postgresai 0.17.0-dev.4 → 0.17.0-dev.6

package/dist/bin/postgres-ai.js

@@ -13533,7 +13533,7 @@ var {
 // package.json
 var package_default = {
   name: "postgresai",
-  version: "0.17.0-dev.4",
+  version: "0.17.0-dev.6",
   description: "postgres_ai CLI",
   license: "Apache-2.0",
   private: false,
@@ -16893,7 +16893,7 @@ var Result = import_lib.default.Result;
 var TypeOverrides = import_lib.default.TypeOverrides;
 var defaults = import_lib.default.defaults;
 // package.json
-var version = "0.17.0-dev.4";
+var version = "0.17.0-dev.6";
 var package_default2 = {
   name: "postgresai",
   version,
@@ -17169,6 +17169,22 @@ class HttpStatusError extends Error {
 function isRetryableHttpStatus(status) {
   return status >= 500 || status === 429;
 }
+function isUnknownRpcSignature(status, text, rpc) {
+  if (status !== 404)
+    return false;
+  try {
+    const parsed = JSON.parse(text);
+    return typeof parsed.message === "string" && /Could not find the .* function/.test(parsed.message) && parsed.message.includes(`${rpc}(`);
+  } catch {
+    return false;
+  }
+}
+function positiveSeconds(v) {
+  return typeof v === "number" && Number.isFinite(v) && v > 0 ? v : null;
+}
+function asyncPollDelayMs(attempt) {
+  return Math.min(1000 * 2 ** attempt, 15000);
+}
 var DEFAULT_HTTP_REQUEST_TIMEOUT_MS = 25000;
 
 class HttpRequestTimeoutError extends Error {
@@ -21466,7 +21482,8 @@ function summarizeF001(nodeData) {
       return `Autovacuum config: ${parts.join(", ")} finding${fired.length > 1 ? "s" : ""}`;
     };
     if (severity === "CRITICAL" || severity === "WARNING") {
-      return { status: "warning", message: summarize() };
+      const top = fired.find((r) => r.severity === "CRITICAL") ?? fired.find((r) => r.severity === "WARNING");
+      return { status: "warning", message: top?.conclusion ? `${summarize()}. ${top.conclusion}` : summarize() };
     }
     return { status: "info", message: summarize() };
   }
@@ -23958,6 +23975,38 @@ function withCheckSummary(report) {
   return report;
 }
 
+// lib/checkup-upload.ts
+function responseId(fn, response, ...keys) {
+  const answer = response ?? {};
+  const id = Number(keys.map((key) => answer[key]).find((value) => value != null));
+  if (!Number.isFinite(id) || id <= 0) {
+    throw new Error(typeof answer.message === "string" ? answer.message : `Unexpected ${fn} response: ${JSON.stringify(response)}`);
+  }
+  return id;
+}
+async function createCheckupReport(rpc, params) {
+  const fn = "checkup_report_create";
+  const response = await rpc(fn, {
+    access_token: params.apiKey,
+    project: params.project,
+    ...params.status ? { status: params.status } : {}
+  });
+  return { reportId: responseId(fn, response, "report_id") };
+}
+async function uploadCheckupReportJson(rpc, params) {
+  const fn = "checkup_report_file_post";
+  const response = await rpc(fn, {
+    access_token: params.apiKey,
+    checkup_report_id: params.reportId,
+    filename: params.filename,
+    check_id: params.checkId,
+    data: params.jsonText,
+    type: "json",
+    generate_issue: true
+  });
+  return { reportChunkId: responseId(fn, response, "report_chunck_id", "report_chunk_id") };
+}
+
 // lib/host-metrics.ts
 import { createHash } from "node:crypto";
 import { chmodSync as chmodSync3, lstatSync, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
@@ -27817,46 +27866,58 @@ async function verifyInitSetup(params) {
 }
 
 // lib/joe.ts
+var JOE_ASYNC_FALLBACK_WAIT_MS = 10 * 60 * 1000;
+var JOE_ASYNC_MAX_WAIT_MS = 60 * 60 * 1000;
 async function callRpc(params) {
+  return (await callRpcRaw(params)).data;
+}
+async function callRpcRaw(params) {
   const { apiKey, apiBaseUrl, fn, body, operation, debug } = params;
   if (!apiKey) {
     throw new Error("API key is required");
   }
   const base = normalizeBaseUrl(apiBaseUrl);
   const url = new URL(`${base}/rpc/${fn}`);
-  const payload = JSON.stringify(body);
   const headers = buildAuthHeaders(apiKey, params.orgScope);
-  if (debug) {
-    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.error(`Debug: POST URL: ${url.toString()}`);
-    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
-    console.error(`Debug: Request body: ${redactSecretsForLog(payload)}`);
-  }
-  let response;
-  const requestTimeout = requestTimeoutSignal(params.timeoutMs);
-  try {
-    response = await fetch(url.toString(), {
-      method: "POST",
-      headers,
-      body: payload,
-      signal: requestTimeout.signal
-    });
-  } catch (err) {
-    if (isFetchTimeout(err)) {
-      throw new HttpRequestTimeoutError(operation, requestTimeout.timeoutMs);
+  const send = async (bodyObj) => {
+    const payload = JSON.stringify(bodyObj);
+    if (debug) {
+      const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
+      console.error(`Debug: POST URL: ${url.toString()}`);
+      console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+      console.error(`Debug: Request body: ${redactSecretsForLog(payload)}`);
+    }
+    let response;
+    const requestTimeout = requestTimeoutSignal(params.timeoutMs);
+    try {
+      response = await fetch(url.toString(), {
+        method: "POST",
+        headers,
+        body: payload,
+        signal: requestTimeout.signal
+      });
+    } catch (err) {
+      if (isFetchTimeout(err)) {
+        throw new HttpRequestTimeoutError(operation, requestTimeout.timeoutMs);
+      }
+      throw new Error(describeFetchError(operation, base, err));
     }
-    throw new Error(describeFetchError(operation, base, err));
-  }
-  const text = await response.text();
-  if (debug) {
-    console.error(`Debug: Response status: ${response.status}`);
-    console.error(`Debug: Response body: ${redactSecretsForLog(text)}`);
+    const text = await response.text();
+    if (debug) {
+      console.error(`Debug: Response status: ${response.status}`);
+      console.error(`Debug: Response body: ${redactSecretsForLog(text)}`);
+    }
+    return { response, text };
+  };
+  let { response, text } = await send(body);
+  if (params.fallbackBody && isUnknownRpcSignature(response.status, text, fn)) {
+    ({ response, text } = await send(params.fallbackBody));
   }
   if (!response.ok) {
     throw new HttpStatusError(formatHttpError(operation, response.status, text, response.statusText), response.status);
   }
   try {
-    return JSON.parse(text);
+    return { data: JSON.parse(text), status: response.status };
   } catch {
     throw new Error(`${operation}: failed to parse response: ${redactSecretsForLog(text)}`);
   }
@@ -27905,6 +27966,25 @@ function isNumericProjectRef(ref) {
 }
 
 // lib/connect.ts
+var money = (cents, currency) => currency.toLowerCase() === "usd" ? `$${(cents / 100).toFixed(2)}` : `${(cents / 100).toFixed(2)} ${currency.toUpperCase()}`;
+function priceText(q) {
+  if (!q.billed && q.same_cluster)
+    return `included: same database cluster as ${q.same_cluster}, no extra charge`;
+  if (!q.billed)
+    return q.free_slots.total ? `free (${q.free_slots.remaining} of ${q.free_slots.total} free slots)` : "free";
+  const { amount, currency, interval } = q.price;
+  const base = `${money(amount, currency)}/${interval} per database cluster (${q.plan} plan)${q.subscription ? `, cluster ${q.quantity + 1} on the subscription` : ""}`;
+  if (q.promo?.valid && q.amount_after_promo !== undefined && q.amount_after_promo !== null) {
+    const after = `${money(q.amount_after_promo, currency)}`;
+    const how = `with ${q.promo.code} (${q.promo.discount_description})`;
+    if (q.promo.duration === "forever")
+      return `${after}/${interval} ${how}, instead of ${base}`;
+    if (q.promo.duration === "repeating")
+      return `${after}/${interval} for ${q.promo.duration_in_months} months ${how}, then ${base}`;
+    return `${after} the first ${interval} ${how}, then ${base}`;
+  }
+  return base;
+}
 var FIRST_CHECKUP_DELAY_MS = 30 * 60000;
 var POLL_MS = 15000;
 var PROVIDERS = ["clickhouse", "rds", "supabase", "self-managed"];
@@ -27960,8 +28040,12 @@ function stateOf(raw) {
 
