text();
-  if (debug) {
-    console.error(`Debug: Response status: ${response.status}`);
-    console.error(`Debug: Response body: ${redactSecretsForLog(text)}`);
-  }
-  if (!response.ok) {
-    throw new Error(formatHttpError(operation, response.status, text, response.statusText));
-  }
-  if (text.trim() === "") {
-    return null;
-  }
-  try {
-    return JSON.parse(text);
-  } catch {
-    throw new Error(`${operation}: failed to parse response: ${text}`);
-  }
-}
-async function createClone(params) {
-  const { apiKey, apiBaseUrl, instanceId, cloneId, branch, snapshotId, dbUser, dbPassword, isProtected, debug } = params;
-  const data = { protected: Boolean(isProtected) };
-  if (cloneId)
-    data.id = cloneId;
-  if (branch)
-    data.branch = branch;
-  if (snapshotId)
-    data.snapshot = { id: snapshotId };
-  if (dbUser && dbPassword)
-    data.db = { username: dbUser, password: dbPassword };
-  return callDblabApi({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action: "/clone",
-    method: "post",
-    data,
-    operation: "Failed to create clone",
-    debug
-  });
-}
-async function listClones(params) {
-  const { apiKey, apiBaseUrl, instanceId, debug } = params;
-  return callDblabApi({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action: "/clones",
-    method: "get",
-    operation: "Failed to list clones",
-    debug
-  });
-}
-async function getClone(params) {
-  const { apiKey, apiBaseUrl, instanceId, cloneId, debug } = params;
-  if (!cloneId)
-    throw new Error("cloneId is required");
-  return callDblabApi({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action: `/clone/${encodeURIComponent(cloneId)}`,
-    method: "get",
-    operation: "Failed to get clone",
-    debug
-  });
-}
-async function resetClone(params) {
-  const { apiKey, apiBaseUrl, instanceId, cloneId, snapshotId, latest, debug } = params;
-  if (!cloneId)
-    throw new Error("cloneId is required");
-  const data = { latest: latest ?? !snapshotId };
-  if (snapshotId)
-    data.snapshotID = snapshotId;
-  return callDblabApi({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action: `/clone/${encodeURIComponent(cloneId)}/reset`,
-    method: "post",
-    data,
-    operation: "Failed to reset clone",
-    debug
-  });
-}
-async function destroyClone(params) {
-  const { apiKey, apiBaseUrl, instanceId, cloneId, debug } = params;
-  if (!cloneId)
-    throw new Error("cloneId is required");
-  return callDblabApi({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action: `/clone/${encodeURIComponent(cloneId)}`,
-    method: "delete",
-    operation: "Failed to destroy clone",
-    debug
-  });
-}
-async function listBranches(params) {
-  const { apiKey, apiBaseUrl, instanceId, debug } = params;
-  return callDblabApi({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action: "/branches",
-    method: "get",
-    operation: "Failed to list branches",
-    debug
-  });
-}
-async function createBranch(params) {
-  const { apiKey, apiBaseUrl, instanceId, branchName, baseBranch, snapshotId, debug } = params;
-  if (!branchName)
-    throw new Error("branchName is required");
-  const data = { branchName };
-  if (baseBranch)
-    data.baseBranch = baseBranch;
-  if (snapshotId)
-    data.snapshotID = snapshotId;
-  return callDblabApi({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action: "/branch",
-    method: "post",
-    data,
-    operation: "Failed to create branch",
-    debug
-  });
-}
-async function deleteBranch(params) {
-  const { apiKey, apiBaseUrl, instanceId, branchName, debug } = params;
-  if (!branchName)
-    throw new Error("branchName is required");
-  return callDblabApi({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action: `/branch/${encodeURIComponent(branchName)}`,
-    method: "delete",
-    operation: "Failed to delete branch",
-    debug
-  });
-}
-async function branchLog(params) {
-  const { apiKey, apiBaseUrl, instanceId, branchName, debug } = params;
-  if (!branchName)
-    throw new Error("branchName is required");
-  return callDblabApi({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action: `/branch/${encodeURIComponent(branchName)}/log`,
-    method: "get",
-    operation: "Failed to fetch branch log",
-    debug
-  });
-}
-async function listSnapshots(params) {
-  const { apiKey, apiBaseUrl, instanceId, branchName, dataset, debug } = params;
-  const qs = new URLSearchParams;
-  const branch = branchName?.trim();
-  if (branch)
-    qs.append("branch", branch);
-  if (dataset)
-    qs.append("dataset", dataset);
-  const action = `/snapshots${qs.toString() ? `?${qs.toString()}` : ""}`;
-  return callDblabApi({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action,
-    method: "get",
-    operation: "Failed to list snapshots",
-    debug
-  });
-}
-async function createSnapshot(params) {
-  const { apiKey, apiBaseUrl, instanceId, cloneId, message, debug } = params;
-  if (!cloneId)
-    throw new Error("cloneId is required");
-  const data = { cloneID: cloneId };
-  if (message)
-    data.message = message;
-  return callDblabApi({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action: "/branch/snapshot",
-    method: "post",
-    data,
-    operation: "Failed to create snapshot",
-    debug
-  });
-}
-async function destroySnapshot(params) {
-  const { apiKey, apiBaseUrl, instanceId, snapshotId, force, debug } = params;
-  if (!snapshotId)
-    throw new Error("snapshotId is required");
-  const action = `/snapshot/${snapshotId}?force=${Boolean(force)}`;
-  return callDblabApi({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action,
-    method: "delete",
-    operation: "Failed to destroy snapshot",
-    debug
-  });
-}
-
-// lib/storage.ts
-import * as fs4 from "fs";
-import * as path4 from "path";
 var MAX_UPLOAD_SIZE = 500 * 1024 * 1024;
 var MAX_DOWNLOAD_SIZE = 500 * 1024 * 1024;
 var MIME_TYPES = {
@@ -18008,11 +17501,11 @@ async function uploadFile(params) {
   if (!filePath) {
     throw new Error("filePath is required");
   }
-  const resolvedPath = path4.resolve(filePath);
-  if (!fs4.existsSync(resolvedPath)) {
+  const resolvedPath = path3.resolve(filePath);
+  if (!fs3.existsSync(resolvedPath)) {
     throw new Error(`File not found: ${resolvedPath}`);
   }
-  const stat = fs4.statSync(resolvedPath);
+  const stat = fs3.statSync(resolvedPath);
   if (!stat.isFile()) {
     throw new Error(`Not a file: ${resolvedPath}`);
   }
@@ -18024,9 +17517,9 @@ async function uploadFile(params) {
     console.error("Warning: storage URL uses HTTP — API key will be sent unencrypted");
   }
   const url = `${base}/upload`;
-  const fileBuffer = fs4.readFileSync(resolvedPath);
-  const fileName = path4.basename(resolvedPath);
-  const ext = path4.extname(fileName).toLowerCase();
+  const fileBuffer = fs3.readFileSync(resolvedPath);
+  const fileName = path3.basename(resolvedPath);
+  const ext = path3.extname(fileName).toLowerCase();
   const mimeType = MIME_TYPES[ext] || "application/octet-stream";
   const formData = new FormData;
   formData.append("file", new Blob([fileBuffer], { type: mimeType }), fileName);
@@ -18085,15 +17578,15 @@ async function downloadFile(params) {
     const relativePath = fileUrl.startsWith("/") ? fileUrl : `/${fileUrl}`;
     fullUrl = `${base}${relativePath}`;
   }
-  const urlFilename = path4.basename(new URL(fullUrl).pathname);
+  const urlFilename = path3.basename(new URL(fullUrl).pathname);
   if (!urlFilename) {
     throw new Error("Cannot derive filename from URL; please specify --output");
   }
-  const saveTo = outputPath ? path4.resolve(outputPath) : path4.resolve(urlFilename);
+  const saveTo = outputPath ? path3.resolve(outputPath) : path3.resolve(urlFilename);
   if (!outputPath) {
-    const normalizedSave = path4.normalize(saveTo);
-    const cwd = path4.normalize(process.cwd());
-    if (normalizedSave !== cwd && !normalizedSave.startsWith(cwd + path4.sep)) {
+    const normalizedSave = path3.normalize(saveTo);
+    const cwd = path3.normalize(process.cwd());
+    if (normalizedSave !== cwd && !normalizedSave.startsWith(cwd + path3.sep)) {
       throw new Error("Derived output path escapes current directory; please specify --output");
     }
   }
@@ -18125,11 +17618,11 @@ async function downloadFile(params) {
   }
   const arrayBuffer = await response.arrayBuffer();
   const buffer = Buffer.from(arrayBuffer);
-  const parentDir = path4.dirname(saveTo);
-  if (!fs4.existsSync(parentDir)) {
-    fs4.mkdirSync(parentDir, { recursive: true });
+  const parentDir = path3.dirname(saveTo);
+  if (!fs3.existsSync(parentDir)) {
+    fs3.mkdirSync(parentDir, { recursive: true });
   }
-  fs4.writeFileSync(saveTo, buffer);
+  fs3.writeFileSync(saveTo, buffer);
   return {
     savedTo: saveTo,
     size: buffer.length,
@@ -18141,9 +17634,9 @@ function buildMarkdownLink(fileUrl, storageBaseUrl, filename) {
   const base = normalizeBaseUrl(storageBaseUrl);
   const normalizedFileUrl = fileUrl.startsWith("/") ? fileUrl : `/${fileUrl}`;
   const fullUrl = fileUrl.startsWith("http://") || fileUrl.startsWith("https://") ? fileUrl : `${base}${normalizedFileUrl}`;
-  const name = filename || path4.basename(new URL(fullUrl).pathname);
+  const name = filename || path3.basename(new URL(fullUrl).pathname);
   const safeName = name.replace(/[\[\]()]/g, "\\$&");
-  const ext = path4.extname(name).toLowerCase();
+  const ext = path3.extname(name).toLowerCase();
   if (IMAGE_EXTENSIONS.has(ext)) {
     return `![${safeName}](${fullUrl})`;
   }
@@ -18431,10 +17924,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema2) {
   return mergeDefs(schema2._zod.def);
 }
-function getElementAtPath(obj, path5) {
-  if (!path5)
+function getElementAtPath(obj, path4) {
+  if (!path4)
     return obj;
-  return path5.reduce((acc, key) => acc?.[key], obj);
+  return path4.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -18798,11 +18291,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path5, issues) {
+function prefixIssues(path4, issues) {
   return issues.map((iss) => {
     var _a;
     (_a = iss).path ?? (_a.path = []);
-    iss.path.unshift(path5);
+    iss.path.unshift(path4);
     return iss;
   });
 }
@@ -21671,7 +21164,7 @@ function finalize(ctx, schema2) {
     result.$schema = "http://json-schema.org/draft-07/schema#";
   } else if (ctx.target === "draft-04") {
     result.$schema = "http://json-schema.org/draft-04/schema#";
-  } else if (ctx.target === "openapi-3.0") {}
+  } else if (ctx.target === "openapi-3.0") {} else {}
   if (ctx.external?.uri) {
     const id = ctx.external.registry.get(schema2)?.id;
     if (!id)
@@ -21890,7 +21383,7 @@ var literalProcessor = (schema2, ctx, json2, _params) => {
     if (val === undefined) {
       if (ctx.unrepresentable === "throw") {
         throw new Error("Literal `undefined` cannot be represented in JSON Schema");
-      }
+      } else {}
     } else if (typeof val === "bigint") {
       if (ctx.unrepresentable === "throw") {
         throw new Error("BigInt literals cannot be represented in JSON Schema");
@@ -25074,211 +24567,6 @@ class StdioServerTransport {
 // lib/mcp-server.ts
 var interpretEscapes = (str2) => (str2 || "").replace(/\\n/g, `
 `).replace(/\\t/g, "\t").replace(/\\r/g, "\r").replace(/\\"/g, '"').replace(/\\'/g, "'");
-var JOE_TOOL_TO_COMMAND = {
-  plan_query: "plan",
-  explain_query: "explain",
-  exec_sql: "exec",
-  hypo_index: "hypo",
-  activity: "activity",
-  terminate_backend: "terminate",
-  reset_clone: "reset",
-  describe: "describe"
-};
-function joeToolDefinitions() {
-  const sessionProps = {
-    project_id: {
-      type: "string",
-      description: "Target project by numeric id OR alias/name (id-or-alias). --project 12 ≡ main-db."
-    },
-    session_id: {
-      type: "string",
-      description: "Run on a specific session's clone (64-bit id as a string). Auto-reused per project when omitted."
-    },
-    new_session: { type: "boolean", description: "Force a fresh session/clone (null session)." },
-    timeout_ms: { type: "number", description: "One-shot poll budget in ms (≤ 25000); on expiry returns a command_id to resume." },
-    debug: { type: "boolean", description: "Enable verbose debug logs." }
-  };
-  return [
-    {
-      name: "plan_query",
-      description: "Plan a query (EXPLAIN, plan-only — NEVER executes; the fast/safe default). Returns a sanitized plan tree (literals redacted). LLM-facing: feeds the plan/stats to your LLM when the org's AI features are enabled. Requires joe:plan.",
-      inputSchema: {
-        type: "object",
-        properties: { sql: { type: "string", description: "The query to plan (one explainable statement)." }, ...sessionProps },
-        required: ["sql", "project_id"],
-        additionalProperties: false
-      }
-    },
-    {
-      name: "explain_query",
-      description: "EXPLAIN ANALYZE a query — EXECUTES it on the hardened, ephemeral DBLab clone and returns the measured, annotated plan (node types, costs, actual-rows/timings, buffers — literals redacted), NOT raw SELECT result rows. LLM-facing: feeds the measured plan/stats to your LLM when AI features are enabled. Requires joe:exec; subject to the org execution policy (read_only allows SELECT-only).",
-      inputSchema: {
-        type: "object",
-        properties: { sql: { type: "string", description: "The query to EXPLAIN ANALYZE (executes on the clone)." }, ...sessionProps },
-        required: ["sql", "project_id"],
-        additionalProperties: false
-      }
-    },
-    {
-      name: "exec_sql",
-      description: "WARNING: executes arbitrary SQL (DDL/DML) on the disposable clone and CAN RETURN REAL (own-data) TABLE ROWS that will enter this agent's LLM context (subject to the agent row-cap / metadata-only minimization). Prefer plan_query (non-executing) when you only need a plan. Requires an explicit joe:exec grant and is subject to the org's joe_execution_policy.",
-      inputSchema: {
-        type: "object",
-        properties: { sql: { type: "string", description: "Arbitrary DDL/DML to run on the clone (e.g. create index, analyze)." }, ...sessionProps },
-        required: ["sql", "project_id"],
-        additionalProperties: false
-      }
-    },
-    {
-      name: "hypo_index",
-      description: "HypoPG hypothetical index + re-plan (no real index built, no data change) — would the planner switch to it? LLM-facing. Requires joe:plan.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          sql: { type: "string", description: "Candidate index DDL (e.g. create index on orders (customer_id))." },
-          query: { type: "string", description: "Target query the hypothetical index is evaluated against." },
-          ...sessionProps
-        },
-        required: ["sql", "query", "project_id"],
-        additionalProperties: false
-      }
-    },
-    {
-      name: "activity",
-      description: "pg_stat_activity snapshot on the clone (query text redacted). LLM-facing. Requires joe:plan.",
-      inputSchema: { type: "object", properties: { ...sessionProps }, required: ["project_id"], additionalProperties: false }
-    },
-    {
-      name: "terminate_backend",
-      description: "pg_terminate_backend(pid) on the clone. Status-only (no data to the LLM). Requires joe:admin.",
-      inputSchema: {
-        type: "object",
-        properties: { pid: { type: "number", description: "Backend pid to terminate." }, ...sessionProps },
-        required: ["pid", "project_id"],
-        additionalProperties: false
-      }
-    },
-    {
-      name: "reset_clone",
-      description: "Reset/recreate the session's thin clone. Status-only (no data to the LLM). Requires joe:admin.",
-      inputSchema: { type: "object", properties: { ...sessionProps }, required: ["project_id"], additionalProperties: false }
-    },
-    {
-      name: "describe",
-      description: "\\d-family schema/relation/index/db/view metadata introspection. LLM-facing (metadata). Requires joe:plan.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          object: { type: "string", description: "Object to describe (e.g. users)." },
-          variant: { type: "string", description: "\\d-family variant (e.g. \\d+, \\di, \\dt)." },
-          ...sessionProps
-        },
-        required: ["object", "project_id"],
-        additionalProperties: false
-      }
-    },
-    {
-      name: "list_projects",
-      description: "List the org's projects and which have Joe ready (org-level discovery — NOT a Joe endpoint; mirrors `pgai projects`). Use it to find the project_ids/aliases you may address with the Joe command tools.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          org_id: { type: "number", description: "Organization ID (optional, falls back to config)." },
-          debug: { type: "boolean", description: "Enable verbose debug logs." }
-        },
-        additionalProperties: false
-      }
-    }
-  ];
-}
-function sanitizeBudgetMs(value) {
-  if (value === undefined || value === null) {
-    return;
-  }
-  const n = Number(value);
-  return Number.isFinite(n) ? n : undefined;
-}
-async function runJoeTool(params) {
-  const command = JOE_TOOL_TO_COMMAND[params.toolName];
-  const a = params.args;
-  const project = String(a.project_id ?? "").trim();
-  if (!project) {
-    return { content: [{ type: "text", text: "project_id is required" }], isError: true };
-  }
-  let sql = null;
-  let cmdArgs = null;
-  if (command === "plan" || command === "explain" || command === "exec" || command === "hypo") {
-    sql = String(a.sql ?? "").trim();
-    if (!sql) {
-      return { content: [{ type: "text", text: "sql is required" }], isError: true };
-    }
-  }
-  if (command === "hypo") {
-    const query = String(a.query ?? "").trim();
-    if (!query) {
-      return { content: [{ type: "text", text: "query is required for hypo_index" }], isError: true };
-    }
-    cmdArgs = { query };
-  }
-  if (command === "terminate") {
-    const raw = a.pid;
-    const pid = typeof raw === "number" ? raw : typeof raw === "string" && /^[0-9]+$/.test(raw.trim()) ? Number(raw.trim()) : Number.NaN;
-    if (!Number.isInteger(pid) || pid <= 0) {
-      return {
-        content: [{ type: "text", text: "pid must be a strict positive integer (backend pid) for terminate_backend" }],
-        isError: true
-      };
-    }
-    cmdArgs = { pid };
-  }
-  if (command === "describe") {
-    const object4 = String(a.object ?? "").trim();