 class ClickhouseKeyError extends Error {
 }
-var serverOf = (name) => name.split("/")[0];
-var errorText = (err) => err instanceof Error ? err.message : String(err);
+var serverOf = (name) => name.split("/")[0].toLowerCase().replace(/\.(?=$|:)/, "");
+function clusterOf(url) {
+  const u = parseUrl(url);
+  return u?.hostname ? `${u.hostname.toLowerCase()}:${u.port || "5432"}` : undefined;
+}
+var errorText = (err) => err instanceof AggregateError && !err.message ? err.errors.map(errorText).join("; ") : err instanceof Error ? err.message : String(err);
 var urlPassword = (u) => decodeURIComponent(u.password) || u.searchParams.get("password") || "";
 var URL_PARAMS_KEPT = ["sslmode", "channel_binding", "application_name"];
 var URL_PARAMS_TLS = ["sslrootcert", "sslcert", "sslkey", "uselibpqcompat"];
@@ -27976,6 +28060,22 @@ function checkUrlParams(url, agent) {
   if (moved.length)
     throw new Error(`The URL's query string sets ${moved.join(" and ")}: put the host and the port in the URL itself (postgresql://user:password@host:5432/dbname), so that the server prepared is the server monitored`);
 }
+function storedPasswordNeeds(monitoringUrl) {
+  const query = new URL(monitoringUrl).search.replace(/^\?/, "");
+  const parts = query ? query.split("&") : [];
+  const keys = parts.map((p) => p.split("=")[0]);
+  const twice = URL_PARAMS_KEPT.filter((k) => keys.indexOf(k) !== keys.lastIndexOf(k));
+  const tls = !twice.includes("sslmode") && parts.some((p) => /^sslmode=(require|verify-ca|verify-full)$/.test(p));
+  const needs = [
+    ...tls ? [] : [`sslmode=require (or verify-full)${twice.includes("sslmode") ? ", once" : ""}`],
+    ...twice.filter((k) => k !== "sslmode").map((k) => `${k} once`),
+    ...parts.some((p) => !p) ? ["no stray &"] : [],
+    ...keys.some((k) => k && !URL_PARAMS_KEPT.includes(k)) ? ["the parameter names without %-escapes"] : []
+  ];
+  return needs.length ? needs.join(" and ") : undefined;
+}
+var shellWord = (s) => /^[\w./:@%+=,-]+$/.test(s) ? s : `'${s.replace(/'/g, "'\\''")}'`;
+var disconnectEach = (names) => names.map((n) => `pgai disconnect ${shellWord(n)} --yes`).join(" and ");
 function roleUrlFor(url, db, password, kept) {
   const u = new URL(url);
   u.username = DEFAULT_MONITORING_USER;
@@ -27984,6 +28084,7 @@ function roleUrlFor(url, db, password, kept) {
   for (const name of [...u.searchParams.keys()])
     if (!kept.includes(name))
       u.searchParams.delete(name);
+  u.search = u.search.replace(/@/g, "%40");
   return u.toString();
 }
 var monitoringUrlFor = (url, db, password) => roleUrlFor(url, db, password, URL_PARAMS_KEPT);
@@ -28023,15 +28124,40 @@ function checkupLines(c) {
     return [`Express checkup could not run: ${c.error}`];
   const warnings = c.findings.filter((f) => f.status === "warning");
   const ok = c.findings.filter((f) => f.status === "ok");
+  const failed = c.failed ?? [];
+  const counts = [`${warnings.length} warning${warnings.length === 1 ? "" : "s"}`, `${ok.length} ok`, `${c.info.length} info`, ...failed.length ? [`${failed.length} could not run`] : []];
   return [
-    `Express checkup while the box starts (${c.checks} checks: ${warnings.length} warning${warnings.length === 1 ? "" : "s"}, ${ok.length} ok):`,
+    `Express checkup while the box starts (${c.checks} checks: ${counts.join(", ")}):`,
     ...warnings.map((f) => `  ${f.check_id} ${f.title}: ${f.message}`),
     ...ok.length ? [`  ok: ${ok.map((f) => f.check_id).join(" ")}`] : [],
-    ...c.failed?.length ? [`  could not run: ${c.failed.join(" ")}`] : [],
+    ...c.info.length ? [`  info: ${c.info.join(" ")}`] : [],
+    ...failed.length ? [`  could not run: ${failed.join(" ")}`] : [],
+    c.report_id ? `Saved as report ${c.report_id}: pgai reports files ${c.report_id}` : `Not saved to PostgresAI: ${c.upload_error}`,
     "The full checkup (query analysis and trends) follows on the box."
   ];
 }
+var boxState = (row) => row.status === "launch_requested" && row.registered_at ? "registered" : row.status ?? "starting";
+async function billingFor(q, name, opts, deps, show) {
+  const billing = { price: priceText(q), requires_payment_method: q.requires_payment_method };
+  if (opts.coupon) {
+    billing.coupon = q.promo?.valid ? { code: q.promo.code, valid: true, description: q.promo.discount_description } : { code: opts.coupon, valid: false, error: q.promo?.error ?? "not valid" };
+  }
+  const billingPage = { ...billing, requires_payment_method: true, next: `Add a payment method at ${q.billing_url ?? deps.billingUrl(q.org_alias)}, then re-run` };
+  const stop = (next) => ({ billing, billingPage, accepted: false, stop: { ...billing, next } });
+  if (billing.coupon && !billing.coupon.valid) {
+    return stop(`Promo code ${opts.coupon}: ${billing.coupon.error}. Nothing was changed: re-run with a valid code, or without ${opts.agent ? "coupon" : "--coupon"}`);
+  }
+  if (q.requires_payment_method)
+    return { billing, billingPage, accepted: false, stop: billingPage };
+  show(billing.price);
+  if (q.billed && !opts.yes && !await deps.confirm(`Provision ${name}? (y/N): `)) {
+    return stop(opts.agent ? `Call connect_database again with yes: true to accept ${billing.price}` : `Re-run with --yes to accept ${billing.price}`);
+  }
+  return { billing, billingPage, accepted: q.billed };
+}
 async function connect(url, opts, deps) {
+  const started = deps.now();
+  const progress = (event, message, more = {}) => deps.progress({ event, elapsed_s: Math.round((deps.now() - started) / 1000), message, ...more });
   const provider = opts.provider ?? detectCloudProvider(url);
   if (!PROVIDERS.includes(provider))
     throw new Error(`--provider must be one of: ${PROVIDERS.join(", ")}`);
@@ -28047,13 +28173,16 @@ async function connect(url, opts, deps) {
     return { status: "action_required", provider, name, next: "--reset-password works with PostgresAI Cloud only (it checks what else monitors this server): connect without --self-hosted, or set PGAI_MON_PASSWORD" };
   }
   if (opts.selfHosted && deps.localStackRunning()) {
-    return { status: "action_required", provider, name, next: "A monitoring stack already runs on this machine: add the database with pgai mon targets add '<postgres_ai_mon URL>'" };
+    return { status: "action_required", provider, name, next: "A monitoring stack already runs on this machine: add the database with PGAI_DB_URL='<postgres_ai_mon URL>' pgai mon targets add" };
   }
   const rows = opts.selfHosted ? [] : await deps.list();
   let row = rows.find((d) => d.name === name && !disconnecting(d.status));
   const fresh = !row;
   let note = "";
   let checkup;
+  let billing = {};
+  let billingPage;
+  let accepted = false;
   const findOrg = async () => {
     try {
       return await deps.clickhouseOrg(new URL(url).hostname, key.keyId, key.keySecret);
@@ -28082,62 +28211,154 @@ async function connect(url, opts, deps) {
       }
       ch = found;
     }
-    if (opts.resetPassword) {
-      const others = rows.filter((d) => d.name !== name && !disconnecting(d.status) && serverOf(d.name) === serverOf(name));
-      if (others.length) {
-        return { status: "action_required", provider, name, next: `A new password for ${DEFAULT_MONITORING_USER} would cut off the monitoring of ${others.map((d) => d.name).join(", ")} on this server: set PGAI_MON_PASSWORD to its password instead` };
-      }
-    }
-    deps.progress(`Preparing ${maskConnectionString(url)}`);
-    const prepared = await deps.prepare(url, provider, { resetPassword: opts.resetPassword });
-    if ("next" in prepared)
-      return { status: "action_required", provider, name, ...prepared };
-    if (prepared.note)
-      note = `; ${prepared.note}`;
-    if (opts.selfHosted) {
-      await deps.selfHosted(prepared.monitoringUrl, key && ch ? { CLICKHOUSE_ORG_ID: ch.orgId, CLICKHOUSE_KEY_ID: key.keyId, CLICKHOUSE_KEY_SECRET: key.keySecret } : {});
-      return { status: "connected", provider, name, dashboard_url: "http://localhost:3000", host_metrics: !!ch, next: `pgai mon health${note}` };
-    }
-    deps.progress(`Provisioning monitoring for ${name}`);
-    const undo = async () => {
-      if (prepared.generated)
+    const undo = async (p) => {
+      if ("generated" in p && p.generated)
         await deps.unprepare(url).catch(() => false);
     };
-    const created = await deps.create({
-      db_url: prepared.monitoringUrl,
-      ...provider === "clickhouse" ? { provider } : {},
-      ...key && ch ? { clickhouse_org_id: ch.orgId, clickhouse_key_id: key.keyId, clickhouse_key_secret: key.keySecret } : {}
-    }).catch(async (err) => {
-      if (err instanceof HttpStatusError && err.status >= 400 && err.status < 500)
-        await undo();
-      throw err;
-    });
-    if (created.status === "failed") {
-      await undo();
-      return { status: "failed", provider, name, id: created.id, next: `${created.error} Re-run pgai connect later.` };
+    let lockId;
+    const unread = (d) => /^Monitoring [0-9a-f]{6}$/.test(d.name);
+    const othersOnServer = (list) => list.filter((d) => d.name !== name && !disconnecting(d.status) && (unread(d) || serverOf(d.name) === serverOf(name)));
+    const storedPassword = rows.some((d) => d.monitoring_password_stored && !/delet/.test(d.status ?? "") && serverOf(d.name) === serverOf(name)) || undefined;
+    const cutOff = (others) => {
+      const on = others.filter((d) => !unread(d)).map((d) => d.name).join(", ");
+      const maybe = others.filter(unread).map((d) => d.name).join(", ");
+      const what = [on && `would cut off the monitoring of ${on} on this server`, maybe && `may cut off the monitoring of ${maybe} (the platform could not read its URL, so its server is not known)`].filter(Boolean).join(", and ");
+      const instead = [
+        ...storedPassword ? ["connect without --reset-password (PostgresAI keeps its password for this server, and sends it only over TLS)"] : [],
+        "set PGAI_MON_PASSWORD to its password instead",
+        `${disconnectEach(others.map((d) => d.name))} first`
+      ];
+      return { status: "action_required", provider, name, next: `A new password for ${DEFAULT_MONITORING_USER} ${what}: ${instead.join(", or ")}` };
+    };
+    const others = othersOnServer(rows).filter((d) => !unread(d)).map((d) => d.name);
+    if (opts.resetPassword && othersOnServer(rows).length)
+      return cutOff(othersOnServer(rows));
+    if (opts.coupon !== undefined && !opts.coupon.trim()) {
+      return { status: "action_required", provider, name, next: `${opts.agent ? "coupon" : "--coupon"} is empty: pass a promotion code, or leave ${opts.agent ? "coupon" : "--coupon"} out` };
+    }
+    const prepOpts = { resetPassword: opts.resetPassword, ...storedPassword ? { storedPassword, others } : {} };
+    if (!opts.selfHosted) {
+      const probe = await deps.prepare(url, provider, { ...prepOpts, check: true });
+      if ("next" in probe)
+        return { status: "action_required", provider, name, ...probe };
+      const b = await billingFor(await deps.quote(opts.coupon, clusterOf(url)), name, opts, deps, (price) => progress("billing", `Billing: ${price}`));
+      if (b.stop)
+        return { status: "action_required", provider, name, ...b.stop };
+      ({ billing, billingPage, accepted } = b);
+    }
+    if (opts.resetPassword) {
+      let lock;
+      try {
+        lock = await deps.resetLock(serverOf(name));
+      } catch (err) {
+        if (err instanceof HttpStatusError && err.status === 409) {
+          return { status: "action_required", provider, name, ...billing, next: `Another pgai connect --reset-password for ${serverOf(name)} is running: wait for it to finish, then re-run (a run that stopped frees the server 15 minutes after it started)` };
+        }
+        if (err instanceof HttpStatusError && err.status === 404) {
+          return { status: "action_required", provider, name, ...billing, next: `This platform cannot lock the server for --reset-password yet: set PGAI_MON_PASSWORD to ${DEFAULT_MONITORING_USER}'s password instead` };
+        }
+        throw err;
+      }
+      if (typeof lock.lock_id !== "string" || !lock.lock_id)
+        throw new Error("cloud_monitoring_reset_lock returned no lock_id: nothing was changed");
+      lockId = lock.lock_id;
+    }
+    let prepared;
+    let created;
+    let unanswered = false;
+    try {
+      if (lockId) {
+        const now = await deps.list();
+        const same = now.find((d) => d.name === name && !disconnecting(d.status));
+        if (same)
+          return { status: "action_required", provider, name, id: same.id, ...billing, next: `${name} is already connected, and its monitoring uses the current password: pgai disconnect ${name} --yes first` };
+        const others = othersOnServer(now);
+        if (others.length)
+          return { ...cutOff(others), ...billing };
+      }
+      progress("preparing", `Preparing ${maskConnectionString(url)}`);
+      prepared = await deps.prepare(url, provider, prepOpts);
+      if ("next" in prepared)
+        return { status: "action_required", provider, name, ...billing, ...prepared };
+      if (!("monitoringUrl" in prepared))
+        throw new Error("prepare returned no monitoring URL");
+      if (prepared.note)
+        note = `; ${prepared.note}`;
+      if (opts.selfHosted) {
+        await deps.selfHosted(prepared.monitoringUrl, key && ch ? { CLICKHOUSE_ORG_ID: ch.orgId, CLICKHOUSE_KEY_ID: key.keyId, CLICKHOUSE_KEY_SECRET: key.keySecret } : {});
+        return { status: "connected", provider, name, dashboard_url: "http://localhost:3000", host_metrics: !!ch, next: `pgai mon health${note}` };
+      }
+      progress("provisioning", `Provisioning monitoring for ${name}`);
+      created = await deps.create({
+        db_url: prepared.monitoringUrl,
+        ...provider === "clickhouse" ? { provider } : {},
+        ...key && ch ? { clickhouse_org_id: ch.orgId, clickhouse_key_id: key.keyId, clickhouse_key_secret: key.keySecret } : {},
+        ...opts.coupon ? { promo_code: opts.coupon } : {},
+        ...accepted ? { accept_price: true } : {}
+      }).catch(async (err) => {
+        if (err instanceof HttpStatusError && err.status >= 400 && err.status < 500)
+          await undo(prepared);
+        else
+          unanswered = true;
+        if (err instanceof HttpStatusError && err.status === 402)
+          return /declined/i.test(err.message) ? "declined" : "payment";
+        if (err instanceof HttpStatusError && err.status === 412)
+          return "price";
+        if (err instanceof HttpStatusError && err.status === 409 && "storedPassword" in prepared && prepared.storedPassword && /none is stored/.test(err.message))
+          return "stored";
+        throw err;
+      });
+      if (created === "payment")
+        return { status: "action_required", provider, name, ...billingPage };
+      if (created === "declined") {
+        return { status: "action_required", provider, name, ...billingPage, next: billingPage.next.replace(/^Add a payment method at /, "The payment method on file was declined: update it at ") };
+      }
+      if (created === "price")
+        return { status: "action_required", provider, name, ...billing, next: "The price changed since it was shown: re-run pgai connect to see it" };
+      if (created === "stored") {
+        const gone = `PostgresAI no longer keeps the password of ${DEFAULT_MONITORING_USER} for this server`;
+        return { status: "action_required", provider, name, ...billing, next: opts.agent ? `${gone}: pass its URL as database_url, or run pgai connect <admin-url> --reset-password in a terminal` : `${gone}: re-run with --reset-password (anything else that logs in as ${DEFAULT_MONITORING_USER} then needs the new one), or set PGAI_MON_PASSWORD to its password` };
+      }
+      if (created.status === "failed") {
+        await undo(prepared);
+        return { status: "failed", provider, name, id: created.id, next: `${created.error} Re-run pgai connect later.` };
+      }
+    } finally {
+      if (lockId && !unanswered)
+        await deps.resetUnlock(lockId).catch(() => {});
     }
     row = { id: created.id, name: created.name, provider, status: created.status, dashboard_url: null, host_metrics: !!ch };
-    checkup = await deps.checkup(withLocalTls(prepared.monitoringUrl, url)).catch((err) => ({ error: errorText(err) }));
-    for (const line of checkupLines(checkup))
-      deps.progress(line);
+    if (prepared.storedPassword) {
+      progress("checkup", `Express checkup skipped: it runs only as ${DEFAULT_MONITORING_USER}, whose password PostgresAI keeps for this server. The full checkup follows on the box.`);
+    } else {
+      checkup = await deps.checkup(withLocalTls(prepared.monitoringUrl, url), created.name).catch((err) => ({ error: errorText(err) }));
+      progress("checkup", checkupLines(checkup).join(`
+`), { checkup });
+    }
   }
-  for (const deadline = Date.now() + opts.waitMs;; ) {
+  let shown;
+  for (const deadline = deps.now() + opts.waitMs;; ) {
     const result = connectStatus(row, provider, fresh);
-    if (result.status !== "provisioning" || Date.now() >= deadline) {
+    const state = boxState(row);
+    if (state !== shown && (shown !== undefined || result.status === "provisioning"))
+      progress("box", `Monitoring box: ${state}`, { state });
+    shown = state;
+    if (result.status !== "provisioning" || deps.now() >= deadline) {
       if (result.status === "connected" && provider === "clickhouse" && !row.host_metrics) {
         result.next += "; for CPU, memory and disk, disconnect and reconnect with --clickhouse-key <key-id>:<key-secret>";
       }
       const { next, ...rest } = result;
-      return { ...rest, ...checkup ? { checkup } : {}, next: next + note };
+      return { ...rest, ...billing, ...checkup ? { checkup } : {}, next: next + note };
     }
-    deps.progress(`Waiting for the monitoring box (${row.status ?? "starting"})`);
     await deps.sleep(POLL_MS);
     row = (await deps.list().catch(() => [])).find((d) => d.id === row.id) ?? row;
   }
 }
-function openConnection(url, opts) {
+async function openConnection(url, opts) {
   const conn = resolveAdminConnection({ conn: url });
-  return connectWithSslFallback(opts.Client ?? Client2, opts.agent ? { ...conn, sslFallbackEnabled: false } : conn);
+  const fallback = !opts.agent && !!conn.sslFallbackEnabled;
+  const { client, usedSsl } = await connectWithSslFallback(opts.Client ?? Client2, { ...conn, sslFallbackEnabled: fallback });
+  return { client, usedSsl, refusedTls: fallback && !usedSsl };
 }
 async function dropMonitoringRole(client) {
   for (const sql of [`drop role ${DEFAULT_MONITORING_USER}`, `drop owned by ${DEFAULT_MONITORING_USER}; drop role ${DEFAULT_MONITORING_USER}`]) {
@@ -28170,7 +28391,7 @@ async function prepareDatabase(url, provider, opts = {}) {
       throw err;
     }
   };
-  const { client } = await open(url).catch((err) => {
+  const { client, usedSsl, refusedTls } = await open(url).catch((err) => {
     if (/client password must be a string/.test(String(err?.message)))
       throw new Error("The URL has no password (and PGPASSWORD is not set): pgai connect postgresql://user:password@host:5432/dbname");
     throw err;
@@ -28184,7 +28405,7 @@ async function prepareDatabase(url, provider, opts = {}) {
            and has_database_privilege(current_user, current_database(), 'CREATE')
            and exists (select 1 from pg_extension where extname = 'pg_stat_statements')) as admin,
          exists (select 1 from pg_roles where rolname = '${DEFAULT_MONITORING_USER}') as mon_exists,
-         current_setting('scram_iterations', true) as iterations
+         current_setting('scram_iterations', true) as iterations, current_setting('ssl') as ssl
        from pg_roles where rolname = current_user`)).rows[0];
     const notes = [caNote(url)].filter((n) => !!n);
     const noted = () => notes.length ? { note: notes.join("; ") } : {};
@@ -28208,9 +28429,31 @@ async function prepareDatabase(url, provider, opts = {}) {
       }
     } else if (me.admin && pgProvider !== "supabase") {
       const exists = `${DEFAULT_MONITORING_USER} already exists on this server`;
+      const setPassword = `Set PGAI_MON_PASSWORD to the password of ${DEFAULT_MONITORING_USER}, or give it a new one: pgai connect <admin-url> --reset-password (anything else that logs in as ${DEFAULT_MONITORING_USER} then needs the new password)`;
+      const needs = storedPasswordNeeds(monitoringUrlFor(url, me.db, ""));
+      const noTls = refusedTls || !usedSsl && me.ssl === "off";
+      const tlsOnly = `PostgresAI sends the password it keeps for ${DEFAULT_MONITORING_USER} only over TLS`;
+      const others = opts.others?.length ? opts.others : undefined;
+      const disconnectOthers = others ? disconnectEach(others) : "pgai disconnect the server's other databases (pgai databases)";
+      const reconnectOthers = `(and connect ${others ? others.join(", ") : "them"} again with it)`;
+      const noTlsWayOut = opts.agent ? `Pass its URL as database_url, or run pgai connect in a terminal with PGAI_MON_PASSWORD set to its password. If nobody has it, in a terminal: ${disconnectOthers}, then pgai connect <admin-url> --reset-password with PGAI_MON_PASSWORD set to a new one ${reconnectOthers}` : `Set PGAI_MON_PASSWORD to its password, or turn on TLS on the server (ssl = on) and put sslmode=require in the URL. If nobody has the password: ${disconnectOthers}, then re-run with --reset-password and PGAI_MON_PASSWORD set to a new one ${reconnectOthers}`;
+      const reuse = me.mon_exists && !opts.resetPassword && !!opts.storedPassword && !(opts.agent ? "" : process.env.PGAI_MON_PASSWORD?.trim());
+      if (reuse && needs) {
+        if (noTls)
+          return { next: `${exists}, but this server takes no TLS, and ${tlsOnly}. ${noTlsWayOut}` };
+        return { next: `${exists}. ${opts.agent ? "database_url" : "The URL"} needs ${needs}: the password PostgresAI keeps for this server is sent only over TLS, to a URL with each parameter once` };
+      }
+      if (reuse) {
+        if (opts.check)
+          return { checked: true };
+        const { password: unused } = await resolveMonitoringPassword({ monitoringUser: DEFAULT_MONITORING_USER });
+        const plan = await buildInitPlan({ database: me.db, monitoringPassword: unused, iterations: Number(me.iterations), includeOptionalPermissions: true, provider: pgProvider, keepExistingPassword: true });
+        await applyInitPlan({ client, plan });
+        return { monitoringUrl: monitoringUrlFor(url, me.db, ""), storedPassword: true, ...noted() };
+      }
       if (me.mon_exists && opts.agent)
         return { next: `${exists}. Pass its URL as database_url, or run pgai connect in a terminal with PGAI_MON_PASSWORD set to its password` };
-      const setPassword = `Set PGAI_MON_PASSWORD to the password of ${DEFAULT_MONITORING_USER}, or give it a new one: pgai connect <admin-url> --reset-password (anything else that logs in as ${DEFAULT_MONITORING_USER} then needs the new password)`;
+      const unset = !opts.storedPassword ? setPassword : noTls ? `This server takes no TLS, and ${tlsOnly}. ${noTlsWayOut}` : !needs ? `Unset PGAI_MON_PASSWORD: PostgresAI keeps the password of ${DEFAULT_MONITORING_USER} for this server` : `Unset PGAI_MON_PASSWORD, and the URL needs ${needs}: PostgresAI keeps the password of ${DEFAULT_MONITORING_USER} for this server, and sends it only over TLS, to a URL with each parameter once`;
       const { password, generated } = await resolveMonitoringPassword({ passwordEnv: opts.agent ? undefined : process.env.PGAI_MON_PASSWORD, monitoringUser: DEFAULT_MONITORING_USER });
       const reset = !!opts.resetPassword && me.mon_exists;
       if (me.mon_exists && !reset) {
@@ -28220,13 +28463,16 @@ async function prepareDatabase(url, provider, opts = {}) {
         try {
           accepted = await logsIn(loginUrlFor(url, me.db, password));
         } catch (err) {
-          return { next: `${exists}, and PGAI_MON_PASSWORD could not be checked from this host (${err instanceof Error ? err.message : String(err)}). Run pgai connect from a host that ${DEFAULT_MONITORING_USER} may connect from` };
+          const orUnset = opts.storedPassword && !noTls ? ", or unset PGAI_MON_PASSWORD: PostgresAI keeps its password for this server" : "";
+          return { next: `${exists}, and PGAI_MON_PASSWORD could not be checked from this host (${err instanceof Error ? err.message : String(err)}). Run pgai connect from a host that ${DEFAULT_MONITORING_USER} may connect from${orUnset}` };
         }
         if (!accepted)
-          return { next: `${exists} and PGAI_MON_PASSWORD is not its password. ${setPassword}` };
+          return { next: `${exists} and PGAI_MON_PASSWORD is not its password. ${unset}` };
         if (await acceptsAnyPassword())
           notes.push(unchecked("PGAI_MON_PASSWORD"));
       }
+      if (opts.check)
+        return { checked: true };
       const monitoringUrl = monitoringUrlFor(url, me.db, password);
       const loginUrl = loginUrlFor(url, me.db, password);
       const plan = await buildInitPlan({ database: me.db, monitoringPassword: password, iterations: Number(me.iterations), includeOptionalPermissions: true, provider: pgProvider, keepExistingPassword: !reset });
@@ -28255,14 +28501,43 @@ ${redactPasswordsInSql(s.sql)}`).join(`
 }
 async function expressCheckup(url, opts = {}) {
   const { client } = await openConnection(url, opts);
+  let reports;
+  const failed = [];
   try {
-    const failed = [];
-    const reports = await generateAllReports(client, "node-01", undefined, (f) => failed.push(f.checkId));
-    const findings = Object.values(reports).map((r) => ({ check_id: r.checkId, title: r.checkTitle, status: r.summary.status, message: r.summary.message })).filter((f) => f.status !== "info").sort((a, b) => Number(b.status === "warning") - Number(a.status === "warning"));
-    return { checks: Object.keys(reports).length + failed.length, findings, ...failed.length ? { failed } : {} };
+    reports = await generateAllReports(client, "node-01", undefined, (f) => failed.push(f.checkId));
   } finally {
     await client.end();
   }
+  const all = Object.values(reports).map((r) => ({ check_id: r.checkId, title: r.checkTitle, status: r.summary.status, message: r.summary.message }));
+  const findings = all.filter((f) => f.status !== "info").sort((a, b) => Number(b.status === "warning") - Number(a.status === "warning"));
+  const result = { checks: all.length + failed.length, findings, info: all.filter((f) => f.status === "info").map((f) => f.check_id), ...failed.length ? { failed } : {} };
+  if (!opts.save)
+    return result;
+  try {
+    return { ...result, report_id: await opts.save(reports) };
+  } catch (err) {
+    return { ...result, upload_error: errorText(err) };
+  }
+}
+async function saveCheckupReport(rpc, accessToken, project, reports) {
+  const { reportId } = await createCheckupReport(rpc, { apiKey: accessToken, project });
+  const setStatus = (status) => rpc("checkup_report_status_update", { access_token: accessToken, report_id: reportId, status });
+  try {
+    for (const [checkId, report] of Object.entries(reports)) {
+      await uploadCheckupReportJson(rpc, {
+        apiKey: accessToken,
+        reportId,
+        filename: `${checkId}.json`,
+        checkId,
+        jsonText: JSON.stringify(report, null, 2)
+      });
+    }
+  } catch (err) {
+    await setStatus("failed").catch(() => {});
+    throw err;
+  }
+  await setStatus("completed");
+  return reportId;
 }
 async function clickhouseOrgFor(host, keyId, keySecret) {
   const apiUrl = process.env.CLICKHOUSE_API_URL || "https://api.clickhouse.cloud";
@@ -28299,16 +28574,21 @@ function platformDeps(p) {
     list: () => rpc("cloud_monitoring_list"),
     create: (body) => rpc("cloud_monitoring_connect", body),
     disconnect: (id) => rpc("cloud_monitoring_disconnect", { instance_id: id }),
+    resetLock: (server) => rpc("cloud_monitoring_reset_lock", { server }),
+    resetUnlock: (lockId) => rpc("cloud_monitoring_reset_unlock", { lock_id: lockId }),
     prepare: (url, provider, o = {}) => prepareDatabase(url, provider, { ...o, agent: p.agent }),
     unprepare: (url) => unprepareDatabase(url, { agent: p.agent }),
     clickhouseOrg: clickhouseOrgFor,
-    checkup: (url) => expressCheckup(url, { agent: p.agent }),
+    checkup: (url, project) => expressCheckup(url, { agent: p.agent, save: (reports) => saveCheckupReport(rpc, p.apiKey, project, reports) }),
+    quote: (coupon, cluster) => rpc("cloud_monitoring_quote", { ...coupon ? { promo_code: coupon } : {}, ...cluster ? { db_server: cluster } : {} }),
+    billingUrl: (orgAlias) => `${p.uiBaseUrl}/${orgAlias}/billing`,
     handoffUrl: async (provider) => {
       const orgs = await listOrgs({ apiKey: p.apiKey, apiBaseUrl: p.apiBaseUrl });
       const org = orgs.length === 1 ? orgs[0] : orgs.find((o) => o.alias === p.orgScope?.alias || o.org_id === p.orgScope?.id);
       return `${p.uiBaseUrl}/${org?.alias ?? "<org>"}/monitoring/scale/create/${provider}`;
     },
-    sleep: (ms) => new Promise((r) => setTimeout(r, ms))
+    sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+    now: () => Date.now()
   };
 }
 
@@ -34995,6 +35275,8 @@ async function handleToolCall(req, rootOpts, extra) {
       const result = await connect(url, {
         provider: args.provider ? String(args.provider) : undefined,
         clickhouseKey: args.clickhouse_key ? String(args.clickhouse_key) : undefined,
+        coupon: args.coupon === undefined || args.coupon === null ? undefined : String(args.coupon),
+        yes: args.yes === true,
         waitMs: 0,
         agent: true
       }, {
@@ -35003,6 +35285,7 @@ async function handleToolCall(req, rootOpts, extra) {
           throw new Error("A self-hosted stack is set up from the CLI: pgai connect <url> --self-hosted");
         },
         localStackRunning: () => false,
+        confirm: async () => false,
         progress: () => {}
       });
       return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }], isError: result.status === "failed" };
@@ -35568,7 +35851,7 @@ async function startMcpServer(rootOpts, extra) {
         },
         {
           name: "connect_database",
-          description: "Put a Postgres database under PostgresAI Cloud monitoring (same as `pgai connect`): prepares the monitoring role (an admin URL creates it; otherwise returns the SQL), provisions the monitoring box, and returns JSON with status (connected | provisioning | disconnecting | action_required | failed), dashboard_url and next (the exact next action). It does not wait for the box: call it again to see the status. Safe to call again. ClickHouse Managed Postgres, RDS and Supabase are detected from the host. The URL must carry its password, and only these query parameters: sslmode, channel_binding, application_name. PGAI_MON_PASSWORD, PGPASSWORD and CLICKHOUSE_KEY_ID + CLICKHOUSE_KEY_SECRET of the server process are not used (pass clickhouse_key), and a TLS failure is not retried in plaintext (say sslmode=disable for a server without TLS).",
+          description: "Put a Postgres database under PostgresAI Cloud monitoring (same as `pgai connect`): prepares the monitoring role (an admin URL creates it; otherwise returns the SQL), provisions the monitoring box, and returns JSON with status (connected | provisioning | disconnecting | action_required | failed), dashboard_url and next (the exact next action). A billed box is provisioned only with yes: true: without it the result is action_required with the price (and requires_payment_method), so show the price to the user first. It does not wait for the box: call it again to see the status. Safe to call again. ClickHouse Managed Postgres, RDS and Supabase are detected from the host. The URL must carry its password, and only these query parameters: sslmode, channel_binding, application_name. PGAI_MON_PASSWORD, PGPASSWORD and CLICKHOUSE_KEY_ID + CLICKHOUSE_KEY_SECRET of the server process are not used (pass clickhouse_key), and a TLS failure is not retried in plaintext (say sslmode=disable for a server without TLS). For another database on a server PostgresAI already monitors for the org, an admin URL with sslmode=require (or verify-*), each query parameter once, is enough: PostgresAI fills in the password of postgres_ai_mon it keeps, over TLS only (on a server without TLS, pass the postgres_ai_mon URL; if nobody has its password, the user runs in a terminal: pgai disconnect the server's other databases, then pgai connect <admin-url> --reset-password with PGAI_MON_PASSWORD set to a new one, then connects them again with it).",
           inputSchema: {
             type: "object",
             properties: {
@@ -35576,6 +35859,8 @@ async function startMcpServer(rootOpts, extra) {
               database_url: { type: "string", description: "postgresql:// URL with the password in it (admin, or the postgres_ai_mon role)" },
               provider: { type: "string", description: "clickhouse | rds | supabase | self-managed (default: detected from the host)" },
               clickhouse_key: { type: "string", description: "ClickHouse Cloud API key as <key-id>:<key-secret> (Basic Service API Reader), for CPU, memory and disk" },
+              yes: { type: "boolean", description: "Accept the price of a billed box. Without it, a billed box is not provisioned: the result has status action_required and the price; ask the user, then call again with yes: true" },
+              coupon: { type: "string", description: "Stripe promotion code for the organization's monitoring subscription (applies when it is first created)" },
               debug: { type: "boolean", description: "Enable verbose debug logs" }
             },
             required: ["database_url"],
@@ -36478,6 +36763,25 @@ function renderMarkdownForTerminal(md) {
 }
 
 // lib/connect.ts
+var money2 = (cents, currency) => currency.toLowerCase() === "usd" ? `$${(cents / 100).toFixed(2)}` : `${(cents / 100).toFixed(2)} ${currency.toUpperCase()}`;
+function priceText2(q) {
+  if (!q.billed && q.same_cluster)
+    return `included: same database cluster as ${q.same_cluster}, no extra charge`;
+  if (!q.billed)
+    return q.free_slots.total ? `free (${q.free_slots.remaining} of ${q.free_slots.total} free slots)` : "free";
+  const { amount, currency, interval } = q.price;
+  const base = `${money2(amount, currency)}/${interval} per database cluster (${q.plan} plan)${q.subscription ? `, cluster ${q.quantity + 1} on the subscription` : ""}`;
+  if (q.promo?.valid && q.amount_after_promo !== undefined && q.amount_after_promo !== null) {
+    const after = `${money2(q.amount_after_promo, currency)}`;
+    const how = `with ${q.promo.code} (${q.promo.discount_description})`;
+    if (q.promo.duration === "forever")
+      return `${after}/${interval} ${how}, instead of ${base}`;
+    if (q.promo.duration === "repeating")
+      return `${after}/${interval} for ${q.promo.duration_in_months} months ${how}, then ${base}`;
+    return `${after} the first ${interval} ${how}, then ${base}`;
+  }
+  return base;
+}
 var FIRST_CHECKUP_DELAY_MS2 = 30 * 60000;
 var POLL_MS2 = 15000;
 var PROVIDERS2 = ["clickhouse", "rds", "supabase", "self-managed"];
@@ -36533,8 +36837,12 @@ function stateOf2(raw) {
 