-    if (!object4) {
-      return { content: [{ type: "text", text: "object is required for describe" }], isError: true };
-    }
-    cmdArgs = { object: object4 };
-    if (a.variant !== undefined)
-      cmdArgs.variant = String(a.variant);
-  }
-  const session = a.session_id !== undefined && a.session_id !== null ? String(a.session_id) : null;
-  const newSession = a.new_session === true;
-  const budgetMs = sanitizeBudgetMs(a.timeout_ms);
-  const outcome = await executeJoeCommand({
-    apiKey: params.apiKey,
-    apiBaseUrl: params.apiBaseUrl,
-    command,
-    project,
-    sql,
-    args: cmdArgs,
-    session,
-    newSession,
-    orgId: params.orgId,
-    budgetMs,
-    debug: params.debug
-  });
-  const payload = {
-    command,
-    command_id: outcome.commandId,
-    session_id: outcome.sessionId,
-    status: outcome.status,
-    budget_expired: outcome.budgetExpired,
-    resume: outcome.budgetExpired ? `pgai joe result ${outcome.commandId}` : undefined,
-    result: outcome.result
-  };
-  const isError = outcome.status === "error" || outcome.status === "timed_out";
-  return { content: [{ type: "text", text: JSON.stringify(payload, null, 2) }], isError };
-}
-async function resolveDblabInstanceForTool(apiKey, apiBaseUrl, args, cfgOrgId, debug) {
-  const project = String(args.project || "").trim();
-  if (!project) {
-    throw new Error("project is required (project id or alias)");
-  }
-  const orgId = args.org_id !== undefined ? Number(args.org_id) : cfgOrgId ?? undefined;
-  return resolveDblabInstanceId({ apiKey, apiBaseUrl, project, orgId, debug });
-}
-function optStr(v) {
-  return v !== undefined && v !== null && String(v).length > 0 ? String(v) : undefined;
-}
 async function handleToolCall(req, rootOpts, extra) {
   const toolName = req.params.name;
   const args = req.params.arguments || {};
@@ -25556,147 +24844,6 @@ async function handleToolCall(req, rootOpts, extra) {
       const files = await fetchReportFileData({ apiKey, apiBaseUrl, reportId, type: type2, checkId, debug });
       return { content: [{ type: "text", text: JSON.stringify(files, null, 2) }] };
     }
-    if (toolName === "list_projects") {
-      const orgId = args.org_id !== undefined ? Number(args.org_id) : cfg.orgId ?? undefined;
-      const projects = await listProjects({ apiKey, apiBaseUrl, orgId, debug });
-      return { content: [{ type: "text", text: JSON.stringify(projects, null, 2) }] };
-    }
-    if (toolName in JOE_TOOL_TO_COMMAND) {
-      const orgId = cfg.orgId ?? undefined;
-      return await runJoeTool({ toolName, apiKey, apiBaseUrl, orgId, args, debug });
-    }
-    if (toolName === "clone_create") {
-      const instanceId = await resolveDblabInstanceForTool(apiKey, apiBaseUrl, args, cfg.orgId, debug);
-      const result = await createClone({
-        apiKey,
-        apiBaseUrl,
-        instanceId,
-        cloneId: optStr(args.clone_id),
-        branch: optStr(args.branch),
-        snapshotId: optStr(args.snapshot_id),
-        dbUser: optStr(args.db_user),
-        dbPassword: optStr(args.db_password),
-        isProtected: args.protected === true,
-        debug
-      });
-      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
-    }
-    if (toolName === "clone_list") {
-      const instanceId = await resolveDblabInstanceForTool(apiKey, apiBaseUrl, args, cfg.orgId, debug);
-      const result = await listClones({ apiKey, apiBaseUrl, instanceId, debug });
-      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
-    }
-    if (toolName === "clone_status") {
-      const cloneId = String(args.clone_id || "").trim();
-      if (!cloneId)
-        return { content: [{ type: "text", text: "clone_id is required" }], isError: true };
-      const instanceId = await resolveDblabInstanceForTool(apiKey, apiBaseUrl, args, cfg.orgId, debug);
-      const result = await getClone({ apiKey, apiBaseUrl, instanceId, cloneId, debug });
-      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
-    }
-    if (toolName === "clone_reset") {
-      const cloneId = String(args.clone_id || "").trim();
-      if (!cloneId)
-        return { content: [{ type: "text", text: "clone_id is required" }], isError: true };
-      const instanceId = await resolveDblabInstanceForTool(apiKey, apiBaseUrl, args, cfg.orgId, debug);
-      const result = await resetClone({
-        apiKey,
-        apiBaseUrl,
-        instanceId,
-        cloneId,
-        snapshotId: optStr(args.snapshot_id),
-        latest: args.latest === true ? true : undefined,
-        debug
-      });
-      return { content: [{ type: "text", text: JSON.stringify(result ?? { reset: true, cloneId }, null, 2) }] };
-    }
-    if (toolName === "clone_destroy") {
-      const cloneId = String(args.clone_id || "").trim();
-      if (!cloneId)
-        return { content: [{ type: "text", text: "clone_id is required" }], isError: true };
-      const instanceId = await resolveDblabInstanceForTool(apiKey, apiBaseUrl, args, cfg.orgId, debug);
-      const result = await destroyClone({ apiKey, apiBaseUrl, instanceId, cloneId, debug });
-      return { content: [{ type: "text", text: JSON.stringify(result ?? { destroyed: true, cloneId }, null, 2) }] };
-    }
-    if (toolName === "branch_list") {
-      const instanceId = await resolveDblabInstanceForTool(apiKey, apiBaseUrl, args, cfg.orgId, debug);
-      const result = await listBranches({ apiKey, apiBaseUrl, instanceId, debug });
-      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
-    }
-    if (toolName === "branch_create") {
-      const branchName = String(args.name || "").trim();
-      if (!branchName)
-        return { content: [{ type: "text", text: "name is required" }], isError: true };
-      const instanceId = await resolveDblabInstanceForTool(apiKey, apiBaseUrl, args, cfg.orgId, debug);
-      const result = await createBranch({
-        apiKey,
-        apiBaseUrl,
-        instanceId,
-        branchName,
-        baseBranch: optStr(args.base_branch),
-        snapshotId: optStr(args.snapshot_id),
-        debug
-      });
-      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
-    }
-    if (toolName === "branch_delete") {
-      const branchName = String(args.name || "").trim();
-      if (!branchName)
-        return { content: [{ type: "text", text: "name is required" }], isError: true };
-      const instanceId = await resolveDblabInstanceForTool(apiKey, apiBaseUrl, args, cfg.orgId, debug);
-      const result = await deleteBranch({ apiKey, apiBaseUrl, instanceId, branchName, debug });
-      return { content: [{ type: "text", text: JSON.stringify(result ?? { deleted: true, branch: branchName }, null, 2) }] };
-    }
-    if (toolName === "branch_log") {
-      const branchName = String(args.name || "").trim();
-      if (!branchName)
-        return { content: [{ type: "text", text: "name is required" }], isError: true };
-      const instanceId = await resolveDblabInstanceForTool(apiKey, apiBaseUrl, args, cfg.orgId, debug);
-      const result = await branchLog({ apiKey, apiBaseUrl, instanceId, branchName, debug });
-      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
-    }
-    if (toolName === "snapshot_list") {
-      const instanceId = await resolveDblabInstanceForTool(apiKey, apiBaseUrl, args, cfg.orgId, debug);
-      const result = await listSnapshots({
-        apiKey,
-        apiBaseUrl,
-        instanceId,
-        branchName: optStr(args.branch),
-        dataset: optStr(args.dataset),
-        debug
-      });
-      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
-    }
-    if (toolName === "snapshot_create") {
-      const cloneId = String(args.clone_id || "").trim();
-      if (!cloneId)
-        return { content: [{ type: "text", text: "clone_id is required" }], isError: true };
-      const instanceId = await resolveDblabInstanceForTool(apiKey, apiBaseUrl, args, cfg.orgId, debug);
-      const result = await createSnapshot({
-        apiKey,
-        apiBaseUrl,
-        instanceId,
-        cloneId,
-        message: optStr(args.message),
-        debug
-      });
-      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
-    }
-    if (toolName === "snapshot_destroy") {
-      const snapshotId = String(args.snapshot_id || "").trim();
-      if (!snapshotId)
-        return { content: [{ type: "text", text: "snapshot_id is required" }], isError: true };
-      const instanceId = await resolveDblabInstanceForTool(apiKey, apiBaseUrl, args, cfg.orgId, debug);
-      const result = await destroySnapshot({
-        apiKey,
-        apiBaseUrl,
-        instanceId,
-        snapshotId,
-        force: args.force === true,
-        debug
-      });
-      return { content: [{ type: "text", text: JSON.stringify(result ?? { destroyed: true, snapshot: snapshotId }, null, 2) }] };
-    }
     throw new Error(`Unknown tool: ${toolName}`);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -25973,197 +25120,6 @@ async function startMcpServer(rootOpts, extra) {
             },
             additionalProperties: false
           }
-        },
-        ...joeToolDefinitions(),
-        {
-          name: "clone_create",
-          description: "Create a DBLab thin clone of the project's database (same as CLI 'pgai dblab clone create'). Requires the joe:plan scope.",
-          inputSchema: {
-            type: "object",
-            properties: {
-              project: { type: "string", description: "Project id or alias" },
-              branch: { type: "string", description: "Branch to clone from" },
-              snapshot_id: { type: "string", description: "Snapshot id to clone from" },
-              clone_id: { type: "string", description: "Clone id (DBLab generates one when omitted)" },
-              db_user: { type: "string", description: "Clone DB user" },
-              db_password: { type: "string", description: "Clone DB password" },
-              protected: { type: "boolean", description: "Protect the clone from auto-deletion" },
-              org_id: { type: "number", description: "Organization id (optional, falls back to config)" },
-              debug: { type: "boolean", description: "Enable verbose debug logs" }
-            },
-            required: ["project"],
-            additionalProperties: false
-          }
-        },
-        {
-          name: "clone_list",
-          description: "List the project's DBLab thin clones (same as CLI 'pgai dblab clone list').",
-          inputSchema: {
-            type: "object",
-            properties: {
-              project: { type: "string", description: "Project id or alias" },
-              org_id: { type: "number", description: "Organization id (optional, falls back to config)" },
-              debug: { type: "boolean", description: "Enable verbose debug logs" }
-            },
-            required: ["project"],
-            additionalProperties: false
-          }
-        },
-        {
-          name: "clone_status",
-          description: "Show a DBLab clone's status (same as CLI 'pgai dblab clone status').",
-          inputSchema: {
-            type: "object",
-            properties: {
-              project: { type: "string", description: "Project id or alias" },
-              clone_id: { type: "string", description: "Clone id" },
-              org_id: { type: "number", description: "Organization id (optional, falls back to config)" },
-              debug: { type: "boolean", description: "Enable verbose debug logs" }
-            },
-            required: ["project", "clone_id"],
-            additionalProperties: false
-          }
-        },
-        {
-          name: "clone_reset",
-          description: "Reset a DBLab clone to a pristine snapshot (same as CLI 'pgai dblab clone reset'). Requires the joe:admin scope.",
-          inputSchema: {
-            type: "object",
-            properties: {
-              project: { type: "string", description: "Project id or alias" },
-              clone_id: { type: "string", description: "Clone id" },
-              snapshot_id: { type: "string", description: "Snapshot id to reset to (default: latest)" },
-              latest: { type: "boolean", description: "Reset to the latest snapshot" },
-              org_id: { type: "number", description: "Organization id (optional, falls back to config)" },
-              debug: { type: "boolean", description: "Enable verbose debug logs" }
-            },
-            required: ["project", "clone_id"],
-            additionalProperties: false
-          }
-        },
-        {
-          name: "clone_destroy",
-          description: "Destroy a DBLab clone (same as CLI 'pgai dblab clone destroy'). Requires the joe:admin scope.",
-          inputSchema: {
-            type: "object",
-            properties: {
-              project: { type: "string", description: "Project id or alias" },
-              clone_id: { type: "string", description: "Clone id" },
-              org_id: { type: "number", description: "Organization id (optional, falls back to config)" },
-              debug: { type: "boolean", description: "Enable verbose debug logs" }
-            },
-            required: ["project", "clone_id"],
-            additionalProperties: false
-          }
-        },
-        {
-          name: "branch_list",
-          description: "List the project's DBLab branches (same as CLI 'pgai dblab branch list').",
-          inputSchema: {
-            type: "object",
-            properties: {
-              project: { type: "string", description: "Project id or alias" },
-              org_id: { type: "number", description: "Organization id (optional, falls back to config)" },
-              debug: { type: "boolean", description: "Enable verbose debug logs" }
-            },
-            required: ["project"],
-            additionalProperties: false
-          }
-        },
-        {
-          name: "branch_create",
-          description: "Create a DBLab branch (same as CLI 'pgai dblab branch create'). Requires the joe:plan scope.",
-          inputSchema: {
-            type: "object",
-            properties: {
-              project: { type: "string", description: "Project id or alias" },
-              name: { type: "string", description: "Branch name" },
-              snapshot_id: { type: "string", description: "Snapshot id to base the branch on" },
-              base_branch: { type: "string", description: "Parent branch to fork from" },
-              org_id: { type: "number", description: "Organization id (optional, falls back to config)" },
-              debug: { type: "boolean", description: "Enable verbose debug logs" }
-            },
-            required: ["project", "name"],
-            additionalProperties: false
-          }
-        },
-        {
-          name: "branch_delete",
-          description: "Delete a DBLab branch (same as CLI 'pgai dblab branch delete'). Requires the joe:admin scope.",
-          inputSchema: {
-            type: "object",
-            properties: {
-              project: { type: "string", description: "Project id or alias" },
-              name: { type: "string", description: "Branch name" },
-              org_id: { type: "number", description: "Organization id (optional, falls back to config)" },
-              debug: { type: "boolean", description: "Enable verbose debug logs" }
-            },
-            required: ["project", "name"],
-            additionalProperties: false
-          }
-        },
-        {
-          name: "branch_log",
-          description: "Show a DBLab branch's snapshot log (same as CLI 'pgai dblab branch log').",
-          inputSchema: {
-            type: "object",
-            properties: {
-              project: { type: "string", description: "Project id or alias" },
-              name: { type: "string", description: "Branch name" },
-              org_id: { type: "number", description: "Organization id (optional, falls back to config)" },
-              debug: { type: "boolean", description: "Enable verbose debug logs" }
-            },
-            required: ["project", "name"],
-            additionalProperties: false
-          }
-        },
-        {
-          name: "snapshot_list",
-          description: "List the project's DBLab snapshots (same as CLI 'pgai dblab snapshot list').",
-          inputSchema: {
-            type: "object",
-            properties: {
-              project: { type: "string", description: "Project id or alias" },
-              branch: { type: "string", description: "Filter by branch" },
-              dataset: { type: "string", description: "Filter by dataset" },
-              org_id: { type: "number", description: "Organization id (optional, falls back to config)" },
-              debug: { type: "boolean", description: "Enable verbose debug logs" }
-            },
-            required: ["project"],
-            additionalProperties: false
-          }
-        },
-        {
-          name: "snapshot_create",
-          description: "Create a DBLab snapshot from a clone (same as CLI 'pgai dblab snapshot create'). Requires the joe:plan scope.",
-          inputSchema: {
-            type: "object",
-            properties: {
-              project: { type: "string", description: "Project id or alias" },
-              clone_id: { type: "string", description: "Clone id to snapshot" },
-              message: { type: "string", description: "Snapshot message" },
-              org_id: { type: "number", description: "Organization id (optional, falls back to config)" },
-              debug: { type: "boolean", description: "Enable verbose debug logs" }
-            },
-            required: ["project", "clone_id"],
-            additionalProperties: false
-          }
-        },
-        {
-          name: "snapshot_destroy",
-          description: "Destroy a DBLab snapshot (same as CLI 'pgai dblab snapshot destroy'). Requires the joe:admin scope.",
-          inputSchema: {
-            type: "object",
-            properties: {
-              project: { type: "string", description: "Project id or alias" },
-              snapshot_id: { type: "string", description: "Snapshot id" },
-              force: { type: "boolean", description: "Force-delete even when dependent clones exist" },
-              org_id: { type: "number", description: "Organization id (optional, falls back to config)" },