 class ClickhouseKeyError2 extends Error {
 }
-var serverOf2 = (name) => name.split("/")[0];
-var errorText2 = (err) => err instanceof Error ? err.message : String(err);
+var serverOf2 = (name) => name.split("/")[0].toLowerCase().replace(/\.(?=$|:)/, "");
+function clusterOf2(url) {
+  const u = parseUrl2(url);
+  return u?.hostname ? `${u.hostname.toLowerCase()}:${u.port || "5432"}` : undefined;
+}
+var errorText2 = (err) => err instanceof AggregateError && !err.message ? err.errors.map(errorText2).join("; ") : err instanceof Error ? err.message : String(err);
 var urlPassword2 = (u) => decodeURIComponent(u.password) || u.searchParams.get("password") || "";
 var URL_PARAMS_KEPT2 = ["sslmode", "channel_binding", "application_name"];
 var URL_PARAMS_TLS2 = ["sslrootcert", "sslcert", "sslkey", "uselibpqcompat"];
@@ -36549,6 +36857,22 @@ function checkUrlParams2(url, agent) {
   if (moved.length)
     throw new Error(`The URL's query string sets ${moved.join(" and ")}: put the host and the port in the URL itself (postgresql://user:password@host:5432/dbname), so that the server prepared is the server monitored`);
 }
+function storedPasswordNeeds2(monitoringUrl) {
+  const query = new URL(monitoringUrl).search.replace(/^\?/, "");
+  const parts = query ? query.split("&") : [];
+  const keys = parts.map((p) => p.split("=")[0]);
+  const twice = URL_PARAMS_KEPT2.filter((k) => keys.indexOf(k) !== keys.lastIndexOf(k));
+  const tls = !twice.includes("sslmode") && parts.some((p) => /^sslmode=(require|verify-ca|verify-full)$/.test(p));
+  const needs = [
+    ...tls ? [] : [`sslmode=require (or verify-full)${twice.includes("sslmode") ? ", once" : ""}`],
+    ...twice.filter((k) => k !== "sslmode").map((k) => `${k} once`),
+    ...parts.some((p) => !p) ? ["no stray &"] : [],
+    ...keys.some((k) => k && !URL_PARAMS_KEPT2.includes(k)) ? ["the parameter names without %-escapes"] : []
+  ];
+  return needs.length ? needs.join(" and ") : undefined;
+}
+var shellWord2 = (s) => /^[\w./:@%+=,-]+$/.test(s) ? s : `'${s.replace(/'/g, "'\\''")}'`;
+var disconnectEach2 = (names) => names.map((n) => `pgai disconnect ${shellWord2(n)} --yes`).join(" and ");
 function roleUrlFor2(url, db, password, kept) {
   const u = new URL(url);
   u.username = DEFAULT_MONITORING_USER;
@@ -36557,6 +36881,7 @@ function roleUrlFor2(url, db, password, kept) {
   for (const name of [...u.searchParams.keys()])
     if (!kept.includes(name))
       u.searchParams.delete(name);
+  u.search = u.search.replace(/@/g, "%40");
   return u.toString();
 }
 var monitoringUrlFor2 = (url, db, password) => roleUrlFor2(url, db, password, URL_PARAMS_KEPT2);
@@ -36596,15 +36921,49 @@ function checkupLines2(c) {
     return [`Express checkup could not run: ${c.error}`];
   const warnings = c.findings.filter((f) => f.status === "warning");
   const ok = c.findings.filter((f) => f.status === "ok");
+  const failed = c.failed ?? [];
+  const counts = [`${warnings.length} warning${warnings.length === 1 ? "" : "s"}`, `${ok.length} ok`, `${c.info.length} info`, ...failed.length ? [`${failed.length} could not run`] : []];
   return [
-    `Express checkup while the box starts (${c.checks} checks: ${warnings.length} warning${warnings.length === 1 ? "" : "s"}, ${ok.length} ok):`,
+    `Express checkup while the box starts (${c.checks} checks: ${counts.join(", ")}):`,
     ...warnings.map((f) => `  ${f.check_id} ${f.title}: ${f.message}`),
     ...ok.length ? [`  ok: ${ok.map((f) => f.check_id).join(" ")}`] : [],
-    ...c.failed?.length ? [`  could not run: ${c.failed.join(" ")}`] : [],
+    ...c.info.length ? [`  info: ${c.info.join(" ")}`] : [],
+    ...failed.length ? [`  could not run: ${failed.join(" ")}`] : [],
+    c.report_id ? `Saved as report ${c.report_id}: pgai reports files ${c.report_id}` : `Not saved to PostgresAI: ${c.upload_error}`,
     "The full checkup (query analysis and trends) follows on the box."
   ];
 }
+function progressText(e) {
+  const s = Math.round(e.elapsed_s);
+  const elapsed = s < 60 ? `${s}s` : `${Math.floor(s / 60)}m${String(s % 60).padStart(2, "0")}s`;
+  const [first, ...rest] = e.message.split(`
+`);
+  const colon = first.endsWith(":") ? ":" : "";
+  return [`${first.slice(0, first.length - colon.length)} (+${elapsed})${colon}`, ...rest].join(`
+`);
+}
+var boxState2 = (row) => row.status === "launch_requested" && row.registered_at ? "registered" : row.status ?? "starting";
+async function billingFor2(q, name, opts, deps, show) {
+  const billing = { price: priceText2(q), requires_payment_method: q.requires_payment_method };
+  if (opts.coupon) {
+    billing.coupon = q.promo?.valid ? { code: q.promo.code, valid: true, description: q.promo.discount_description } : { code: opts.coupon, valid: false, error: q.promo?.error ?? "not valid" };
+  }
+  const billingPage = { ...billing, requires_payment_method: true, next: `Add a payment method at ${q.billing_url ?? deps.billingUrl(q.org_alias)}, then re-run` };
+  const stop = (next) => ({ billing, billingPage, accepted: false, stop: { ...billing, next } });
+  if (billing.coupon && !billing.coupon.valid) {
+    return stop(`Promo code ${opts.coupon}: ${billing.coupon.error}. Nothing was changed: re-run with a valid code, or without ${opts.agent ? "coupon" : "--coupon"}`);
+  }
+  if (q.requires_payment_method)
+    return { billing, billingPage, accepted: false, stop: billingPage };
+  show(billing.price);
+  if (q.billed && !opts.yes && !await deps.confirm(`Provision ${name}? (y/N): `)) {
+    return stop(opts.agent ? `Call connect_database again with yes: true to accept ${billing.price}` : `Re-run with --yes to accept ${billing.price}`);
+  }
+  return { billing, billingPage, accepted: q.billed };
+}
 async function connect2(url, opts, deps) {
+  const started = deps.now();
+  const progress = (event, message, more = {}) => deps.progress({ event, elapsed_s: Math.round((deps.now() - started) / 1000), message, ...more });
   const provider = opts.provider ?? detectCloudProvider2(url);
   if (!PROVIDERS2.includes(provider))
     throw new Error(`--provider must be one of: ${PROVIDERS2.join(", ")}`);
@@ -36620,13 +36979,16 @@ async function connect2(url, opts, deps) {
     return { status: "action_required", provider, name, next: "--reset-password works with PostgresAI Cloud only (it checks what else monitors this server): connect without --self-hosted, or set PGAI_MON_PASSWORD" };
   }
   if (opts.selfHosted && deps.localStackRunning()) {
-    return { status: "action_required", provider, name, next: "A monitoring stack already runs on this machine: add the database with pgai mon targets add '<postgres_ai_mon URL>'" };
+    return { status: "action_required", provider, name, next: "A monitoring stack already runs on this machine: add the database with PGAI_DB_URL='<postgres_ai_mon URL>' pgai mon targets add" };
   }
   const rows = opts.selfHosted ? [] : await deps.list();
   let row = rows.find((d) => d.name === name && !disconnecting2(d.status));
   const fresh = !row;
   let note = "";
   let checkup;
+  let billing = {};
+  let billingPage;
+  let accepted = false;
   const findOrg = async () => {
     try {
       return await deps.clickhouseOrg(new URL(url).hostname, key.keyId, key.keySecret);
@@ -36655,62 +37017,154 @@ async function connect2(url, opts, deps) {
       }
       ch = found;
     }
-    if (opts.resetPassword) {
-      const others = rows.filter((d) => d.name !== name && !disconnecting2(d.status) && serverOf2(d.name) === serverOf2(name));
-      if (others.length) {
-        return { status: "action_required", provider, name, next: `A new password for ${DEFAULT_MONITORING_USER} would cut off the monitoring of ${others.map((d) => d.name).join(", ")} on this server: set PGAI_MON_PASSWORD to its password instead` };
-      }
-    }
-    deps.progress(`Preparing ${maskConnectionString(url)}`);
-    const prepared = await deps.prepare(url, provider, { resetPassword: opts.resetPassword });
-    if ("next" in prepared)
-      return { status: "action_required", provider, name, ...prepared };
-    if (prepared.note)
-      note = `; ${prepared.note}`;
-    if (opts.selfHosted) {
-      await deps.selfHosted(prepared.monitoringUrl, key && ch ? { CLICKHOUSE_ORG_ID: ch.orgId, CLICKHOUSE_KEY_ID: key.keyId, CLICKHOUSE_KEY_SECRET: key.keySecret } : {});
-      return { status: "connected", provider, name, dashboard_url: "http://localhost:3000", host_metrics: !!ch, next: `pgai mon health${note}` };
-    }
-    deps.progress(`Provisioning monitoring for ${name}`);
-    const undo = async () => {
-      if (prepared.generated)
+    const undo = async (p) => {
+      if ("generated" in p && p.generated)
         await deps.unprepare(url).catch(() => false);
     };
-    const created = await deps.create({
-      db_url: prepared.monitoringUrl,
-      ...provider === "clickhouse" ? { provider } : {},
-      ...key && ch ? { clickhouse_org_id: ch.orgId, clickhouse_key_id: key.keyId, clickhouse_key_secret: key.keySecret } : {}
-    }).catch(async (err) => {
-      if (err instanceof HttpStatusError && err.status >= 400 && err.status < 500)
-        await undo();
-      throw err;
-    });
-    if (created.status === "failed") {
-      await undo();
-      return { status: "failed", provider, name, id: created.id, next: `${created.error} Re-run pgai connect later.` };
+    let lockId;
+    const unread = (d) => /^Monitoring [0-9a-f]{6}$/.test(d.name);
+    const othersOnServer = (list) => list.filter((d) => d.name !== name && !disconnecting2(d.status) && (unread(d) || serverOf2(d.name) === serverOf2(name)));
+    const storedPassword = rows.some((d) => d.monitoring_password_stored && !/delet/.test(d.status ?? "") && serverOf2(d.name) === serverOf2(name)) || undefined;
+    const cutOff = (others) => {
+      const on = others.filter((d) => !unread(d)).map((d) => d.name).join(", ");
+      const maybe = others.filter(unread).map((d) => d.name).join(", ");
+      const what = [on && `would cut off the monitoring of ${on} on this server`, maybe && `may cut off the monitoring of ${maybe} (the platform could not read its URL, so its server is not known)`].filter(Boolean).join(", and ");
+      const instead = [
+        ...storedPassword ? ["connect without --reset-password (PostgresAI keeps its password for this server, and sends it only over TLS)"] : [],
+        "set PGAI_MON_PASSWORD to its password instead",
+        `${disconnectEach2(others.map((d) => d.name))} first`
+      ];
+      return { status: "action_required", provider, name, next: `A new password for ${DEFAULT_MONITORING_USER} ${what}: ${instead.join(", or ")}` };
+    };
+    const others = othersOnServer(rows).filter((d) => !unread(d)).map((d) => d.name);
+    if (opts.resetPassword && othersOnServer(rows).length)
+      return cutOff(othersOnServer(rows));
+    if (opts.coupon !== undefined && !opts.coupon.trim()) {
+      return { status: "action_required", provider, name, next: `${opts.agent ? "coupon" : "--coupon"} is empty: pass a promotion code, or leave ${opts.agent ? "coupon" : "--coupon"} out` };
+    }
+    const prepOpts = { resetPassword: opts.resetPassword, ...storedPassword ? { storedPassword, others } : {} };
+    if (!opts.selfHosted) {
+      const probe = await deps.prepare(url, provider, { ...prepOpts, check: true });
+      if ("next" in probe)
+        return { status: "action_required", provider, name, ...probe };
+      const b = await billingFor2(await deps.quote(opts.coupon, clusterOf2(url)), name, opts, deps, (price) => progress("billing", `Billing: ${price}`));
+      if (b.stop)
+        return { status: "action_required", provider, name, ...b.stop };
+      ({ billing, billingPage, accepted } = b);
+    }
+    if (opts.resetPassword) {
+      let lock;
+      try {
+        lock = await deps.resetLock(serverOf2(name));
+      } catch (err) {
+        if (err instanceof HttpStatusError && err.status === 409) {
+          return { status: "action_required", provider, name, ...billing, next: `Another pgai connect --reset-password for ${serverOf2(name)} is running: wait for it to finish, then re-run (a run that stopped frees the server 15 minutes after it started)` };
+        }
+        if (err instanceof HttpStatusError && err.status === 404) {
+          return { status: "action_required", provider, name, ...billing, next: `This platform cannot lock the server for --reset-password yet: set PGAI_MON_PASSWORD to ${DEFAULT_MONITORING_USER}'s password instead` };
+        }
+        throw err;
+      }
+      if (typeof lock.lock_id !== "string" || !lock.lock_id)
+        throw new Error("cloud_monitoring_reset_lock returned no lock_id: nothing was changed");
+      lockId = lock.lock_id;
+    }
+    let prepared;
+    let created;
+    let unanswered = false;
+    try {
+      if (lockId) {
+        const now = await deps.list();
+        const same = now.find((d) => d.name === name && !disconnecting2(d.status));
+        if (same)
+          return { status: "action_required", provider, name, id: same.id, ...billing, next: `${name} is already connected, and its monitoring uses the current password: pgai disconnect ${name} --yes first` };
+        const others = othersOnServer(now);
+        if (others.length)
+          return { ...cutOff(others), ...billing };
+      }
+      progress("preparing", `Preparing ${maskConnectionString(url)}`);
+      prepared = await deps.prepare(url, provider, prepOpts);
+      if ("next" in prepared)
+        return { status: "action_required", provider, name, ...billing, ...prepared };
+      if (!("monitoringUrl" in prepared))
+        throw new Error("prepare returned no monitoring URL");
+      if (prepared.note)
+        note = `; ${prepared.note}`;
+      if (opts.selfHosted) {
+        await deps.selfHosted(prepared.monitoringUrl, key && ch ? { CLICKHOUSE_ORG_ID: ch.orgId, CLICKHOUSE_KEY_ID: key.keyId, CLICKHOUSE_KEY_SECRET: key.keySecret } : {});
+        return { status: "connected", provider, name, dashboard_url: "http://localhost:3000", host_metrics: !!ch, next: `pgai mon health${note}` };
+      }
+      progress("provisioning", `Provisioning monitoring for ${name}`);
+      created = await deps.create({
+        db_url: prepared.monitoringUrl,
+        ...provider === "clickhouse" ? { provider } : {},
+        ...key && ch ? { clickhouse_org_id: ch.orgId, clickhouse_key_id: key.keyId, clickhouse_key_secret: key.keySecret } : {},
+        ...opts.coupon ? { promo_code: opts.coupon } : {},
+        ...accepted ? { accept_price: true } : {}
+      }).catch(async (err) => {
+        if (err instanceof HttpStatusError && err.status >= 400 && err.status < 500)
+          await undo(prepared);
+        else
+          unanswered = true;
+        if (err instanceof HttpStatusError && err.status === 402)
+          return /declined/i.test(err.message) ? "declined" : "payment";
+        if (err instanceof HttpStatusError && err.status === 412)
+          return "price";
+        if (err instanceof HttpStatusError && err.status === 409 && "storedPassword" in prepared && prepared.storedPassword && /none is stored/.test(err.message))
+          return "stored";
+        throw err;
+      });
+      if (created === "payment")
+        return { status: "action_required", provider, name, ...billingPage };
+      if (created === "declined") {
+        return { status: "action_required", provider, name, ...billingPage, next: billingPage.next.replace(/^Add a payment method at /, "The payment method on file was declined: update it at ") };
+      }
+      if (created === "price")
+        return { status: "action_required", provider, name, ...billing, next: "The price changed since it was shown: re-run pgai connect to see it" };
+      if (created === "stored") {
+        const gone = `PostgresAI no longer keeps the password of ${DEFAULT_MONITORING_USER} for this server`;
+        return { status: "action_required", provider, name, ...billing, next: opts.agent ? `${gone}: pass its URL as database_url, or run pgai connect <admin-url> --reset-password in a terminal` : `${gone}: re-run with --reset-password (anything else that logs in as ${DEFAULT_MONITORING_USER} then needs the new one), or set PGAI_MON_PASSWORD to its password` };
+      }
+      if (created.status === "failed") {
+        await undo(prepared);
+        return { status: "failed", provider, name, id: created.id, next: `${created.error} Re-run pgai connect later.` };
+      }
+    } finally {
+      if (lockId && !unanswered)
+        await deps.resetUnlock(lockId).catch(() => {});
     }
     row = { id: created.id, name: created.name, provider, status: created.status, dashboard_url: null, host_metrics: !!ch };
-    checkup = await deps.checkup(withLocalTls2(prepared.monitoringUrl, url)).catch((err) => ({ error: errorText2(err) }));
-    for (const line of checkupLines2(checkup))
-      deps.progress(line);
+    if (prepared.storedPassword) {
+      progress("checkup", `Express checkup skipped: it runs only as ${DEFAULT_MONITORING_USER}, whose password PostgresAI keeps for this server. The full checkup follows on the box.`);
+    } else {
+      checkup = await deps.checkup(withLocalTls2(prepared.monitoringUrl, url), created.name).catch((err) => ({ error: errorText2(err) }));
+      progress("checkup", checkupLines2(checkup).join(`
+`), { checkup });
+    }
   }
-  for (const deadline = Date.now() + opts.waitMs;; ) {
+  let shown;
+  for (const deadline = deps.now() + opts.waitMs;; ) {
     const result = connectStatus2(row, provider, fresh);
-    if (result.status !== "provisioning" || Date.now() >= deadline) {
+    const state = boxState2(row);
+    if (state !== shown && (shown !== undefined || result.status === "provisioning"))
+      progress("box", `Monitoring box: ${state}`, { state });
+    shown = state;
+    if (result.status !== "provisioning" || deps.now() >= deadline) {
       if (result.status === "connected" && provider === "clickhouse" && !row.host_metrics) {
         result.next += "; for CPU, memory and disk, disconnect and reconnect with --clickhouse-key <key-id>:<key-secret>";
       }
       const { next, ...rest } = result;
-      return { ...rest, ...checkup ? { checkup } : {}, next: next + note };
+      return { ...rest, ...billing, ...checkup ? { checkup } : {}, next: next + note };
     }
-    deps.progress(`Waiting for the monitoring box (${row.status ?? "starting"})`);
     await deps.sleep(POLL_MS2);
     row = (await deps.list().catch(() => [])).find((d) => d.id === row.id) ?? row;
   }
 }
-function openConnection2(url, opts) {
+async function openConnection2(url, opts) {
   const conn = resolveAdminConnection({ conn: url });
-  return connectWithSslFallback(opts.Client ?? Client2, opts.agent ? { ...conn, sslFallbackEnabled: false } : conn);
+  const fallback = !opts.agent && !!conn.sslFallbackEnabled;
+  const { client, usedSsl } = await connectWithSslFallback(opts.Client ?? Client2, { ...conn, sslFallbackEnabled: fallback });
+  return { client, usedSsl, refusedTls: fallback && !usedSsl };
 }
 async function dropMonitoringRole2(client) {
   for (const sql of [`drop role ${DEFAULT_MONITORING_USER}`, `drop owned by ${DEFAULT_MONITORING_USER}; drop role ${DEFAULT_MONITORING_USER}`]) {
@@ -36743,7 +37197,7 @@ async function prepareDatabase2(url, provider, opts = {}) {
       throw err;
     }
   };
-  const { client } = await open(url).catch((err) => {
+  const { client, usedSsl, refusedTls } = await open(url).catch((err) => {
     if (/client password must be a string/.test(String(err?.message)))
       throw new Error("The URL has no password (and PGPASSWORD is not set): pgai connect postgresql://user:password@host:5432/dbname");
     throw err;
@@ -36757,7 +37211,7 @@ async function prepareDatabase2(url, provider, opts = {}) {
            and has_database_privilege(current_user, current_database(), 'CREATE')
            and exists (select 1 from pg_extension where extname = 'pg_stat_statements')) as admin,
          exists (select 1 from pg_roles where rolname = '${DEFAULT_MONITORING_USER}') as mon_exists,
-         current_setting('scram_iterations', true) as iterations
+         current_setting('scram_iterations', true) as iterations, current_setting('ssl') as ssl
        from pg_roles where rolname = current_user`)).rows[0];
     const notes = [caNote2(url)].filter((n) => !!n);
     const noted = () => notes.length ? { note: notes.join("; ") } : {};
@@ -36781,9 +37235,31 @@ async function prepareDatabase2(url, provider, opts = {}) {
       }
     } else if (me.admin && pgProvider !== "supabase") {
       const exists = `${DEFAULT_MONITORING_USER} already exists on this server`;
+      const setPassword = `Set PGAI_MON_PASSWORD to the password of ${DEFAULT_MONITORING_USER}, or give it a new one: pgai connect <admin-url> --reset-password (anything else that logs in as ${DEFAULT_MONITORING_USER} then needs the new password)`;
+      const needs = storedPasswordNeeds2(monitoringUrlFor2(url, me.db, ""));
+      const noTls = refusedTls || !usedSsl && me.ssl === "off";
+      const tlsOnly = `PostgresAI sends the password it keeps for ${DEFAULT_MONITORING_USER} only over TLS`;
+      const others = opts.others?.length ? opts.others : undefined;
+      const disconnectOthers = others ? disconnectEach2(others) : "pgai disconnect the server's other databases (pgai databases)";
+      const reconnectOthers = `(and connect ${others ? others.join(", ") : "them"} again with it)`;
+      const noTlsWayOut = opts.agent ? `Pass its URL as database_url, or run pgai connect in a terminal with PGAI_MON_PASSWORD set to its password. If nobody has it, in a terminal: ${disconnectOthers}, then pgai connect <admin-url> --reset-password with PGAI_MON_PASSWORD set to a new one ${reconnectOthers}` : `Set PGAI_MON_PASSWORD to its password, or turn on TLS on the server (ssl = on) and put sslmode=require in the URL. If nobody has the password: ${disconnectOthers}, then re-run with --reset-password and PGAI_MON_PASSWORD set to a new one ${reconnectOthers}`;
+      const reuse = me.mon_exists && !opts.resetPassword && !!opts.storedPassword && !(opts.agent ? "" : process.env.PGAI_MON_PASSWORD?.trim());
+      if (reuse && needs) {
+        if (noTls)
+          return { next: `${exists}, but this server takes no TLS, and ${tlsOnly}. ${noTlsWayOut}` };
+        return { next: `${exists}. ${opts.agent ? "database_url" : "The URL"} needs ${needs}: the password PostgresAI keeps for this server is sent only over TLS, to a URL with each parameter once` };
+      }
+      if (reuse) {
+        if (opts.check)
+          return { checked: true };
+        const { password: unused } = await resolveMonitoringPassword({ monitoringUser: DEFAULT_MONITORING_USER });
+        const plan = await buildInitPlan({ database: me.db, monitoringPassword: unused, iterations: Number(me.iterations), includeOptionalPermissions: true, provider: pgProvider, keepExistingPassword: true });
+        await applyInitPlan({ client, plan });
+        return { monitoringUrl: monitoringUrlFor2(url, me.db, ""), storedPassword: true, ...noted() };
+      }
       if (me.mon_exists && opts.agent)
         return { next: `${exists}. Pass its URL as database_url, or run pgai connect in a terminal with PGAI_MON_PASSWORD set to its password` };
-      const setPassword = `Set PGAI_MON_PASSWORD to the password of ${DEFAULT_MONITORING_USER}, or give it a new one: pgai connect <admin-url> --reset-password (anything else that logs in as ${DEFAULT_MONITORING_USER} then needs the new password)`;
+      const unset = !opts.storedPassword ? setPassword : noTls ? `This server takes no TLS, and ${tlsOnly}. ${noTlsWayOut}` : !needs ? `Unset PGAI_MON_PASSWORD: PostgresAI keeps the password of ${DEFAULT_MONITORING_USER} for this server` : `Unset PGAI_MON_PASSWORD, and the URL needs ${needs}: PostgresAI keeps the password of ${DEFAULT_MONITORING_USER} for this server, and sends it only over TLS, to a URL with each parameter once`;
       const { password, generated } = await resolveMonitoringPassword({ passwordEnv: opts.agent ? undefined : process.env.PGAI_MON_PASSWORD, monitoringUser: DEFAULT_MONITORING_USER });
       const reset = !!opts.resetPassword && me.mon_exists;
       if (me.mon_exists && !reset) {
@@ -36793,13 +37269,16 @@ async function prepareDatabase2(url, provider, opts = {}) {
         try {
           accepted = await logsIn(loginUrlFor2(url, me.db, password));
         } catch (err) {
-          return { next: `${exists}, and PGAI_MON_PASSWORD could not be checked from this host (${err instanceof Error ? err.message : String(err)}). Run pgai connect from a host that ${DEFAULT_MONITORING_USER} may connect from` };
+          const orUnset = opts.storedPassword && !noTls ? ", or unset PGAI_MON_PASSWORD: PostgresAI keeps its password for this server" : "";
+          return { next: `${exists}, and PGAI_MON_PASSWORD could not be checked from this host (${err instanceof Error ? err.message : String(err)}). Run pgai connect from a host that ${DEFAULT_MONITORING_USER} may connect from${orUnset}` };
         }
         if (!accepted)
-          return { next: `${exists} and PGAI_MON_PASSWORD is not its password. ${setPassword}` };
+          return { next: `${exists} and PGAI_MON_PASSWORD is not its password. ${unset}` };
         if (await acceptsAnyPassword())
           notes.push(unchecked("PGAI_MON_PASSWORD"));
       }
+      if (opts.check)
+        return { checked: true };
       const monitoringUrl = monitoringUrlFor2(url, me.db, password);
       const loginUrl = loginUrlFor2(url, me.db, password);
       const plan = await buildInitPlan({ database: me.db, monitoringPassword: password, iterations: Number(me.iterations), includeOptionalPermissions: true, provider: pgProvider, keepExistingPassword: !reset });
@@ -36828,14 +37307,43 @@ ${redactPasswordsInSql(s.sql)}`).join(`
 }
 async function expressCheckup2(url, opts = {}) {
   const { client } = await openConnection2(url, opts);
+  let reports;
+  const failed = [];
   try {
-    const failed = [];
-    const reports = await generateAllReports(client, "node-01", undefined, (f) => failed.push(f.checkId));
-    const findings = Object.values(reports).map((r) => ({ check_id: r.checkId, title: r.checkTitle, status: r.summary.status, message: r.summary.message })).filter((f) => f.status !== "info").sort((a, b) => Number(b.status === "warning") - Number(a.status === "warning"));
-    return { checks: Object.keys(reports).length + failed.length, findings, ...failed.length ? { failed } : {} };
+    reports = await generateAllReports(client, "node-01", undefined, (f) => failed.push(f.checkId));
   } finally {
     await client.end();
   }
+  const all = Object.values(reports).map((r) => ({ check_id: r.checkId, title: r.checkTitle, status: r.summary.status, message: r.summary.message }));
+  const findings = all.filter((f) => f.status !== "info").sort((a, b) => Number(b.status === "warning") - Number(a.status === "warning"));
+  const result = { checks: all.length + failed.length, findings, info: all.filter((f) => f.status === "info").map((f) => f.check_id), ...failed.length ? { failed } : {} };
+  if (!opts.save)
+    return result;
+  try {
+    return { ...result, report_id: await opts.save(reports) };
+  } catch (err) {
+    return { ...result, upload_error: errorText2(err) };
+  }
+}
+async function saveCheckupReport2(rpc, accessToken, project, reports) {
+  const { reportId } = await createCheckupReport(rpc, { apiKey: accessToken, project });
+  const setStatus = (status) => rpc("checkup_report_status_update", { access_token: accessToken, report_id: reportId, status });
+  try {
+    for (const [checkId, report] of Object.entries(reports)) {
+      await uploadCheckupReportJson(rpc, {
+        apiKey: accessToken,
+        reportId,
+        filename: `${checkId}.json`,
+        checkId,
+        jsonText: JSON.stringify(report, null, 2)
+      });
+    }
+  } catch (err) {
+    await setStatus("failed").catch(() => {});
+    throw err;
+  }
+  await setStatus("completed");
+  return reportId;
 }
 async function clickhouseOrgFor2(host, keyId, keySecret) {
   const apiUrl = process.env.CLICKHOUSE_API_URL || "https://api.clickhouse.cloud";
@@ -36866,90 +37374,141 @@ async function clickhouseOrgFor2(host, keyId, keySecret) {
   }
   throw failed ?? notFound;
 }
+function disconnectBilling(reply) {
+  const r = reply ?? {};
+  if (r.billing_warning)
+    return `not released (${r.billing_warning}): contact support`;
+  if (r.billing?.subscription === "canceled")
+    return "subscription canceled: no further charges; the unused part of this period is credited (prorated)";
+  if (r.billing?.subscription === "active" && typeof r.billing.quantity === "number") {
+    return `${r.billing.quantity} ${r.billing.quantity === 1 ? "database cluster" : "database clusters"} left on the subscription`;
+  }
+  return;
+}
 function platformDeps2(p) {
   const rpc = (fn, body = {}) => callRpc({ apiKey: p.apiKey, apiBaseUrl: p.apiBaseUrl, fn, body, operation: fn.replace(/_/g, " "), debug: p.debug, orgScope: p.orgScope });
   return {
     list: () => rpc("cloud_monitoring_list"),
     create: (body) => rpc("cloud_monitoring_connect", body),
     disconnect: (id) => rpc("cloud_monitoring_disconnect", { instance_id: id }),
+    resetLock: (server) => rpc("cloud_monitoring_reset_lock", { server }),
+    resetUnlock: (lockId) => rpc("cloud_monitoring_reset_unlock", { lock_id: lockId }),
     prepare: (url, provider, o = {}) => prepareDatabase2(url, provider, { ...o, agent: p.agent }),
     unprepare: (url) => unprepareDatabase2(url, { agent: p.agent }),
     clickhouseOrg: clickhouseOrgFor2,
-    checkup: (url) => expressCheckup2(url, { agent: p.agent }),
+    checkup: (url, project) => expressCheckup2(url, { agent: p.agent, save: (reports) => saveCheckupReport2(rpc, p.apiKey, project, reports) }),
+    quote: (coupon, cluster) => rpc("cloud_monitoring_quote", { ...coupon ? { promo_code: coupon } : {}, ...cluster ? { db_server: cluster } : {} }),
+    billingUrl: (orgAlias) => `${p.uiBaseUrl}/${orgAlias}/billing`,
     handoffUrl: async (provider) => {
       const orgs = await listOrgs({ apiKey: p.apiKey, apiBaseUrl: p.apiBaseUrl });
       const org = orgs.length === 1 ? orgs[0] : orgs.find((o) => o.alias === p.orgScope?.alias || o.org_id === p.orgScope?.id);
       return `${p.uiBaseUrl}/${org?.alias ?? "<org>"}/monitoring/scale/create/${provider}`;
     },
-    sleep: (ms) => new Promise((r) => setTimeout(r, ms))
+    sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+    now: () => Date.now()
   };
 }
 