-              debug: { type: "boolean", description: "Enable verbose debug logs" }
-            },
-            required: ["project", "snapshot_id"],
-            additionalProperties: false
-          }
         }
       ]
     };
@@ -27037,39 +25993,9 @@ function renderMarkdownForTerminal(md) {
 }
 
 // lib/joe.ts
-import * as fs5 from "fs";
-import * as path5 from "path";
-import * as crypto2 from "node:crypto";
-var JOE_COMMANDS2 = [
-  "plan",
-  "explain",
-  "exec",
-  "hypo",
-  "activity",
-  "terminate",
-  "reset",
-  "describe"
-];
-var TERMINAL_STATES2 = new Set([
-  "done",
-  "error",
-  "timed_out"
-]);
-var AI_ENABLED_COMMANDS2 = new Set([
-  "plan",
-  "explain",
-  "exec",
-  "hypo",
-  "activity",
-  "describe"
-]);
-var EXECUTING_COMMANDS2 = new Set([
-  "exec",
-  "explain"
-]);
-var DEFAULT_BUDGET_MS2 = 25000;
-var DEFAULT_POLL_INTERVAL_MS2 = 800;
-async function callRpc2(params) {
+var DEFAULT_BUDGET_MS = 25000;
+var DEFAULT_POLL_INTERVAL_MS = 800;
+async function callRpc(params) {
   const { apiKey, apiBaseUrl, fn, body, operation, debug } = params;
   if (!apiKey) {
     throw new Error("API key is required");
@@ -27089,13 +26015,18 @@ async function callRpc2(params) {
     console.error(`Debug: Request body: ${redactSecretsForLog(payload)}`);
   }
   let response;
+  const requestTimeout = requestTimeoutSignal(params.timeoutMs);
   try {
     response = await fetch(url.toString(), {
       method: "POST",
       headers,
-      body: payload
+      body: payload,
+      signal: requestTimeout.signal
     });
   } catch (err) {
+    if (isFetchTimeout(err)) {
+      throw new HttpRequestTimeoutError(operation, requestTimeout.timeoutMs);
+    }
     throw new Error(describeFetchError(operation, base, err));
   }
   const text = await response.text();
@@ -27104,86 +26035,72 @@ async function callRpc2(params) {
     console.error(`Debug: Response body: ${redactSecretsForLog(text)}`);
   }
   if (!response.ok) {
-    throw new Error(formatHttpError(operation, response.status, text, response.statusText));
+    throw new HttpStatusError(formatHttpError(operation, response.status, text, response.statusText), response.status);
   }
   try {
     return JSON.parse(text);
   } catch {
-    throw new Error(`${operation}: failed to parse response: ${text}`);
+    throw new Error(`${operation}: failed to parse response: ${redactSecretsForLog(text)}`);
   }
 }
-async function submitCommand2(params) {
-  const { apiKey, apiBaseUrl, command, projectId, sql, args, sessionId, idempotencyKey, debug } = params;
-  if (!JOE_COMMANDS2.includes(command)) {
-    throw new Error(`Unknown Joe command: ${command}`);
-  }
-  const body = {
-    project_id: projectId,
-    command,
-    sql: sql ?? null,
-    args: args ?? null,
-    session_id: sessionId ?? null
-  };
-  if (idempotencyKey) {
-    body.idempotency_key = idempotencyKey;
+async function startCommand(params) {
+  const { apiKey, apiBaseUrl, instanceId, command, debug, timeoutMs } = params;
+  if (!String(command ?? "").trim()) {
+    throw new Error("command text is required");
   }
-  return callRpc2({
+  const commandId = await callRpc({
     apiKey,
     apiBaseUrl,
-    fn: "joe_command_submit",
-    body,
-    operation: `Failed to submit ${command} command`,
-    debug
+    fn: "joe_command_run",
+    body: { instance_id: instanceId, command },
+    operation: "Failed to run Joe command",
+    debug,
+    timeoutMs
   });
-}
-async function getCommandStatus2(params) {
-  const { apiKey, apiBaseUrl, commandId, debug } = params;
-  if (!commandId) {
-    throw new Error("commandId is required");
+  if (typeof commandId !== "string" || !/^[0-9]+$/.test(commandId)) {
+    throw new Error(`Failed to run Joe command: expected a command id string, got: ${redactSecretsForLog(JSON.stringify(commandId))}`);
   }
-  return callRpc2({
-    apiKey,
-    apiBaseUrl,
-    fn: "joe_command_status",
-    body: { command_id: commandId },
-    operation: "Failed to fetch command status",
-    debug
-  });
+  return commandId;
 }
-async function getCommandResult2(params) {
-  const { apiKey, apiBaseUrl, commandId, debug } = params;
+async function getCommandOutput(params) {
+  const { apiKey, apiBaseUrl, commandId, debug, timeoutMs } = params;
   if (!commandId) {
     throw new Error("commandId is required");
   }
-  return callRpc2({
+  return callRpc({
     apiKey,
     apiBaseUrl,
-    fn: "joe_command_result",
+    fn: "joe_command_output",
     body: { command_id: commandId },
-    operation: "Failed to fetch command result",
-    debug
+    operation: "Failed to fetch command output",
+    debug,
+    timeoutMs
   });
 }
-function normalizeProjectRow2(row) {
-  const projectId = row.project_id ?? row.id ?? 0;
+function preserveIntegerId(value) {
+  if (typeof value === "number")
+    return value;
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) ? parsed : value;
+}
+function normalizeProjectRow(row) {
   return {
-    project_id: Number(projectId),
+    project_id: preserveIntegerId(row.project_id ?? 0),
     alias: row.alias ?? null,
     name: row.name ?? null,
-    label: row.label ?? null,
-    joe_ready: Boolean(row.joe_ready ?? row.joe_api_v2_enabled ?? false),
-    tunnel: Boolean(row.tunnel ?? row.tunnel_ready ?? false),
-    instance_id: row.instance_id == null ? null : Number(row.instance_id),
-    dblab_instance_id: row.dblab_instance_id == null ? null : Number(row.dblab_instance_id)
+    joe_ready: Boolean(row.joe_ready ?? false),
+    tunnel: Boolean(row.tunnel ?? false),
+    instance_id: row.instance_id == null ? null : preserveIntegerId(row.instance_id),
+    dblab_instance_id: row.dblab_instance_id == null ? null : preserveIntegerId(row.dblab_instance_id)
   };
 }
-async function listProjects2(params) {
+async function listProjects(params) {
   const { apiKey, apiBaseUrl, orgId, debug } = params;
   const body = {};
   if (typeof orgId === "number") {
     body.org_id = orgId;
   }
-  const rows = await callRpc2({
+  const rows = await callRpc({
     apiKey,
     apiBaseUrl,
     fn: "projects_list",
@@ -27194,166 +26111,158 @@ async function listProjects2(params) {
   if (!Array.isArray(rows)) {
     return [];
   }
-  return rows.map(normalizeProjectRow2);
+  return rows.map(normalizeProjectRow);
 }
-function isNumericProjectRef3(ref) {
+function isNumericProjectRef(ref) {
   return /^[0-9]+$/.test(ref.trim());
 }
-async function resolveProjectId2(params) {
+async function resolveJoeInstanceId(params) {
   const ref = String(params.project ?? "").trim();
   if (!ref) {
     throw new Error("project is required (--project <id|alias>)");
   }
-  if (isNumericProjectRef3(ref)) {
-    return Number(ref);
-  }
-  const projects = await listProjects2({
+  const projects = await listProjects({
     apiKey: params.apiKey,
     apiBaseUrl: params.apiBaseUrl,
     orgId: params.orgId,
     debug: params.debug
   });
   const needle = ref.toLowerCase();
-  const match = projects.find((p) => p.alias !== null && p.alias.toLowerCase() === needle || p.name !== null && p.name.toLowerCase() === needle || p.label !== null && p.label.toLowerCase() === needle);
+  const match = isNumericProjectRef(ref) ? projects.find((p) => String(p.project_id) === String(preserveIntegerId(ref))) : projects.find((p) => p.alias !== null && p.alias.toLowerCase() === needle || p.name !== null && p.name.toLowerCase() === needle);
   if (!match) {
-    throw new Error(`Project not found for alias/name '${ref}'. Run 'pgai projects' to see available projects.`);
-  }
-  return match.project_id;
-}
-function sessionStorePath2(dir) {
-  return path5.join(dir ?? getConfigDir2(), "joe-sessions.json");
-}
-function readSessionStore2(dir) {
-  const file = sessionStorePath2(dir);
-  if (!fs5.existsSync(file)) {
-    return {};
-  }
-  try {
-    const parsed = JSON.parse(fs5.readFileSync(file, "utf8"));
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-      return parsed;
+    throw new Error(`Project not found for id/alias/name '${ref}'. Run 'pgai projects' to see available projects.`);
+  }
+  if (match.instance_id == null) {
+    throw new Error(`Project '${ref}' has no Joe instance. Run 'pgai projects' to see which projects have Joe ready.`);
+  }
+  return match.instance_id;
+}
+var DESCRIBE_VARIANTS = [
+  "\\d",
+  "\\d+",
+  "\\dt",
+  "\\dt+",
+  "\\di",
+  "\\di+",
+  "\\l",
+  "\\l+",
+  "\\dv",
+  "\\dv+",
+  "\\dm",
+  "\\dm+"
+];
+function buildJoeCommandText(command, input = {}) {
+  const arg = String(input.arg ?? "").trim();
+  switch (command) {
+    case "plan":
+    case "explain":
+    case "exec":
+    case "hypo": {
+      if (!arg) {
+        throw new Error(`${command} requires an argument`);
+      }
+      return `${command} ${arg}`;
+    }
+    case "activity":
+    case "reset":
+      return command;
+    case "terminate": {
+      if (!/^[1-9][0-9]*$/.test(arg)) {
+        throw new Error("pid must be a positive integer");
+      }
+      return `terminate ${arg}`;
+    }
+    case "describe": {
+      if (!arg) {
+        throw new Error("describe requires an object name");
+      }
+      const variant = String(input.variant ?? "\\d").trim();
+      if (!DESCRIBE_VARIANTS.includes(variant)) {
+        throw new Error(`Unsupported describe variant '${variant}'. Supported: ${DESCRIBE_VARIANTS.join(" ")}`);
+      }
+      return `${variant} ${arg}`;
     }
-  } catch {}
-  return {};
-}
-function readStoredSessionId2(projectId, dir) {
-  const store = readSessionStore2(dir);
-  const value = store[String(projectId)];
-  return typeof value === "string" && value.length > 0 ? value : null;
-}
-function writeStoredSessionId2(projectId, sessionId, dir) {
-  const baseDir = dir ?? getConfigDir2();
-  if (!fs5.existsSync(baseDir)) {
-    fs5.mkdirSync(baseDir, { recursive: true, mode: 448 });
-  }
-  const store = readSessionStore2(dir);
-  store[String(projectId)] = sessionId;
-  fs5.writeFileSync(sessionStorePath2(dir), JSON.stringify(store, null, 2) + `
-`, { mode: 384 });
-}
-function clearStoredSessionId2(projectId, dir) {
-  const file = sessionStorePath2(dir);
-  if (!fs5.existsSync(file)) {
-    return;
-  }
-  const store = readSessionStore2(dir);
-  if (String(projectId) in store) {
-    delete store[String(projectId)];
-    fs5.writeFileSync(file, JSON.stringify(store, null, 2) + `
-`, { mode: 384 });
-  }
-}
-function computeIdempotencyKey2(command, projectId, sql, args) {
-  if (EXECUTING_COMMANDS2.has(command)) {
-    const canonical = `${projectId}
-${command}
-${sql ?? ""}
-${JSON.stringify(args ?? null)}`;
-    return `joe-${crypto2.createHash("sha256").update(canonical).digest("hex")}`;
   }
-  return `joe-${crypto2.randomUUID()}`;
 }
-var defaultSleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
-async function runCommand2(params) {
-  const {
-    apiKey,
-    apiBaseUrl,
-    command,
-    projectId,
-    sql,
-    args,
-    sessionId,
-    debug
-  } = params;
-  const budgetMs = typeof params.budgetMs === "number" && Number.isFinite(params.budgetMs) ? params.budgetMs : DEFAULT_BUDGET_MS2;
-  const pollIntervalMs = params.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS2;
+var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function runCommand(params) {
+  const { apiKey, apiBaseUrl, instanceId, command, debug } = params;
+  const budgetMs = typeof params.budgetMs === "number" && Number.isFinite(params.budgetMs) && params.budgetMs >= 0 ? params.budgetMs : DEFAULT_BUDGET_MS;
+  const pollIntervalMs = params.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
   const now = params.now ?? Date.now;
-  const sleep = params.sleep ?? defaultSleep2;
-  const idempotencyKey = params.idempotencyKey ?? computeIdempotencyKey2(command, projectId, sql, args);
-  const submitted = await submitCommand2({
-    apiKey,
-    apiBaseUrl,
-    command,
-    projectId,
-    sql,
-    args,
-    sessionId,
-    idempotencyKey,
-    debug
-  });
-  const commandId = submitted.command_id;
-  const newSessionId = submitted.session_id ?? sessionId ?? null;
+  const sleep = params.sleep ?? defaultSleep;
+  const commandId = await startCommand({ apiKey, apiBaseUrl, instanceId, command, debug });
   const deadline = now() + budgetMs;
-  let status = submitted.status;
-  while (true) {
-    const statusResp = await getCommandStatus2({ apiKey, apiBaseUrl, commandId, debug });
-    status = statusResp.status;
-    if (TERMINAL_STATES2.has(status)) {
-      break;
+  let status = "pending";
+  const remainingRequestMs = () => Math.max(1, Math.min(DEFAULT_HTTP_REQUEST_TIMEOUT_MS, deadline - now()));
+  if (now() >= deadline) {
+    return { commandId, status, output: null, budgetExpired: true };
+  }
+  for (;; ) {
+    let output;
+    try {
+      output = await getCommandOutput({
+        apiKey,
+        apiBaseUrl,
+        commandId,
+        debug,
+        timeoutMs: remainingRequestMs()
+      });
+    } catch (err) {
+      if (err instanceof HttpRequestTimeoutError) {
+        return { commandId, status, output: null, budgetExpired: true };
+      }
+      if (err instanceof HttpStatusError && isRetryableHttpStatus(err.status)) {
+        if (now() >= deadline) {
+          return { commandId, status, output: null, budgetExpired: true };
+        }
+        await sleep(pollIntervalMs);
+        continue;
+      }
+      throw err;
+    }
+    status = output.status;
+    if (status === "ok" || status === "error") {
+      return { commandId, status, output, budgetExpired: false };
     }
     if (now() >= deadline) {
-      return { commandId, sessionId: newSessionId, status, result: null, budgetExpired: true };
+      return { commandId, status, output: null, budgetExpired: true };
     }
     await sleep(pollIntervalMs);
   }
-  const result = await getCommandResult2({ apiKey, apiBaseUrl, commandId, debug });
-  return { commandId, sessionId: newSessionId, status, result, budgetExpired: false };
 }
-async function executeJoeCommand2(params) {
-  const projectId = await resolveProjectId2({
-    apiKey: params.apiKey,
-    apiBaseUrl: params.apiBaseUrl,
-    project: params.project,
-    orgId: params.orgId,
-    debug: params.debug
-  });
-  let sessionId;
-  if (params.newSession) {
-    clearStoredSessionId2(projectId, params.sessionDir);
-    sessionId = null;
-  } else if (params.session) {
-    sessionId = String(params.session);
+async function executeJoeCommand(params) {
+  const commandText = buildJoeCommandText(params.command, params.input);
+  let instanceId;
+  const directRef = String(params.instanceId ?? "").trim();
+  if (directRef) {
+    if (!/^[0-9]+$/.test(directRef)) {
+      throw new Error("instanceId must be a numeric Joe instance id");
+    }
+    instanceId = directRef;
+  } else if (String(params.project ?? "").trim()) {
+    instanceId = await resolveJoeInstanceId({
+      apiKey: params.apiKey,
+      apiBaseUrl: params.apiBaseUrl,
+      project: String(params.project),
+      orgId: params.orgId,
+      debug: params.debug
+    });
   } else {
-    sessionId = readStoredSessionId2(projectId, params.sessionDir);
+    throw new Error("either instanceId or project is required");
   }
-  const outcome = await runCommand2({
+  const outcome = await runCommand({
     apiKey: params.apiKey,
     apiBaseUrl: params.apiBaseUrl,
-    command: params.command,
-    projectId,
-    sql: params.sql,
-    args: params.args,
-    sessionId,
+    instanceId,
+    command: commandText,
     budgetMs: params.budgetMs,
     pollIntervalMs: params.pollIntervalMs,
     debug: params.debug,
     now: params.now,
     sleep: params.sleep
   });
-  if (outcome.sessionId) {
-    writeStoredSessionId2(projectId, outcome.sessionId, params.sessionDir);
-  }
-  return { ...outcome, command: params.command, projectId };
+  return { ...outcome, command: params.command, instanceId, commandText };
 }
 function clientSidePlanFlags(planJson) {
   const flags = [];
@@ -27372,57 +26281,44 @@ function clientSidePlanFlags(planJson) {
       }
     }
   };
+  if (Array.isArray(planJson)) {
+    for (const entry of planJson) {
+      if (entry && typeof entry === "object") {
+        walk(entry.Plan ?? entry);
+      }
+    }
+    return flags;
+  }
   if (planJson && typeof planJson === "object") {
     const root = planJson;
     walk(root.Plan ?? planJson);
   }
   return flags;
 }
-function formatJoeResult(command, result) {
+function formatJoeOutput(output) {
   const lines = [];
-  switch (command) {
-    case "plan":
-    case "explain": {
-      if (result.plan_text) {
-        lines.push(result.plan_text);
-      }
-      for (const flag of clientSidePlanFlags(result.plan_json)) {
-        lines.push(`⚑ ${flag}`);
-      }
-      if (result.queryid || result.plan_fingerprint) {
-        lines.push(`(queryid ${result.queryid ?? "?"} · plan_fp ${result.plan_fingerprint ?? "?"})`);
-      }
-      break;
-    }
-    case "exec": {
-      const notices = result.notices ?? [];
-      const rowCount = result.row_count ?? 0;
-      lines.push(`${notices.join(" ") || "OK"} · ${rowCount} row${rowCount === 1 ? "" : "s"}`);
-      if (result.result_rows && result.result_rows.length > 0) {
-        lines.push(JSON.stringify(result.result_rows, null, 2));
-      }
-      break;
-    }
-    case "hypo": {
-      lines.push(result.hypo_used ? "hypothetical index would be used" : "hypothetical index would NOT be used");
-      if (result.hypo_plan !== undefined) {
-        lines.push(JSON.stringify(result.hypo_plan, null, 2));
-      }
-      break;
-    }
-    case "activity":
-    case "describe": {
-      lines.push(JSON.stringify(result.snapshot ?? null, null, 2));
-      break;
-    }
-    case "terminate": {
-      lines.push(`terminated ${result.terminated ? "yes" : "no"} · pid ${result.pid ?? "?"}`);
-      break;
-    }
-    case "reset": {
-      lines.push(`reset ${result.reset ? "ok" : "no"}`);
-      break;
-    }
+  const section = (value, label) => {
+    if (value == null || value.trim() === "")
+      return;
+    if (lines.length > 0)
+      lines.push("");
+    if (label)
+      lines.push(`${label}:`);
+    lines.push(value);
+  };
+  section(output.response);
+  section(output.plan_text, "plan");
+  const flags = clientSidePlanFlags(output.plan_json).map((flag) => `⚑ ${flag}`);
+  if (flags.length > 0) {
+    lines.push(...flags);
+  }
+  section(output.plan_execution_text, "execution plan (EXPLAIN ANALYZE)");
+  section(output.stats, "stats");
+  section(output.recommendations, "recommendations");
+  if (output.queryid) {
+    if (lines.length > 0)
+      lines.push("");
+    lines.push(`(queryid ${output.queryid})`);
   }
   return lines.join(`
 `);
@@ -27442,293 +26338,11 @@ function formatProjectsTable(projects) {
 `);
 }
 
-// lib/dblab.ts
-function isNumericProjectRef4(ref) {
-  return /^[0-9]+$/.test(ref.trim());
-}
-async function resolveDblabInstanceId2(params) {
-  const { apiKey, apiBaseUrl, orgId, debug } = params;
-  if (!apiKey) {
-    throw new Error("API key is required");
-  }
-  const ref = String(params.project ?? "").trim();
-  if (!ref) {
-    throw new Error("project is required (--project <id|alias>)");
-  }
-  let projects;
-  try {
-    projects = await listProjects({ apiKey, apiBaseUrl, orgId, debug });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    throw new Error(`Failed to resolve project's DBLab instance: ${message}`);
-  }
-  const numeric = isNumericProjectRef4(ref);
-  const needle = ref.toLowerCase();
-  const match = projects.find((p) => {
-    if (numeric) {
-      return String(p.project_id) === ref;
-    }
-    return p.alias !== null && p.alias.toLowerCase() === needle || p.name !== null && p.name.toLowerCase() === needle || p.label !== null && p.label.toLowerCase() === needle;
-  });
-  if (!match) {
-    throw new Error(`No DBLab instance found for project '${ref}'. Run 'pgai projects' to see available projects.`);
-  }
-  if (match.dblab_instance_id == null) {
-    throw new Error(`Project '${ref}' has no active DBLab instance. Register a DBLab instance for it in the Console first.`);
-  }
-  return String(match.dblab_instance_id);
-}
-async function callDblabApi2(params) {
-  const { apiKey, apiBaseUrl, instanceId, action, method, data, operation, debug } = params;
-  if (!apiKey) {
-    throw new Error("API key is required");
-  }
-  if (!instanceId) {
-    throw new Error("instanceId is required");
-  }
-  const base = normalizeBaseUrl(apiBaseUrl);
-  const url = new URL(`${base}/rpc/dblab_api_call`);
-  const bodyObj = {
-    instance_id: instanceId,
-    action,
-    method
-  };
-  if (data !== undefined) {
-    bodyObj.data = data;
-  }
-  const body = JSON.stringify(bodyObj);
-  const headers = {
-    "access-token": apiKey,
-    "Content-Type": "application/json",
-    Connection: "close"
-  };
-  if (debug) {
-    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.error(`Debug: POST URL: ${url.toString()}`);
-    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
-    console.error(`Debug: Request body: ${redactSecretsForLog(body)}`);
-  }
-  let response;
-  try {
-    response = await fetch(url.toString(), { method: "POST", headers, body });
-  } catch (err) {
-    throw new Error(describeFetchError(operation, base, err));
-  }
-  const text = await response.text();
-  if (debug) {
-    console.error(`Debug: Response status: ${response.status}`);
-    console.error(`Debug: Response body: ${redactSecretsForLog(text)}`);
-  }
-  if (!response.ok) {
-    throw new Error(formatHttpError(operation, response.status, text, response.statusText));
-  }
-  if (text.trim() === "") {
-    return null;
-  }
-  try {
-    return JSON.parse(text);
-  } catch {
-    throw new Error(`${operation}: failed to parse response: ${text}`);
-  }
-}
-async function createClone2(params) {
-  const { apiKey, apiBaseUrl, instanceId, cloneId, branch, snapshotId, dbUser, dbPassword, isProtected, debug } = params;
-  const data = { protected: Boolean(isProtected) };
-  if (cloneId)
-    data.id = cloneId;
-  if (branch)
-    data.branch = branch;
-  if (snapshotId)
-    data.snapshot = { id: snapshotId };
-  if (dbUser && dbPassword)
-    data.db = { username: dbUser, password: dbPassword };
-  return callDblabApi2({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action: "/clone",
-    method: "post",
-    data,
-    operation: "Failed to create clone",
-    debug
-  });
-}
-async function listClones2(params) {
-  const { apiKey, apiBaseUrl, instanceId, debug } = params;
-  return callDblabApi2({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action: "/clones",
-    method: "get",
-    operation: "Failed to list clones",
-    debug
-  });
-}
-async function getClone2(params) {
-  const { apiKey, apiBaseUrl, instanceId, cloneId, debug } = params;
-  if (!cloneId)
-    throw new Error("cloneId is required");
-  return callDblabApi2({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action: `/clone/${encodeURIComponent(cloneId)}`,
-    method: "get",
-    operation: "Failed to get clone",
-    debug
-  });
-}
-async function resetClone2(params) {
-  const { apiKey, apiBaseUrl, instanceId, cloneId, snapshotId, latest, debug } = params;
-  if (!cloneId)
-    throw new Error("cloneId is required");
-  const data = { latest: latest ?? !snapshotId };
-  if (snapshotId)
-    data.snapshotID = snapshotId;
-  return callDblabApi2({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action: `/clone/${encodeURIComponent(cloneId)}/reset`,
-    method: "post",
-    data,
-    operation: "Failed to reset clone",
-    debug
-  });
-}
-async function destroyClone2(params) {
-  const { apiKey, apiBaseUrl, instanceId, cloneId, debug } = params;
-  if (!cloneId)
-    throw new Error("cloneId is required");
-  return callDblabApi2({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action: `/clone/${encodeURIComponent(cloneId)}`,
-    method: "delete",
-    operation: "Failed to destroy clone",
-    debug
-  });
-}
-async function listBranches2(params) {
-  const { apiKey, apiBaseUrl, instanceId, debug } = params;
-  return callDblabApi2({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action: "/branches",
-    method: "get",
-    operation: "Failed to list branches",
-    debug
-  });
-}
-async function createBranch2(params) {
-  const { apiKey, apiBaseUrl, instanceId, branchName, baseBranch, snapshotId, debug } = params;
-  if (!branchName)
-    throw new Error("branchName is required");
-  const data = { branchName };
-  if (baseBranch)
-    data.baseBranch = baseBranch;
-  if (snapshotId)
-    data.snapshotID = snapshotId;
-  return callDblabApi2({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action: "/branch",
-    method: "post",
-    data,
-    operation: "Failed to create branch",
-    debug
-  });
-}
-async function deleteBranch2(params) {
-  const { apiKey, apiBaseUrl, instanceId, branchName, debug } = params;
-  if (!branchName)
-    throw new Error("branchName is required");
-  return callDblabApi2({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action: `/branch/${encodeURIComponent(branchName)}`,
-    method: "delete",
-    operation: "Failed to delete branch",
-    debug
-  });
-}
-async function branchLog2(params) {
-  const { apiKey, apiBaseUrl, instanceId, branchName, debug } = params;
-  if (!branchName)
-    throw new Error("branchName is required");
-  return callDblabApi2({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action: `/branch/${encodeURIComponent(branchName)}/log`,
-    method: "get",
-    operation: "Failed to fetch branch log",
-    debug
-  });
-}
-async function listSnapshots2(params) {
-  const { apiKey, apiBaseUrl, instanceId, branchName, dataset, debug } = params;
-  const qs = new URLSearchParams;
-  const branch = branchName?.trim();
-  if (branch)
-    qs.append("branch", branch);
-  if (dataset)
-    qs.append("dataset", dataset);
-  const action = `/snapshots${qs.toString() ? `?${qs.toString()}` : ""}`;
-  return callDblabApi2({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action,
-    method: "get",
-    operation: "Failed to list snapshots",
-    debug
-  });
-}
-async function createSnapshot2(params) {
-  const { apiKey, apiBaseUrl, instanceId, cloneId, message, debug } = params;
-  if (!cloneId)
-    throw new Error("cloneId is required");
-  const data = { cloneID: cloneId };
-  if (message)
-    data.message = message;
-  return callDblabApi2({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action: "/branch/snapshot",
-    method: "post",
-    data,
-    operation: "Failed to create snapshot",
-    debug
-  });
-}
-async function destroySnapshot2(params) {
-  const { apiKey, apiBaseUrl, instanceId, snapshotId, force, debug } = params;
-  if (!snapshotId)
-    throw new Error("snapshotId is required");
-  const action = `/snapshot/${snapshotId}?force=${Boolean(force)}`;
-  return callDblabApi2({
-    apiKey,
-    apiBaseUrl,
-    instanceId,
-    action,
-    method: "delete",
-    operation: "Failed to destroy snapshot",
-    debug
-  });
-}
-
 // bin/postgres-ai.ts
 init_util();
 
 // lib/instances.ts
-import * as fs6 from "fs";
+import * as fs4 from "fs";
 
 // node_modules/js-yaml/dist/js-yaml.mjs
 /*! js-yaml 4.1.1 https://github.com/nodeca/js-yaml @license MIT */
@@ -30393,11 +29007,11 @@ class InstancesParseError extends Error {
   }
 }
 function loadInstances(file) {
-  if (!fs6.existsSync(file))
+  if (!fs4.existsSync(file))
     return [];
-  if (fs6.lstatSync(file).isDirectory())
+  if (fs4.lstatSync(file).isDirectory())
     return [];
-  const text = fs6.readFileSync(file, "utf8");
+  const text = fs4.readFileSync(file, "utf8");
   if (text.trim() === "")
     return [];
   let parsed;
@@ -30575,8 +29189,8 @@ async function registerAasCollection(apiKey, instanceId, opts) {
 }
 
 // lib/storage.ts
-import * as fs7 from "fs";
-import * as path6 from "path";
+import * as fs5 from "fs";
+import * as path4 from "path";
 var MAX_UPLOAD_SIZE2 = 500 * 1024 * 1024;
 var MAX_DOWNLOAD_SIZE2 = 500 * 1024 * 1024;
 var MIME_TYPES2 = {
@@ -30617,11 +29231,11 @@ async function uploadFile2(params) {
   if (!filePath) {
     throw new Error("filePath is required");
   }
-  const resolvedPath = path6.resolve(filePath);
-  if (!fs7.existsSync(resolvedPath)) {
+  const resolvedPath = path4.resolve(filePath);
+  if (!fs5.existsSync(resolvedPath)) {
     throw new Error(`File not found: ${resolvedPath}`);
   }
-  const stat = fs7.statSync(resolvedPath);
+  const stat = fs5.statSync(resolvedPath);
   if (!stat.isFile()) {
     throw new Error(`Not a file: ${resolvedPath}`);
   }
@@ -30633,9 +29247,9 @@ async function uploadFile2(params) {
     console.error("Warning: storage URL uses HTTP — API key will be sent unencrypted");
   }
   const url = `${base}/upload`;
-  const fileBuffer = fs7.readFileSync(resolvedPath);
-  const fileName = path6.basename(resolvedPath);
-  const ext = path6.extname(fileName).toLowerCase();
+  const fileBuffer = fs5.readFileSync(resolvedPath);
+  const fileName = path4.basename(resolvedPath);
+  const ext = path4.extname(fileName).toLowerCase();
   const mimeType = MIME_TYPES2[ext] || "application/octet-stream";
   const formData = new FormData;
   formData.append("file", new Blob([fileBuffer], { type: mimeType }), fileName);
@@ -30694,15 +29308,15 @@ async function downloadFile2(params) {
     const relativePath = fileUrl.startsWith("/") ? fileUrl : `/${fileUrl}`;
     fullUrl = `${base}${relativePath}`;
   }
-  const urlFilename = path6.basename(new URL(fullUrl).pathname);
+  const urlFilename = path4.basename(new URL(fullUrl).pathname);
   if (!urlFilename) {
     throw new Error("Cannot derive filename from URL; please specify --output");
   }
-  const saveTo = outputPath ? path6.resolve(outputPath) : path6.resolve(urlFilename);
+  const saveTo = outputPath ? path4.resolve(outputPath) : path4.resolve(urlFilename);
   if (!outputPath) {
-    const normalizedSave = path6.normalize(saveTo);
-    const cwd = path6.normalize(process.cwd());
-    if (normalizedSave !== cwd && !normalizedSave.startsWith(cwd + path6.sep)) {
+    const normalizedSave = path4.normalize(saveTo);
+    const cwd = path4.normalize(process.cwd());
+    if (normalizedSave !== cwd && !normalizedSave.startsWith(cwd + path4.sep)) {
       throw new Error("Derived output path escapes current directory; please specify --output");
     }
   }
@@ -30734,11 +29348,11 @@ async function downloadFile2(params) {
   }
   const arrayBuffer = await response.arrayBuffer();
   const buffer = Buffer.from(arrayBuffer);
-  const parentDir = path6.dirname(saveTo);
-  if (!fs7.existsSync(parentDir)) {
-    fs7.mkdirSync(parentDir, { recursive: true });
+  const parentDir = path4.dirname(saveTo);
+  if (!fs5.existsSync(parentDir)) {
+    fs5.mkdirSync(parentDir, { recursive: true });
   }
-  fs7.writeFileSync(saveTo, buffer);
+  fs5.writeFileSync(saveTo, buffer);
   return {
     savedTo: saveTo,
     size: buffer.length,
@@ -30750,9 +29364,9 @@ function buildMarkdownLink2(fileUrl, storageBaseUrl, filename) {
   const base = normalizeBaseUrl(storageBaseUrl);
   const normalizedFileUrl = fileUrl.startsWith("/") ? fileUrl : `/${fileUrl}`;
   const fullUrl = fileUrl.startsWith("http://") || fileUrl.startsWith("https://") ? fileUrl : `${base}${normalizedFileUrl}`;
-  const name = filename || path6.basename(new URL(fullUrl).pathname);
+  const name = filename || path4.basename(new URL(fullUrl).pathname);
   const safeName = name.replace(/[\[\]()]/g, "\\$&");
-  const ext = path6.extname(name).toLowerCase();
+  const ext = path4.extname(name).toLowerCase();
   if (IMAGE_EXTENSIONS2.has(ext)) {
     return `![${safeName}](${fullUrl})`;
   }
@@ -30798,8 +29412,8 @@ ${links}`;
 // lib/init.ts
 import { randomBytes } from "crypto";
 import { URL as URL2, fileURLToPath } from "url";
-import * as fs8 from "fs";
-import * as path7 from "path";
+import * as fs6 from "fs";
+import * as path5 from "path";
 var DEFAULT_MONITORING_USER = "postgres_ai_mon";
 var KNOWN_PROVIDERS = ["self-managed", "supabase"];
 var SKIP_ROLE_CREATION_PROVIDERS = ["supabase"];
@@ -30891,21 +29505,21 @@ async function connectWithSslFallback(ClientClass, adminConn, verbose) {
 }
 function sqlDir() {
   const currentFile = fileURLToPath(import.meta.url);
-  const currentDir = path7.dirname(currentFile);
+  const currentDir = path5.dirname(currentFile);
   const candidates = [
-    path7.resolve(currentDir, "..", "sql"),
-    path7.resolve(currentDir, "..", "..", "sql")
+    path5.resolve(currentDir, "..", "sql"),
+    path5.resolve(currentDir, "..", "..", "sql")
   ];
   for (const candidate of candidates) {
-    if (fs8.existsSync(candidate)) {
+    if (fs6.existsSync(candidate)) {
       return candidate;
     }
   }
   throw new Error(`SQL directory not found. Searched: ${candidates.join(", ")}`);
 }
 function loadSqlTemplate(filename) {
-  const p = path7.join(sqlDir(), filename);
-  return fs8.readFileSync(p, "utf8");
+  const p = path5.join(sqlDir(), filename);
+  return fs6.readFileSync(p, "utf8");
 }
 function applyTemplate(sql, vars) {
   return sql.replace(/\{\{([A-Z0-9_]+)\}\}/g, (_, key) => {
@@ -31441,10 +30055,28 @@ async function checkCurrentUserPermissions(client) {
 
       union all
 
+      select
+        'postgres_ai schema exists' as permission_name,
+        'optional' as status,
+        to_regnamespace('postgres_ai') is not null as granted
+
+      union all
+
+      select
+        'usage on postgres_ai schema' as permission_name,
+        'optional' as status,
+        case
+          when to_regnamespace('postgres_ai') is null then null
+          else has_schema_privilege(current_user, 'postgres_ai', 'USAGE')
+        end as granted
+
+      union all
+
       select
         'postgres_ai.pg_statistic view exists' as permission_name,
         'optional' as status,
         case
+          when to_regnamespace('postgres_ai') is null then null
           when not has_schema_privilege(current_user, 'postgres_ai', 'USAGE') then null
           else to_regclass('postgres_ai.pg_statistic') is not null
         end as granted
@@ -31455,6 +30087,7 @@ async function checkCurrentUserPermissions(client) {
         'select on postgres_ai.pg_statistic' as permission_name,
         'optional' as status,
         case
+          when to_regnamespace('postgres_ai') is null then null
           when not has_schema_privilege(current_user, 'postgres_ai', 'USAGE') then null
           when to_regclass('postgres_ai.pg_statistic') is null then null
           else has_table_privilege(current_user, 'postgres_ai.pg_statistic', 'select')
@@ -31474,6 +30107,10 @@ async function checkCurrentUserPermissions(client) {
             when permission_name like 'select on pg_catalog.pg_index' then
               format('grant select on pg_catalog.pg_index to %I;', current_user)
           end
+        when permission_name = 'postgres_ai schema exists' and granted = false then
+          '-- run postgresai prepare-db or create the postgres_ai schema and pg_statistic view manually'
+        when permission_name = 'usage on postgres_ai schema' and granted = false then
+          format('grant usage on schema postgres_ai to %I;', current_user)
         when permission_name = 'postgres_ai.pg_statistic view exists' and granted = false then
           '-- create postgres_ai.pg_statistic view (see setup script)'
         when permission_name = 'select on postgres_ai.pg_statistic' and granted = false then
@@ -31500,6 +30137,10 @@ function formatPermissionCheckMessages(result) {
   const warnings = [];
   const errors3 = [];
   for (const row of result.missingOptional) {
+    if (row.permission_name === "postgres_ai schema exists") {
+      warnings.push("Warning: optional: postgres_ai schema not found — F004/F005 (bloat estimates) will be skipped; run prepare-db or create the view manually to enable them.");
+      continue;
+    }
     const fix = row.fix_command ? ` Fix: ${row.fix_command}` : "";
     warnings.push(`Warning: optional permission missing — ${row.permission_name}.${fix}`);
   }
@@ -31950,9 +30591,9 @@ function escapeLiteral2(value) {
 }
 
 // lib/pkce.ts
-import * as crypto3 from "crypto";
+import * as crypto from "crypto";
 function generateRandomString(length = 64) {
-  const bytes = crypto3.randomBytes(length);
+  const bytes = crypto.randomBytes(length);
   return base64URLEncode(bytes);
 }
 function base64URLEncode(buffer) {
@@ -31962,7 +30603,7 @@ function generateCodeVerifier() {
   return generateRandomString(32);
 }
 function generateCodeChallenge(verifier) {
-  const hash = crypto3.createHash("sha256").update(verifier).digest();
+  const hash = crypto.createHash("sha256").update(verifier).digest();
   return base64URLEncode(hash);
 }
 function generateState() {
@@ -32191,8 +30832,8 @@ import { createInterface } from "readline";
 import * as childProcess from "child_process";
 
 // lib/checkup.ts
-import * as fs9 from "fs";