 // lib/joe.ts
 var DEFAULT_BUDGET_MS = 25000;
 var DEFAULT_POLL_INTERVAL_MS = 800;
+var JOE_ASYNC_FALLBACK_WAIT_MS2 = 10 * 60 * 1000;
+var JOE_ASYNC_MAX_WAIT_MS2 = 60 * 60 * 1000;
+var JOE_ASYNC_MAX_POLL_FAILURES = 5;
 async function callRpc2(params) {
+  return (await callRpcRaw2(params)).data;
+}
+async function callRpcRaw2(params) {
   const { apiKey, apiBaseUrl, fn, body, operation, debug } = params;
   if (!apiKey) {
     throw new Error("API key is required");
   }
   const base = normalizeBaseUrl(apiBaseUrl);
   const url = new URL(`${base}/rpc/${fn}`);
-  const payload = JSON.stringify(body);
   const headers = buildAuthHeaders(apiKey, params.orgScope);
-  if (debug) {
-    const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
-    console.error(`Debug: POST URL: ${url.toString()}`);
-    console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
-    console.error(`Debug: Request body: ${redactSecretsForLog(payload)}`);
-  }
-  let response;
-  const requestTimeout = requestTimeoutSignal(params.timeoutMs);
-  try {
-    response = await fetch(url.toString(), {
-      method: "POST",
-      headers,
-      body: payload,
-      signal: requestTimeout.signal
-    });
-  } catch (err) {
-    if (isFetchTimeout(err)) {
-      throw new HttpRequestTimeoutError(operation, requestTimeout.timeoutMs);
+  const send = async (bodyObj) => {
+    const payload = JSON.stringify(bodyObj);
+    if (debug) {
+      const debugHeaders = { ...headers, "access-token": maskSecret(apiKey) };
+      console.error(`Debug: POST URL: ${url.toString()}`);
+      console.error(`Debug: Request headers: ${JSON.stringify(debugHeaders)}`);
+      console.error(`Debug: Request body: ${redactSecretsForLog(payload)}`);
+    }
+    let response;
+    const requestTimeout = requestTimeoutSignal(params.timeoutMs);
+    try {
+      response = await fetch(url.toString(), {
+        method: "POST",
+        headers,
+        body: payload,
+        signal: requestTimeout.signal
+      });
+    } catch (err) {
+      if (isFetchTimeout(err)) {
+        throw new HttpRequestTimeoutError(operation, requestTimeout.timeoutMs);
+      }
+      throw new Error(describeFetchError(operation, base, err));
     }
-    throw new Error(describeFetchError(operation, base, err));
-  }
-  const text = await response.text();
-  if (debug) {
-    console.error(`Debug: Response status: ${response.status}`);
-    console.error(`Debug: Response body: ${redactSecretsForLog(text)}`);
+    const text = await response.text();
+    if (debug) {
+      console.error(`Debug: Response status: ${response.status}`);
+      console.error(`Debug: Response body: ${redactSecretsForLog(text)}`);
+    }
+    return { response, text };
+  };
+  let { response, text } = await send(body);
+  if (params.fallbackBody && isUnknownRpcSignature(response.status, text, fn)) {
+    ({ response, text } = await send(params.fallbackBody));
   }
   if (!response.ok) {
     throw new HttpStatusError(formatHttpError(operation, response.status, text, response.statusText), response.status);
   }
   try {
-    return JSON.parse(text);
+    return { data: JSON.parse(text), status: response.status };
   } catch {
     throw new Error(`${operation}: failed to parse response: ${redactSecretsForLog(text)}`);
   }
 }
-async function startCommand(params) {
+function joeAsyncWaitMs(handle) {
+  const expires = positiveSeconds(handle.expires_in_s);
+  return Math.min(expires ? expires * 1000 : JOE_ASYNC_FALLBACK_WAIT_MS2, JOE_ASYNC_MAX_WAIT_MS2);
+}
+function asyncHandleCommandId(reply, operation) {
+  const commandId = reply?.command_id;
+  if (typeof commandId !== "string" || !/^[0-9]+$/.test(commandId)) {
+    throw new Error(`${operation}: the platform accepted the command over the job channel but ` + `returned no command id: ${redactSecretsForLog(JSON.stringify(reply))}`);
+  }
+  return commandId;
+}
+async function startCommandDetailed(params) {
   const { apiKey, apiBaseUrl, instanceId, command, debug, timeoutMs } = params;
   if (!String(command ?? "").trim()) {
     throw new Error("command text is required");
   }
-  const commandId = await callRpc2({
+  const operation = "Failed to run Joe command";
+  const body = { instance_id: instanceId, command };
+  const { data, status } = await callRpcRaw2({
     apiKey,
     apiBaseUrl,
     fn: "joe_command_run",
-    body: { instance_id: instanceId, command },
-    operation: "Failed to run Joe command",
+    body: { ...body, accept_async: true },
+    fallbackBody: body,
+    operation,
     debug,
     timeoutMs
   });
-  if (typeof commandId !== "string" || !/^[0-9]+$/.test(commandId)) {
-    throw new Error(`Failed to run Joe command: expected a command id string, got: ${redactSecretsForLog(JSON.stringify(commandId))}`);
+  if (status === 202) {
+    const handle = data ?? {};
+    return {
+      commandId: asyncHandleCommandId(data, operation),
+      asyncWaitMs: joeAsyncWaitMs(handle),
+      firstAnswerEstimateS: positiveSeconds(handle.first_answer_estimate_s)
+    };
   }
-  return commandId;
+  if (typeof data !== "string" || !/^[0-9]+$/.test(data)) {
+    throw new Error(`${operation}: expected a command id string, got: ${redactSecretsForLog(JSON.stringify(data))}`);
+  }
+  return { commandId: data, asyncWaitMs: null, firstAnswerEstimateS: null };
 }
 async function getCommandOutput(params) {
   const { apiKey, apiBaseUrl, commandId, debug, timeoutMs } = params;
@@ -37079,18 +37638,29 @@ function buildJoeCommandText(command, input = {}) {
 var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
 async function runCommand(params) {
   const { apiKey, apiBaseUrl, instanceId, command, debug } = params;
-  const budgetMs = typeof params.budgetMs === "number" && Number.isFinite(params.budgetMs) && params.budgetMs >= 0 ? params.budgetMs : DEFAULT_BUDGET_MS;
-  const pollIntervalMs = params.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const explicitBudgetMs = typeof params.budgetMs === "number" && Number.isFinite(params.budgetMs) && params.budgetMs >= 0 ? params.budgetMs : null;
   const now = params.now ?? Date.now;
   const sleep = params.sleep ?? defaultSleep;
-  const commandId = await startCommand({ apiKey, apiBaseUrl, instanceId, command, debug });
+  const started = await startCommandDetailed({ apiKey, apiBaseUrl, instanceId, command, debug });
+  const commandId = started.commandId;
+  const budgetMs = explicitBudgetMs ?? started.asyncWaitMs ?? DEFAULT_BUDGET_MS;
+  const pollDelayMs = (attempt) => params.pollIntervalMs ?? (started.asyncWaitMs === null ? DEFAULT_POLL_INTERVAL_MS : asyncPollDelayMs(attempt));
   const deadline = now() + budgetMs;
   let status = "pending";
   const remainingRequestMs = () => Math.max(1, Math.min(DEFAULT_HTTP_REQUEST_TIMEOUT_MS, deadline - now()));
   if (now() >= deadline) {
-    return { commandId, status, output: null, budgetExpired: true };
+    return { commandId, status, output: null, budgetExpired: true, budgetMs };
   }
-  for (;; ) {
+  let announced = false;
+  const announce = () => {
+    if (announced || started.asyncWaitMs === null)
+      return;
+    announced = true;
+    const estimate = started.firstAnswerEstimateS;
+    console.error(`Queued on the Joe job channel (command ${commandId}` + (estimate ? `, reaches Joe in about ${estimate}s` : "") + `); waiting up to ${Math.round(budgetMs / 1000)}s...`);
+  };
+  let transientFailures = 0;
+  for (let attempt = 0;; attempt++) {
     let output;
     try {
       output = await getCommandOutput({
@@ -37102,25 +37672,28 @@ async function runCommand(params) {
       });
     } catch (err) {
       if (err instanceof HttpRequestTimeoutError) {
-        return { commandId, status, output: null, budgetExpired: true };
+        return { commandId, status, output: null, budgetExpired: true, budgetMs };
       }
       if (err instanceof HttpStatusError && isRetryableHttpStatus(err.status)) {
-        if (now() >= deadline) {
-          return { commandId, status, output: null, budgetExpired: true };
+        transientFailures += 1;
+        if (now() >= deadline || started.asyncWaitMs !== null && transientFailures >= JOE_ASYNC_MAX_POLL_FAILURES) {
+          return { commandId, status, output: null, budgetExpired: true, budgetMs };
         }
-        await sleep(pollIntervalMs);
+        await sleep(pollDelayMs(attempt));
         continue;
       }
       throw err;
     }
+    transientFailures = 0;
     status = output.status;
     if (status === "ok" || status === "error") {
-      return { commandId, status, output, budgetExpired: false };
+      return { commandId, status, output, budgetExpired: false, budgetMs };
     }
     if (now() >= deadline) {
-      return { commandId, status, output: null, budgetExpired: true };
+      return { commandId, status, output: null, budgetExpired: true, budgetMs };
     }
-    await sleep(pollIntervalMs);
+    announce();
+    await sleep(pollDelayMs(attempt));
   }
 }
 async function executeJoeCommand(params) {
@@ -37305,22 +37878,6 @@ async function postDblabRpc(rpc, bodyObj, params) {
   }
   return { response, text };
 }
-function isUnknownRpcSignature(status, text, rpc) {
-  if (status !== 404)
-    return false;
-  try {
-    const parsed = JSON.parse(text);
-    return typeof parsed.message === "string" && /Could not find the .* function/.test(parsed.message) && parsed.message.includes(`${rpc}(`);
-  } catch {
-    return false;
-  }
-}
-function positiveSeconds(v) {
-  return typeof v === "number" && Number.isFinite(v) && v > 0 ? v : null;
-}
-function dblabPollDelay(attempt) {
-  return Math.min(1000 * 2 ** attempt, 15000);
-}
 var DBLAB_ASYNC_FALLBACK_WAIT_MS = 15 * 60 * 1000;
 var DBLAB_ASYNC_MAX_WAIT_MS = 60 * 60 * 1000;
 var DBLAB_POLL_MAX_CONSECUTIVE_FAILURES = 5;
@@ -37407,7 +37964,7 @@ async function awaitDblabCall(handle, params) {
       announced = true;
       console.error(`Waiting for the DBLab instance to pick up the call (job ${jobId}` + (estimate ? `, typically ~${estimate}s` : "") + ")...");
     }
-    const delay = dblabPollDelay(attempt);
+    const delay = asyncPollDelayMs(attempt);
     if (now() + delay >= deadline) {
       throw new Error(`${operation}: timed out waiting for the DBLab instance (job ${jobId}, last status ${lastStatus}). ` + dblabNotResentAdvice(jobId));
     }
@@ -40129,7 +40686,7 @@ function feedbackMessage() {
 }
 