-import * as path8 from "path";
+import * as fs7 from "fs";
+import * as path6 from "path";
 
 // lib/metrics-embedded.ts
 var METRICS = {
@@ -33923,7 +32564,7 @@ function buildCheckInfoMap() {
 }
 
 // lib/checkup.ts
-var __dirname = "/home/agent/workspace/postgresai-joe-v2/cli/lib";
+var __dirname = "/Users/nik/gitlab/postgresai-wt-joe-cli/cli/lib";
 var SECONDS_PER_DAY = 86400;
 var SECONDS_PER_HOUR = 3600;
 var SECONDS_PER_MINUTE = 60;
@@ -34409,7 +33050,7 @@ function createBaseReport(checkId, checkTitle, nodeName) {
 }
 function readTextFileSafe(p) {
   try {
-    const value = fs9.readFileSync(p, "utf8").trim();
+    const value = fs7.readFileSync(p, "utf8").trim();
     return value || null;
   } catch {
     return null;
@@ -34422,8 +33063,8 @@ function resolveBuildTs() {
   if (fromFile)
     return fromFile;
   try {
-    const pkgRoot = path8.resolve(__dirname, "..");
-    const fromPkgFile = readTextFileSafe(path8.join(pkgRoot, "BUILD_TS"));
+    const pkgRoot = path6.resolve(__dirname, "..");
+    const fromPkgFile = readTextFileSafe(path6.join(pkgRoot, "BUILD_TS"));
     if (fromPkgFile)
       return fromPkgFile;
   } catch (err) {
@@ -34431,8 +33072,8 @@ function resolveBuildTs() {
     console.warn(`[resolveBuildTs] Warning: path resolution failed: ${errorMsg}`);
   }
   try {
-    const pkgJsonPath = path8.resolve(__dirname, "..", "package.json");
-    const st = fs9.statSync(pkgJsonPath);
+    const pkgJsonPath = path6.resolve(__dirname, "..", "package.json");
+    const st = fs7.statSync(pkgJsonPath);
     return st.mtime.toISOString();
   } catch (err) {
     if (process.env.DEBUG) {
@@ -34688,12 +33329,70 @@ async function generateF003(client, nodeName) {
   };
   return report;
 }
+function bloatErrorStatus(err) {
+  const error2 = err instanceof Error ? err.message : String(err);
+  const code = typeof err === "object" && err !== null && "code" in err ? String(err.code || "") : "";
+  const normalized = error2.toLowerCase();
+  let reason = "query_error";
+  if (code === "3F000" || normalized.includes('schema "postgres_ai" does not exist')) {
+    reason = "missing_schema";
+  } else if (code === "42P01" || normalized.includes('relation "postgres_ai.pg_statistic" does not exist')) {
+    reason = "missing_view";
+  } else if (code === "42501" || normalized.includes("permission denied")) {
+    reason = "missing_grant";
+  }
+  return { ok: false, reason, error: error2 };
+}
+async function getBloatCheckStatus(client) {
+  try {
+    const result = await client.query(`
+      select
+        to_regnamespace('postgres_ai') is not null as schema_exists,
+        case
+          when to_regnamespace('postgres_ai') is null then false
+          else has_schema_privilege(current_user, 'postgres_ai', 'USAGE')
+        end as schema_usage,
+        case
+          when to_regnamespace('postgres_ai') is null then false
+          when not has_schema_privilege(current_user, 'postgres_ai', 'USAGE') then false
+          else to_regclass('postgres_ai.pg_statistic') is not null
+        end as view_exists,
+        case
+          when to_regnamespace('postgres_ai') is null then false
+          when not has_schema_privilege(current_user, 'postgres_ai', 'USAGE') then false
+          when to_regclass('postgres_ai.pg_statistic') is null then false
+          else has_table_privilege(current_user, 'postgres_ai.pg_statistic', 'SELECT')
+        end as view_select
+    `);
+    const capability = result.rows[0] || {};
+    if (!capability.schema_exists) {
+      return { ok: false, reason: "missing_schema", error: 'schema "postgres_ai" does not exist' };
+    }
+    if (!capability.schema_usage) {
+      return { ok: false, reason: "missing_grant", error: "permission denied for schema postgres_ai" };
+    }
+    if (!capability.view_exists) {
+      return { ok: false, reason: "missing_view", error: 'relation "postgres_ai.pg_statistic" does not exist' };
+    }
+    if (!capability.view_select) {
+      return { ok: false, reason: "missing_grant", error: "permission denied for relation postgres_ai.pg_statistic" };
+    }
+    return { ok: true, reason: null, error: null };
+  } catch (err) {
+    return bloatErrorStatus(err);
+  }
+}
 async function generateF004(client, nodeName) {
   const report = createBaseReport("F004", "Autovacuum: heap bloat (estimated)", nodeName);
   const postgresVersion = await getPostgresVersion(client);
   const pgMajorVersion = parseInt(postgresVersion.server_major_ver, 10);
   let bloatedTables = [];
+  let status = await getBloatCheckStatus(client);
   try {
+    if (!status.ok)
+      throw Object.assign(new Error(status.error || "Bloat prerequisites unavailable"), {
+        code: status.reason === "missing_schema" ? "3F000" : status.reason === "missing_view" ? "42P01" : status.reason === "missing_grant" ? "42501" : undefined
+      });
     const sql = getMetricSql(METRIC_NAMES.F004, pgMajorVersion);
     const bloatResult = await client.query(sql);
     const vacuumStatsResult = await client.query(`
@@ -34737,7 +33436,8 @@ async function generateF004(client, nodeName) {
       };
     });
   } catch (err) {
-    const errorMsg = err instanceof Error ? err.message : String(err);
+    status = bloatErrorStatus(err);
+    const errorMsg = status.error || "Unknown error";
     console.error(`[F004] Error estimating table bloat: ${errorMsg}`);
     if (errorMsg.includes("postgres_ai.")) {
       console.error(`  Hint: Run "postgresai prepare-db <connection>" to create required objects.`);
@@ -34747,6 +33447,7 @@ async function generateF004(client, nodeName) {
   const totalCount = bloatedTables.length;
   const totalBloatSizeBytes = bloatedTables.reduce((sum, t) => sum + t.bloat_size, 0);
   const dbEntry = {
+    status,
     bloated_tables: bloatedTables,
     total_count: totalCount,
     total_bloat_size_bytes: totalBloatSizeBytes,
@@ -34765,7 +33466,12 @@ async function generateF005(client, nodeName) {
   const postgresVersion = await getPostgresVersion(client);
   const pgMajorVersion = parseInt(postgresVersion.server_major_ver, 10);
   let bloatedIndexes = [];
+  let status = await getBloatCheckStatus(client);
   try {
+    if (!status.ok)
+      throw Object.assign(new Error(status.error || "Bloat prerequisites unavailable"), {
+        code: status.reason === "missing_schema" ? "3F000" : status.reason === "missing_view" ? "42P01" : status.reason === "missing_grant" ? "42501" : undefined
+      });
     const sql = getMetricSql(METRIC_NAMES.F005, pgMajorVersion);
     const bloatResult = await client.query(sql);
     const vacuumStatsResult = await client.query(`
@@ -34814,7 +33520,8 @@ async function generateF005(client, nodeName) {
       };
     });
   } catch (err) {
-    const errorMsg = err instanceof Error ? err.message : String(err);
+    status = bloatErrorStatus(err);
+    const errorMsg = status.error || "Unknown error";
     console.error(`[F005] Error estimating index bloat: ${errorMsg}`);
     if (errorMsg.includes("postgres_ai.")) {
       console.error(`  Hint: Run "postgresai prepare-db <connection>" to create required objects.`);
@@ -34824,6 +33531,7 @@ async function generateF005(client, nodeName) {
   const totalCount = bloatedIndexes.length;
   const totalBloatSizeBytes = bloatedIndexes.reduce((sum, idx) => sum + idx.bloat_size, 0);
   const dbEntry = {
+    status,
     bloated_indexes: bloatedIndexes,
     total_count: totalCount,
     total_bloat_size_bytes: totalBloatSizeBytes,
@@ -35496,6 +34204,10 @@ function generateCheckSummary(checkId, report) {
       return summarizeF001(nodeData);
     case "F003":
       return summarizeF003(nodeData);
+    case "F004":
+      return summarizeBloat(nodeData, "table");
+    case "F005":
+      return summarizeBloat(nodeData, "index");
     case "G001":
       return summarizeG001(nodeData);
     case "G003":
@@ -35681,6 +34393,25 @@ function summarizeF003(nodeData) {
   }
   return { status: "warning", message: parts.join(", ") };
 }
+function summarizeBloat(nodeData, kind) {
+  const data = nodeData?.data || {};
+  let totalCount = 0;
+  for (const dbData of Object.values(data)) {
+    const dbEntry = dbData;
+    if (dbEntry?.status?.ok === false) {
+      const reason = String(dbEntry.status.reason || "query_error").replaceAll("_", " ");
+      return { status: "warning", message: `Bloat estimate degraded: ${reason}` };
+    }
+    totalCount += dbEntry?.total_count || 0;
+  }
+  if (totalCount === 0) {
+    return { status: "ok", message: `No bloated ${kind}${kind === "index" ? "es" : "s"} found` };
+  }
+  return {
+    status: "warning",
+    message: `Found ${totalCount} bloated ${kind}${totalCount === 1 ? "" : kind === "index" ? "es" : "s"}`
+  };
+}
 function summarizeG001(nodeData) {
   const data = nodeData?.data || {};
   const settingsCount = Object.keys(data).length;
@@ -35713,7 +34444,7 @@ function summarizeG003(nodeData) {
 }
 
 // lib/instances.ts
-import * as fs10 from "fs";
+import * as fs8 from "fs";
 class InstancesParseError2 extends Error {
   constructor(file, cause) {
     const causeMsg = cause instanceof Error ? cause.message : String(cause);
@@ -35722,11 +34453,11 @@ class InstancesParseError2 extends Error {
   }
 }
 function loadInstances2(file) {
-  if (!fs10.existsSync(file))
+  if (!fs8.existsSync(file))
     return [];
-  if (fs10.lstatSync(file).isDirectory())
+  if (fs8.lstatSync(file).isDirectory())
     return [];
-  const text = fs10.readFileSync(file, "utf8");
+  const text = fs8.readFileSync(file, "utf8");
   if (text.trim() === "")
     return [];
   let parsed;
@@ -35759,22 +34490,22 @@ function buildInstance(name, connStr) {
   };
 }
 function addInstanceToFile(file, instance) {
-  if (fs10.existsSync(file) && fs10.lstatSync(file).isDirectory()) {
-    fs10.rmSync(file, { recursive: true, force: true });
+  if (fs8.existsSync(file) && fs8.lstatSync(file).isDirectory()) {
+    fs8.rmSync(file, { recursive: true, force: true });
   }
   const existing = loadInstances2(file);
   if (existing.some((i3) => i3.name === instance.name)) {
     throw new Error(`Monitoring target '${instance.name}' already exists`);
   }
   existing.push(instance);
-  fs10.writeFileSync(file, dump2(existing), "utf8");
+  fs8.writeFileSync(file, dump2(existing), "utf8");
 }
 function removeInstanceFromFile(file, name) {
   const instances = loadInstances2(file);
   const filtered = instances.filter((i3) => i3.name !== name);
   if (filtered.length === instances.length)
     return false;
-  fs10.writeFileSync(file, dump2(filtered), "utf8");
+  fs8.writeFileSync(file, dump2(filtered), "utf8");
   return true;
 }
 function extractSslmode(connStr) {
@@ -35869,13 +34600,13 @@ function stripMatchingQuotes(value) {
   return trimmed;
 }
 var REQUIRED_ENV_KEYS = [
-  { key: "REPLICATOR_PASSWORD", defaultValue: () => crypto4.randomBytes(32).toString("hex"), introducedIn: "0.13" },
+  { key: "REPLICATOR_PASSWORD", defaultValue: () => crypto2.randomBytes(32).toString("hex"), introducedIn: "0.13" },
   { key: "VM_AUTH_USERNAME", defaultValue: () => "vmauth", introducedIn: "0.15" },
-  { key: "VM_AUTH_PASSWORD", defaultValue: () => crypto4.randomBytes(18).toString("base64"), introducedIn: "0.15" }
+  { key: "VM_AUTH_PASSWORD", defaultValue: () => crypto2.randomBytes(18).toString("base64"), introducedIn: "0.15" }
 ];
 function ensureRequiredEnvVars(projectDir) {
-  const envFile = path9.resolve(projectDir, ".env");
-  const existing = fs11.existsSync(envFile) ? fs11.readFileSync(envFile, "utf8") : "";
+  const envFile = path7.resolve(projectDir, ".env");
+  const existing = fs9.existsSync(envFile) ? fs9.readFileSync(envFile, "utf8") : "";
   const added = [];
   const appendLines = [];
   for (const spec of REQUIRED_ENV_KEYS) {
@@ -35894,7 +34625,7 @@ function ensureRequiredEnvVars(projectDir) {
 ` : "") + appendLines.join(`
 `) + `
 `;
-  fs11.writeFileSync(envFile, newContent, { encoding: "utf8", mode: 384 });
+  fs9.writeFileSync(envFile, newContent, { encoding: "utf8", mode: 384 });
   return added;
 }
 async function execFilePromise(file, args) {
@@ -35959,7 +34690,7 @@ function expandHomePath(p) {
   if (s === "~")
     return os3.homedir();
   if (s.startsWith("~/") || s.startsWith("~\\")) {
-    return path9.join(os3.homedir(), s.slice(2));
+    return path7.join(os3.homedir(), s.slice(2));
   }
   return s;
 }
@@ -36008,10 +34739,10 @@ function prepareOutputDirectory(outputOpt) {
   if (!outputOpt)
     return;
   const outputDir = expandHomePath(outputOpt);
-  const outputPath = path9.isAbsolute(outputDir) ? outputDir : path9.resolve(process.cwd(), outputDir);
-  if (!fs11.existsSync(outputPath)) {
+  const outputPath = path7.isAbsolute(outputDir) ? outputDir : path7.resolve(process.cwd(), outputDir);
+  if (!fs9.existsSync(outputPath)) {
     try {
-      fs11.mkdirSync(outputPath, { recursive: true });
+      fs9.mkdirSync(outputPath, { recursive: true });
     } catch (e) {
       const errAny = e;
       const code = typeof errAny?.code === "string" ? errAny.code : "";
@@ -36037,9 +34768,15 @@ function prepareUploadConfig(opts, rootOpts, shouldUpload, uploadExplicitlyReque
       console.error("Tip: run 'postgresai auth' or pass --api-key / set PGAI_API_KEY");
       return null;
     }
-    console.error("Notice: no API key configured \u2014 results will NOT be uploaded to PostgresAI.");
-    console.error("        To upload: run 'postgresai auth login' or pass --api-key / set PGAI_API_KEY.");
-    console.error("        To run locally without this notice, pass --no-upload.");
+    if (opts.markdown) {
+      console.error("Notice: no API key configured \u2014 regular report upload is disabled.");
+      console.error("        The full report JSON will still be sent to the PostgresAI API for markdown conversion.");
+      console.error("        To avoid sending report data, replace --markdown with --no-upload and --json or --output.");
+    } else {
+      console.error("Notice: no API key configured \u2014 results will NOT be uploaded to PostgresAI.");
+      console.error("        To upload: run 'postgresai auth login' or pass --api-key / set PGAI_API_KEY.");
+      console.error("        To run locally without this notice, pass --no-upload.");
+    }
     return;
   }
   const cfg = readConfig();
@@ -36047,7 +34784,7 @@ function prepareUploadConfig(opts, rootOpts, shouldUpload, uploadExplicitlyReque
   let project = (opts.project || cfg.defaultProject || "").trim();
   let projectWasGenerated = false;
   if (!project) {
-    project = `project_${crypto4.randomBytes(6).toString("hex")}`;
+    project = `project_${crypto2.randomBytes(6).toString("hex")}`;
     projectWasGenerated = true;
     try {
       writeConfig({ defaultProject: project });
@@ -36093,8 +34830,8 @@ async function uploadCheckupReports(uploadCfg, reports, spinner, logUpload) {
 }
 function writeReportFiles(reports, outputPath) {
   for (const [checkId, report] of Object.entries(reports)) {
-    const filePath = path9.join(outputPath, `${checkId}.json`);
-    fs11.writeFileSync(filePath, JSON.stringify(report, null, 2), "utf8");
+    const filePath = path7.join(outputPath, `${checkId}.json`);
+    fs9.writeFileSync(filePath, JSON.stringify(report, null, 2), "utf8");
     const title = report.checkTitle || checkId;
     console.log(`\u2713 ${checkId} ${title}: ${filePath}`);
   }
@@ -36139,7 +34876,7 @@ function getDefaultMonitoringProjectDir() {
   const override = process.env.PGAI_PROJECT_DIR;
   if (override && override.trim())
     return override.trim();
-  return path9.join(getConfigDir(), "monitoring");
+  return path7.join(getConfigDir(), "monitoring");
 }
 async function downloadText(url) {
   const controller = new AbortController;
@@ -36156,12 +34893,12 @@ async function downloadText(url) {
 }
 async function ensureDefaultMonitoringProject() {
   const projectDir = getDefaultMonitoringProjectDir();
-  const composeFile = path9.resolve(projectDir, "docker-compose.yml");
-  const instancesFile = path9.resolve(projectDir, "instances.yml");
-  if (!fs11.existsSync(projectDir)) {
-    fs11.mkdirSync(projectDir, { recursive: true, mode: 448 });
+  const composeFile = path7.resolve(projectDir, "docker-compose.yml");
+  const instancesFile = path7.resolve(projectDir, "instances.yml");
+  if (!fs9.existsSync(projectDir)) {
+    fs9.mkdirSync(projectDir, { recursive: true, mode: 448 });
   }
-  if (!fs11.existsSync(composeFile)) {
+  if (!fs9.existsSync(composeFile)) {
     const refs = [
       process.env.PGAI_PROJECT_REF,
       package_default.version,
@@ -36173,39 +34910,39 @@ async function ensureDefaultMonitoringProject() {
       const url = `https://gitlab.com/postgres-ai/postgres_ai/-/raw/${encodeURIComponent(ref)}/docker-compose.yml`;
       try {
         const text = await downloadText(url);
-        fs11.writeFileSync(composeFile, text, { encoding: "utf8", mode: 384 });
+        fs9.writeFileSync(composeFile, text, { encoding: "utf8", mode: 384 });
         break;
       } catch (err) {
         lastErr = err;
       }
     }
-    if (!fs11.existsSync(composeFile)) {
+    if (!fs9.existsSync(composeFile)) {
       const msg = lastErr instanceof Error ? lastErr.message : String(lastErr);
       throw new Error(`Failed to bootstrap docker-compose.yml: ${msg}`);
     }
   }
-  if (fs11.existsSync(instancesFile) && fs11.lstatSync(instancesFile).isDirectory()) {
-    fs11.rmSync(instancesFile, { recursive: true, force: true });
+  if (fs9.existsSync(instancesFile) && fs9.lstatSync(instancesFile).isDirectory()) {
+    fs9.rmSync(instancesFile, { recursive: true, force: true });
   }
-  if (!fs11.existsSync(instancesFile)) {
+  if (!fs9.existsSync(instancesFile)) {
     const header = `# PostgreSQL instances to monitor
 ` + `# Add your instances using: pgai mon targets add <connection-string> <name>
 
 `;
-    fs11.writeFileSync(instancesFile, header, { encoding: "utf8", mode: 384 });
+    fs9.writeFileSync(instancesFile, header, { encoding: "utf8", mode: 384 });
   }
-  const pgwatchConfig = path9.resolve(projectDir, ".pgwatch-config");
-  if (!fs11.existsSync(pgwatchConfig)) {
-    fs11.writeFileSync(pgwatchConfig, "", { encoding: "utf8", mode: 384 });
+  const pgwatchConfig = path7.resolve(projectDir, ".pgwatch-config");
+  if (!fs9.existsSync(pgwatchConfig)) {
+    fs9.writeFileSync(pgwatchConfig, "", { encoding: "utf8", mode: 384 });
   }
-  const envFile = path9.resolve(projectDir, ".env");
-  if (!fs11.existsSync(envFile)) {