 // bin/postgres-ai.ts
-import { createInterface } from "readline";
+import { createInterface as createInterface2 } from "readline";
 import { Writable } from "stream";
 import * as childProcess from "child_process";
 
@@ -42722,48 +43279,11 @@ async function verifyApiKey(params) {
     clearTimeout(timer);
   }
 }
-async function createCheckupReport(params) {
-  const { apiKey, apiBaseUrl, project, status } = params;
-  const bodyObj = {
-    access_token: apiKey,
-    project
-  };
-  if (status)
-    bodyObj.status = status;
-  const resp = await postRpc({
-    apiKey,
-    apiBaseUrl,
-    rpcName: "checkup_report_create",
-    bodyObj
-  });
-  const reportId = Number(resp?.report_id);
-  if (!Number.isFinite(reportId) || reportId <= 0) {
-    throw new Error(`Unexpected checkup_report_create response: ${JSON.stringify(resp)}`);
-  }
-  return { reportId };
+async function createCheckupReport2(params) {
+  return createCheckupReport((rpcName, bodyObj) => postRpc({ ...params, rpcName, bodyObj }), params);
 }
-async function uploadCheckupReportJson(params) {
-  const { apiKey, apiBaseUrl, reportId, filename, checkId, jsonText } = params;
-  const bodyObj = {
-    access_token: apiKey,
-    checkup_report_id: reportId,
-    filename,
-    check_id: checkId,
-    data: jsonText,
-    type: "json",
-    generate_issue: true
-  };
-  const resp = await postRpc({
-    apiKey,
-    apiBaseUrl,
-    rpcName: "checkup_report_file_post",
-    bodyObj
-  });
-  const chunkId = Number(resp?.report_chunck_id ?? resp?.report_chunk_id);
-  if (!Number.isFinite(chunkId) || chunkId <= 0) {
-    throw new Error(`Unexpected checkup_report_file_post response: ${JSON.stringify(resp)}`);
-  }
-  return { reportChunkId: chunkId };
+async function uploadCheckupReportJson2(params) {
+  return uploadCheckupReportJson((rpcName, bodyObj) => postRpc({ ...params, rpcName, bodyObj }), params);
 }
 async function convertCheckupReportJsonToMarkdown(params) {
   const { apiKey, apiBaseUrl, checkId, jsonPayload, reportType } = params;
@@ -42998,7 +43518,8 @@ function summarizeF0012(nodeData) {
       return `Autovacuum config: ${parts.join(", ")} finding${fired.length > 1 ? "s" : ""}`;
     };
     if (severity === "CRITICAL" || severity === "WARNING") {
-      return { status: "warning", message: summarize() };
+      const top = fired.find((r) => r.severity === "CRITICAL") ?? fired.find((r) => r.severity === "WARNING");
+      return { status: "warning", message: top?.conclusion ? `${summarize()}. ${top.conclusion}` : summarize() };
     }
     return { status: "info", message: summarize() };
   }
@@ -43155,6 +43676,48 @@ function summarizeG0032(nodeData) {
   };
 }
 