+  const envFile = path7.resolve(projectDir, ".env");
+  if (!fs9.existsSync(envFile)) {
     const envText = `PGAI_TAG=${package_default.version}
 # PGAI_REGISTRY=registry.gitlab.com/postgres-ai/postgres_ai
 `;
-    fs11.writeFileSync(envFile, envText, { encoding: "utf8", mode: 384 });
+    fs9.writeFileSync(envFile, envText, { encoding: "utf8", mode: 384 });
   }
-  return { fs: fs11, path: path9, projectDir, composeFile, instancesFile };
+  return { fs: fs9, path: path7, projectDir, composeFile, instancesFile };
 }
 function sanitizeTagForBackup(tag) {
   if (tag == null)
@@ -36214,10 +34951,10 @@ function sanitizeTagForBackup(tag) {
   return /^[A-Za-z0-9._-]{1,64}$/.test(stripped) ? stripped : null;
 }
 function readDeployedTag(projectDir) {
-  const envFile = path9.resolve(projectDir, ".env");
-  if (!fs11.existsSync(envFile))
+  const envFile = path7.resolve(projectDir, ".env");
+  if (!fs9.existsSync(envFile))
     return null;
-  const m = fs11.readFileSync(envFile, "utf8").match(/^PGAI_TAG=(.+)$/m);
+  const m = fs9.readFileSync(envFile, "utf8").match(/^PGAI_TAG=(.+)$/m);
   return m ? sanitizeTagForBackup(m[1]) : null;
 }
 function isValidComposeYaml(text) {
@@ -36254,10 +34991,10 @@ function composeContentEqual(a, b) {
   return a.replace(/\s+$/, "") === b.replace(/\s+$/, "");
 }
 async function refreshBundledComposeIfStale(projectDir, oldTag) {
-  if (fs11.existsSync(path9.resolve(projectDir, ".git")))
+  if (fs9.existsSync(path7.resolve(projectDir, ".git")))
     return false;
-  const composeFile = path9.resolve(projectDir, "docker-compose.yml");
-  if (!fs11.existsSync(composeFile))
+  const composeFile = path7.resolve(projectDir, "docker-compose.yml");
+  if (!fs9.existsSync(composeFile))
     return false;
   const refs = [
     process.env.PGAI_PROJECT_REF,
@@ -36270,24 +35007,24 @@ async function refreshBundledComposeIfStale(projectDir, oldTag) {
     console.error("  Keeping the existing compose. If dashboards are blank after upgrade, re-run this command once network is available.");
     return false;
   }
-  const existing = fs11.readFileSync(composeFile, "utf8");
+  const existing = fs9.readFileSync(composeFile, "utf8");
   if (composeContentEqual(existing, fetched))
     return false;
   const deployedTag = sanitizeTagForBackup(oldTag ?? readDeployedTag(projectDir));
   const tagPart = deployedTag ?? new Date().toISOString().replace(/[:.]/g, "-");
-  const oldHash = crypto4.createHash("sha256").update(existing).digest("hex").slice(0, 8);
-  const backup = path9.resolve(projectDir, `docker-compose.yml.bak-${tagPart}-${oldHash}`);
+  const oldHash = crypto2.createHash("sha256").update(existing).digest("hex").slice(0, 8);
+  const backup = path7.resolve(projectDir, `docker-compose.yml.bak-${tagPart}-${oldHash}`);
   let backupName = null;
   try {
-    fs11.writeFileSync(backup, existing, { encoding: "utf8", mode: 384, flag: "wx" });
-    backupName = path9.basename(backup);
+    fs9.writeFileSync(backup, existing, { encoding: "utf8", mode: 384, flag: "wx" });
+    backupName = path7.basename(backup);
   } catch (err) {
     const e = err;
     if (e && e.code === "EEXIST") {
-      backupName = path9.basename(backup);
+      backupName = path7.basename(backup);
     }
   }
-  fs11.writeFileSync(composeFile, fetched, { encoding: "utf8", mode: 384 });
+  fs9.writeFileSync(composeFile, fetched, { encoding: "utf8", mode: 384 });
   const backupNote = backupName ? ` (backup: ${backupName})` : "";
   console.log(`\u2713 Refreshed docker-compose.yml to ${package_default.version}${backupNote}`);
   return true;
@@ -37264,7 +36001,7 @@ program2.command("unprepare-db [conn]").description("remove monitoring setup: dr
     closeReadline();
   }
 });
-program2.command("checkup [checkIdOrConn] [conn]").description("generate health check reports directly from PostgreSQL (express mode)").option("--check-id <id>", `specific check to run (see list below), or ALL`).option("--node-name <name>", "node name for reports", "node-01").option("--output <path>", "output directory for JSON files").option("--upload", "upload JSON results to PostgresAI (requires API key)").option("--no-upload", "disable upload to PostgresAI").option("--project <project>", "project name or ID for remote upload (used with --upload; defaults to config defaultProject; auto-generated on first run)").option("--json", "output JSON to stdout").option("--markdown", "output markdown to stdout").addHelpText("after", [
+program2.command("checkup [checkIdOrConn] [conn]").description("generate health check reports directly from PostgreSQL (express mode)").option("--check-id <id>", `specific check to run (see list below), or ALL`).option("--node-name <name>", "node name for reports", "node-01").option("--output <path>", "output directory for JSON files").option("--upload", "upload JSON results to PostgresAI (requires API key)").option("--no-upload", "disable upload to PostgresAI").option("--project <project>", "project name or ID for remote upload (used with --upload; defaults to config defaultProject; auto-generated on first run)").option("--json", "output JSON to stdout").option("--markdown", "output markdown via PostgresAI API (transmits the full report JSON)").addHelpText("after", [
   "",
   "Available checks:",
   ...Object.entries(CHECK_INFO).map(([id, title]) => `  ${id}: ${title}`),
@@ -37275,7 +36012,7 @@ program2.command("checkup [checkIdOrConn] [conn]").description("generate health
   "  postgresai checkup postgresql://user:pass@host:5432/db --check-id H002",
   "  postgresai checkup postgresql://user:pass@host:5432/db --output ./reports",
   "  postgresai checkup postgresql://user:pass@host:5432/db --no-upload --json",
-  "  postgresai checkup postgresql://user:pass@host:5432/db --no-upload --markdown"
+  "  postgresai checkup postgresql://user:pass@host:5432/db --markdown"
 ].join(`
 `)).action(async (checkIdOrConn, connArg, opts, cmd) => {
   const checkIdPattern = /^[A-Z]\d{3}$/i;
@@ -37315,6 +36052,13 @@ Usage: postgresai checkup ${checkId} postgresql://user@host:5432/dbname
     return;
   }
   const uploadExplicitlyDisabled = opts.upload === false;
+  if (uploadExplicitlyDisabled && shouldConvertMarkdown) {
+    console.error("Error: --no-upload and --markdown are mutually exclusive");
+    console.error("Markdown conversion is performed by the PostgresAI API and transmits the full report JSON.");
+    console.error("Drop --no-upload to allow transmission, or use --json or --output for local-only output.");
+    process.exitCode = 1;
+    return;
+  }
   let shouldUpload = !uploadExplicitlyDisabled;
   const outputPath = prepareOutputDirectory(opts.output);
   if (outputPath === null) {
@@ -37497,7 +36241,9 @@ Usage: postgresai checkup ${checkId} postgresql://user@host:5432/dbname
       console.log(`
 For details:`);
       console.log("  --json          Output JSON");
-      console.log("  --markdown      Output markdown");
+      if (!uploadExplicitlyDisabled) {
+        console.log("  --markdown      Output markdown via PostgresAI API");
+      }
       console.log("  --output <dir>  Save to directory");
     }
   } catch (error2) {
@@ -37521,12 +36267,12 @@ function resolvePaths() {
   const startDir = process.cwd();
   let currentDir = startDir;
   while (true) {
-    const composeFile = path9.resolve(currentDir, "docker-compose.yml");
-    if (fs11.existsSync(composeFile)) {
-      const instancesFile = path9.resolve(currentDir, "instances.yml");
-      return { fs: fs11, path: path9, projectDir: currentDir, composeFile, instancesFile };
+    const composeFile = path7.resolve(currentDir, "docker-compose.yml");
+    if (fs9.existsSync(composeFile)) {
+      const instancesFile = path7.resolve(currentDir, "instances.yml");
+      return { fs: fs9, path: path7, projectDir: currentDir, composeFile, instancesFile };
     }
-    const parentDir = path9.dirname(currentDir);
+    const parentDir = path7.dirname(currentDir);
     if (parentDir === currentDir)
       break;
     currentDir = parentDir;
@@ -37658,10 +36404,10 @@ function resolveAdoptedProject(reg) {
 }
 function updatePgwatchConfig(configPath, updates) {
   let lines = [];
-  if (fs11.existsSync(configPath)) {
-    const stats = fs11.statSync(configPath);
+  if (fs9.existsSync(configPath)) {
+    const stats = fs9.statSync(configPath);
     if (!stats.isDirectory()) {
-      const content = fs11.readFileSync(configPath, "utf8");
+      const content = fs9.readFileSync(configPath, "utf8");
       lines = content.split(/\r?\n/).filter((l) => l.trim() !== "");
     }
   }
@@ -37673,7 +36419,7 @@ function updatePgwatchConfig(configPath, updates) {
       lines.push(`${key}=${value}`);
     }
   }
-  fs11.writeFileSync(configPath, lines.join(`
+  fs9.writeFileSync(configPath, lines.join(`
 `) + `
 `, { encoding: "utf8", mode: 384 });
 }
@@ -37711,12 +36457,12 @@ async function runCompose(args, grafanaPassword) {
   if (grafanaPassword) {
     env.GF_SECURITY_ADMIN_PASSWORD = grafanaPassword;
   } else {
-    const cfgPath = path9.resolve(projectDir, ".pgwatch-config");
-    if (fs11.existsSync(cfgPath)) {
+    const cfgPath = path7.resolve(projectDir, ".pgwatch-config");
+    if (fs9.existsSync(cfgPath)) {
       try {
-        const stats = fs11.statSync(cfgPath);
+        const stats = fs9.statSync(cfgPath);
         if (!stats.isDirectory()) {
-          const content = fs11.readFileSync(cfgPath, "utf8");
+          const content = fs9.readFileSync(cfgPath, "utf8");
           const match = content.match(/^grafana_password=([^\r\n]+)/m);
           if (match) {
             env.GF_SECURITY_ADMIN_PASSWORD = match[1].trim();
@@ -37729,10 +36475,10 @@ async function runCompose(args, grafanaPassword) {
       }
     }
   }
-  const envFilePath = path9.resolve(projectDir, ".env");
-  if (fs11.existsSync(envFilePath)) {
+  const envFilePath = path7.resolve(projectDir, ".env");
+  if (fs9.existsSync(envFilePath)) {
     try {
-      const envContent = fs11.readFileSync(envFilePath, "utf8");
+      const envContent = fs9.readFileSync(envFilePath, "utf8");
       if (!env.VM_AUTH_USERNAME) {
         const m = envContent.match(/^VM_AUTH_USERNAME=([^\r\n]+)/m);
         if (m)
@@ -37789,20 +36535,20 @@ mon.command("local-install").description("install local monitoring stack (genera
   console.log(`Project directory: ${projectDir}
 `);
   if (opts.project) {
-    const cfgPath2 = path9.resolve(projectDir, ".pgwatch-config");
+    const cfgPath2 = path7.resolve(projectDir, ".pgwatch-config");
     updatePgwatchConfig(cfgPath2, { project_name: opts.project });
     console.log(`Using project name: ${opts.project}
 `);
   }
-  const envFile = path9.resolve(projectDir, ".env");
+  const envFile = path7.resolve(projectDir, ".env");
   let existingRegistry = null;
   let existingPassword = null;
   let existingReplicatorPassword = null;
   let existingVmAuthUsername = null;
   let existingVmAuthPassword = null;
   let previousTag = null;
-  if (fs11.existsSync(envFile)) {
-    const existingEnv = fs11.readFileSync(envFile, "utf8");
+  if (fs9.existsSync(envFile)) {
+    const existingEnv = fs9.readFileSync(envFile, "utf8");
     const previousTagMatch = existingEnv.match(/^PGAI_TAG=(.+)$/m);
     if (previousTagMatch)
       previousTag = previousTagMatch[1].trim();
@@ -37830,10 +36576,10 @@ mon.command("local-install").description("install local monitoring stack (genera
   if (existingPassword) {
     envLines.push(`GF_SECURITY_ADMIN_PASSWORD=${existingPassword}`);
   }
-  envLines.push(`REPLICATOR_PASSWORD=${existingReplicatorPassword || crypto4.randomBytes(32).toString("hex")}`);
+  envLines.push(`REPLICATOR_PASSWORD=${existingReplicatorPassword || crypto2.randomBytes(32).toString("hex")}`);
   envLines.push(`VM_AUTH_USERNAME=${existingVmAuthUsername || "vmauth"}`);
-  envLines.push(`VM_AUTH_PASSWORD=${existingVmAuthPassword || crypto4.randomBytes(18).toString("base64")}`);
-  fs11.writeFileSync(envFile, envLines.join(`
+  envLines.push(`VM_AUTH_PASSWORD=${existingVmAuthPassword || crypto2.randomBytes(18).toString("base64")}`);
+  fs9.writeFileSync(envFile, envLines.join(`
 `) + `
 `, { encoding: "utf8", mode: 384 });
   await refreshBundledComposeIfStale(projectDir, previousTag);
@@ -37870,7 +36616,7 @@ Use demo mode without API key: postgres-ai mon local-install --demo`);
     if (apiKey) {
       console.log("Using API key provided via --api-key parameter");
       writeConfig({ apiKey });
-      updatePgwatchConfig(path9.resolve(projectDir, ".pgwatch-config"), { api_key: apiKey });
+      updatePgwatchConfig(path7.resolve(projectDir, ".pgwatch-config"), { api_key: apiKey });
       console.log(`\u2713 API key saved
 `);
     } else if (opts.yes) {
@@ -37887,7 +36633,7 @@ Use demo mode without API key: postgres-ai mon local-install --demo`);
           const trimmedKey = inputApiKey.trim();
           if (trimmedKey) {
             writeConfig({ apiKey: trimmedKey });
-            updatePgwatchConfig(path9.resolve(projectDir, ".pgwatch-config"), { api_key: trimmedKey });
+            updatePgwatchConfig(path7.resolve(projectDir, ".pgwatch-config"), { api_key: trimmedKey });
             apiKey = trimmedKey;
             console.log(`\u2713 API key saved
 `);
@@ -37921,7 +36667,7 @@ Use demo mode without API key: postgres-ai mon local-install --demo`);
 # Add your instances using: postgres-ai mon targets add
 
 `;
-    fs11.writeFileSync(instancesPath2, emptyInstancesContent, "utf8");
+    fs9.writeFileSync(instancesPath2, emptyInstancesContent, "utf8");
     console.log(`Instances file: ${instancesPath2}`);
     console.log(`Project directory: ${projectDir2}
 `);
@@ -38025,17 +36771,17 @@ You can provide either:`);
     }
   } else {
     console.log("Step 2: Demo mode enabled - using included demo PostgreSQL database");
-    const currentDir = path9.dirname(fileURLToPath2(import.meta.url));
+    const currentDir = path7.dirname(fileURLToPath2(import.meta.url));
     const demoCandidates = [
-      path9.resolve(currentDir, "..", "..", "instances.demo.yml"),
-      path9.resolve(currentDir, "..", "..", "..", "instances.demo.yml")
+      path7.resolve(currentDir, "..", "..", "instances.demo.yml"),
+      path7.resolve(currentDir, "..", "..", "..", "instances.demo.yml")
     ];
-    const demoSrc = demoCandidates.find((p) => fs11.existsSync(p));
+    const demoSrc = demoCandidates.find((p) => fs9.existsSync(p));
     if (demoSrc) {
-      if (fs11.existsSync(instancesPath) && fs11.lstatSync(instancesPath).isDirectory()) {
-        fs11.rmSync(instancesPath, { recursive: true, force: true });
+      if (fs9.existsSync(instancesPath) && fs9.lstatSync(instancesPath).isDirectory()) {
+        fs9.rmSync(instancesPath, { recursive: true, force: true });
       }
-      fs11.copyFileSync(demoSrc, instancesPath);
+      fs9.copyFileSync(demoSrc, instancesPath);
       console.log(`\u2713 Demo monitoring target configured
 `);
     } else {
@@ -38054,15 +36800,15 @@ Searched: ${demoCandidates.join(", ")}
   console.log(`\u2713 Configuration updated
 `);
   console.log(opts.demo ? "Step 4: Configuring Grafana security..." : "Step 4: Configuring Grafana security...");
-  const cfgPath = path9.resolve(projectDir, ".pgwatch-config");
+  const cfgPath = path7.resolve(projectDir, ".pgwatch-config");
   let grafanaPassword = "";
   let vmAuthUsername = "";
   let vmAuthPassword = "";
   try {
-    if (fs11.existsSync(cfgPath)) {
-      const stats = fs11.statSync(cfgPath);
+    if (fs9.existsSync(cfgPath)) {
+      const stats = fs9.statSync(cfgPath);
       if (!stats.isDirectory()) {
-        const content = fs11.readFileSync(cfgPath, "utf8");
+        const content = fs9.readFileSync(cfgPath, "utf8");
         const match = content.match(/^grafana_password=([^\r\n]+)/m);
         if (match) {
           grafanaPassword = match[1].trim();
@@ -38074,15 +36820,15 @@ Searched: ${demoCandidates.join(", ")}
       const { stdout: password } = await execFilePromise("openssl", ["rand", "-base64", "12"]);
       grafanaPassword = password.trim().replace(/\n/g, "");
       let configContent = "";
-      if (fs11.existsSync(cfgPath)) {
-        const stats = fs11.statSync(cfgPath);
+      if (fs9.existsSync(cfgPath)) {
+        const stats = fs9.statSync(cfgPath);
         if (!stats.isDirectory()) {
-          configContent = fs11.readFileSync(cfgPath, "utf8");
+          configContent = fs9.readFileSync(cfgPath, "utf8");
         }
       }
       const lines = configContent.split(/\r?\n/).filter((l) => !/^grafana_password=/.test(l));
       lines.push(`grafana_password=${grafanaPassword}`);
-      fs11.writeFileSync(cfgPath, lines.filter(Boolean).join(`
+      fs9.writeFileSync(cfgPath, lines.filter(Boolean).join(`
 `) + `
 `, "utf8");
     }
@@ -38095,9 +36841,9 @@ Searched: ${demoCandidates.join(", ")}
     grafanaPassword = "demo";
   }
   try {
-    const envFile2 = path9.resolve(projectDir, ".env");
-    if (fs11.existsSync(envFile2)) {
-      const envContent = fs11.readFileSync(envFile2, "utf8");
+    const envFile2 = path7.resolve(projectDir, ".env");
+    if (fs9.existsSync(envFile2)) {
+      const envContent = fs9.readFileSync(envFile2, "utf8");
       const userMatch = envContent.match(/^VM_AUTH_USERNAME=([^\r\n]+)/m);
       const passMatch = envContent.match(/^VM_AUTH_PASSWORD=([^\r\n]+)/m);
       if (userMatch)
@@ -38113,13 +36859,13 @@ Searched: ${demoCandidates.join(", ")}
         vmAuthPassword = vmPass.trim().replace(/\n/g, "");
       }
       let envContent = "";
-      if (fs11.existsSync(envFile2)) {
-        envContent = fs11.readFileSync(envFile2, "utf8");
+      if (fs9.existsSync(envFile2)) {
+        envContent = fs9.readFileSync(envFile2, "utf8");
       }
       const envLines2 = envContent.split(/\r?\n/).filter((l) => !/^VM_AUTH_USERNAME=/.test(l) && !/^VM_AUTH_PASSWORD=/.test(l)).filter((l, i3, arr) => !(i3 === arr.length - 1 && l === ""));
       envLines2.push(`VM_AUTH_USERNAME=${vmAuthUsername}`);
       envLines2.push(`VM_AUTH_PASSWORD=${vmAuthPassword}`);
-      fs11.writeFileSync(envFile2, envLines2.join(`
+      fs9.writeFileSync(envFile2, envLines2.join(`
 `) + `
 `, { encoding: "utf8", mode: 384 });
     }
@@ -38152,7 +36898,7 @@ Searched: ${demoCandidates.join(", ")}
       });
       const adoptedProject = resolveAdoptedProject(reg);
       if (adoptedProject != null) {
-        updatePgwatchConfig(path9.resolve(projectDir, ".pgwatch-config"), {
+        updatePgwatchConfig(path7.resolve(projectDir, ".pgwatch-config"), {
           project_name: adoptedProject
         });
         const verb = reg?.created ? "Registered" : "Adopted";
@@ -38368,11 +37114,11 @@ mon.command("config").description("show monitoring services configuration").acti
   console.log(`Project Directory: ${projectDir}`);
   console.log(`Docker Compose File: ${composeFile}`);
   console.log(`Instances File: ${instancesFile}`);
-  if (fs11.existsSync(instancesFile) && !fs11.lstatSync(instancesFile).isDirectory()) {
+  if (fs9.existsSync(instancesFile) && !fs9.lstatSync(instancesFile).isDirectory()) {
     console.log(`
 Instances configuration:
 `);
-    const text = fs11.readFileSync(instancesFile, "utf8");
+    const text = fs9.readFileSync(instancesFile, "utf8");
     process.stdout.write(text);
     if (!/\n$/.test(text))
       console.log();
@@ -38421,8 +37167,8 @@ mon.command("update").description("update monitoring stack (migrate .env, pull i
       console.log("\u2713 .env is up to date");
     }
     console.log();
-    const gitDir = path9.resolve(projectDir, ".git");
-    if (fs11.existsSync(gitDir)) {
+    const gitDir = path7.resolve(projectDir, ".git");
+    if (fs9.existsSync(gitDir)) {
       console.log("Fetching latest changes...");
       await execFilePromise("git", ["fetch", "origin"]);
       const { stdout: branch } = await execFilePromise("git", ["rev-parse", "--abbrev-ref", "HEAD"]);
@@ -38577,7 +37323,7 @@ mon.command("check").description("monitoring services system readiness check").a
 var targets = mon.command("targets").description("manage databases to monitor");
 targets.command("list").description("list monitoring target databases").action(async () => {
   const { instancesFile: instancesPath, projectDir } = await resolveOrInitPaths();
-  if (!fs11.existsSync(instancesPath) || fs11.lstatSync(instancesPath).isDirectory()) {
+  if (!fs9.existsSync(instancesPath) || fs9.lstatSync(instancesPath).isDirectory()) {
     console.error(`instances.yml not found in ${projectDir}`);
     process.exitCode = 1;
     return;
@@ -38640,7 +37386,7 @@ targets.command("add [connStr] [name]").description("add monitoring target datab
 });
 targets.command("remove <name>").description("remove monitoring target database").action(async (name) => {
   const { instancesFile: file } = await resolveOrInitPaths();
-  if (!fs11.existsSync(file) || fs11.lstatSync(file).isDirectory()) {
+  if (!fs9.existsSync(file) || fs9.lstatSync(file).isDirectory()) {
     console.error("instances.yml not found");
     process.exitCode = 1;
     return;
@@ -38668,7 +37414,7 @@ targets.command("remove <name>").description("remove monitoring target database"
 });
 targets.command("test <name>").description("test monitoring target database connectivity").action(async (name) => {
   const { instancesFile: instancesPath } = await resolveOrInitPaths();
-  if (!fs11.existsSync(instancesPath) || fs11.lstatSync(instancesPath).isDirectory()) {
+  if (!fs9.existsSync(instancesPath) || fs9.lstatSync(instancesPath).isDirectory()) {
     console.error("instances.yml not found");
     process.exitCode = 1;
     return;
@@ -38712,7 +37458,7 @@ targets.command("test <name>").description("test monitoring target database conn
   }
 });
 var auth = program2.command("auth").description("authentication and API key management");
-auth.command("login", { isDefault: true }).description("authenticate via browser (OAuth) or store API key directly").option("--set-key <key>", "store API key directly without OAuth flow").option("--port <port>", "local callback server port (default: random)", parseInt).option("--debug", "enable debug output").action(async (opts) => {
+async function runAuthLogin(opts) {
   if (opts.setKey) {
     const trimmedKey = opts.setKey.trim();
     if (!trimmedKey) {
@@ -38913,7 +37659,12 @@ Authentication failed: ${message}`);
     console.error(`Authentication error: ${message}`);
     process.exit(1);
   }
-});
+}
+function configureLoginCommand(command) {
+  return command.description("authenticate via browser (OAuth) or store API key directly").option("--set-key <key>", "store API key directly without OAuth flow").option("--port <port>", "local callback server port (default: random)", parseInt).option("--debug", "enable debug output");
+}
+configureLoginCommand(auth.command("login", { isDefault: true })).action(runAuthLogin);
+configureLoginCommand(program2.command("login")).action(runAuthLogin);
 auth.command("show-key").description("show API key (masked)").action(async () => {
   const cfg = readConfig();
   if (!cfg.apiKey) {
@@ -38930,15 +37681,15 @@ To authenticate, run: pgai auth`);
 });
 auth.command("remove-key").description("remove API key").action(async () => {
   const newConfigPath = getConfigPath();
-  const hasNewConfig = fs11.existsSync(newConfigPath);
+  const hasNewConfig = fs9.existsSync(newConfigPath);
   let legacyPath;
   try {
     const { projectDir } = await resolveOrInitPaths();
-    legacyPath = path9.resolve(projectDir, ".pgwatch-config");
+    legacyPath = path7.resolve(projectDir, ".pgwatch-config");
   } catch {
-    legacyPath = path9.resolve(process.cwd(), ".pgwatch-config");
+    legacyPath = path7.resolve(process.cwd(), ".pgwatch-config");
   }
-  const hasLegacyConfig = fs11.existsSync(legacyPath) && fs11.statSync(legacyPath).isFile();
+  const hasLegacyConfig = fs9.existsSync(legacyPath) && fs9.statSync(legacyPath).isFile();
   if (!hasNewConfig && !hasLegacyConfig) {
     console.log("No API key configured");
     return;
@@ -38948,11 +37699,11 @@ auth.command("remove-key").description("remove API key").action(async () => {
   }
   if (hasLegacyConfig) {
     try {
-      const content = fs11.readFileSync(legacyPath, "utf8");
+      const content = fs9.readFileSync(legacyPath, "utf8");
       const filtered = content.split(/\r?\n/).filter((l) => !/^api_key=/.test(l)).join(`
 `).replace(/\n+$/g, `
 `);
-      fs11.writeFileSync(legacyPath, filtered, "utf8");
+      fs9.writeFileSync(legacyPath, filtered, "utf8");
     } catch (err) {
       console.warn(`Warning: Could not update legacy config: ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -38963,7 +37714,7 @@ To authenticate again, run: pgai auth`);
 });
 mon.command("generate-grafana-password").description("generate Grafana password for monitoring services").action(async () => {
   const { projectDir } = await resolveOrInitPaths();
-  const cfgPath = path9.resolve(projectDir, ".pgwatch-config");
+  const cfgPath = path7.resolve(projectDir, ".pgwatch-config");
   try {
     const { stdout: password } = await execFilePromise("openssl", ["rand", "-base64", "12"]);
     const newPassword = password.trim().replace(/\n/g, "");
@@ -38973,17 +37724,17 @@ mon.command("generate-grafana-password").description("generate Grafana password
       return;
     }
     let configContent = "";
-    if (fs11.existsSync(cfgPath)) {
-      const stats = fs11.statSync(cfgPath);
+    if (fs9.existsSync(cfgPath)) {
+      const stats = fs9.statSync(cfgPath);
       if (stats.isDirectory()) {
         console.error(".pgwatch-config is a directory, expected a file. Skipping read.");
       } else {
-        configContent = fs11.readFileSync(cfgPath, "utf8");
+        configContent = fs9.readFileSync(cfgPath, "utf8");
       }
     }
     const lines = configContent.split(/\r?\n/).filter((l) => !/^grafana_password=/.test(l));
     lines.push(`grafana_password=${newPassword}`);
-    fs11.writeFileSync(cfgPath, lines.filter(Boolean).join(`
+    fs9.writeFileSync(cfgPath, lines.filter(Boolean).join(`
 `) + `
 `, "utf8");
     console.log("\u2713 New Grafana password generated and saved");
@@ -39005,19 +37756,19 @@ Note: This command requires 'openssl' to be installed`);
 });
 mon.command("show-grafana-credentials").description("show Grafana credentials for monitoring services").action(async () => {
   const { projectDir } = await resolveOrInitPaths();
-  const cfgPath = path9.resolve(projectDir, ".pgwatch-config");
-  if (!fs11.existsSync(cfgPath)) {
+  const cfgPath = path7.resolve(projectDir, ".pgwatch-config");
+  if (!fs9.existsSync(cfgPath)) {
     console.error("Configuration file not found. Run 'postgres-ai mon local-install' first.");
     process.exitCode = 1;
     return;
   }
-  const stats = fs11.statSync(cfgPath);
+  const stats = fs9.statSync(cfgPath);
   if (stats.isDirectory()) {
     console.error(".pgwatch-config is a directory, expected a file. Cannot read credentials.");
     process.exitCode = 1;
     return;
   }
-  const content = fs11.readFileSync(cfgPath, "utf8");
+  const content = fs9.readFileSync(cfgPath, "utf8");
   const lines = content.split(/\r?\n/);
   let password = "";
   for (const line of lines) {
@@ -39037,9 +37788,9 @@ Grafana credentials:`);
   console.log("  URL:      http://localhost:3000");
   console.log("  Username: monitor");
   console.log(`  Password: ${password}`);
-  const envFile = path9.resolve(projectDir, ".env");
-  if (fs11.existsSync(envFile)) {
-    const envContent = fs11.readFileSync(envFile, "utf8");
+  const envFile = path7.resolve(projectDir, ".env");
+  if (fs9.existsSync(envFile)) {
+    const envContent = fs9.readFileSync(envFile, "utf8");
     const vmUser = envContent.match(/^VM_AUTH_USERNAME=([^\r\n]+)/m);
     const vmPass = envContent.match(/^VM_AUTH_PASSWORD=([^\r\n]+)/m);
     if (vmUser && vmPass) {
@@ -39765,13 +38516,13 @@ reports.command("data [reportId]").description("get checkup report file data (in
     });
     spinner.stop();
     if (opts.output) {
-      const dir = path9.resolve(opts.output);
-      fs11.mkdirSync(dir, { recursive: true });
+      const dir = path7.resolve(opts.output);
+      fs9.mkdirSync(dir, { recursive: true });
       for (const f of result) {
-        const safeName = path9.basename(f.filename);
-        const filePath = path9.join(dir, safeName);
+        const safeName = path7.basename(f.filename);
+        const filePath = path7.join(dir, safeName);
         const content = f.type === "json" ? JSON.stringify(tryParseJson(f.data), null, 2) : f.data;
-        fs11.writeFileSync(filePath, content, "utf-8");
+        fs9.writeFileSync(filePath, content, "utf-8");
         console.log(filePath);
       }
     } else if (opts.json) {
@@ -39816,62 +38567,45 @@ function tryParseJson(s) {
     return s;
   }
 }
-function inferCommandFromResult(r) {
-  if (r.command)
-    return r.command;
-  if (r.plan_text !== undefined || r.plan_json !== undefined)
-    return "plan";
-  if (r.row_count !== undefined || r.result_rows !== undefined)
-    return "exec";
-  if (r.hypo_used !== undefined)
-    return "hypo";
-  if (r.terminated !== undefined)
-    return "terminate";
-  if (r.reset !== undefined)
-    return "reset";
-  if (r.snapshot !== undefined)
-    return "activity";
-  return null;
-}
-function printJoeOutcome(command, outcome, json3, budgetMs) {
-  const effectiveBudgetMs = typeof budgetMs === "number" && Number.isFinite(budgetMs) ? budgetMs : DEFAULT_BUDGET_MS2;
+function printJoeOutcome(outcome, json3, budgetMs) {
+  const effectiveBudgetMs = typeof budgetMs === "number" && Number.isFinite(budgetMs) ? budgetMs : DEFAULT_BUDGET_MS;
   const budgetSeconds = Math.round(effectiveBudgetMs / 1000);
   if (outcome.budgetExpired) {
     if (json3) {
       console.log(JSON.stringify({
         command_id: outcome.commandId,
         status: outcome.status,
-        session_id: outcome.sessionId,
         budget_expired: true,
         resume: `pgai joe result ${outcome.commandId}`
       }, null, 2));
     } else {
-      console.log(`submitted ${outcome.commandId} \xB7 ${outcome.status} \xB7 budget ${budgetSeconds}s reached \u2014 resume:  pgai joe result ${outcome.commandId}`);
+      console.log(`started ${outcome.commandId} \xB7 ${outcome.status} \xB7 budget ${budgetSeconds}s reached \u2014 resume:  pgai joe result ${outcome.commandId}`);
     }
     return;
   }
-  const result = outcome.result;
-  if (outcome.status === "done" && result) {
-    if (json3) {
-      console.log(JSON.stringify(result, null, 2));
-    } else {
-      console.log(`submitted ${outcome.commandId} \xB7 done`);
-      const body = formatJoeResult(command, result);
+  const output = outcome.output;
+  if (outcome.status === "ok") {
+    if (!output) {
+      console.error(`command ${outcome.commandId} ok but output is empty`);
+      process.exitCode = 1;
+      return;
+    }
+    if (json3)
+      console.log(JSON.stringify(output, null, 2));
+    else {
+      console.log(`command ${outcome.commandId} \xB7 ok`);
+      const body = formatJoeOutput(output);
       if (body)
         console.log(body);
     }
     return;
   }
-  if (outcome.status === "error") {
-    const msg = result?.error ?? "command failed";
-    console.error(`command ${outcome.commandId} error: ${msg}`);
-    process.exitCode = 1;
-    return;
-  }
-  console.error(`command ${outcome.commandId} timed out on the server \u2014 resume:  pgai joe result ${outcome.commandId}`);
+  if (json3 && output)
+    console.log(JSON.stringify(output, null, 2));
+  console.error(`command ${outcome.commandId} error: ${output?.error ?? "command failed"}`);
   process.exitCode = 1;
 }
-async function runJoeCli(command, sql, args, opts) {
+async function runJoeCli(command, arg, opts) {
   try {
     const rootOpts = program2.opts();
     const cfg = readConfig();
@@ -39882,27 +38616,29 @@ async function runJoeCli(command, sql, args, opts) {
       return;
     }
     const projectRef = (opts.project ?? cfg.defaultProject ?? "").toString().trim();
-    if (!projectRef) {
-      console.error("Project is required. Pass --project <id|alias>.");
+    const instanceRef = (opts.instanceId ?? "").toString().trim();
+    if (!projectRef && !instanceRef) {
+      console.error("Specify --instance-id <id> (or --project <id|alias> once projects_list is available).");
       process.exitCode = 1;
       return;
     }
     const { apiBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
-    const budgetMs = typeof opts.budget === "number" && !Number.isNaN(opts.budget) ? opts.budget * 1000 : undefined;
-    const outcome = await executeJoeCommand2({
+    if (typeof opts.budget === "number" && (!Number.isFinite(opts.budget) || opts.budget < 0)) {
+      throw new Error("--budget must be a non-negative number of seconds");
+    }
+    const budgetMs = typeof opts.budget === "number" ? opts.budget * 1000 : undefined;
+    const outcome = await executeJoeCommand({
       apiKey,
       apiBaseUrl,
       command,
-      project: projectRef,
-      sql,
-      args,
-      session: opts.session ?? null,
-      newSession: !!opts.newSession,
+      project: projectRef || undefined,
+      instanceId: instanceRef || undefined,
+      input: { arg, variant: opts.variant ?? null },
       orgId: cfg.orgId ?? undefined,
       budgetMs,
       debug: !!opts.debug
     });
-    printJoeOutcome(command, outcome, !!opts.json, budgetMs);
+    printJoeOutcome(outcome, !!opts.json, budgetMs);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     console.error(message);
@@ -39910,47 +38646,34 @@ async function runJoeCli(command, sql, args, opts) {
   }
 }
 function withJoeOptions(cmd) {
-  return cmd.option("--project <id|alias>", "target project by numeric id OR alias/name").option("--session <id>", "run on a specific session's clone").option("--new-session", "start a fresh session/clone (null session)").option("--budget <seconds>", "one-shot poll budget in seconds (default 25)", (v) => parseInt(v, 10)).option("--debug", "enable debug output").option("--json", "output raw JSON");
+  return cmd.option("--instance-id <id>", "target the Joe instance id directly (skips --project resolution; the v1 path while projects_list is unavailable)").option("--project <id|alias>", "target project by numeric id OR alias/name (requires projects_list)").option("--budget <seconds>", "one-shot poll budget in seconds (default 25)", (v) => parseFloat(v)).option("--debug", "enable debug output").option("--json", "output raw JSON");
 }
-var joe = program2.command("joe").description("Joe API v2 \u2014 plan/EXPLAIN/exec queries on ephemeral DBLab clones");
+var joe = program2.command("joe").description("Joe \u2014 plan/EXPLAIN/exec queries on ephemeral DBLab clones");
 withJoeOptions(joe.command("plan <sql>").description("plan a query (EXPLAIN, plan-only \u2014 no execution; the fast/safe default)")).action(async (sql, opts) => {
-  await runJoeCli("plan", sql, null, opts);
+  await runJoeCli("plan", sql, opts);
 });
-withJoeOptions(joe.command("explain <sql>").description("EXPLAIN ANALYZE a query (EXECUTES on the hardened, ephemeral clone)")).action(async (sql, opts) => {
-  await runJoeCli("explain", sql, null, opts);
+withJoeOptions(joe.command("explain <sql>").description("EXPLAIN + EXPLAIN ANALYZE a query (EXECUTES on the ephemeral clone)")).action(async (sql, opts) => {
+  await runJoeCli("explain", sql, opts);
 });
 withJoeOptions(joe.command("exec <sql>").description("run arbitrary DDL/DML on the clone (e.g. create index, analyze)")).action(async (sql, opts) => {
-  await runJoeCli("exec", sql, null, opts);
+  await runJoeCli("exec", sql, opts);
 });
-withJoeOptions(joe.command("hypo <indexSql>").description("HypoPG hypothetical index + re-plan (no real index, no data change)").requiredOption("--query <sql>", "target query the hypothetical index is evaluated against")).action(async (indexSql, opts) => {
-  await runJoeCli("hypo", indexSql, { query: opts.query }, opts);
+withJoeOptions(joe.command("hypo <args>").description("HypoPG hypothetical indexes (e.g. `hypo create index on users (email)`, `hypo desc`, `hypo reset`)")).action(async (args, opts) => {
+  await runJoeCli("hypo", args, opts);
 });
-withJoeOptions(joe.command("activity").description("running-activity snapshot (pg_stat_activity; query text redacted)")).action(async (opts) => {
-  await runJoeCli("activity", null, null, opts);
+withJoeOptions(joe.command("activity").description("running-activity snapshot (pg_stat_activity) on the clone")).action(async (opts) => {
+  await runJoeCli("activity", null, opts);
 });
 withJoeOptions(joe.command("terminate <pid>").description("pg_terminate_backend(pid) on the clone")).action(async (pid, opts) => {
-  const pidStr = (pid ?? "").trim();
-  if (!/^[0-9]+$/.test(pidStr)) {
-    console.error("pid must be a number");
-    process.exitCode = 1;
-    return;
-  }