+// lib/json-stderr.ts
+import { spawn, spawnSync } from "node:child_process";
+import { createInterface } from "node:readline";
+import { format } from "node:util";
+function writeEvent(event) {
+  process.stderr.write(`${JSON.stringify(event)}
+`);
+}
+function jsonConsole() {
+  const { error, warn } = console;
+  const log = (level) => (...args) => {
+    const message = format(...args);
+    writeEvent({ event: "log", level: /^\s*Debug:/.test(message) ? "debug" : /^\s*(?:\[[^\]]+\]\s*)?Warning:/.test(message) ? "warn" : level, message });
+  };
+  console.error = log("error");
+  console.warn = log("warn");
+  return () => {
+    console.error = error;
+    console.warn = warn;
+  };
+}
+var LOGIN = /^(\s*(?:Login|VictoriaMetrics Auth): ).+$/;
+function runChild(command, args, env, json, source) {
+  if (!json)
+    return Promise.resolve(spawnSync(command, args, { stdio: ["ignore", 2, 2], env }).status);
+  return new Promise((resolve) => {
+    const child = spawn(command, args, { stdio: ["ignore", "pipe", "pipe"], env });
+    for (const [stream, level] of [[child.stdout, "info"], [child.stderr, "error"]]) {
+      createInterface({ input: stream }).on("line", (line) => {
+        const message = line.replace(LOGIN, "$1***** (pgai mon show-grafana-credentials)");
+        if (line.trim() !== "")
+          writeEvent({ event: "log", level, source, message });
+      });
+    }
+    child.on("error", (err) => {
+      writeEvent({ event: "log", level: "error", source, message: err.message });
+      resolve(null);
+    });
+    child.on("close", (code) => resolve(code));
+  });
+}
+
 // lib/instances.ts
 import * as fs10 from "fs";
 class InstancesParseError2 extends Error {
@@ -43300,12 +43863,22 @@ function buildClientConfig(connStr, extra = {}) {
     port: parsed.port ? Number(parsed.port) : undefined,
     user: parsed.user,
     password: parsed.password,
-    database: parsed.database || undefined,
+    database: databaseName3(withoutSslmode(channelBinding.uri), parsed.database),
     ssl: sslOptionFromSslmode(sslmode),
     ...enableChannelBinding ? { enableChannelBinding: true } : {},
     ...extra
   };
 }
+function databaseName3(connStr, parsed) {
+  if (!parsed)
+    return;
+  try {
+    const u = new URL(connStr);
+    if (/^postgres(ql)?:$/.test(u.protocol))
+      return decodeURIComponent(u.pathname.slice(1));
+  } catch {}
+  return parsed;
+}
 function withoutSslmode(connStr) {
   try {
     const u = new URL(connStr);
@@ -43349,7 +43922,7 @@ Download: https://nodejs.org/`);
 var rl = null;
 function getReadline() {
   if (!rl) {
-    rl = createInterface({ input: process.stdin, output: process.stdout });
+    rl = createInterface2({ input: process.stdin, output: process.stdout });
   }
   return rl;
 }
@@ -43574,7 +44147,7 @@ async function execFilePromise(file, args, options = {}) {
     });
   });
 }
-function spawnSync2(cmd, args, options) {
+function spawnSync3(cmd, args, options) {
   const result = childProcess.spawnSync(cmd, args, {
     stdio: options?.stdio === "inherit" ? "inherit" : "pipe",
     env: options?.env,
@@ -43587,7 +44160,7 @@ function spawnSync2(cmd, args, options) {
     stderr: typeof result.stderr === "string" ? result.stderr : ""
   };
 }
-function spawn2(cmd, args, options) {
+function spawn3(cmd, args, options) {
   const proc = childProcess.spawn(cmd, args, {
     stdio: options?.stdio ?? "pipe",
     env: options?.env,
@@ -43618,7 +44191,7 @@ async function question(prompt) {
 }
 async function questionHidden(prompt) {
   closeReadline();
-  const hidden = createInterface({ input: process.stdin, output: new Writable({ write: (_chunk, _encoding, done) => done() }), terminal: true });
+  const hidden = createInterface2({ input: process.stdin, output: new Writable({ write: (_chunk, _encoding, done) => done() }), terminal: true });
   process.stdout.write(prompt);
   return new Promise((resolve) => {
     hidden.question("", (answer) => {
@@ -43749,7 +44322,7 @@ function prepareUploadConfig(opts, rootOpts, shouldUpload, uploadExplicitlyReque
 }
 async function uploadCheckupReports(uploadCfg, reports, spinner, logUpload) {
   spinner.update("Creating remote checkup report");
-  const created = await withRetry(() => createCheckupReport({
+  const created = await withRetry(() => createCheckupReport2({
     apiKey: uploadCfg.apiKey,
     apiBaseUrl: uploadCfg.apiBaseUrl,
     project: uploadCfg.project
@@ -43762,7 +44335,7 @@ async function uploadCheckupReports(uploadCfg, reports, spinner, logUpload) {
   for (const [checkId, report] of Object.entries(reports)) {
     spinner.update(`Uploading ${checkId}.json`);
     const jsonText = JSON.stringify(report, null, 2);
-    const r = await withRetry(() => uploadCheckupReportJson({
+    const r = await withRetry(() => uploadCheckupReportJson2({
       apiKey: uploadCfg.apiKey,
       apiBaseUrl: uploadCfg.apiBaseUrl,
       reportId,
@@ -44009,6 +44582,56 @@ function printResult(result, json) {
 var program2 = new Command2;
 program2.name("postgres-ai").description("PostgresAI CLI").version(package_default.version).option("--api-key <key>", "API key (overrides PGAI_API_KEY)").option("--api-base-url <url>", "API base URL for backend RPC (overrides PGAI_API_BASE_URL)").option("--ui-base-url <url>", "UI base URL for browser routes (overrides PGAI_UI_BASE_URL)").option("--storage-base-url <url>", "Storage base URL for file uploads (overrides PGAI_STORAGE_BASE_URL)");
 program2.showHelpAfterError();
+program2.configureOutput({
+  outputError: (text, write) => jsonConnectArgv() ? writeEvent({ event: "log", level: "error", message: text.trim().replace(/^(error: unknown option ')(--[^=]*|-[^-])[\s\S]*'(?=\n\(Did you mean [^\n]*\)$|$)/, "$1$2'") }) : write(text),
+  writeErr: (text) => void (jsonConnectArgv() || process.stderr.write(text))
+});
+function splitArgv(options, argv) {
+  const operands = [];
+  const unknown = [];
+  let dest = operands;
+  let json = false;
+  for (let i = 0;i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--") {
+      dest.push(...dest === unknown ? argv.slice(i) : argv.slice(i + 1));
+      break;
+    }
+    const option = options.find((o) => o.long === arg || o.short === arg);
+    if (option) {
+      if (option.required)
+        i++;
+      else if (option.long === "--json")
+        json = true;
+      continue;
+    }
+    if (options.some((o) => o.required && arg.startsWith(`${o.long}=`)))
+      continue;
+    if (dest === operands && arg.length > 1 && arg.startsWith("-"))
+      dest = unknown;
+    dest.push(arg);
+  }
+  return { operands, unknown, json };
+}
+function argvRun(argv = process.argv.slice(2)) {
+  const root = splitArgv(program2.options, argv);
+  let command = program2.commands.find((c) => c.name() === root.operands[0]);
+  let rest = root.unknown;
+  if (root.operands.length === 0) {
+    const end = rest.indexOf("--");
+    const at = rest.slice(0, end < 0 ? undefined : end).indexOf("connect");
+    if (at >= 0)
+      [command, rest] = [program2.commands.find((c) => c.name() === "connect"), rest.slice(at + 1)];
+  }
+  return { command, json: !!command && splitArgv(command.options, rest).json };
+}
+function jsonConnect(command, json) {
+  return command?.parent === program2 && command.name() === "connect" && jsonOutput(json);
+}
+function jsonConnectArgv() {
+  const run = argvRun();
+  return jsonConnect(run.command, run.json);
+}
 program2.addHelpText("after", () => `
 \uD83D\uDCA1 Ideas / feedback: ${FEEDBACK_URL}
 `);
@@ -44030,6 +44653,15 @@ function withOrgOptions(command) {
   ORG_SCOPED_COMMANDS.add(command);
   return command.option("--org <alias>", `organization alias (or ${ORG_ENV}); required with a global token`).option("--org-id <id>", `organization id (or ${ORG_ID_ENV}); alternative to --org`);
 }
+var restoreConsole;
+program2.hook("preAction", (_thisCommand, actionCommand) => {
+  if (jsonConnect(actionCommand, actionCommand.opts().json))
+    restoreConsole = jsonConsole();
+});
+program2.hook("postAction", () => {
+  restoreConsole?.();
+  restoreConsole = undefined;
+});
 program2.hook("preAction", (_thisCommand, actionCommand) => {
   const initPointsToConnect = actionCommand.parent === program2 && actionCommand.name() === "init" && !interactive(actionCommand.opts().json);
   if (!ORG_SCOPED_COMMANDS.has(actionCommand) || initPointsToConnect) {
@@ -44057,7 +44689,7 @@ program2.command("feedback").description("share ideas or feedback about the CLI"
   if (opts.open) {
     const openCommand = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
     try {
-      spawn2(openCommand, [FEEDBACK_URL], { detached: true, stdio: "ignore" }).unref();
+      spawn3(openCommand, [FEEDBACK_URL], { detached: true, stdio: "ignore" }).unref();
     } catch {}
   }
 });
@@ -45342,7 +45974,7 @@ function ensureHostMetricsDir(projectDir) {
 }
 function isDockerRunning() {
   try {
-    const result = spawnSync2("docker", ["info"], { stdio: "pipe", timeout: 5000 });
+    const result = spawnSync3("docker", ["info"], { stdio: "pipe", timeout: 5000 });
     return result.status === 0;
   } catch {
     return false;
@@ -45355,7 +45987,7 @@ function shouldScaleOutNodeExporter(args) {
   return !args.slice(upIndex + 1).some((a) => !a.startsWith("-"));
 }
 function getComposeCmd() {
-  const tryCmd = (cmd, args) => spawnSync2(cmd, args, { stdio: "ignore", timeout: 5000 }).status === 0;
+  const tryCmd = (cmd, args) => spawnSync3(cmd, args, { stdio: "ignore", timeout: 5000 }).status === 0;
   if (tryCmd("docker", ["compose", "version"]))
     return ["docker", "compose"];
   if (tryCmd("docker-compose", ["version"]))
@@ -45364,7 +45996,7 @@ function getComposeCmd() {
 }
 function checkRunningContainers() {
   try {
-    const result = spawnSync2("docker", ["ps", "--filter", "name=grafana-with-datasources", "--filter", "name=pgwatch", "--format", "{{.Names}}"], { stdio: "pipe", encoding: "utf8", timeout: 5000 });
+    const result = spawnSync3("docker", ["ps", "--filter", "name=grafana-with-datasources", "--filter", "name=pgwatch", "--format", "{{.Names}}"], { stdio: "pipe", encoding: "utf8", timeout: 5000 });
     if (result.status === 0 && result.stdout) {
       const containers = result.stdout.trim().split(`
 `).filter(Boolean);
@@ -45709,7 +46341,7 @@ async function runCompose(args, grafanaPassword, extraEnv) {
     finalArgs.push("--scale", "self-node-exporter=0");
   }
   return new Promise((resolve) => {
-    const child = spawn2(cmd[0], [...cmd.slice(1), "-f", composeFile, ...finalArgs], {
+    const child = spawn3(cmd[0], [...cmd.slice(1), "-f", composeFile, ...finalArgs], {
       stdio: "inherit",
       env,
       cwd: projectDir
@@ -45899,7 +46531,7 @@ function emitConnect(result, json) {
   process.exitCode = CONNECT_EXIT[result.status];
 }
 function failCloud(err, json) {
-  printResult({ status: "failed", next: err instanceof Error ? err.message : String(err) }, json);
+  printResult({ status: "failed", next: errorText2(err) }, json);
   process.exitCode = 1;
 }
 function signedIn(opts) {
@@ -45911,6 +46543,7 @@ function signedIn(opts) {
   return !!cloudApi().apiKey;
 }
 async function runConnect(url, opts) {
+  const json = jsonOutput(opts.json);
   const name = (() => {
     try {
       return databaseName2(url);
@@ -45926,42 +46559,61 @@ async function runConnect(url, opts) {
   if (!Number.isFinite(waitMinutes) || waitMinutes < 0) {
     return emitConnect({ status: "failed", provider, name, next: "--wait must be a number of minutes (0 = do not wait)" }, opts.json);
   }
-  if (!opts.selfHosted && !signedIn(opts)) {
-    return emitConnect({ status: "action_required", provider, name, next: "Sign in: pgai auth login (agents: set PGAI_API_KEY), then re-run" }, opts.json);
-  }
-  const api = cloudApi(opts.debug);
   try {
+    if (!opts.selfHosted && !signedIn(opts)) {
+      return emitConnect({ status: "action_required", provider, name, next: "Sign in: pgai auth login (agents: set PGAI_API_KEY), then re-run" }, opts.json);
+    }
+    const api = cloudApi(opts.debug);
     const result = await connect2(url, { ...opts, waitMs: waitMinutes * 60000 }, {
       ...api,
       selfHosted: async (monitoringUrl, env) => {
         const scope = getActiveOrgScope2();
         const org = scope?.alias ? ["--org", scope.alias] : scope?.id ? ["--org-id", String(scope.id)] : [];
         const project = name.replace(/[^A-Za-z0-9._-]+/g, "-");
-        const r = childProcess.spawnSync(process.execPath, [process.argv[1], "mon", "local-install", "-y", ...org, "--project", project], {
-          stdio: ["ignore", 2, 2],
-          env: { ...process.env, ...env, PGAI_DB_URL: monitoringUrl, PGAI_API_BASE_URL: api.apiBaseUrl, ...api.apiKey ? { PGAI_API_KEY: api.apiKey } : {} }
-        });
-        if (r.status !== 0)
+        const status = await runChild(process.execPath, [process.argv[1], "mon", "local-install", "-y", ...org, "--project", project], { ...process.env, ...env, PGAI_DB_URL: monitoringUrl, PGAI_API_BASE_URL: api.apiBaseUrl, ...api.apiKey ? { PGAI_API_KEY: api.apiKey } : {} }, json, "mon local-install");
+        if (status !== 0)
           throw new Error("mon local-install failed (see above)");
       },
       localStackRunning: () => checkRunningContainers().running,
-      progress: (line) => console.error(line)
+      confirm: async (q) => {
+        if (!interactive(opts.json))
+          return false;
+        process.exitCode = 130;
+        const answer = await question(q);
+        process.exitCode = undefined;
+        closeReadline();
+        return /^(y|yes)$/i.test(answer.trim());
+      },
+      progress: (e) => json ? writeEvent(e) : console.error(progressText(e))
     });
     emitConnect(result, opts.json);
   } catch (err) {
-    emitConnect({ status: "failed", provider, name, next: err instanceof Error ? err.message : String(err) }, opts.json);
+    emitConnect({ status: "failed", provider, name, next: errorText2(err) }, opts.json);
   }
 }
-withOrgOptions(program2.command("connect <database-url>")).description("put a database under PostgresAI's care: prepare it, provision monitoring, print the dashboard").option("--provider <provider>", "clickhouse | rds | supabase | self-managed (default: detected from the host)").option("--clickhouse-key <id:secret>", "ClickHouse Cloud API key (Basic Service API Reader) for CPU, memory and disk; or CLICKHOUSE_KEY_ID + CLICKHOUSE_KEY_SECRET").option("--self-hosted", "run the monitoring stack on this machine (mon local-install) instead of PostgresAI Cloud").option("--reset-password", "postgres_ai_mon exists and its password is lost: set a new one (admin URL; refused while another database on the server is monitored)").option("--wait <minutes>", "how long to wait for the monitoring box (0 = do not wait)", "20").option("-y, --yes", "never prompt").option("--json", "JSON output (default when stdout is not a TTY)").option("--debug", "print HTTP requests (secrets masked)").addHelpText("after", [
+withOrgOptions(program2.command("connect <database-url>")).description("put a database under PostgresAI's care: prepare it, provision monitoring, print the dashboard").option("--provider <provider>", "clickhouse | rds | supabase | self-managed (default: detected from the host)").option("--clickhouse-key <id:secret>", "ClickHouse Cloud API key (Basic Service API Reader) for CPU, memory and disk; or CLICKHOUSE_KEY_ID + CLICKHOUSE_KEY_SECRET").option("--self-hosted", "run the monitoring stack on this machine (mon local-install) instead of PostgresAI Cloud").option("--reset-password", "postgres_ai_mon exists and its password is lost: set a new one (admin URL; refused while another database on the server is monitored)").option("--wait <minutes>", "how long to wait for the monitoring box (0 = do not wait)", "20").option("--coupon <code>", "promotion code for the organization's monitoring subscription (applies when it is first created)").option("-y, --yes", "never prompt: accept the price of a billed box").option("--json", "JSON output (default when stdout is not a TTY)").option("--debug", "print HTTP requests (secrets masked)").addHelpText("after", [
   "",
   "Steps (each skipped when already done; safe to re-run): sign in, prepare the database",
   "(an admin URL creates the postgres_ai_mon role; otherwise the SQL is printed), provision",
   "the monitoring box, run the express checkup while it starts, wait, print the dashboard URL.",
   "",
+  "Billing is per Postgres cluster observed: another database in a cluster the organization already",
+  'monitors is included. Once the URL is checked, connect shows the price (or "free (N of M free slots)"). A billed',
+  "box is provisioned only when accepted: at the prompt, or with --yes. With no payment method",
+  "it stops (exit 3) and names the console page to add one. --coupon applies a promotion code.",
+  "",
   'Exit codes: 0 connected or provisioning, 1 failed, 3 action required (see "next").',
   "",
+  "JSON output (--json, or stdout not a TTY): stdout is the result; stderr is one JSON event a",
+  'line: the steps, and {"event":"log","level":"error"|"warn"|"info"|"debug","message":...}',
+  'for any other text (an error, a warning, --debug); "source":"mon local-install" for that',
+  "child's lines (the logins it prints are masked: pgai mon show-grafana-credentials shows them).",
+  "",
   "Environment: PGAI_API_KEY (instead of signing in), PGAI_MON_PASSWORD (the password of",
-  "postgres_ai_mon when the role already exists; it is checked, never changed),",
+  "postgres_ai_mon when the role already exists; it is checked, never changed; not needed",
+  "for another database on a server PostgresAI already monitors for the org, with",
+  "sslmode=require or verify-* in the URL: PostgresAI fills in the password it keeps (over TLS only), and",
+  "the express checkup is skipped, as it runs only as postgres_ai_mon),",
   "PGPASSWORD (the password for a URL without one),",
   "CLICKHOUSE_KEY_ID + CLICKHOUSE_KEY_SECRET (instead of --clickhouse-key).",
   "",
@@ -45972,6 +46624,9 @@ withOrgOptions(program2.command("connect <database-url>")).description("put a da
 ].join(`
 `)).action(runConnect);
 var interactive = (json) => !!process.stdin.isTTY && !!process.stdout.isTTY && !json;
+function jsonOutput(json) {
+  return !!json || !process.stdout.isTTY;
+}
 withOrgOptions(program2.command("init")).description("first run for a person at a terminal: sign in, ask for the database URL, then pgai connect").option("--json", "JSON output (init is interactive: prints the pgai connect command to use instead)").action(async (opts) => {
   if (!interactive(opts.json)) {
     return emitConnect({ status: "action_required", provider: "self-managed", name: "", next: "pgai init is for a person at a terminal; agents and scripts: pgai connect <database-url>" }, opts.json);
@@ -46014,8 +46669,8 @@ withOrgOptions(program2.command("disconnect <name>")).description("stop monitori
     if (!opts.yes && !(process.stdin.isTTY && /^y/i.test(await question(`Disconnect ${row.name} and delete its monitoring box? (y/N): `)))) {
       return emitConnect({ status: "action_required", provider: row.provider, name: row.name, id: row.id, next: `pgai disconnect ${row.name} --yes` }, opts.json);
     }
-    await cloudApi(opts.debug).disconnect(row.id);
-    printResult({ status: "disconnected", name: row.name, id: row.id, next: row.host_metrics ? "Delete the ClickHouse Cloud API key you gave us" : "none" }, opts.json);
+    const billing = disconnectBilling(await cloudApi(opts.debug).disconnect(row.id));
+    printResult({ status: "disconnected", name: row.name, id: row.id, ...billing ? { billing } : {}, next: row.host_metrics ? "Delete the ClickHouse Cloud API key you gave us" : "none" }, opts.json);
   } catch (err) {
     failCloud(err, opts.json);
   }
@@ -46601,9 +47256,9 @@ mon.command("health").description("health check for monitoring services").option
     allHealthy = true;
     for (const service of services) {
       try {
-        const result = spawnSync2("docker", ["inspect", "-f", "{{.State.Status}}", service.container], { stdio: "pipe" });
+        const result = spawnSync3("docker", ["inspect", "-f", "{{.State.Status}}", service.container], { stdio: "pipe" });
         const present = result.status === 0;
-        const health = present && service.readHealth ? (spawnSync2("docker", ["inspect", "-f", "{{if .State.Health}}{{.State.Health.Status}}{{end}}", service.container], { stdio: "pipe" }).stdout || "").trim() : "";
+        const health = present && service.readHealth ? (spawnSync3("docker", ["inspect", "-f", "{{if .State.Health}}{{.State.Health.Status}}{{end}}", service.container], { stdio: "pipe" }).stdout || "").trim() : "";
         const verdict = judgeServiceHealth(service, present, (result.stdout || "").trim(), health);
         console.log(`${verdict.mark} ${service.name}: ${verdict.label}`);
         if (!verdict.ok)
@@ -46871,7 +47526,7 @@ async function sinkPrometheusMaybeUp() {
   } catch {
     return true;
   }
-  const ps = spawnSync2(cmd[0], [...cmd.slice(1), "-f", composeFile, "ps", "-a", "-q", "--status", "running", "--status", "paused", "sink-prometheus"]);
+  const ps = spawnSync3(cmd[0], [...cmd.slice(1), "-f", composeFile, "ps", "-a", "-q", "--status", "running", "--status", "paused", "sink-prometheus"]);
   return ps.status !== 0 || ps.stdout.trim() !== "";
 }
 async function reloadHostMetrics(projectDir, job, file) {
@@ -46906,14 +47561,36 @@ async function reloadHostMetrics(projectDir, job, file) {
   }
   return true;
 }
+var CONN_STR_FORMAT = "Invalid connection string format: use postgresql://user:password@host[:port]/database";
 function defaultTargetName(connStr) {
+  if (!/^postgres(ql)?:\/\//.test(connStr))
+    return { error: CONN_STR_FORMAT };
+  if (/[\x00-\x1f\x7f]/.test(connStr))
+    return { error: "Invalid connection string format: remove the control character (such as a CR from a CRLF file), or percent-encode it" };
+  const at = connStr.lastIndexOf("@");
+  if (at < 0)
+    return { error: CONN_STR_FORMAT };
+  if (!/^(?:[A-Za-z0-9\-._~!$&'()*+,;=:@]|%[0-9A-Fa-f]{2})*$/.test(connStr.slice(connStr.indexOf("//") + 2, at))) {
+    return { error: "Invalid connection string format: percent-encode the user name and the password (all but ASCII letters, digits, '-', '.', '_' and '~'), and an '@' in the database name or the query" };
+  }
+  let url;
   try {
-    new URL(connStr);
+    url = new URL(connStr);
   } catch {
-    return null;
-  }
-  const m = connStr.match(/^postgres(?:ql)?:\/\/[^:]+:[^@]+@([^:\/]+)(?::\d+)?\/([^?]+)/);
-  return m ? `${m[1]}-${m[2]}`.replace(/[^a-zA-Z0-9-]/g, "-") : null;
+    return { error: CONN_STR_FORMAT };
+  }
+  if (!url.username)
+    return { error: CONN_STR_FORMAT };
+  if (/%3a/i.test(url.username))
+    return { error: "Invalid connection string format: percent-encode the user name and the password one at a time, with a raw ':' between them" };
+  if (!url.password)
+    return { error: "Invalid connection string format: put the password in the URL: postgresql://user:password@host[:port]/database" };
+  if (url.hostname.includes(":"))
+    return { error: "Invalid connection string format: an IPv6 address is not supported as the host; use a host name" };
+  const db = url.pathname.slice(1);
+  if (!db)
+    return { error: CONN_STR_FORMAT };
+  return { name: `${url.hostname}-${db}`.replace(/[^a-zA-Z0-9-]/g, "-") };
 }
 function parseEnvValue(content, key) {
   const last = [...content.matchAll(new RegExp(`^[ \\t]*(?:export[ \\t]+)?${key}=(.*)$`, "gm"))].at(-1);
@@ -46958,7 +47635,7 @@ async function setRdsHostStats(projectDir, values) {
   if (!cmd)
     return true;
   const { composeFile } = await resolveOrInitPaths();
-  const ps = spawnSync2(cmd[0], [...cmd.slice(1), "-f", composeFile, "--profile", "rds", "ps", "-q", "--status", "running", "rds-host-stats"]);
+  const ps = spawnSync3(cmd[0], [...cmd.slice(1), "-f", composeFile, "--profile", "rds", "ps", "-q", "--status", "running", "rds-host-stats"]);
   if (ps.status !== 0) {
     console.error("If rds-host-stats is running, recreate it: docker compose --profile rds up -d rds-host-stats");
     return true;
@@ -47042,6 +47719,8 @@ async function syncVmalert(projectDir, apply, addOnly = false) {
     setEnvValues(projectDir, { COMPOSE_PROFILES: composeProfilesValue(current, want, "host-metrics") });
   return true;
 }
+var looksLikeConnStr = (value) => /^postgres(ql)?:\/\//i.test(value);
+var isPlainTargetName = (value) => /^[A-Za-z0-9._=-]+$/.test(value) && !/(password|pwd)\s*=/i.test(value);
 async function addTarget(file, projectDir, connStr, name, env, { apply = true } = {}) {
   if (!connStr) {
     console.error("Connection string required: postgresql://user:pass@host:port/db");
@@ -47051,15 +47730,15 @@ async function addTarget(file, projectDir, connStr, name, env, { apply = true }
   const channelBinding = splitChannelBinding2(connStr);
   connStr = channelBinding.uri;
   const defaultName = defaultTargetName(connStr);
-  if (!defaultName) {
-    console.error("Invalid connection string format");
+  if ("error" in defaultName) {
+    console.error(defaultName.error);
     process.exitCode = 1;
     return false;
   }
   if (channelBinding.value !== null) {
     console.error("Note: removed channel_binding from the connection string; the collector does not support it (TLS is kept)");
   }
-  const instanceName = name && name.trim() ? name.trim() : defaultName;
+  const instanceName = name && name.trim() ? name.trim() : defaultName.name;
   if (detectProvider(connStr) !== "clickhouse" && extractProjectRefFromUrl(connStr) && supabaseHostMetricsOn(projectDir, env) && !SUPABASE_TARGET_NAME_RE.test(instanceName)) {
     console.error(SUPABASE_TARGET_NAME_ERROR);
     process.exitCode = 1;
@@ -47140,8 +47819,43 @@ Re-running with the same name and connection string is safe; retry after fixing
 
 Supabase: with PGAI_SUPABASE_HOST_METRICS=true (environment or .env), writes host-metrics/supabase-<name>.yml.
 RDS instance endpoint: writes RDS_DB_INSTANCE_IDENTIFIER, AWS_REGION, PGAI_CLUSTER and PGAI_NODE_NAME to .env for rds-host-stats.
+
+Environment:
+  PGAI_DB_URL  the connection string, unless a postgres:// or postgresql:// URL is given
+               (keeps the password out of argv). The only argument is then the name, of
+               ASCII letters, digits, '.', '_', '=' and '-', with no password= or pwd=;
+               anything else is refused. Set it for this command only:
+                 PGAI_DB_URL='postgresql://user:pass@host:5432/db' postgres-ai mon targets add my-db
+               Under sudo, pass it on stdin: sudo logs a variable kept with --preserve-env.
+                 printf '%s\\n' "$URL" | sudo sh -c \\
+                   'IFS= read -r PGAI_DB_URL; export PGAI_DB_URL; exec postgres-ai mon targets add my-db'
+               sudo I/O logging (log_input in sudoers) records stdin: then read it from a
+               file of mode 0600 in the root shell.
+                 sudo sh -c \\
+                   'IFS= read -r PGAI_DB_URL < /path/to/db-url; export PGAI_DB_URL; exec postgres-ai mon targets add my-db'
 `).action(async (connStr, name) => {
   const { instancesFile: file, projectDir } = await resolveOrInitPaths();
+  const envUrl = process.env.PGAI_DB_URL || undefined;
+  delete process.env.PGAI_DB_URL;
+  if (envUrl && name === undefined && (connStr === undefined || !looksLikeConnStr(connStr))) {
+    const arg = connStr?.trim();
+    if (arg && !isPlainTargetName(arg)) {
+      console.error("PGAI_DB_URL is set: pass only the target name (ASCII letters, digits, '.', '_', '=', '-'; no password= or pwd=)");
+      process.exitCode = 1;
+      return;
+    }
+    name = arg;
+    connStr = envUrl;
+    let user = "";
+    if (!("error" in defaultTargetName(splitChannelBinding2(envUrl).uri))) {
+      try {
+        user = decodeURIComponent(new URL(envUrl).username);
+      } catch {
+        user = new URL(envUrl).username;
+      }
+    }
+    console.error(`Using PGAI_DB_URL${user ? ` (user ${user})` : ""}`);
+  }
   await addTarget(file, projectDir, connStr, name, process.env);
 });
 targets.command("remove <name>").description("remove monitoring target database").action(async (name) => {
@@ -47341,7 +48055,7 @@ Opening browser for authentication...`);
 ${authUrl}
 `);
     const openCommand = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-    const browserProcess = spawn2(openCommand, [authUrl], { detached: true, stdio: "ignore" });
+    const browserProcess = spawn3(openCommand, [authUrl], { detached: true, stdio: "ignore" });
     browserProcess.on("error", () => {});
     browserProcess.unref();
     console.log("Waiting for authorization...");
@@ -48541,7 +49255,7 @@ function tryParseJson(s) {
   }
 }
 function printJoeOutcome(outcome, json, budgetMs) {
-  const effectiveBudgetMs = typeof budgetMs === "number" && Number.isFinite(budgetMs) ? budgetMs : DEFAULT_BUDGET_MS;
+  const effectiveBudgetMs = Number.isFinite(outcome.budgetMs) ? outcome.budgetMs : typeof budgetMs === "number" && Number.isFinite(budgetMs) ? budgetMs : DEFAULT_BUDGET_MS;
   const budgetSeconds = Math.round(effectiveBudgetMs / 1000);
   if (outcome.budgetExpired) {
     if (json) {