-  await runJoeCli("terminate", null, { pid: parseInt(pidStr, 10) }, opts);
+  await runJoeCli("terminate", pid, opts);
 });
 withJoeOptions(joe.command("reset").description("reset/recreate the session's thin clone")).action(async (opts) => {
-  await runJoeCli("reset", null, null, opts);
+  await runJoeCli("reset", null, opts);
 });
 withJoeOptions(joe.command("describe <object>").description("\\d-family schema/relation/index metadata").option("--variant <variant>", "\\d-family variant (e.g. \\d+, \\di, \\dt)")).action(async (object4, opts) => {
-  const args = { object: object4 };
-  if (opts.variant)
-    args.variant = opts.variant;
-  await runJoeCli("describe", null, args, opts);
-});
-withJoeOptions(joe.command("history <terms>").description("search prior Joe analyses, metadata-only (M1b \u2014 not yet available)")).action(async (_terms, _opts) => {
-  console.error("Joe history search is not available yet \u2014 it is planned for M1b. " + "No history-search backend is deployed; this command is a placeholder until then.");
-  process.exitCode = 1;
+  await runJoeCli("describe", object4, opts);
 });
-program2.command("projects").description("list the org's projects (shows which have Joe ready) \u2014 org-level, not a Joe endpoint").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (opts) => {
+joe.command("result <commandId>").description("fetch a Joe command's output by id (resume a budget-expired one-shot)").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (commandId, opts) => {
   try {
     const rootOpts = program2.opts();
     const cfg = readConfig();
@@ -39961,78 +38684,25 @@ program2.command("projects").description("list the org's projects (shows which h
       return;
     }
     const { apiBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
-    const projects = await listProjects2({
-      apiKey,
-      apiBaseUrl,
-      orgId: cfg.orgId ?? undefined,
-      debug: !!opts.debug
-    });
+    const output = await getCommandOutput({ apiKey, apiBaseUrl, commandId, debug: !!opts.debug });
     if (opts.json) {
-      console.log(JSON.stringify(projects, null, 2));
-    } else {
-      console.log(formatProjectsTable(projects));
-    }
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    console.error(message);
-    process.exitCode = 1;
-  }
-});
-async function resolveDblabTarget(project, debug) {
-  const rootOpts = program2.opts();
-  const cfg = readConfig();
-  const { apiKey } = getConfig(rootOpts);
-  if (!apiKey) {
-    throw new Error("API key is required. Run 'pgai auth' first or set --api-key.");
-  }
-  const ref = (project ?? "").trim();
-  if (!ref) {
-    throw new Error("--project <id|alias> is required");
-  }
-  const { apiBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
-  const orgId = cfg.orgId ?? undefined;
-  const instanceId = await resolveDblabInstanceId2({ apiKey, apiBaseUrl, project: ref, orgId, debug });
-  return { apiKey, apiBaseUrl, orgId, instanceId };
-}
-var dblab = program2.command("dblab").description("DBLab thin-clone / branch / snapshot management (proxies the Platform DBLab API)");
-var clone2 = dblab.command("clone").description("DBLab thin-clone management (proxies the Platform DBLab API)");
-clone2.command("create").description("create a thin clone of the project's database").requiredOption("--project <id|alias>", "project id or alias").option("--branch <branch>", "branch to clone from").option("--snapshot <id>", "snapshot id to clone from").option("--id <id>", "clone id (DBLab generates one when omitted)").option("--db-user <user>", "clone DB user").option("--db-password <password>", "clone DB password").option("--protected", "protect the clone from auto-deletion").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (opts) => {
-  try {
-    const { apiKey, apiBaseUrl, instanceId } = await resolveDblabTarget(opts.project, !!opts.debug);
-    const result = await createClone2({
-      apiKey,
-      apiBaseUrl,
-      instanceId,
-      cloneId: opts.id,
-      branch: opts.branch,
-      snapshotId: opts.snapshot,
-      dbUser: opts.dbUser,
-      dbPassword: opts.dbPassword,
-      isProtected: !!opts.protected,
-      debug: !!opts.debug
-    });
-    printResult(result, opts.json);
-  } catch (err) {
-    console.error(err instanceof Error ? err.message : String(err));
-    process.exitCode = 1;
-  }
-});
-joe.command("status <commandId>").description("show a Joe command's status (metadata only)").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (commandId, opts) => {
-  try {
-    const rootOpts = program2.opts();
-    const cfg = readConfig();
-    const { apiKey } = getConfig(rootOpts);
-    if (!apiKey) {
-      console.error("API key is required. Run 'pgai auth' first or set --api-key.");
-      process.exitCode = 1;
+      console.log(JSON.stringify(output, null, 2));
+      if (output.status !== "ok") {
+        process.exitCode = 1;
+      }
       return;
     }
-    const { apiBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
-    const status = await getCommandStatus2({ apiKey, apiBaseUrl, commandId, debug: !!opts.debug });
-    if (opts.json) {
-      console.log(JSON.stringify(status, null, 2));
+    if (output.status === "ok") {
+      console.log(`command ${output.command_id} \xB7 ok`);
+      const body = formatJoeOutput(output);
+      if (body)
+        console.log(body);
+    } else if (output.status === "error") {
+      console.error(`command ${output.command_id} error: ${output.error ?? "command failed"}`);
+      process.exitCode = 1;
     } else {
-      console.log(`command ${status.command_id} \xB7 ${status.status}${status.error ? ` \xB7 ${status.error}` : ""}`);
+      console.error(`command ${output.command_id} \xB7 ${output.status} \u2014 result is not ready`);
+      process.exitCode = 1;
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -40040,17 +38710,7 @@ joe.command("status <commandId>").description("show a Joe command's status (meta
     process.exitCode = 1;
   }
 });
-clone2.command("list").description("list the project's thin clones").requiredOption("--project <id|alias>", "project id or alias").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (opts) => {
-  try {
-    const { apiKey, apiBaseUrl, instanceId } = await resolveDblabTarget(opts.project, !!opts.debug);
-    const result = await listClones2({ apiKey, apiBaseUrl, instanceId, debug: !!opts.debug });
-    printResult(result, opts.json);
-  } catch (err) {
-    console.error(err instanceof Error ? err.message : String(err));
-    process.exitCode = 1;
-  }
-});
-joe.command("result <commandId>").description("fetch a Joe command's result by id (resume a timed-out one-shot)").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (commandId, opts) => {
+program2.command("projects").description("list the org's projects (shows which have Joe ready) \u2014 org-level, not a Joe endpoint").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (opts) => {
   try {
     const rootOpts = program2.opts();
     const cfg = readConfig();
@@ -40061,28 +38721,16 @@ joe.command("result <commandId>").description("fetch a Joe command's result by i
       return;
     }
     const { apiBaseUrl } = resolveBaseUrls2(rootOpts, cfg);
-    const result = await getCommandResult2({ apiKey, apiBaseUrl, commandId, debug: !!opts.debug });
+    const projects = await listProjects({
+      apiKey,
+      apiBaseUrl,
+      orgId: cfg.orgId ?? undefined,
+      debug: !!opts.debug
+    });
     if (opts.json) {
-      console.log(JSON.stringify(result, null, 2));
-      if (result.status === "error" || result.status === "timed_out") {
-        process.exitCode = 1;
-      }
-      return;
-    }
-    const inferred = inferCommandFromResult(result);
-    if (result.status === "done" && inferred) {
-      console.log(`command ${result.command_id} \xB7 done`);
-      const body = formatJoeResult(inferred, result);
-      if (body)
-        console.log(body);
-    } else if (result.status === "error") {
-      console.error(`command ${result.command_id} error: ${result.error ?? "command failed"}`);
-      process.exitCode = 1;
-    } else if (result.status === "timed_out") {
-      console.error(`command ${result.command_id} timed out on the server`);
-      process.exitCode = 1;
+      console.log(JSON.stringify(projects, null, 2));
     } else {
-      console.log(`command ${result.command_id} \xB7 ${result.status}`);
+      console.log(formatProjectsTable(projects));
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -40090,145 +38738,6 @@ joe.command("result <commandId>").description("fetch a Joe command's result by i
     process.exitCode = 1;
   }
 });
-clone2.command("status <cloneId>").description("show a clone's status").requiredOption("--project <id|alias>", "project id or alias").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (cloneId, opts) => {
-  try {
-    const { apiKey, apiBaseUrl, instanceId } = await resolveDblabTarget(opts.project, !!opts.debug);
-    const result = await getClone2({ apiKey, apiBaseUrl, instanceId, cloneId, debug: !!opts.debug });
-    printResult(result, opts.json);
-  } catch (err) {
-    console.error(err instanceof Error ? err.message : String(err));
-    process.exitCode = 1;
-  }
-});
-clone2.command("reset <cloneId>").description("reset a clone to a pristine snapshot").requiredOption("--project <id|alias>", "project id or alias").option("--snapshot <id>", "snapshot id to reset to (default: latest)").option("--latest", "reset to the latest snapshot").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (cloneId, opts) => {
-  try {
-    const { apiKey, apiBaseUrl, instanceId } = await resolveDblabTarget(opts.project, !!opts.debug);
-    const result = await resetClone2({
-      apiKey,
-      apiBaseUrl,
-      instanceId,
-      cloneId,
-      snapshotId: opts.snapshot,
-      latest: opts.latest,
-      debug: !!opts.debug
-    });
-    printResult(result ?? { reset: true, cloneId }, opts.json);
-  } catch (err) {
-    console.error(err instanceof Error ? err.message : String(err));
-    process.exitCode = 1;
-  }
-});
-clone2.command("destroy <cloneId>").description("destroy a clone (requires joe:admin)").requiredOption("--project <id|alias>", "project id or alias").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (cloneId, opts) => {
-  try {
-    const { apiKey, apiBaseUrl, instanceId } = await resolveDblabTarget(opts.project, !!opts.debug);
-    const result = await destroyClone2({ apiKey, apiBaseUrl, instanceId, cloneId, debug: !!opts.debug });
-    printResult(result ?? { destroyed: true, cloneId }, opts.json);
-  } catch (err) {
-    console.error(err instanceof Error ? err.message : String(err));
-    process.exitCode = 1;
-  }
-});
-var branch = dblab.command("branch").description("DBLab branch management (proxies the Platform DBLab API)");
-branch.command("list").description("list the project's branches").requiredOption("--project <id|alias>", "project id or alias").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (opts) => {
-  try {
-    const { apiKey, apiBaseUrl, instanceId } = await resolveDblabTarget(opts.project, !!opts.debug);
-    const result = await listBranches2({ apiKey, apiBaseUrl, instanceId, debug: !!opts.debug });
-    printResult(result, opts.json);
-  } catch (err) {
-    console.error(err instanceof Error ? err.message : String(err));
-    process.exitCode = 1;
-  }
-});
-branch.command("create <name>").description("create a branch").requiredOption("--project <id|alias>", "project id or alias").option("--snapshot <id>", "snapshot id to base the branch on").option("--base-branch <branch>", "parent branch to fork from").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (name, opts) => {
-  try {
-    const { apiKey, apiBaseUrl, instanceId } = await resolveDblabTarget(opts.project, !!opts.debug);
-    const result = await createBranch2({
-      apiKey,
-      apiBaseUrl,
-      instanceId,
-      branchName: name,
-      baseBranch: opts.baseBranch,
-      snapshotId: opts.snapshot,
-      debug: !!opts.debug
-    });
-    printResult(result, opts.json);
-  } catch (err) {
-    console.error(err instanceof Error ? err.message : String(err));
-    process.exitCode = 1;
-  }
-});
-branch.command("delete <name>").description("delete a branch (requires joe:admin)").requiredOption("--project <id|alias>", "project id or alias").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (name, opts) => {
-  try {
-    const { apiKey, apiBaseUrl, instanceId } = await resolveDblabTarget(opts.project, !!opts.debug);
-    const result = await deleteBranch2({ apiKey, apiBaseUrl, instanceId, branchName: name, debug: !!opts.debug });
-    printResult(result ?? { deleted: true, branch: name }, opts.json);
-  } catch (err) {
-    console.error(err instanceof Error ? err.message : String(err));
-    process.exitCode = 1;
-  }
-});
-branch.command("log <name>").description("show a branch's snapshot log").requiredOption("--project <id|alias>", "project id or alias").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (name, opts) => {
-  try {
-    const { apiKey, apiBaseUrl, instanceId } = await resolveDblabTarget(opts.project, !!opts.debug);
-    const result = await branchLog2({ apiKey, apiBaseUrl, instanceId, branchName: name, debug: !!opts.debug });
-    printResult(result, opts.json);
-  } catch (err) {
-    console.error(err instanceof Error ? err.message : String(err));
-    process.exitCode = 1;
-  }
-});
-var snapshot = dblab.command("snapshot").description("DBLab snapshot management (proxies the Platform DBLab API)");
-snapshot.command("list").description("list the project's snapshots").requiredOption("--project <id|alias>", "project id or alias").option("--branch <branch>", "filter by branch").option("--dataset <dataset>", "filter by dataset").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (opts) => {
-  try {
-    const { apiKey, apiBaseUrl, instanceId } = await resolveDblabTarget(opts.project, !!opts.debug);
-    const result = await listSnapshots2({
-      apiKey,
-      apiBaseUrl,
-      instanceId,
-      branchName: opts.branch,
-      dataset: opts.dataset,
-      debug: !!opts.debug
-    });
-    printResult(result, opts.json);
-  } catch (err) {
-    console.error(err instanceof Error ? err.message : String(err));
-    process.exitCode = 1;
-  }
-});
-snapshot.command("create").description("create a snapshot from a clone").requiredOption("--project <id|alias>", "project id or alias").requiredOption("--clone <id>", "clone id to snapshot").option("--message <message>", "snapshot message").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (opts) => {
-  try {
-    const { apiKey, apiBaseUrl, instanceId } = await resolveDblabTarget(opts.project, !!opts.debug);
-    const result = await createSnapshot2({
-      apiKey,
-      apiBaseUrl,
-      instanceId,
-      cloneId: opts.clone,
-      message: opts.message,
-      debug: !!opts.debug
-    });
-    printResult(result, opts.json);
-  } catch (err) {
-    console.error(err instanceof Error ? err.message : String(err));
-    process.exitCode = 1;
-  }
-});
-snapshot.command("destroy <snapshotId>").description("destroy a snapshot (requires joe:admin)").requiredOption("--project <id|alias>", "project id or alias").option("--force", "force-delete even when dependent clones exist").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (snapshotId, opts) => {
-  try {
-    const { apiKey, apiBaseUrl, instanceId } = await resolveDblabTarget(opts.project, !!opts.debug);
-    const result = await destroySnapshot2({
-      apiKey,
-      apiBaseUrl,
-      instanceId,
-      snapshotId,
-      force: !!opts.force,
-      debug: !!opts.debug
-    });
-    printResult(result ?? { destroyed: true, snapshot: snapshotId }, opts.json);
-  } catch (err) {
-    console.error(err instanceof Error ? err.message : String(err));
-    process.exitCode = 1;
-  }
-});
 var mcp = program2.command("mcp").description("MCP server integration");
 mcp.command("start").description("start MCP stdio server").option("--debug", "enable debug output").action(async (opts) => {
   const rootOpts = program2.opts();
@@ -40302,29 +38811,29 @@ mcp.command("install [client]").description("install MCP server configuration fo
     let configDir;
     switch (client) {
       case "cursor":
-        configPath = path9.join(homeDir, ".cursor", "mcp.json");
-        configDir = path9.dirname(configPath);
+        configPath = path7.join(homeDir, ".cursor", "mcp.json");
+        configDir = path7.dirname(configPath);
         break;
       case "windsurf":
-        configPath = path9.join(homeDir, ".windsurf", "mcp.json");
-        configDir = path9.dirname(configPath);
+        configPath = path7.join(homeDir, ".windsurf", "mcp.json");
+        configDir = path7.dirname(configPath);
         break;
       case "codex":
-        configPath = path9.join(homeDir, ".codex", "mcp.json");
-        configDir = path9.dirname(configPath);
+        configPath = path7.join(homeDir, ".codex", "mcp.json");
+        configDir = path7.dirname(configPath);
         break;
       default:
         console.error(`Configuration not implemented for: ${client}`);
         process.exitCode = 1;
         return;
     }
-    if (!fs11.existsSync(configDir)) {
-      fs11.mkdirSync(configDir, { recursive: true });
+    if (!fs9.existsSync(configDir)) {
+      fs9.mkdirSync(configDir, { recursive: true });
     }
     let config2 = { mcpServers: {} };
-    if (fs11.existsSync(configPath)) {
+    if (fs9.existsSync(configPath)) {
       try {
-        const content = fs11.readFileSync(configPath, "utf8");
+        const content = fs9.readFileSync(configPath, "utf8");
         config2 = JSON.parse(content);
         if (!config2.mcpServers) {
           config2.mcpServers = {};
@@ -40337,7 +38846,7 @@ mcp.command("install [client]").description("install MCP server configuration fo
       command: pgaiPath,
       args: ["mcp", "start"]
     };
-    fs11.writeFileSync(configPath, JSON.stringify(config2, null, 2), "utf8");
+    fs9.writeFileSync(configPath, JSON.stringify(config2, null, 2), "utf8");
     console.log(`\u2713 PostgresAI MCP server configured for ${client}`);
     console.log(`  Config file: ${configPath}`);
     console.log("");
@@ -40359,6 +38868,5 @@ export {
   refreshBundledComposeIfStale,
   readDeployedTag,
   planMonitoringRegistration,
-  isValidComposeYaml,
-  inferCommandFromResult
+  isValidComposeYaml
 };